HORNSAT, Model Checking, Verication and Games * (Abstract For Category A) Sandeep K. Shukla Harry B. Hunt III Daniel J.

Transcription

1 HORNSAT, Model Checking, Verication and Game * (Abtract For Category A) Sandeep K. Shukla Harry B. Hunt III Daniel J. Roenkrantz Department of Computer Science Univerity at Albany { State Univerity of New York Albany, NY fandeep,hunt,djrg@c.albany.edu Abtract We develop a methodology baed upon HORNSAT for model checking and for checking behavioral relation between nite tate procee. Thi methodology ha a number of advantage, previouly only obtained in dierent olution of ome of thee problem. For example, our methodology can be ued to generate diagnotic information [CC92] eciently. It can be ued to do model checking eciently, for variou fragment of modal mu-calculu. It i naturally local [SW91, Lar92]; and it can be made to run both on the y [VW86, CVWY92, FM91, BCG95] and incrementally [SS94]. Our reult how that previou methodologie involving ytem of Boolean equation [Lar92, And94] can be imulated by nding maximal and minimal olution of weakly poitive and weakly negative Horn formula. Since ecient algorithm for nding minimal and maximal atifying aignment for HORNSAT and it variant NHORNSAT can be eaily obtained [DG84, AI91], we ue them to develop ecient algorithm for model checking and other verication problem. We alo develop uniform game theoretic formulation of all the relation in the linear time/branching time hierarchy of [vg90]. We dene a cla of game uch that every relation in the hierarchy ha it characteritic game in thi cla. Thi cla which we call Stirling cla, include the biimulation game of [Sti93]. We alo how that our HORNSAT baed methodology implie the exitence of uch a cla of game, ince there i a natural game aociated with the kind of HORNSAT intance created uing our methodology. A a corollary, we obtain natural ucient condition on any behavioral relation, for to be polynomial time decidable for nite tate tranition ytem. Contact Author Information Name: Addre: Sandeep K. Shukla Department of Computer Science, Room LI 67A Univerity at Albany - State Univerity of New York Albany, NY andeep@c.albany.edu Telephone: (518) Fax: (518) * Thi reearch wa upported by NSF Grant CCR and CCR

2 1 Introduction 1.1 Motivation, Reult and Related Work We conider a number of problem related to the verication of nite tate ytem. Thee problem include model checking for variou logic including alternation free mu calculu and checking behavioral relation between nite tate procee. We outline a methodology, for olving thee problem, baed upon ecient reduction to the atiability problem for HORN formula. The advantage of thi methodology include the following: (i) it yield ecient olution, (ii) it yield local and on the y olution naturally, (iii) it can be ued to generate diagnotic information eciently, (iv) it can be modied eaily to yield incremental olution, and (v) data tructure and algorithm for the ecient olution of the required HORN atiability problem already exit in the literature [DG84, AI91]. (See Appendice D and E.) The deirability of (i) through (iv) for verication algorithm ha been widely dicued [VW86, BCG95, CC92, FM91, Lar88, Lar90, CVWY92, CS91, And94, SS94, SW91, Cle90]. However, the olution propoed in the literature have only ome of the advantage of (i) through (iv) and have only been applied to ome of the verication problem conidered here. Our uniform methodology combine all thee advantage in the ame olution. Our methodology i baed upon ecient reduction of the problem conidered to the minimal and maximal atiability problem, for weakly poitive and weakly negative [Sch78] Horn formula. We call thee atiability problem, minimal-hornsat and maximal-nhornsat repectively. In fact, a retricted form of thee Horn formula i enough for ome of the problem. We call thi retricted form of HORNSAT and NHORNSAT rooted (N)HORNSAT. In Section 2, we outline how our algorithm for model checking for modal mu-calculu i a implication of the one in [Lar92, And94]. (Recall that [Lar92] involve conitent and factual olution of Boolean equation ytem and [And94] involve maximal and minimal xed point of Boolean equation ytem.) We further illutrate our (N)HORNSAT baed methodology by outlining our ecient algorithm (i) to generate diagnotic information for the prebiimulation relation between nite tate ytem, and (ii) for model checking alternation free mu calculu. We dicu why our algorithm are naturally local and on the y in the ene of [VW86, Lar88, SW91, FM91, CVWY92, BCG95]; and we oberve that they can be modied eaily to run incrementally in the ene of [SS94]. Moreover, the (N)HORNSAT baed algorithm for thee problem are a ecient a the algorithm for thee problem preented in [FM91, CC92, CS91, And94, SS94, Lar88, SW91]. Conequently, it turn out that an ecient verier can be baed on an implementation whoe core conit of a olver for (N)HORNSAT which run in linear time, (we dicu uch algorithm in the appendix), which ha the option to run on the y for pace eciency, and an option to run incrementally (e.g., uing imple modication of the incremental HORNSAT algorithm given in [AI91]). The fact that ecient olution for HORNSAT and it variant are already exitent in the literature [DG84, AI91] and that many important verication problem are reducible to thoe variant of HORNSAT make the implementation of verication tool eaier. Moreover, it relieve the deigner of the verier from the obligation of reinventing complex data tructure which are already exitent in the literature on HORNSAT. Our reult how that many model checking algorithm in the literature invented complex data tructure where a exiting ecient data tructure for olving variant of HORNSAT are ucient to obtain the ame eciency. Moreover, thi lead to modular deign, becaue the ecient implementation of HORNSAT olver can be delegated to a dierent deigner. However, in [KVW95] a data tructure for a linear time algorithm of functional dependency in relational databae [Bee80] wa reued to obtain model checking algorithm for CTL. It i intereting to note that functional dependency and HORNSAT are interreducible and in [AI91, ADS83] one can nd that ame kind of data tructure are needed to olve them in linear time. 1 In [And94] the model checking problem for mu-calculu wa reduced to olving x point of Boolean equation and for eciency, complex graph baed data tructure were 1 However, (N)HORNSAT capture the eence of thee problem more directly and intuitively. Moreover, ecient data tructure for olving (N)HORNSAT are eaily implementable. Alo, HORNSAT baed method are directly implementable in PROLOG. 1

3 invented. Our reult how that the full power of boolean equation are not needed to olve thee problem. In fact, a kind of implication baed methodology embodied in (N)HORNSAT i enough. Not only from implementational point of view, but alo theoretically, our reult bring out the underlying principle of a number of verication methodology. Undertanding the dierent methodologie from an unifying framework ha been emphaized alo in [KVW95]. Latly extending a reult in [Sti93], we dene a general cla of game and how that thi cla include the characteritic game, for each of the behavioral relation in the linear time /branching time hierarchy [vg90]. We alo how that the exitence of uch a cla of characteritic game alo follow from our rooted NHORNSAT baed methodology for behavioral relation ince, (i) we how that there i a natural two player game aociated with rooted NHORNSAT problem, and (ii) we how that all the relation in linear time/branching time hierarchy [vg90] can be reduced to rooted NHORNSAT. Then we recall from [SRHS96] that many polynomial time decidable relation in [vg90] are reducible to rooted NHORNSAT in polynomial time. We alo oberve that exitence of winning trategie in the game correponding to thee relation are alo reducible to the NHORNSAT problem. A generalization of thee obervation lead to a uciency condition for thee relation to be polynomial time decidable for nite tate ytem. 1.2 Organization of the Paper We aume that the reader i familiar with the baic denition of variou behavioral relation in linear time/branching time hierarchy [vg90]. (Otherwie, Appendix A ha ome of the relevant denition.) Section 2 dene baic notion of (N)HORNSAT and dicue it relationhip with Boolean equation baed methodologie in [Lar92, And94]. Sketche of ecient data tructure and algorithm to olve the atiability problem of (N)HORNSAT are given in the Appendix D and E. In Section 3, we dicu the deirability of on the y, local and incremental propertie of verication algorithm and point out that thee propertie come naturally in our (N)HORNSAT baed methodology. Section 4, dicue the ue of our methodology to obtain diagnotic information eciently. Relevant denition uch a denition of intuitionitic Henney-Milner logic [CC92] and prebiimulation are provided in Appendix B. In Section 5, we develop algorithm for model checking alternation free mu calculu and Henney-Milner logic with recurion uing (N)HORNSAT baed method. Denition related to modal mucalculu and alternation free mu-calculu are provided in the Appendix C. Section 6, dene Stirling cla a a cla of game and give a ucient condition for polynomial time decidability of behavioral relation between nite tate procee. Note that due to lack of pace, no correctne proof have been included. 2 Satiability Problem for (N)HORNSAT Although mot of the denition related to behavioral relation, tranition ytem etc., are given in the appendix, denition of atiability problem for HORNSAT and it variant are dicued below. We include thee denition in the main text becaue we have reduced all our problem to (N)HORNSAT and hence it i crucial. Some of the other relevant denition related to mu-calculu and model checking are in the correponding ection and appendice a appropriate. Let u conider an intance of a propoitional CNF atiability problem, which i a conjunction of claue and each claue i a dijunction of poitive and negative literal with either of the following two retriction. 1. Each claue i a dijunction of literal with at mot one negative literal. 2. Each claue i a dijunction of literal with at mot one poitive literal. When the rt retriction applie, we call the problem NHORNSAT, and when the econd retriction applie, we call it HORNSAT [DG84]. We are intereted in nding maximal and minimal atifying aignment (if one exit) repectively. An intance of the problem i preented a a pair (X; C), where X = fx 1 ; x 2 ; :::; x n g, a nite et of propoitional variable which take boolean value, and C = fc 1 ; C 2 ; :::; C m g, a et of claue with the correponding retriction dicued above. Note that if an intance ha a atifying aignment, uch an aignment can be repreented a 2

4 an element of an n-dimenional Boolean lattice f0; 1g n. If we conider 0 < 1, then with a pointwie extenion of the ordering, and a pointwie ^ and _ a meet and join operation, we get a complete lattice. Now, for an intance of a atiability problem h, let u denote the et of all atifying aignment a SAT (h) f0; 1g n. An element x 2 SAT (h) i minimal, if no other y 2 SAT (h), i le than x in the ordering of f0; 1g n. Dually, an element x 2 SAT (h) i maximal, if no other y 2 SAT (h), i greater than x in the ordering of f0; 1g n. So now we have the following two problem: 1. Problem maximal-nhornsat: Given an NHORNSAT intance, nd a maximal atifying aignment, if there i one. Other wie, conclude that the intance i not atiable. 2. Problem minimal-hornsat: Given a HORNSAT intance, nd a minimal atifying aignment, if there i one. Otherwie, conclude that the intance i not atiable. A linear time algorithm for minimal-hornsat appear in [DG84](See Appendix D). It follow that maximal- NHORNSAT i alo olvable in linear time (See Appendix E). In ome of our application we have a pecial type of HORNSAT or NHORNSAT intance. Here we dicu that pecial type of NHORNSAT called rooted NHORNSAT and the correponding cae and algorithm for HORNSAT i very imilar. Denition 2.1 Given a claue C k of the form x j ) W i2i x i, where I i an index et poibly empty (note that the dijunction W i2i x i = true when I =.), we call x j, the head of the claue C k, denoted a head(c k ) = x j, and W i2i x i, the tail of C k. Any variable x i appearing in tail(c k ), i called a dijunct in the tail. Note that for a claue of the form C k = x j, head(c k ) = x j and tail(c k ) = true. Similarly, for a claue of the form C k = x j, head(c k ) = true and tail(c k ) = x j. Denition 2.2 A intance of a rooted NHORNSAT problem i of the form (X; C; x 1 ) where (X; C) i an NHORNSAT intance and x 1 2 X i uch that C 1 = x 1 (containing a ingle poitive literal). And the claue in C are ordered in uch a way that if head(c k ) = x j then, there mut be a claue C l (l < k) preceding it, uch that x j i a dijunct in tail(c l ). Alo for a ingle literal claue C k = x p (k > 1), x p mut alo be a dijunct in tail(c l ) for ome l < k. and x p cannot be head of any claue. Note that if C 2 i an implication claue then head(c 2 ) = x 1. The correctne of our (N)HORNSAT baed methodology for model checking can be eaily demontrated by howing the following. The (N)HORNSAT baed methodology may replace the methodologie in [Lar92, And94] baed upon ytem of imple Boolean equation. The advantage of thi lie in the fact that ecient algorithm and data tructure for (N)HORNSAT are already available in the literature [DG84, AI91]. The oundne and completene of our methodology eaily follow from the following theorem and it extenion to the reult in [And94].. Theorem 2.3 The factuality problem and the conitency problem of ytem of imple Boolean equation decribed in [Lar92] can be eciently reduced to the minimal-hornsat and maximal-nhornsat problem repectively. The reaon why thi theorem hold i a follow: Given a ytem of imple Boolean equation, if we are intereted in factuality [Lar92], we replace an equation of the form x = true by a ingle literal claue x, an equation of the form x = fale by a ingle negated literal claue x, an equation of the form x = x 1 ^ x 2 by a claue x ( x 1 ^ x 2, and an equation of the form x = x 1 _ x 2 by two claue x ( x 1 and x ( x 2. It i eay to prove that the variable which are aigned a value 1 in the minimal atifying aignment for thi HORNSAT intance are the factual variable of the original Boolean equational ytem. A dualization of thi will how that the conitency problem of [Lar92] can be reduced eciently to the maximal-nhornsat problem. Similarly, the problem of nding the leat and greatet xed point of the Boolean equation of [And94] can be reduced to minimal-hornsat and maximal-nhornsat repectively. Detail are omitted due to lack of pace. 3

5 3 On the Fly, Local and Incremental Model Checking In thi ection, we aume that the reader i familiar with modal mu-calculu and the idea of model checking. Otherwie, brief dicuion may be found in Section 5. We dicu here the advantage of local, on the y and incremental algorithm for model checking and checking behavioral relation. We alo ketch how our (N)HORNSAT baed methodology achieve thee deirable goal. Local Model Checking : The idea of nite tate model checking i to decide if a given tate of a nite tate ytem atie a given pecication. The pecication i expreed in a uitable logic, uch a modal mucalculu. However, the original algorithm [EL86] for nite tate model checking were \global" in the following ene. Thee global algorithm ue a x point approximation technique for computing et of tate which atify a xpoint formula. However, in many cae, thi involve many unneceary computation a dicued in [Lar90, SW91, Bra92]. Hence, in [SW91] a tableau baed algorithm for model checking wa introduced. They appealed to an implicit xpoint induction rather than iterative approximation and our (N)HORNSAT contruction alo appeal to an implicit xpoint induction. A local model checking algorithm doe not explore all the tate of the nite tate ytem, if not required. It trie to explore only a minimal et of tate and determine whether certain propertie are true in thoe tate in order to infer that a given property i true in a given tate. The tableau baed method in [Lar90, SW91, Bra92] are example of uch local algorithm for model checking. Our (N)HORNSAT baed method achieve thi objective naturally. Given a x point formula, and a tate of a nite tranition ytem, uppoe we want to determine if atie. We generate (N)HORN formula roughly a follow: We ue a Boolean variable Y, uch that atie the property expreed in if and only if Y i true in the atifying aignment of the maximal/minimal (N)HORNSAT intance. If i a maximal xpoint formula, then we generate a maximal-nhornsat intance, if i a minimal x point formula, we generate a minimal-hornsat intance, in cae of neted x point it i more ubtle. However, in the next ection, it will be clear, that we explore only thoe tate which are neceary to be explored in our method. Hence, our model checking algorithm are a local a any other local model checking algorithm in the literature. On the Fly Model Checking : Traditional model checking algorithm uch a [EL86] require the whole tate pace to be contructed in memory before they can be applied. However, in many application, one can nd counter example much before exploring the whole tate pace. More over, when the nite tate ytem are decribed uccinctly, for example, uing parallel compoition operator, the actual tate pace may be exponentially large and hence, it might be impractical to contruct the whole tate pace in memory. A a reult in [VW86, CVWY92, BCG95, KVW95, FM91] on the y model checking and behavioral relation checking have been emphaized. In an on the y algorithm the tate pace i contructed on demand, hence the verication take place together with the contruction of the tate pace. In our (N)HORNSAT baed approach, on the y algorithm i obtained naturally becaue of the exiting on the y or online algorithm for (N)HORNSAT [AI91] and ome minor improvement on them. Our reduction to (N)HORNSAT can be done in NLOGSPACE and on the y algorithm for HORNSAT work in O(q) amortized time, where q i the ize of each new claue generated. Since the ize of the (N)HORNSAT intance created i linear in the product of the ize of the tranition ytem and the pecication in the cae of model checking, and product of the ize of the two tranition ytem in cae of relational checking, we might ue in the wort cae, linear pace and linear time in thoe meaure. For on the y behavioral relation checking thi i an improvement over [FM91] which require quadratic time in thee meaure for behavioral relation checking. However, in mot cae, counter example are found after contructing ubtantially le number of claue. Detail of our on line algorithm for (N)HORNSAT and another depth rt earch baed on the y algorithm for rooted (N)HORNSAT will be preented in a fuller verion of thi abtract. Incremental Model Checking : In [SS94], an incremental algorithm for model checking alternation free mucalculu wa developed. The baic idea behind the algorithm wa a follow: Suppoe, a model checking algorithm i run on a tranition ytem and a formula and the information regarding atiability of ubformula at dierent tate are available. Now, uppoe, there are ome change in the pecication of the tranition ytem, o that ome new tranition are added and ome tranition are deleted from the tranition ytem. An incremental algorithm exploit the information available from the previou run of the model checking algorithm. It carrie out minimal computation o that the model checking problem with repect to the changed tranition ytem i olved in time O(), where i a meaure of change in the tranition ytem. It ha been pointed out [SS94] 4

6 that in the wort cae, thi may not be poible. One can contruct example, uch that one ha to pend a much time in the incremental algorithm a required in the model checking from the cratch. However, in the bet cae and more importantly, in many pragmatic ituation the incremental computation could be linear in the ize of the modication. It can be hown that minor modication of the online algorithm for HORNSAT [AI91] will give an incremental algorithm for (N)HORNSAT. Hence, with addition and deletion of claue, the amortized time in incrementally olving the modied (N)HORNSAT problem will be linear in the ize of the modication. Since, modication in the tranition ytem will be reected in the change in the correponding (N)HORNSAT intance, we can now directly obtain incremental algorithm for all the problem conidered in thi paper including the behavioral relation checking and model checking which have amortized time complexity linear in the ize of the modication. 4 Generating Diagnotic Information Eciently via HORNSAT We briey outline how we can eciently generate diagnotic information in the ene of [CC92] when two tranition ytem are not related by a behavioral relation. In [CC92], a method wa preented to generate a formula of intuitionitic Heney Milner logic which ditinguihe the two procee in the ene of [Wal88]. In the rt ubection we explain the problem following [CC92] and in the next ubection we review the HORNSAT baed method for checking behavioral relation between nite tate procee preented in [SRHS96]. Then we extend thi method to generate diagnotic information much more eciently than the method preented in [CC92]. Although our method i general enough to apply to all the preorder and equivalence conidered in [SRHS96], we illutrate our technique only on prebiimulation preorder which wa alo the illutrative example ued in [CC92]. 4.1 Prebiimulation and Intuitionitic Heney Milner Logic Denition 4.1 [CC92, Wal88] An Extended Labelled Tranition Sytem(elt) i a quadruple hs; Act;!; "i where hs:act;!i i a labelled tranition ytem and " S Act i an underdenedne relation. The relation " repreent underdenedne. If (p; a) 2" then the behavior of p in repone to action a i not completely pecied. Other a?tranition may be added later. A proce i a pair (T; ) where T i an extended tranition ytem and i a tate in that tranition ytem. notation: We ue p " a in place of (p; a) 2" and p # a in place of :(p " a). Given a labelled tranition ytem(lt), one can eaily generate the correponding extended tranition ytem (elt). Moreover, given a nite lt, one can ue a tranitive cloure algorithm in polynomial time to generate the correponding elt. The ize of the generated elt i linear in the ize of the lt [CC92]. Hence, for implicity we aume henceforth that we are given elt for checking behavioral relation. In Appendix B we dene a particular relation on elt called prebiimulation preorder and it can be eaily een [CC92] that many other imulation relation and equivalence can be hown a pecial cae of thi preorder. We denote the preorder by v. If two procee P and Q are in the prebiimulation preorder, we write P v Q. We alo dene Intuitionitic Henney-Milner Logic (IHML) which i a characteritic logic for prebiimulation in Appendix B, following [Sti87]. The logical characterization of prebiimulation preorder [Sti87] ay that if P v Q then the et of IHML formula atied by P i a ubet of the et of IHML formula atied by Q. Denition 4.2 We call an IHML formula a diagnotic formula for two procee P = (hp; Act;!; "i; p 0 ) and Q = (hq; Act;!; "i; q 0 ), if P j= but Q 6j=. (In which cae we ay that ditinguihe P from Q.) So given two procee, P = (hp; Act;!; "i; p 0 ) and Q = (hq; Act;!; "i; q 0 ), we are intereted in contructing a diagnotic formula for them if P 6v Q. In [CC92] an algorithm for thi problem i preented. The complexity of their algorithm i quite high. Although in [CS91] an ecient algorithm for computing behavioral relation via model checking i preented, the method in [CC92] for producing diagnotic trace doe not trivially apply to that algorithm. 4.2 HORNSAT baed checking of Prebiimulation Preorder We now recall from [SRHS96], how to reduce the prebiimulation problem to rooted NHORNSAT. 5

7 Given two nite tate procee P = (hp; Act;!; "i; p 0 ) and Q = (hq; Act;!; "i; q 0 ), we outline an algorithm for checking if P v Q. We give an ecient reduction to an NHORNSAT intance (ee appendix) and ince there i linear time algorithm to check the atiability of NHORNSAT, that give u an ecient algorithm for prebiimulation preorder checking. Our reduction of the prebiimulation problem to an NHORNSAT intance f i a follow: 1. The variable in the formula f are X p;q where p and q are the tate in the two tranition ytem. 2. The claue in the formula f are of the following three type. (a) A ingle poitive literal X p;q. If (p; q) i required to be in the prebiimulation relation we contruct thi type of claue. We alway create X p0 ;q 0 becaue (p 0; q 0) require to be in the prebiimulation relation for the relation to hold between the two tranition ytem. Alo, if there i a pair (p; q) uch that p; q have no out going tranition and p " a for all a 2 Act, or if p; q have no out going tranition and p # a a well a q # a for all a 2 Act, then we generate a claue X p;q. (b) A ingle negated literal X p;q. Such a claue i contructed to indicate that (p; q) cannot be in any prebiimulation relation. We create uch a claue when one of the following i true: i. When there i an a 2 Act uch that p a! p 0 for ome p 0 but there i no q 0 uch that q a! q 0. We mark uch a claue with a claue number and < a > true to indicate that q doe not have an a action wherea p ha one. ii. For ome a 2 Act, p # a but q " a. We mark thi claue with the claue number and [a] #true to denote that p atie [a] #true but q doe not. iii. For ome a 2 Act, p # a and q # a but there i q 0 uch that q a! q 0 but there i no p 0 uch that p a! p 0. Mark thi claue with a claue number and [a] #fale to denote that [a] #fale i atied by p but not by q. (Note that [a] #fale can be atied by a tate p if and only if there i no a action out of it and p # a). W (c) Implication claue of the form X p;q ) i;j Xi;j. If a claue of thi form i contructed then it mean that for (p; q) to be in the prebiimulation relation one of the (i; j)' mut alo be in the prebiimulation relation. We generate thee claue in the following cae: i. For each action a 2 Act, for each tranition p! a p 0. in P, we create an implication claue in the following manner: W Let S(q; a) = fq i j q! a q ig. Then we generate a claue X p;q ) r2s(q;a) X p 0 ;r and mark thi claue with a claue number and \a1" to denote that it correpond to obligation that an a action in the rt proce need to be matched by a imilar one in the econd proce. ii. If for all a 2 Act, both p # a and q # a, then for each a 2 Act, for each tranition q! a q 0. in Q, we create an implication claue in the following manner: W Let S(p; a) = fp i j p! a p ig. Then we generate a claue X p;q ) X r2s(p;a) r;q0 and mark thi claue with a claue number and \a2" to denote that it correpond to the obligation that an a action in the econd proce need to be matched by a imilar one in the rt. Now we tate without a proof a theorem that tate that the NHORNSAT intance produced by the above ketched algorithm i atiable if and only if P v Q. Alo the ize of the NHORNSAT intance i O(jPj jqj) and hence a linear time NHORNSAT olver baed on [DG84] (ee appendix) combined with the above reduction will give a ecient an algorithm for prebiimulation checking. Theorem 4.3 the NHORNSAT intance produced by the algorithm decribed above, i atiable if and only if P v Q. The running time of the prebiimulation checking algorithm obtained thi way i O(jPj jqj). 4.3 Generating Diagnotic Formula Now we how how to obtain diagnotic IHML formula without increaing the aymptotic complexity, in cae P 6v Q. Recall that the linear time algorithm for HORNSAT atiability preented in [DG84] rt build a graph repreentation of the intance and then do pebbling on the graph. The on the y algorithm for HORNSAT in [AI91] build thi graph incrementally on demand bai. In the appendix, we have outlined, how to adapt thi pebbling to NHORNSAT. Thi pebbling help u to generate the diagnotic IHML formula without any extra overhead. 6

8 Note that when the two ytem are not related by prebiimulation preorder, there i a pebbling from ffaleg to true in the graph. (See appendix). Now, ince (p 0 ; q 0 ) are not related, there i a pebbling through X p0;q 0. We can nd uch a pebbling in linear time and once uch a pebbling ha been found we contruct the IHML formula a follow: Recall we marked each claue with a claue number and a certain xed ize information whoe ize depend on the ize of Act. During the graph building while olving the NHORNSAT intance, we labelled the edge of the graph by claue number a well a the marking of the claue. The ditinguihing formula for (p; q) 2 P Q i obtained by the following rule: We are auming that the NHORNSAT intance produced by the algorithm in the previou ection i unatiable and thu there i a pebbling from ffaleg to true through X p0;q 0. The ditinguihing formula i not repreented directly but a a et of equation in variable of the form d p;q uch that the value of the variable d p0;q 0, if the equation are olved, will give the ditinguihing formula for the two tranition ytem. The value of d p;q give the ditinguihing formula for the tate p; q If there i an edge directly from the node fale in the graph to X p;q (which alo mean that there i a claue C i = X p;q.) Obviouly that edge mut be marked by (i; m) where m i either of the following three ymbol. < a > true, [a] #true and [a] #fale. Then create the equation d p;q = m. 2. Let X p;q be pebbled and the pebbling i via edge marked with (i; a1) for ome claue C i, for ome a 2 Act, and the claue C i V W i of the form X p;q ) r2s(q;a) X p 0 ;r where S(q; a) = fq i j q! a q ig. Then create a new equation d p;q =< a > ( r2s(q;a) d p 0 ;r). 3. Let X p;q be pebbled via edge marked with (i; a2) for ome claue C i, for ome a 2 Act, and the claue C i i of the form X p;q ) W r2s(p;a) X r;q 0 where S(p; a) = fpi j p a! p ig. Then create a new equation d p;q = [a] #( W r2s(q;a) d r;q 0 ). The following theorem tate the correctne of the above method and the proof i by induction on the pebbling ditance [DG84] which i omitted due to lack of pace. Theorem 4.4 The method outlined above produce a et of propoitional equation with propoitional variable of the form d p;q uch that the value of d p0;q0 (when the ubtitution are made according to the equation et,) i a diagnotic IHML formula for the procee P and Q when P 6v Q. Moreover, the ize of thi equational repreentation of the diagnotic formula i at the wort O(jP j jqj max(jp j; jqj)) However, it i eay to ee that the ize of the NHORNSAT intance will be O(jP j jqj (max(jp j; jqj)) 2 ) and uing the linear time implementation of the pebbling and writing the ditinguihing formula during the pebbling itelf will provide an algorithm that run in O(jP j jqj (max(jp j; jqj)) 2 ) time which i O(jPj jqj) 3 and which ha the property that it decide if P v Q and in cae P 6v Q, it produce an equational repreentation of a diagnotic IHML formula without any extra cot in the aymptotic complexity. We alo generate diagnotic trace for model checking in a very imilar way by marking the claue with pecial information of xed ize. The detail of diagnotic information generation for model checking i not dicued in thi abtract. 5 Model Checking Fragment of Modal Mu-Calculu Although our methodology can be extended to apply to general Mu-Calculu [Koz83, Bra92], we illutrate our method through two well dicued fragment of modal mu-calculu. One i the unneted ingle xed point fragment. Thi i imilar to the Henney-Milner Logic with recurion [Lar88, Lar90]. The other i alternationfree mu-calculu, a dicued in [CS91]. We recall their denition from [CS91] in Appendix C. 5.1 Model Checking to (N)HORNSAT Now we illutrate how to reduce the model checking problem for the above mentioned fragment of modal mucalculu to (N)HORNSAT. 2 We can contruct example of tranition ytem P and Q uch that P 6v Q and the ditinguihing IHML formula i exponential in the ize of the decription of P and Q. Thi lower bound on the ditinguihing formula ize jutie our ue of the equational repreentation for the ditinguihing formula. 3 Note that jpj = O(jP j 2 ) 7

9 5.1.1 Reduction of Model Checking Single Fix point Mu-Calculu to (N)HORNSAT For each tate 2 S of the given nite tate ytem T and each variable X i of the equational pecication, we aociate a boolean variable Y Xi. Recall, in the ingle xpoint calculu, there i a ingle block of equation which i either a max block or a min block. We conider the cae when the block i a max block B = maxfeg where E = fx 1 = 1 ; :::; X n = n g. A dualization will hold for min block. Here, the model checking problem i to determine if 2 kx i k kbke, for a given tranition ytem T = hs; Act;! i, for an initial environment e, and 2 S. (See Appendix C for clarication on the notation). The reduction proceed a follow: 1. Create a variable Y X i 2. For each variable of the form Y X j ^e in B and put the variable Y X i in a queue. on the queue, uch that X j appear in the left-hand ide of an equation (i) If ^e i X j = A where A i atomic, then create a claue Y A if A i true at ele create a claue Y A. (Thi information i obtained from the valuation map aociated with the model.) Put the variable Y A in the queue if thi variable wa never on the queue before.! Y Xp _ Y Xq (ii) If ^e i X j = X p _ X q, then create the claue Y X j into the queue, if thee variable were never on the queue before. Y Xq 3. If Y X j (iii) If ^e i X j = X p ^ X q, then create two claue Y X j variable Y Xp and Y Xq! Y Xp and Y X j into the queue, if they were never on the queue before. (iv) If ^e i X j = haix p, then create a claue of the form Y X j and put the variable Y Xp! Y Xq and and put the W! Y Xp 0 2a() where a() = 0 f 0 j 9 0 :! a 0 g. When a() i empty, the dijunction i equivalent to fale. Put the variable Y Xp the queue if they were never on the queue before. (v) If ^e i X j = [a]x p, then create claue of the form Y X j! Y Xp for each a() where a() = f 0 j 9 0 :! a 0 g. Put the variable Y Xp on the queue if they were never on the queue 0 before. When a() i empty, create the ingle literal claue Y X j literal claue Y X j i in the queue and if X j doe not appear on the left hand ide in B, then if 2 e(x j), add a ingle ele add the claue Y X j. Thi will produce an NHORNSAT intance, of the ize linear in the product of the ize of the tranition ytem and equational block B. We now tate the theorem tating the correctne of the reduction. The correctne of the model checking algorithm obtained thi way follow from the dicuion in ection 2. Let 2 S i a tate in the given nite tate tranition ytem T = hs; Act;!i. Let X i be a variable in the equational block ued in pecifying a property uing the yntax of [CS91] and let the initial environment be e. Suppoe the block pecifying the formula i a max block, B = maxfeg where E = fx 1 = 1 ; :::; X n = n g. Theorem 5.1 If h i the intance of NHORNSAT produced by the algorithm decribed above from the given model checking problem (if 2 kx i k kbke ), then h i atiable and in the maximal atifying aignment of h Y Xi = 1, if and only if 2 kx i k kbke. The dual of the above theorem hold for min block. Which mean that in the minimal olution of the HORNSAT intance produced in that cae, Y Xi = 1 if and only if 2 kx i k kbke. Thi give u a linear time algorithm for the problem Alternation free mu calculu Now we generalize the algorithm in the previou ection, to obtain a (N)HORNSAT baed algorithm for the model checking of alternation free mu-calculu. A linear time algorithm for the ame problem wa preented in [CS91]. Their algorithm needed to invent an ecient data tructure to obtain the linear time algorithm. Our method bring out the fact that the eential data tructure neceary to obtain the linear time algorithm for model checking could alo be obtained by noting the fact that crucial data tructuring [DG84] give linear time algorithm for HORNSAT/NHORNSAT. Given a Tranition ytem T, a valuation map, an initial environment e, a blocket B, the model checking problem i to decide if 2 kx i k kbke, for a given tate in the tranition ytem and a given variable X i appearing on the left hand ide of ome equation in ome block B l in B.. 0 on 8

10 Briey, the tep in the (N)HORNSAT baed verion of the algorithm for model checking alternation free mu-calculu are a follow: 1. Create a variable Y X i and put the variable Y X i in the queue aociated with the block Bl where Xi appear on the left hand ide. 2. Expand the variable in the queue aociated with each block, in the revere topological order, 4 with the following rule: If the block i a max block then ue the method decribed in the previou ubection and if the block i a min block ue a dual approach. Keep the NHORN or HORN claue for each block eparated. If new variable Y X j i generated and X j belong to a dierent block B, put that variable in the queue aociated with block B. If the a variable Y X j in the queue for a block B i already expanded then remove it from the queue otherwie expand it. 3. Start olving the minimal-hornsat/maximal-nhornsat intance correponding to each block in the topological order. Let h B be the HORNSAT/ NHORNSAT intance correponding to block B. Suppoe a variable Y X j wa aigned a value 1 in the olution of a h B (where X j appear on the left hand ide in B) then add a claue Y X j in the (N)HORNSAT intance correponding to the block which had to put thi variable in the queue of the block B (Thi information can be read o the block graph alo). If Y X j wa aigned a value 0 in the olution of a h B (where X j appear on the left hand ide in B) then add a claue Y X j in the (N)HORNSAT intance correponding to the block which put thi variable in the queue of the block B. Then continue olving the next block HORNSAT intance. Suppoe the block B correponding to X i, i a max block. (Dual hold for min block). The maximal-nhornsat intance for the block B i atiable and Y X i = 1, in the maximal atifying aignment, if and only if 2 kx ik kbke. Note that thi algorithm produce a equence of HORNSAT and NHORNSAT intance and it i local and it can be made into an On the y algorithm by noting that one can ue the on the y algorithm for each HORNSAT intance. We tate the theorem about the correctne and eciency of the algorithm ketched above with out proof. Theorem 5.2 The algorithm for model checking alternation free mu-calculu obtained by reducing the problem to a equence of minimal-hornsat and maximal-nhornsat problem run in time linear in the product of the ize of the tranition ytem and the block et pecifying the property. Hence the HORNSAT baed algorithm i a ecient a the algorithm in [CS91]. We alo have developed HORNSAT baed method to capture the tableau baed local model checking in [Cle90] and [SW91]. Detail will appear in a future verion of thi paper. In the next ection, we go on to ee that there i a game aociated to rooted HORNSAT and in fact, that implie exitence of the characteritic game for all the behavioral relation in the linear time /branching time hierarchy[vg90]. 6 Game for rooted (N)HORNSAT and Stirling Game We now decribe a game for rooted NHORNSAT. We howed in Section 4, how to reduce the problem of checking prebiimulation relation between nite tate procee to rooted NHORNSAT. Note that in [CS91, Ste89], it wa hown that mot equivalence and preorder including failure equivalence, trace equivalence etc., are reducible to prebiimulation problem(via proce tranformation). Hence, all thoe relation that are reducible to a prebiimulation problem are alo reducible to rooted NHORNSAT. Given a two-player game for rooted NHORNSAT, we can eaily aociate game to all thee relation a well. Now recall that Colin Stirling in [Sti93] dened a characteritic game for biimulation. Our reult how that uch a game formulation i very natural given the game for rooted NHORNSAT. However, we develop here a dierent cla of game uch that all relational preorder and equivalence between nite tate procee in linear time /branching time hierarchy [vg90] have their characteritic game in thi cla. In particular Stirling' biimulation game i one game in our cla. Henceforth we call our cla of game Stirling Cla of game. 4 Given B, the block et, topologically ort the block in B with repect to the variable dependency relation depicted in block graph. Let B 1 ; B 2 ; :::; Bm be the et of block in the topologically orted order. 9

11 6.1 Game for rooted NHORNSAT Recall the denition of rooted HORNSAT from Section 2. Game for an intance of a rooted NHORNSAT intance h = (X; C; x 1 ) i a two player game G h a follow: Player I i called a poiler who want to how that the intance h i not atiable and Player II i called a duplicator who want to how that the intance h i atiable. The game proceed in round. In the rt round, the poiler open the game by chooing a claue C i uch that head(c i ) = x 1. Duplicator ha to reciprocate by chooing x ij uch that x ij i a dijunct in tail(c i ). In the ubequent round, the poiler chooe a claue C k uch that head(c k ) = x ij where x ij wa choen by the duplicator in the previou round. The duplicator ha to reciprocate by chooing a dijunct in the tail of C k. The game continue until one of the player loe. The duplicator loe if it doe not have uch a dijunct to chooe (i.e, when the poiler ha choen a claue of the form x l in it lat move), the poiler loe when the game continue for ever (which i not poible in a nite ize NHORNSAT intance) or when the poiler chooe a claue choen earlier. It i eay to prove the following theorem by recalling the pebbling baed algorithm for olving NHORNSAT dicued in the Appendix E. Theorem 6.1 Given an intance h = (X; C; x 1 ) of the rooted NHORNSAT problem, the duplicator ha a winning trategy 5 in the correponding game if and only if h i atiable. 6.2 Stirling Cla of Game Now we are ready to decribe Stirling Cla of game. Each game in thi cla alo ha two player. One player i called duplicator or prover and the other i called poiler or diprover. Each game in the cla ha the following component: 1. Two Finite Tranition ytem T 1 = hs 1 ; A;! 1 ; 1 i and T 2 = hs 2 ; A;! 2 ; 2 i. 2. Two language R 1 A and R 2 A. 3. Two total relation m 2 R 1 A and m 2 R 2 A. 4. A et of (winning poition)? S 1 S A et of tarting poition? S 1 S A et M f1; 2g which denote the indice of the coordinate of a poition that poiler can play on. In each round the duplicator play on the other coordinate. 7. A poitive integer r denoting the number of round allowed in the game. Thi i crucial for ome of the game. The game tart in a poition h; ti 2. A play of the game i a nite or innite length equence of the form h 1 0 ; 2 0i; :::; h 1 i ; 2 i i; :::. The poiler want to how that there i a dierence between the two tranition ytem (the kind of dierence it want to how depend on the relation the game correpond to). The duplicator want to how that uch a ditinction attempted by the poiler i not poible. A partial play in a game i a prex of a play of the game. Let j be a partial play h 1 0 ; 2 0 i; :::; h1 j ; 2 ji. The next pair h 1 j+1 ; 2 j+1i i determined by the following move rule: The Spoiler pick a triple hi; x; ui uch that i 2 M and x 2 R i and i x j =) i u. and u = i j+1. (Note that =) i denote an extended tep in the tranition ytem T i ). Let the choice of the poiler in the move be hi; x; ui and let i 0 6= i. Then the Duplicator pick a pair hy; u 0 i uch that (x; y) 2 m i 0 and i0 y j =) i 0 u 0 and u 0 = i0. j+1 Extending a partial play j to j+1 by the above move rule i called a round of the game. Hence a play can be thought of a a equence of round. Each round conit of two move. The rt move of each round i a move by the poiler and the econd move i by the duplicator. If in a round, after the poiler ha made it move, the duplicator can alo make a move according to the move decribed above, then we ay that the duplicator ha a matching move in that round. Now we decribe the winning condition of a game of thi kind. The game may continue until one of the player win. The winning condition for each player i a follow. 5 For the denition of winning trategy, ee next ubection 10

12 Duplicator win: 1. The play i h 1 0; 2 0i; :::; h 1 n; 2 ni and there i no available tranition from i n and M = fig. In cae M = f1; 2g, the correponding condition i that 1 n and 2 n both have no available tranition. 2. A partial play i h 1 0; 2 0i; :::; h 1 n; 2 ni and for ome i < n, 1 i = 1 n and 2 i = 2 n. Spoiler win: 1. The play i h 1 0; 2 0i; :::; h 1 n; 2 ni and h 1 n; 2 ni =2?. 2. M = f1; 2g and a partial play i h 1 0; 2 0i; :::; h 1 n; 2 ni. For ome i 2 M, 9x 2 R i:(9 i 2 S i:( i n =) i i ) but for i 0 2 M? fig, forall y uch that ((x; y) 2 m i 0 and for all i 0 2 S i 0, there i no tranition i0 y n =) i 0 i M = fig(i 2 f1; 2g) and a partial play i h 1 0; 2 0i; :::; h 1 n; 2 ni, 9x 2 R i:(9 i 2 S i:( i n =) i i ) but for i 0 2 M?fig, forall y uch that ((x; y) 2 m i 0 and for all i 0 2 S i 0, there i no tranition i0 y n =) i 0 i 0. So the duplicator win the game if either in the lat poition of the play, there i no further allowable move by none (when M = f1; 2g ) or there i no further allowable move by the poiler(when jmj = 1), depending on the cardinality of the et M. Duplicator alo win, if in the play a poition i repeated. In both cae, the poiler ha failed to expoe a ditinction between the tranition ytem. The poiler win, if in the lat poition of the play i not a winning poition which mean the poiler ha been able to force the duplicator to a non winning poition of the game or if in the lat poition, the poiler ha an allowable move but the duplicator doe not have a matching move. A trategy for a player i a et of rule which tell him/her how to make a move depending on the partial play and opponent' move o far. A trategy i a winning trategy for a player, if playing with that trategy, that player win againt all poible trategie of the opponent. 6.3 Simulation and Equivalence a game in the Stirling Cla We now dene what i meant by a characteritic game for a particular relation or equivalence relation between nite tate procee. Denition 6.2 A game G in Stirling cla i called a characteritic game for a relation R between two nite tate procee, if the following condition hold. Let the game G be played on two tranition ytem T 1 and T 2 and the duplicator ha a hitory free winning trategy if and only if T 1 and T 2 are related by the relation R. Now we illutrate the characteritic game for the following relation between nite tate tranition ytem. 1. Biimulation Game(Bim? game) 2. Weak Biimulation Game(W eakbim? game) 3. Simulation Game(Sim? game) 4. Ready Simulation Game(Rim? game) 5. Failure Equivalence Game(F ailure? game) In the Appendix F we have dicued the characteritic game for ome other relation uch a Forward Simulation Game(F im? game), Trace Equivalence Game(T race? game), Readine Equivalence Game(Readine? game), and the 2-neted Equivalence Game (2? neted? game) Many other equivalence conidered in the literature may be hown to have a characteritic game in the Stirling Cla. Here, we lit the retriction on variou parameter of the Stirling cla of game which make the game a characteritic game for the particular relation. Note that denote the identity relation in the ubequent paragraph. We alo aume in the following that all the game are being played on T 1 = hs 1 ; A;! 1 ; 1 i and T 2 = hs 2 ; A;! 2 ; 2 i. Characteritic Game for Biimulation : Bim? game i a game in Stirling cla with the following parameter: R 1 = R 2 = A, m 1 ; m 2 =,? = S 1 S 2, = fh 1 ; 2 ig, M = f1; 2g, r =j S 1 j j S 2 j +1. Characteritic Game For Weak Biimulation: W eakbim? game i a game in Stirling cla with the following parameter: R 1 = R 2 = A, m 1 (a) = a ; m 2 (a) = a 8a 2 A,? = S 1 S 2, = fh 1 ; 2 ig, x x 11

13 M = f1; 2g, r =j S 1 j j S 2 j +1. Characteritic Game For Simulation preorder : im? game i a game in Stirling cla with the following parameter: R 1 = R 2 = A, m 1 ; m 2 =,? = S 1 S 2, = fh 1 ; 2 ig, M = f1g, r =j S 1 j j S 2 j +1. Characteritic Game For Ready-imulation preorder : Rim? game i a game in Stirling cla with the following parameter: R 1 = R 2 = A, m 1 ; m 2 =,? = fh; ti j 2 S 1 ; t 2 S 2 ^ init() = init(t)g, = fh 1 ; 2 ig, M = f1g, r =j S 1 j j S 2 j +1. Characteritic Game For Failure Equivalence: F ailure?game i a game in Stirling cla with the following parameter: R 1 = R 2 = A, m 1 ; m 2 =,? = fh; ti j 2 S 1 ; t 2 S 2 ^ F ailure() = F ailure(t)g, = fh 1 ; 2 ig, M = f1; 2g, r = 1. For each relation R, in the linear-time/branching time hierarchy, and it characteritic game G R, the following theorem can be proved eaily. Theorem 6.3 Let T 1 ; T 2 be two tranition ytem and let G R be the intance of the characteritic game for a relation R, uch that the game i played on T 1 and T 2. The duplicator ha a winning trategy for thi intance of the game G R if and only if R hold between the given two tranition ytem. For certain ubcla of Stirling cla, the problem whether the duplicator ha a winning trategy i directly reducible to rooted NHORNSAT problem. Hence, for any behavioral relation, whoe characteritic game i in thi ubcla, the problem of checking that relation between two nite tate tranition ytem i reducible to the rooted NHORNSAT problem. Thi lead to a polynomial time algorithm for the problem of checking that relation, provided one can create the intance of the game from the intance of the relational problem in polynomial time. For all the game in Stirling Cla, given that the tranition ytem are repreented a nite tate ytem, the tranformation to game intance i polynomial time, provided that the winning poition can be decided in polynomial time. Hence, we get a uciency condition a to under what condition a behavioral relation between nite tate procee i polynomial time decidable. So far a we know, thi i the rt time uch a ucient characterization of polynomial time decidable behavioral relation between nite tate tranition ytem i given. Thi i ueful, becaue, when ever a new relation i dened, if that relation atie thi et of condition, it i guaranteed that the relation i polynomial time decidable for nite tate tranition ytem A Subcla of Stirling Cla We now briey give a ucient characterization a to when a game in Stirling Cla i reducible to an intance of rooted NHORNSAT in polynomial time. 1. R 1 and R 2 are nite and explicitly enumerated. For example, in biimulation game R 1 = R 2 = A, where A i the et of action ymbol. 2. The repreentation of the et of winning poition i either by an explicit liting or uch that determining if a poition of the game i a winning poition i polynomial time decidable. A a corollary we get the following reult: Theorem 6.4 Given a game G in Stirling cla atifying the condition lited above, whether the duplicator ha a winning trategy for G, can be decided in polynomial time. Hence the corollary i : Corollary Any behavioral relation between two nite tate tranition ytem, whoe characteritic game atify the condition lited above, i decidable in polynomial time. Hence, trong and weak biimulation equivalence, forward imulation, imulation equivalence, ready imulation and equivalence, prebiimulation, k-neted imulation for any xed k are all polynomial time decidable relation for nite tate tranition ytem. Acknowledgement: We thank Mohe Vardi, Pierre Wolper and Rajeev Alur for helpful communication. We thank S. S. Ravi for helpful dicuion. 12