Checking Timed Büchi Automata Emptiness on Simulation Graphs

Transcription

1 Chcking Timd Büchi Automata Emptinss on Simulation Graphs Stavros Tripakis Cadnc Rsarch Laboratoris Timd automata [Alur and Dill 1994] ar a popular modl for dscribing ral-tim and mbddd systms and rasoning formally about thm. Efficint modl-chcking algorithms hav bn dvlopd and implmntd in tools such as Kronos [Daws t al. 1996] or Uppaal [Larsn t al. 1997] for chcking safty proprtis on this modl, which amounts to rachability. Ths algorithms us th so-calld zon-closd simulation graph, a finit graph that admits fficint rprsntation and has bn rcntly shown to prsrv rachability [Bouyr 2004]. Building upon [Bouyr 2004] and our prvious work [Bouajjani t al. 1997; Tripakis t al. 2005], w show that this graph can also b usd for chcking livnss proprtis, in particular, mptinss of timd Büchi automata. Catgoris and Subjct Dscriptors: D.2.4 [Softwar Enginring]: Softwar/Program Vrification Modl chcking; F.3.1 [Logics and Manings of Programs]: Spcifying and Vrifying and Rasoning about Programs Gnral Trms: Vrification, Dsign, Languags Additional Ky Words and Phrass: Formal mthods, spcification languags, modl chcking, timd Büchi automata, proprty-prsrving abstractions 1. INTRODUCTION Advancs in hardwar hav bn stady ovr th past dcads, and hav rsultd in xcution platforms with imprssiv computing powr. Availability of computing powr maks possibl th dvlopmnt of applications that ar of incrasing complxity. Dsign mthods, howvr, ar having a hard tim to kp up with this trnd. In particular, disproportional tsting fforts ar oftn dvotd to nsur that th applications function corrctly. or: systms mt thir rquirmnts. Formal vrification is a mthodology that aims to improv dsign quality with th us of formal modls and proof tchniqus. In particular, it proposs to us such modls to dscrib both th systm and th rquirmnts and thn attmpt to formally prov that th systm mts th rquirmnts. Modl-chcking taks this furthr by proposing to us modls whr this proof can b carrid out automatically, at last in principl. Diffrnt modl-chcking tchniqus and tools hav bn Author s addrss: S. Tripakis, Cadnc Rsarch Laboratoris, Cadnc Dsign Systms, 2150 Shattuck Avnu, Brkly CA 94704, USA. tripakis@cadnc.com. This work was don whil th author was with th Vrimag Laboratory. This rsarch has bn partially supportd by th CNRS STIC projct CORTOS and by th Europan IST Ntwork of Excllnc ARTIST2. Prmission to mak digital/hard copy of all or part of this matrial without f for prsonal or classroom us providd that th copis ar not mad or distributd for profit or commrcial advantag, th ACM copyright/srvr notic, th titl of th publication, and its dat appar, and notic is givn that copying is by prmission of th ACM, Inc. To copy othrwis, to rpublish, to post on srvrs, or to rdistribut to lists rquirs prior spcific prmission and/or a f. c 2008 ACM /08/ $5.00 ACM Transactions on Computational Logic, Vol. V, No. N, March 2008, Pags 1 18.

2 2 Stavros Tripakis dvlopd in th past thr dcads, for diffrnt typs of modls: for instanc, s [Quill and Sifakis 1981; Clark t al. 1986; Clark t al. 2000]. In this papr, w ar intrstd in modl-chcking for timd automata [Alur and Dill 1994]. Timd automata (TA) ar finit automata quippd with ral-valud variabls, calld clocks, that masur tim. This fatur maks th TA modl particularly suitabl for modling systms whr timing constraints ar important. This is spcially th cas for ral-tim and mbddd systms. In turn, ths typs of systms ar oftn usd in safty-critical applications, which maks modlchcking for TA an important problm. TA modl-chcking has bn wll-studid. Evn though th smantics of TA ar infinit-stat (bcaus of th clocks) many modl-chcking problms for TA ar dcidabl [Alur t al. 1993; Alur and Dill 1994]. Th rason is that th infinit stat-spac admits a finit abstraction, calld th rgion graph, which prsrvs most proprtis of intrst. This abstraction is dfind by an quivalnc rlation on clock configurations, which inducs a partition of th stat spac into a finit st of rgions: two stats in a rgion ar quivalnt, and quivalnt stats hav quivalnt futur bhaviors, thus, also satisfy th sam sts of proprtis. Using th rgion graph, on can in principl rduc modl-chcking for a TA into modlchcking for a finit-stat automaton. Th lattr problm can b solvd by an xhaustiv xploration of th stat-spac of th finit automaton. In practic, th rgion-graph is not usd, bcaus it is too larg: th numbr of nods in th graph grows xponntially with th numbr of clocks and th siz of constants usd in th clock constraints. Evn small xampls can gnrat a hug numbr of rgions, making xhaustiv xploration intractabl. To rmdy this problm, symbolic modl-chcking mthods for TA hav bn dvlopd, which attmpt to rduc th siz of th stat-spac to b xplord, by oprating on sts of stats coarsr than rgions. Among ths symbolic mthods ar th fixpoint itration mthod of [Hnzingr t al. 1994] and th partition-rfinmnt mthod of [Tripakis and Yovin 2001], both implmntd in th tool Kronos [Daws t al. 1996]. Unfortunatly, ths mthods ar still limitd by stat-xplosion problms. On of th rasons is that thy oprat backwards and nd-up xploring unrachabl parts of th stat spac (stats that cannot b rachd from th st of initial stats). Anothr rason is that thy oprat on a singl TA which nds to b constructd a-priori as th product of a st of communicating timd automata: building such an automaton oftn fails in practic, again du to stat-xplosion. In practic, TA modl-chckrs such as Kronos or Uppaal [Larsn t al. 1997] us anothr typ of graph, calld simulation graph. Th lattr has th advantag that it can b built on-th-fly, in a forward mannr, without having to build th product of automata in advanc. Morovr, th simulation graph is much smallr than th rgion graph, in practic. Diffrnt vrsions of th simulation graph xist. Th xact simulation graph is basd on th succssor oprator Post which givs th prcis st of succssor stats for a givn st of stats, with rspct to tim-laps followd by a discrt transition. Apart from bing xact, Post has th advantag to prsrv convxity: if S = (q, Z) is a nod in th graph such that th st of clock stats Z is convx (in this cas Z is calld a zon) thn th succssor of S using Post is also convx. This is important

3 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 3 sinc it allows fficint data-structurs to b usd to rprsnt Z, in particular, DBMs [Dill 1989; Brthomiu and Mnasch 1983]. Unfortunatly, th xact simulation graph may b infinit [Daws and Tripakis 1998], thus xhaustiv xploration of this graph is not possibl in gnral. To rmdy this, finit vrsions of th xact graph hav bn dvlopd, using an abstraction oprator. On choic of an abstraction oprator is th rgion-closur oprator which rturns, givn a zon Z, th union of all rgions intrscting Z. This oprator can b usd to dfin th rgion-closd simulation graph. Th lattr is finit, sinc th numbr of possibl rgions is finit. Unfortunatly, th rgion-closur of a zon is not gnrally a zon (i.., it is not convx) thrfor DBMs cannot b usd. For this rason, th rgion-closd simulation graph is not usd in practic. Anothr choic of an abstraction oprator is a zon-closur oprator (calld maximization in [Tripakis and Courcoubtis 1996], xtrapolation in [Daws and Tripakis 1998] and k-approximation in [Bouyr 2004]), which abstracts Z by anothr zon Z such that all constraints dfind in Z ar boundd by th maximal constant apparing in th guards and invariants of th automaton. This oprator can b usd to dfin th zon-closd simulation graph. This graph is finit sinc th numbr of zons with boundd constraints ar boundd. This is th graph typically usd in Kronos and Uppaal for chcking rachability, that is, whthr a givn stat of th TA is rachabl from a givn st of initial stats. [Bouyr 2004] showd that th zon-closd simulation graph is corrct for rachability, providd th automaton dos not hav diagonal constraints. Ths ar constraints of th form x y c, whr x and y ar clocks and c is a constant. Corrct mans that a location q is rachabl in a diagonal-fr TA A iff th zon-closd simulation graph of A contains a rachabl nod (q, Z). If A has diagonal constraints, its zon-closd simulation graph is gnrally an ovr-approximation, that is, it may contain unrachabl locations [Bngtsson and Yi 2003; Bouyr 2004]. Rachability is important sinc it allows to xprss safty proprtis, which informally stat that somthing bad will nvr happn. Anothr st of important proprtis ar livnss proprtis, which stat that somthing good will vntually happn [Lamport 1977]. Livnss proprtis cannot b statd in trms of rachability. Instad, among othr possibilitis, livnss proprtis can b xprssd in trms of ω-automata, that is, automata on infinit words, such as Büchi automata. Th modl-chcking problm thn bcoms chcking whthr th Büchi automaton modling th composition of th systm with th proprty (or its complmnt) is mpty (i.., accpts no infinit word). Büchi vrsions of timd automata xist and ar calld timd Büchi automata [Alur and Dill 1994]. Th work of Bouyr sttld th qustion of rachability, that is, languag mptinss of plain TA. What about mptinss of timd Büchi automata (TBA)? Can th zon-closd simulation graph b usd for chcking mptinss of TBA? W answr this qustion positivly for diagonal-fr TBA. This complts our prvious work [Bouajjani t al. 1997; Tripakis t al. 2005] on chcking timd Büchi automata mptinss fficintly. Mor prcisly, w show that th languag of a strongly non-zno TBA A is mpty iff th xact simulation graph of A (providd it is finit) contains no accpting cycl. A TBA is strongly non-zno if it has no accpting zno run, that is, an accpting run

4 4 Stavros Tripakis whr tim cannot progrss. Th strong non-znonss assumption is not rstrictiv: as shown in [Tripakis t al. 2005], vry TBA A can b transformd into a strongly non-zno TBA A containing on xtra clock, such that A is mpty iff A is mpty. W also show that, if A is diagonal-fr, thn th languag of A is mpty iff th zon-closd simulation graph of A contains no accpting cycl. Ths rsults ar obtaind by lifting cycls from th xact and zon-closd simulation graphs to th rgion-closd simulation graph, and thn using th proof of [Bouajjani t al. 1997; Tripakis t al. 2005] for th lattr graph. Th lifting is possibl bcaus of commutation proprtis of th approximation oprators involvd, which ar provd using th rsults of [Bouyr 2004]. Th rst of this papr is organizd as follows. In Sction 2 w rcall timd Büchi automata. In Sction 3 w prsnt th thr vrsions of th simulation graphs. In Sction 4 w provid th rsults. Sction 5 concluds this papr. 2. TIMED BÜCHI AUTOMATA Lt R b th st of non-ngativ ral numbrs. Lt X b a finit st of variabls, calld clocks, taking valus in R. A valuation on X is a function v : X R that assigns to ach variabl in X a valu in R. 0 dnots th valuation assigning 0 to all variabls in X. Givn a valuation v and δ R, v + δ is dfind to b th valuation v such that v (x) = v(x) + δ for all x X. Givn a valuation v and X X, v[x := 0] is dfind to b th valuation v such that v (x) = 0 if x X and v (x) = v(x) othrwis. Lt N b th st of natural numbrs, including 0. An atomic constraint on X is a constraint of on of th forms x#c or x y#c, whr x, y X, c N and # {<,, =,, >}. A boolan xprssion on atomic constraints dfins a st of valuations, th ons satisfying th xprssion, calld an X -polyhdron. A conjunction of atomic constraints dfins a convx polyhdron, or zon. X -polyhdra using atomic constraints of th form x y#c ar calld diagonal, othrwis, thy ar calld diagonal-fr [Bouyr 2004]. Dfinition 1 Timd Büchi Automata [Alur and Dill 1994]. A timd Büchi automaton is a tupl A = (X, Q, q 0, E, I, F ), whr: X is a finit st of clocks. Q is a finit st of locations and q 0 Q is th initial location. F Q is a finit st of accpting locations. E is a finit st of dgs of th form = (q, Z, X, q ), whr q, q Q ar th sourc and targt locations, Z is a convx X -polyhdron, calld th guard of, and X X is a st of clocks to b rst (to zro) upon crossing th dg. I is a function associating with ach location q Q a convx X -polyhdron, calld th invariant of q. A is said to b diagonal-fr if all its guards and invariants ar diagonal-fr. An xampl of a timd Büchi automaton is shown in Figur 1. This automaton has two clocks x and y, thr locations q 0, q 1, q 2 and thr dgs. Thr is on accpting location, q 2. Th clock constraints annotating th locations ar th invariants. Th invariants of q 1 and q 2 ar x 1 and x 3, rspctivly. Th

5 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 5 y > 2 x := 0 q 0 x := 0 q 1 y := 0 q 2 x 1 x 3 Fig. 1. A Timd Büchi Automaton. invariant of q 0 is omittd in th figur: whn this is don w assum that th invariant is th trivial on which lavs all clocks unconstraind, namly, x X x 0. Th dgs ar annotatd with clock rsts and guards, for instanc th dg from q 2 to q 1 rsts clock x and has a guard y > 2. Whn guards ar omittd thy ar assumd to b trivial, as with invariants. A stat of A is a pair s = (q, v), whr q Q and v I(q). Th initial stat of A is s 0 = (q 0, 0). Givn two stats s = (q, v) and s = (q, v ), and an dg = (q, Z, X, q ), thr is a discrt transition s s iff v Z and v = v[x := 0] I(q ). Givn δ R, thr is a tim transition s δ s iff q = q and v = v+δ I(q). Notic that sinc I(q) is assumd to b convx, th lattr condition implis that δ [0, δ], v + δ I(q). W writ s δ s if thr xists s such that s δ s and s s. An infinit run of A starting at stat s is an infinit squnc (s 0, δ 0, 0 ), (s 1, δ 1, 1 ),..., whr s 0 = s and for all i = 0, 1,..., s i = (q i, v i ) is a stat, δ i R, i E, and δ i i s i si+1. Th run is calld accpting if thr xists an infinit st of indics i such that q i F. Th run is calld non-zno if t R, k, i=0,...,k δ i > t, othrwis, it is calld zno. Dfinition 2 Languag and mptinss problm. Th languag of A, dnotd Lang(A), is dfind to b th st of all non-zno accpting runs of A starting at th initial stat s 0. Th mptinss problm for A is to chck whthr Lang(A) =. For xampl, th automaton shown in Figur 1 has a non-mpty languag: indd, its has a non-zno accpting run which visits locations q 0, q 1, q 2, q 1, q 2,..., always spnding zro tim in q 0 and q 1, and 2.1 units of tim in q 2. Th mptinss problm for timd Büchi automata is known to b PSPACEcomplt [Alur and Dill 1994]. Dfinition 3 Strong non-znonss. A timd Büchi automaton A is calld strongly non-zno if all accpting runs starting at th initial stat of A ar nonzno. As an xampl, th automaton shown in Figur 1 is strongly non-zno. This is bcaus clock y is rst to zro and thn lowr-boundd by 2 in th singl loop that visits th accpting location q 2. This fact guarants that at last 2 tim units will b spnt vry tim this location is visitd.

6 6 Stavros Tripakis It is shown in [Tripakis t al. 2005] that any timd Büchi automaton A with n clocks, l locations and m dgs can b transformd into a strongly non-zno timd Büchi automaton snz(a) with n + 1 clocks and at most 2l locations and (2m + 1)n dgs, such that Lang(A) = iff Lang(snz(A)) =. This rsult allows us, without loss of gnrality, to focus our attntion on chcking mptinss of strongly non-zno timd Büchi automata. 3. SIMULATION GRAPHS Considr a TBA A = (X, Q, q 0, E, I, F ). A symbolic stat S is a pair (q, Z) whr q Q and Z is an X -polyhdron. S is calld convx iff Z is convx (i.., Z is a zon). S rprsnts a st of stats of A, namly, (q, Z) = {(q, v) v Z}. W first provid a gnric dfinition of a simulation graph, using a gnric succssor oprator for symbolic stats, Succ(, ). W will thn spcializ this dfinition using diffrnt instancs of Succ. Givn a symbolic stat S and an dg, Succ(S, ) rturns a symbolic stat S. Dfinition 4 Gnric simulation graph. Givn an initial symbolic stat S 0 and a succssor oprator Succ(, ), th simulation graph of A with rspct to Succ and S 0, dnotd SG Succ (A, S 0 ), is a labld graph (S, S 0, ), whr: S is th st of nods, dfind to b th last st of non-mpty symbolic stats, such that: (1 ) S 0 S and (2 ) if E, S S and S = Succ(S, ) is non-mpty, thn S S. S 0 is th initial nod, is th st of dgs, dfind as follows. SG Succ (A, S 0 ) has an dg S S iff S, S S and S = Succ(S, ). S is calld th -succssor of S. Notic that, givn S and, th -succssor of S is uniqu. 3.1 Exact simulation graph A natural dfinition of th simulation graph is obtaind using th following symbolic succssor oprator: Dfinition 5 Exact symbolic succssors. Post(S, ) = {s s S. δ R.s δ s } Dfinition 6 Exact simulation graph. Th xact simulation graph of A is th graph SG(A) = SG Post (A, {(q 0, 0)}). Th nods of SG(A) contain all rachabl stats of A and nothing but th rachabl stats. Also, for vry nod (q, Z) of SG(A), Z is a zon, that is, Z is convx. This is an important fatur, sinc it allows fficint data structurs for rprsntation of zons, such as DBMs [Dill 1989], to b usd. On th othr hand, SG(A) can b infinit [Tripakis and Courcoubtis 1996; Daws and Tripakis 1998]. Thus, it is not appropriat for fully-automatic rachability chcking. Diffrnt rmdis to this problm xist, two of which ar discussd in th squl.

7 Chcking Timd Büchi Automata Emptinss on Simulation Graphs Rgion-closd simulation graph A first possibility is to dfin th simulation graph as an abstraction of th rgion graph. In particular, a symbolic stat S can b rplacd by th union of rgions that S intrscts. Sinc th numbr of rgions is finit, thr is a finit numbr of such unions, thus, finitnss of th simulation graph is guarantd. This approach is takn in [Bouajjani t al. 1997; Tripakis t al. 2005]. W brifly rcall it hr. Lt us first introduc som notation. Lt δ R. W dfin fract(δ) and δ to b th fractional and intgral parts of δ, rspctivly; that is, δ = fract(δ) + δ. For xampl, fract(1.3) = 0.3 and 1.3 = 1. Lt A b a TBA with a st of clocks X. For ach clock x X, w dfin c x N to b th gratst constant apparing in a guard or invariant of A that involvs clock x, that is: c x = max{c x#c or x y#c or y x#c is a constraint in a guard or invariant of A} For xampl, for th automaton shown in Figur 1, w hav c x = 3 and c y = 2. Dfinition 7 Rgions [Alur and Dill 1994]. Lt A b a TBA with st of clocks X. Lt = (c x ) x X b th tupl of maximal constants for ach clock in X, as dfind abov. W dfin two quivalnc rlations btwn valuations on X, th rgion quivalnc and th diagonal-fr rgion quivalnc. Two valuations v, v ar rgion-quivalnt, dnotd v v, iff all th following conditions hold: (1 ) For all x X, ithr v(x) = v (x), or v(x) > c x and v (x) > c x. (2 ) For all x, y X with v(x) c x and v(y) c y, fract(v(x)) fract(v(y)) iff fract(v (x)) fract(v (y)). (3 ) For all x X with v(x) c x or v (x) c x, fract(v(x)) = 0 iff fract(v (x)) = 0. (4 ) For all x, y X, for any intrval I in th st {(, c y ), { c y }, ( c y, c y + 1),..., ( 1, 0), {0}, (0, 1),..., (c x 1, c x ), {c x }, (c x, + )} w hav v(x) v(y) I iff v (x) v (y) I. Two valuations v, v ar diagonal-fr rgion-quivalnt, dnotd v v, iff conditions 1-3 abov hold (but not ncssarily condition 4). Each rgion quivalnc inducs a partition of th spac of valuations, R X, into a finit numbr of quivalnc classs, calld rgions. Th st of rgions inducd by th rgion quivalnc is dnotd R. Th st of rgions inducd by th diagonalfr rgion quivalnc is dnotd R. Notic that is strongr than thus R is a finr partition than R. Also notic that sinc in ach partition rgions ar disjoint and covr th ntir valuation spac, ach valuation blongs to a uniqu rgion. An xampl of th st of rgions ovr two clocks x, y inducd by constants c x = 3 and c y = 2 is providd in Figur 2. A valuation can b viwd as a point in th n-dimnsional spac R n, whr n is th numbr of clocks. In this cas thr ar two clocks, thus a valuation is a point in R 2. Th partition R is illustratd to th lft of th figur and th partition R is illustratd to th right of th figur. Som xampls of rgions ar givn blow: Th singlton {(0, 1)} is a rgion in both R and R.

8 8 Stavros Tripakis y x rgions inducd by th rgion quivalnc y rgions inducd by th diagonal-fr rgion quivalnc x Fig. 2. Exampl of rgions ovr two clocks x and y. Th opn triangl 0 < x < y < 1 is a rgion in both R and R. Th unboundd subspac x > 3 y > 2 is a rgion in R but not in R. Th opn lin 2 < x = y < 3 is a rgion in R but not in R Dfinition 8 Rgion-closur oprator. Givn an X -polyhdron Z, dfin Closur (Z) to b th union of all rgions that intrsct Z: Closur (Z) = {R R R Z }. W lift th dfinition to symbolic stats as follows: Closur ((q, Z)) = (q, Closur (Z)) and dfin th composit succssor oprator: Clo Post (S, ) = Closur (Post(S, )). Dfinition 9 Rgion-closd simulation graph. Th rgion-closd simulation graph of A is th graph SG R (A) = SG Clo Post (A, Closur ({(q 0, 0)})). SG R (A) is guarantd to b finit and is also xact with rspct to rachability of locations, 1 maning that thr is a nod (q, Z) in SG R (A) iff thr is a rachabl stat (q, v) in A. Closur, Clo Post and SG R hav bn dfind with rspct to th st of rgions R, inducd by th rgion quivalnc. In th sam mannr, w dfin, Clo Post and SG R with rspct to th st of rgions R, inducd by th diagonalfr rgion quivalnc: (Z) = {R R R Z } ((q, Z)) = (q, (Z)) Clo Post (S, ) = (Post(S, )) SG R (A) = SG Clo Post (A, ({(q 0, 0)})) 1 Rachability of stats can b rducd to rachability of locations by adding an xtra location (th on to b rachd) and annotating th dgs to this location with a guard that ncods th stats to b rachd. This assums that th targt stats ar dfinabl by guards..

9 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 9 y x a zon Z Z 1 = Closur (Z) \ Z Z 2 = Approx (Z) \ Closur (Z) Z 3 = (Z) \ Approx (Z) Fig. 3. Illustration of ovr-approximation oprators. Notic that, by dfinition, Z Closur (Z), for any Z. Also, sinc R is a finr partition than R, it follows that for any Z: Z Closur (Z) (Z). (1) Illustrations of th Closur and oprators ar providd in Figur 3. It is assumd that R and R ar as shown in Figur 2. Th figur shows a zon Z dfind by th constraints x 1 1 y 3 x y 1. Thr succssivly largr ovr-approximations of Z ar also shown: Closur (Z) = Z Z 1 Approx (Z) = Z Z 1 Z 2 (Z) = Z Z 1 Z 2 Z 3 Notic that both Closur (Z) and (Z) ar non-convx in this xampl. For instanc, Z 3 = x 1 y 2. Th Approx oprator is dfind blow. 3.3 Zon-closd simulation graph As illustratd in th xampl abov, th Closur and oprators may yild non-convx polyhdra: this is problmatic sinc this kind of polyhdra dos not admit fficint data-structur rprsntations. In practic, tools such as Kronos or Uppaal us a zon-closur ovr-approximation oprator which nsurs both convxity and finitnss. Such an oprator was first proposd in [Tripakis and Courcoubtis 1996; Daws and Tripakis 1998] and claimd in [Daws and Tripakis 1998] to b xact with rspct to rachability of locations. Latr, Bouyr provd that this ovr-approximation is indd xact for diagonal-fr timd automata, but is not always xact for timd automata with diagonal constraints [Bouyr 2004]. For th rst of this sction, w assum that A is a diagonal-fr TBA. For th dfinition that follows, lt A b a diagonal-fr TBA with st of clocks X. Lt = (c x ) x X b th tupl of maximal constants for ach clock in X, and R b th st of rgions inducd by th rgion quivalnc, as dfind abov. A union of rgions in R is an X -polyhdron, howvr, it is gnrally not convx. Lt Z b th st of all convx unions of rgions in R. By dfinition, vry lmnt of Z is a zon. Not that Z is a finit st, sinc R is finit. Also not that Z is closd by intrsction, that is, if Z 1 Z and Z 2 Z thn Z 1 Z 2 Z. Dfinition 10 Zon-closur oprator. Lt Z b a convx X -polyhdron. Approx (Z) is dfind to b th smallst zon in Z containing Z.

10 10 Stavros Tripakis Not that Approx (Z) is wll-dfind sinc Z is finit and closd by intrsction. Also not that, vn though A is diagonal-fr, Approx (Z) is dfind with rspct to th st of rgions R and not with rspct to th st of rgions R. Finally, not that, by dfinition, for any zon Z: Closur (Z) Approx (Z) (2) Th Approx oprator is illustratd in Figur 3. It is assumd that R and R ar as shown in Figur 2. Zon Z is dfind by th constraints x 1 1 y 3 x y 1 as xplaind abov. Approx (Z) is dfind by th constraints x 1 y 1 2 x y 1. An important rsult from [Bouyr 2004] is th following: Lmma 1 [Bouyr 2004]. For any zon Z: Approx (Z) (Z). Combining Lmma 1 with Proprtis (1) and (2), w obtain: Z Closur (Z) Approx (Z) (Z). (3) An xampl is providd in Figur 3, whr w hav a squnc of strict inclusions: Z Closur (Z) Approx (Z) (Z). To procd with th dfinition of th zon-closd simulation graph, w lift th dfinition of Approx to symbolic stats: Approx ((q, Z)) = (q, Approx (Z)) and dfin th composit succssor oprator: Apx Post (S, ) = Approx (Post(S, )). Dfinition 11 Zon-Closd Simulation Graph. Th zon-closd simulation graph of a diagonal-fr timd Büchi automaton A is th graph SG Z (A) = SG Apx Post (A, Approx ({(q 0, 0)})). SG Z (A) is finit sinc Z is finit. Bouyr shows that SG Z (A) is also xact with rspct to rachability of locations [Bouyr 2004]. From now on, whn w rfr to th zon-closd simulation graph of a TBA A w will assum that A is a diagonal-fr TBA. 3.4 Lassos Any simulation graph is a discrt graph, thus, notions such as paths or cycls in this graph ar dfind in th standard way. A lasso is a path starting at th initial nod followd by a cycl. Mor prcisly, givn a graph (S, S 0, ), a lasso is a squnc S 0 0 S1 1 n 1 Sn n n+l 1 n+l Sn+l Sn such that n 0 and l 0. That is, S 0 0 S1 1 n 1 Sn is a path from th initial nod S 0 to a nod S n, and S n n+l 1 n+l n Sn+l Sn is a cycl from S n to itslf. W say that th lasso is accpting if its cycl visits som accpting nod, that is, thr is som i {0,..., l} such that S n+i = (q, Z) and q F.

11 Chcking Timd Büchi Automata Emptinss on Simulation Graphs CHECKING TIMED BÜCHI AUTOMATA EMPTINESS In this sction w show how chcking mptinss for strongly non-zno timd Büchi automata (TBA for short) can b rducd to finding accpting cycls in th diffrnt typs of simulation graphs. In all thr thorms that follow, th dirction Lang(A) implis that th simulation graph has an accpting lasso (providd th simulation graph is finit) is asy to show and is basd on th following post-stability proprty, providd hr without a proof. Lmma 2. Lt A b a TBA and lt s 0 δ 0 0 s1 δ 1 1 b an infinit run of A. Thn, in ach of SG(A), SG R (A), SG R (A), SG Z (A), thr xists an infinit path S 0 0 S1 1, such that for all i = 0, 1,..., si S i. Th following two lmmata rlat th dgs of SG(A), SG R (A) and SG R (A) to thos of th rgion graph. W first rcall th dfinition of th rgion graph. Dfinition 12 Rgion graph [Alur and Dill 1994]. Lt A b a TBA with st of locations Q and tupl of clock constants. Lt R b th st of rgions R or R. Th rgion graph with rspct to R is a graph whos nods ar of th form (q, R), whr q Q and R R. Th initial nod of th graph is (q 0, { 0}). Th graph has two typs of transitions: Tim-lapsing transitions of th form (q, R) ɛ rg (q, R ) iff thr xist valuations v R and v R, and δ R, such that (q, v) δ (q, v ). And discrt transitions of th form (q, R) rg (q, R ), whr is an dg of A, iff thr xist valuations v R and v R, such that (q, v) (q, v ). W us ɛ rg to ɛ dnot th rflxiv, transitiv closur of rg. W also writ (q, R) ɛ rg rg (q, R ) if thr xists R t such that (q, R) ɛ rg (q, R t ) and (q, R t ) rg (q, R ). Lmma 3. Lt S 1 = (q 1, Z 1 ) and S 2 = (q 2, Z 2 ) = Post(S 1, ). Lt R b ithr R or R and rg dnot th transitions of th corrsponding rgion graphs, rspctivly. Thn: (1 ) For all rgions R 1, R 2 R, if R 1 Z 1 and (q 1, R 1 ) ɛ rg rg (q 2, R 2 ), thn R 2 Z 2. (2 ) For any rgion R 2 R such that R 2 Z 2, thr xists a rgion R 1 R such that R 1 Z 1 and (q 1, R 1 ) ɛ rg rg (q 2, R 2 ). Proof. Part 1: Lt v 1 R 1 Z 1. By dfinition of th rgion graph and th fact that (q 1, R 1 ) ɛ rg rg (q 2, R 2 ), thr xist δ R and v 2 R 2 such that (q 1, v 1 ) δ (q 2, v 2 ). Thn, by dfinition of Post, v 2 Z 2. Thus, R 2 Z 2. Part 2: Lt v 2 R 2 Z 2. By dfinition of Post, thr xists δ R and δ v 1 Z 1 such that (q 1, v 1 ) (q 2, v 2 ). Lt R 1 R b th rgion whr v 1 blongs. Clarly, R 1 Z 1. Also, by dfinition of th rgion graph, (q 1, R 1 ) ɛ rg rg (q 2, R 2 ). Lmma 4. Lt S 1 S2 b an dg of SG R (A) or SG R (A), with S i = (q i, Z i ), for i = 1, 2. For any rgion R 2 Z 2, thr xists a rgion R 1 Z 1 such that (q 1, R 1 ) ɛ rg rg (q 2, R 2 ) in th corrsponding rgion graph.

12 12 Stavros Tripakis Proof. Considr first th cas of SG R (A). By dfinition of SG R (A), S 2 = Closur (Post(S 1, )). Lt S = (q 2, Z) = Post(S 1, ). By dfinition of Closur, R 2 Z. Thus, by part 2 of Lmma 3, thr xists a rgion R 1 R such that (q 1, R 1 ) ɛ rg rg (q 2, R 2 ) and R 1 Z 1. By dfinition of SG R (A), S 1 is rgion-closd, that is, Closur (S 1 ) = S 1. Thus, R 1 Z 1. Th cas of SG R (A) is similar, with th diffrnc that S 2 = (Post(S 1, )). Again w us part 2 of Lmma 3. Basd on Lmma 1, w can show th following: Lmma 5. For any zon Z: (Approx (Z)) = (Z). Proof. Indd, by Proprty (3) and th monotonicity of, w hav (Z) (Approx (Z)) ( (Z)). Th rsult follows from th fact that is idmpotnt: ( (Z)) = (Z). Th xampl shown in Figur 3 can b usd to illustrat th abov rsult. Indd, th zon Z shown in th figur vrifis th quality (Approx (Z)) = (Z) as xpctd. Notic that this quality dos not hold in gnral if w rplac by Closur. This is to b xpctd sinc Approx (Z) can b strictly largr than Closur (Z), and Closur (Approx (Z)) is largr than Approx (Z). Indd, this situation occurs in Figur 3. and Lmma 6. For any convx symbolic stat S and any dg Closur (Post(S, )) = Closur (Post(Closur (S), )) (Post(S, )) = (Post( (S), )). Proof. Lt S = (q, Z). By dfinition, Closur (S) = (q, Closur (Z)) and (S) = (q, (Z)). From Z (Z) Closur (Z), w obtain: By monotonicity of Post and and S (S) Closur (S). oprators, w hav: Closur (Post(S, )) Closur (Post(Closur (S), )) (Post(S, )) (Post( (S), )). This provs th -dirction for both qualitis. For th othr dirction, w will us th notation of Figur 4, namly, S = (q, Z ) = Post(S, ),

13 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 13 S Post(, ) S Closur S Closur (Post(, )) Closur S S Post(, ) S S (Post(, )) S, Fig. 4. Commutation diagrams provd in Lmma 6. and S = (q, Z ) = Closur (S) S = (q, Z ) = Closur (Post(S, )). Using this notation, th first proof objctiv bcoms Z Closur (Z ). Lt R b a rgion containd in Z. By dfinition of Closur, (q, R ) Post(S, ). By part 2 of Lmma 3, thr xists a rgion R R such that R Z and (q, R) ɛ rg rg (q, R ). Sinc Z = Closur (Z), it must b that R Z. By part 1 of Lmma 3, R Z. Thus, R Closur (Z ). Th proof is similar for. Again w us Lmma 3. Lmma 7. For any convx symbolic stat S and any dg (Approx (Post(S, ))) = (Post(Closur (S), )). Proof. By Lmma 5, w hav (Approx (Post(S, ))) = (Post(S, )). Th rsult follows from Lmma Chcking mptinss on th rgion-closd simulation graphs In ordr for th papr to b slf-containd, w rcall on of th main rsults of [Bouajjani t al. 1997; Tripakis t al. 2005].

14 14 Stavros Tripakis S Approx (Post(, )) S S (Post(, )) S Fig. 5. Commutation diagram provd in Lmma 7. S0 1 S 1 S 2 R R 1 2 R 2 1 R 2 2 R Fig. 6. Evry lasso of a rgion-closd simulation graph contains a lasso of th corrsponding rgion graph. Thorm 1 [Bouajjani t al. 1997; Tripakis t al. 2005]. Lt A b a strongly non-zno timd Büchi automaton. Lang(A) iff SG R (A) contains an accpting lasso. If A is diagonal-fr thn Lang(A) iff SG R (A) contains an accpting lasso. Th dirction Lang(A) implis... in th thorm abov can b provn using Lmma 2. W now illustrat th main ida of th proof of th convrs, which is mor involvd. This is bcaus simulation graphs ar not gnrally prstabl [Tripakis and Yovin 2001], which mans that, givn an dg S S, it is not guarantd that vry stat in S has a succssor in S. Thus, whn w hav a cycl, w cannot guarant that, starting from an arbitrary stat s 1 at som nod in th cycl, w can find a succssor s 2 of s 1, thn s 3 of s 2, and so on, ad infinitum, in ordr to form an infinit run. That is, w cannot xtract an infinit run from a cycl in a forward mannr. Instad, w procd backwards, as illustratd in Figur 6. Th ida applis to both rgion graphs with rspct to R or R, thrfor, in th discussion that follows w simply rfr to rgions and rgion graphs without spcifying which of th two. Lt S i = (q i, Z i ). W pick an arbitrary nod in th cycl, say, S 2. Z 2 is a union of rgions (th small circls drawn insid th llipsis). W pick on such rgion, say R1, 2 arbitrarily. By Lmma 4, thr xists som rgion R1 1 Z 1 such that Similarly, thr xists R 2 3 Z 2 such that (q 1, R 1 1) ɛ rg 1 rg (q 2, R 2 1). (q 2, R 2 3) ɛ rg 2 rg (q 1, R 1 1),

15 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 15 and so on. Sinc th numbr of rgions containd in any Z i is finit, soonr or latr th sam rgion will b ncountrd, that is, a cycl will b found. In th cas of th drawing of Figur 6 this cycl is (q 1, R 1 1) ɛ rg 1 rg (q 2, R 2 2) ɛ 2 rg (q 1, R 1 2) ɛ rg 1 rg (q 2, R 2 3) ɛ 2 rg (q 1, R 1 1). 2 Th abov cycl can b xtndd backwards until th initial nod S 0, so that a lasso is found. This lasso corrsponds to a lasso in th rgion graph of A. Morovr, th lasso is accpting, sinc all rgions in a nod ar associatd with th sam location, and th simulation-graph cycl is accpting. Thn, using th rsults of [Alur and Dill 1994] and th pr-stability proprty of th rgion graphs w can xtract an infinit accpting run from th lasso: in th cas of th rgion graph with rspct to R w also us th fact that A is diagonal-fr (othrwis it is not guarantd that such a run xists). Sinc A is strongly non-zno, th run is also non-zno, thus Lang(A). 4.2 Chcking mptinss on th xact simulation graph Thorm 2. Lt A b a strongly non-zno timd Büchi automaton. If Lang(A) = thn SG(A) contains no accpting lasso. If Lang(A) and SG(A) is finit thn SG(A) contains an accpting lasso. Proof. Th dirction Lang(A) implis... is provn using Lmma 2 as mntiond abov. For th convrs, suppos SG(A) has an accpting lasso: S 0 0 S1 1 n 1 Sn n n+l 1 n+l Sn+l Sn+l+1, with S n+l+1 = S n. Dfin S i = Closur (S i ), for all i = 0,..., n + l. W claim that S 0 0 S 1 n 1 1 S n n+l 1 n S n+l n+l S n+l+1 is an accpting lasso of SG R (A). Th rsult follows from Thorm 1. W now prov th claim. First, w hav: S 0 = Closur (S 0 ) = Closur ({(q 0, 0)}), Thus, S 0 is indd th initial nod of SG R (A). Scond, w hav: S 1 = Closur (S 1 ) = Closur (Post(S 0, 0 )) by Lmma 6 = Closur (Post(Closur (S 0 ), 0 )) = Closur (Post(S 0, 0 )). Thus, S 1 is indd th 0 -succssor of S 0 in SG R (A). W can continu th sam way, showing that S 2 is th 1 -succssor of S 1 in SG R (A), tc. Sinc S n+l+1 = Closur (S n+l+1 ) and S n+l+1 = S n, w hav S n+l+1 = S n, that is, w hav a lasso. 2 Notic that R1 2 is lft out bcaus it has no succssors in S 1. This dos not man R1 2 is a dadlock sinc thr might b othr succssor nods to S 2.

16 16 Stavros Tripakis 4.3 Chcking mptinss on th zon-closd simulation graph Thorm 3. Lt A b a strongly non-zno and diagonal-fr timd Büchi automaton. Lang(A) iff SG Z (A) contains an accpting lasso. Proof. Th dirction Lang(A) implis... is provn using Lmma 2 as mntiond abov. For th convrs, suppos SG Z (A) has an accpting lasso: S 0 0 S1 1 n 1 Sn n n+l 1 n+l Sn+l Sn+l+1, with S n+l+1 = S n. Dfin S i = Closur (S i ), for all i = 0,..., n + l. W claim that S 0 0 S 1 n 1 1 S n n+l 1 n S n+l n+l S n+l+1 is an accpting lasso of SG R (A). Th rsult follows from Thorm 1. W now prov th claim. First, w hav: S 0 = (S 0 ) = (Approx ({(q 0, 0)})) by Lmma 5 = ({(q 0, 0)}). Thus, S 0 is indd th initial nod of SG R (A). Scond, w hav: S 1 = (S 1 ) = (Approx (Post(S 0, 0 ))) by Lmma 7 = (Post( (S 0 ), 0 )) = (Post(S 0, 0 )). Thus, S 1 is indd th 0 -succssor of S 0 in SG R (A). W can continu th sam way, showing that S 2 is th 1 -succssor of S 1 in SG R (A), tc. Sinc S n+l+1 = (S n+l+1 ) and S n+l+1 = S n, w hav S n+l+1 = Closur (S n ) = S n, that is, w hav a lasso in SG R (A). Morovr, this is an accpting lasso sinc it visits th sam locations as th original lasso of SG Z (A). 4.4 An xampl W nd this sction with a simpl xampl of how simulation graphs can b usd to chck mptinss of timd Büchi automata. W considr th TBA shown in Figur 1. Its xact simulation graph and its zon-closd simulation graph ar shown in Figur 7. Notic that th xact simulation graph is finit in this cas. Also not that th two graphs diffr only in on nod: nod (q 1, x = 0 2 < y 3) in th xact graph vrsus nod (q 1, x = 0 2 < y) in th zon-closd graph. Indd, zon x = 0 2 < y is th zon-closur of zon x = 0 2 < y 3 with rspct to th st of rgions shown in Figur 2. Both graphs hav accpting cycls, which implis that th languag of th automaton is non-mpty. Indd this is th cas as statd in Sction CONCLUSIONS AND PERSPECTIVES This papr complts th work of [Bouajjani t al. 1997; Tripakis t al. 2005] on chcking languag mptinss of timd Büchi automata fficintly. In [Bouajjani t al. 1997; Tripakis t al. 2005] w showd how to chck mptinss on th

17 Chcking Timd Büchi Automata Emptinss on Simulation Graphs 17 (q 0, x = y = 0) (q 0, x = y = 0) (q 1, 0 = x y) (q 1, 0 = x y) (q 2, y = 0 0 x 1) (q 2, y = 0 0 x 1) (q 1, x = 0 2 < y 3) (q 1, x = 0 2 < y) xact simulation graph zon-closd simulation graph Fig. 7. Exact and zon-closd simulation graphs for th timd Büchi automaton shown in Figur 1. rgion-closd simulation graph. Howvr, th lattr is not usd in practic, sinc its nods ar non-convx, thus, not fficintly rprsntabl. Using rcnt rsults of Bouyr [Bouyr 2004] on simulation-graph ovr-approximations that prsrv convxity, w show that th main rsult of [Bouajjani t al. 1997; Tripakis t al. 2005] carris ovr to th zon-closd simulation graph. Popular timd automata modl-chckrs such as Kronos and Uppaal gnrat this graph whil chcking for rachability. Our rsult implis that ths tools can b usd not only for rachability, but also to chck mptinss of (strongly non-zno) timd Büchi automata. This can b don with small modifications to th tools, namly, implmnting an algorithm to find accpting cycls [Courcoubtis t al. 1992] or strongly connctd componnts [Tarjan 1972] in a graph. Our rsult also provs th corrctnss of (strongly non-zno) timd Büchi automata mptinss algorithms implmntd in th tool Opn-Kronos. 3 Prspctivs of this work includ studying othr classs of proprtis, apart from rachability and Büchi mptinss, that ar prsrvd in th zon-closd simulation graph. It would also b intrsting to study whthr othr, coarsr, zon-basd abstractions, such as th inclusion abstraction proposd in [Daws and Tripakis 1998] or th abstractions proposd in [Bhrmann t al. 2004], can b usd to chck timd Büchi automata mptinss. REFERENCES Alur, R., Courcoubtis, C., and Dill, D Modl chcking in dns ral tim. Information and Computation 104, 1, Alur, R. and Dill, D A thory of timd automata. Thortical Computr Scinc 126, Bhrmann, G., Bouyr, P., Larsn, K., and Plánk, R Lowr and uppr bounds in zon basd abstractions of timd automata. In TACAS 04. LNCS, vol Springr. 3 S tripakis/opnkronos.html.

18 18 Stavros Tripakis Bngtsson, J. and Yi, W On clock diffrnc constraints and trmination in rachability analysis of timd automata. In ICFEM 03. LNCS, vol Springr. Brthomiu, B. and Mnasch, M An numrativ approach for analyzing tim Ptri nts. IFIP Congrss Sris 9, Bouajjani, A., Tripakis, S., and Yovin, S On-th-fly Symbolic Modl chcking for Ral-tim Systms. In 18th IEEE Ral-Tim Systms Symposium (RTSS 97). IEEE Computr Socity, Bouyr, P Forward analysis of updatabl timd automata. Formal Mthods in Systm Dsign 24, 3, Clark, E., Grumbrg, O., and Pld, D Modl Chcking. MIT Prss. Clark, E. M., Emrson, E. A., and Sistla, A. P Automatic vrification of finit-stat concurrnt systms using tmporal logic spcifications. ACM Trans. Program. Lang. Syst. 8, 2, Courcoubtis, C., Vardi, M., Wolpr, P., and Yannakakis, M Mmory fficint algorithms for th vrification of tmporal proprtis. Formal Mthods in Systm Dsign 1, Daws, C., Olivro, A., Tripakis, S., and Yovin, S Th Tool KRONOS. In Hybrid Systms III: Vrification and Control, R. Alur, T. Hnzingr, and E. Sontag, Eds. LNCS, vol Springr, Daws, C. and Tripakis, S Modl Chcking of Ral-Tim Rachability Proprtis Using Abstractions. In 4th Intl. Conf. on Tools and Algorithms for th Construction and Analysis of Systms (TACAS 98), B. Stffn, Ed. LNCS, vol Springr, Dill, D Timing assumptions and vrification of finit-stat concurrnt systms. In Automatic Vrification Mthods for Finit Stat Systms, J. Sifakis, Ed. LNCS, vol Springr, Hnzingr, T., Nicollin, X., Sifakis, J., and Yovin, S Symbolic modl chcking for ral-tim systms. Information and Computation 111, 2, Lamport, L Proving th corrctnss of multiprocss programs. IEEE Trans. Soft. Eng., Larsn, K., Pttrson, P., and Yi, W Uppaal in a nutshll. Softwar Tools for Tchnology Transfr 1, 1/2 (Oct.). Quill, J. and Sifakis, J Spcification and vrification of concurrnt systms in CESAR. In 5th Intl. Sym. on Programming. LNCS, vol Tarjan, R Dpth first sarch and linar graph algorithms. SIAM Journal on Computing 1, 2, Tripakis, S. and Courcoubtis, C Extnding Promla and Spin for Ral Tim. In 2nd Intl. Workshop on Tools and Algorithms for Construction and Analysis of Systms (TACAS 96), T. Margaria and B. Stffn, Eds. LNCS, vol Springr, Tripakis, S. and Yovin, S Analysis of Timd Systms using Tim-abstracting Bisimulations. Formal Mthods in Systm Dsign 18, 1 (Jan.), Tripakis, S., Yovin, S., and Bouajjani, A Chcking Timd Büchi Automata Emptinss Efficintly. Formal Mthods in Systm Dsign 26, 3 (May), Rcivd Jun 2006; rvisd Octobr 2007; accptd Fbruary 2008