## Module checking revisited (1997)

Venue: | In Proc. 9th CAV, LNCS 1254 |

Citations: | 37 - 6 self |

### BibTeX

@INPROCEEDINGS{Kupferman97modulechecking,

author = {Orna Kupferman and Moshe Y. Vardi},

title = {Module checking revisited},

booktitle = {In Proc. 9th CAV, LNCS 1254},

year = {1997},

pages = {36--47},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. When we verify the correctness of an open system with respect to a desired requirement, we should take into consideration the different environments with which the system may interact. Each environment induces a different behavior of the system, and we want all these behaviors to satisfy the requirement. Module checking is an algorithmic method that checks, given an open system (modeled as a finite structure) and a desired requirement (specified by a temporal-logic formula), whether the open system satisfies the requirement with respect to all environments. In this paper we extend the module-checking method with respect to two orthogonal issues. Both issues concern the fact that often we are not interested in satisfaction of the requirement with respect to all environments, but only with respect to these that meet some restriction. We consider the case where the environment has incomplete information about the system; i.e., when the system has internal variables, which are not readable by its environment, and the case where some assumptions are known about environment; i.e., when the system is guaranteed to satisfy the requirement only when its environment satisfies certain assumptions. We study the complexities of the extended module-checking problems. In particular, we show that for universal temporal logics (e.g., LTL, ¥ CTL, and ¥ CTL ¦), module checking with incomplete information coincides with module checking, which by itself coincides with model checking. On the other hand, for non-universal temporal logics (e.g., CTL and CTL ¦), module checking with incomplete information is harder than module checking, which is by itself harder than model checking. 1

### Citations

3667 | A R. Communicating sequential processes
- Hoare
- 1985
(Show Context)
Citation Context ...in a closed system all the nondeterministic choices are internal, and resolved by the system, in an open system there are also external nondeterministic choices, which are resolved by the environment =-=[Hoa85]-=-. In order to check whether a closed system satisfies a required property, we translate the system into some formal model, specify the property with a temporal-logic formula, and check formally that t... |

1251 | Automatic Verification of Finite-State Concurrent Systems Using Temporal Logic Specifications - CLARKE, EMERSON, et al. - 1986 |

854 | E.A.: Design and synthesis of synchronization skeletons using branching time temporal logic - Clarke, Emerson - 1981 |

325 |
On the Development of Reactive Systems
- PNUELI, HAREL
- 1985
(Show Context)
Citation Context ... satisfy a possibility requirement or, equivalently, that disabling some of its behaviors causes the requirement not to be satisfied. We also distinguish between two types of systems: closed and open =-=[HP85]-=-. A closed system is a system whose behavior is completely determined by the state of the system. An open system is a system that interacts with its environment and whose behavior depends on this inte... |

314 | P.: An Automata-Theoretic Approach to Branching-Time Model
- Kupferman, Vardi, et al.
(Show Context)
Citation Context ...r with a direction ��������� in 1 Essentially, thes�¨§ £ automaton is similar to the product alternating tree automaton obtained in the alternating-automata theoretic framework for CTL model checking =-=[BVW94]-=-. There, as there is a single computation tree with respect to which the formula is checked, the automaton obtained is a 1-letter automaton. Here, as there are many computation trees to check, we get ... |

283 | Model Checking and Modular Verification
- Grumberg, Long
- 1994
(Show Context)
Citation Context ...versal and non-universal. Both logics describe the computation tree induced by the system. Formulas of universal temporal logics describe requirements that should hold in all the branches of the tree =-=[GL94]-=-. These requirements may be either linear (e.g., in all computations, only finitely many requests are sent) or branching (e.g., in all computations we eventually reach a state from which, no matter ho... |

250 | Specification and verification of concurrent systems in CESAR - Queille, Sifakis |

248 | Checking that finite state concurrent programs satisfy their linear specification
- Lichtenstein, Pnueli
- 1985
(Show Context)
Citation Context ...roblem in terms of the size of the system, assuming that the specification is fixed [VW86]. Since the system is typically much bigger than the specification, this complexity is of particular interest =-=[LP85]-=-. By [KV96], the program complexity of CTL module checking with complete information is PTIME-complete. On the other hand, the time complexity of the algorithm we present here is exponential in the si... |

212 | An Algebraic Definition of Simulation Between Programs - Milner - 1971 |

209 |
P.: Automata-theoretic techniques for modal logics of programs
- Vardi, Wolper
- 1986
(Show Context)
Citation Context ...cost. This is, however, not true. Let us define the program complexity of module checking as the complexity of the problem in terms of the size of the system, assuming that the specification is fixed =-=[VW86]-=-. Since the system is typically much bigger than the specification, this complexity is of particular interest [LP85]. By [KV96], the program complexity of CTL module checking with complete information... |

200 | Specifying concurrent program modules - Lamport - 1983 |

177 | Specification and design of (parallel) programs - Jones - 1983 |

157 |
The Temporal Semantics of Concurrent Programs
- Pnueli
- 1981
(Show Context)
Citation Context ...roduction Temporal logics, which are modal logics geared towards the description of the temporal ordering of events, have been adopted as a powerful tool for specifying and verifying reactive systems =-=[Pnu81]-=-. One of the most significant developments in this area is the discovery of algorithmic methods for verifying temporal-logic properties of finite-state systems [CE81, QS81, LP85, CES86]. This derives ... |

156 | The Complexity of Tree Automata and Logics of Programs - Emerson, Jutla - 1988 |

141 | Applications of temporal logic to the specification and verification of reactive systems: a survey of current trends - Pnueli - 1986 |

100 | Reasoning about networks with many identical finite-state processes - Clarke, Grumberg, et al. - 1986 |

96 |
P.E.: Alternating automata on infinite trees
- Muller, Schupp
- 1987
(Show Context)
Citation Context ...t entails. For that, we first define formally alternating tree automata.s3.1 Alternating Tree Automata Alternating tree automata generalize nondeterministic tree automata and were first introduced in =-=[MS87]-=-. An alternating tree automatons�������¡ ��¡¢ 0�¤£��¡¥ � runs on full � -labeleds-trees (for an agreed setsof directions). It consists of a finite setsof states, an initial state ¢ 0 �¦s, a transition... |

88 | Module checking
- Kupferman, Vardi, et al.
- 2001
(Show Context)
Citation Context ...with some environment. Therefore, one can check satisfaction of universal requirements in an open system by model checking the composition of the system with this maximal environment. As discussed in =-=[KV96]-=-, this approach can not be adapted when verifying an open system with respect to non-universal requirements. Here, satisfaction of the requirements with respect to the maximal environment does not imp... |

80 |
The complexity of two-player games of incomplete information
- Reif
- 1984
(Show Context)
Citation Context ...Proof (sketch): The upper bound follows from Theorem 6. For the lower bound, we do a reduction from the outcome problem for two-players games with incomplete information, proved to be EXPTIME-hard in =-=[Rei84]-=-. A two-player game with incomplete information consists of an AND-OR graph with an initial state and a set of designated states. Each of the states in the graph is labeled by readable and unreadable ... |

75 | Bisimulation and model checking - Fisler, Vardi - 1999 |

26 |
Temporal model checking under generalized fairness constraints
- Emerson, Lei
- 1985
(Show Context)
Citation Context ...et of strategies ¥ such thats� ¥ is deadlock free and satisfies ¤ . The alternating-automata-theoretic approach to CTL and CTL ¡ model checking is extended in [KV95] to handle Fair-CTL and Fair-CTL ¡ =-=[EL85]-=-. Using the same extension, we can handle here modules augmented with fairness conditions. We now consider the complexity bounds that follow from our algorithm. Theorem 6. The module-checking problem ... |

19 | On the Complexity of Branching Modular Model Checking
- KUPFERMAN, Y
- 1995
(Show Context)
Citation Context ...s, such that �¦�s�¨§ £ � is exactly the set of strategies ¥ such thats� ¥ is deadlock free and satisfies ¤ . The alternating-automata-theoretic approach to CTL and CTL ¡ model checking is extended in =-=[KV95]-=- to handle Fair-CTL and Fair-CTL ¡ [EL85]. Using the same extension, we can handle here modules augmented with fairness conditions. We now consider the complexity bounds that follow from our algorithm... |

17 |
temporal logics
- Automata
- 1985
(Show Context)
Citation Context ...s ¥ ¤ , thus iff the intersection ofs� ands¡¦£ is empty. The reduction of the module-checking problem to the emptiness problem for tree automata implies, by the finite-model property of tree automata =-=[Eme85]-=-, that defining reactive satisfaction with respect to only finite-state environments is equivalent to the current definition. In the presence of incomplete information, not all possible pruning of ��¡... |

12 |
Reasoning about uncertainty in fault-tolerant distributed systems
- Fischer, Zuck
- 1988
(Show Context)
Citation Context ...o check whether an open system satisfies a required property, we should check the behavior of the system with respect to any environment, and often there is much uncertainty regarding the environment =-=[FZ88]-=-. In particular, it might be that the environment does not enable all the external nondeterministic choices. To see this, consider a sandwich-dispensing machine that serves, upon request, sandwiches w... |

8 | Temporal Specification and Verification of Reactive Modules - Manna, Pnueli - 1992 |

2 | Simulating aternating tree automata by nondeterministic automata: New results and new proofs of - Muller, Schupp - 1995 |