Extending Automated Compositional Verification to the Full Class of Omega-Regular Languages

Transcription

1 Extending Automted Compositionl Verifiction to the Full Clss of Omeg-Regulr Lnguges Azdeh Frzn 1, Yu-Fng Chen 2, Edmund M. Clrke 1, Yih-Kuen Tsy 2, nd Bow-Yw Wng 3 1 Crnegie Mellon University 2 Ntionl Tiwn University 3 Acdemi Sinic Abstrct. Recent studies hve suggested the pplicbility of lerning to utomted compositionl verifiction. However, current lerning lgorithms fll short when it comes to lerning liveness properties. We extend the utomton synthesis prdigm for the infinitry lnguges by presenting n lgorithm to lern n rbitrry regulr set of infinite sequences (n ω-regulr lnguge) over n lphbet Σ. Our min result is n lgorithm to lern nondeterministic Büchi utomton tht recognizes n unknown ω-regulr lnguge. This is done by lerning unique projection of it on Σ using the frmework suggested by Angluin for lerning regulr subsets of Σ. 1 Introduction Compositionl verifiction is n essentil technique for ddressing the stte explosion problem in Model Checking [1, 7, 8, 11]. Most compositionl techniques dvocte proving properties of system by checking properties of its components in n ssume-gurntee style. The essentil ide is to model check ech component independently by mking n ssumption bout its environment, nd then dischrge the ssumption on the collection of the rest of the components. In the prdigm of utomted compositionl resoning through lerning [8], system behviors nd their requirements re formlized s regulr lnguges. Assumptions in premises of compositionl proof rules re often regulr lnguges; their corresponding finite-stte utomt cn therefore be generted by lerning techniques for regulr lnguges. In utomted compositionl resoning, compositionl proof rule is chosen priori. The rule indictes how system cn be decomposed. Below is n exmple of simple rule: M 2 = A M 1 A = P M 1 M 2 = P for two components M 1 nd M 2, nd ssumption A, nd property P. Intuitively, this rule sys tht if M 2 gurntees A, nd M 1 gurntees P in n environment tht respects A, then the system composed of M 1 nd M 2 gurntees P. The gol is to utomticlly generte the ssumption A by lerning. This reserch ws sponsored by the icast project of the Ntionl Science Council, Tiwn, under the grnt no. NSC P Y nd the Semiconductor Reserch Corportion (SRC) under the grnt no TJ-1366.

2 2 A. Frzn, Y. Chen et l One nturlly wishes to verify ll sorts of properties using this frmework. However, ll existing lgorithms fll short when it comes to lerning ssumptions which involve liveness properties. In this pper, we present n lgorithm tht fills this gp nd extends the lerning prdigm to the full clss of ω-regulr lnguges. Soundness nd completeness of the bove proof rule with respect to liveness properties remins intct since ω-regulr lnguges shre the required closure properties of regulr lnguges. Automtion cn be chieved following the frmework of [8]. See [9] for more detiled discussion. The ctive lerning model used in utomted compositionl resoning involves techer who is wre of n unknown lnguge, nd lerner whose gol is to lern tht lnguge. The lerner cn put two types of queries to the techer. A membership query sks if string belongs to the unknown lnguge. An equivlence query checks whether conjecture utomton recognizes the unknown lnguge. The techer provides counterexmple if the conjecture is incorrect [2]. More specificlly, in the process of lerning n ssumption, n initil ssumption is generted by the lerner through series of membership queries. An equivlence query is then mde to check if the ssumption stisfies premises of the compositionl proof rule. If it does, the verifiction process termintes with success. Otherwise, the lerner refines the ssumption by the returned counterexmple nd more membership queries. Since the wekest ssumption either estblishes or flsifies system requirements, the verifiction process eventully termintes when the wekest ssumption is ttined. A novel ide in [8] uses model checkers to resolve both membership nd equivlence queries utomticlly. By using Angluin s L* [2] lgorithm, the verifiction process cn be performed without humn intervention. The product of the lerning lgorithm L* is deterministic finite-stte utomton recognizing the unknown regulr lnguge [2]. By the Myhill-Nerode Theorem, the miniml deterministic finite-stte utomton cn be generted from the equivlence clsses defined by the corsest right congruence reltion of ny regulr lnguge [13]. The L lgorithm computes the equivlence clsses by membership queries, nd refines them with counterexmples returned by equivlence queries. It cn, in fct, infer the miniml deterministic finite-stte utomton for ny unknown regulr lnguge with polynomil number of queries in the size of the trget utomton. The upper bound ws lter improved in [18]. Unfortuntely, the L* lgorithm cnnot be directly generlized to lern ω- regulr lnguges. Firstly, deterministic Büchi utomt re less expressive thn generl Büchi utomt. Inferred deterministic finite-stte utomt require more thn the Büchi cceptnce condition to recognize rbitrry ω-regulr lnguges. Secondly, equivlence clsses defined by the corsest right congruence reltion over n ω-regulr lnguge do not necessrily correspond to the sttes of its utomton. The ω-regulr lnguge ( + b) ω hs only one equivlence clss. Yet, there is no one-stte ω-utomton with Büchi, Rbin, Streett, or even Muller cceptnce conditions tht cn recognize this lnguge. Mler nd Pnueli [14] mde n ttempt to generlize L* for the ω-regulr lnguges. Their lgorithm, L ω, lerns proper subclss of ω-regulr lnguges

3 3 which is not expressive enough to cover liveness properties. This restricted clss hs the useful property of being uniquely identifible by the syntctic right congruence. Thus, L ω hs the dvntge of generting the miniml deterministic Muller utomton (isomorphic to the syntctic right congruence) recognizing lnguge in the restricted clss. The syntctic right congruence, however, cnnot be used to identify n rbitrry ω-regulr lnguge. Attempts to use more expressive congruences [3, 21] hve been unsuccessful. Our min ides re inspired by the work of Clbrix, Nivt, nd Podelski [5]. Consider ultimtely periodic ω-strings of the form uv ω. Büchi [4] observed tht the set of ultimtely periodic ω-strings chrcterizes ω-regulr lnguges; two ω-regulr lnguges re in fct identicl if nd only if they hve the sme set of ultimtely periodic ω-strings. Clbrix et l. [5] show tht the finitry lnguge {u$v uv ω L} (where $ is fresh symbol) is regulr for ny ω-regulr lnguge L. These properties help uniquely identify Büchi utomton for the regulr lnguge corresponding to ultimtely periodic ω-strings of n rbitrry ω-regulr lnguge. We develop lerning lgorithm for the regulr lnguge {u$v uv ω L} through membership nd equivlence queries on the unknown ω-regulr lnguge L. A Büchi utomton ccepting L cn hence be constructed from the finite-stte utomton generted by our lerning lgorithm. 2 Preliminries Let Σ be finite set clled the lphbet. A finite word over Σ is finite sequence of elements of Σ. An empty word is represented by ɛ. For two words u = u 1... u n nd v = v 1... v n, define uv = u 1... u n v 1... v m. For word u, u n is recursively defined s uu n 1 with u 0 = ɛ. Define u + = i=1 {ui }, nd u = {ɛ} u +. An infinite word over Σ is n infinite sequence of elements of Σ. For finite word u, define the infinite word u ω = uu... u.... Opertors +,, nd ω re nturlly extended to sets of finite words. A word u is prefix (resp. suffix) of nother word v if nd only if there exists word w Σ such tht v = uw (resp. v = wu). A set of words S is clled prefix-closed (resp. suffix-closed) if nd only if for ll v S, if u is prefix (resp. suffix) of v then u S. The set of ll finite words on Σ is denoted by Σ. Σ + is the set of ll nonempty words on Σ; therefore, Σ + = Σ \{ɛ}. Let u be finite word. u is the length of word u with ɛ = 0. The set of ll infinite words on Σ is denoted by Σ ω. A lnguge is subset of Σ, nd n ω-lnguge is subset of Σ ω. A finite utomton A is tuple (Σ, Q, I, F, δ) where Σ is n lphbet, Q is finite set of sttes, I Q is set of initil sttes, F Q is set of finl sttes, nd δ Q Σ Q is the trnsition reltion. A finite word u = u 1... u n is ccepted by A if nd only if there exists sequence q i0 u 1 q i1 u 2... u n q in such tht q i0 I, q in F, nd for ll j, we hve q ij Q nd (q ij 1, u j, q ij ) δ. Define L(A) = {u u is ccepted by A}. A lnguge L Σ is regulr if nd only if there exists n utomton A such tht L = L(A). A Büchi utomton hs the sme structure s finite utomton, except tht it is intended for recognizing infinite words. An infinite word u = u 1... u n... is ccepted by Büchi utomton A if nd only if there exists sequence

4 4 A. Frzn, Y. Chen et l q i0 u 1 q i1 u 2... u n q in... such tht q i0 I, q ij Q nd (q ij 1, u j, q ij ) δ (for ll j), nd there exists stte q F such tht q = q ij for infinitely mny j s. Agin, define L(A) = {u u is ccepted by A}. An ω-lnguge L Σ ω is ω- regulr if nd only if there exists Büchi utomton A such tht L = L(A). For n ω-lnguge L, let UP(L) = {uv ω u Σ, v Σ +, uv ω L}. Words of the form uv ω re clled the ultimtely periodic. Let α be n ultimtely periodic word. A word v Σ + is period of α if there exists word u Σ such tht α = uv ω. Theorem 1. (Büchi)[4] Let L nd L be two ω-regulr lnguges. L = L if nd only if UP(L) = UP(L ). The bove theorem implies tht the set of ultimtely periodic words of n ω- regulr lnguge L uniquely chrcterizes L. Define L $ (red regulr imge of L) on Σ {$} s L $ = {u$v uv ω L}. Intuitively, the symbol $ mrks the beginning of the period nd seprtes it from the prefix of the ω-word uv ω. Note tht L $ Σ $Σ +. We cn then sy tht L $ uniquely chrcterizes L. Theorem 2. (Büchi)[4] If L is n ω-regulr lnguge, then there exist regulr lnguges L 1,..., L n nd L 1,..., L n such tht L = n i=1 L i(l i )ω. Theorem 3. (Clbrix, Nivt, nd Podelski)[5] L $ is regulr. Moreover, one cn show tht the syntctic congruence of the regulr lnguge L $ nd Arnold s congruence [3] for L coincide on the set Σ + [6]. 3 Ultimtely Periodic Words Define n equivlence reltion on the words in Σ $Σ + : Definition 1. The equivlence reltion on Σ $Σ + is defined by: u, u Σ nd v, v Σ +. u$v u $v uv ω = u v ω Bsed on the ω-word b ω, we hve $b b$b b$bb... b k $b k, for ll k, k. Therefore, the equivlence clss [$b] is equl to the set of words b $b +. Definition 2. An equivlence reltion sturtes lnguge L if nd only if for two words u nd v, where u v, we hve u L implies v L. Let L be n ω-regulr lnguge, nd L $ its corresponding regulr lnguge s defined bove. Let u$v be word in L $ nd u $v Σ $Σ + such tht u$v u $v. Since uv ω = u v ω, we hve u v ω L, nd therefore (by definition) u $v L $. This implies the following Proposition: Proposition 1. The equivlence reltion sturtes L $.

5 5 Let R Σ $Σ + be regulr lnguge. Proposition 1 suggests tht sturting is necessry condition for R to be L $ for some ω-regulr lnguge L. The interesting point is tht one cn show tht it is sufficient s well. This cn be done by constructing Büchi utomton B tht recognizes L directly from the utomton A recognizing R [5]. Since this construction is used in our lgorithm, we describe it here. We first need the following lemm: Lemm 1. (Clbrix, Nivt, nd Podelski) [5] Let L, L Σ be two regulr lnguges such tht LL = L nd L + = L. Then, α UP(LL ω ) if nd only if there exist u L nd v L such tht α = uv ω. Let R Σ $Σ + be regulr lnguge. Let A = (Σ {$}, Q, I, F, δ) be deterministic utomton recognizing R. Define Q $ to be the set of sttes tht cn be reched by strting in n initil stte nd reding the prt of word u$v M tht precedes the $. Formlly, For ech stte q Q $, let Q $ = {q Q u$v R, q i I, q = δ(q i, u)} M q = {u q i I, δ(q i, u) = q} (1) N q = {v q f F, δ(q, $v) = q f }. (2) For ech q, M q nd N q re regulr lnguges; one cn esily construct n utomton ccepting ech by modifying A. Moreover, the definitions of M q nd N q long side the fct R Σ $Σ +, implies tht R = q Q $ M q $N q. Next, we prtition N q bsed on the finl sttes of the utomton. For ech finl stte q f F nd q Q $, let the regulr lnguge N q,qf be N q,qf = {v δ(q, v) = q δ(q, $v) = q f δ(q f, v) = q f } (3) Finlly, for the regulr lnguge R Σ $Σ +, we define the ω-regulr lnguge ω(r) s ω(r) = M q Nq,q ω f. (4) (q,q f ) Q $ F We cll this lnguge ω(r) to indicte the fct tht it is the corresponding ω- regulr lnguge of R. Next we show tht ω(r) is the ω-regulr lnguge whose regulr imgge is indeed R. The following theorem sttes this result: Theorem 4. Let R Σ $Σ + be regulr lnguge tht is sturted by. Then, there exists n ω-regulr lnguge L such tht R = L $. Proof. See [9] for the proof. In fct, L = ω(r) in the bove theorem. One cn directly build Büchi utomton recognizing L from A. The set Q $ cn be effectively computed. For ech stte q Q $, the lnguge M q is recognized by the utomton (Σ, Q, I, {q}, δ).

6 6 A. Frzn, Y. Chen et l For ech finl stte q f, the lnguge N q,qf is the intersection of the lnguges L(Σ, Q, {q}, {q}, δ), L(Σ, Q, {δ(q, $)}, {q f }, δ), nd L(Σ, Q, {q f }, {q f }, δ). For ech pir (q, q f ), once we hve DFAs recognizing M q nd N q,qf, we cn esily construct 1 Büchi utomton recognizing M q Nq,q ω f. The Büchi utomton recognizing L is the union of these utomt. Ech M q Nq,q ω f is recognized by n utomton of size t most A + A 3, which mens tht L is recognized by n utomt of size t most A 3 + A 5. A question tht nturlly rises is wht cn one sy bout the result of the bove construction if R is not sturted by? As we will see in Section 4, we need to construct Büchi utomt from DFAs guessed in the process of lerning which my not be necessrily sturted by. For regulr lnguge R Σ $Σ + which is not sturted by nd L = (q,q f ) Q $ F M qnq,q ω f, it is not necessrily the cse tht R = L $ (compre with the sttement of Theorem 4). For exmple, R = {$b} is not sturted by since it contins n element of the clss [$b] (nmely, $b), but does not contin the whole clss (which is the set b $b + ). But, L hs number of essentil properties: Proposition 2. Let R = U $ for some rbitrry ω-regulr lnguge U. Then, we hve ω(r) = U (defined by (4)). Proof. Direct consequence of Theorem 4. Proposition 3. Assume R Σ $Σ + is regulr lnguge. Let [u$v] denote the equivlence clss of the word u$v by the reltion. For ech pir of words (u, v) Σ Σ +, if [u$v] R = then uv ω ω(r). Proof. If uv ω ω(r), there exist string u in some M q nd string v in some N q,qf such tht u v ω = uv ω (Lemm 1). Since u is in M q nd v is in N q,qf, we hve u $v in R. Becuse u v ω = uv ω, we hve u $v [u$v], which contrdicts [u$v] R =. Proposition 4. Assume R Σ $Σ + is regulr lnguge. For ech pir of words (u, v) Σ Σ +, if [u$v] R then uv ω ω(r). Proof. If [u$v] R, we cn find k nd k stisfying uv k (v k ) ω ω(r) (follows from proof of Theorem 4). Since uv ω = uv k (v k ) ω, we hve uv ω ω(r). 4 Lerning ω-regulr Lnguges In this section, we present n lgorithm tht lerns n unknown ω-regulr lnguge nd genertes nondeterministic Büchi utomton which recognizes L s the result. There re well-known nd well-studied lgorithms for lerning deterministic finite utomton (DFA) [2, 18]. We propose n pproch which uses the L* lgorithm [2] s the bsis for lerning n unknown ω-regulr lnguge L. 1 One cn connect the finl sttes of A(M q) to the initil sttes of A ω (N q,qf ) by ɛ trnsitions, nd let the finl sttes of N q,qf be the finl sttes of the resulting Büchi utomton. A ω (N q,qf ) cn be obtined from A(N q,qf ) by normlizing it nd connecting the finl stte to the initil stte by n epsilon trnsition [17].

7 7 The ide behind L* is lerning by experimenttion. The lerner hs the bility to mke membership queries. An orcle ( techer who knows the trget lnguge), on ny input word v, returns yes-or-no nswer depending on whether v belongs to the trget lnguge. The lerning lgorithm thus chooses prticulr inputs to clssify, nd consequently mkes progress. The lerner lso hs the bility to mke equivlence queries. A conjecture lnguge is guessed by the lerner, which will then be verified by the techer through n equivlence check ginst the trget lnguge. The techer returns yes when the conjecture is correct, or no ccompnied by counterexmple to the equivlence of the conjecture nd the trget lnguge. This counterexmple cn be positive counterexmple ( word tht belongs to the trget lnguge but does not belong to the conjecture lnguge) or negtive counterexmple ( word tht does not belong to the the trget lnguge but belongs to the conjecture lnguge). We refer the reder unfmilir with L* to [2] for more informtion on the lgorithm. The gol of our lerning lgorithm is to come up with nondeterministic Büchi utomton tht recognizes n unknown ω-regulr lnguge L. We ssume tht there is techer who cn correctly nswer the membership nd equivlence queries on L s discussed bove. The ide is to lern the lnguge L $ insted of lerning L directly. One cn reuse the core of the L* lgorithm here, but mny chnges hve to be mde. The reson is tht the membership nd equivlence queries llowed in the setting of our lgorithm re for the ω-regulr lnguge L nd not for the regulr lnguge L $. One hs to trnslte the queries nd their responses bck nd forth from the L $ level to the L level. Membership Queries: The L* lgorithm frequently needs to sk questions of the form: does the string w belong to the trget lnguge L $?. We need to trnslte this query into one tht cn be posed to our techer. The following simple steps perform this tsk: 1. Does w belong to Σ $Σ +? If no, then the nswer is NO. If yes, then go to the next step. 2. Let w = u$v. Does uv ω belong to L? if no, then the nswer is NO. If yes, then the nswer is YES. We know tht L $ Σ $Σ + which helps us filter out some strings without sking the techer. If we hve w Σ $Σ +, then w is of the form u$v which corresponds to the ultimtely periodic word uv ω. The techer cn respond to the membership query by checking whether uv ω belongs to L. The nswer to this query indictes whether u$v should belong to our current conjecture. Note tht by the definition of L $, we hve u$v L $ uv ω L. Equivlence Queries: L* genertes conjecture DFAs tht need to be verified, nd therefore question of the form Is the conjecture lnguge M i equivlent to the trget lnguge L $? needs to be sked. We need to trnslte this query into n equivlent one tht cn be posed to the techer: 1. Is M i subset of Σ $Σ +? If no, get the counterexmple nd continue with L*. If yes, then go the next step.

8 8 A. Frzn, Y. Chen et l 2. Is ω(m i ) (the corresponding ω-regulr lnguge of M i ) equivlent to L? If yes, we re done. If no, we get n ultimtely periodic word c tht is (negtive or positive) counterexmple to the equivlence check. Return NO nd finitry interprettion of c (described below) to L*. Agin, the M i Σ $Σ + check works s preliminry test to filter out conjectures tht re obviously not correct. If conjecture lnguge (DFA) M i psses the first test, we construct its corresponding Büchi utomton ω(m i ). The techer cn then respond by checking the equivlence between L nd ω(m i ). If they re not equivlent, the techer will return counterexmple to the equivlence of the two lnguges. In order to proceed with L*, we hve to trnslte these ω-words to finite words tht re counterexmples to the equivlence of M i nd L $. To do this, for the counterexmple uv ω, we construct DFA tht ccepts [u$v]. There re two cses for ech counterexmple uv ω : The word uv ω is positive counterexmple: the word uv ω should be in ω(m i ) but is not. Since uv ω ω(m i ), by Proposition 4, [u$v] M i nd there exists word u $v [u$v] such tht u $v is not in M i. Then u $v cn serve s n effective positive counterexmple for the L* lgorithm. To find u $v, it suffices to check the emptiness of the lnguge [u$v] M i. There re vrious wys in which one cn compute [u$v]. One wy is by direct construction of DFA ccepting [u$v] from the Büchi utomton tht ccepts the lnguge contining single word uv ω. There is detiled description of this construction in [5] (note tht lthough this construction hs n exponentil blow up in generl, in this specil cse it is liner). We use different construction in our implementtion which is presented in [9]. The word uv ω is negtive counterexmple: the word uv ω should not be in ω(m i ), but it is. Since uv ω L, by Proposition 3, [u$v] M i nd there exists word u $v [u$v] such tht u $v M i. One cn find this word by checking emptiness of M i [u$v]. Then u $v works s proper negtive counterexmple for the L* lgorithm. Here is why the bove procedure works: A conjecture M my not be sturted by. Consider the cse presented in Figure 1(). There re four equivlence clsses: [u 1 $v 1 ] is contined in M, [u 2 $v 2 ] nd [u 3 $v 3 ] hve intersections with M but re not contined in it, nd [u 4 $v 4 ] is completely outside M. Now ssume L = ω(m) (s defined by (4)) is the ω-regulr lnguge corresponding to M. Proposition 4 implies tht u 1 v1 ω L. Proposition 3 implies tht u 4 v4 ω L. However, one cnnot stte nything bout u 2 v2 ω nd u 3 v3 ω with certinty; they my or my not be in L. Let us ssume (for the ske of the rgument) tht u 2 v2 ω L nd u 3 v3 ω L. This mens tht L $ (which is not equivlent to M) is ctully the shded re in Figure 1(b). Now, if L is not the correct conjecture (L L), one will end up with n ω-word uv ω s counterexmple. As mentioned bove, we hve one of the following two cses: (1) The word uv ω is negtive counterexmple (uv ω ω(m) nd uv ω L). There re two possibilities for the clss [u$v] :

9 9 u2$v2 u1$v1 u4$v4 u2$v2 u1$v1 u4$v4 M M u3$v3 u3$v3 () (b) u2$v2 u1$v1 u4$v4 u2$v2 u1$v1 u4$v4 M M u3$v3 u3$v3 (c) (d) Fig. 1. The Cse of Non-sturtion [u$v] M: This cse is rther trivil. Any word in [u$v], including u$v, belongs to M while it should not. Therefore, u$v cn serve s proper negtive counterexmple for the next itertion of L*. [u$v] M: This cse is more tricky. This mens tht u 2 v2 ω ws wrongly included in ω(m). But since some of the strings in [u$v] do not belong to M, n rbitrry string from [u$v] does not necessrily work s negtive counterexmple for the next itertion of L*. One hs to find string which is in both [u$v] nd M, which mens it belongs to [u$v] M. The shded re in Figure 1(c) demonstrtes this set for the exmple. Note tht [u$v] M cnnot be empty; by Proposition 3, [u$v] M = implies tht uv ω L which is contrdiction. (2) The word uv ω is positive counterexmple (uv ω ω(m) nd uv ω L). There re two possibilities for the clss [u$v] : [u$v] M = : This cse is rther trivil. All words in [u$v], including u$v, do not belong to M while they should. Therefore, u$v cn serve s proper positive counterexmple for the next itertion of L*. [u$v] M : This cse is more tricky. This mens tht u 3 v3 ω ws wrongly left out of ω(m). But since some of the strings in [u$v] do belong to M, n rbitrry string from tht clss is not necessrily going to work s proper positive counterexmple for the next itertion of L*. We hve to mke sure to find one tht is in [u$] but not in M. The set [u$v] M contins such string which is gurnteed to mke L* progress. The shded re in Figure 1(d) demonstrtes this set for the exmple. Note tht [u$v] M cnnot be empty; [u$v] M = implies tht [u$v] M in which cse by Proposition 4, we hve uv ω L, which is contrdiction.

10 10 A. Frzn, Y. Chen et l Below, we give more technicl description of our lgorithm followed by n exmple for greter clrity. Definition 3. An observtion tble is tuple S, E, T where S is set of prefixclosed words in Σ such tht ech word in S represents syntctic right congruence clss of L $, E is set of suffix-closed strings in Σ such tht ech word in E is distinguishing word, nd T : (S SΣ) E {, +} is defined s { + if ασ L$ T (α, σ) = if ασ L $. An observtion tble is closed if for every word s SΣ, there exists word s S such tht T (s, ) = T (s, ) (where T (s, ) indictes the row of the tble which strts with s). The gol of L* here is to lern L $ for n unknown ω-lnguge L on lphbet Σ {$}. Our initil setting is the sme s L*; the distinguishing experiment set E = {λ} nd the congruence clss set S = {λ}. We fill the tble by sking membership queries for ech pir of strings (α, σ) (S SΣ) E; NO response sets T (α, σ) =, nd YES response sets T (α, σ) = +. Note tht the membership queries re trnslted s discussed bove to formt pproprite for the techer. $ q 3 q 5 $ q 2 q 4 b q 0 b q 1, b, b q 7 q 2 b q 3 b q 5 q 6 b, b q 4, b () DFA., b (b) Büchi Automton. Fig. 2. First Itertion. When the observtion tble is closed, conjecture DFA A = (S, Σ, q 0, F, δ), where Q = {u u S}, q 0 = λ, δ = {(u,, u ) u S T (u, ) = T (u, )}, nd F = {u T (u, λ) = +} is constructed from the tble. We then check if M 0 = L(A) is subset of Σ $Σ +. If not, there is counterexmple in L(A $ ) Σ $Σ + from the lnguge continment check, ll of whose suffixes re dded to the set of distinguishing words E. If M 0 Σ $Σ +, we construct Büchi utomton B bsed on A (see Section 3), nd perform the equivlence check. The counterexmples re interpreted (s discussed bove) nd the pproprite counterexmples re dded to set E. We then proceed to nother itertion of this lgorithm, until the trget lnguge is found. Exmple 1. We demonstrte our lgorithm by showing the steps performed on simple exmple. Assume tht the trget lnguge is b(( + b) ) ω. This ω- expression corresponds to the liveness property: hppens infinitely often in

11 11 q 0, b q 5 q 2 $ b q 7 q b 1 q 2, b, b q b 1 b b $ q 4 q 6 q 6 q 4 q 3 b b () DFA. (b) Büchi Automton., b q 5 Fig. 3. Second Itertion. computtion with the prefix b which cnnot be lerned using ny of the existing lgorithms. Tble 1() shows the closed observtion from the first itertion of our lgorithm. Figure 2() demonstrtes the DFA tht corresponds to this observtion tble, nd Figure 2(b) demonstrtes the Büchi utomton constructed form this DFA. The first conjecture is not correct; the word b() ω belongs to the trget lnguge, but is not ccepted by the utomton in Figure 2(b). Therefore, the lgorithm goes into second itertion. The counterexmple is trnslted into one pproprite for the L* (b$), nd ll its suffixes re dded to the top row of the tble. Tble 1(b) is the closed tble which we cquire fter dding the counterexmple. Figure 3() shows the DFA corresponding to this tble, nd Figure 3(b) shows the Büchi utomton constructed bsed on this DFA. This Büchi utomton psses the equivlence check nd the lgorithm is finished lerning the trget lnguge. Complexity: Note tht for the trget ω-regulr lnguge L, our lerning lgorithm termintes by lerning L $ (nd hence L). We cn show tht our lerning lgorithm is polynomil (in terms of number of queries performed) on the size of L $ (nd the size of the counter exmples). However, one cn show tht L $, in the worst cse, cn be exponentilly bigger tht the miniml Büchi utomton ccepting L. We refer the interested reder to [9] for more detiled discussion. 5 Optimiztions In this section, we briefly discuss some prcticl optimiztions tht we hve dded to our implementtion of the lgorithm presented in Section 4 to gin more efficient lerning tool. Equivlence query s the lst resort: The equivlence query for n ω-regulr lnguge is expensive, even more thn equivlence checking for regulr lnguges. The min reson is tht it requires complementing the Büchi utomton, which hs proven lower bound of 2 O(n log n) [16]. Therefore, hving fewer equivlence queries speeds up the process of lerning. For ech conjecture DFA A tht is built during n itertion of the lgorithm (more specificlly, the incorrect conjectures), L(A) my not be sturted by. If one could check for sturtion nd mke sturte L(A) by dding/removing words, one could void going through with n (expensive) equivlence check tht will most probbly hve NO response. Unfortuntely, there is no known wy of effectively checking for sturtion. But

12 12 A. Frzn, Y. Chen et l λ b b $b $b b$b b$b λ b $ + b $ + $b $ b bb b$ $b $$ b bb b$ + $ $$ $b $bb $b$ () First Itertion. λ b b $b $b b$b b$b $ b$ b$ λ b $ + b $ + $b b$ + + $ b bb b$ $b $$ b bb $ $$ $b $bb $b$ b$ b$b + + b$$ (b) Second Itertion. Tble 1. Observtion Tbles. ll is not lost. One cn construct nother DFA A where L(A ) = (Σ $Σ + ) L(A). Since A is deterministic, A cn esily be constructed. Let B nd B be respectively the corresponding Büchi utomt for A nd A. If L(B) L(B ) then there is uv ω L(B) L(B ), nd we know tht only prt of the equivlence clss [u$v] is in L(A) nd the rest of it is in L(A ). To decide whether the clss should go into L(A) (the conjecture) completely, or be ltogether removed from it, we cn pose membership query for uv ω to the techer. If uv ω L, then the clss should belong to the conjecture, nd therefore ny word in [u$v] L(A ) works s positive counterexmple for the next itertion of L*. If uv ω L then ny word in [u$v] L(A) cn serve s negtive counterexmple for the next itertion of the L*. This check is polynomil in the size of A, nd sves us n unnecessry equivlence query. Minimiztion nd Simplifiction: Our lgorithm constructs nd hndles mny DFAs during the construction of the Büchi utomton from the conjecture DFA (from M q s nd N q,qf s). Hence, the lgorithm cn benefit from minimizing ll those DFAs in order to reduce the overhed of working with them lter on. DFA minimiztion cn be done very efficiently; the complexity is n log n [12], where n is the size of the source DFA. When the conjecture Büchi utomton is built, nother useful technique is to simplify the Büchi utomton by detecting simultion reltion between sttes [19]. Intuitively, stte p simultes nother stte q in the Büchi utomton if ll ccepting trces strting from q re lso ccepting trces strting from p. If p simultes q nd both trnsitions r p nd r q re in the utomton, then r q cn be sfely removed without chnging the lnguge of the Büchi utomton. Furthermore, if p nd q simulte ech other, then fter redirecting

13 13 ll of q s incoming trnsitions to p, q cn be sfely removed. This technique is useful for reducing the size of the result utomton, becuse the structures of M q nd Nq,q ω f re usully very similr, which provides good opportunities for finding simultion reltions. 6 Preliminry Experimentl Results We hve implemented our lgorithm using JAVA. DFA opertions re delegted to the dk.brics.utomton pckge, nd the Büchi utomton equivlence checking function is provided by the GOAL tool [20]. Σ = 2 Σ = 4 Avg Min Mx Avg Min Mx Trget BA recognizing L Lerned DFA Lerned BA Lerned BA (fter simplifiction) (Unit: number of sttes) Tble 2. Results for Rndomly Generted Temporl Formuls. We check the performnce of our tool by lerning rndomly generted ω- regulr lnguges. More specificlly, we combine the following 5 steps to get trget Büchi utomton: 1. Rndomly generte LTL formuls with length of 6 nd with 1 or 2 propositions (which produces respectively Büchi utomt with Σ = 2 nd 4). 2. If the formul ppered before, discrd it nd go bck to step Use the LTL2BA [10] lgorithm to mke them Büchi utomt. 4. Apply the simplifiction [19] to mke the Büchi utomt s smll s possible. 5. If the size of the utomton is smller thn 5, discrd it nd go to step 1. Note tht the combintion of these steps does not gurntee the minimlity of the resulting Büchi utomton. Tble 2 presents the performnce of our lgorithm on these rndomly generted ω-regulr lnguges. The sizes of the lerned utomt re compred with the sizes of the trget utomt. The result shows tht the size the lerned utomton is comprble with the size of the trget utomton. Tble 2 presents summry of the results of 100 lerning tsks. We hve 50 re with Σ = 2 nd nother hlf of them with Σ = 4. On different note, we present the performnce of our lgorithm on lerning properties tht re often used in verifiction. Tble 3 presents the result of these experiments. The trget lnguges re described by temporl formuls selected from Mnn nd Pnueli [15] nd clssified ccording to the hierrchy of temporl properties which they proposed in the sme pper. We trnslte those temporl formuls to Büchi utomt by the LTL2BA lgorithm. The first column of the tble lists the six clsses of the hierrchy. We select two temporl formuls

14 14 A. Frzn, Y. Chen et l Property Cnonicl Trget Lerned Responsive Trget Lerned DB Clsses Formuls St Trns St Trns Formuls St Trns St Trns codb? Rective FGp GFq GFp GFq No Persistence FGp G(p FGq) No Recurrence GFp G(p Fq) No Obligtion Gp Fq Fp Fq Yes Sfety Gp p Gq Yes Gurntee Fp p Fq Yes Tble 3. Effectiveness for lerning utomt from selected temporl formuls. for ech clss 2. One of them is formul in cnonicl form 3 nd the other is formul in responsive form 4. Mler nd Pnueli s lgorithm [14] cn only hndle the bottom three levels of tht hierrchy. Their lgorithm cnnot hndle some importnt properties such s progress G(p Fq) nd strong firness GFp GFq, which cn be hndled by our lgorithm. 7 Conclusions nd Future Work We hve extended the lerning prdigm of the infinitry lnguges by presenting n lgorithm to lern n rbitrry ω-regulr lnguge L over n lphbet Σ. Our min result is n lgorithm to lern nondeterministic Büchi utomton tht recognizes n unknown ω-regulr lnguge by lerning unique projection of it (L $ ) on Σ using the L*[2] lgorithm. We lso presented preliminry experimentl results tht suggest tht lgorithms performs well on smll exmples. In the future, we would like to extend our experiments by lerning bigger Büchi utomt. We would lso like to use this lerning lgorithm s core of compositionl verifiction tool to equip the tool with the cpbility to check liveness properties tht hve been missing from such tools so fr. One wy of improving our lgorithm is to find n effective wy of checking for sturtion, which ppers to be difficult nd remins unsolved. References 1. R. Alur, P. Mdhusudn, nd W. Nm. Symbolic compositionl verifiction by lerning ssumptions. In Proceedings of the 17th Interntionl Conference on Computer-Aided Verifiction (2005), LNCS 3576, pges Springer, D. Angluin. Lerning regulr sets from queries nd counterexmples. Informtion nd Computtion, 75(2):87 106, A. Arnold. A syntctic congruence for rtionl omeg-lnguge. Theoreticl Computer Science, 39: , J.R. Büchi. On decision method in restricted second-order rithmetic. In Proceedings of the 1960 Interntionl Congress on Logic, Methodology nd Philosophy of Science, pges 1 11, In this tble, p nd q re propositions. If one replces p nd q in formul f with temporl formuls contining only pst opertors, f still belongs to the sme clss. 3 The cnonicl formul is simple representtive formul for ech clss. 4 A responsive formul usully contins two propositions p nd q. The proposition p represents stimulus nd q is response to p

15 15 5. H. Clbrix, M. Nivt, nd A. Podelski. Ultimtely periodic words of rtionl ω- lnguges. In Proceedings of the 9th Interntionl Conference on Mthemticl Foundtions of Progrmming Semntics (1993), LNCS 802, pges , H. Clbrix, M Nivt, nd A Podelski. Sur les mots ultimement périodiques des lngges rtionnels de mots infinis. Comptes Rendus de l Acdémie des Sciences, 318: , S. Chki, E. Clrke, N. Sinh, nd P. Thti. Automted ssume-gurntee resoning for simultion conformnce. In Proceedings of the 17th Interntionl Conference on Computer-Aided Verifiction (2005), LNCS 3576, pges , J.M. Cobleigh, D. Ginnkopoulou, nd C.S. Păsărenu. Lerning ssumptions for compositionl verifiction. In Proceedings of the 9th Interntionl Conference on Tools nd Algorithms for the Construction nd Anlysis of Systems (TACAS 2003), LNCS 2619, pges , A. Frzn, Y. Chen, E. Clrke, Y. Tsy, nd B. Wng. Extending utomted compositionl verifiction to the full clss of omeg-regulr lnguges. Technicl Report CMU-CS , Crnegie Mellon University, Deprtment of Computer Science, P. Gstin nd D. Oddoux. Fst LTL to Büchi utomt trnsltions. In Proceedings of CAV (2001), LNCS 2102, pges Springer, A. Gupt, K.L. McMilln, nd Z. Fu. Automted ssumption genertion for compositionl verifiction. In Proceedings of the 19th Interntionl Conference on Computer-Aided Verifiction (2005), LNCS 4590, pges , J.E. Hopcroft. A n log n lgorithm for minimizing sttes in finite utomton. Technicl report, Stnford University, J.E. Hopcroft nd J.D. Ullmn. Introduction to Automt Theory, Lnguges nd Computtion. Addison-Wesley, O. Mler nd A. Pnueli. On the lernbility of infinitry regulr sets. Informtion nd Computtion, 118(2): , Z. Mnn nd A. Pnueli. A hierrchy of temporl properties. Technicl Report STAN-CS , Stnford University, Deprtment of Computer Science, M. Michel. Complementtion is more difficult with utomt on infinite words. In CNET, Pris, D. Perrin nd J.E. Pin. Infinite Words: Automt, Semigroups, Logic nd Gmes. Acdemic Press, R.L. Rivest nd R.E. Schpire. Inference of finite utomt using homing sequences. Informtion nd Computtion, 103(2): , F. Somenzi nd R. Bloem. Efficient Büchi utomt from LTL formule. In Proceedings of CAV (2000), LNCS 1855, pges , Y. Tsy, Y. Chen, M. Tsi, K. Wu, nd W. Chn. GOAL: A grphicl tool for mnipulting Büchi utomt nd temporl formule. In Proceedings of TACAS (2007), LNCS 4424, pges D. L. Vn, B. Le Sëc, nd I. Litovsky. Chrcteriztions of rtionl omeglnguges by mens of right congruences. Theor. Comput. Sci., 143(1):1 21, 1995.