1. Review of the automata-theoretic approach to model-checking

2. Overview* Kripke structures Temporal logics: LTL, CTL, CTL* From LTL to Buchi automata Model checking *Thanks for borrowed slides: Orna Grumberg, Ken McMillan

3. Program verification Given a program and a specification, does the program satisfy the specification? Not decidable! We restrict the problem to a decidable one: Finite-state abstractions Propositional temporal logics

4. Model Checking MC G(p -> F q) yes no p q p q temporal formula finite-state model algorithm counterexample Model must now represent all behaviors

5. Finite state systems Hardware designs Communication protocols High level description of non finite state systems Web service abstractions

6. Properties in temporal logic mutual exclusion: always  ( cs 1  cs 2 ) non starvation: always (request  eventually grant) communication protocols: (  get-message) until send-message

7. Kripke structures A Kripke structure (S,AP,R,L) consists of –set of states S, atomic propositions AP –set of transitions R  S  S –labeling L  S  AP Example: Kripke model of a program pp p repeat p := true; p := false; end

8. Kripke structure / transition system a,ba a b,c c a,c a,b b

9.  =s 0 s 1 s 2... is a run in M from s iff s = s 0 and for every i  0: (s i,s i+1 )  R How to specify properties of runs: temporal logics!

10. Linear temporal logic: LTL AP – a set of atomic propositions LTL: propositional logic + temporal operators Gp Fp Xp pUq

11. Examples of LTL properties x=a  y=b  XXXX z=a+b pay B deliver B: “before” liveness: “if input, then eventually output” G (input  F output) strong fairness: “infinitely sent implies infinitely received” GF send  GF receive

12. Branching time logics: CTL, CTL* Model of time is a tree, not a sequence Path quantifiers A: “for every path” E: “there exists a path” AF p p p p

13. Computation Tree Logic: CTL Every operator F, G, X, U preceded by A or E Universal modalities: pp p... AG p pppp p pp AF p

14. CTL, cont... Existential modalities: p p... EG p p p EF p

15. CTL, cont Other modalities AX p, EX p, A(p U q), E(p U q) Examples: mutual exclusion specs... AG  (C 1  C 2 ) mutual exclusion AG (request  AF grant) non-starvation AG (N 1  EX T 1 ) non-blocking

16. CTL* Contains both CTL and LTL –path formulas p U q, G p, Fp, Xp,  p, p  q –state formulas A p, E p Note: p in LTL  A p in CTL* CTL* is more powerful than CTL Example: Fairness assumptions A (GF p  GF q)

17. Model checking complexities CTL LTL O(2 f (V+E)) CTL O(f (V+E)) * = Note: all are linear in model size PSPACE COMPLETE

18. LTL vs. Buchi automata Buchi automaton: finite-state automaton accepting infinite words by going forever through some accepting state a 1 a 2 a 3 ……………………………… s 0 s 1 s 2 s 3 ………. f ….. f ….. f ….. f….. Languages accepted by Buchi automata: ω-regular

19. Let φ be an LTL formula with propositions AP. There exists a Buchi automaton B(φ) over alphabet 2 AP accepting exactly the infinite words satisfying φ. Naïve construction: simple recursion on the structure of φ Examples: if φ = X p then B(φ) is if φ = p U q then B(φ) is but: each negation leads to exponential blowup! p q accept p

20. Smarter way: one-step construction exponential number of states given a state of B(φ) and an input, a next state of B(φ) can be computed in PSPACE with respect to φ

21. Example: p U q States: consistent sets of subformulas (or their negations) (  ) subformulas p U q,  (p U q), p,  p, q,  q p, q p U q p,  q, p U q p,  q,  (p U q)  p, q, p U q  p  q,  (p U q) States (consistent sets): Intuition: a state contains the formulas satisfied by all accepted infinite runs starting in that state

22. p,  q, p U q p, q, p U q  p,  q,  (p U q)  p, q, p U q p,  q,  (p U q) all Initial states: all containing p U q Transitions: on assignment in source state

23. Model checking Input: Kripke structure K LTL formula φ 1.Construct B(  φ) 2.Search for runs of K accepted by B(  φ) 3.If none found, output “yes” otherwise, output counter-example run

24. Can be done in NPSPACE, so in PSPACE: Non-deterministically generate runs of K  B(  φ) Accept when looping in where S is a state in K and f is an accepting state of B(  φ) Run of K States of B(  φ) s 0 s 1 s 2 … f …. f … Deterministic algorithm: depth-first search + some efficient bookkeeping O(2 |φ| |K|) S

25. Some other complexities Model checking for CTL: O( | φ| |K|) Satisfiability for CTL: EXPTIME-complete Model checking for CTL*: PSPACE-complete Satisfiability for CTL*: 2-EXPTIME-complete