Lecture Notes in Computer Science 3472

566 Therese Berg and Harald Raffelt
holds if there is an a-transitions to a state of the labeled transition system
which satisfies φ. The important point about HML is that HML-properties
can characterize finite automata up to bisimulation.
• Modal µ-calculus
was introduced by Kozen [Koz83] and extends Hennessy-Milner logic by a
least fixpoint operator (µ) . In general a fixpoint of a function f is a value
x such that f (x )=x . Intuitively, the µ-calculus makes it possible to use
modalities inside of recursively defined patterns. For example consider the
CTL formula EF (φ). Another way of expressing this is to say that there is
a property X such that either φ is satisfied in the current state or there is
some successor state in which X is true. X = φ ∨ ✸X . This property can be
expressed in µ-calculus as µ X .φ ∨ ✸X .
Due to the extreme power of fixpoint operators the µ-calculus allows to
express very complex properties within a sparse formalism. The µ-calculus
covers LTL and CTL, and it is even possible to express fairness constraints
which is not possible with the basic version of LTL and CTL.
19.3.3 Model Checking Algorithms
Model checking can be realized by several different approaches; prominent examples
are the semantic approach, theautomata theoretic approach, andthetableau
approach.
The idea behind the semantic approach is to inductively compute the semantics
of the formula in question to a given finite model, directly. This generates
a set of states which satisfy the formula. The semantic approach is typically
used for model checking branching time logics. There are efficient algorithms
using this approach which operate linear in the size of the model even for the
alternation free µ-calculus [CS92].
The automata theoretic approach is used for model checking linear-time logics
and branching-time logics as well. This approach reduces the model checking
problem to an inclusion problem between automata. An automaton Aφ is
constructed from the property φ which accepts all runs satisfying φ. Another
automaton AM is constructed from model M which accepts the executions runs
of the model. M satisfies φ if the language of the model-automaton AM is a
subset of language accepted by the properties automaton Aφ. This problem can
be reduced to the problem of deciding non-emptiness of a product automaton
which is possible by reachability analysis. As an example, an efficient algorithm
for model checking LTL [Var96] is presented later.
The tableau method is used to determine if a certain state s of a given model
M satisfies a property φ. This approach tries to construct a proof tree that
witnesses that a given state satisfies a certain property. If no proof tree can
be found, it provides a disproof (counterexample) of the property for the given
state. Since the tableau method inspects only a small fraction of the state space
[SW91], it combines well with incremental construction of the state space, which
is a prominent approach to deal with the state explosion problem.