# Automata-Theoretic LTL Model-Checking

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 Automata-Theoretic LTL Model-Checking Arie Gurfinkel SEI/CMU Automata-Theoretic LTL Model-Checking p.1

2 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions Boolean Operations Temporal operators a a X a Fa Ga a U b a is true now a is true in the next state a will be true in the Future a will be Globally true in the future a will hold true Until b becomes true

3 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions Boolean Operations Temporal operators a a X a Fa Ga a U b a is true now a is true in the next state a will be true in the Future a will be Globally true in the future a will hold true Until b becomes true

4 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions Boolean Operations Temporal operators a a X a Fa Ga a U b a is true now a is true in the next state a will be true in the Future a will be Globally true in the future a will hold true Until b becomes true

5 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions Boolean Operations Temporal operators a a a a a a X a Fa Ga a U b a is true now a is true in the next state a will be true in the Future a will be Globally true in the future a will hold true Until b becomes true

6 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions Boolean Operations Temporal operators a a a a b a X a Fa Ga a is true now a is true in the next state a will be true in the Future a will be Globally true in the future a U b a will hold true Until b becomes true

7 Outline Automata-Theoretic Model-Checking Finite Automata and Regular Languages Automata over infinite words: Büchi Automata Representing models and formulas with automata Model checking as language emptiness Automata-Theoretic LTL Model-Checking p.2

8 Finite Automata A finite automaton A (over finite words) is a tuple (Σ,Q,,Q 0,F), where Σ is a finite alphabet Q is a finite set of states Q Σ Q is a transition relation Q 0 Q is a set of initial states F Q is a set of final states Automata-Theoretic LTL Model-Checking p.3

9 Finite Automaton: An Example b,c a,c a q b 0 q 1 Σ = {a,b,c},q = {q 0,q 1 },Q 0 = {q 0 },F = {q 1 } Automata-Theoretic LTL Model-Checking p.4

10 A Run A run of A over a word v Σ of length v is a mapping ρ : {0,1,..., v } Q s.t. First state is the initial state: ρ(0) Q 0 States are related by transition relation: 0 i v (ρ(i),v(i),ρ(i+1)) A run is a path in A from q 0 to a state ρ( v ) s.t. the edges are labeled with letters in v A run is accepting if it ends in an accepting state: ρ( v ) F. A accepts v iff exists an accepting run of A on v. Automata-Theoretic LTL Model-Checking p.5

11 An Example of a Run b,c a,c a q b 0 q 1 A run q 0,q 1,q 1,q 1,q 0 on aacb is accepting A run q 0,q 0,q 0,q 0,q 0 on bbbb is accepting A run q 0,q 0,q 1,q 1,q 1 on baac is rejecting Automata-Theoretic LTL Model-Checking p.6

12 Language The language L(A) Σ is the set of all words in Σ accepted by A. b,c a a,c q b 0 q 1 The language is {ǫ,b,bb,ccc,bab,...} That is, a regular expression: ǫ+a(a+c) b(b+c) Automata-Theoretic LTL Model-Checking p.7

13 Regular Languages A set of strings is regular if is a language of a finite automaton (i.e., recognizable by a finite automaton) An automaton is deterministic if the transition relation is deterministic for every letter in the alphabet: a (q,a,q ) (q,a,q ) q = q otherwise, it is non-deterministic. NFA = DFA: Every non-deterministic finite automaton (NFA) can be translated into a language-equivalent deterministic automaton (DFA) Automata-Theoretic LTL Model-Checking p.8

14 Automata on Infinite Words Reactive programs execute forever need infinite sequences of states to model them! Solution: finite automata over infinite words. Simplest case: Büchi automata Same structure as automata on finite words... but different notion of acceptance Recognize words from Σ ω (not Σ!) Σ = {a,b} v = abaabaaab... Σ = {a,b,c} L 1 = {v in v after every a there is a b} Some words in L 1 : ababab aaabaaab abbabbabb accbaccb Automata-Theoretic LTL Model-Checking p.9

15 Infinite Run and Acceptance Recall, F is the set of accepting states A run ρ of a Büchi automaton A is over an infinite word v Σ ω. Domain of the run is the set of all natural numbers. Let inf(ρ) be the set of states that appear infinitely often in ρ: inf(ρ) = {q i N j i ρ(j) = q} A run ρ is accepting (Büchi accepting) iff inf(ρ) F. A set of strings is ω-regular iff it is recognizable by a Büchi automaton Automata-Theoretic LTL Model-Checking p.10

16 Example b,c a,c a q b 0 q 1 Automata-Theoretic LTL Model-Checking p.11

17 Example b,c a,c q 0 a b q 1 Language of the automaton is: ((b+c) ω a(a+c) b) ω This is an ω-regular expression Automata-Theoretic LTL Model-Checking p.11

18 Examples Let Σ = {0,1}. Define Büchi automata for the following languages: 1. L = {v 0 occurs in v exactly once} 2. L = {v after each 0 in v there is a 1} 3. L = {v v contains finitely many 1 s} 4. L = (01) n Σ ω 5. L = {v 0 occurs in every even position of v} Automata-Theoretic LTL Model-Checking p.12

19 Closure Properties Büchi-recognizable languages are closed under... (alphabet) projection and union Same algorithms as Finite Automata intersection Different construction from Finite Automata complement i.e., from a Büchi automaton A recognizing L one can construct an automaton A recognizing Σ ω L. A has order of O(2 QlogQ) ) states, where Q are states in A [Safra s construction] Automata-Theoretic LTL Model-Checking p.13

20 Complementation: Example Complement is easy for deterministic Büchi automata: b,c a,c a A q b 0 q 1 Automata-Theoretic LTL Model-Checking p.14

21 Complementation: Example Complement is easy for deterministic Büchi automata: b,c a,c a,b,c a,c a a A q b 0 q 1 A Automata-Theoretic LTL Model-Checking p.14

22 Complementation: Example Complement is easy for deterministic Büchi automata: b,c a,c a,b,c a,c a a A q b 0 q 1 A But, Büchi automata are not closed under determinization!!! a,b b a b b b a q 1 q 2 Automata-Theoretic LTL Model-Checking p.14

23 Intersection (Special Case) Büchi automata are closed under intersection [Chouka74]: given two Büchi automata (note all states of B 1 are accepting): B 1 = (Σ,Q 1, 1,Q 0 1,Q 1 ) B 2 = (Σ,Q 2, 2,Q 0 2,F 2 ) Define B = (Σ,Q 1 Q 2,,Q 0 1 Q0 2,Q 1 F 2 ), where ((s 1,s 2 ),a,(s 1,s 2 )) iff (s i,a,s i ) i, i = 1,2 Then, L(B ) = L(B 1 ) L(B 2 ) Automata-Theoretic LTL Model-Checking p.15

24 Intersection (General Case) Main problem: determining accepting states need to go through accepting states of B 1 and B 2 infinite number of times Automata-Theoretic LTL Model-Checking p.16

25 Intersection (General Case) Main problem: determining accepting states need to go through accepting states of B 1 and B 2 infinite number of times Key idea: make 3 copies of the automaton: 1st copy: start and accept here 2nd copy: move from here from 1 when accepting state from B 1 has been seen 3rd copy: move here from 2 when accepting state from B 2 has been seen, then go back to 1 Automata-Theoretic LTL Model-Checking p.16

26 Intersection (General Case) Given two Büchi automata: B 1 = (Σ,Q 1, 1,Q 0 1,F 2 ) B 2 = (Σ,Q 2, 2,Q 0 2,F 2 ) Define B = (Σ,Q 1 Q 2 {0,1,2},,Q 0 1 Q0 2 {0},Q 1 Q 2 {2}), where ((s1,s 2,0),a,(s 1,s 2,0)) iff (s i,a,s i ) i, i = 1,2, and s 1 F 1 ((s1,s 2,1),a,(s 1,s 2,1)) iff (s i,a,s i ) i, i = 1,2, and s 2 F 2 ((s1,s 2,0),a,(s 1,s 2,1)) iff (s i,a,s i ) i, i = 1,2, and s 1 F 1 ((s1,s 2,1),a,(s 1,s 2,2)) iff (s i,a,s i ) i, i = 1,2, and s 2 F 2 ((s1,s 2,2),a,(s 1,s 2,0)) iff (s i,a,s i ) i, i = 1,2 Then, L(B ) = L(B 1 ) L(B 2 ) Automata-Theoretic LTL Model-Checking p.17

27 Complexity The emptiness problem for Büchi automata is decidable L(A) logspace-complete for NLOGSPACE, i.e., solvable in linear time [Vardi, Wolper]) see later in the lecture. Nonuniversality problem for Büchi automata is decidable L(A) Σ ω logspace-complete for PSPACE [Sistla, Vardi, Wolper] Automata-Theoretic LTL Model-Checking p.18

28 Modeling Systems Using Automata A system is a set of all its executions. So, every state is accepting! Transform Kripke structure (S,R,S 0,L), where L : S 2 AP...into automaton A = (Σ,S {l},,{l},s {l}), where Σ = 2 AP (l,α,s ) iff s S 0 and α = L(s) (s,α,s) iff (s,s ) R and α = L(s ) {p,q} l {p} {p} {p,q} s 0 s 1 {p} s 0 s 1 {p,q} {p,q} {q} s 2 {q} s 2 Kripke structure Automaton Automata-Theoretic LTL Model-Checking p.19

29 LTL and Büchi Automata Specification also in the form of an automaton! Büchi automata can encode all LTL properties. Examples: a b Other examples: p (p q) (p q) ( (p U q)) a U b Automata-Theoretic LTL Model-Checking p.20

30 LTL to Büchi Automata Theorem [Wolper, Vardi, Sistla 83]: Given an LTL formula φ, one can build a Büchi automaton S = (Σ,Q,,Q 0,F), where Σ = 2 Prop the number of automatic propositions, variables, etc. in φ Q 2 O( φ ), where φ is the length of the formula... s.t. L(S) is exactly the set of computations satisfying the formula φ. Algorithm: see Section 9.4 of Model Checking book or try one of the online tools: But Büchi automata are more expressive than LTL! Automata-Theoretic LTL Model-Checking p.21

31 Automata-theoretic Model Checking The system A satisfies the specification S when L(A) L(S)... each behavior of the system is among the allowed behaviours Alternatively, let L(S) be the language Σ ω L(S). Then, L(A) L(S) L(A) L(S) = no behavior of A is prohibited by S If the intersection is not empty, any behavior in it corresponds to a counterexample. Counterexamples are always of the form uv ω, where u and v are finite words. Automata-Theoretic LTL Model-Checking p.22

32 Complexity Checking whether a formula φ is satisfied by a finite-state model K can be done in time O( K 2 O( φ ) ) or in space O((log K + φ ) 2 ). i.e., checking is polynomial in the size of the model and exponential in the size of the specification. Automata-Theoretic LTL Model-Checking p.23

33 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Automata-Theoretic LTL Model Checking p.2

34 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? a b f e c d Automata-Theoretic LTL Model Checking p.2

35 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No it accepts a(bef) ω a b f e c d Automata-Theoretic LTL Model Checking p.2

36 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No it accepts a(bef) ω a b f e c d Automata-Theoretic LTL Model Checking p.2

37 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No it accepts a(bef) ω a b f e c d Automata-Theoretic LTL Model Checking p.2

38 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No it accepts a(bef) ω a b f e c d Automata-Theoretic LTL Model Checking p.2

39 Emptiness of Büchi Automata An automation is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No it accepts a(bef) ω a b f e c d Automata-Theoretic LTL Model Checking p.2

40 LTL Model-Checking LTL Model-Checking = Emptiness of Büchi automata a tiny bit of automata theory + trivial graph-theoretic problem typical solution use depth-first search (DFS) Problem: state-explosion the graph is HUGE End result: LTL model-checking a very elaborate DFS Automata-Theoretic LTL Model Checking p.3

41 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

42 Depth-First Search Refresher 1 Automata-Theoretic LTL Model Checking p.4

43 Depth-First Search Refresher 1 2 Automata-Theoretic LTL Model Checking p.4

44 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

45 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

46 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

47 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

48 Depth-First Search Refresher Automata-Theoretic LTL Model Checking p.4

49 Depth-First Search Refresher Depth-first tree Automata-Theoretic LTL Model Checking p.4

50 DFS The Algorithm 1: time:=0 2: proc DF S(v) 3: add v to Visited 4: d[v]:= time 5: time:=time+1 6: for all w succ(v) do 7: if w Visited then 8: DF S(w) 9: end if 10: end for 11: f[v]:=time 12: time:=time+1 13: end proc Automata-Theoretic LTL Model Checking p.5

51 DFS Data Structures implicit STACK stores the current path through the graph Visited table stores visited nodes used to avoid cycles for each node discovery time array d finishing time array f Automata-Theoretic LTL Model Checking p.6

52 What we want Running time at most linear anything else is not feasible Memory requirements sequentially accessed (for the STACK) disk storage is good enough assume unlimited supply so can ignore randomly accessed (for hash tables) must use RAM limited resource minimize why cannot use virtual memory? Automata-Theoretic LTL Model Checking p.7

53 Additionally... Counterexamples an automaton is non-empty iff exists an accepting run this is the counterexample we want it Approximate solutions partial result is better than nothing! Automata-Theoretic LTL Model Checking p.8

54 DFS Complexity Running time each node is visited once linear in the size of the graph Memory the STACK accessed sequentially can store on disk ignore Visited table randomly accessed important Visited = S n n number of nodes in the graph S number of bits needed to represent each node Automata-Theoretic LTL Model Checking p.9

55 Take 1 Tarjan s SCC algorithm Idea: find all maximal SCCs: SCC 1, SCC 2, etc. an automaton is non-empty iff exists SCC i containing an accepting state Automata-Theoretic LTL Model Checking p.10

56 Take 1 Tarjan s SCC algorithm Idea: find all maximal SCCs: SCC 1, SCC 2, etc. an automaton is non-empty iff exists SCC i containing an accepting state Fact: each SCC is a sub-tree of DFS-tree need to find roots of these sub-trees Automata-Theoretic LTL Model Checking p.10

57 Take 1 Tarjan s SCC algorithm Idea: find all maximal SCCs: SCC 1, SCC 2, etc. an automaton is non-empty iff exists SCC i containing an accepting state 1 Fact: each SCC is a sub-tree of DFS-tree need to find roots of these sub-trees Automata-Theoretic LTL Model Checking p.10

58 Finding a Root of an SCC For each node v, compute lowlink[v] lowlink[v] is the minimum of discovery time of v discovery time of w, where w belongs to the same SCC as v the length of a path from v to w is at least 1 Fact: v is a root of an SCC iff d[v] = lowlink[v] Automata-Theoretic LTL Model Checking p.11

59 Finally: the algorithm 1: proc SCC_SEARCH(v) 2: add v to Visited 3: d[v]:= time 4: time:=time+1 5: lowlink[v]:= d[v] 6: push v on STACK 7: for all w succ(v) do 8: if w Visited then 9: SCC_SEARCH(w) 10: lowlink[v]:= min(lowlink[v], lowlink[w]) 11: else if d[w] < d[v] and w is on STACK then 12: lowlink[v]:= min(d[w], lowlink[v]) 13: end if 14: end for 15: if lowlink[v] = d[v] then 16: repeat 17: pop x from top of STACK 18: if x F then 19: terminate with Yes 20: end if 21: until x = v 22: end if 23: end proc Automata-Theoretic LTL Model Checking p.12

60 Finally: the algorithm 1: proc SCC_SEARCH(v) 2: add v to Visited 3: d[v]:= time 4: time:=time+1 5: lowlink[v]:= d[v] 6: push v on STACK 7: for all w succ(v) do 8: if w Visited then 9: SCC_SEARCH(w) 10: lowlink[v]:= min(lowlink[v], lowlink[w]) 11: else if d[w] < d[v] and w is on STACK then 12: lowlink[v]:= min(d[w], lowlink[v]) : end if 14: end for 15: if lowlink[v] = d[v] then 16: repeat 17: pop x from top of STACK 18: if x F then 19: terminate with Yes 20: end if 21: until x = v 22: end if 23: end proc Automata-Theoretic LTL Model Checking p.12

61 Tarjan s SCC algorithm Analysis Running time linear in the size of the graph Memory STACK sequential, ignore Visited O(S n) lowlink logn n n is not known a priori assume n is at least 2 32 Counterexamples can be extracted from the STACK even more get multiple counterexamples If we sacrifice some of generality, can we do better? Automata-Theoretic LTL Model Checking p.13

62 Take 2 Two Sweeps Don t look for maximal SCCs Find a reachable accepting state that is on a cycle Idea: use two sweeps sweep one: find all accepting states sweep two: look for cycles from accepting states Automata-Theoretic LTL Model Checking p.14

63 Take 2 Two Sweeps Don t look for maximal SCCs Find a reachable accepting state that is on a cycle Idea: use two sweeps sweep one: find all accepting states sweep two: look for cycles from accepting states Problem? no longer a linear algorithm (revisit the states multiple times) Automata-Theoretic LTL Model Checking p.14

64 Take 2 Two Sweeps Don t look for maximal SCCs Find a reachable accepting state that is on a cycle Idea: use two sweeps sweep one: find all accepting states sweep two: look for cycles from accepting states Problem? no longer a linear algorithm (revisit the states multiple times) Automata-Theoretic LTL Model Checking p.14

65 Fixing non-linearity Graph Theoretic Result: let v and u be two nodes, such that f[v] < f[u] v is not on a cycle then, no cycle containing u contains nodes reachable from v Automata-Theoretic LTL Model Checking p.15

66 Fixing non-linearity Graph Theoretic Result: let v and u be two nodes, such that f[v] < f[u] v is not on a cycle then, no cycle containing u contains nodes reachable from v Automata-Theoretic LTL Model Checking p.15

67 Fixing non-linearity Graph Theoretic Result: let v and u be two nodes, such that f[v] < f[u] v is not on a cycle then, no cycle containing u contains nodes reachable from v Automata-Theoretic LTL Model Checking p.15

68 Take 3 Double DFS 1: proc DFS1(v) 2: add v to Visited 3: for all w succ(v) do 4: if w Visited then 5: DF S1(w) 6: end if 7: end for 8: if v F then 9: add v to Q 10: end if 11: end proc 1: proc DFS2(v,f) 2: add v to Visited 3: for all w succ(v) do 4: if v = f then 5: terminate with Yes 6: else if w Visited then 7: DFS2(w,f) 8: end if 9: end for 10: end proc 1: proc SWEEP2(Q) 2: while Q [] do 3: f := dequeue(q) 4: DFS2(f,f) 5: end while 6: terminate with No 7: end proc 1: proc DDFS(v) 2: Q = 3: Visited = 4: DF S1(v) 5: Visited = 6: SW EEP 2(Q) 7: end proc Automata-Theoretic LTL Model Checking p.16

69 Double DFS Analysis Running time linear! (single V isited table for different final states, so no state is processed twice) Memory requirements O(n S) Problem where is the counterexample?! Automata-Theoretic LTL Model Checking p.17

70 Take 4 Nested DFS Idea when an accepting state is finished stop first sweep start second sweep if cycle is found, we are done otherwise, restart the first sweep As good as double DFS, but does not need to always explore the full graph counterexample is readily available a path to an accepting state is on the stack of the first sweep a cycle is on the stack of the second Automata-Theoretic LTL Model Checking p.18

71 A Few More Tweaks No need for two Visited hashtables empty hashtable wastes space merge into one by adding one more bit to each node (v,0) Visited iff v was seen by the first sweep (v,1) Visited iff v was seen by the second sweep Early termination condition nested DFS can be terminated as soon as it finds a node that is on the stack of the first DFS Automata-Theoretic LTL Model Checking p.19

72 Nested DFS 1: proc DF S1(v) 2: add (v,0) to Visited 3: for all w succ(v) do 4: if (w,0) Visited then 5: DF S1(w) 6: end if 7: end for 8: if v F then 9: DF S2(v, v) 10: end if 11: end proc 1: proc DFS2(v,f) 2: add (v,1) to Visited 3: for all w succ(v) do 4: if v = f then 5: terminate with Yes 6: else if (w,1) Visited then 7: DFS2(w,f) 8: end if 9: end for 10: end proc Automata-Theoretic LTL Model Checking p.20

73 On-the-fly Model-Checking Typical problem consists of description of several process P 1,P 2,... property ϕ in LTL Before applying DFS algorithm construct graph for P = Π n i= 1 P i construct Büchi automaton A ϕ for ϕ construct Büchi automaton for P A ϕ Automata-Theoretic LTL Model Checking p.21

74 On-the-fly Model-Checking Typical problem consists of description of several process P 1,P 2,... property ϕ in LTL Before applying DFS algorithm construct graph for P = Π n i= 1 P i construct Büchi automaton A ϕ for ϕ construct Büchi automaton for P A ϕ But, all constructions can be done in DFS order combine everything with the search result: on-the-fly algorithm, only the necessary part of the graph is built Automata-Theoretic LTL Model Checking p.21

75 Symbolic LTL Model-Checking LTL Model-Checking = Finding a reachable cycle Represent the graph symbolically and use symbolic techniques to search There exists an infinite path from s, iff s = EG true the graph is finite infinite cyclic! exists a cycle containing an accepting state a iff a occurs infinitely often use fairness to capture accepting states LTL Model-Checking = EG true under fairness! Automata-Theoretic LTL Model Checking p.28

### Automata-based Verification - III

COMP30172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20: email: howard.barringer@manchester.ac.uk March 2009 Third Topic Infinite Word Automata Motivation Büchi Automata

### Introduction. Büchi Automata and Model Checking. Outline. Büchi Automata. The simplest computation model for infinite behaviors is the

Introduction Büchi Automata and Model Checking Yih-Kuen Tsay Department of Information Management National Taiwan University FLOLAC 2009 The simplest computation model for finite behaviors is the finite

### Automata, Logic and Games: Theory and Application

Automata, Logic and Games: Theory and Application 1. Büchi Automata and S1S Luke Ong University of Oxford TACL Summer School University of Salerno, 14-19 June 2015 Luke Ong Büchi Automata & S1S 14-19 June

### Tecniche di Specifica e di Verifica. Automata-based LTL Model-Checking

Tecniche di Specifica e di Verifica Automata-based LTL Model-Checking Finite state automata A finite state automaton is a tuple A = (Σ,S,S 0,R,F) Σ: set of input symbols S: set of states -- S 0 : set of

### Tecniche di Specifica e di Verifica. Automata-based LTL Model-Checking

Tecniche di Specifica e di Verifica Automata-based LTL Model-Checking Finite state automata A finite state automaton is a tuple A = (S,S,S 0,R,F) S: set of input symbols S: set of states -- S 0 : set of

### Büchi Automata and Linear Temporal Logic

Büchi Automata and Linear Temporal Logic Joshua D. Guttman Worcester Polytechnic Institute 18 February 2010 Guttman ( WPI ) Büchi & LTL 18 Feb 10 1 / 10 Büchi Automata Definition A Büchi automaton is a

### The State Explosion Problem

The State Explosion Problem Martin Kot August 16, 2003 1 Introduction One from main approaches to checking correctness of a concurrent system are state space methods. They are suitable for automatic analysis

### Chapter 3: Linear temporal logic

INFOF412 Formal verification of computer systems Chapter 3: Linear temporal logic Mickael Randour Formal Methods and Verification group Computer Science Department, ULB March 2017 1 LTL: a specification

### Lecture 17: Language Recognition

Lecture 17: Language Recognition Finite State Automata Deterministic and Non-Deterministic Finite Automata Regular Expressions Push-Down Automata Turing Machines Modeling Computation When attempting to

### Büchi Automata and their closure properties. - Ajith S and Ankit Kumar

Büchi Automata and their closure properties - Ajith S and Ankit Kumar Motivation Conventional programs accept input, compute, output result, then terminate Reactive program : not expected to terminate

### Timo Latvala. March 7, 2004

Reactive Systems: Safety, Liveness, and Fairness Timo Latvala March 7, 2004 Reactive Systems: Safety, Liveness, and Fairness 14-1 Safety Safety properties are a very useful subclass of specifications.

### Definition of Büchi Automata

Büchi Automata Definition of Büchi Automata Let Σ = {a,b,...} be a finite alphabet. By Σ ω we denote the set of all infinite words over Σ. A non-deterministic Büchi automaton (NBA) over Σ is a tuple A

### Further discussion of Turing machines

Further discussion of Turing machines In this lecture we will discuss various aspects of decidable and Turing-recognizable languages that were not mentioned in previous lectures. In particular, we will

### Automata, Logic and Games. C.-H. L. Ong

Automata, Logic and Games C.-H. L. Ong June 12, 2015 2 Contents 0 Automata, Logic and Games 1 0.1 Aims and Prerequisites............................... 1 0.2 Motivation.....................................

### Büchi Automata and Their Determinization

Büchi Automata and Their Determinization Edinburgh, October 215 Plan of the Day 1. Büchi automata and their determinization 2. Infinite games 3. Rabin s Tree Theorem 4. Decidability of monadic theories

### Automata and Reactive Systems

Automata and Reactive Systems Lecture WS 2002/2003 Prof. Dr. W. Thomas RWTH Aachen Preliminary version (Last change March 20, 2003) Translated and revised by S. N. Cho and S. Wöhrle German version by M.

### FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY

15-453 FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY REVIEW for MIDTERM 1 THURSDAY Feb 6 Midterm 1 will cover everything we have seen so far The PROBLEMS will be from Sipser, Chapters 1, 2, 3 It will be

### LTL is Closed Under Topological Closure

LTL is Closed Under Topological Closure Grgur Petric Maretić, Mohammad Torabi Dashti, David Basin Department of Computer Science, ETH Universitätstrasse 6 Zürich, Switzerland Abstract We constructively

### T Reactive Systems: Temporal Logic LTL

Tik-79.186 Reactive Systems 1 T-79.186 Reactive Systems: Temporal Logic LTL Spring 2005, Lecture 4 January 31, 2005 Tik-79.186 Reactive Systems 2 Temporal Logics Temporal logics are currently the most

### Automata Theory and Model Checking

Automata Theory and Model Checking Orna Kupferman Abstract We study automata on infinite words and their applications in system specification and verification. We first introduce Büchi automata and survey

### CSC173 Workshop: 13 Sept. Notes

CSC173 Workshop: 13 Sept. Notes Frank Ferraro Department of Computer Science University of Rochester September 14, 2010 1 Regular Languages and Equivalent Forms A language can be thought of a set L of

### MTAT Complexity Theory October 13th-14th, Lecture 6

MTAT.07.004 Complexity Theory October 13th-14th, 2011 Lecturer: Peeter Laud Lecture 6 Scribe(s): Riivo Talviste 1 Logarithmic memory Turing machines working in logarithmic space become interesting when

### CS5371 Theory of Computation. Lecture 7: Automata Theory V (CFG, CFL, CNF)

CS5371 Theory of Computation Lecture 7: Automata Theory V (CFG, CFL, CNF) Announcement Homework 2 will be given soon (before Tue) Due date: Oct 31 (Tue), before class Midterm: Nov 3, (Fri), first hour

### FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY

5-453 FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY NON-DETERMINISM and REGULAR OPERATIONS THURSDAY JAN 6 UNION THEOREM The union of two regular languages is also a regular language Regular Languages Are

### CISC4090: Theory of Computation

CISC4090: Theory of Computation Chapter 2 Context-Free Languages Courtesy of Prof. Arthur G. Werschulz Fordham University Department of Computer and Information Sciences Spring, 2014 Overview In Chapter

### Lecture 3: Nondeterministic Finite Automata

Lecture 3: Nondeterministic Finite Automata September 5, 206 CS 00 Theory of Computation As a recap of last lecture, recall that a deterministic finite automaton (DFA) consists of (Q, Σ, δ, q 0, F ) where

### Temporal Logic Model Checking

18 Feb, 2009 Thomas Wahl, Oxford University Temporal Logic Model Checking 1 Temporal Logic Model Checking Thomas Wahl Computing Laboratory, Oxford University 18 Feb, 2009 Thomas Wahl, Oxford University

### 1 More finite deterministic automata

CS 125 Section #6 Finite automata October 18, 2016 1 More finite deterministic automata Exercise. Consider the following game with two players: Repeatedly flip a coin. On heads, player 1 gets a point.

### Theory of Computation Lecture 1. Dr. Nahla Belal

Theory of Computation Lecture 1 Dr. Nahla Belal Book The primary textbook is: Introduction to the Theory of Computation by Michael Sipser. Grading 10%: Weekly Homework. 30%: Two quizzes and one exam. 20%:

### Theory of computation: initial remarks (Chapter 11)

Theory of computation: initial remarks (Chapter 11) For many purposes, computation is elegantly modeled with simple mathematical objects: Turing machines, finite automata, pushdown automata, and such.

### of acceptance conditions (nite, looping and repeating) for the automata. It turns out,

Reasoning about Innite Computations Moshe Y. Vardi y IBM Almaden Research Center Pierre Wolper z Universite de Liege Abstract We investigate extensions of temporal logic by connectives dened by nite automata

### Finite Automata and Regular languages

Finite Automata and Regular languages Huan Long Shanghai Jiao Tong University Acknowledgements Part of the slides comes from a similar course in Fudan University given by Prof. Yijia Chen. http://basics.sjtu.edu.cn/

### CSCE 551: Chin-Tser Huang. University of South Carolina

CSCE 551: Theory of Computation Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Church-Turing Thesis The definition of the algorithm came in the 1936 papers of Alonzo Church h and Alan

Introduction: Computer Science is a cluster of related scientific and engineering disciplines concerned with the study and application of computations. These disciplines range from the pure and basic scientific

### Finite State Transducers

Finite State Transducers Eric Gribkoff May 29, 2013 Original Slides by Thomas Hanneforth (Universitat Potsdam) Outline 1 Definition of Finite State Transducer 2 Examples of FSTs 3 Definition of Regular

### Deterministic Finite Automata. Non deterministic finite automata. Non-Deterministic Finite Automata (NFA) Non-Deterministic Finite Automata (NFA)

Deterministic Finite Automata Non deterministic finite automata Automata we ve been dealing with have been deterministic For every state and every alphabet symbol there is exactly one move that the machine

### FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY

15-453 FORMAL LANGUAGES, AUTOMATA AND COMPUTABILITY Chomsky Normal Form and TURING MACHINES TUESDAY Feb 4 CHOMSKY NORMAL FORM A context-free grammar is in Chomsky normal form if every rule is of the form:

### cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska

cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska LECTURE 6 CHAPTER 2 FINITE AUTOMATA 2. Nondeterministic Finite Automata NFA 3. Finite Automata and Regular Expressions 4. Languages

### Equivalence of DFAs and NFAs

CS 172: Computability and Complexity Equivalence of DFAs and NFAs It s a tie! DFA NFA Sanjit A. Seshia EECS, UC Berkeley Acknowledgments: L.von Ahn, L. Blum, M. Blum What we ll do today Prove that DFAs

### Chomsky Normal Form and TURING MACHINES. TUESDAY Feb 4

Chomsky Normal Form and TURING MACHINES TUESDAY Feb 4 CHOMSKY NORMAL FORM A context-free grammar is in Chomsky normal form if every rule is of the form: A BC A a S ε B and C aren t start variables a is

### Finite Automata Part Two

Finite Automata Part Two DFAs A DFA is a Deterministic Finite Automaton A DFA is defined relative to some alphabet Σ. For each state in the DFA, there must be exactly one transition defined for each symbol

### Computation Tree Logic (CTL) & Basic Model Checking Algorithms

Computation Tree Logic (CTL) & Basic Model Checking Algorithms Martin Fränzle Carl von Ossietzky Universität Dpt. of Computing Science Res. Grp. Hybride Systeme Oldenburg, Germany 02917: CTL & Model Checking

### Chapter 4: Computation tree logic

INFOF412 Formal verification of computer systems Chapter 4: Computation tree logic Mickael Randour Formal Methods and Verification group Computer Science Department, ULB March 2017 1 CTL: a specification

### Languages. Non deterministic finite automata with ε transitions. First there was the DFA. Finite Automata. Non-Deterministic Finite Automata (NFA)

Languages Non deterministic finite automata with ε transitions Recall What is a language? What is a class of languages? Finite Automata Consists of A set of states (Q) A start state (q o ) A set of accepting

### Lecture 23 : Nondeterministic Finite Automata DRAFT Connection between Regular Expressions and Finite Automata

CS/Math 24: Introduction to Discrete Mathematics 4/2/2 Lecture 23 : Nondeterministic Finite Automata Instructor: Dieter van Melkebeek Scribe: Dalibor Zelený DRAFT Last time we designed finite state automata

### Before we show how languages can be proven not regular, first, how would we show a language is regular?

CS35 Proving Languages not to be Regular Before we show how languages can be proven not regular, first, how would we show a language is regular? Although regular languages and automata are quite powerful

### Finite Automata (contd)

Finite Automata (contd) CS 2800: Discrete Structures, Fall 2014 Sid Chaudhuri Recap: Deterministic Finite Automaton A DFA is a 5-tuple M = (Q, Σ, δ, q 0, F) Q is a fnite set of states Σ is a fnite input

### Linear Temporal Logic and Büchi Automata

Linear Temporal Logic and Büchi Automata Yih-Kuen Tsay Department of Information Management National Taiwan University FLOLAC 2009 Yih-Kuen Tsay (SVVRL @ IM.NTU) Linear Temporal Logic and Büchi Automata

### cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska

cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska LECTURE 1 Course Web Page www3.cs.stonybrook.edu/ cse303 The webpage contains: lectures notes slides; very detailed solutions to

### Turing machines and linear bounded automata

and linear bounded automata Informatics 2A: Lecture 29 John Longley School of Informatics University of Edinburgh jrl@inf.ed.ac.uk 25 November, 2011 1 / 13 1 The Chomsky hierarchy: summary 2 3 4 2 / 13

### Automata and Computability. Solutions to Exercises

Automata and Computability Solutions to Exercises Spring 27 Alexis Maciel Department of Computer Science Clarkson University Copyright c 27 Alexis Maciel ii Contents Preface vii Introduction 2 Finite Automata

### On Model Checking for Visibly Pushdown Automata

Japan Institute of Advanced Industrial Science and Technology Research Center for Specification and Verification LATA 2012 On Model Checking for Visibly Pushdown Automata Nguyen Van Tang and Hitoshi Ohsaki

### Theory of Computation p.1/?? Theory of Computation p.2/?? Unknown: Implicitly a Boolean variable: true if a word is

Abstraction of Problems Data: abstracted as a word in a given alphabet. Σ: alphabet, a finite, non-empty set of symbols. Σ : all the words of finite length built up using Σ: Conditions: abstracted as a

### CSE 135: Introduction to Theory of Computation Nondeterministic Finite Automata (cont )

CSE 135: Introduction to Theory of Computation Nondeterministic Finite Automata (cont ) Sungjin Im University of California, Merced 2-3-214 Example II A ɛ B ɛ D F C E Example II A ɛ B ɛ D F C E NFA accepting

### Finish K-Complexity, Start Time Complexity

6.045 Finish K-Complexity, Start Time Complexity 1 Kolmogorov Complexity Definition: The shortest description of x, denoted as d(x), is the lexicographically shortest string such that M(w) halts

### Theory of Computation

Theory of Computation Lecture #10 Sarmad Abbasi Virtual University Sarmad Abbasi (Virtual University) Theory of Computation 1 / 43 Lecture 10: Overview Linear Bounded Automata Acceptance Problem for LBAs

### A Symbolic Approach to Safety LTL Synthesis

A Symbolic Approach to Safety LTL Synthesis Shufang Zhu 1 Lucas M. Tabajara 2 Jianwen Li Geguang Pu 1 Moshe Y. Vardi 2 1 East China Normal University 2 Rice Lucas M. Tabajara (Rice University) 2 University

### Models for Efficient Timed Verification

Models for Efficient Timed Verification François Laroussinie LSV / ENS de Cachan CNRS UMR 8643 Monterey Workshop - Composition of embedded systems Model checking System Properties Formalizing step? ϕ Model

### Nondeterministic finite automata

Lecture 3 Nondeterministic finite automata This lecture is focused on the nondeterministic finite automata (NFA) model and its relationship to the DFA model. Nondeterminism is an important concept in the

### Theory of Computation

Thomas Zeugmann Hokkaido University Laboratory for Algorithmics http://www-alg.ist.hokudai.ac.jp/ thomas/toc/ Lecture 3: Finite State Automata Motivation In the previous lecture we learned how to formalize

### Introduction to the Theory of Computation. Automata 1VO + 1PS. Lecturer: Dr. Ana Sokolova.

Introduction to the Theory of Computation Automata 1VO + 1PS Lecturer: Dr. Ana Sokolova http://cs.uni-salzburg.at/~anas/ Setup and Dates Lectures and Instructions 23.10. 3.11. 17.11. 24.11. 1.12. 11.12.

### Clarifications from last time. This Lecture. Last Lecture. CMSC 330: Organization of Programming Languages. Finite Automata.

CMSC 330: Organization of Programming Languages Last Lecture Languages Sets of strings Operations on languages Finite Automata Regular expressions Constants Operators Precedence CMSC 330 2 Clarifications

### Time Complexity (1) CSCI Spring Original Slides were written by Dr. Frederick W Maier. CSCI 2670 Time Complexity (1)

Time Complexity (1) CSCI 2670 Original Slides were written by Dr. Frederick W Maier Spring 2014 Time Complexity So far we ve dealt with determining whether or not a problem is decidable. But even if it

CMPSCI611: NP Completeness Lecture 17 Essential facts about NP-completeness: Any NP-complete problem can be solved by a simple, but exponentially slow algorithm. We don t have polynomial-time solutions

### 6.045 Final Exam Solutions

6.045J/18.400J: Automata, Computability and Complexity Prof. Nancy Lynch, Nati Srebro 6.045 Final Exam Solutions May 18, 2004 Susan Hohenberger Name: Please write your name on each page. This exam is open

### automata-theoretic model checking

automata-theoretic model checking Kousha Etessami Bell Labs (starting next week, my affiliation will be U. of Edinburgh) overview The purpose of my lectures: to cover the fundamental algorithms used in

### DM17. Beregnelighed. Jacob Aae Mikkelsen

DM17 Beregnelighed Jacob Aae Mikkelsen January 12, 2007 CONTENTS Contents 1 Introduction 2 1.1 Operations with languages...................... 2 2 Finite Automata 3 2.1 Regular expressions/languages....................

### Properties of Regular Languages. BBM Automata Theory and Formal Languages 1

Properties of Regular Languages BBM 401 - Automata Theory and Formal Languages 1 Properties of Regular Languages Pumping Lemma: Every regular language satisfies the pumping lemma. A non-regular language

### Introduction to the Theory of Computation. Automata 1VO + 1PS. Lecturer: Dr. Ana Sokolova.

Introduction to the Theory of Computation Automata 1VO + 1PS Lecturer: Dr. Ana Sokolova http://cs.uni-salzburg.at/~anas/ Setup and Dates Lectures Tuesday 10:45 pm - 12:15 pm Instructions Tuesday 12:30

### Model Checking of Safety Properties

Model Checking of Safety Properties Orna Kupferman Hebrew University Moshe Y. Vardi Rice University October 15, 2010 Abstract Of special interest in formal verification are safety properties, which assert

### Automata Theory for Presburger Arithmetic Logic

Automata Theory for Presburger Arithmetic Logic References from Introduction to Automata Theory, Languages & Computation and Constraints in Computational Logic Theory & Application Presented by Masood

### Turing Machines Part II

Turing Machines Part II Hello Hello Condensed Slide Slide Readers! Readers! This This lecture lecture is is almost almost entirely entirely animations that that show show how how each each Turing Turing

### Pushdown Automata. We have seen examples of context-free languages that are not regular, and hence can not be recognized by finite automata.

Pushdown Automata We have seen examples of context-free languages that are not regular, and hence can not be recognized by finite automata. Next we consider a more powerful computation model, called a

### Definition: Alternating time and space Game Semantics: State of machine determines who

CMPSCI 601: Recall From Last Time Lecture Definition: Alternating time and space Game Semantics: State of machine determines who controls, White wants it to accept, Black wants it to reject. White wins

### Theory of Computation 4 Non-Deterministic Finite Automata

Theory of Computation 4 Non-Deterministic Finite Automata Frank Stephan Department of Computer Science Department of Mathematics National University of Singapore fstephan@comp.nus.edu.sg Theory of Computation

### Variants of Turing Machine (intro)

CHAPTER 3 The Church-Turing Thesis Contents Turing Machines definitions, examples, Turing-recognizable and Turing-decidable languages Variants of Turing Machine Multi-tape Turing machines, non-deterministic

### CS243, Logic and Computation Nondeterministic finite automata

CS243, Prof. Alvarez NONDETERMINISTIC FINITE AUTOMATA (NFA) Prof. Sergio A. Alvarez http://www.cs.bc.edu/ alvarez/ Maloney Hall, room 569 alvarez@cs.bc.edu Computer Science Department voice: (67) 552-4333

### Antichains: A New Algorithm for Checking Universality of Finite Automata

Antichains: A New Algorithm for Checking Universality of Finite Automata M. De Wulf 1, L. Doyen 1, T. A. Henzinger 2,3, and J.-F. Raskin 1 1 CS, Université Libre de Bruxelles, Belgium 2 I&C, Ecole Polytechnique

### Applied Automata Theory

Applied Automata Theory Roland Meyer TU Kaiserslautern Roland Meyer (TU KL) Applied Automata Theory (WiSe 2013) 1 / 161 Table of Contents I 1 Regular Languages and Finite Automata Regular Languages Finite

### Chapter 3. Regular grammars

Chapter 3 Regular grammars 59 3.1 Introduction Other view of the concept of language: not the formalization of the notion of effective procedure, but set of words satisfying a given set of rules Origin

### Before We Start. The Pumping Lemma. Languages. Context Free Languages. Plan for today. Now our picture looks like. Any questions?

Before We Start The Pumping Lemma Any questions? The Lemma & Decision/ Languages Future Exam Question What is a language? What is a class of languages? Context Free Languages Context Free Languages(CFL)

### September 7, Formal Definition of a Nondeterministic Finite Automaton

Formal Definition of a Nondeterministic Finite Automaton September 7, 2014 A comment first The formal definition of an NFA is similar to that of a DFA. Both have states, an alphabet, transition function,

### Component-wise Incremental LTL Model Checking

Component-wise Incremental LTL Model Checking Vince Molnár 1, András Vörös 1, Dániel Darvas 1, Tamás Bartha 2 and István Majzik 1 1 Department of Measurement and Information Systems, Budapest University

### From Monadic Second-Order Definable String Transformations to Transducers

From Monadic Second-Order Definable String Transformations to Transducers Rajeev Alur 1 Antoine Durand-Gasselin 2 Ashutosh Trivedi 3 1 University of Pennsylvania 2 LIAFA, Université Paris Diderot 3 Indian

### Property Checking of Safety- Critical Systems Mathematical Foundations and Concrete Algorithms

Property Checking of Safety- Critical Systems Mathematical Foundations and Concrete Algorithms Wen-ling Huang and Jan Peleska University of Bremen {huang,jp}@cs.uni-bremen.de MBT-Paradigm Model Is a partial

### 6.841/18.405J: Advanced Complexity Wednesday, February 12, Lecture Lecture 3

6.841/18.405J: Advanced Complexity Wednesday, February 12, 2003 Lecture Lecture 3 Instructor: Madhu Sudan Scribe: Bobby Kleinberg 1 The language MinDNF At the end of the last lecture, we introduced the

### Finite Automata Part One

Finite Automata Part One Computability Theory What problems can we solve with a computer? What problems can we solve with a computer? What kind of computer? Computers are Messy http://www.intel.com/design/intarch/prodbref/27273.htm

### Turing Machine Variants

CS311 Computational Structures Turing Machine Variants Lecture 12 Andrew Black Andrew Tolmach 1 The Church-Turing Thesis The problems that can be decided by an algorithm are exactly those that can be decided

### Chapter 2: Finite Automata

Chapter 2: Finite Automata 2.1 States, State Diagrams, and Transitions Finite automaton is the simplest acceptor or recognizer for language specification. It is also the simplest model of a computer. A

### CHAPTER 1 Regular Languages. Contents

Finite Automata (FA or DFA) CHAPTER Regular Languages Contents definitions, examples, designing, regular operations Non-deterministic Finite Automata (NFA) definitions, euivalence of NFAs and DFAs, closure

### Undecidable Problems and Reducibility

University of Georgia Fall 2014 Reducibility We show a problem decidable/undecidable by reducing it to another problem. One type of reduction: mapping reduction. Definition Let A, B be languages over Σ.

### Decidability and Undecidability

Decidability and Undecidability Major Ideas from Last Time Every TM can be converted into a string representation of itself. The encoding of M is denoted M. The universal Turing machine U TM accepts an

### Uses of finite automata

Chapter 2 :Finite Automata 2.1 Finite Automata Automata are computational devices to solve language recognition problems. Language recognition problem is to determine whether a word belongs to a language.

### CS357: CTL Model Checking (two lectures worth) David Dill

CS357: CTL Model Checking (two lectures worth) David Dill 1 CTL CTL = Computation Tree Logic It is a propositional temporal logic temporal logic extended to properties of events over time. CTL is a branching

### cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska

cse303 ELEMENTS OF THE THEORY OF COMPUTATION Professor Anita Wasilewska LECTURE 14 SMALL REVIEW FOR FINAL SOME Y/N QUESTIONS Q1 Given Σ =, there is L over Σ Yes: = {e} and L = {e} Σ Q2 There are uncountably

### Extended transition function of a DFA

Extended transition function of a DFA The next two pages describe the extended transition function of a DFA in a more detailed way than Handout 3.. p./43 Formal approach to accepted strings We define the

### ECS 120: Theory of Computation UC Davis Phillip Rogaway February 16, Midterm Exam

ECS 120: Theory of Computation Handout MT UC Davis Phillip Rogaway February 16, 2012 Midterm Exam Instructions: The exam has six pages, including this cover page, printed out two-sided (no more wasted