Some theoretical aspects of verification (with a focus on bisimilarity)

<strong>Some</strong> <strong>theoretical</strong> <strong>aspects</strong> <strong>of</strong> <strong>verification</strong> 

(<strong>with</strong> a <strong>focus</strong> on bisimilarity) 

Petr Jančar 

Dept <strong>of</strong> Computer Science 

Technical University Ostrava (FEI VˇSB-TU) 

Czech Republic 

www.cs.vsb.cz/jancar 

Informatik-Kolloquium, Jena, 14 May 2007 

Petr Jančar (TU Ostrava) <strong>Some</strong> <strong>aspects</strong> <strong>of</strong> <strong>verification</strong> Kolloquium Jena, 14 May 2007 1 / 89

A (hardware) design process 

(From K. Schneider: Verification <strong>of</strong> reactive systems) 

Specification 

Equivalence 

proving 

Specification 

Design 

Verification 

Design 


VHDL 

Implementation 


RT/Gate level 

Switch level 

Chip 

Implementation 


Fabrication 

Test 


Outline <strong>of</strong> the talk 

Historical remarks, logics, decision problems, 

theorem proving, program <strong>verification</strong> 

(Temporal) logics <strong>of</strong> runs; linear vs. branching time; 

model checking 

Behavioural equivalences; bisimulation 

Undecidability <strong>of</strong> bisimilarity on Type -1 systems (an extension <strong>of</strong> 

pushdown automata) [Jančar and Srba, FOSSACS 2006] 

Final remarks 


Leibniz’ programme 

Gottfried Wilhelm Leibniz (1646 - 1716) 

Whenever there are different opinions about certain facts, one 

should not discuss them like philosophers usually do; 

instead one should ‘calculate’ the truth. 

lingua characteristica (to express all kinds <strong>of</strong> properties) 

calculus ratiocinator (laws to allow a ‘decision procedure’) 

(using universal encyclopedia) 

Leibniz planned the project for the next three centuries ! 

(His research in the differential calculus went in that direction.) 


Propositional logic 

Augustus de Morgan (1806-1871) 

George Boole (1815-1864) ... 

‘Leibniz sense’ calculus for propositional logic 

¬(x ∧ y) = ¬x ∨ ¬y 

x ∧ true = x 

. . . 

(Boole viewed this as a contribution to Leibniz’ research 

programme) 

Stanley Javins in 1869 ... a machine checking boolean expressions 

(something like a cash register at that time) 


Logical basis for mathematics 

Gottlob Frege (1848-1925) 

in 1879, Begriffschrift 

(boolean connectives ... but also quantifiers, relations, functions) 

beginnings <strong>of</strong> first order logic 

Frege the first to distinguish between syntax and semantics. 

David Hilbert (1862-1943) ... wanted logical basis for mathematics 

Alfred Whitehead (1861-1947), Bertrand Russell (1872-1970): 

Principia mathematica (1910-1913) 


First order predicate calculus 

Alfred Tarski (1902-1983) (till 1923 Alfred Teitelbaum): 

end <strong>of</strong> 1920s ... interpretation (semantics) 

e.g., ∀x.∀y.∃z.(x + y < z) is true in (N, +,

Herbrand’s Theorem; resolution principle 

Jacques Herbrand (1908-1931) 

in 1930 ... a semi-decision procedure for valid (or unsatisfiable) sentences 

<strong>of</strong> first order predicate calculus: 

Φ ≡ ∀x1.∀x2. . . . ∀xn.F is unsatisfiable iff 

there is a finite set <strong>of</strong> ground clauses <strong>of</strong> F which is 

unsatisfiable in propositional calculus. 

E.g. we prove validity <strong>of</strong> 

( (∀x.M(x) ⇒ D(x)) ∧ M(f (s)) ) ⇒ D(f (s)) 

The negation 

∀x. (¬M(x) ∨ D(x)) ∧ M(f (s)) ∧ ¬D(f (s)) 

is unsatisfiable since 

{ ¬M(f (s)) ∨ D(f (s)) , M(f (s)) , ¬D(f (s)) } is unsatisfiable: 

By Robinson’s resolution (1965) we can derive D(f (s)) and then the 

empty clause � (contradiction). 


Axiomatization <strong>of</strong> first order predicate calculus 

David Hilbert (1862-1943) and Wilhelm Ackermann (1896-1962) 

in 1928 ... an axiomatization <strong>of</strong> first order predicate calculus 

Ax 1 φ ⇒ (ψ ⇒ φ) 

Ax 2 (φ ⇒ (ψ ⇒ η)) ⇒ ((φ ⇒ ψ) ⇒ (φ ⇒ η)) 

Ax 3 (¬φ ⇒ ψ) ⇒ ((¬φ ⇒ ¬ψ) ⇒ φ)) 

Ax 4 (∀x(φ ⇒ ψ)) ⇒ (φ ⇒ ∀xψ)), x not free in φ 

Ax 5 ∀x(φ(x)) ⇒ φ(e) 

Ax 6 e ≡ e 

Ax 7 ei ≡ e ′ i ⇒ f (e1, . . . , ei, . . . , en) ≡ f (e1, . . . , ei, . . . , en) 

Ax 8 ei ≡ e ′ i ⇒ R(e1, . . . , ei, . . . , en) ≡ R(e1, . . . , ei, . . . , en) 

Rule MP (modus ponens) 

φ, φ ⇒ ψ 

ψ 

Rule GEN (generalization) 

φ 

∀xφ 


Questions <strong>of</strong> completeness and (algorithmic) decidability 

Kurt Gödel (1906-1978) 

in 1930 completeness (Γ ⊢ φ iff Γ |= φ) 

(Every consistent 1st order theory has a model.) 

Presburger arithmetic (theory <strong>of</strong> addition; symbols 0, 1, + [and =]) 

1. ∀x : ¬(0 = x + 1) 

2. ∀x∀y : ¬(x = y) ⇒ ¬(x + 1 = y + 1) 

3. ∀x : x + 0 = x 

4. ∀x∀y : (x + y) + 1 = x + (y + 1) 

5. An axiom scheme: 

(P(0) ∧ ∀x : P(x) ⇒ P(x + 1)) ⇒ ∀x : P(x) 

P(x) ... any formula constructed from 0, 1, +, = 

and containing a single free variable x 

Petr Jančar (TU Ostrava) <strong>Some</strong> <strong>aspects</strong> <strong>of</strong> <strong>verification</strong> 

Kolloquium Jena, 14 May 2007 10 / 

89

Presburger arithmetic 

Example sentence (the sum <strong>of</strong> two even numbers is even): 

∀x.∀y. ((∃x1.x = x1 + x1) ∧ (∃y1.y = y1 + y1)) ⇒ (∃z.x + y = z + z) 

Mojzesz Presburger (1904-1943) 

in 1929 ... completeness and decidability 

(for the ‘Presburger arithmetic’) 

Lower bound 22n, upper bound 222p(n) (from 1970s) 

The idea <strong>of</strong> a pro<strong>of</strong> <strong>of</strong> decidability: 

- the prenex form <strong>with</strong> just one ternary predicate, 

- use <strong>of</strong> finite automata (for quantifier elimination) 

Our example sentence (the sum <strong>of</strong> two even numbers is even) 

∀x.∀y.∀x1.∀y1.∃z.∃z1. 

¬(x1 + x1 = x) ∨ ¬(y1 + y1 = y) ∨ ((x + y = z1) ∧ (z + z = z1)) 



89

(Nondeterministic) finite automata; determinization 

a,b 

1 

b 

2 

1 1, 2 

a,b 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

b 

2 

1 1, 2 

a,b 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

2 

1, 2 

a,b 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

b 

2 

1, 2 

a,b 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

b 

2 

1, 2 

a,b 

a 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

b 

2 

1, 2 

a,b 

a 

b 

3 

a,b 

4 

1, 4 

1, 3 1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

b 

2 

1, 2 

a,b 

a 

b 

3 

1, 3 

a,b 

4 

a 

1, 4 

1, 2, 4 

1, 2, 3 1, 3, 4 


1, 2, 3, 4 

b 


89


a,b 

1 

1 

a 

b 

b 

2 

1, 2 

a,b 

a 

a 

b 

3 

b 

1, 3 

a,b 

1, 2, 3 


4 

a 

b 

a 

a 

b 

1, 4 

1, 2, 4 

b 

1, 3, 4 

a 

1, 2, 3, 4 

b 

a 


89

Finite automata - closure properties 

b 

b 

1 

1, A 

a 

a 

2 

b 

b 

b 

A 

a 

a 

B 

2, B 1, B 1, C 

2, C 2, A 2, D 

1, D 

Petr Jančar (TU Ostrava) <strong>Some</strong> <strong>aspects</strong> b <strong>of</strong> <strong>verification</strong> 

b 

b 

C 

a 

a,b 

D 


89


b 

1 

a 

a 

2 

b 

b 

1, A 2, B 1, B 1, C 

b 

A 

a 

a 

B 

2, C 2, A 2, D 

1, D 


b 

b 

C 

a 

a,b 

D 


89


b 

1 

1, A 

a 

a 

a 

2 

b 

b 

b 

A 

a 

a 

B 

2, B 1, B 1, C 

2, C 2, A 2, D 

1, D 


b 

b 

C 

a 

a,b 

D 


89


b 

b 

1 

1, A 

a 

a 

a 

2 

b 

b 

b 

A 

a 

a 

B 

2, B 1, B 1, C 

2, C 2, A 2, D 

1, D 


b 

b 

C 

a 

a,b 

D 


89


b 

b 

1 

1, A 

a 

a 

a 

2 

b 

2, B 

b 

2, C 

b 

a 

a 

a 

b 

b 

A 

1, B 

a 

2, A 

1, D 

a 

a 

b 

b 

B 

b 

b 

1, C 

a 

2, D 


a 

a 

b 

C 

a 

a,b 

D 


89

Finite automata - summary 

Nondeterministic FA −→ equivalent deterministic FA 

(possibly <strong>with</strong> an exponential increase <strong>of</strong> the number <strong>of</strong> states) 

(but e.g. traversing its state space 

can be done in polynomial space) 

The class <strong>of</strong> regular languages is (effectively) closed wrt 

union, intersection, complement, 

concatenation, iteration (star: L ∗ ), 

reversal, ... 

Questions like L(A) ? = ∅, 

or “is there a cycle containing a particular state ?” 

can be decided ‘quickly’ 

( e.g. by depth-first-search in O(n + m) ) 

(NLOGSPACE-complete problems) 



89

Finite automaton - an outside view 

a b b a b 

q0 



89

Decidability <strong>of</strong> Presburger arithmetic (by automata) 

∀x.∀y.∀x1.∀y1.∃z.∃z1. 

¬(x1 + x1 = x) ∨ ¬(y1 + y1 = y) ∨ ((x + y = z1) ∧ (z + z = z1)) 

An automaton accepting all (binary codes <strong>of</strong>) (i, j, k) 

which satisfy i + j = k 

i 0 0 1 0 1 

j 0 1 1 0 0 

k 1 0 0 0 1 

q0 



89

Decidability <strong>of</strong> Presburger arithmetic - cont. 

An automaton accepting all (binary codes <strong>of</strong>) (k1, k2, . . . , kn) 

which satisfy quantifier-free φ(x1, x2, . . . , xn) 

k1 1 0 0 1 1 

k2 0 1 1 0 1 

. . 

kn 1 1 0 1 0 

q0 

By projection, an automaton accepting (k1, k2, . . . , kn−1) 

satisfying ∃xn.φ(x1, x2, . . . , xn) 

Formula ∀x.φ is rewritten by ¬∃x.¬φ ... 



89

Decidability <strong>of</strong> Presburger arithmetic - cont. 

Summary: 

To a general Φ(x1, x2, . . . , xn) (defining a subset [[Φ]] ⊆ N n ) 

we construct automaton AΦ accepting precisely 

(the binary codes <strong>of</strong>) (k1, k2, . . . , kn) ∈ [[Φ]], i.e. 

For closed Φ we have: 

[[Φ]] corresponds to L(AΦ) 

Φ is true iff ε ∈ L(AΦ) iff L(AΦ) �= ∅ 

Φ is true iff L(A¬Φ) = ∅ 



89

Presburger definable sets = semilinear sets 

A set L ⊆ N k is linear if there are: 

a basis b ∈ N k and periods p1, p2, . . . , pn ∈ N k so that 

L = { b + c1p1 + c2p2 + · · · + cnpn | c1, c2, . . . , cn ∈ N } 

◦ ◦ ◦ ◦ • ◦ • • • 

◦ ◦ ◦ ◦ ◦ • ◦ • • 

◦ ◦ ◦ • ◦ • • • • 

◦ ◦ ◦ ◦ • ◦ • ◦ • 

◦ ◦ • ◦ • ◦ • ◦ • 

◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ 

A set S ⊆ N k is semilinear iff it is a finite union <strong>of</strong> linear sets. 

Ginsburg, Spanier 1966: 

Presburger-definable subsets <strong>of</strong> Nk are precisely the semilinear sets. 



89

Addition and multiplication 

Theory N ; symbols 0, S, +, ·, < [and =]). 

A basic axiom system for the arithmetic on natural numbers 

(<strong>with</strong>out the induction principle) 

1. Sx �= 0 

2. Sx = Sy ⇒ x = y 

3. x + 0 = x 

4. x + Sy = S(x + y) 

5. x · 0 = 0 

6. x · Sy = (x · y) + x 

7. ¬(x < 0) 

8. (x < Sy) ⇔ (x < y) ∨ (x = y) 

9. (x < y) ∨ (x = y) ∨ (y < x) 



89

Undecidability, incompleteness (<strong>of</strong> arithmetic) 

Gödel in 1931 .... incompleteness 

(Every formal system able to express arithmetic (i.e., theory N) ...) 

Alan Turing (1913-1954), Alonzo Church (1903-1995) 

1936 ... Turing machines, λ-calculus, 

a stable notion <strong>of</strong> computable functions (Church-Turing thesis) 

(also undecidability <strong>of</strong> (validity in) first order logic; thus 

answering negatively the question stated by Hilbert and 

Ackermann) 



89

Absolute limits (for automated <strong>verification</strong>) 

Negative side: 

The incompleteness and undecidability results revealed 

some absolute limits for finitistic reasoning 

(and for automated computations), 

i.e., limits for Hilbert’s program and Leibniz’ calculus ratiocinator. 

Positive side: 

completeness <strong>of</strong> axiomatization <strong>of</strong> first order logic, 

semidecidability <strong>of</strong> validity (unsatisfiability) 

decidability results for special cases 

(though computational complexity plays an important role) 



89

Electronic computer era 

In 1946, John Mauchly and J Presper Eckert developed 

ENIAC I 

Electrical Numerical Integrator And Calculator 

the world’s first electronic digital computer 

The fascinating era <strong>of</strong> electronic computers started ... 



89

Automated theorem proving 

M. Davis in 1954 ... implementation <strong>of</strong> the decision procedure for 

Presburger arithmetic: 

the first success: computer proved that 

the sum <strong>of</strong> two even numbers is an even number 

Wang in 1958-1964 ... automated theorem prover 

(proved the simple laws <strong>of</strong> predicate calculus in Principia Mathematica) 

Davis, Putnam, Prawitz ... unification 

Robinson 1965 ... resolution principle 



89

Automated theorem proving - cont. 

1970s, 1980s, 1990s, 2000s 

dozens <strong>of</strong> various (s<strong>of</strong>tware) theorem provers (or pro<strong>of</strong> assistants) 

Used for verifying (computer) systems 

usually extend first order logic: induction principles, higher order logics 

(reasoning on data structures like lists, trees, graphs, ... 

functional programming, functions <strong>of</strong> higher order types, ...) 

One example: 

Hunt W.: Microprocessor design <strong>verification</strong>, 

Journal <strong>of</strong> Automated Reasoning 5, 4(1989), 429 - 460 

(<strong>verification</strong> <strong>of</strong> the 32-bit processor FM8502), a part <strong>of</strong> a bigger project: 

Bevier W., Hunt W., Moore J., Young W.: 

An approach to system <strong>verification</strong>, 

Journal <strong>of</strong> Automated Reasoning 5, 4(1989), 411 - 428 

(<strong>verification</strong> <strong>of</strong> code generator, assembler, kernel <strong>of</strong> an operating system) 



89

<strong>Some</strong> available theorem provers (pro<strong>of</strong> assistants) 

PVS Specification and Verification System 

http://pvs.csl.sri.com/ 

Stanford research institute 

The HOL System 

http://www.cl.cam.ac.uk/Research/HVG/HOL/ 

Cambridge university, UK 

Coq 

http://pauillac.inria.fr/coq/ 

Inria, France 

Further available tools: 

ACL2 at Univ. <strong>of</strong> Texas at Austin, USA, Isabelle at Cambridge, UK, Larch, 

MIT, USA, Nuprl, Cornell, USA, TPS, Carnegie Mellon Univ., USA 



89

Program <strong>verification</strong> 

Late 1960s: 

specialized logics and pro<strong>of</strong> procedures for 

<strong>verification</strong> <strong>of</strong> computer programs and systems 

Among the pioneers: 

Floyd, Hoare, Dijkstra, Gries, Lamport, Owicki, Manna, Pnueli 



89

Verification <strong>of</strong> a computer program (division <strong>of</strong> numbers) 

{ x1, x2 are integers satisfying C1: x1 ≥ 0, x2 > 0 } 

Program P 

{ C2: x1 = z1x2 + z2 ∧ 0 ≤ z2 < x2 } 

We want to verify: {C1}P{C2} ... (specification <strong>of</strong> P) 

Generated <strong>verification</strong> conditions: 

{C1} y1 := 0; y2 := x1 {INV} 

{INV ∧ y2 ≥ x2} y1 := y1 + 1; y2 := y2 − x2 {INV} 

{INV ∧ ¬(y2 ≥ x2)} z1 := y1; z2 := y2 {C2} 



89



Program P 

y1 := 0; y2 := x1; 

while y2 ≥ x2 do (y1 := y1 + 1; y2 := y2 − x2); 

z1 := y1; z2 := y2 

{ C2: x1 = z1x2 + z2 ∧ 0 ≤ z2 < x2 } 



{C1} y1 := 0; y2 := x1 {INV} 


{INV ∧ ¬(y2 ≥ x2)} z1 := y1; z2 := y2 {C2} 



89



Program P 

y1 := 0; y2 := x1; 

{ x1 = y1x2 + y2 ∧ 0 ≤ y2 } ... INV 

while y2 ≥ x2 do (y1 := y1 + 1; y2 := y2 − x2); 

z1 := y1; z2 := y2 

{ C2: x1 = z1x2 + z2 ∧ 0 ≤ z2 < x2 } 



{C1} y1 := 0; y2 := x1 {INV} 


{INV ∧ ¬(y2 ≥ x2)} z1 := y1; z2 := y2 {C2} 



89

Axiomatic semantics (partial correctness) 

{A}skip{A} 

{B[a/X ]}X := a{B} 

{A}c0{C} {C}c1{B} 

{A}c0; c1{B} 

{A ∧ b}c0{B} {A ∧ ¬b}c1{B} 

{A}if b then c0 else c1{B} 

{A ∧ b}c{A} 

{A}while b do c{A ∧ ¬b} 

|= (A ⇒ A ′ ) {A ′ }c{B} |= (B ′ ⇒ B) 

{A}c{B} 



89

Program-and-pro<strong>of</strong> development 

Stephen A. Cook (in late 1970s) showed relative completeness: 

|= {A}c{B} implies ⊢ {A}c{B} 

(though ‘being a pro<strong>of</strong>’ depends on some assertions to be valid) 

David Gries (The science <strong>of</strong> programming): 

“the study <strong>of</strong> program correctness pro<strong>of</strong>s has led to the discovery 

and elucidation <strong>of</strong> methods for developing programs. 

Basically, one attempts to 

develop a program and its pro<strong>of</strong> hand-in-hand, 

<strong>with</strong> the pro<strong>of</strong> ideas leading the way !” 

(For tedious things like detailed pro<strong>of</strong>s <strong>of</strong> elementary bits <strong>of</strong> mathematics 

etc. ... use automated pro<strong>of</strong> assistants.) 



89

<strong>Some</strong> specialized tools for deductive program <strong>verification</strong>s 

The Stanford Temporal Prover, STeP 

http://www-step.stanford.edu/ 

Stanford university, USA 

TLV - Temporal Logic Verifier 

http://www.wisdom.weizmann.ac.il/ verify/tlv/ 

Weizmann Institute <strong>of</strong> Science, Israel 

———————————– 

A comprehensive survey <strong>of</strong> <strong>verification</strong> tools 

at Faculty <strong>of</strong> Informatics, Masaryk University Brno, Czech Rep. 

http://anna.fi.muni.cz/yahoda/ 



89

Denotational semantics, while-command 

for command c ... semantics C[[c]] : Σ → Σ⊥ 

C[[while b do c]] ... (σ, σ ′ ) s.t. σ 

if B[[b]]σ = false then σ 

if B[[b]]σ = true and σ c 

then σ 

while b do c 

−→ σ ′ 

while b do c 

−→ σ ′ 

while b do c 

−→ σ 

−→ σ ′ 

−→ σ ′′ and σ ′′ while b do c 

I.e., we apply a functional Γ : (Σ → Σ⊥) → (Σ → Σ⊥): 

⊥ ⊆ Γ(⊥) ⊆ Γ(Γ(⊥)) ⊆ Γ(Γ(Γ(⊥))) ⊆ . . . 



89

Fixpoints <strong>of</strong> monotonic functionals 



89




89




89




89




89




89

Knaster-Tarski theorem 

Bronislaw Knaster (1893-1990) 

Alfred Tarski (1902-1983) (till 1923 Alfred Teitelbaum): 

Assume a monotonic functional Γ : 2 A → 2 A 

(B ⊆ C ⇒ Γ(B) ⊆ Γ(C)). 

Then Y = � {X | Γ(X ) ⊆ X } 

(intersection, i.e. glb, <strong>of</strong> all prefixed points) 

is the least fixpoint <strong>of</strong> Γ. (Γ(Y ) = Y ) 

Dually, (Γ is monotonic also on (2 A , ⊇), and) 

Z = � {X | X ⊆ Γ(X )} 

(union, i.e. lub, <strong>of</strong> all postfixed points) 

is the greatest fixpoint <strong>of</strong> Γ. (Γ(Z) = Z) 



89

Fixpoints for continuous functionals 

Suppose a monotonic Γ : 2 A → 2 A 

For f0 ⊆ f1 ⊆ f2 ⊆ · · · ⊆ � 

n∈ω fn we get 

� 

Γ(fn) ⊆ Γ( � 

fn) 

n∈ω 

(Monotonic) Γ is continuous if � 

� 

� 

Γ(fn) = Γ 

n∈ω 

n∈ω 

Then we get lfp(Γ) as 

∅ ⊆ Γ(∅) ⊆ Γ(Γ(∅)) ⊆ · · · ⊆ � 

n∈ω Γn (∅) = Γ �� 

n∈ω Γn (∅) � 

fn 

� 

n∈ω 

Similarly for the gfp(Γ): 

A ⊇ Γ(A) ⊇ Γ(Γ(A)) ⊇ · · · ⊇ � 

n∈ω Γn (A) = Γ �� 

n∈ω Γn (A) � 



89

Verifying ‘simple’ properties 

Concurrent, parallel, interactive, ‘nondeterministic’ systems, 

<strong>with</strong> ongoing behaviour ... 

No input-output characterization (specification) ... 

Verification <strong>of</strong> ‘simple’ properties ... 

Peterson’s protocol (to avoid critical section clash) 

Process A : 

** noncritical region ** 

flagA := true 

turn := B 

waitfor 

(flagB = false ∨ turn = A) 

** critical region ** 

flagA := false 



Process B : 


flagB := true 

turn := A 

waitfor 

(flagA = false ∨ turn = B) 

** critical region ** 

flagB := false 



89

Kripke structure (transition system) 

¬critA, ¬critB, 

flag A, ¬flag B, 

turn = B 


flag A, ¬flag B, 

turn = ⊥ 


¬flag A, ¬flag B, 

turn = ⊥ 


flag A,flag B, 

turn = ⊥ 



¬flag A,flag B, 

turn = ⊥ 


¬flag A, ¬flag B, 

turn = A 


89

Simple (temporal) properties 

(we refer to Peterson’s protocol) 

a safety property: ∀t : (¬critA(t) ∨ ¬critB(t)) 

“something bad never happens” 

a liveness property: ∀t : flagA(t) ⇒ (∃t ′ : t ≤ t ′ ∧ critA(t ′ )) 

“something good eventually happens” 

(e.g., also fairness properties ... more complicated) 



89

First order logic <strong>of</strong> order (FOLO) 

Reasoning about finite runs (later also infinite runs) 

We assume a set AP (atomic propositions) <strong>of</strong> unary predicates P1, P2, . . . 

φ ::= P(x) | x = y | x < y | ¬φ | φ1 ∧ φ2 | ∃x.φ 

E.g. ∀x : flagA(x) ⇒ (∃x ′ : x ≤ x ′ ∧ critA(x ′ )) 

Interpreted on {0, 1, . . . , n} <strong>with</strong> the natural meaning <strong>of</strong> < . 

we can add (define): φ1 ∨ φ2, true, false, succ(x, y), ... 

The structure (interpretation) can be viewed as 

w = 

� P1 

¬P2 

P3 

.. 

i.e., as a word in alphabet 2 AP 

� � ¬P1 

P2 


P3 

.. 

� � � 

¬P1 

P2 . . . 

¬P3 

.. 


89

Semantics <strong>of</strong> FOLO 

For interpreting free variables we need a valuation: 

Then 

V : {x, y, z, . . . } → {0, 1, . . . , n} 

w |=V φ ... w satisfies (is a model <strong>of</strong>) φ in valuation V 

can be defined by structural induction: 

w |=V P(x) . . . w(V(x)) ∋ P (P(V(x))) 

w |=V x = y . . . V(x) = V(y) 

w |=V x < y . . . V(x) < V(y) 

w |=V ¬φ . . . w �|=V φ 

w |=V φ1 ∧ φ2 . . . w |=V φ1 and w |=V φ2 

w |=V ∃x.φ . . . there is j s.t. w |= V[j/x] φ 



89

Decidability <strong>of</strong> validity in FOLO by finite automata 

φ ::= P(x) | x = y | x < y | ¬φ | φ1 ∧ φ2 | ∃x.φ 

flagA(x) ⇒ (∃x ′ : x ≤ x ′ ∧ critA(x ′ )) ... Φ(flagA, critA; x) 

Φ(P1, P2, P3; x1, x2, x3) 

P1 1 0 0 0 0 1 0 1 

P2 1 1 1 0 1 1 0 0 

P3 0 0 1 1 1 0 0 1 

x1 0 0 1 0 0 0 0 0 

x2 0 0 0 0 0 0 1 0 

x3 1 0 0 0 0 0 0 0 

q0 



89

Decidability <strong>of</strong> validity in FOLO by finite automata - cont. 

Büchi (early 1960s) 

To each closed Φ (<strong>with</strong> predicates P1, P2, . . . , Pk) 

construct a finite automaton AΦ, over the alphabet 2 {P1,P2,...,Pk} , such that 

w |= Φ iff w ∈ L(AΦ) .... L(Φ) = L(AΦ) 

So we have: Φ valid iff ¬Φ unsatisfiable iff L(A¬Φ) = ∅ 

Model checking: 

decide if K, s |= Φ (i.e., if all runs from s satisfy Φ) 

construct automaton A¬Φ 

construct the product automaton A = (K, s) × A¬Φ 

decide if L(A) = ∅ (if NO then provide counterexample) 



89

Monadic second order logic <strong>of</strong> order (MSOLO) 

FOLO-languages are a (proper) subclass <strong>of</strong> regular languages: 

Star-free regular languages is the least class which contains 

elementary (finite) languages and is closed wrt 

∪ (union), · (concatenation), ¯ (complement). 

E.g., “on each even position (and maybe elsewhere) is b” 

can not be expressed. ..... ababbbababbb 

We need Monadic second order logic (MSOLO) 

φ ::= P(x) | x = y | x < y | ¬φ | φ1 ∧ φ2 | ∃x.φ | ∃X .φ | x ∈ X 

∃X .0 ∈ X ∧ ∀y∀z.(succ(y, z) ⇒ (y ∈ X ⇔ ¬z ∈ X )) 

∧ ∀y.y ∈ X ⇒ Qb(y) 

Büchi: MSOLO-languages are exactly regular languages. 



89

Logics and automata on infinite words 

Infinite runs w = 

� P1 

¬P2 

P3 

.. 

� � ¬P1 

P2 

P3 

.. 

� � � 

¬P1 

P2 . . . 

¬P3 

.. 

No problem <strong>with</strong> interpreting logics (L(Φ) ⊆ Σ ω ) 

φ ::= P(x) | x = y | x < y | ¬φ | φ1 ∧ φ2 | ∃x.φ 

φ ::= P(x) | x = y | x < y | ¬φ | φ1 ∧ φ2 | ∃x.φ | ∃X .φ | x ∈ X 

What about automata ? 

Büchi: accepts when an accepting state appears infinitely <strong>of</strong>ten 

a,b b Lω(A) = { w ∈ {a, b} ω | 

b 


w contains just 

finitely many a’s } 


89

Automata on infinite words 

(Nondeterministic) Büchi automata ... ω-regular languages 

The same as MSOLO ω-languages: 

NBA → MSOLO easy 

(∃X1 (positions for state q1) ∃X2 (state q2) ....) 

MSOLO → NBA similarly as in the finite word case 

but intersection a bit more complicated, 

and determization does not hold ! (see the previous example), 

complementation still holds but more difficult 

(a nice application <strong>of</strong> Ramsey theorem for the countable case) 

Muller automata {I1, I2, . . . , Ik} ... one coincides <strong>with</strong> inf. <strong>of</strong>ten visited on 

a (run on a) word 

Rabin automata {(G1, R1), (G2, R2), . . . , (Gk, Rk)} 

for one pair, Gi is visited infinitely <strong>of</strong>ten but Ri only finitely <strong>of</strong>ten 

Streett automata, Mostowski (parity) automata, ... 



89

Validity and model checking for infinite words 

Validity 

To a MSOLO formula Φ, construct NBA L(A¬Φ) so that 

|= Φ iff L(A¬Φ) = ∅ 

Model checking 

To decide if K, s |= Φ , check if L(A) = ∅ for A = (K, s) × A¬Φ 

Warning. Already satisfiability <strong>of</strong> FOLO nonelementary 

(for input size n, we get at least the tower 222... <strong>of</strong> height n), 

so Aφ must be generally very large. 

Nevertheless, see: 

MONA project 

http://www.brics.dk/mona/ 

Brics, Denmark 



89

Linear Temporal Logic (LTL) 

In practical life (<strong>of</strong> ‘small things’), it is <strong>of</strong>ten convenient to use just 

LTL (or PLTL - Propositional Linear(-time) Temporal Logic) 

(Amir Pnueli in late 1970s advocated the use in <strong>verification</strong>; 

the logic goes back to Prior (1957,1967), etc.) 

φ ::= P | ¬φ | φ1 ∧ φ2 | X φ | φ1Uφ2 

F φ ≡ true U φ, Gφ ≡ ¬F ¬φ, . . . 

Recall the safety property and the liveness property (in FOLO) 

∀t : (¬critA(t) ∨ ¬critB(t)), ∀t : flagA(t) ⇒ (∃t ′ : t ≤ t ′ ∧ critA(t)) 

in LTL: G(¬critA ∨ ¬critB), G(flagA ⇒ F (critA)) 

Kamp (1968), Gabbay,Pnueli,Shelah,Stavi (1980): 

FOLO and LTL equally expressive 



89

Model checking LTL 

Decide if K, s |= Φ (i.e., if all runs from s satisfy LTL-formula Φ): 

construct automaton A¬Φ 

construct the product automaton A = (K, s) × A¬Φ 

decide if L(A) = ∅ (if NO then provide counterexample) 

Moshe Vardi: 

LTL-formula Φ ... Alternating BA ... NBA 

(subset construction; exponential increase) 

Model checking LTL is PSPACE-complete 

(the state space on demand, on the fly ...) 

Time complexity <strong>of</strong> used algorithms O( |K| · 2 |Φ| ) 

SPIN (LTL model checker) 

http://spinroot.com/ 

Bell Labs 



89

Vending machines 

V1 

V3 

def 

= 5k.5k.( c<strong>of</strong>fee.collect.V1 

+ tea.collect.V1 ) 

def 

= 5k.5k.c<strong>of</strong>fee.collect.V3 

+ 5k.5k.tea.collect.V3 


c<strong>of</strong>fee tea 

5k 

collect 


89

Vending machines - cont. 

V1 

V2 

def 

= 5k.5k.( c<strong>of</strong>fee.collect.V1 + tea.collect.V1 ) 

✤ 

V1 

✣ 

5k 5k 

collect 

c<strong>of</strong>fee 

tea 

def 

= 5k.5k.c<strong>of</strong>fee.collect.V2 + 5k.5k.tea.collect.V2 

✤ 

✣ 

5k 

5k 

5k 

5k 

collect 



tea 

✜ 

✢ 

✜ 

✢ 


89

Branching time 

LTL does not make difference between 

• 

• 

coin coin 

coin 

• • 

• 


tea 


• • 

CTL (Computation Tree Logic) 

• • 

φ ::= P | ¬φ | φ1 ∧ φ2 | EX φ | AX φ | E(φ1Uφ2) | A(φ1Uφ2) 

Model checking: decide if K, s |= Φ 

complexity O( |K| · |Φ| ) 

(number <strong>of</strong> pairs (state s, subformula ψ)) 



89

Model checking CTL 

The ‘most complicated’ subcase: A(φUψ) 

ϕ 

ψ 

ϕ ϕ 

SMV (Symbolic model checking; author Ken McMillan) 

http://www-cad.eecs.berkeley.edu/ kenmcmil/smv/ 

Cadence Berkeley Laboratories 

CTL ∗ ... Eφ <strong>with</strong>out restrictions, subsumes LTL, CTL 

(model checking PSPACE-complete, as for LTL) 


ψ 


89



ϕ 

2 

ψ 

2 

ϕ ϕ 







1 

ψ 


89



ϕ 

2 

ψ 

2 

ϕ ϕ 







1 

ψ 


89



ϕ 

1 

ψ 

1 

ϕ ϕ 







1 

ψ 


89



ϕ 

1 

ψ 

1 

ϕ ϕ 







1 

ψ 


89



ϕ 

1 

ψ 

1 

ϕ ϕ 







0 

ψ 


89



ϕ 

1 

ψ 

1 

ϕ ϕ 







0 

ψ 


89



ϕ 

1 

ψ 

0 

ϕ ϕ 







0 

ψ 


89



ϕ 

1 

ψ 

0 

ϕ ϕ 







0 

ψ 


89



ϕ 

1 

ψ 

0 

ϕ ϕ 







0 

ψ 


89

Tree automata 

Tree automata (not on words but on trees) 

∗ 

+ a 

a a 

(q0, ∗) → {(q0, q0), (q0, qa), (qa, q0), (qa, qa)} 

(q0, +) → {(q0, q0), (q0, qa), (qa, q0), (qa, qa)} 

(qa, a) → {qF } 

Finite tree automata: 

top-down, bottom-up, nondeterministic, deterministic, 

regular tree-languages, 

closed wrt ∪, ∩, ¯, ... 



89

More on tree unfoldings 

Unfolding <strong>of</strong> a graph (<strong>with</strong>out dead-ends) ... an infinite tree 

binary tree ... { ε, 0, 1, 00, 01, 10, 11, . . . } 

ɛ 

0 1 

00 01 10 11 

Theory S2S (two successors) ... s1(u, u0), s2(u, u1) 

φ ::= P(x) | x ∈ X | s1(x, y) | s2(x, y) | 

¬φ | φ1 ∧ φ2 | ∃xφ | ∃X φ 

x −→ ∗ y ... expressible in S2S (but not in first order) 



89

Decidability <strong>of</strong> S2S 

A tree t (whose vertices are) labelled by elements <strong>of</strong> 2 {P1,P2,...,Pn} 

t |=V φ 

t |= φ for closed φ 

|= φ ... φ valid (¬φ unsatisfiable) 

M. Rabin (late 1960s): Büchi-like tree automaton; 

not closed wrt complementation 

more powerful Rabin (tree) automata closed wrt ∪, ∩, and ¯ 

(complementation difficult) 

(No hope for determinization: T ∃a ) 

|= Φ iff T (A¬Φ) = ∅ 



89

µ-calculus 

Kozen, Pratt (1980s) 

Bradfield, Emerson, Stirling, Vardi, Walukiewicz, ... 

µ-calculus ... modal logic <strong>with</strong> fixpoints 

φ ::= P | X | ¬φ | φ1 ∧ φ2 | 〈a〉φ | µX .φ 

each X in the scope <strong>of</strong> an even number <strong>of</strong> negations 

Examples: 

µX .P ∨ 〈−〉X (reaches P (in finitely many steps)) 

νX .〈a〉X (can perform a forever) 

An interesting problem: 

model checking µ-calculus (K, s |= Φ) 

in NP ∩ co-NP 



89

Parity games (in NP and co-NP) 

n 

7 

6 

5 

4 

3 

2 

1 

. 

“A lift game for 2 players” 

(a directed graph <strong>with</strong> ordered nodes; 

the nodes are partitioned into red and blue; 

each node has out-degree ≥ 1 ) 

in red nodes (floors), player RED chooses the next 

node (floor) 

in blue nodes (floors), player BLUE chooses the 

next node (floor) 

The player winning an infinite play is determined by 

the colour <strong>of</strong> the lowest node (floor) visited 

infinitely <strong>of</strong>ten 

Who has a winning strategy where ? 



89

Specification; process algebras 

Operational semantics <strong>of</strong> some process constructs 

Action Prefix: a.E 

✿✿✿✿✿✿✿✿✿✿✿✿✿✿ 

Choice: E + F 

✿✿✿✿✿✿✿ 

✓ 

E a → E ′ 

✒E 

+ F a → E ′ 

✓ 

✞ ☎ 

✝a.E 

✆ 

a → E 

� 

{Ei : i ∈ I } 

✏ 

✑ 

Ej a → F 

� 

{Ei : i ∈ I } 

✒ 

a → F 


✓ 

F a → F ′ 

✒E 

+ F a → F ′ 

(j ∈ I ) 

✏ 

✑ 

✏ 

✑ 


89

Process algebras - cont. 

def 

Nil: 0 = � ∅ 

✿✿✿ 

Process Definition: X ✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ 

def 

= E 

✓ 

✞ 

☎ 

✝No 

transitions for 0 — no rules ✆ 

E a → F 

✒X 

a → F 

(X def 

= E) 


✏ 

✑ 


89

Synchronisation Merge 

✓ 

E a → E ′ 

E||F 

✒ 

a → E ′ ||F 

✓ 

(a �∈ L(F )) 

✏ 

✑ 

E a → E ′ F a → F ′ 

✒ 

E||F a → E ′ ||F ′ 

✓ 

F a → F ′ 

E||F 

✒ 

a → E||F ′ 

A process E is equipped <strong>with</strong> an associated 

synchronisation sort L(E). 

✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿✿ 

Concurrent processes must synchronise on 

actions common to their respective sorts. 


(a ∈ L(E) ∩ L(F )) 

(a �∈ L(E)) 

✏ 

✑ 

✏ 

✑ 


89

Example: a railway level crossing (from Faron Moller) 

Rail 

tcross train 

car 

up 

down 

Road 


ccross 

green 

red 


89

Railway Components 

Road 

Rail 

down 

red 

car 

ccross 

train 

tcross 

✞ 

✝ 

✞ 

Road def 

✝ 

up 

Rail def 

green 

☎ 

= car.up.ccross.down.Road 

✆ 

� 

L(Road) = car, ccross, 

� 

up, down 

☎ 

= train.green.tcross.red.Rail 

✆ 

� 

L(Rail) = train, tcross, 

� 

green, red 



89

Railway Components - cont. 

Controller 

green 

down 

red 

up 

✎ 

Controller def 

✍ 

L(Controller) = 

= green.red.Controller 

+ up.down.Controller 

� 

green, red, 

� 

up, down 


☞ 

✌ 


89

The Complete Railway System 

✞ 

Crossing def 

✝ 

up 

☎ 

= Road || Controller || Rail 

✆ 

Road Controller Rail 

down 

down 

ccross up car 

train 

train 

train 

Crossing 

ccross up car 

down 

train 

green 


red 

green 

car 

tcross 

red 

green 

red 

tcross 

car 


89

Behavioural equivalences and preorders; simulation 

Does a system implement another one ? Are they equivalent ? 

(system = labelled transition system) 

Language (trace) equivalence is <strong>of</strong>ten too coarse 


• 

coin coin 

• 

• 

tea 

• • 

• • 

A binary relation R over STATES is a simulation if 

whenever (s, t) ∈ R then for every action a 

if s 

• 

coin 

• 


a 

−→ s ′ a 

then t −→ t ′ for some t ′ such that (s ′ , t ′ ) ∈ R. 

s is simulated by t if there is a simulation R ∋ (s, t). 

The union <strong>of</strong> (all) simulations is the (maximal) simulation 

(the greatest fixpoint) 



89

Bisimulation equivalence 

Milner, Park (1980s) 

A binary relation R over STATES is a bisimulation if 

it is a symmetric simulation, i.e. 


if s 

a 

−→ s ′ a 

then t −→ t ′ for some t ′ such that (s ′ , t ′ ) ∈ R. 


if t 

a 

−→ t ′ a 

then s −→ s ′ for some s ′ such that (s ′ , t ′ ) ∈ R. 

s is bisimilar <strong>with</strong> t if there is a bisimulation R ∋ (s, t). 

The union <strong>of</strong> (all) bisimulations is the (maximal) bisimulation 

(the bisimulation equivalence). 



89

Linear Time / Branching Time Spectrum 

Bisimulation equivalence 

2-nested simulation equivalence 

Ready simulation equivalence 

Possible-futures equivalence Ready trace equivalence 

Readiness equivalence Failure trace equivalence 

Failures equivalence 

Completed trace equivalence 

Trace equivalence 


Simulation equivalence 


89

Minsky counter machines 

A Minsky counter machine C is given by 

a fixed number <strong>of</strong> (nonnegative integer) counters c1, c2, . . . , cm 

a program (in fact, a set <strong>of</strong> labelled instructions) 

1 : com1; 2 : com2; ...... ; n : comn , where 

comn is instruction HALT 

comi (i = 1, 2, ..., n − 1) are commands <strong>of</strong> two types: 

cj := cj + 1; goto k 

if cj = 0 then goto k1 else (cj := cj − 1; goto k2) 



89

Undecidability <strong>of</strong> behavioural equivalences for Petri nets 

Fact. 

It is undecidable if a 2-counter machine C halts on the zero input (i.e., 

when starting <strong>with</strong> c1 = c2 = 0). 

Jančar 1994: an algorithm A 

so that 

C −→ A −→ N C 1 , NC 2 

if C halts (on zero input) then the behaviours <strong>of</strong> N C 1 , NC 2 differ 

‘drastically’ (one can perform a trace which the other cannot) 

if C does not halt then the behaviours <strong>of</strong> N C 1 , NC 2 

in a strict sense (the nets are bisimilar) 


are the same 


89

Reduction <strong>of</strong> halting problem to Petri net equivalences 

c2 s1 s2 s3 s4 s5 sn 

c1 

• 


s6 

. . . 


89


c2 s1 s2 s3 s4 s5 sn 

c1 

• 


s6 

. . . 


89


• 

c2 s1 s2 s3 s4 s5 sn 

• . . . 

c1 


s6 


89


c2 s1 s2 s3 s4 s5 sn 

• 

c1 

• 


s6 

. . . 


89


c2 s1 s2 s3 s4 s5 sn 

• 

c1 

• 

+ 

+ 


s6 

. . . 


89


c2 s1 s2 s3 s4 s5 sn 

c1 

• 

+ + 

+ + 


s6 

. . . 


89


c2 s1 s2 s3 s4 s5 sn 

c1 

• 

+ + 

+ + 

p2 


s6 

. . . 

p1 


89


c2 s1 s2 s3 s4 s5 sn 

c1 

• 

+ + 

+ + 

p2 


s6 

. . . 

• 

p1 


89

Reduction - cont. 

• 

• 

. 

• • 

• • 

• • • • 

• • 

• • 

• • • • 

• • 

• • 

• • 

• • 


• 

• 


89 

• 

.

Simulation on one-counter nets - semilinear 

p(m) is not simulated by q(n) ... red 

p(m) is simulated by q(n) ... black 

• • • • • • • • • 

n • • • • • • • • • 

. • • • • • • • • • 

• • • • • • • • • 

1 • • • • • • • • • 

0 • • • • • • • • • 

0 1 2 . . . m 


?? 


89

Bisimilarity over ‘context-free’ processes decidable 

Context-free grammar (in Greibach NF) 

finitely many rules <strong>of</strong> the type A1 → aB1B2 . . . Bk 

Processes BPA (sequential) 

A1A2 . . . An 

a 

b 

B1B2 . . . BkA2 . . . An 

a a b 

. . . 


Processes BPP (parallel) 

A1 

a 

B1B2 . . . Bk 

Christensen, Hirshfeld, Moller (1993) 

decidable (nonprimitive recursive 

upper bound) 

Srba (2002) PSPACE-hard 

Jančar (2003) PSPACE-complete 


89

DPDA language equivalence, PDA bisimilarity 

G. Sénizergues (1997, 2001) 

The language equivalence problem for deterministic pushdown automata is 

decidable 

C. Stirling (2002) 

Simplified the pro<strong>of</strong> substantially, and showed that it is primitive recursive 

———————————– 

G. Sénizergues (1998, 2005) 

Decidability <strong>of</strong> bisimulation equivalence for equational graphs <strong>of</strong> finite 

out-degree. 

———————————– 

An open problem (a possible extension to Type -1 systems) solved 

negatively: 

Jančar, Srba: Undecidability results for bisimilarity on prefix rewrite 

systems (FoSSaCS 2006) 



89

Bisimulation game 

2 Players: Attacker and Defender 

Game board: a labelled transition system 

Rules for playing from an initial position (s0, t0): 

REPEAT 

in the current position (s, t) 

Attacker performs a move from one <strong>of</strong> the states s, t 

a 

(either s −→ s ′ a 

or t −→ t ′ ); if not possible, Defender has won. 

Defender responds by a move from the other state, labelled by the 

same action a; thus a new position (s ′ , t ′ ) arises. 

If Defender cannot respond, Attacker has won. 

Any infinite play is viewed as Defender’s winning. 

Fact: s0 ∼ t0 iff Defender has a winning strategy from (s0, t0). 



89

Pushdown graphs; generated by Type 0 systems 

pX 

pX 

qA 

pX 

c 

b 

−→ pXA 

c 

−→ qε 

a 

−→ qε 

b 

pXA 

q qA 

a 

c 

b 

pXAA 

c 

qAA 

Type 0 system: finite sets <strong>of</strong> rules w1 

(the same class <strong>of</strong> generated graphs) 

a 

b 

a 

a 

−→ w2 

An involved result: Bisimilarity is decidable 

(Sénizergues (1998,2005), then Stirling) 


pXAAA 

c 

qAAA 

b 

a 

. . . 

. . . 


89

Type -1 systems; rules R a → w 

X 

XA∗ A 

c 

X 

b 

−→ XA 

c 

−→ ε 

a 

−→ ε 

c 

b 

XA 

ε A 

a 

b 

a 

XAA 

AA 

b 

a 

c 

XAAA 

c 

AAA 

Stirling, Sénizergues: is bisimilarity decidable ? 

Sénizergues’ decidability result for equational graphs <strong>of</strong> finite out-degree 

(equivalent to the case R a 

−→ w <strong>with</strong> prefix-free R) 

Maybe in the normed case ? 

(u is normed if each path from u can be prolonged to reach ε) 


b 

a 

. . . 

. . . 


89

Hierarchy <strong>of</strong> prefix rewriting 

Type Form <strong>of</strong> Rewrite Rules 

Type -2 R1 

a 

−→ R2 

Type -1a/-1b R a 

−→ w / w a 

−→ R 

Type 0 w a 

−→ w ′ 

Type 1 1 

2 pX a 

Type 2 

−→ qw 

X a 

−→ w 

Type 3 X a 

−→ Y , X a 

−→ ε 


Type -2 

Type -1a Type -1b 

Type 0 = Type 1 1 

2 

Type 2 

Type 3 


89

Our results 

Normed Processes Unnormed Processes 

Type -2 

Type -1b 

Type -1a 

Type 0, and decidable decidable 

Type 1 1 

2 

Type 2 

EXPTIME-hard 

∈ P 

EXPTIME-hard 

∈ 2-EXPTIME (?) 

P-hard PSPACE-hard 

Type 3 P-complete P-complete 



89

Our results 


Type -2 Σ 1 1 -complete Σ1 1 -complete 

Type -1b Π 0 1 -complete Σ1 1 -complete 

Type -1a Π 0 1 -complete Π0 1 -complete 


Type 1 1 

2 EXPTIME-hard EXPTIME-hard 

Type 2 ∈ P ∈ 2-EXPTIME (?) 





89

Our results 


Type -2 Σ 1 1 -complete Σ1 1 -complete 

Type -1b Π 0 1 -complete Σ1 1 -complete 

Type -1a Π 0 1 -complete Π0 1 -complete 


Type 1 1 

2 EXPTIME-hard EXPTIME-hard 

Type 2 ∈ P ∈ 2-EXPTIME (?) 



The main new result: Bisimilarity is undecidable on Type -1a systems. 



89

Inf-PCP (a version <strong>of</strong> Post Correspondence Problem) 

A PCP-instance : 

u1 u2 . . . un 

v1 v2 . . . vn 

ui, vi : nonempty words in an alphabet 

An infinite initial solution: a sequence i1, i2, i3, . . . from {1, 2, . . . , n} such 

that i1=1 and ui1ui2 ui3ui4 · · · = vi1vi2 vi3vi4 · · · 

Given a Turing machine M, <strong>with</strong> instructions (q0, a) → (q1, b, +1), . . . , 

and an input word, say w = aabab, we can construct PCP-instance so 

that: M does not halt on w ⇐⇒ there is an infinite initial solution. 

# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 



89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 



89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 



89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 



89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 


# 

#q0aabab# 


89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 


#q0a 

#q0aabab#bq1 


89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 


#q0aa 

#q0aabab#bq1 a 


89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 


#q0aa b . . . 

#q0aabab#bq1 ab. . . 


89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 

#q0aa b . . . 


So neg-HP is reducible to inf-PCP; inf-PCP is Π 0 1 -complete. 



89



u1 u2 . . . un 

v1 v2 . . . vn 







# q0a . . . a b . . . 

#q0aabab# bq1 . . . a b . . . 

#q0aa b . . . 


So neg-HP is reducible to inf-PCP; inf-PCP is Π 0 1 -complete. 

Note: we can even require |ui| ≤ |vi| 



89

Inf-PCP is reducible to bisimilarity on (normed) Type -1a 

u1 u2 . . . un 

v1 v2 . . . vn 

ui, vi ∈ {A, B} + , |ui| ≤ |vi| 

Observation: The following conditions are equivalent 

ui1ui2 ui3 · · · = vi1vi2 vi3 · · · 

∀m: ui1ui2 · · · uim is a prefix <strong>of</strong> vi1vi2 · · · vim 

∀m: (ui1ui2 · · · uim) R is a suffix <strong>of</strong> (vi1vi2 · · · vim) R 

∀m: (uim) R (uim−1 )R · · · (ui1 )R is a suffix <strong>of</strong> (vim) R (vim−1 )R · · · (vi1 )R 

A game: Defender stepwise generates a sequence 

. . . Iim . . . Ii3Ii2 Ii1 (<strong>with</strong> 

i1 = 1) 

Attacker has a possibility to stop this process and win whenever 

(uim) R (uim−1 )R · · · (ui1 )R is not a suffix <strong>of</strong> (vim) R (vim−1 )R · · · (vi1 )R 



89

Implementation <strong>of</strong> the game; generating rules 

X c 

−→ Y 

X c 

−→ Yi X ′ c 

−→ Yi 

Yi 

i 

−→ X ′ Ii 

Y i 

−→ XIi 

XI1 ⊥ 

Yi 

c c 

j 

−→ XIj 

YI1 ⊥ . . . Y8I1 ⊥ . . . 


for all i ∈ {1, 2, . . . , n} 

for all i ∈ {1, 2, . . . , n} 

for all i, j ∈ {1, 2, . . . , n}, i �= j 

X ′ I1 ⊥ 

c 

. . . Y8I1 ⊥ . . . 


89


X c 

−→ Y 

X c 

−→ Yi X ′ c 

−→ Yi 

Yi 

i 

−→ X ′ Ii 

Y i 

−→ XIi 

YI1 ⊥ 

XI1 ⊥ 

Yi 

c c 

5 

j 

−→ XIj 

. . . Y8I1 ⊥ . . . 

8 

. . . XI5I1 ⊥ . . . XI8I1 ⊥ 


for all i ∈ {1, 2, . . . , n} 

for all i ∈ {1, 2, . . . , n} 

for all i, j ∈ {1, 2, . . . , n}, i �= j 

X ′ I1 ⊥ 

c 

. . . Y8I1 ⊥ 

5 8 

. . . 

XI5I1 ⊥ . . . X ′ I8I1 ⊥ 


89


X c 

−→ Y 

X c 

−→ Yi X ′ c 

−→ Yi 

Yi 

i 

−→ X ′ Ii 

Y i 

−→ XIi 

YI1 ⊥ 

XI1 ⊥ 

Yi 

c c 

5 

j 

−→ XIj 

. . . Y8I1 ⊥ . . . 

8 

. . . XI5I1 ⊥ . . . XI8I1 ⊥ 


for all i ∈ {1, 2, . . . , n} 

for all i ∈ {1, 2, . . . , n} 

for all i, j ∈ {1, 2, . . . , n}, i �= j 

X ′ I1 ⊥ 

c 

. . . Y8I1 ⊥ 

5 8 

. . . 

XI5I1 ⊥ . . . X ′ I8I1 ⊥ 


89

Switch-to-checking rules 

XI7I15I3I8I1 ⊥ X ′ I7I15I3I8I1 ⊥ 

(ui7 )R (ui15 )R (ui3 )R (ui8 )R (ui1 )R (vi7 )R (vi15 )R (vi3 )R (vi8 )R (vi1 )R 

X d 

−→ C 

X (I ∗ )Ii 

d 

−→ C ′ w X ′ (I ∗ )Ii 

Notation: I ∗ stands for (I1 + I2 + · · · + In) ∗ ; 

XI7I15I3I8I1 ⊥ 

d 

d 

−→ C ′ w for all i ∈ {1, 2, . . . , n} 

and all suffices w <strong>of</strong> v R 

i 

X ′ I7I15I3I8I1 ⊥ 

CI7I15I3I8I1 ⊥ C ′ wI8I1 ⊥ 


d 


89

Checking rules 

CI7I15I3I8I1 ⊥ C ′ wI8I1 ⊥ 

We want to guarantee: CI7I15I3I8I1 ⊥ is bisimilar to C ′ wI8I1 ⊥ 

iff 

(ui7 )R (ui15 )R (ui3 )R (ui8 )R (ui1 )R = w(vi8 )R (vi1 )R 

CA a 

−→ C C ′ A a 

−→ C ′ 

CB b 

C⊥ e 

CIi 

−→ C C ′ B b 

−→ C ′ 

−→ ε C ′ ⊥ e 

−→ ε 

h(uR i ) 

−→ C tail(uR i ) C ′ Ii 

h(v R 

i ) 

−→ C ′ tail(v R 

i ) 

for all i ∈ {1, 2, . . . , n} 

Notation. h(w) = a when head(w) = A, h(w) = b when head(w) = B 



89

Summary <strong>of</strong> the reduction: inf-PCP → bisim-Type-1a 

u1 u2 . . . un 

v1 v2 . . . vn 

−→ 

generating rules 

switch-to-checking rules 

checking rules 

There is an infinite initial solution ⇐⇒ XI1 ⊥ is bisimilar <strong>with</strong> X ′ I1 ⊥ 

(Moreover: XI1 ⊥, X ′ I1 ⊥ are normed processes.) 



89

Formal methods (formal <strong>verification</strong>) in industry 

In reality, mainly simulation and testing, 

but the need <strong>of</strong> formal methods is felt more and more widely 

(need <strong>of</strong> incorporating them into the s<strong>of</strong>tware engineering technologies) 

complex, distributed, parallel hardware and s<strong>of</strong>tware 

(e.g. in embedded systems hardware/s<strong>of</strong>tware mixture) 

Brief ‘history’ <strong>of</strong> model checking: 

1980s (Clarke, Emerson, Sifakis, ...) 

finite state systems (traffic light controller) 

1990s 

MC penetrates the hardware industry (Intel, Motorola, ...) 

(also communication protocols, ...) 

2000s 

penetration <strong>of</strong> (infinite state) MC into industry (s<strong>of</strong>tware) 

R. Leino (Micros<strong>of</strong>t research, USA) (AVIS 2005), 

BLAST (Berkeley lazy abstraction s<strong>of</strong>tware tool), ... 



89

Active research areas 

specification formalisms 

(oriented on the user; graphical toolkits, 

interface for theorem provers, ...) 

process calculi (π-calculus, mobile agents, security, typing, ...) 

coping <strong>with</strong> the state explosion 

(data domains, recursion, concurrency, real time, ...) 

reduction (partial order reduction, symmetries [hardware], ...) 

encoding (BDD’s, symbolic model checking, ...) 

abstraction (data, predicates, control ...) 

compositionality 

effective algorithms (complexity, decidability) 

methods for <strong>verification</strong> <strong>of</strong> infinite state systems, parametrized systems 

real time systems, hybrid systems, probabilistic systems 

heuristics, experiments, ... 



89

Conferences 

<strong>Some</strong> specialized conferences in the area <strong>of</strong> <strong>verification</strong> 

Tools and algorithms for the construction and analysis <strong>of</strong> systems (TACAS) 

(part <strong>of</strong> European Joint Conferences on Theory and Practice <strong>of</strong> S<strong>of</strong>tware 

(ETAPS)) 

(TACAS 2006, 12th Int. Conf., March 27-30, Vienna, Austria) 

Computer Aided Verification (CAV) 

(CAV 2006, 18th Int. Conf., August 16-21, Seattle, Washington, USA) 

Concurrency theory (Concur) 

(Concur 2006, 17th Int. Conf., August 27-30, Bonn, Germany) 

Automated Technology for Verification and Analysis (ATVA) 

(ATVA 2006, 4th Int. Symposium, October 23-26, Beijing, China) 



89

Textbooks, survey books 

<strong>Some</strong> recent survey books on <strong>verification</strong> (and related topics) 

Clarke E. and Grumberg O. and Peled D. 

Model checking, MIT Press 1999 

Bergstra J. and Ponse A. and Smolka S.(editors) 

Handbook <strong>of</strong> Process Algebra, Elsevier 2001 

Bérard B. and others (from LSV ENS Cachan, France) 

Systems and S<strong>of</strong>tware Verification, Springer 2001 

Peled D. 

S<strong>of</strong>tware reliability methods, Springer 2001 

Schneider K. 

Verification <strong>of</strong> reactive systems, Springer 2004 



89

Some theoretical aspects of verification (with a focus on bisimilarity)

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?