Our growing dependence on increasingly complex computer and software systems necessitates the development of formalisms, techniques, and tools for assessing functional properties of these systems. One such technique that has emerged in the last twenty years is model checking, which systematically (and automatically) checks whether a model of a given system satisfies a desired property such as deadlock freedom, invariants, and request-response properties. This automated technique for verification and debugging has developed into a mature and widely used approach with many applications. Principles of Model Checking offers a comprehensive introduction to model checking that is not only a text suitable for classroom use but also a valuable reference for researchers and practitioners in the field. The book begins with the basic principles for modeling concurrent and communicating systems, introduces different classes of properties (including safety and liveness), presents the notion of fairness, and provides automata-based algorithms for these properties. It introduces the temporal logics LTL and CTL, compares them, and covers algorithms for verifying these logics, discussing real-time systems as well as systems subject to random phenomena. Separate chapters treat such efficiency-improving techniques as abstraction and symbolic manipulation. The book includes an extensive set of examples (most of which run through several chapters) and a complete set of basic results accompanied by detailed proofs. Each chapter concludes with a summary, bibliographic notes, and an extensive list of exercises of both practical and theoretical nature.

/pdf/principles-of-model-checking-249iimickz.pdf

Principles of Model Checking

Model Checking

The SPIN Model Checker is used for both teaching software verification techniques, and for validating large scale applications. The growing number of users has created a need for a more comprehensive user guide and a standard reference manual that describes the most recent version of the tool. This book fills that need. SPIN is used in over 40 countries. The offical SPIN web site, spinroot.com receives between 2500 and 3000 hits per day. It has been estimated that up to three-quarters of the $400 billion spent annually to hire programmers in the United States is ultimately spent on debugging

The SPIN Model Checker: Primer and Reference Manual

Temporal logic comes in two varieties: linear-time temporal logic assumes implicit universal quantification over all paths that are generated by the execution of a system; branching-time temporal logic allows explicit existential and universal quantification over all paths. We introduce a third, more general variety of temporal logic: alternating-time temporal logic offers selective quantification over those paths that are possible outcomes of games, such as the game in which the system and the environment alternate moves. While linear-time and branching-time logics are natural specification languages for closed systems, alternating-time logics are natural specification languages for open systems. For example, by preceding the temporal operator "eventually" with a selective path quantifier, we can specify that in the game between the system and the environment, the system has a strategy to reach a certain state. The problems of receptiveness, realizability, and controllability can be formulated as model-checking problems for alternating-time formulas. Depending on whether or not we admit arbitrary nesting of selective path quantifiers and temporal operators, we obtain the two alternating-time temporal logics ATL and ATLa.ATL and ATLa are interpreted over concurrent game structures. Every state transition of a concurrent game structure results from a choice of moves, one for each player. The players represent individual components and the environment of an open system. Concurrent game structures can capture various forms of synchronous composition for open systems, and if augmented with fairness constraints, also asynchronous composition. Over structures without fairness constraints, the model-checking complexity of ATL is linear in the size of the game structure and length of the formula, and the symbolic model-checking algorithm for CTL extends with few modifications to ATL. Over structures with weak-fairness constraints, ATL model checking requires the solution of 1-pair Rabin games, and can be done in polynomial time. Over structures with strong-fairness constraints, ATL model checking requires the solution of games with Boolean combinations of Buchi conditions, and can be done in PSPACE. In the case of ATLa, the model-checking problem is closely related to the synthesis problem for linear-time formulas, and requires doubly exponential time.

/pdf/alternating-time-temporal-logic-3du0km9tzh.pdf

Alternating-time temporal logic

The subject of this chapter is the study of formal languages (mostly languages recognizable by finite automata) in the framework of mathematical logic.

/pdf/languages-automata-and-logic-418xw4tas7.pdf

Languages, automata, and logic

A central aim and ever-lasting dream of computer science is to put the development of hardware and software systems on a mathematical basis which is both firm and practical. Such a scientific foundation is needed especially for the construction of reactive programs, like communication protocols or control systems.

For the construction and analysis of reactive systems an elegant and powerful theory has been developed based on automata theory, logical systems for the specification of nonterminating behavior, and infinite two-person games.

The 19 chapters presented in this multi-author monograph give a consolidated overview of the research results achieved in the theory of automata, logics, and infinite games during the past 10 years. Special emphasis is placed on coherent style, complete coverage of all relevant topics, motivation, examples, justification of constructions, and exercises.

Automata logics, and infinite games: a guide to current research

Automata Logics, and Infinite Games

We investigate the power of first-order logic with only two variables over /spl omega/-words and finite words, a logic denoted by FO/sup 2/. We prove that FO/sup 2/ can express precisely the same properties as linear temporal logic with only the unary temporal operators: "next", "previously", "sometime in the future", and "sometime in the past", a logic we denote by unary-TL. Moreover, our translation from FO/sup 2/ to unary-TL converts every FO/sup 2/ formula to an equivalent unary-TL formula that is at most exponentially larger, and whose operator depth is at most twice the quantifier depth of the first-order formula. We show that this translation is optimal. While satisfiability for full linear temporal logic, as well as for unary-TL, is known to be PSPACE-complete, we prove that satisfiability for FO/sup 2/ is NEXP-complete, in sharp contrast to the fact that satisfiability for FO/sup 3/ has non-elementary computational complexity. Our NEXP time upper bound for FO/sup 2/ satisfiability has the advantage of being in terms of the quantifier depth of the input formula. It is obtained using a small model property for FO/sup 2/ of independent interest, namely: a satisfiable FO/sup 2/ formula has a model whose "size" is at most exponential in the quantifier depth of the formula. Using our translation from FO/sup 2/ to unary-TL we derive this small model property from a corresponding small model property for unary-TL. Our proof of the small model property for unary-TL is based on an analysis of unary-TL types.

First-order logic with two variables and unary temporal logic

Stutter-invariant temporal properties are expressible without the next-time operator

A monadic second-order language, denoted by $\mathcal{L}d$, is introduced for the specification of sets of timed state sequences. A fragment of $\mathcal{L}d$, denoted by 

, is proved to be expressively complete for timed automata (Alur and Dill), i.e., every timed regular language is definable by a 

-formula and every 

-formula defines a timed regular language. As a consequence the satisfiability problem for 

is decidable.

Thomas Wilke

Papers

Automata logics, and infinite games: a guide to current research

Automata Logics, and Infinite Games

First-order logic with two variables and unary temporal logic

Stutter-invariant temporal properties are expressible without the next-time operator

Specifying Timed State Sequences in Powerful Decidable Logics and Timed Automata