Representing Temporal System Properties Specified with CCTL formulas using Finite Automaton

Transcription

1 University of Granada Investigation Group Sistemas Concurrentes SISTEMAS CONCURRENTES Technical Report UGR SC February 2008 Representing Temporal System Properties Specified with CCTL formulas using Finite Automaton by Luis E. Mendoza Morales Processes and Systems Department Simón Bolívar University Manuel I. Capel Tuñón Software Engineering Department University of Granada SISTEMAS CONCURRENTES is an investigation group of the Software Engineering Department at the University of Granada, registered in the Junta de Andalucía Council under TIC 157 code. Address: Escuela Técnica Superior de Ingeniería Informática, C/ Periodista Daniel Saucedo Aranda s/n, Granada, Spain. Telephone: Fax: URL: sc/.

2 ABSTRACT Model Checking (MC) techniques uses some logical formalism, as temporal logic, to specify the behavioural properties of the system execution over time. The introduction of temporal logic MC algorithms allows reasoning about concurrency and correct sequence of events to be automated. To this end MC tools use a type of state transition graph (finite automaton) called Kripke structure to capture the behaviour of reactive systems. This technical report presents an algorithm to construct a finite automaton which can generate all the infinite sequences that satisfy a given discrete time property expressed by means of one or several Clocked Computation Tree Logic (CCTL) formulas, in such a way that accepted structures by the Kripke structure and the models of these are equivalent. We can use this graphical representation to perform the system discrete time verification according to a CCTL specification and also to integrate it into an on the fly model checking method. Keywords: Model checking, Temporal logic, Automaton generation, Discrete time verification, CCTL.

3 1 Introduction Model Checking (MC) technique has become to be a successful technique, frequently used to uncover well hidden bugs in sizeable industrial cases (several tools and MC applications are described in [2]). However, MC algorithms are affected by the combinatorial explosion of the search space which is induced as a consequence of testing realistic finite state systems models, which usually have thousands of control states, with respect to a model of the system properties. According to [12] the main idea of MC algorithms is the following one: the syntax graph (automaton) of the formula to check is obtained, the sets of configurations representing subformulas are computed bottom up, and finally whether the set of initial states is a subset of the extension set of the complete formula is checked. The best suited systems for verification by MC are those that are easily modeled by (finite) automata 1 [2], also called a Kripke structure [7]. The availability of such graphical representations is one of the benefits of automata based formalisms. These representations provide the possibility of building relatively abstract graphical representations of complex models of a systems s execution. In the literature we can find several articles that shows that temporal logic formulas can be translated into equivalent Büchi automata [8]. For example, some works with ETL f, ETL l and ETL r [16] temporal logics, others with CTL and CTL [3], other obtain an automaton from LTL [9] formulas, and more recently an algorithm developed to construct a finite automata from FIL formulas [10, 11]. An interesting point of [9, 10, 11] is that the described algorithms executed according to the on the fly 2 technique. Although the algorithm presented in this technical report is based on the latter ones, the key difference with the other works is our algorithm addresses the temporal logic formulas interpreted according an interval logic. This interpretation is useful when we need analyze and verify real time systems timing properties. Each interval represents a specific temporal context (the time when the formula must be valid), which is a subset of states of the global context, on which temporal formulas obtain a different interpretation from the case no interval is specified. In prior work [10] was established that in case of real time and reactive systems, not all temporal logic languages have the same capability to describe the properties of complex systems or can be used with the same effectiveness. In this sense, we have adopted Clocked Computation Tree Logic (CCTL) [13], which allows its formulas to be graphically represented by means of a kind of timing diagram that corresponds very closely to a human being s mental picture of time 3. CCTL is therefore capable of accurately describe complex system 1 An automaton is a machine evolving from one state to another under the action of transitions. An automaton (or part of an automaton) is often depicted by drawing each state as a circle and each transition as an arrow. An incoming arrow without origin identifies the initial state [2, 7]. 2 The automaton is only generated as needed during the verification process. 3 In order to represent real time systems, CCTL uses the timed transition systems introduced by [4], where transitions are labelled by natural numbers that denote the time consumption of the action associated with the transition.

4 2 time properties, while at the same time, preserves its ease of use for non mathematical experts, which represents and this is its main advantage over other textual logics, such as Linear Temporal Logic (LTL) or Computation Tree Logic (CTL). In this work, (a) we present a new algorithm to construct Kripke structures A ϑ from a ϑ CCTL formula, (b) we show that these structures (a kind of automaton) can generate all the finite sequences (of a system model execution) that satisfy a temporal property (described by a discrete time specification), and (c) we show that the automaton (Kripke structure) execution sequences and the models satisfied by de CCTL formula are equivalent. We can use this graphical representation to perform the system discrete time verification according to a CCTL specification, which can also be integrated into an on the fly model checking method [10, 11]. The technical report is structured as follows. First, basic definitions of timed automata and timed Büchi automata, CCTL temporal logic, and fixpoint characterization, are are given. After, we will describe the algorithm in detail and how to derive the timed automaton which is semantically equivalent to the set of CCTL formulas that make up the system specification. Next, is applied the procedure to an example. Finally, we will present the intended future development and the main conclusions of the work that has been carried out. 2 Formal framework 2.1 Timed automata Timed automata have been first proposed in [1] as an extension of the automata theoretic approach to the modeling of real time systems. Timed automata accept timed words, i.e., the occurrence of a real time value is associated with each symbol. In short, a timed automaton is a finite state machine equipped with a set of clocks. Clocks are piece wise continuous real valued functions of time (a dense time model) that precisely record the time elapsed between events. Clocks are allowed to be reset to a new value which becomes the initial value of the next continuous transition. Transitions are associated with a guard (time constraint) which is a predicate over the clocks. The guard determines when a transition can be taken. Timed Automaton. A timed automaton (TA) A, is a tuple Σ, S, I, C, R, where Σ is an input alphabet, S is a finite set of states, I S is the set of initial states, C is a finite set of clocks, and R S S Σ 2 C Φ(C) give the set of transitions. An edge s, s, a, λ, δ R represents a transition from state s to state s on input symbol a. The set λ C gives the clocks to be reset with this transition, and δ is a clock constraint over C. A timed word (string, sequence) over an alphabet Σ is a pair ( σ, τ) where σ is an infinite word and τ is a time sequence. For a timed word ( ρ, τ), a run r = ( s, ν) of a timed automata ia a infinite sequence r : s 0, v 0 σ 1,τ 1 s 1, v 1 σ 2,τ 2 s 2, v 2 σ 3,τ 3..., where

5 3 s 0 S 0, for all t C, v 0 (t) = 0, and an edge s i 1, s i, σ i, λ i, δ i R exists for all i 1 such that (v i 1 + τ i τ i 1 ) satisfies δ i and v i = [λ i 0](v i 1 + τ i τ i 1 ). For such a run, inf(r) = {s S s = s i for infinitely many i 0 runs}. Different kinds of ω automata are defined by adding an acceptance condition (i.e., accepting states rather than final states) to the definition of the transition relationships (e.g., Büchi, Muller, Rabin). We use TBA because these are the simplest automata over infinite words [7] and with these we can represent time regular processes [5]. Timed Büchi Automaton. A timed Büchi automaton (TBA) A, is a tuple Σ, S, I, C, R, F, where Σ, S, I, C, R is a timed automata, and F S is the set of accepting states. A run r = ( s, ν) of a TBA over a timed word (σ, τ) is accepted if it contains some acceptation state an infinite number of times; or more formally, iff inf(r) F. F can be empty, in that case all the infinite words which can be derived of an automaton run are accepted. As we see, a run of a Büchi Automaton A over an infinite word ( σ, τ) Σ ω is defined in almost the same way as a run of a finite automaton over a finite word, except that now v = ω [7]. 2.2 CCTL Clocked Computation Tree Logic (CCTL) [13] temporal logic [14] is used to reason with sequences of states, where a state is a certain interpretation which assigns truth values to the atomic propositions of the language and time is isomorphic to the set of non negative integers. CCTL includes the CTL [6] with the operators until (U) and the operator next (X) and other derived operators in LTL, such as R, B, C and S, useful to ease real time systems properties specification. All LTL-like temporal operators are preceded by a run quantor (A universal, E existential) which determines whether the temporal operator must be interpreted over one run (existential quantification) or over every run (universal quantification) starting in the actual configuration. See [15] for more details. Sintax of CCTL. Given an atomic proposition p P, the arbitrary CCTL formulae ϕ and ψ, and the time bounds a N and b N { }, the syntax of CCTL is defined by: p ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ EX [a] ϕ EF [a,b] ϕ EG [a,b] ϕ E(ϕU [a,b] ψ) ϕ := E(ϕR [a,b] ψ) E(ϕB [a,b] ψ) E(ϕC [a] ψ) E(ϕS [a] ψ) (1) AX [a] ϕ AF [a,b] ϕ AG [a,b] ϕ A(ϕU [a,b] ψ) A(ϕR [a,b] ψ) A(ϕB [a,b] ψ) A(ϕC [a] ψ) A(ϕS [a] ψ) Interval logics allow us to carry out a logical reasoning at the level of time intervals, instead of instants. Within our approach, the basic model for understanding real time systems is the interval structure [15], i.e., a state transition system with labelled transitions, assuming that every interval structure has exactly one clock for the measure of time.

6 4 Interval structure. An interval structure (IS) is a quintuple I = P, S, T, L, I with a set of atomic propositions P, a set of states S, a set of initial states I, a function T : S S ω (N 0 ) that connects states with labelled transitions and a state labelling function L : S (P ). Now we associate states with clock values: Configuration. A configuration is a pair g = (s, ν) S N 0 where the state s is associated with a possible clock value ν. The set of all configurations is: G = {(s, ν) (s, ν) S N 0 and 0 ν max time(s)} (2) A clock interpretation ν for a set C of clocks assigns a natural value to each clock; that is, it is a mapping from C to N 0. We say that a clock interpretation ν for C satisfies a clock constraint δ over C iff δ evaluates to true using the values given by ν. For t N 0, ν + t denotes the clock interpretation which maps every clock x to the value ν(x) + t, and the clock interpretation t ν assigns to each clock x the value t ν(x). For Y C, [Y t]ν denotes the clock interpretation for C which assigns t to each x Y, and agrees with ν over the rest of the clocks. Nevertheless, and unlike other interval logics, the semantics of CCTL temporal operators is interpreted over intervals made of instants, which is given by the validation relation: Validation relation of CCTL. Given an IS I = P, S, T, L, I, a configuration g 0 = (s, v) G, and the time bounds a N and b N { }, where: I, g 0 = p : p L(s) I, g 0 = ϕ : not I, g 0 = ϕ I, g 0 = (ϕ ψ) : I, g 0 = ϕ and I, g 0 = ψ I, g 0 = EX [a] ϕ : there ex. a run r = (g 0,... ) s.t. i > a holds I, g i = ϕ I, g 0 = EF [a,b] ϕ : there ex. a run r = (g 0,... ) s.t. i a i b holds I, g i = ϕ I, g 0 = EG [a,b] ϕ : there ex. a run r = (g 0,... ) s.t. i a i b holds I, g i = ϕ I, g 0 = E(ϕU [a,b] ψ) : there ex. a run r = (g 0,... ) and an a i b s.t. g i = ψ and j < i holds I, g j = ϕ The other operators may be derived by the defined ones: I, g 0 = AX [a] ϕ : EX [a] ϕ I, g 0 = AF [a,b] ϕ : EG [a,b] ϕ I, g 0 = AG [a,b] ϕ : EF [a,b] ϕ I, g 0 = A(ϕU [a,b] ψ) : E[ ψu( ϕ ψ)] EG ψ (3) (4) (5)

7 5 X [a] ϕ The formula ϕ has to hold after exactly the time a. F [a,b] ϕ The formula ϕ has to hold at least once within the interval [a,b]. G [a,b] ϕ The formula ϕ has to hold at all time of the interval [a,b]. The formula ψ has to become true within the interval ϕu [a,b] ψ [a,b] and all time steps before, the formula ϕ has to be valid. Its the logical dual of the U operator. The formula ψ has to become true along the interval [a,b] up to and ϕr [a,b] ψ including the first time instance where the formula ϕ has to be valid. However, the formula ϕ is not required to hold eventually. If ψ becomes true within the interval [a,b] then ϕ has ϕb [a,b] ψ to be valid at one time instance before this event. Otherwise ϕ has to be valid at least once up to the time b. If the formula ϕ is true on the current run up to the ϕc [a] ψ time a 1 then the formula ψ has to hold at time a. From time zero up to time a 1 the formula ϕ has to ϕs [a] ψ hold and at time a the formula ψ has to become valid. Table 1: Informal description of the temporal operators In the Table 2 can be seen a textual description of temporal operators usually deployed in CCTL specifications. An interval is formed by identifying its end points, which are instants that satisfy certain properties. These points represent the interpretation context of temporal operators within an infinite sequence of states corresponding to a system execution. All interval operators can be affected by a single time bound only; i.e., Quantor Operator [instant] Nested Formula. Once the endpoints of a certain interval have been located or the lower bound is set to zero in the case of single bounded timing, the semantics of the accompanying formula (nested formula) is restricted to the interpretation context made of the discrete time context given by a subset of states on a execution path, e.g. EF[5]ϕ means that there exists a path such that ϕ holds in one of the five next states. Thus, each interval represents a specific temporal context, which is a subset of states of the global context, on which temporal formulas attain a different interpretation with respect to no interval is specified. The following example clearly illustrates the main characteristics of CCTL correct interpretation. Let us consider a timed temporal structure (see [14], p.21) with only 2 states {v, u}, on which the propositions (a, b) must hold, respectively; and the single transition between these is labelled with a time delay equal to 4 units, then the sets of states where the 3 next formulas hold are the following ones:

8 6 EF[3]a {v} EF[3]EF[3]a {v} EF[6]a {u, v} The semantics of CCTL which formalizes the concepts which have been briefly presented in this section can be seen in [15]. 2.3 Fixpoint semantic MC takes a structure (representing the system property) which is unwound into a model and a formula, and automatically checks if the structure (model) meets the specification (formula). In other words, the model checker determines whether the Kripke structure is a model of the formula(s). The basic model for real time systems is the interval structure, i.e., a state transition system with labelled transitions expressing timing constraints. Then, the fundamental structures are timed Kripke structures (unit delay, temporal). Because the CCTL MC algorithms represent sets of states and transitions, we need to operate on entire sets rather than on individual states and transitions. For this purpose, we use a fixpoint characterization of the temporal logic operators [7], that uses the predicate transformer definition. Fixpoint. A set S S is a fixpoint of a function τ : P(S) P(S) if τ(s ) = S. Predicate transformer. Let M = (S, R, L) be an arbitrary finite Kripke structure. The set P(S) of all subsets of S forms a lattice under the set inclusion ordering. A function that maps P(S) to P(S) is called a predicate transformer. Let τ : P(S) P(S) be such function; then 1. τ is monotonic provided that P Q implies τ(p ) τ(q); 2. τ is -continuous provided that P 1 P 2... implies τ( i P i ) = i τ(p i ); 3. τ is -continuous provided that P 1 P 2... implies τ( i P i ) = i τ(p i ). We write τ i (Z) to denote i applications of τ to Z. More formally, τ i (Z) is defined recursively by τ 0 (Z) = Z and τ i+1 (Z) = τ(τ i (Z)) [7]. A monotonic predicate transformer τ on P (S) always has a least fixpoint, µz.τ(z), and a greatest fixpoint, νz.τ(z): µz.τ(z) = {Z τ(z) Z} whenever τ is monotonic, and µz.τ(z) = i τ i (F alse) whenever τ is also - continuous. Similarly, νz.τ(z) = {Z τ(z) Z} whenever τ is monotonic, and νz.τ(z) = i τ i (T rue) whenever τ is also -continuous [7]. If we identify each CCTL formula ϕ with the predicate {g 0 I, g 0 = ϕ} in P(S), then each of the basic CCTL operators may be characterized as a least or greatest fixpoint of an appropriate predicate transformer [7], i.e.,

9 7 A(ϕU [a,b] ψ) = µz.ψ (ϕ AX [a+1,b] Z) E(ϕU [a,b] ψ) = µz.ψ (ϕ EX [a+1,b] Z) A(ϕR [a,b] ψ) = νz.ψ (ϕ AX [a+1,b] Z) E(ϕR [a,b] ψ) = νz.ψ (ϕ AX [a+1,b] Z) Intuitively, least fixpoint correspond to eventualities while greatest fixpoints correspond to properties that should hold forever. Thus, A(ϕU [a,b] ψ) has a least fixpoint characterization and E(ϕR [a,b] ψ) has a greatest fixpoint characterization. The main ideas that support the proofs of these fixpoint characterizations, and a complete explanation about these concepts, can be see in [7]. 3 Generation of the automaton Our vision consists of the development of a strategy for verifying (system properties) that uses timed Büchi automata. To attain this goal, we show in this work a way to construct deterministic TBA, where only having into account the current state together with the next symbol and its acceptation time, the next state change is deterministically obtained. This objective is gradually reached by following a process that starts analyzing the CCTL temporal formula of the property to be verified, and then building the graph which allows the generation of the semantically equivalent Büchi automaton to the CCTL formula, which specifies the complete system behaviour. 3.1 Construction process The algorithm shown in Fig. 1 allows the entire process execution. 1 record Node=[Name:string,Predecessor:set of string,unprocessed:set of formula, 2 Processed:set of formula,next:set of formula,accept:integer]; 3 4 record AcceptanceCond=[Key:formula,SubformulasSet:set of formula]; 5 6 function create graph(ϑ) 7 return(expand([name new name(),predecessor {init}, 8 Unprocessed {ϑ},processed { },Next { },Accept ],{ })) 9 return(accepting states(nodes_set,ϑ)) 10 return(draw tba(nodes_set,graph_tool)) 11 end create graph; Figure 1: Büchi automaton generation algorithm.

10 8 Our proposal (function create graph() encoded in lines 6 11) starts analyzing the CCTL temporal formula of the property to be verified, and then building the graph (function expand() invoked in line 7), which, first of all, generate the ϑ CCTL formula s graph initial node (lines 7 8). This node has only a single input edge (Predecessor), labelled init, to signify it is the initial node. Moreover, it has only one single initial obligation in Unprocessed field, called ϑ, and the Processed and Next fields are initially empty ({ }). Also, the Nodes Set data structure is initialized. Afterwards, using the information stores in the Nodes Set graph data structure filled in the first phase, we update this data structure (function accepting states() invoked in line 9) with the information needed to fulfil the TBA definition in section 2.1. Finally, using the last data structure we can draw the graphical representation (function draw tba() invoked in line 10) of the TBA semantically equivalent to the CCTL formula. In next sections the procedure is totaly explained. 3.2 CCTL formulas analysis To carry out the analysis of CCTL formulas, a set of rules should be followed. The application of these rules will allow decomposing the formula into the different operators and subformulas it includes, thereby the automaton accepting states can be obtained, which specify the property regarding the system behavior. These rules are known as the reductor set, since these make up a set of conditions for carrying out the reduction of complex CCTL formula into a simpler CCTL subformulas (related) set, which are equivalent to the original formula. Reduction set. The reductor set red(ϕ) of a ϕ CCTL formula is the smallest set of well formed CCTL formulas, which does not contain the ϕ initial formula, s.t. the following rules are applicable: If ϕ = EX [a] ϕ 1, EF [a,b] ϕ 1, EG [a,b] ϕ 1 or E(ϕ 1 U [a,b] ϕ 2 ), then ϕ 1, ϕ 2 red(ϕ) If ϕ = ϕ 1, ϕ 1 ϕ 2, ϕ 1 ϕ 2, ϕ 1 ϕ 2 or ϕ 1 ϕ 2, then ϕ 1 and ϕ 2 red(ϕ) If ϕ is of any other form then red(ϕ) = { } Reduction relation. Between 2 CCTL formulas, ϕ and ϕ, there is a reduction relation with respect to formula ρ red(ϕ), denoted as ϕ ρ ϕ, which reads ϕ is ρ-reducible to ϕ or ϕ is an ρ-reduct of ϕ, iff one of the rules shown in Table 2 is applicable, where ϕ is the original formula, ρ 1 is the reductor set of the ϕ formula to obtain the ϕ formula that must be satisfied in the future, and ρ 2 is the reductor set of the ϕ formula that makes it be true at the current instant. ϕ is the reduced formula by the application of the ρ-reduct. By combining the above definitions by means a process that simplifies the verification of properties as they are expressed in the initial CCTL formula, it is possible to build a graph defining the states and transitions that represent the CCTL formula. These definitions allow guaranteeing any condition expressed by a reductor ρ is maintained. Formally, when ρ is valid in a time instance i of an IS I (I, g i = ρ), then I, g i = ϕ iff I, g i = ϕ.

11 9 ϕ ρ 1 ϕ ρ 2 η ( ) New1(η) ( ) Next2(η) ( ) New2(η) ( ) f U [a,b] g {g} f U [a+1,b] g {f} f U [b,b] g { } {g} f R [a,b] g {f, g} f R [a+1,b] g {g} f R [b,b] g { } {g} f g {g} {f} (*) These field names are used by the algorithm in the next section. Table 2: Reduction rules. 3.3 Graph Construction Algorithm The algorithm shown in Fig. 5 allows the generation of a graph or labelled transition system (LTS), where the graph nodes are labelled by the set of CCTL subformulas. These subformulas are obtained by formulas decomposition according to its Boolean structure, by expanding temporal operators in order to separate these that are immediately true from those that are satisfied from the next state on. This algorithm is based on the one presented in [9, 10, 11], uses the depth first search (DFS) [9] strategy, and addresses the temporal logic formulas interpreted according an interval logic. The data structure Node used to keep node information throughout the entire process is made up of 6 fields: 1. its Name; 2. Predecessor, containing the names of the nodes that have and edge directed to it; 3. Unprocessed, is the set of formulas that must hold in it and have not et been processed; 4. Processed, contains the formulas which have already been analyzed; and, 5. Next, is the set of formulas that must hold in all its immediate successors. 6. Accept 4, indicates whether the node represents an acceptance state. The algorithm, starting from the previously described node, iteratively searches and analyzes each one of the nodes displaying obligations to fulfill in the Unprocessed field (lines 12 31). On the contrary, if the node displays Unprocessed = { }, then the node is added to Node Set (lines 2 10). In the case that there is a processed node in Node Set with the same information in Predecessor and Next fields that of the node being included, then an updating of Node Set node record is carried out by adding the set of input edges of the new node to the Predecessor field (lines 3 6). If the node does not exist in the Node Set node record (lines 7 10), the node is added to the list and a new node is constructed by its successor, according to the following: (a) the 4 This field is used by next algorithm.

12 10 1 function expand(node,nodes_set) 2 if Unprocessed(Node)={ } then 3 if ND Nodes_Set with Processed(ND)=Processed(Node) and 4 Next(ND)=Next(Node) then 5 Predecessor(ND):=Predecessor(ND) Predecessor(Node); 6 return(nodes_set); 7 else return(expand([name new name(), 8 Predecessor {Name(Node)}, Unprocessed Next(Node), 9 Processed { },Next { }, 10 Accept ], {Node} Nodes_Set)) 11 else 12 let η Unprocessed; 13 Unprocessed(Node):=Unprocessed(Node)\{η}; 14 case η of 15 η = P n or P n or T rue or F alse or ϕ U [b, b]ψ or ϕ R [b, b]ψ => 16 if η = F alse or Neg(η) Processed(Node) 17 then return(nodes Set) 18 else Processed(Node):=Processed(Node) {η}; 19 return(expand(node,nodes Set)); 20 η = ϕ U [a, b]ψ or ϕ R [a, b]ψ or ϕ ψ => 21 Node1:=[Name new name(), Predecessor Predecessor(Node), 22 Unprocessed Unprocessed(Node) ({New1(η)}\Processed(Node)), 23 Processed Processed(Node) {η}, Next Next(Node),Accept ]; 24 Node2:=[Name Name(Node), Predecessor Predecessor(Node), 25 Unprocessed Unprocessed(Node) ({New2(η)}\Processed(Node)), 26 Processed Processed(Node) {η}, Next Next(Node) {Next2(η)},Accept ]; 27 return(expand(node2,expand(node1,nodes_set))); 28 η = ϕ ψ => 29 return(expand([name Name(Node), Predecessor Predecessor(Node), 30 Unprocessed Unprocessed(Node) ({ϕ, ψ}\processed(node)), 31 Processed Processed(Node) {η}, Next Next(Node)],Accept ],Nodes_Set)) 32 end expand; Figure 2: Graph generation algorithm. Predecessor field of the successor node is initialized with the node name which was added to Node Set; (b) the Unprocessed field is initialized with the contents of the Next field of the latter one; and (c) the Processed and Next fields of the successor node are initially empty ({ }). When a node is processed, the formula η is removed from Unprocessed field (line 13). In case that η is a proposition or its negation, then η is already in Processed field ( η is identified with η) and the current node is discharged (lines 16 17), since it contains a contradiction. In the contrary case, η is added to Processed field (lines 18 19). When η is not a proposition, the node is split in two nodes or it becomes a new node (lines 20 31); in any case, new formulas are added to the Unprocessed and Next fields, depending on: η = ϕ ψ. Both ϕ and ψ are added to Unprocessed field as truth and both are needed to

13 11 make η hold. η = ϕ ψ. The node is split, adding ϕ to Unprocessed field of one copy, and ψ to the other copy. These nodes correspond to the two ways in which η can be made to hold. η = ϕu [a,b] ψ. The node is split. For the first copy, ψ is added to Next field. For the other copy, ϕ is added to Unprocessed field and ϕ U [a+1,b] ψ, to Next field. This splitting is explained by observing that ϕ U [a,b] ψ is equivalent to (where a N and b N { } are the time bounds): ϕu [a,b] ψ : { ϕ X[ϕU[a+1,b] ψ] if 0 < a < b ψ ϕ if a = b 0 (6) η = ϕr [a,b] ψ. The node is split, adding ψ to Unprocessed field of both copies, ϕ to Unprocessed field of the first copy, and ϕ R [a+1,b] ψ, to Next field of the second copy. This splitting is explained by observing that ϕ R [a,b] ψ is equivalent to (where a N and b N { } are the time bounds): ϕr [a,b] ψ : { ψ X[ϕR[a+1,b] ψ] if 0 < a < b ψ ϕ if a = b 0 (7) The algorithm in a pseudo code language described in Fig. 1, uses the new name() function to generate the name of each node, the Neg function, which is defined as follows: Neg(P n ) and Neg( P n ), and the New1(η), New2(η), and Next2(η) functions, which correspond to the cells ρ 1, ρ 2 and ϕ, respectively, of Table Büchi automata generation algorithm Now is show how to derive, from the data structure returned by the graph construction algorithm execution, a TBA that fits the definition described in section 2.1. The previous algorithm permits us to build the graph or transition system that corresponds to a CCTL formula, but not the TBA equivalent to it. Hence, we need to determine the accepted and non accepted automata states, which corresponds with their accepted runs. To allows this objective, we follow the algorithm shown in Fig. 6 The algorithm in a pseudo code language described in Fig. 6 search the Next field in the Nodes Set data structure (lines 3 6) of the graph nodes constructed from ϑ, to record the CCTL subformulas that represents an eventuality 5 (lines 4 5). The set formed by this subformulas define the eventualities that affect the satisfaction of the CCTL formula; i.e., are the acceptance conditions of the formula. The data structure AcceptanceCond (line 4 in Fig. 1) used to keep acceptance conditions information throughout the process is made up of 2 fields: 5 Those subformulas that can to postpone the satisfaction of a CCTL formula (in this case, ϑ) along the time interval.

14 12 1 function accepting states(nodes_set,ϑ) 2 AcceptanceConds_Set [Key ϑ,subformulasset { }]; 3 for each Node Nodes_Set do 4 if χ Next(Node) is a eventuality then 5 SubformulasSet:=SubformulasSet {χ}]; 6 return(acceptanceconds_set); 7 for each Node Nodes_Set do 8 if Next(Node) SubformulasSet then 9 Accept(Node):=0 10 else 11 Accept(Node):=1; 12 end accepting states; Figure 3: Accepted and non accepted states determination algorithm. 1. Key, containing the formula common to all CCTL subformulas that are part of that acceptation set; and, 2. SubformulasSet, containing the subformulas from the Subformulas set which to the Key field. Finally, the algorithm determines the accepted and non accepted states that belong to the Büchi automata. The algorithm check for each node (lines 7 11) if the Next field contains any acceptance condition (i.e., an eventuality) determined previously. In case of the Next field contain some acceptance condition (line 8) this means that the state represented by the node do not correspond to an acceptance state because this node have eventualities that are not satisfied yet or any acceptance condition is not immediately satisfied in this state. Otherwise, the node represent an acceptance state because it not have eventualities to be satisfied. The algorithm store the value 0 (line 9) in the Accept field of each node registered in the Nodes Set data structure in case of the node do not represent an acceptance state. If the node represents an acceptance state is stored the value 1 (line 11) in the Accept field. 3.5 Graphical representation visualization With the information saved in the update Node Set data record, is possible to visualize the graphical representation of the TBA. To allows this, we can use any graph visualization software. The algorithm shown in Fig. 4 summarize this task. 4 An algorithm execution example In this section we present the algorithm execution thought an example. The example CCTL formula used to show the algorithm execution is ϑ = E(F [1,3] ϕ), which express the truth of the atomic proposition ϕ in the future, within the interval [1, 3].

15 13 1 function draw tba(nodes_set,graph_tool)) 2 TBARepresentation:=draw the TBA stored in Nodes_Set; 3 display TBARepresentation; 4 end draw tba; 4.1 Graph construction Figure 4: Büchi automaton visualization algorithm. In order to be able to use the algorithm, we must express the previous formula using the U and R operators. Then, ϑ = E(F [1,3] ϕ) = E( ϕu [1,3] ϕ), which specifies that the atomic proposition ϕ will hold until (U) the atomic proposition ϕ was true within the interval [1, 3]. Fig. 5 shows the tree of nodes processed during the algorithm execution for the E( ϕu [1,3] ϕ) CCTL formula. The node obtained by applying the create graph(ϑ) function is in its root; the function is described in lines in Fig. 1, which contains the ϑ formula in the Unprocessed field whose property automaton is sought. The interpretation of the lines connecting two nodes is the following one: dashed lines signify that a node (the upper one) has been split in two (the lower ones), whereas continuous arrowed lines represent that the lower node is successor of the upper one (notice that in these cases the lower one has in the Predecessor field the identifier of the upper node and the same set of formulas that the upper node has in its Next field. When a node is split in two, the node placed to the right of the derived nodes represents the upper node update (notice that both nodes have the same name), thereby a dashed line is drawn to stress that it is not actually representing a new node. The two occasions in which a node in Fig. 5 is split coincide with the analysis of the ϕu [a,b] ϕ formula, therefore the expansion rule applied is the one showed in lines (row 1 of Table 2). Then, to the Unprocessed field of the new node that has been created (placed below on the left) is augmented with a single reductor of ϑ, i.e., ϕ, whereas the other reductor (in this case only ϕ) is added to the Unprocessed field of the node representing the update of the upper node (placed below on the right) and the same ϑ to its Next field. The numbers that appear in the upper right corner of each node in Fig. 5 indicate the expansion order of that node. Two numbers in a same node means that the node is expanded two times, because the first time the expand() function (lines 4 33 in Fig.1) is executed, an update of that node is carry on, underlining the changes made, so that the next call to this function, expands the node resulting from the aforementioned update (hence the second of their numbers is also underlined). Observing these numbers, we can see that the DFS strategy is used. Thus, the node 1 is divided into two (node 2 and its upgrade), processed first node 2 and all its successors before processing the node 1 updating and all its successors. In Fig. 5, each of the circles that contain numbers indicating the expansion order of a node means that at this point of the execution is added a new node (which is being processed) to the Node Set node record (line 11 in Fig. 1). Whereas if one of those numbers appears preceded

16 14 Figure 5: Nodes obtained by the algorithm execution to ϑ = E(F [1,3] ϕ) formula. by the symbol means that at this execution time of algorithm the node is already a part of Node Set node record (has been stored in a previous step), which updates the Predecessor field (line 7 in Fig. 1), which is equivalent to adding an incoming arc to it. It can be seen that when the expand() function finished, the Node Set node record for ϑ has the content shown in Table 3 which correspond with the graphical representation in Figure 6. Name Predecessor Unprocessed Processed Next Accept 2 {init} { } { ϕu [1,3] ϕ, ϕ} { } 1 3 {2, 3, 6, 8} { } { } { } 1 1 {init} { } { ϕu [1,3] ϕ, ϕ} { ϕu [2,3] ϕ, ϕ} 0 6 {1} { } { ϕu [2,3] ϕ, ϕ} { } 1 5 {1} { } { ϕu [2,3] ϕ, ϕ} { ϕu [3,3] ϕ, ϕ} 0 8 {5} { } { ϕu [3,3] ϕ, ϕ} { } 1 Table 3: Node Set of ϑ = E(F [1,3] ϕ) formula.

17 15 Note in Node Set node record (see Table 3) that Unprocessed field of every nodes is empty ({ }), which means that the algorithm execution only returns nodes fully expanded. The graph shown in Fig. 6 is obtained from Table 3. Transitions are given by the Predecessor field of individual nodes, so that for each n P redecessor(m) depicts a transition type n m. If init P redecessor(m), then m is an initial node (1 and 2 node cases, which are marked with the symbol > in Figure 6). The label associated with each node correspond to the content stored in the Processed field. When a node has no content in this field, such as the node 3, then label with the value T (True), which represents any combination of literal is met therein. Figure 6: Graph generated by the algorithm execution to ϑ = E(F [1,3] ϕ) formula. 4.2 Büchi automaton generation Now is shown the algorithm to generate the Büchi automaton starting from the structure returned by the graph algorithm execution described in previous chapter. As results of the algorithm execution described in section 3.4, we obtain the Table 4 which contains the AcceptanceConds Set record for E( ϕu [1,3] ϕ) formula, that allow to determine the acceptance states that are necessary to finish the construction of the Büchi automaton. Key SubformulasSet ϕu [1,3] ϕ { ϕu [2,3] ϕ, ϕu [3,3] ϕ} Table 4: AcceptanceConds Set of E( ϕu [1,3] ϕ) formula. According to Table 4, the ϕu [2,3] ϕ, and ϕu [3,3] ϕ subformulas are the eventualities that affect the satisfaction of the ϕu [1,3] ϕ formula; i.e., they are the acceptance conditions set of the formula. With this result, the Accept field in Table 3 was filled which means that the nodes 2, 3, 6 and 8, correspond to the acceptance states (value 1) of the E(ϕU [1,3] ϕ), whereas the nodes 1 and 5, represents non acceptance states (value 0). In other words, the nodes 2, 3, 6 and 8 not have eventualities to be satisfied, and the nodes 1 and 5, have eventualities that are not satisfied. The Fig. 4, generated with Graphviz 6 visualization software, shows the Büchi automaton transformed from the graph shown in Fig. 6, using directly the Node Set data record. 6

18 16 Figure 7: TBA of E( ϕu [1,3] ϕ) formula. 5 Conclusions Here was presented an algorithm to construct a semantically equivalent finite automaton of a set of CCTL formulas. This algorithm can generate the automaton representing all the infinite sequence that satisfy a given discrete time property expressed by means of one or several CCTL formulas, in such a way that accepted structures by the Kripke structure (automaton) and the models of these are equivalent. Although this algorithm can be integrated into an on the fly model checking method to perform the system discrete time verification according to a CCTL specification. It is also shown the application of the algorithm execution and the initial ideas about how can be generated a more compact Büchi automaton that corresponds with the target CCTL formula. In future work, we will carry out the formalisation and demonstration of these ideas. Furthermore, we plan to obtain results of the application to other more complex CCTL formulas, as well as a comparison with the results yielded from the algorithm execution with the temporal logics, like LTL [9] and FIL [10, 11]. References [1] R. Alur and D.L. Dill. A theory of timed automata. Theor. Comput. Sci., 126(2), [2] B. Bérard, M. Bidoit, A. Finkel, F. Laroussinie, A. Petit, L. Petrucci, Ph. Schnoebelen, and P. McKenzie. Systems and software verification: model-checking techniques and tools

19 17 [3] G. Bhat, R. Cleaveland, and O. Grumberg. Efficient on the fly model checking for ctl. In Proceedings of the 10th Annual IEEE Symposium on Logic in Computer Science (LICS 95), [4] S.V. Campos and E.M. Clarke. Real-time symbolic model checking for discrete time models [5] A.M.K. Cheng. Real Time Systems: Scheduling, Analysis, and Verification. John Wiley & Sons, Inc., [6] E.A. Clarke, E.A. Emerson, and A.P. Sistla. Automatic verification of finite state concurrent systems. In ACM Symposioum on Principles of Programming Languages, [7] E.M. Clarke, O. Grumberg, and D.A. Peled. Model Checking. MIT. The MIT Press, Cambridge, USA, [8] C. Courcoubetis, M. Vardi, P. Wolper, and M. Yannakakis. Memory efficient algorithms for the verification of temporal properties. Form. Methods Syst. Des., 1(2 3), [9] R. Gerth, D. Peled, M.Y. Vardi, and P. Wolper. Simple on the fly automatic verification of linear temporal logic. In Proceedings of the Fifteenth IFIP WG6.1 International Symposium on Protocol Specification, Testing and Verification XV, [10] M.J. Hornos and M.I. Capel. Automata generation for on the fly automatic verification using formulas of an interval logic. In ACSD 01: Proceedings of the Second International Conference on Application of Concurrency to System Design, [11] M.J. Hornos and M.I. Capel. On the fly model checking from interval logic specifications. SIGPLAN Not., 37(12): , [12] W. Reif, J. Rüf, G. Schellhorn, and T. Vollmer. Do You Trust Your Model Checker?, Lecture Notes in Computer Science 1954: Third International Conference on Formal Methods in Computer-Aided Design (FMCAD 00), pages Springer Verlag, Berlin, Germany, [13] J. Rüf. RAVEN: Real time analyzing and verification environment. Journal of Universal Computer Science, 7(1):89 104, [14] J. Rüf and T. Kropf. A new algorithm for discrete timed symbolic model checking, Lecture Notes in Computer Science 1201: International Workshop Hybrid and Real-Time Systems HART 97, pages Springer Verlag, Berlin, Germany, [15] J. Rüf and T. Kropf. Modeling and Checking Networks of Communicating Real time Processes, Lecture Notes in Computer Science 1703: Correct Hardware Design and Verification Methods (CHARME), pages Springer Verlag, Berlin, Germany, [16] M.Y. Vardi and P. Wolper. Reasoning about infinite computations. Inf. Comput., 115(1), 1994.