Abstract
This paper proposes a tableau-based approach to model checking linear temporal properties to mitigate the state space explosion in model checking. The core idea of the approach is to split an original model checking problem into multiple smaller model checking problems using the tableau method and tackle each smaller one. We prove a theorem to guarantee that the multiple smaller model checking problems are equivalent to the original model checking problem. We use Maude, a high-level specification and programming language based on rewriting logic, to develop a tool called DCA2MC to support our approach. Some case studies are conducted to compare DCA2MC with Maude LTL model checker, Spin, and LTSmin model checkers in terms of running performance and memory usage, showing the power of our proposed approach.
This research was partially supported by JSPS KAKENHI Grant Numbers JP23K28060, JP23K19959, JP24K20757.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
DCA2MC means a divide and conquer approach to model checking. We chose this name because our tableau-based approach originates from the idea of the divide and conquer approach to model checking linear temporal properties.
References
Anderson, T.E.: The performance of spin lock alternatives for shared-memory multiprocessors. IEEE Trans. Parallel Distrib. Syst. 1(1), 6–16 (1990)
Aung, M.N., Phyo, Y., Do, C.M., Ogata, K.: A divide and conquer approach to eventual model checking. Mathematics 9(4) (2021)
Aung, M.N., Phyo, Y., Do, C.M., Ogata, K.: A tool for model checking eventual model checking in a stratified way. In: 9th DSA, pp. 270–279 (2022)
Ben-Ari, M.: Mathematical Logic for Computer Science. Springer, Heidelberg (2012). https://doi.org/10.1007/978-1-4471-4129-7
Clarke, E.M., Biere, A., Raimi, R., Zhu, Y.: Bounded model checking using satisfiability solving. Formal Methods Syst. Des. 19(1), 7–34 (2001)
Clarke, E.M., Grumberg, O., Long, D.E.: Model checking and abstraction. ACM Trans. Program. Lang. Syst. 16(5), 1512–1542 (1994)
Clarke, E.M., Grumberg, O., Minea, M., Peled, D.A.: State space reduction using partial order techniques. Int. J. Softw. Tools Technol. Transf. 2(3), 279–287 (1999)
Marques-Silva, J., Malik, S.: Propositional SAT solving. In: Handbook of Model Checking, pp. 247–275. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-10575-8_9
Clavel, M., Durán, F., Eker, S., Lincoln, P., Martí-Oliet, N., Meseguer, J., Talcott, C.: All About Maude - A High-Performance Logical Framework. LNCS, vol. 4350. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-71999-1
Do, C.M., Phyo, Y., Ogata, K.: A divide & conquer approach to until and until stable model checking. In: 34th SEKE (2022)
Do, C.M., Phyo, Y., Ogata, K.: Sequential and parallel tools for model checking conditional stable properties in a layered way. IEEE Access 10, 133749–133765 (2022)
Do, C.M., Phyo, Y., Riesco, A., Ogata, K.: Optimization techniques for model checking leads-to properties in a stratified way. ACM Trans. Softw. Eng. Methodol. 32(6) (2023)
Do, C.M., Phyo, Y., Riesco, A., Ogata, K.: A parallel stratified model checking technique/tool for leads-to properties. In: 7th ISSSR, pp. 155–166 (2021)
Gerth, R., Peled, D., Vardi, M.Y., Wolper, P.: Simple on-the-fly automatic verification of linear temporal logic. In: PSTV 1995. IAICT, pp. 3–18. Springer, Boston, MA (1996). https://doi.org/10.1007/978-0-387-34892-6_1
Meseguer, J.: Twenty years of rewriting logic. J. Log. Algebraic Methods Program. 81(7–8), 721–781 (2012)
de Moura, L., Rueß, H., Sorea, M.: Bounded model checking and induction: from refutation to verification. In: Hunt, W.A., Somenzi, F. (eds.) CAV 2003. LNCS, vol. 2725, pp. 14–26. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45069-6_2
Phyo, Y., Aung, M.N., Do, C.M., Ogata, K.: A layered and parallelized method of eventual model checking. Information 14(7), 384 (2023)
Phyo, Y., Do, C.M., Ogata, K.: A divide & conquer approach to conditional stable model checking. In: Cerone, A., Ölveczky, P.C. (eds.) ICTAC 2021. LNCS, vol. 12819, pp. 105–111. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-85315-0_7
Phyo, Y., Do, C.M., Ogata, K.: A divide & conquer approach to leads-to model checking. Comput. J. 65, 1353–1364 (2021)
Phyo, Y., Do, C.M., Ogata, K.: A support tool for the L+1-layer divide & conquer approach to leads-to model checking. In: COMPSAC, pp. 854–863. IEEE (2021)
van der Berg, F., Laarman, A.: SpinS: extending LTSmin with Promela through SpinJa. Electron. Notes Theor. Comput. Sci. 296, 95–105 (2013)
Vardi, M.Y.: An automata-theoretic approach to linear temporal logic. In: Moller, F., Birtwistle, G. (eds.) Logics for Concurrency. LNCS, vol. 1043, pp. 238–266. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-60915-6_6
Wolper, P.: The tableau method for temporal logic: an overview. Logique et Anal. (N.S.) 28(110/111), 119–136 (1985)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
The Termination of the Tableau Construction
The Termination of the Tableau Construction
To show the termination property of the tableau construction, we first define the length of formulas and the set of subformulas of formulas.
Definition 12
The length \(|\varphi |\) of \(\varphi \in \mathcal {L}_\textsf{LTL}\) is defined inductively as follows:
-
1.
\(| a | = 1\) for each \(a \in \boldsymbol{A}\);
-
2.
\(| \lnot \varphi | = | \varphi | + 1\);
-
3.
\(| \varphi _1 \vee \varphi _2 |= | \varphi _1 | + | \varphi _2 | + 1\);
-
4.
\(| {\bigcirc } \varphi | = | \varphi | + 1\);
-
5.
\(| \varphi _1 \mathrel {\mathcal {U}} \varphi _2 | = | \varphi _1 | + | \varphi _2 | + 1\).
Definition 13
The set \(\textsf{Sub}(\varphi )\) of subformulas of \(\varphi \in \mathcal {L}_\textsf{LTL}\) is defined inductively as follows:
-
1.
\(\textsf{Sub}(a) = \{ a \}\) for each \(a \in \boldsymbol{A}\);
-
2.
\(\textsf{Sub}(\lnot \varphi ) = \{ \lnot \varphi \} \cup \textsf{Sub}(\varphi )\);
-
3.
\(\textsf{Sub}(\varphi _1 \vee \varphi _2) = \{ \varphi _1 \vee \varphi _2 \} \cup \textsf{Sub}(\varphi _1) \cup \textsf{Sub}(\varphi _2)\);
-
4.
\(\textsf{Sub}(\bigcirc \varphi ) = \{ \bigcirc \varphi \} \cup \textsf{Sub}(\varphi )\);
-
5.
\(\textsf{Sub}(\varphi _1 \mathrel {\mathcal {U}} \varphi _2) = \{ \varphi _1 \mathrel {\mathcal {U}} \varphi _2 \} \cup \textsf{Sub}(\varphi _1) \cup \textsf{Sub}(\varphi _2)\).
We define some sets of formulas as follows:
-
\(\textsf{Sub}_{\lnot }(\varphi ) \triangleq \{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi ) \}\) is the negations of \(\textsf{Sub}(\varphi )\),
-
\(\textsf{Sub}_{\bigcirc }(\varphi ) \triangleq \{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi ) \cup \textsf{Sub}_{\lnot }(\varphi ) \}\) is the formulas of \(\textsf{Sub}(\varphi ) \cup \textsf{Sub}_{\lnot }(\varphi )\) preceded by \(\bigcirc \),
-
\(\mathcal {F}(\varphi ) \triangleq \textsf{Sub}(\varphi ) \cup \textsf{Sub}_{\lnot }(\varphi ) \cup \textsf{Sub}_{\bigcirc }(\varphi )\).
We then prove the relation between the size of \(\mathcal {F}(\varphi )\) and the length of \(\varphi \).
Lemma 10
\(| \mathcal {F}(\varphi ) | \le 4 \times | \varphi |\).
Proof
We prove it by structural induction on \(\varphi \) as follows:
-
Base Case \(\varphi = a \in \boldsymbol{A}\). Because
$$ \mathcal {F}(a) = \{a, \lnot a, \bigcirc a, {\bigcirc } \lnot a \} \text { and } | a | = 1, $$we have \(| \mathcal {F}(a) | = 4 \le 4 \times | a |\).
-
Induction Step
-
Case I1 \(\varphi = \lnot \varphi _1\). We observe that
$$\begin{aligned} \textsf{Sub}_{\lnot }(\lnot \varphi _1)&=\{ \lnot \psi \mid \psi \in \textsf{Sub}(\lnot \varphi _1) \} \\ &=\{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi _1) \} \cup \{\lnot \lnot \varphi _1\} \\ &=\textsf{Sub}_{\lnot }(\varphi _1) \cup \{\lnot \lnot \varphi _1\}, \\ \textsf{Sub}_{\bigcirc }(\lnot \varphi _1)&=\{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\lnot \varphi _1) \cup \textsf{Sub}_{\lnot }(\lnot \varphi _1) \} \\ &=\{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi _1) \cup \textsf{Sub}_{\lnot }(\varphi _1) \} \cup \{\bigcirc \lnot \varphi _1\}\cup \{\bigcirc \lnot \lnot \varphi _1\} \\ &=\textsf{Sub}_{\bigcirc }(\varphi _1)\cup \{\bigcirc \lnot \varphi _1\}\cup \{\bigcirc \lnot \lnot \varphi _1\}. \end{aligned}$$Thus,
$$\begin{aligned} \mathcal {F}(\lnot \varphi _1)&=\textsf{Sub}(\lnot \varphi _1) \cup \textsf{Sub}_{\lnot }(\lnot \varphi _1) \cup \textsf{Sub}_{\bigcirc }(\lnot \varphi _1) \\ &=\{\lnot \varphi _1\}\cup \textsf{Sub}(\varphi _1)\cup \textsf{Sub}_{\lnot }(\varphi _1) \\ &\cup \{\lnot \lnot \varphi _1\}\cup \textsf{Sub}_{\bigcirc }(\varphi _1)\cup \{\bigcirc \lnot \varphi _1\}\cup \{\bigcirc \lnot \lnot \varphi _1\} \\ &=\mathcal {F}(\varphi _1)\cup \{\lnot \varphi _1,\lnot \lnot \varphi _1,\bigcirc \lnot \varphi _1,\bigcirc \lnot \lnot \varphi _1\}. \end{aligned}$$By the induction hypothesis, \(|\mathcal {F}(\varphi _1)|\le 4\times |\varphi _1|\). Hence,
$$ |\mathcal {F}(\lnot \varphi _1)|=|\mathcal {F}(\varphi _1)|+4\le 4\times |\varphi _1|+4=4\times (|\varphi _1|+1)=4\times |\lnot \varphi _1|. $$ -
Case I2 \(\varphi = \varphi _1 \vee \varphi _2\). We observe that
$$\begin{aligned} \textsf{Sub}_{\lnot }(\varphi _1 \vee \varphi _2)&=\{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi _1 \vee \varphi _2) \} \\ &=\{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi _1) \cup \textsf{Sub}(\varphi _2) \} \cup \{\lnot (\varphi _1\vee \varphi _2)\} \\ &=\{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi _1) \} \cup \{ \lnot \psi \mid \psi \in \textsf{Sub}(\varphi _2) \} \cup \{\lnot (\varphi _1\vee \varphi _2)\} \\ &=\textsf{Sub}_\lnot (\varphi _1) \cup \textsf{Sub}_\lnot (\varphi _2) \cup \{\lnot (\varphi _1\vee \varphi _2)\}, \\ \textsf{Sub}_{\bigcirc }(\varphi _1 \vee \varphi _2)&=\{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi _1 \vee \varphi _2) \cup \textsf{Sub}_{\lnot }(\varphi _1 \vee \varphi _2) \} \\ &=\{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi _1) \cup \textsf{Sub}(\varphi _2) \cup \textsf{Sub}_{\lnot }(\varphi _1) \cup \textsf{Sub}_\lnot (\varphi _2)\} \\ &\cup \{\bigcirc (\varphi _1\vee \varphi _2)\}\cup \{\bigcirc \lnot (\varphi _1\vee \varphi _2)\} \\ &=\{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi _1) \cup \textsf{Sub}_\lnot (\varphi _1) \} \\ &\cup \{ \bigcirc \psi \mid \psi \in \textsf{Sub}(\varphi _2) \cup \textsf{Sub}_\lnot (\varphi _2)\} \\ &\cup \{\bigcirc (\varphi _1\vee \varphi _2)\}\cup \{\bigcirc \lnot (\varphi _1\vee \varphi _2)\} \\ &=\textsf{Sub}_\bigcirc (\varphi _1)\cup \textsf{Sub}_\bigcirc (\varphi _2)\cup \{\bigcirc (\varphi _1\vee \varphi _2)\}\cup \{\bigcirc \lnot (\varphi _1\vee \varphi _2)\}. \end{aligned}$$Thus,
$$\begin{aligned} \mathcal {F}(\varphi _1 \vee \varphi _2) &= \textsf{Sub}(\varphi _1 \vee \varphi _2) \cup \textsf{Sub}_{\lnot }(\varphi _1 \vee \varphi _2) \cup \textsf{Sub}_{\bigcirc }(\varphi _1 \vee \varphi _2) \\ &=\{\varphi _1\vee \varphi _2\}\cup \textsf{Sub}(\varphi _1)\cup \textsf{Sub}(\varphi _2) \\ &\cup \textsf{Sub}_\lnot (\varphi _1) \cup \textsf{Sub}_\lnot (\varphi _2) \cup \{\lnot (\varphi _1\vee \varphi _2)\} \\ &\cup \textsf{Sub}_\bigcirc (\varphi _1)\cup \textsf{Sub}_\bigcirc (\varphi _2)\cup \{\bigcirc (\varphi _1\vee \varphi _2)\}\cup \{\bigcirc \lnot (\varphi _1\vee \varphi _2)\} \\ &=\mathcal {F}(\varphi _1)\cup \mathcal {F}(\varphi _2)\cup \{\varphi _1\vee \varphi _2,\lnot (\varphi _1\vee \varphi _2),\bigcirc (\varphi _1\vee \varphi _2),\bigcirc \lnot (\varphi _1\vee \varphi _2)\}. \end{aligned}$$By the induction hypothesis, \(|\mathcal {F}(\varphi _1)|\le 4\times |\varphi _1|\) and \(|\mathcal {F}(\varphi _2)|\le 4\times |\varphi _2|\). Hence,
$$ |\mathcal {F}(\varphi _1\vee \varphi _2)|=|\mathcal {F}(\varphi _1)|+|\mathcal {F}(\varphi _2)|+4\le 4\times (|\varphi _1|+|\varphi _2|+1)=4\times |\varphi _1\vee \varphi _2|. $$ -
Case I3 \(\varphi = \bigcirc \varphi _1\). The proof is similar to Case I1.
-
Case I4 \(\varphi = \varphi _1 \mathrel {\mathcal {U}} \varphi _2\). The proof is similar to Case I2. \(\square \)
-
Let \(\mathcal {T}\) be the tableau of \(\varphi \) constructed based on Algorithm 1 with the tableau rules. It is apparent that the formulas labeling the nodes of \(\mathcal {T}\) are subformulas or negations of subformulas of \(\varphi \) or such formulas preceded by \(\bigcirc \), that is \(\mathcal {F}(\varphi )\). Therefore, the number of nodes of \(\mathcal {T}\) is at most equal to the number of subsets of \(\mathcal {F}(\varphi )\), that is \(2^{|\mathcal {F}(\varphi )|} \le 2^{4 \times | \varphi |}\) regarding Lemma 10. Because \(| \varphi |\) is finite and previously created nodes are used instead of creating new ones in \(\mathcal {T}\), the construction of \(\mathcal {T}\) for any LTL formula \(\varphi \) terminates.
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Minh Do, C., Takagi, T., Ogata, K. (2024). A Tableau-Based Approach to Model Checking Linear Temporal Properties. In: Ogata, K., Mery, D., Sun, M., Liu, S. (eds) Formal Methods and Software Engineering. ICFEM 2024. Lecture Notes in Computer Science, vol 15394. Springer, Singapore. https://doi.org/10.1007/978-981-96-0617-7_20
Download citation
DOI: https://doi.org/10.1007/978-981-96-0617-7_20
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-96-0616-0
Online ISBN: 978-981-96-0617-7
eBook Packages: Computer ScienceComputer Science (R0)