1. How CTL model checking works
Model Checking II
How CTL model checking works

2. CTL A E X F G U Model checking problem Determine M, s0 f
Or find all s s.t M, s f

3. Need only
E X F G U
define others
e.g.
AG p   EF p
AF p   EG p

4. Explicit state model checking
Option CES (original paper)
Represent state transition graph explicitly
Walk around marking states
Graph algorithms involving strongly connected components etc.
Not covered in this course (cf. SPIN)
Used particularly in software model checking

5. Symbolic MC Option 2 McMillan et al because of STATE EXPLOSION problem
State graph exponential in program/circuit size
Graph algorithms linear in state graph size
INSTEAD
Use symbolic representation of both sets of states
and of state transtion graph

6. Symbolic MC Fixed point characerisations of CTL ops
Sets of states formulas
relations between states (BDDs)
Fixed point characerisations of CTL ops
NO explicit state graph

7. A state
Vector of boolean variables
(v1,v2,v3, …., vn)  {0,1}n

8. Boolean formulas (x  y)  z ( is exclusive or) (1  0)  0 = 1
(1  0)  = 1
assignment [x=1,y=0,z=0] gives answer 1
is a model or satisfying assignment
Write as 101
Exercise: Find another model

9. Boolean formulas (x  y)  z ( is exclusive or) (1  1)  0 = 0
(1  1)  = 0
assignment [x=1,y=1,z=0] is not a model

10. Formula is a tautology if ALL assignments are models and is contradictory if NONE is.

11. Boolean formulas
For us, interesting formulas are somewhere in between: some assignments are models, some not
IDEA: A formula can represent a set of states (its models)

12. {000,001, … , 111} true {} false {111} x  y  z {101} x  y  z
{111,101} x  z .
{000,001, … , 111} true

13. Example (x  y)  z represents {100,010,110,111}
(x  y)  z is in form ({100,010,110,111},xyz)
Exercise: Find formulas (with var. names x,y,z) for the sets {}
{100}
{110,100,010,000}

14. Exercise Find an element of form({001,010,100},abc)
Will slarva and write form(P,vs) to stand
for a formula representing P and using variables vs

15. What is needed now? A good data structure for boolean formulas
Binary Decision Diagrams (BDDs)
Akers (IEEE Trans. Comp 78)
Bryant (IEEE Trans. Comp. 86, most cited CS paper!)
see also Bryant’s document about a Hitachi patent from 93
McMillan saw application to symbolic MC

16. Binary Decision Diagrams
Canonical form (constant time comparison)
Polynomial algorithms for ’and’, ’or’, ’not’ etc.
Exponential but practically efficient algorithm for boolean quantification
(Presentation based on lecture notes by Ken McMillan)

17. Ordered Decision Tree ab + cd (ab)  (cd) a 0 1 b b 0 1 0 1 c c c c b b c c c c d d d d d d d d

18. To get OBDD Combine isomorphic subtrees
Eliminate redundant nodes (those with identical children)
Tree becomes a graph

19. (O)BDD
ab + cd
(ab)  (cd) a 1 b c 1 d 1

20. Make BDD for
(x  y)  z

21. Combining BDDs
apply algorithm (for building and of two BDDs, or of two BDDs etc.)
v is top variable in either f or g
Solve recursively for v=0 and v=1 to get 0 and 1 branches of result node
Do not create new result node if both brances equal (return that result) or if equivalent node already exists in reduce table. (The apply function is also memoized.)
Terminates when both f and g constants (1 or 0)

22. Quantification b. f is f | b=0  f | b=1
get by replacing each b node by its 0 branch
also have efficient algorithm for quantifying over a set of variables

23. BDDs + Many formulas (and circuits) have small representations
-Some do not! Multipliers
- BDD representation of a function can vary exponentially in size depending on variable ordering; users may need to play with variable orderings (less automatic)
+ Good algorithms and packages (e.g. CUDD)
+ EXTREMELY useful in practice
- Size limitations a big problem

24. Exercise revisited
Find a BDD for your
form({001,010,100},abc)

25. Lattice
{000,001, …. , 110, 111} .
{000,001} {000,010} {110,111}
{000} {001} {010} {110} {111} {}

26. form({},v) false
form(PQ,v) form(P,v)  form(Q,v)
form(PQ,v) form(P,v)  form(Q,v)

27. R set of pairs of states R R R R p
Image(P,R)
{t  s s  P  s R t}

28. Forward image {t  s s  P  s R t}  R R R R Image(P,R) p
form(Image(P,R),v’) = v form(P,v)  form(R,(v,v’)) 

29. Backward image {s  t t  Q  s R t}  R R R R Q
form(Image-1(Q,R),v) = v form(Q,v’)  form(R,(v,v’)) 

30. Symbolic MC of CTL
Compute set of states satisfying a formula recursively (and use BDDs as rep.)
consider E cases define others
e.g.
AX p   EX p
A (p U q)  ?

31. CTL formula f H(f) set of states satisfying f
a (atomic) L(a) (cf. Lars)
p S – H(p)
p  q H(p)  H(q)
P  q ?
EX p familiar ?

32. CTL formula f H(f) set of states satisfying f
P  q H(p)  H(q)
EX p Image-1(H(p),R)

33. Remaining operators Fixed point characterisation EF p  p  EX (EF p)
least fixed point

34. Fixed points f : set of S -> set of S Monotonic
x  y => f(x)  f(y)
Fixed point
y s.t f(y) = y

35. Fixed points monotonic f has Least fixed point y. f(y) [lfp y. f(y)]
Greatest fixed point y. F(y)
[gfp y. F(y)]

36. Lattice again {000,001, …. , 110, 111} . {000,001} {000,010} {110,111}
{000,001} {000,010} {110,111}
{000} {001} {010} {110} {111} {}

37. Lattice (S finite) S . {}

38. Fixed points {}  f({})  f(f({}))  f(f(f({})))  ….
Limit is the least fixed point y. f(y)
S  f(S)  f(f(S)  f(f(f(S)))  ….
Limit is greatest fixed point y. f(y)

39. CTL EF p  p  EX (EF p) H(EF p) = y. H(p)  H( EX y)
= y. H(p)  Image-1(y,R)

40. Fixed point iteration
S0 = H(p)
Si+1 = H(p)  Image-1(Si,R)

41. Fixed point iteration P

42. Fixed point iteration
p  EX (p  EX p) P

43. Fixed point iteration
Evetually stops! P

44. Concrete example
010
011

45. Concrete example 7 4 6
010
011 1 5 2 3
EF p p = dreq  q0  dack

46. dack
and or q0
dreq
Boxes with funny arrows are clocked D flip-flops (like Magnus showed before)
We will study this example
and

47. EG
EG p  p  EX (EG p)
H(EG p)
= y. H(p)  Image-1(y,R)

48. EG EG p  p  EX (EG p) H(EG p) = y. H(p)  Image-1(y,R)
NB: We can do all of these operations using BDDs to represent the sets

49. Fixed point interation in the other direction

50. Fixed point interation in the other direction
p  EX p P

51. Fixed point interation in the other direction
p  EX (p  EX p) P

52. Fixed point interation in the other direction
p  EX (p  EX p) …. p

53. Concrete example 7 4 6
010
011 1 5 2 3
EG p p = (dreq  q0 )  dack

54. EU E (p U g)  q  (p  EX (E (p U g) ) H(E (p U g) )
= y. H(q)  (H(p)  Image-1(y,R))
Exercise: define H (A(p U q))

55. All done with BDDS!
Glad påsk