Lecture Notes in Computer Science 3472

19 Model Checking 567
Another approach of fighting state explosion is to represent the transition relation
of the models implicitly with an ordered binary decision diagram (OBDD)
[BCMD90], since the size of the transition relation is the main limiting factor. By
using common model checking algorithms with OBDDs and some refinements,
very large examples with up to 10 120 states have been verified [BCL92].
Model Checking LTL To model check Kripke structures with LTL-properties
the following approach is proposed. In the first step the model M and the property
φ are translated into automata models AM and Aφ which represent the
structures in a common way. The automaton AM accepts all computations which
are possible in the model and Aφ accepts all computations which are allowed
with respect to the property. The model checking problem now reduces to the
automata theoretic problem of checking that all computations accepted by an
automaton AM are also accepted by the automaton Aφ, thatisL(AM ) ⊆L(Aφ).
Equivalently, one can check that the language L(AM ) ∩ L(Aφ) isempty.Instead
of building the complement of the language accepted by Aφ it is possible to use
the language of the complement automaton Aφ, which is defined such that it
accepts the words of the complement language L � �
Aφ = L (Aφ). Complement
automata where first studied by Büchi [Büc62], a definition and construction in
the context of temporal logics is given by Sistla, Vardi, and Wolper [SVW87].
Since Aφ exactly accepts the computations satisfying φ the negation L(Aφ)
of the automaton can be expressed by negation of the property. Aφ = A¬φ
There is a number of approaches how to transform an LTL property into an
automaton. One basic approach presented in the following model checking algorithm
was purposed by Wolper, Vardi and Sistla in 1983 [WVS83], but there are
some improved versions. Gastin and Oddoux for example present in “Fast LTL
to Büchi Automata Translation” [GO01] a different method which use a variation
of Büchi automata (very weak alternating automata) as intermediate step.
Etessami and Holzmann suppose a method for “Optimizing Büchi Automata”
[EH00] to reduce the size of the automata.
The following basic LTL model checking algorithm presented by Moshe Y.
Vardi in 1996 [Var96] is structured in 5 steps:
(1) The Kripke structure M , which represents the model, is translated into a
Büchi automaton.
(2) The LTL-property φ is translated into an alternating Büchi automaton A¬φ
which exactly accepts the computations satisfying ¬φ. (AlternatingBüchi
automaton are introduced in the later Definition 19.6)
(3) The alternating Büchi automaton A¬φ is translated into a nondeterministic
Büchi automation A¬φ which exactly accepts the same set of computations.
(4) The language intersection of AM and A¬φ is build, such that L(AM ∩A¬φ) =
L(AM ) ∩L(A¬φ)
(5) The language L(AM ∩ A¬φ) is checked for emptiness.
If L(AM ∩A¬φ) isemptythenM |= φ. On the other hand, if L(AM ∩A¬φ) isnot
empty there is at least one run of AM ∩ A¬φ which is accepted by the model M