SLIDE 1
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
1
Modeling versus Verification
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
CTL May Be Ambiguous when Model Checking Moore Machines Cdric Roux - - PowerPoint PPT Presentation
CTL May Be Ambiguous when Model Checking Moore Machines Cdric Roux - - PowerPoint PPT Presentation
CTL May Be Ambiguous when Model Checking Moore Machines Cdric Roux and Emmanuelle Encrenaz Universit Pierre et Marie Curie Laboratoire dInformatique de Paris 6 Architecture des Systmes Intgrs et Microlectronique Cdric Roux
SLIDE 2
SLIDE 3
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 1 CHARME 2003
Modeling versus Verification
Modeling world
SLIDE 4
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 1 CHARME 2003
Modeling versus Verification
Moore or Mealy machines
Modeling world
SLIDE 5
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 1 CHARME 2003
Modeling versus Verification
Verification world
Moore or Mealy machines
Modeling world
SLIDE 6
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 1 CHARME 2003
Modeling versus Verification
Verification world
Kripke structures Moore or Mealy machines
Modeling world
SLIDE 7
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 1 CHARME 2003
Modeling versus Verification
Verification world
Kripke structures Moore or Mealy machines
Modeling world Translation
SLIDE 8
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 2 CHARME 2003
From Moore to Kripke
SLIDE 9
i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM 2 CHARME 2003
From Moore to Kripke
SLIDE 10
i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
3
First translation scheme
SLIDE 11
i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
Remove the input signals
3
First translation scheme
SLIDE 12
i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
First translation scheme
Simple
3
Remove the input signals
SLIDE 13
i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
First translation scheme
Simple Impossible to express properties including input signals Remove the input signals
3
SLIDE 14
i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
4
Second translation scheme
SLIDE 15
a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
4
Second translation scheme
Input signals into target state of transitions
SLIDE 16
a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
4
Second translation scheme
Composition of Moore machines lost Input signals into target state of transitions
SLIDE 17
i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
Third translation scheme
5
SLIDE 18
i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
Third translation scheme
Input signals into source state of transitions
5 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
SLIDE 19
i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
Third translation scheme
Input signals into source state of transitions
5 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 We can compose Moore machines
SLIDE 20
i i i i i i a b c d e f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
From Moore to Kripke
Third translation scheme
Input signals into source state of transitions
5 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 We can compose Moore machines This may introduce ambiguities when using CTL
SLIDE 21
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
SLIDE 22
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
Checking the property AX EX p
SLIDE 23
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
a b c e f g i i i i i i
Checking the property AX EX p
d
SLIDE 24
states verifying p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
a b c e f g i i i i i i
Checking the property AX EX p
d
SLIDE 25
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
a b c e f g i i i i i i
Checking the property AX EX p
states verifying EX p d
SLIDE 26
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6
Possible CTL ambiguities
a b c e f g i i i i i i
Checking the property AX EX p
states verifying AX EX p d
SLIDE 27
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 e0 e1 f0 g0 g1 6
Possible CTL ambiguities
Checking the property AX EX p
d0 f1 d1
SLIDE 28
states verifying p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d1 e0 e1 f0 g0 g1 6
Possible CTL ambiguities
Checking the property AX EX p
d0 f1
SLIDE 29
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d1 e0 e1 f0 f1 g0 g1 6
Possible CTL ambiguities
Checking the property AX EX p
states verifying EX p d0
SLIDE 30
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 6
Possible CTL ambiguities
Checking the property AX EX p
states verifying AX EX p
SLIDE 31
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 6
Possible CTL ambiguities
a b c d e f g i i i i i i
Checking the property AX EX p
states verifying AX EX p
SLIDE 32
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1 6
Possible CTL ambiguities
a b c d e f g i i i i i i
Checking the property AX EX p
states verifying AX EX p «AX EX p does not have the same truth value in both structures»
SLIDE 33
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 7
A first ambiguity
Possible CTL ambiguities
SLIDE 34
a0 a1 b0 b1 c0 c1 d1 e0 e1 f0 f1 g0 g1 d0 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a b c e f g i i i i i i states verifying EX p d
A first ambiguity
Possible CTL ambiguities
7
SLIDE 35
a0 a1 b0 b1 c0 c1 d1 e0 e1 f0 f1 g0 g1 d0 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a b c e f g i i i i i i states verifying EX p d
A first ambiguity
States b0 and b1 should verify EX p, as state b does
Possible CTL ambiguities
7
SLIDE 36
states verifying EX p
E i to remove this ambiguity E i
a0 a1 b0 b1 c0 c1 d1 e0 e1 f0 f1 g0 g1 d0 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a b c e f g i i i i i i d
A first ambiguity
States b0 and b1 should verify EX p, as state b does We introduce
Possible CTL ambiguities
states verifying EX p 7
SLIDE 37
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
Possible CTL ambiguities
A second ambiguity
8
SLIDE 38
states verifying AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
a b c d e f g i i i i i i
A second ambiguity
8
SLIDE 39
states verifying AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
a b c d e f g i i i i i i
A second ambiguity
b0 (and b1) should not verify AX EX p, and a0 and a1 should
8
SLIDE 40
states verifying AX EX p
A i A i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
a b c d e f g i i i i i i
A second ambiguity
b0 (and b1) should not verify AX EX p, and a0 and a1 should We introduce to remove this ambiguity
states verifying AX EX p 8
SLIDE 41
E i A i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
Possible CTL ambiguities
Checking the property AX EX p
9
SLIDE 42
E i A i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
Checking the property AX EX p
9
SLIDE 43
E i A i
states verifying p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
Checking the property AX EX p
9
SLIDE 44
E i A i
E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
Checking the property AX EX p
states verifying EX p 9
SLIDE 45
E i A i
A i E i
states verifying AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 g0 g1
Possible CTL ambiguities
Checking the property AX EX p
f1 9
SLIDE 46
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003
Possible CTL ambiguities
Comparison with AX EX p
10
SLIDE 47
A i E i
states verifying AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
a b c d e f g i i i i i i
Comparison with AX EX p
states verifying AX EX p 10
SLIDE 48
A i E i
states verifying AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 a0 a1 b0 b1 c0 c1 d0 d1 e0 e1 f0 f1 g0 g1
Possible CTL ambiguities
a b c d e f g i i i i i i
Comparison with AX EX p
states verifying AX EX p
The ambiguities have been removed
10
SLIDE 49
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
SLIDE 50
A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and
SLIDE 51
A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL
SLIDE 52
A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL (univ_abstract, exist_abstract) Easily integrable in a symbolic model−checker
SLIDE 53
A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL (univ_abstract, exist_abstract) Easily integrable in a symbolic model−checker Applicable to Mealy machines
SLIDE 54
A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL (univ_abstract, exist_abstract) Easily integrable in a symbolic model−checker Applicable to Mealy machines and are not relevant for LTL A i E i
SLIDE 55
AX and EX seem similar to [ ] and < > of the mu−calculus A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL (univ_abstract, exist_abstract) Easily integrable in a symbolic model−checker Applicable to Mealy machines and are not relevant for LTL * * A i E i A i E i
SLIDE 56
AX and EX seem similar to [ ] and < > of the mu−calculus A i E i
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 11
iCTL
Extends CTL with and More expressive than CTL (univ_abstract, exist_abstract) Easily integrable in a symbolic model−checker Applicable to Mealy machines and are not relevant for LTL * * A i E i A i E i but what about EX ? A i
SLIDE 57
Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003