O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag. 20  Home/Search   Document Not in Database   Summary   Related Articles   Check

.... enable faster model checking than temporal environment assumptions since generally temporal assumptions lead to larger state spaces to be searched [9] The complexities for different assume guarantee reasoning styles with LTL (Linear Time Logic) or CTL (Computational Tree Logic) are explored in [6] [13] Generally speaking, using LTL and CTL as assumptions are both computation hard. The selection is a trade off depending on the applications. In our approach, we use ACTL (AComputational Tree Logic) a subset of CTL, to capture the assumptions because (1) the environment assumptions can be ....

....discusses related work. Section 3 focuses on the tableau construction and Verilog synthesis. Section 4 describes a case study on an ATM switch fabric. Section 5 finally concludes the paper. 2. Related Work The theoretical analysis of the complexity of assumeguarantee reasoning is discussed in [6] and [13] where it is shown that the complexity of using ACTL or LTL as the assumptions in the compositional verification is PSPACEcomplete and EXPSPACE complete, respectively. The tableau size is a key factor affecting the verification efficiency. This motivated us to look into the construction ....

O. Kupferman and M. Y. Vardi. On the complexity of branching modular model checking. In Proceedings of Concurrent Theory, pages 408--422, Philadelphia, Pennsylvania, USA, August 1995. Extended abstract.

....efficient approach to avoid state explosion in model checking tools has been done by means of Ordered Binary Decision Diagrams (OBDD) 12] This approach is called Symbolic Model Checking [16, 52, 69] In order to express the TL formula j, either CTL or LTL logic is used. It has been much debate [37, 63, 78] as to which of these approaches is more suitable for model checking, and the debate continues [91] Particularly, the Cadence SMV tool [101] accepts specifications written in both logics. Cadence SMV is an enhanced version of the traditional SMV [102] tool developed at Carnegie Mellon University ....

Orna Kupferman and Moshe Y. Vardi. On the Complexity of Branching Modular Model Checking. In 6 International Conference on Concurrency Theory, Philadelphia, Pennsylvania, USA, 21-24 August 1995.

....in LTL, the notion of circularity is a somewhat weak one, in that proofs carried out with circular rules are efficiently translatable into proofs with non circular rules, and vice versa. The computational complexity of establishing an assume guarantee triple has been studied extensively in [GL94,KV95,KV97] for various combinations of specification logics. We have considered a different question, that of the complexity of translating between proofs obtained with different compositional rules, whenever this is possible. There are a number of ways one could choose to strengthen the circular ....

O. Kupferman and M. Vardi. On the complexity of branching modular model checking. In CONCUR, volume 962 of LNCS, 1995.

....fragment of computation tree logic (CTL) 6] to be checked with a model checker like SMV [22] The theoretical foundations of this approach are not new. Several researchers have explored the e#cacy and complexity of di#erent styles of assume guarantee reasoning with LTL and CTL specifications [27, 19]. The primary contributions of this paper are pragmatic (i) implementing a tool to synthesize stubs and drivers that encode given LTL assumptions, ii) supporting local assumptions about the behavior of individual components of the environment, and (iii) providing initial experimental evidence of ....

....model checking problem, the assumption is an LTL formula, and the guarantee is a branching temporal logic formula (see e.g. 27] Another approach is branching modular model checking, in which both assumption # and guarantee # are branching temporal logic formulae. This case is considered in [14, 19]. In these papers it is argued that, in the context of modular verification, it is advantageous to use only universal temporal logic (like LTL and ACTL) Universal temporal logic formulae have the helpful property that once they are satisfied in a module, they are also satisfied in any system that ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking (extended abstract). In Insup Lee and Scott A. Smolka, editors, CONCUR '95: Concurrency Theory, 6th International Conference, volume 962 of Lecture Notes in Computer Science, pages 408-422, Philadelphia, Pennsylvania, 2124 August 1995. Springer-Verlag.

....fragment of computation tree logic (CTL) 6] to be checked with a model checker like SMV [22] The theoretical foundations of this approach are not new. Several researchers have explored the efficacy and complexity of different styles of assume guarantee reasoning with LTL and CTL specifications [27, 19]. The primary contributions of this paper are pragmatic (i) implementing a tool to synthesize stubs and drivers that encode given LTL assumptions, ii) supporting local assumptions about the behavior of individual components of the environment, and (iii) providing initial experimental evidence of ....

....model checking problem, the assumption is an LTL formula, and the guarantee is a branching temporal logic formula (see e.g. 27] Another approach is branching modular model checking, in which both assumption OE and guarantee are branching temporal logic formulae. This case is considered in [14, 19]. In these papers it is argued that, in the context of modular verification, it is advantageous to use only universal temporal logic (like LTL and ACTL) Universal temporal logic formulae have the helpful property that once they are satisfied in a module, they are also satisfied in any system that ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking (extended abstract). In Insup Lee and Scott A. Smolka, editors, CONCUR '95: Concurrency Theory, 6th International Conference, volume 962 of Lecture Notes in Computer Science, pages 408-422, Philadelphia, Pennsylvania, 2124 August 1995. Springer-Verlag.

....fragment of computation tree logic (CTL) 7] to be checked with a model checker like SMV [23] The theoretical foundations of this approach are not new. Several researchers have explored the efficacy and complexity of different styles of assume guarantee reasoning with LTL and CTL specifications [29, 20]. The primary contributions of this paper are pragmatic (i) implementing a tool to synthesize safe stubs and drivers that encode given LTL assumptions, ii) supporting local assumptions about the behavior of individual components of the environment, and (iii) providing initial experimental ....

....k M 0 ; i is true, where br(OE) is a branching version (a 8CTL formula) of the LTL formula OE (see [29] for details) Another approach is branching modular model checking, in which both assumption OE and guarantee are branching temporal logic formulae. This case is considered in [15] and in [20] it is shown that the branching modular model checking problem is a proper extension of the linear branching modular model checking problem. In these papers it is argued that, in the context of modular verification, it is advantageous to use only universal temporal logic (like LTL and 8CTL) ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking (extended abstract). In Insup Lee and Scott A. Smolka, editors, CONCUR '95: Concurrency Theory, 6th International Conference, volume 962 of Lecture Notes in Computer Science, pages 408-422, Philadelphia, Pennsylvania, 21-24 August 1995. Springer-Verlag.

....there is another alternative: fold the assumption into the formulae to be checked, e.g. A . The theoretical foundations of this approach are not new. Several researchers have explored the efficacy and complexity of different styles of assume guarantee reasoning with LTL and CTL specifications [22, 15]. Our contribution is in (i) formalizing environment refinement as a weak simulation to prove the safety of our analysis, ii) adapting module checking to account for the kinds of inter unit linkages that appear in software systems, iii) allowing local assumptions about the behavior of individual ....

.... holds in the computation tree that consists of all computations of the program that satisfy A (see e.g. 22] Another approach is branching modular model checking, in which both assumption A and guarantee are branching temporal logic formulae. The latter problem is considered in [12] and in [15] it is shown that the branching modular model checking problem is a proper extension of the linear branching modular model checking problem. In these papers it is argued that, in the context of modular verification, it is advantageous to use only universal branching temporal logic, i.e. branching ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking (extended abstract). In Insup Lee and Scott A. Smolka, editors, CONCUR '95: Concurrency Theory, 6th International Conference, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, Pennsylvania, 21--24 August 1995. Springer-Verlag.

No context found.

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag. 20

No context found.

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....alternatively (as in the proof above) the nondeterministic tree automaton for E: needs to be complemented. The doubly exponential size of the tree automaton then leads to EXPSPACE and 2EXPTIME upper bounds. On the other hand, typical EXPSPACE and 2EXPTIME lower bound proofs for temporal logic [VS85,KV95] require the use of temporal logic formulas that do not t into the restricted syntax that is present in the problems above (e.g. formulas of the form A d for some CTL formula ) VW86b] and let A 0 be nondeterministic B uchi word automaton that accepts exactly all words (i.e. ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408-422, Philadelphia, August 1995. Springer-Verlag.

....expressive power and branching time model checking tools can handle systems with extremely large state spaces [BCM 90, McM93, CGL93] If we examine this issue more closely, however, we find that the computational superiority of CTL over LTL is not that clear. For example, as shown in [Var95, KV95] the advantage that CTL enjoys over LTL disappears also when the complexity of modular verification is considered. The distinction between closed an open systems discussed in this paper questions the computational superiority of the branching time paradigm further. Our conclusion is that the ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....temporal logic formula , if there is an infinite module M 0 of degree k such that MkM 0 satisfies , then there also exists a finite module M 00 of degree k such that MkM 00 satisfies . The alternating automata theoretic approach to CTL and CTL model checking is extended in [KV95] to handle Fair CTL and Fair CTL [EL85] Using the same extension, we can solve the problem of robust model checking also for handle modules augmented with fairness conditions. 4 Universal and Mixed Formulas The study of verification of open system has motivated the use of universal temporal ....

....h ; i iff M satisfies the implication [Pnu85] see also [JT95] The situation is different in the branching paradigm. For universal temporal logic, M satisfies h ; i iff is satisfied in the composition MkM , of M with a module M that embodies all the behaviors that satisfy [GL94, KV95]. For general branching temporal logic, the above is no longer valid. Robust model checking can be viewed as a special case of the assume guarantee setting, where is true. Robust model checking, however, can be used to solve the general assume guarantee setting. Indeed, M satisfies h ; i iff M ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th CONCUR, LNCS 962, pages 408--422, 1995.

....a serious obstacle to industrial scale verification. Various techniques reduce the size of the state space that a model checker must analyze. Some decompose designs into smaller components which are analyzed separately; combining results on the smaller components yields results on the full design [23, 29]. Others reduce the size of individual components through some form of abstraction [11, 18] An abstraction hides some information from a state space to yield a smaller state space. Ideally, operations over the smaller state space should use less resources than over the original state space. ....

Kupferman, O. and M. Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....alternatively (as in the proof above) the nondeterministic tree automaton for E: needs to be complemented. The doubly exponential size of the tree automaton then leads to EXPSPACE and 2EXPTIME upper bounds. On the other hand, typical EXPSPACE and 2EXPTIME lower bound proofs for temporal logic [VS85,KV95] require the use of temporal logic formulas that do not fit into the restricted syntax that is present in the problems above (e.g. formulas of the form A d for some CTL formula ) The generation of interesting witnesses in [BBER97] goes through a search for a counterexample for a ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th CONCUR, LNCS 962, pp. 408--422, 1995.

....the formula AFAGp. We now solve this implication problem. As A and A are CTL formulas, the known 2EXPTIME upper bound for CTL satisfiability [13] suggests an obvious 2EXPTIME upper bound for the problem. Moreover, as A and A are 8CTL formulas, the problem can be solved in EXPSPACE [27]. Can we hope for a better bound This at first seems unlikely: the implication problem is EXPSPACE hard already for in LTL and in 8CTL [27] Here, however, we handle the special case where = A . Hopefully, the tight syntactic relation between and A would enable a more efficient ....

....[13] suggests an obvious 2EXPTIME upper bound for the problem. Moreover, as A and A are 8CTL formulas, the problem can be solved in EXPSPACE [27] Can we hope for a better bound This at first seems unlikely: the implication problem is EXPSPACE hard already for in LTL and in 8CTL [27]. Here, however, we handle the special case where = A . Hopefully, the tight syntactic relation between and A would enable a more efficient check. It is conjectured in [31] that the problem can be solved in polynomial space, which matches our lower bound. The algorithm we present below ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....is very well understood. Theorem 1. 1) SC85, VW86] The fair model checking problem for specification in LTL is PSPACE complete. Determining whether M j= for in LTL can be done in time k2 O(l) and space O( log k l) 2 ) where k is the size of M , and l is the length of . 2) CES86, KV95] The fair model checking problem for specification in CTL is PTIME complete. Determining whether M j= for in CTL can be done in time O(kl) and space O(l log 2 k) where k is the size of M , and l is the length of . 3) EL85a, KV95] The fair model checking problem for specification in ....

....is the size of M , and l is the length of . 2) CES86, KV95] The fair model checking problem for specification in CTL is PTIME complete. Determining whether M j= for in CTL can be done in time O(kl) and space O(l log 2 k) where k is the size of M , and l is the length of . 3) EL85a, KV95] The fair model checking problem for specification in CTL is PSPACE complete. Determining whether M j= for in CTL can be done in time k2 O(l) and space O(l(log k l) 2 ) where k is the size of M , and l is the length of . Since modular model checking with assumption and ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....m is the size of the system and is the length of the formula. Closed System Open System ATL joint complexity PTIME PTIME [CES86] O(m ) ATL structure complexity NLOGSPACE PTIME [BVW94] Fair ATL joint complexity PTIME PTIME [CES86] O(m 2 2 ) Fair ATL structure complexity NLOGSPACE PTIME [KV95] ATL joint complexity PSPACE 2EXPTIME [CES86] m 2 O( ATL sstructure complexity NLOGSPACE PTIME [BVW94] Table 1. Model checking complexity results Acknowledgments. We thank Amir Pnueli, Moshe Vardi, and Mihalis Yannakakis for helpful discussions. We also thank Luca de Alfaro and Freddy ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, 1995.

.... while the validity problem for LTL is PSPACE complete [SC85] the validity problem for CTL is EXPTIME complete [FL79, EH85] and the validity problem for CTL is 2EXPTIMEcomplete [VS85, EJ88] In the rest of this paper we examine four additional verification scenarios: modular verification [KV95] verification of open systems [KV96, KVW98] verification of concurrent systems [BVW94, Kup95] and automata theoretic verification [KV98] In each case we show that CTL does not dominate LTL computationally. In the concluding section of the paper we discuss the implication of these results on ....

....form: h 1 iM 1 h 1 i htrueiM 1 h 1 i h 2 iM 2 h 2 i htrueiM 2 h 2 i 9 = htrueiM 1 kM 2 h 1 2 i Thus, a key step in modular verification is checking that assume guarantee assertions hold, which we called the branching modular model checking problem. Theorem 2. 1 [KV95] 1) The branching modular model checking problem for 8CTL is PSPACE complete. 2) The branching modular model checking problem for 8CTL is EXPSPACE complete. Thus, in the context of modular model checking, 8CTL has the same computational complexity as LTL, while 8CTL is exponentially ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....A and A are equivalent. As A and A are CTL formulas, the known 2EXPTIME upper bound for CTL satisfiability [ES84, EJ88] suggests an obvious 2EXPTIME upper bound for the above equivalence problem. Moreover, as A and A are 8CTL formulas, the problem can be solved in EXPSPACE [KV95] We present here an EXPSPACE algorithm that is much simpler than the one in [KV95] as it avoids Safra s complicated co determinization construction [Saf89] that is used in the definition of the maximal models described there. Our hopes to use the tight syntactic relation between A and A in ....

....upper bound for CTL satisfiability [ES84, EJ88] suggests an obvious 2EXPTIME upper bound for the above equivalence problem. Moreover, as A and A are 8CTL formulas, the problem can be solved in EXPSPACE [KV95] We present here an EXPSPACE algorithm that is much simpler than the one in [KV95] as it avoids Safra s complicated co determinization construction [Saf89] that is used in the definition of the maximal models described there. Our hopes to use the tight syntactic relation between A and A in order to improve this bound were not fulfilled. We conjecture that the problem can be ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th CONCUR, LNCS 962. pp. 408--422,1995.

....checking and yet overcome many of its expressiveness limitations. On the other hand, the computational superiority of CTL is also not that clear. For example, comparing the complexities of CTL and LTL model checking for concurrent programs, both are in PSPACE [VW86a, BVW94] As shown in [Var95, KV95] the advantage that CTL enjoys over LTL disappears also when the complexity of modular verification is considered. The distinction between closed an open systems questions the computational superiority of the branching time paradigm further. Indeed, the traditional belief of CTL is easier than ....

....checking, the usual argument that, from a complexity point of view, CTL is easier than LTL, topples. Indeed, the situation is then similar to the one existing for validity checking. In both problems, CTL is harder than LTL, and the universal fragment of CTL is easier than its existential one [KV95] Finally, we note that the additional difficulties that need to be faced when we move from verification of closed systems to verification of open systems, do not arise when we consider verification by bisimulation [Mil71] To see this, consider two modules M and M 0 . When we label the states ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....the unremitting increase in design complexity, known as the state explosion problem, remains a serious obstacle to industrial scale verification. Research into combating state explosion takes many forms, including alternate representations of transition systems [3, 32] compositional reasoning [20, 27], and various state space reduction techniques [10, 14, 25] Most of the latter techniques are a form of abstraction. An abstraction suppresses information from a concrete state space by mapping it into a smaller, abstract state space. Each set of concrete states mapping to a single abstract state ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conference on Concurrency Theory, volume 962 of Lecture Notes in Computer Science, pages 408--422, Philadelphia, August 1995. Springer-Verlag.

....handles the logic, and the nonemptiness test handles the algorithmics. This separation makes both components simple and enables us to identify the exact complexity of the model checking problem. Second, using Libi alternating automata (LAA) which are HAA augmented with a fairness condition [KV95], we can restrict path quantification in TCTL to range only over computations of the program that diverge (i.e. in which time always proceed) and we can extend our method to fair TCTL. Both extensions do not exist in the algorithm TMC. Most importantly, as the nonemptiness test for LAA combines ....

....with which c is compared. This can be specified using the generalized Buchi fairness condition: a sequence of region diverges iff for every clock c 2 CU , the sequence visits infinitely often a region with either c = 0 or c v c . In order to perform fair model checking, HAA were extended in [KV95] to Libi Alternating Automata (LAA) A LAA is an HAA extended with a generalized Buchi fairness condition fi 2 Q ; i.e. fi is a set of subsets of the state space of the LAA (the version presented in [KV95] uses a Rabin fairness condition) For a run of a LAA with an acceptance condition ff ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, pages 408--422, Philadelphia, August 1995.

....checking and yet overcome many of its expressiveness limitations. On the other hand, the computational superiority of CTL is also not that clear. For example, comparing the complexities of CTL and LTL model checking for concurrent programs, both are in PSPACE [VW86a, BVW94] As shown in [Var95, KV95] the advantage that CTL enjoys over LTL disappears also when the complexity of modular verification is considered. In this work we questioned the computational superiority of the branching time paradigm further. We showed that when reasoning about open systems, the complexity of CTL model ....

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th Conferance on Concurrency Theory, pages 408--422, Philadelphia, August 1995.

.... and guarantee if and only if in all compositions of M with E , if the composition satisfies , then it satisfies as well. Checking assume guarantee specifications is helpful in modular verification [GL94] For universal temporal logics, automatic methods for this check are suggested in [Pnu85, Var95, KV95]. These methods depend on the fact that the simulation order captures agreement on universal temporal logic formulas, and they cannot be extended to handle non universal formulas. Module checking can be viewed as a special case of the assume guarantee paradigm, where the guarantee may be any ....

....only universal path quantification is allowed) has been studied in the literature. Hence the following theorem. Theorem 1. 1) KV96] The module checking problem with incomplete information is PTIME complete (and solvable in linear time) for 8CTL and is PSPACE complete for LTL and 8CTL . 2) [Pnu85, KV95] The assume guarantee module checking problem is PSPACE complete for LTL and 8CTL and is EXPSPACE complete for 8CTL . As with module checking, things becomemore challenging whenwe turn to solve the problems for the case and are not necessarily universal temporal logic formulas. We first ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In Proc. 6th CONCUR, LNCS 962, pp. 408--422, August 1995.

No context found.

O. Bernholz (Kupferman), M. Vardi, `On the Complexity of Branching Modular Model Checking, ' Proc. CONCUR95 Conference , Philadelphia, August 1995.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC