O. Kupferman and M.Y. Vardi. Module checking revisited. In Computer Aided Verification, Proc. 9th International Conference, volume 1254 of Lecture Notes in Computer Science, pages 36--47. Springer-Verlag, 1997.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....the notion of circularity is a somewhat weak one, in that proofs carried out with circular rules are efficiently translatable into proofs with non circular rules, and vice versa. The computational complexity of establishing an assume guarantee triple has been studied extensively in [GL94,KV95,KV97] for various combinations of specification logics. We have considered a different question, that of the complexity of translating between proofs obtained with different compositional rules, whenever this is possible. There are a number of ways one could choose to strengthen the circular proof ....

O. Kupferman and M. Vardi. Module checking revisited. In CAV, volume 1254 of LNCS, 1997.

....system components. In general, we wish to incorporate partial knowledge about the behavior of an open system s environment for a broad class of environments. This knowledge effectively converts an open system to a closed system that can be safely verified. Recent work by Kupferman and Vardi [13] develops complexity results for model checking of partial systems in the presence of temporal logic formulae that describe environment assumptions. Dwyer and Schmidt [11] show that either temporal logic formulae or finite state automata can be used to filter an imprecise description of a system, ....

O. Kupferman and M. Vardi. Module checking revisited. In Proceedings of the Eighth International Workshop on Computer Aided Verification, July 1997.

....sequences then the property holds, otherwise the sequences are presented to the user as exhibits of erroneous system behavior. 3.2 Module Checking In computer system design, a closed system is a system whose behavior is completely determined by the state of the system. An open system (or module [22, 23]) is a system that interacts with its environment and whose behavior depends on this interaction. Given an open system and temporal logic formula, the module checking problem asks whether for all possible environments, the composition of the model with the environment satisfies the formula. ....

....behavior of each sub system (e.g. 6] then perform analyses using interfaces in place of the details of the sub systems. This notion of capturing environment behavior with interfaces also appears in recent developments on theoretical issues related to model checking of partial systems (e.g. [22, 23]) There has been considerably less work on the practical issues involved with finite state verification of partial systems. Aside from our work with FLAVERS, discussed in Section 3, there are two other recent related practical efforts. Avrunin, Dillon and Corbett [5] have developed a technique ....

O. Kupferman and M. Vardi. Module checking revisited. In Proceedings of the Eighth International Workshop on Computer Aided Verification, July 1997.

....the ACTL tableau construction. Unfortunately, no efficient technique exists to check or compute fair preorder between models. In [17] Grumberg and Long suggest how to check the fair preorder only for a few trivial cases. Kupferman and Vardi showed that the general case is PSPACE hard to compute [22]. Henzinger, Kupferman, and Rajamani [18] have proposed a new type of fair preorder that can be computed in polynomial time. However, it is not clear that this preorder is appropriate for compositional reasoning. 6.1.1 Example: The Futurebus Protocol. David Long has used this type of reasoning ....

O. Kupferman and M. Y. Vardi. Module checking revisited. In O. Grumberg, editor, Proc. of the 9th conference on Computer-Aided Verification (CAV'97), volume 1254 of LNCS, pages 36--47, Haifa, June 1997.

No context found.

O. Kupferman and M.Y. Vardi. Module checking revisited. In Computer Aided Verification, Proc. 9th International Conference, volume 1254 of Lecture Notes in Computer Science, pages 36--47. Springer-Verlag, 1997.

.... As for branching time settings, control problems for settings with maximal environment is studied in [Ant95] Also, for maximal environments, the control problem can be transformed (by ipping the role of the system and the environment) into module checking problems solved in [KV96,KV97a]. Yet another work, but in a di erent framework is [MT98] where the speci cation is also modeled by a transition system and the correctness criterion is that there should be a behavior preserving simulation from the plant 2 to the speci cation. This has been later extended to the case of ....

....of linear versus branching temporal logics, cf. Lam80,Pnu85] We mainly refer here to the linear temporal logic LTL and the branching temporal logic CTL. One of the beliefs dominating this discussion has been while specifying is easier in LTL, model checking is easier for CTL . As is argued in [KV96,KV97a,KV99b], the computational advantage of CTL over LTL (cf. CGP99] disappears once one considers reactive environments. Our results here show that the same phenomenon occurs in the context of the synthesis problem and the control problem: once one considers reactive environments, the problems for LTL ....

O. Kupferman and M.Y. Vardi. Module checking revisited. In Computer Aided Verication, Proc. 9th Int. Conference, volume 1254 of Lecture Notes in Computer Science, pages 36-47. Springer-Verlag, 1997.

....a different disabling of the external nondeterministic choices. Accordingly, there are many different possible environments to consider. It turned out that model checking methods are applicable also for verification of open systems with respect to universal temporal logic formulas [MP92, KV96, KV97a] To see this, consider an execution of an open system in a maximal environment; i.e. an environment that enables all the external nondeterministic choices. The result is a closed system, and it is simulated by any other execution of the system in some environment. Therefore, one can check ....

....can happen no matter what the eating habits of the people in line are. Note that while this requirement holds with respect to the maximal environment, it does not hold, for instance, in an environment in which all the people in line do not like ham. Module checking is suggested in [KV96, KVW97,KV97a] as a general method for verification of open systems (we use the terms open system and module interchangeably) Given a module M and a temporal logic formula , the module checking problem asks whether for all possible environments E , the execution of M in E satisfies . There are two ways ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. Module checking revisited. In Computer Aided Verification, Proc. 9th Int. Conference, volume 1254 of Lecture Notes in Computer Science, pages 36--47. Springer-Verlag, 1997.

.... As for branching time settings, synthesis of memoryless controllers for settings with maximal environments is studied in [Ant95] Also, for maximal environments, the control problem can be transformed (by ipping the role of the system and the environment) into module checking problems solved in [KV96,KV97]. Yet another work, but in a di erent framework is [MT98] where the speci cation is also modeled by a transition system and the correctness criterion is that there should be a behavior preserving simulation from the plant to the speci cation. This has been later extended to the case of ....

O. Kupferman and M.Y. Vardi. Module checking revisited. In Proc. 9th CAV, LNCS 1254, pages 36-47, 1997.

....can consistently disable the transition from the read state to the get state, and detects the fact that the ATM cannot always get money eventually. The model discussed in [KV96] is somewhat simplistic as it does not allow the system to have internal variables. This assumption is removed in [KV97], which considers module checking with incomplete information. In this setting, the system has internal variables, which the environment cannot read. While [KV96] considers arbitrary disabling of transitions, the setting in [KV97] is such that whenever two computations of the system differ only in ....

....the system to have internal variables. This assumption is removed in [KV97] which considers module checking with incomplete information. In this setting, the system has internal variables, which the environment cannot read. While [KV96] considers arbitrary disabling of transitions, the setting in [KV97] is such that whenever two computations of the system differ only in the values of internal variables along them, the disabling of transitions along them coincide. While the setting in [KV97] is more general, it still does not solve the general robust model checking problem. To see this, let us go ....

[Article contains additional citation context not shown here]

O. Kupferman and M.Y. Vardi. Module checking revisited. In Proc. 9th CAV, LNCS 1254, pages 36--47, 1997.

....both are PSPACE complete [52,2] As shown in [49,27] the advantage that CTL enjoys over LTL disappears also when the complexity of modular verification is considered. The distinction between closed an open systems questions the computational superiority of the branching time paradigm further [28,29,50]. Our conclusion is that the debate about the relative merit of the linear and branching paradigms will not be settled by technical arguments such as expressive power or computational complexity. Rather, the discussion should focus on the attractiveness of the approaches to practitioners who ....

O. Kupferman and M.Y. Vardi. Module checking revisited. In Computer Aided Verification, Proc. 9th Int. Conference, volume 1254 of Lecture Notes in Computer Science, pages 36--47. Springer-Verlag, 1997.

....the synchronous [Yan97] and asynchronous [PR79] cases. In the special case that all path quantifiers are parameterized by single agents, and no cooperation between agents with different information is possible, decidability follows from the results on module checking with incomplete information [KV97] In this case, the model checking complexity for both synchronous and asynchronous ATL is EXPTIME complete, and 2EXPTIME complete for ATL . The structure complexity of all four problems is EXPTIME complete, thus rendering reasoning about agents with incomplete information infeasible even ....

O. Kupferman, M.Y. Vardi. Module checking revisited. Proc. CAV, Springer LNCS 1254, pp. 36--47, 1997.

....BVW94] As shown in [Var95, KV95] the advantage that CTL enjoys over LTL disappears also when the complexity of modular verification is considered. The distinction between closed an open systems questions the computational superiority of the branching time paradigm further. As shown in [KV96, KV97] while for LTL specifications, the model checking paradigm is applicable also for the verification of open systems, this is not true for CTL specifications. The ability of CTL to quantify computations existentially requires a more careful check, in which all possible environments are taken into ....

O. Kupferman and M.Y. Vardi. Module checking revisited. In Proc. 9th CAV, LNCS 1254, pp. 36--47, 1997.

No context found.

O. Kupferman and M. Y. Vardi. Module checking revisited. In O. Grumberg, editor, Proc. of the 9th conference on Computer-AidedVeri#cation #CAV'97#,volume 1254 of LNCS, pages 36#47, Haifa, June 1997.

No context found.

O. Kupferman and M.Y. Vardi. Module checking revisited. In Proc. of the 9th Intern. Conference on Computer Aided Veri cation, CAV'97, LNCS 1254, pages 36-47, June 1997.

No context found.

O. Kupferman and M.Y. Vardi. Module checking revisited. In CAV'97, volume 1254 of Lecture Notes in Computer Science, pages 36--47. Springer, 1997.

No context found.

O. Kupferman and M.Y. Vardi. Module checking revisited. In Proc. of the 9th Intern. Conference on Computer Aided Veri cation, CAV'97, LNCS 1254, pages 36-47, June 1997.

No context found.

Kupferman and M. Y. Vardi. Module checking revisited. In Proc. of the 9th Conference on Computer-Aided Verification (CAV97), pages 36--47, Haifa, Israel, June 1997.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC