Presburger Arithmetic and Its Use in Verification

CHAPTER 5.
DURATION CALCULUS AND PRESBURGER FRAGMENTS
Figure 5.1. Observation intervals [10].
Figure 5.2. AsimpleKripkestructure[15].
where P is in the set of state variable names, k, c i ∈ Z and ⊲⊳ ∈{}.
The above fragments of DC are undecidable already; if the duration is limited in
the form ∫ S⊲⊳k,thediscrete-timesatisfiabilityproblemisdecidable[10]. Withthe
decidable fragments of DC, the model-checking problem is described in the following
manner: models are expressed by means of automata (normally, a labelled automata
like Kripke structures) and durations are calculated basing on traces of execution.
Here the notion of traces is abstracted to the notion of visiting frequencies of nodes.
Therefore, given a DC formula φ and a Kripke structure K, K is a model of φ when
every trace of K satisfies φ, writtenK |= φ. We consider an example of Kripke
structures described in Figure 5.2 and check it against the property ∫ P < 2.
Certainly the answer is false because there exist some traces which visit P at least
twice.
When abstracting from traces, some frequencies are not corresponding to any
real trace, so a counting semantic in a multiset m is introduced [10]. The multiset
guarantees the consistency between visiting frequencies and traces. The modelchecking
algorithm does a bottom-up marking and generates side-condition in a
form of Presburger formulas. The consistency condition C(K, i 0 ,j 0 , m, e) isexpressed
by linear constraints of inflow and outflow equations, and there are some
36