31,590 research outputs found
Rich Counter-Examples for Temporal-Epistemic Logic Model Checking
Model checking verifies that a model of a system satisfies a given property,
and otherwise produces a counter-example explaining the violation. The verified
properties are formally expressed in temporal logics. Some temporal logics,
such as CTL, are branching: they allow to express facts about the whole
computation tree of the model, rather than on each single linear computation.
This branching aspect is even more critical when dealing with multi-modal
logics, i.e. logics expressing facts about systems with several transition
relations. A prominent example is CTLK, a logic that reasons about temporal and
epistemic properties of multi-agent systems. In general, model checkers produce
linear counter-examples for failed properties, composed of a single computation
path of the model. But some branching properties are only poorly and partially
explained by a linear counter-example.
This paper proposes richer counter-example structures called tree-like
annotated counter-examples (TLACEs), for properties in Action-Restricted CTL
(ARCTL), an extension of CTL quantifying paths restricted in terms of actions
labeling transitions of the model. These counter-examples have a branching
structure that supports more complete description of property violations.
Elements of these counter-examples are annotated with parts of the property to
give a better understanding of their structure. Visualization and browsing of
these richer counter-examples become a critical issue, as the number of
branches and states can grow exponentially for deeply-nested properties.
This paper formally defines the structure of TLACEs, characterizes adequate
counter-examples w.r.t. models and failed properties, and gives a generation
algorithm for ARCTL properties. It also illustrates the approach with examples
in CTLK, using a reduction of CTLK to ARCTL. The proposed approach has been
implemented, first by extending the NuSMV model checker to generate and export
branching counter-examples, secondly by providing an interactive graphical
interface to visualize and browse them.Comment: In Proceedings IWIGP 2012, arXiv:1202.422
Degree of Sequentiality of Weighted Automata
Weighted automata (WA) are an important formalism to describe quantitative properties. Obtaining equivalent deterministic machines is a longstanding research problem. In this paper we consider WA with a set semantics, meaning that the semantics is given by the set of weights of accepting runs. We focus on multi-sequential WA that are defined as finite unions of sequential WA. The problem we address is to minimize the size of this union. We call this minimum the degree of sequentiality of (the relation realized by) the WA.
For a given positive integer k, we provide multiple characterizations of relations realized by a union of k sequential WA over an infinitary finitely generated group: a Lipschitz-like machine independent property, a pattern on the automaton (a new twinning property) and a subclass of cost register automata. When possible, we effectively translate a WA into an equivalent union of k sequential WA. We also provide a decision procedure for our twinning property for commutative computable groups thus allowing to compute the degree of sequentiality. Last, we show that these results also hold for word transducers and that the associated decision problem is PSPACE
-complete
Variability Abstraction and Refinement for Game-Based Lifted Model Checking of Full CTL
One of the most promising approaches to fighting the configuration space explosion problem in lifted model checking are variability abstractions. In this work, we define a novel game-based approach for variability-specific abstraction and refinement for lifted model checking of the full CTL, interpreted over 3-valued semantics. We propose a direct algorithm for solving a 3-valued (abstract) lifted model checking game. In case the result of model checking an abstract variability model is indefinite, we suggest a new notion of refinement, which eliminates indefinite results. This provides an iterative incremental variability-specific abstraction and refinement framework, where refinement is applied only where indefinite results exist and definite results from previous iterations are reused. The practicality of this approach is demonstrated on several variability models
Discounting in LTL
In recent years, there is growing need and interest in formalizing and
reasoning about the quality of software and hardware systems. As opposed to
traditional verification, where one handles the question of whether a system
satisfies, or not, a given specification, reasoning about quality addresses the
question of \emph{how well} the system satisfies the specification. One
direction in this effort is to refine the "eventually" operators of temporal
logic to {\em discounting operators}: the satisfaction value of a specification
is a value in , where the longer it takes to fulfill eventuality
requirements, the smaller the satisfaction value is.
In this paper we introduce an augmentation by discounting of Linear Temporal
Logic (LTL), and study it, as well as its combination with propositional
quality operators. We show that one can augment LTL with an arbitrary set of
discounting functions, while preserving the decidability of the model-checking
problem. Further augmenting the logic with unary propositional quality
operators preserves decidability, whereas adding an average-operator makes some
problems undecidable. We also discuss the complexity of the problem, as well as
various extensions
Bounded Refinement Types
We present a notion of bounded quantification for refinement types and show
how it expands the expressiveness of refinement typing by using it to develop
typed combinators for: (1) relational algebra and safe database access, (2)
Floyd-Hoare logic within a state transformer monad equipped with combinators
for branching and looping, and (3) using the above to implement a refined IO
monad that tracks capabilities and resource usage. This leap in expressiveness
comes via a translation to "ghost" functions, which lets us retain the
automated and decidable SMT based checking and inference that makes refinement
typing effective in practice.Comment: 14 pages, International Conference on Functional Programming, ICFP
201
The Hardness of Finding Linear Ranking Functions for Lasso Programs
Finding whether a linear-constraint loop has a linear ranking function is an
important key to understanding the loop behavior, proving its termination and
establishing iteration bounds. If no preconditions are provided, the decision
problem is known to be in coNP when variables range over the integers and in
PTIME for the rational numbers, or real numbers. Here we show that deciding
whether a linear-constraint loop with a precondition, specifically with
partially-specified input, has a linear ranking function is EXPSPACE-hard over
the integers, and PSPACE-hard over the rationals. The precise complexity of
these decision problems is yet unknown. The EXPSPACE lower bound is derived
from the reachability problem for Petri nets (equivalently, Vector Addition
Systems), and possibly indicates an even stronger lower bound (subject to open
problems in VAS theory). The lower bound for the rationals follows from a novel
simulation of Boolean programs. Lower bounds are also given for the problem of
deciding if a linear ranking-function supported by a particular form of
inductive invariant exists. For loops over integers, the problem is PSPACE-hard
for convex polyhedral invariants and EXPSPACE-hard for downward-closed sets of
natural numbers as invariants.Comment: In Proceedings GandALF 2014, arXiv:1408.5560. I thank the organizers
of the Dagstuhl Seminar 14141, "Reachability Problems for Infinite-State
Systems", for the opportunity to present an early draft of this wor
Proving Abstractions of Dynamical Systems through Numerical Simulations
A key question that arises in rigorous analysis of cyberphysical systems
under attack involves establishing whether or not the attacked system deviates
significantly from the ideal allowed behavior. This is the problem of deciding
whether or not the ideal system is an abstraction of the attacked system. A
quantitative variation of this question can capture how much the attacked
system deviates from the ideal. Thus, algorithms for deciding abstraction
relations can help measure the effect of attacks on cyberphysical systems and
to develop attack detection strategies. In this paper, we present a decision
procedure for proving that one nonlinear dynamical system is a quantitative
abstraction of another. Directly computing the reach sets of these nonlinear
systems are undecidable in general and reach set over-approximations do not
give a direct way for proving abstraction. Our procedure uses (possibly
inaccurate) numerical simulations and a model annotation to compute tight
approximations of the observable behaviors of the system and then uses these
approximations to decide on abstraction. We show that the procedure is sound
and that it is guaranteed to terminate under reasonable robustness assumptions
The Reach-Avoid Problem for Constant-Rate Multi-Mode Systems
A constant-rate multi-mode system is a hybrid system that can switch freely
among a finite set of modes, and whose dynamics is specified by a finite number
of real-valued variables with mode-dependent constant rates. Alur, Wojtczak,
and Trivedi have shown that reachability problems for constant-rate multi-mode
systems for open and convex safety sets can be solved in polynomial time. In
this paper, we study the reachability problem for non-convex state spaces and
show that this problem is in general undecidable. We recover decidability by
making certain assumptions about the safety set. We present a new algorithm to
solve this problem and compare its performance with the popular sampling based
algorithm rapidly-exploring random tree (RRT) as implemented in the Open Motion
Planning Library (OMPL).Comment: 26 page
Revisiting Synthesis for One-Counter Automata
We study the (parameter) synthesis problem for one-counter automata with
parameters. One-counter automata are obtained by extending classical
finite-state automata with a counter whose value can range over non-negative
integers and be tested for zero. The updates and tests applicable to the
counter can further be made parametric by introducing a set of integer-valued
variables called parameters. The synthesis problem for such automata asks
whether there exists a valuation of the parameters such that all infinite runs
of the automaton satisfy some omega-regular property. Lechner showed that (the
complement of) the problem can be encoded in a restricted one-alternation
fragment of Presburger arithmetic with divisibility. In this work (i) we argue
that said fragment, called AERPADPLUS, is unfortunately undecidable.
Nevertheless, by a careful re-encoding of the problem into a decidable
restriction of AERPADPLUS, (ii) we prove that the synthesis problem is
decidable in general and in N2EXP for several fixed omega-regular properties.
Finally, (iii) we give a polynomial-space algorithm for the special case of the
problem where parameters can only be used in tests, and not updates, of the
counter
- …