MODEL CHECKING FOR DYNAMIC ALLOCATION AND DEALLOCATION Extended Abstract
|
|
- Alice Pope
- 5 years ago
- Views:
Transcription
1 MODEL CHECKING FOR DYNAMIC ALLOCATION AND DEALLOCATION Extended Abstract Dino Distefano, Arend Rensink, Joost-Pieter Katoen Department of Computer Science, University of Twente P.O. Box 217, 7500 AE Enschede, The Netherlands {ddino, rensink, Fax: Abstract Allocational Temporal Logic (ATL) is a formalism to express properties concerning the dynamic allocation and de-allocation of entities, such as the objects in an object-based system. The logic is interpreted on History-Dependent Automata, extended with a symbolic representation for certain cases of unbounded allocation. A simple imperative language with primitive statements for (de)allocation, demonstrate the kind of behaviour that can be modelled. A model checking algorithm for ATL is shortly sketched. 1. Introduction One of the aspects of computation that state-of-the-art model checking does not deal with very well is that of dynamic allocation and deallocation (birth and death) of entities. This is especially true if the number of entities is not known beforehand, or even unbounded. Though there are now calculi (such as the π-calculus [7]) that can express the generation of fresh names, as well as models (such as history-dependent automata [8]) that can describe both the birth and the death of entities, what has been missing so far is a logic where these concepts are captured as primitives. An attempt to formulate such a logic is presented in this extended abstract. It is called allocational temporal logic (ATL). The logic is interpreted over so-called high-level allocational Büchi automata (HABA), which extend history-dependent automata [8] with a predicate for the unboundedness of (the number of entities in) a state, and with a (generalised) Büchi acceptance condition. The model-checking problem for ATL is shown to be decidable [4]. Here, we describe informally the 1
2 2 tableau-based model-checking algorithm. To the best of our knowledge, this yields the first approach to effectively model-check models with an unbounded number of entities. This is of particular interest to e.g. the verification of object-oriented systems in which the number of objects is typically not known in advance and may be even unbounded. Proofs can be found in [4] Related work. History-dependent (HD) automata [8] are the main inspiration for HABAs. The novelty introduced in HABAs is the black hole abstraction that allows us to deal with a possibly unbounded number of entities. Related to ATL, concerning properties of freshness, is the recent Spatial Logic (SL) [2, 1] defined for the Ambient Calculus. In SL fresh means distinct from any name used in the formula and in the model satisfying it. In contrast, in ATL, if an entity is fresh it means that the entity is used in the current state and did not appear previously. There are in principle two approaches to model-checking LTL: the automata-theoretic approach [10] and the tableau method [6]. Our algorithm is strongly based on the latter. Model-checking tools for object-oriented systems are becoming more and more popular (e.g. Bandera [3] and Java PathFinder [5]). However, in the approaches we are aware of, dynamic creation of objects is only supported to a limited extent (the number of created objects must be bounded). 2. Allocational temporal logic Let LVar be a countable set of logical variables ranged over by x, y, z, and Ent be a countable set of entities ranged over by e, e, e 1,.... Allocational Temporal Logic (ATL) is an extension of propositional LTL [9] that allows existential quantification over logical variables that can denote entities, or may be undefined. For x LVar, the syntax of ATL is defined by the following grammar: φ ::= x new x = x x.φ φ φ φ Xφ φ U φ The operators have the following intuitive meaning. Formula x new holds if the entity denoted by x is fresh in the current state. Formula x = y holds if variables x and y denote the same entity in the current state; x = x is violated if x is undefined, i.e., if x does not denote any entity. x.φ is valid in the current state if there exists an entity for which φ holds if assigned to x. X (next) and U (until) are the standard LTL operators. We denote x y for (x = y), x alive for x = x and x dead for x x, while x old for x alive (x new). The other boolean connectives and
3 the temporal operators F (eventually) and G (always) are derived in the usual way. An allocational sequence σ is an infinite sequence of sets of entities E 0 E 1 E 2 where E i Ent, for i N. Let σ i = E i E i+1. For given σ, Ei σ denotes the set of entities in the i-th state of σ. The semantics of ATL-formulae is defined by satisfaction relation σ, N, θ = φ where σ is an allocational sequence, N E0 σ is the set of entities that is initially new, and θ : LVar Ent is a partial valuation of the free variables in φ. Let Ni σ denote the set of new entities in state i, i.e., N0 σ = N and Ni+1 σ = Eσ i+1 \Eσ i, and let θσ i : LVar Ent denote the valuation at state i, where θi σ(x) = θ(x) if θ(x) Eσ k for all k i, and θσ i is undefined elsewhere. The satisfaction relation = is defined as follows: σ, N, θ = x new iff x dom(θ) and θ(x) N σ, N, θ = x = y iff x, y dom(θ) and θ(x) = θ(y) σ, N, θ = x.φ iff e E0 σ : σ, N, θ{e/x} = φ σ, N, θ = φ iff σ, N, θ φ σ, N, θ = φ ψ iff either σ, N, θ = φ or σ, N, θ = ψ σ, N, θ = Xφ iff σ, N, θ = φ U ψ iff σ 1, N1 σ, θσ 1 = φ i : (σ i, Ni σ, θσ i = ψ and j < i : σ j, Nj σ, θσ j = φ). Here, θ{e/x} is defined as usual, i.e., θ{e/x}(x) = e and θ{e/x}(y) = θ(y) for y x. Example 2.1. Properties concerning dynamic allocation/de-allocation can be formalised in ATL. For example, formula G( x. y. z.(x = y x = z y = z)) asserts that the number of entities that are alive never exceeds 2, while G((F x.x new) x.x(x alive)) states that the number of entities that are alive grows unboundedly. As a more involved example, x alive U y.(y new (x alive U z.(z new y z x alive))) states that before x is deallocated, two new entities will be allocated. In ATL-formulae, entities can only be addressed through logical variables and valuations of variables (i.e., entities) can only be compared in the same state. These observations allow a reallocation of entities from one state to its next state, as long as this is done injectively. For E, E Ent, a reallocation λ from E to E is a partial injective function λ : E E. A folded allocational sequence is an infinite alternating sequence E 0 λ 0 E 1 λ 1, where λ i is a reallocation from E i to E i+1 for i 0. We write λ σ i for the reallocation function of σ in state i. Note that for folded allocational sequence σ, N0 σ = N, and N i+1 σ = Eσ i+1 \cod(λσ i ). Similarly, θ0 σ = θ and θσ i+1 = λσ i θi σ. Thus, entity e is considered to be deallocated if e dom(λ). Using these adapted definitions of N and θ, an alternative satisfaction relation for ATL can be defined in 3
4 4 terms of folded allocational sequences. Allocational and folded allocational sequences are not fully abstract with respect to the validity of ATL-formulas as several of such sequences may satisfy the same formulae. We therefore consider folded allocational sequences and allocational triple (σ, N, θ) modulo isomorphism. Isomorphic allocational triples satisfy the same set of ATL-formulae. HABA. The following class of automata we introduce are based on Büchi automata and on history-dependent (HD) automata [8]. Let / Ent be a special, distinguished entity, called black hole. Its role will become clear later on. We denote E = E { } for arbitrary E Ent. Furthermore, for E, E 1 Ent, an -reallocation is a partial function λ : E E1 such that λ(e) = λ(e ) e = e for all e, e E and dom(λ) λ( ) =. That is, λ is injective when mapping away from and preserves. Definition 2.2. A High-level Allocational Büchi Automaton (HABA) H is a tuple X, Q, E,, I, F, with X LVar a finite set of logical variables; Q a (possibly infinite) set of states; E : Q 2 Ent B, a function that associates to each state q Q a finite set E q of entities and a predicate B q expressing that there is an unbounded number of entities in q not explicitly modelled by E q ; Q (Ent Ent ) Q, such that for (q, λ, q ), λ is an -reallocation from E q to E q with (i) dom(λ) iff E q = (E, ff) and E q = (E, ff), and (ii) cod(λ) E q = (E, ff); I : Q 2 Ent (X Ent) a partial function yielding for every initial state q dom(i) an initial valuation (N, θ), where N E q is a finite set of entities, and θ : X E q is a partial valuation of the variables in X; F 2 Q a set of sets of accept states. Notational conventions: we write (q, N, θ) I for I(q) = (N, θ) and q λ q for (q, λ, q ). We adopt the generalised Büchi acceptance condition, i.e, ρ = q 0 λ 0 q 1 λ 1 q 2 is a run of HABA H if q i λi q i+1 for all i N and {i q i F } = ω for all F F. Let runs(h) denote the set of runs of H. Predicate B q holds in state q iff the number of entities in q is bounded. An unbounded state q (denoted q ), possesses the distinguished entity that represents all entities that may be added to q (imploded entities). High-level state q thus represents all possible
5 states obtained from q by adding a finite number of entities to E q. If a transition to state q maps (implodes) entities onto the black hole, these entities cannot be distinguished anymore from there on. Moreover, if q λ q, entities in the black hole are either preserved (if q ), or are destroyed (if q ). The black hole thus allows to abstract from the identity of entities if these are not relevant anymore. A run ρ = q 0 λ 0 q 1 λ 1 of HABA H = X, Q, E,, I, F generates an allocation triple (σ, N, θ), where σ = E 0 λ σ 0 E 1λ σ 1 is a folded allocational sequence, if there is a generator, i.e., a family of functions φ i : E i Eq i satisfying for all i 0: 1 e, e E i. (φ i (e) = φ i (e ) e = e ) 2 E qi cod(φ i ) 3 q i ( e E i : φ i (e) ) 4 λ i φ i = φ i+1 λ σ i 5 e E i+1. (φ i+1 (e) = e cod(λ σ i )) 6 I(q 0 ) = (φ 0 (N), φ 0 θ). Let L(H) = {(σ, N, θ) ρ runs(h) : ρ generates (σ, N, θ)}. Example 2.3. The picture below depicts a HABA with X = {x, y}. Squares denote bounded states, (large) circles denote unbounded states, small circles denote entities, and accept states have a bold boundary. Dashed arrows indicate -reallocations. In initial states, dotted lines represent θ, and filled circles denote new entities. In q 1, variable x denotes (old) entity e 1, while y is undefined. Entity e 3 in state q 2 represents the same entity as e 1 in q 1, while e 1 (in q 2 ) represents a new entity. Run q 1 λ 12 (q 2 λ 22 ) ω generates sequences where the initial entity dies after q 2 q 1 λ e 12 3 the second state, while the new entity created in the second state will be alive x e 1 e1 y λ 14 forever. Run q 1 λ 14 (q 4 λ 44 ) ω generates λ 22 λ 44 sequences where the entity in the initial state dies immediately. Once q 4 is λ 13 e λ 3 33 reached, a new entity e 3 is created at every e 3 q 4 step, and in this run thus the number q 3 e 1 of entities grows unboundedly. 3. Programming allocation and deallocation This section introduces a simple programming language L capturing the essence of allocation and deallocation. It provides an intuition about the setup and the sort of behaviour that can be modelled by HABA. 5
6 6 For PVar a set of program variables with v, v i PVar and PVar LVar =, the set of statements of L is given by: (p ) L ::= decl v 1,..., v n : (s 1 s k ) (s ) Stat ::= new(v) del(v) v := v skip s; s if b then s else s fi while b do s od (b ) Bexp ::= v = v b b b A program p is a parallel composition of a finite number of statements preceded by the declaration of a finite number of global variables. new(v) creates (i.e., allocates) a new entity that will be referred to by the program variable v. The old value of v is lost. Thus, if v is the only variable that refers to entity e, say, then after the execution of new(v), e cannot be referenced anymore. del(v) destroys (i.e., deallocates) the entity associated to v, and makes v undefined. The assignment v := w passes the reference held by w (if any) to v. Again, the entity v was referring to might become unreferenced (for ever). Example 3.1. The following program, where g(i) = (i+1) mod 4, models the implementation of a naive solution to the dining philosopher problem: DPhil decl v 1, v 2, v 3, v 4 : (P h 1 P h 2 P h 3 P h 4 ) where Ph i while tt do if (v i alive v g(i) alive) then del(v i ); del(v g(i) ); new(v i ); new(v g(i) ) else skip fi od The variables v i and v g(i) represent the left and the right chopstick of philosopher Ph i, respectively. If v i and v g(i) are defined 1, then the chopsticks are on the table. Taking the chopsticks from the table is represented by destroying the corresponding entities, while putting the chopsticks back on the table is modelled by creating new entities. Some properties that can possibly be satisfied by this program, stated in ATL, are: F( x.x dead), stating that eventually two philosophers will eat at the same time; F( x. y.(x = y)), expressing that eventually there is only one chopstick on the table (an inconsistency); or G( x. y. z.(x old y old z old (x = y x = z y = z))), expressing that among the philosophers there exists a greedy impostor who always eats and never thinks (an unfair computation).
7 7 while new := {{v 1 }} {v 1 } {v 1, v 2 } := {v 1, v 2 } {v 2 } new {{v 1 }, {v 2 }} {{v 1, v 2 }} id 1 while {{v 1, v 2 }} {v 1 } {v 1, v 2 } {v 2 } {v 1, v 2 } {v 2 } id := while 2 new {{v 1 }, {v 2 }, } {{v 1, v 2 }, } {{v 1, v 2 }, } := v 2 := v 1 ; while while while tt do new(v 1 ); v 2 := v 1 od new new(v 1 ); v 2 := v 1 ; while {v 1 } {v1, v 2 } {v 2 } id 1 = {v 1, v 2 } {v 1, v 2 } id 2 = ({v 1, v 2 } {v 1, v 2 }, ) Figure 1. Semantics for p Example 3.2. Consider the following L program p decl v 1, v 2 : while tt do new(v 1 ); v 2 := v 1 od Figure 1 depicts the p operational semantics in terms of HABA. Entities in a state are represented by partitions of the program variables (every partition corresponds to an entity). Variables in the same partition refer to the same entity. As a convention, if is among these partitions the state is unbounded (i.e, we identify by ). Note how by using black hole abstraction and -reallocations, the automaton implodes in a finite state one although the number of entities grows unboundedly. In [4], a symbolic semantics for the language L is defined using HABA and it is shown to be always finite state. 4. Model-checking ATL In this section, we sketch an algorithm, defined in [4] for modelchecking ATL formulae against a HABA. The algorithm extends the tableau method for LTL [6] to ATL. Valuations. ATL-formulae are evaluated on states of a HABA by mapping the free variables of the formula to entities of the state. Any such mapping resolves all basic propositions: x new (a freshness proposition) and x = y (entity equation proposition). In turn, the basic propositions determine the validity of arbitrary formulae. There is, however, a fundamental obstacle to this principle. For variables (of the formula 1 Again, here we use the notation v alive standing for v = v.
8 8 in question) that are mapped to the black hole, entity equations are not resolved, since it is not clear whether the variables are mapped to distinct entities that have imploded into the black hole, or to the same one. To deal with this difficulty, we introduce an intermediate layer in the evaluation of the formula on the state. This additional layer consists of a partial partitioning of the free variables. An entity equation is then resolved by the question whether the equated variables are in the same partition. Closure. Along the lines of [6], we associate to each state q of a HABA sets of valuations, specifically aimed at establishing the validity of a given formula φ. We first collect all ATL-formulae whose validity is possibly relevant to the validity of φ into the so-called closure of φ. Tableau graph. We then construct a graph whose nodes, called atoms, are built from states of a HABA, valuations of formulae from the closure, and a bound on the number of entities that are imploded into the black hole. This last number is particularly important in the construction of the transition between atoms. The transitions of the graph take into account the corresponding -reallocation on the transition of the original HABA H. If H is finite-state, then the graph can be effectively constructed: the set of atoms is finite for every given state. Allocational path. Informally, an allocational path through a tableau graph is an infinite sequence of atoms and transitions (labelled by - reallocations), where the state of the atoms correspond to a run of the HABA such that all until -subformulae in any of the atoms are satisfied somewhere further down the sequence. An allocational path that correspond to a run that satisfies a formula φ is called fulfilling path. There exists a correspondence between the fulfilment of a formula by a path and the presence of that formula in the initial atom of the path. This observation is crucial for the proof of the decidability of the model checking problem for ATL. Furthermore, there is a correspondence between the satisfiability of a formula in the HABA and the existence of a fulfilling path in the tableau graph. The machinery briefly sketched here, together with some rather standard theory, is sufficient to prove the following result stating in essence that the model-checking problem for ATL over HABA is decidable [4]. Theorem 4.1. For any HABA H and formula φ, it is decidable whether or not H φ.
9 5. Future work In the future we plan to investigate the use of HABA for the definition of the semantics of more realistic OOP languages. The first step would be the definition of automata where entities can reference each other. Another (long term) open research question that need further investigations is satisfiability of ATL. Similarly, it would be interesting to develop a proof theory for ATL, as well as, to explore a possible embedding of LTL in ATL. References [1] L. Caires and L. Cardelli. A spatial logic for concurrency (part I). In TACS 01, LNCS 2255, pp. 1 37, Springer, [2] L. Cardelli and A. D. Gordon. Logical properties of name restriction. In TLCA 01, LNCS 2044, pp , Springer, [3] J. Corbett, M. Dwyer, J. Hatcliff, C. Pasareanu, Robby, S. Laubach, and H. Zheng. Bandera: Extracting finite-state models from Java source code. In ICSE 00, pp , IEEE CS Press, [4] D. Distefano, A. Rensink, J.-P. Katoen. Model Checking for dynamic Allocation and Deallocation. Technical report TR-01-40, University of Twente, [5] K. Havelund and T. Pressburger. Model checking Java programs using Java PathFinder. Int. J. on Software Tools for Technology Transfer, 2(4): , [6] O. Lichtenstein and A. Pnueli. Checking that finite state concurrent programs satisfy their linear specification. In POPL 85, pp , ACM Press, [7] R. Milner, J. Parrow, and D. Walker. A calculus of mobile processes (part I and II). Inf. & Comp., 100(1): 1-77, [8] U. Montanari and M. Pistore. An introduction to history-dependent automata. Electr. Notes in Th. Comp. Sci., 10, [9] A. Pnueli. The temporal logic of programs. In FOCS 77, pp , IEEE CS Press, [10] M. Y. Vardi and P. Wolper. An automata-theoretic approach to automatic program verification. In LICS 86, pp , IEEE CS Press,
Automata, Logic and Games: Theory and Application
Automata, Logic and Games: Theory and Application 1. Büchi Automata and S1S Luke Ong University of Oxford TACL Summer School University of Salerno, 14-19 June 2015 Luke Ong Büchi Automata & S1S 14-19 June
More informationComputer-Aided Program Design
Computer-Aided Program Design Spring 2015, Rice University Unit 3 Swarat Chaudhuri February 5, 2015 Temporal logic Propositional logic is a good language for describing properties of program states. However,
More informationLinear Temporal Logic and Büchi Automata
Linear Temporal Logic and Büchi Automata Yih-Kuen Tsay Department of Information Management National Taiwan University FLOLAC 2009 Yih-Kuen Tsay (SVVRL @ IM.NTU) Linear Temporal Logic and Büchi Automata
More informationT Reactive Systems: Temporal Logic LTL
Tik-79.186 Reactive Systems 1 T-79.186 Reactive Systems: Temporal Logic LTL Spring 2005, Lecture 4 January 31, 2005 Tik-79.186 Reactive Systems 2 Temporal Logics Temporal logics are currently the most
More informationAn Introduction to Temporal Logics
An Introduction to Temporal Logics c 2001,2004 M. Lawford Outline Motivation: Dining Philosophers Safety, Liveness, Fairness & Justice Kripke structures, LTS, SELTS, and Paths Linear Temporal Logic Branching
More informationHelsinki University of Technology Laboratory for Theoretical Computer Science Research Reports 66
Helsinki University of Technology Laboratory for Theoretical Computer Science Research Reports 66 Teknillisen korkeakoulun tietojenkäsittelyteorian laboratorion tutkimusraportti 66 Espoo 2000 HUT-TCS-A66
More informationTimo Latvala. February 4, 2004
Reactive Systems: Temporal Logic LT L Timo Latvala February 4, 2004 Reactive Systems: Temporal Logic LT L 8-1 Temporal Logics Temporal logics are currently the most widely used specification formalism
More informationFrom Liveness to Promptness
From Liveness to Promptness Orna Kupferman Hebrew University Nir Piterman EPFL Moshe Y. Vardi Rice University Abstract Liveness temporal properties state that something good eventually happens, e.g., every
More informationAlan Bundy. Automated Reasoning LTL Model Checking
Automated Reasoning LTL Model Checking Alan Bundy Lecture 9, page 1 Introduction So far we have looked at theorem proving Powerful, especially where good sets of rewrite rules or decision procedures have
More informationLTL is Closed Under Topological Closure
LTL is Closed Under Topological Closure Grgur Petric Maretić, Mohammad Torabi Dashti, David Basin Department of Computer Science, ETH Universitätstrasse 6 Zürich, Switzerland Abstract We constructively
More informationAlternating-Time Temporal Logic
Alternating-Time Temporal Logic R.Alur, T.Henzinger, O.Kupferman Rafael H. Bordini School of Informatics PUCRS R.Bordini@pucrs.br Logic Club 5th of September, 2013 ATL All the material in this presentation
More informationOverview. overview / 357
Overview overview6.1 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL
More informationTemporal logics and explicit-state model checking. Pierre Wolper Université de Liège
Temporal logics and explicit-state model checking Pierre Wolper Université de Liège 1 Topics to be covered Introducing explicit-state model checking Finite automata on infinite words Temporal Logics and
More informationIntroduction to Temporal Logic. The purpose of temporal logics is to specify properties of dynamic systems. These can be either
Introduction to Temporal Logic The purpose of temporal logics is to specify properties of dynamic systems. These can be either Desired properites. Often liveness properties like In every infinite run action
More informationThe State Explosion Problem
The State Explosion Problem Martin Kot August 16, 2003 1 Introduction One from main approaches to checking correctness of a concurrent system are state space methods. They are suitable for automatic analysis
More informationMatching Logic: Syntax and Semantics
Matching Logic: Syntax and Semantics Grigore Roșu 1 and Traian Florin Șerbănuță 2 1 University of Illinois at Urbana-Champaign, USA grosu@illinois.edu 2 University of Bucharest, Romania traian.serbanuta@unibuc.ro
More informationStrategy Logic. 1 Introduction. Krishnendu Chatterjee 1, Thomas A. Henzinger 1,2, and Nir Piterman 2
Strategy Logic Krishnendu Chatterjee 1, Thomas A. Henzinger 1,2, and Nir Piterman 2 1 University of California, Berkeley, USA 2 EPFL, Switzerland c krish@eecs.berkeley.edu, {tah,nir.piterman}@epfl.ch Abstract.
More informationLogic Model Checking
Logic Model Checking Lecture Notes 10:18 Caltech 101b.2 January-March 2004 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. the assignment
More informationTemporal Logic. Stavros Tripakis University of California, Berkeley. We have designed a system. We want to check that it is correct.
EE 244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Fall 2016 Temporal logic Stavros Tripakis University of California, Berkeley Stavros Tripakis (UC Berkeley) EE 244, Fall 2016
More informationDeciding Safety and Liveness in TPTL
Deciding Safety and Liveness in TPTL David Basin a, Carlos Cotrini Jiménez a,, Felix Klaedtke b,1, Eugen Zălinescu a a Institute of Information Security, ETH Zurich, Switzerland b NEC Europe Ltd., Heidelberg,
More informationPartial model checking via abstract interpretation
Partial model checking via abstract interpretation N. De Francesco, G. Lettieri, L. Martini, G. Vaglini Università di Pisa, Dipartimento di Ingegneria dell Informazione, sez. Informatica, Via Diotisalvi
More informationTheoretical Foundations of the UML
Theoretical Foundations of the UML Lecture 17+18: A Logic for MSCs Joost-Pieter Katoen Lehrstuhl für Informatik 2 Software Modeling and Verification Group moves.rwth-aachen.de/teaching/ws-1718/fuml/ 5.
More informationDecision Procedures for CTL
Decision Procedures for CTL Oliver Friedmann and Markus Latte Dept. of Computer Science, University of Munich, Germany Abstract. We give an overview over three serious attempts to devise an effective decision
More informationCDS 270 (Fall 09) - Lecture Notes for Assignment 8.
CDS 270 (Fall 09) - Lecture Notes for Assignment 8. ecause this part of the course has no slides or textbook, we will provide lecture supplements that include, hopefully, enough discussion to complete
More informationProperty Checking of Safety- Critical Systems Mathematical Foundations and Concrete Algorithms
Property Checking of Safety- Critical Systems Mathematical Foundations and Concrete Algorithms Wen-ling Huang and Jan Peleska University of Bremen {huang,jp}@cs.uni-bremen.de MBT-Paradigm Model Is a partial
More informationLTL Model Checking. Wishnu Prasetya.
LTL Model Checking Wishnu Prasetya wishnu@cs.uu.nl www.cs.uu.nl/docs/vakken/pv Overview This pack : Abstract model of programs Temporal properties Verification (via model checking) algorithm Concurrency
More informationThe Expressivity of Universal Timed CCP: Undecidability of Monadic FLTL and Closure Operators for Security
The Expressivity of Universal Timed CCP: Undecidability of Monadic FLTL and Closure Operators for Security Carlos Olarte and Frank D. Valencia INRIA /CNRS and LIX, Ecole Polytechnique Motivation Concurrent
More informationUsing Patterns and Composite Propositions to Automate the Generation of Complex LTL Specifications
Using Patterns and Composite Propositions to Automate the Generation of Complex LTL Specifications Salamah Salamah, Ann Q. Gates, Vladik Kreinovich, and Steve Roach Dept. of Computer Science, University
More informationTrace Diagnostics using Temporal Implicants
Trace Diagnostics using Temporal Implicants ATVA 15 Thomas Ferrère 1 Dejan Nickovic 2 Oded Maler 1 1 VERIMAG, University of Grenoble / CNRS 2 Austrian Institute of Technology October 14, 2015 Motivation
More informationAlternating Time Temporal Logics*
Alternating Time Temporal Logics* Sophie Pinchinat Visiting Research Fellow at RSISE Marie Curie Outgoing International Fellowship * @article{alur2002, title={alternating-time Temporal Logic}, author={alur,
More informationModel Checking LTL with Regular Valuations for Pushdown Systems 1
Model Checking LTL with Regular Valuations for Pushdown Systems 1 Javier Esparza Division of Informatics University of Edinburgh Edinburgh EH9 3JZ United Kingdom E-mail: jav@dcs.ed.ac.uk and Antonín Kučera
More informationChapter 4: Computation tree logic
INFOF412 Formal verification of computer systems Chapter 4: Computation tree logic Mickael Randour Formal Methods and Verification group Computer Science Department, ULB March 2017 1 CTL: a specification
More informationModel Checking & Program Analysis
Model Checking & Program Analysis Markus Müller-Olm Dortmund University Overview Introduction Model Checking Flow Analysis Some Links between MC and FA Conclusion Apology for not giving proper credit to
More informationChapter 3: Linear temporal logic
INFOF412 Formal verification of computer systems Chapter 3: Linear temporal logic Mickael Randour Formal Methods and Verification group Computer Science Department, ULB March 2017 1 LTL: a specification
More informationFrom Liveness to Promptness
From Liveness to Promptness Orna Kupferman 1, Nir Piterman 2, and Moshe Y. Vardi 3 1 Hebrew University 2 Ecole Polytechnique Fédéral de Lausanne (EPFL) 3 Rice University Abstract. Liveness temporal properties
More informationAutomata on Infinite words and LTL Model Checking
Automata on Infinite words and LTL Model Checking Rodica Condurache Lecture 4 Lecture 4 Automata on Infinite words and LTL Model Checking 1 / 35 Labeled Transition Systems Let AP be the (finite) set of
More informationVerification Using Temporal Logic
CMSC 630 February 25, 2015 1 Verification Using Temporal Logic Sources: E.M. Clarke, O. Grumberg and D. Peled. Model Checking. MIT Press, Cambridge, 2000. E.A. Emerson. Temporal and Modal Logic. Chapter
More informationOverview. Discrete Event Systems Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for?
Computer Engineering and Networks Overview Discrete Event Systems Verification of Finite Automata Lothar Thiele Introduction Binary Decision Diagrams Representation of Boolean Functions Comparing two circuits
More informationNew Complexity Results for Some Linear Counting Problems Using Minimal Solutions to Linear Diophantine Equations
New Complexity Results for Some Linear Counting Problems Using Minimal Solutions to Linear Diophantine Equations (Extended Abstract) Gaoyan Xie, Cheng Li and Zhe Dang School of Electrical Engineering and
More informationPSL Model Checking and Run-time Verification via Testers
PSL Model Checking and Run-time Verification via Testers Formal Methods 2006 Aleksandr Zaks and Amir Pnueli New York University Introduction Motivation (Why PSL?) A new property specification language,
More informationImpartial Anticipation in Runtime-Verification
Impartial Anticipation in Runtime-Verification Wei Dong 1, Martin Leucker 2, and Christian Schallhart 2 1 School of Computer, National University of Defense Technology, P.R.China 2 Institut für Informatik,
More informationLinear-time Temporal Logic
Linear-time Temporal Logic Pedro Cabalar Department of Computer Science University of Corunna, SPAIN cabalar@udc.es 2015/2016 P. Cabalar ( Department Linear oftemporal Computer Logic Science University
More informationTemporal Logic Model Checking
18 Feb, 2009 Thomas Wahl, Oxford University Temporal Logic Model Checking 1 Temporal Logic Model Checking Thomas Wahl Computing Laboratory, Oxford University 18 Feb, 2009 Thomas Wahl, Oxford University
More informationCS477 Formal Software Dev Methods
CS477 Formal Software Dev Methods Elsa L Gunter 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 Slides based in part on previous lectures by Mahesh Vishwanathan, and by Gul Agha
More informationAutomated Synthesis of Tableau Calculi
Automated Synthesis of Tableau Calculi Renate A. Schmidt 1 and Dmitry Tishkovsky 1 School of Computer Science, The University of Manchester Abstract This paper presents a method for synthesising sound
More informationTemporal Logic with Past is Exponentially More Succinct
Temporal Logic with Past is Exponentially More Succinct Nicolas Markey Lab. Informatique Fondamentale d Orléans Univ. Orléans & CNRS FRE 2490 Rue Léonard de Vinci - BP 6759 45067 Orléans Cedex 2 - France
More informationLinear-Time Logic. Hao Zheng
Linear-Time Logic Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: zheng@cse.usf.edu Phone: (813)974-4757 Fax: (813)974-5456 Hao Zheng (CSE, USF)
More informationTimed Test Generation Based on Timed Temporal Logic
Timed Test Generation Based on Timed Temporal Logic STEFAN D. BRUDA and CHUN DAI Department of Computer Science Bishop s University Sherbrooke, Quebec J1M 1Z7 CANADA stefan@bruda.ca, cdai@cs.ubishops.ca
More informationModel Checking. Boris Feigin March 9, University College London
b.feigin@cs.ucl.ac.uk University College London March 9, 2005 Outline 1 2 Techniques Symbolic 3 Software 4 Vs. Deductive Verification Summary Further Reading In a nutshell... Model checking is a collection
More informationBüchi Automata and Linear Temporal Logic
Büchi Automata and Linear Temporal Logic Joshua D. Guttman Worcester Polytechnic Institute 18 February 2010 Guttman ( WPI ) Büchi & LTL 18 Feb 10 1 / 10 Büchi Automata Definition A Büchi automaton is a
More informationLecture Notes on Emptiness Checking, LTL Büchi Automata
15-414: Bug Catching: Automated Program Verification Lecture Notes on Emptiness Checking, LTL Büchi Automata Matt Fredrikson André Platzer Carnegie Mellon University Lecture 18 1 Introduction We ve seen
More informationCS256/Spring 2008 Lecture #11 Zohar Manna. Beyond Temporal Logics
CS256/Spring 2008 Lecture #11 Zohar Manna Beyond Temporal Logics Temporal logic expresses properties of infinite sequences of states, but there are interesting properties that cannot be expressed, e.g.,
More informationReasoning about Strategies: From module checking to strategy logic
Reasoning about Strategies: From module checking to strategy logic based on joint works with Fabio Mogavero, Giuseppe Perelli, Luigi Sauro, and Moshe Y. Vardi Luxembourg September 23, 2013 Reasoning about
More informationVerifying qualitative and quantitative properties with LTL over concrete domains
Verifying qualitative and quantitative properties with LTL over concrete domains Régis Gascon Laboratoire Spécification et Vérification CNRS & ENS Cachan FRANCE gascon@lsv.ens-cachan.fr Abstract. We introduce
More informationAugmenting a Regular Expression-Based Temporal Logic with Local Variables
Augmenting a Regular Expression-Based Temporal Logic with Local Variables Cindy Eisner IBM Haifa Research Laboratory Email: eisner@il.ibm.com Dana Fisman Hebrew University and IBM Haifa Research Laboratory
More informationFirst-order resolution for CTL
First-order resolution for Lan Zhang, Ullrich Hustadt and Clare Dixon Department of Computer Science, University of Liverpool Liverpool, L69 3BX, UK {Lan.Zhang, U.Hustadt, CLDixon}@liverpool.ac.uk Abstract
More informationLecture 16: Computation Tree Logic (CTL)
Lecture 16: Computation Tree Logic (CTL) 1 Programme for the upcoming lectures Introducing CTL Basic Algorithms for CTL CTL and Fairness; computing strongly connected components Basic Decision Diagrams
More informationTimed Automata. Chapter Clocks and clock constraints Clock variables and clock constraints
Chapter 10 Timed Automata In the previous chapter, we have discussed a temporal logic where time was a discrete entities. A time unit was one application of the transition relation of an LTS. We could
More informationPartially Ordered Two-way Büchi Automata
Partially Ordered Two-way Büchi Automata Manfred Kufleitner Alexander Lauser FMI, Universität Stuttgart, Germany {kufleitner, lauser}@fmi.uni-stuttgart.de June 14, 2010 Abstract We introduce partially
More informationAutomata-based Verification - III
COMP30172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20: email: howard.barringer@manchester.ac.uk March 2009 Third Topic Infinite Word Automata Motivation Büchi Automata
More informationGenerating Linear Temporal Logic Formulas for Pattern-Based Specifications
Generating Linear Temporal Logic Formulas for Pattern-Based Specifications Salamah Salamah, Vladik Kreinovich, and Ann Q. Gates Dept. of Computer Science, University of Texas at El Paso El Paso, TX 79968,
More informationFormal Verification Techniques. Riccardo Sisto, Politecnico di Torino
Formal Verification Techniques Riccardo Sisto, Politecnico di Torino State exploration State Exploration and Theorem Proving Exhaustive exploration => result is certain (correctness or noncorrectness proof)
More informationDeclarative modelling for timing
Declarative modelling for timing The real-time logic: Duration Calculus Michael R. Hansen mrh@imm.dtu.dk Informatics and Mathematical Modelling Technical University of Denmark 02153 Declarative Modelling,
More informationLinear Temporal Logic (LTL)
Chapter 9 Linear Temporal Logic (LTL) This chapter introduces the Linear Temporal Logic (LTL) to reason about state properties of Labelled Transition Systems defined in the previous chapter. We will first
More informationAn On-the-fly Tableau Construction for a Real-Time Temporal Logic
#! & F $ F ' F " F % An On-the-fly Tableau Construction for a Real-Time Temporal Logic Marc Geilen and Dennis Dams Faculty of Electrical Engineering, Eindhoven University of Technology P.O.Box 513, 5600
More informationAn optimal tableau-based decision algorithm for Propositional Neighborhood Logic
An optimal tableau-based decision algorithm for Propositional Neighborhood Logic Davide Bresolin, Angelo Montanari, and Pietro Sala Department of Mathematics and Computer Science, University of Udine,
More informationThe Complexity of Computing the Behaviour of Lattice Automata on Infinite Trees
The Complexity of Computing the Behaviour of Lattice Automata on Infinite Trees Karsten Lehmann a, Rafael Peñaloza b a Optimisation Research Group, NICTA Artificial Intelligence Group, Australian National
More informationPSPACE-completeness of LTL/CTL model checking
PSPACE-completeness of LTL/CTL model checking Peter Lohmann April 10, 2007 Abstract This paper will give a proof for the PSPACE-completeness of LTLsatisfiability and for the PSPACE-completeness of the
More informationFrom CCS to Hybrid π via baby steps. Bill Rounds CSE, U of Michigan
From CCS to Hybrid π via baby steps Bill Rounds CSE, U of Michigan Main idea The hybrid pi-calculus extends pi-calculus by adding a component called the continuous environment, which evolves over time
More informationAbstracting real-valued parameters in parameterised boolean equation systems
Department of Mathematics and Computer Science Formal System Analysis Research Group Abstracting real-valued parameters in parameterised boolean equation systems Master Thesis M. Laveaux Supervisor: dr.
More informationFirst-Order Logic. Chapter Overview Syntax
Chapter 10 First-Order Logic 10.1 Overview First-Order Logic is the calculus one usually has in mind when using the word logic. It is expressive enough for all of mathematics, except for those concepts
More informationFirst Order Logic: Syntax and Semantics
CS1081 First Order Logic: Syntax and Semantics COMP30412 Sean Bechhofer sean.bechhofer@manchester.ac.uk Problems Propositional logic isn t very expressive As an example, consider p = Scotland won on Saturday
More informationAxiomatic Semantics. Lecture 9 CS 565 2/12/08
Axiomatic Semantics Lecture 9 CS 565 2/12/08 Axiomatic Semantics Operational semantics describes the meaning of programs in terms of the execution steps taken by an abstract machine Denotational semantics
More informationAbstraction for Falsification
Abstraction for Falsification Thomas Ball 1, Orna Kupferman 2, and Greta Yorsh 3 1 Microsoft Research, Redmond, WA, USA. Email: tball@microsoft.com, URL: research.microsoft.com/ tball 2 Hebrew University,
More informationFirst-Order Logic. 1 Syntax. Domain of Discourse. FO Vocabulary. Terms
First-Order Logic 1 Syntax Domain of Discourse The domain of discourse for first order logic is FO structures or models. A FO structure contains Relations Functions Constants (functions of arity 0) FO
More informationTemporal Logic. M φ. Outline. Why not standard logic? What is temporal logic? LTL CTL* CTL Fairness. Ralf Huuck. Kripke Structure
Outline Temporal Logic Ralf Huuck Why not standard logic? What is temporal logic? LTL CTL* CTL Fairness Model Checking Problem model, program? M φ satisfies, Implements, refines property, specification
More informationFailure Diagnosis of Discrete Event Systems With Linear-Time Temporal Logic Specifications
Failure Diagnosis of Discrete Event Systems With Linear-Time Temporal Logic Specifications Shengbing Jiang and Ratnesh Kumar Abstract The paper studies failure diagnosis of discrete event systems with
More informationAlmost Linear Büchi Automata
Almost Linear Büchi Automata Tomáš Babiak Vojtěch Řehák Jan Strejček Faculty of Informatics Masaryk University Brno, Czech Republic {xbabiak, rehak, strejcek}@fi.muni.cz We introduce a new fragment of
More informationUsing Patterns and Composite Propositions to Automate the Generation of LTL Specifications
Using Patterns and Composite Propositions to Automate the Generation of LTL Specifications Salamah Salamah, Ann Q. Gates, Vladik Kreinovich, and Steve Roach Dept. of Computer Science, University of Texas
More informationfor Propositional Temporal Logic with Since and Until Y. S. Ramakrishna, L. E. Moser, L. K. Dillon, P. M. Melliar-Smith, G. Kutty
An Automata-Theoretic Decision Procedure for Propositional Temporal Logic with Since and Until Y. S. Ramakrishna, L. E. Moser, L. K. Dillon, P. M. Melliar-Smith, G. Kutty Department of Electrical and Computer
More informationModel for reactive systems/software
Temporal Logics CS 5219 Abhik Roychoudhury National University of Singapore The big picture Software/ Sys. to be built (Dream) Properties to Satisfy (caution) Today s lecture System Model (Rough Idea)
More informationBounded Synthesis. Sven Schewe and Bernd Finkbeiner. Universität des Saarlandes, Saarbrücken, Germany
Bounded Synthesis Sven Schewe and Bernd Finkbeiner Universität des Saarlandes, 66123 Saarbrücken, Germany Abstract. The bounded synthesis problem is to construct an implementation that satisfies a given
More informationA Logical Characterization for Weighted Event-Recording Automata
A Logical Characterization for Weighted Event-Recording Automata June 23, 2009 Karin Quaas Institut für Informatik, Universität Leipzig 04009 Leipzig, Germany quaas@informatik.uni-leipzig.de Abstract.
More informationAutomata-Theoretic Model Checking of Reactive Systems
Automata-Theoretic Model Checking of Reactive Systems Radu Iosif Verimag/CNRS (Grenoble, France) Thanks to Tom Henzinger (IST, Austria), Barbara Jobstmann (CNRS, Grenoble) and Doron Peled (Bar-Ilan University,
More informationChapter 5: Linear Temporal Logic
Chapter 5: Linear Temporal Logic Prof. Ali Movaghar Verification of Reactive Systems Spring 94 Outline We introduce linear temporal logic (LTL), a logical formalism that is suited for specifying LT properties.
More informationTimo Latvala. March 7, 2004
Reactive Systems: Safety, Liveness, and Fairness Timo Latvala March 7, 2004 Reactive Systems: Safety, Liveness, and Fairness 14-1 Safety Safety properties are a very useful subclass of specifications.
More informationFORMAL METHODS LECTURE III: LINEAR TEMPORAL LOGIC
Alessandro Artale (FM First Semester 2007/2008) p. 1/39 FORMAL METHODS LECTURE III: LINEAR TEMPORAL LOGIC Alessandro Artale Faculty of Computer Science Free University of Bolzano artale@inf.unibz.it http://www.inf.unibz.it/
More informationChapter 6: Computation Tree Logic
Chapter 6: Computation Tree Logic Prof. Ali Movaghar Verification of Reactive Systems Outline We introduce Computation Tree Logic (CTL), a branching temporal logic for specifying system properties. A comparison
More informationState-Space Exploration. Stavros Tripakis University of California, Berkeley
EE 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Fall 2014 State-Space Exploration Stavros Tripakis University of California, Berkeley Stavros Tripakis (UC Berkeley) EE
More informationIntroduction to Kleene Algebras
Introduction to Kleene Algebras Riccardo Pucella Basic Notions Seminar December 1, 2005 Introduction to Kleene Algebras p.1 Idempotent Semirings An idempotent semiring is a structure S = (S, +,, 1, 0)
More informationReasoning about Equilibria in Game-like Concurrent Systems
Reasoning about Equilibria in Game-like Concurrent Systems Julian Gutierrez, Paul Harrenstein, Michael Wooldridge Department of Computer Science University of Oxford Abstract In this paper we study techniques
More informationInformal Statement Calculus
FOUNDATIONS OF MATHEMATICS Branches of Logic 1. Theory of Computations (i.e. Recursion Theory). 2. Proof Theory. 3. Model Theory. 4. Set Theory. Informal Statement Calculus STATEMENTS AND CONNECTIVES Example
More informationSyntax. Notation Throughout, and when not otherwise said, we assume a vocabulary V = C F P.
First-Order Logic Syntax The alphabet of a first-order language is organised into the following categories. Logical connectives:,,,,, and. Auxiliary symbols:.,,, ( and ). Variables: we assume a countable
More informationAbstractions and Decision Procedures for Effective Software Model Checking
Abstractions and Decision Procedures for Effective Software Model Checking Prof. Natasha Sharygina The University of Lugano, Carnegie Mellon University Microsoft Summer School, Moscow, July 2011 Lecture
More informationOn simulations and bisimulations of general flow systems
On simulations and bisimulations of general flow systems Jen Davoren Department of Electrical & Electronic Engineering The University of Melbourne, AUSTRALIA and Paulo Tabuada Department of Electrical
More informationComputation Tree Logic
Computation Tree Logic Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: zheng@cse.usf.edu Phone: (813)974-4757 Fax: (813)974-5456 Hao Zheng (CSE,
More informationDeterministic ω-automata for LTL: A safraless, compositional, and mechanically verified construction
Deterministic ω-automata for LTL: A safraless, compositional, and mechanically verified construction Javier Esparza 1 Jan Křetínský 2 Salomon Sickert 1 1 Fakultät für Informatik, Technische Universität
More informationFirst Order Logic vs Propositional Logic CS477 Formal Software Dev Methods
First Order Logic vs Propositional Logic CS477 Formal Software Dev Methods Elsa L Gunter 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 Slides based in part on previous lectures
More informationSynthesis of Designs from Property Specifications
Synthesis of Designs from Property Specifications Amir Pnueli New York University and Weizmann Institute of Sciences FMCAD 06 San Jose, November, 2006 Joint work with Nir Piterman, Yaniv Sa ar, Research
More informationAutomata-based Verification - III
CS3172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20/22: email: howard.barringer@manchester.ac.uk March 2005 Third Topic Infinite Word Automata Motivation Büchi Automata
More information