ACTL Formulas Research Articles

Model checking software product line based on multi-valued logic

Software product line (SPL) maximises commonality between software products to reduce cost and improve productivity. SPL has been widely applied in critical systems, and ensuring correctness of the system is thus of great importance. In this paper, we consider the incomplete designs in the early stage of software development. This enables detecting design errors earlier, reducing the cost of later development of final products. We first propose bilattice-based feature transitions systems (BFTSs), which support description of uncertainty. We then express system behavioural properties using ACTL formulas and define its semantics over BFTSs. On the one hand, we provide the procedures that translate BFTSs to multi-valued Kripke structure and develop a software model checker assistant BPMCA. On the other hand, we decompose the multi-valued BFTS to lower the complexity of model checking. Finally, we implement our approach and illustrate its effectiveness on a benchmark from the literature.

Linear templates of ACTL formulas with an application to SAT-based verification

ACTL formulas with linear counterexamples have been studied and the templates of ACTL formulas for which linear counterexamples exist have been identified. This paper further studies ACTL formulas having linear counterexamples in light of bounded semantics, and an application of this to SAT-based verification (in particular, bounded correctness checking) of ACTL properties is developed. In addition to the analysis on the semantic aspects, one goal is to provide a good solution to embedding the subset of ACTL that has linear counterexamples into an existing verification approach of ACTL. Due to that ECTL formulas are dual to ACTL formulas, we develop a refined bounded semantics for ECTL for the purpose of showing unsatisfiability of ACTL properties. Experimental data and experimental comparison are reported.

Model-based Runtime Verification Framework for Self-optimizing Systems

This paper describes a novel on-line model checking approach offered as service of a real-time operating system (RTOS). The verification system is intended especially for self-optimizing component-based real-time systems where self-optimization is performed by dynamically exchanging components. The verification is performed at the level of (RT-UML) models. The properties to be checked are expressed by RT-OCL terms where the underlying temporal logic is restricted to either time-annotated ACTL or LTL formulae. The on-line model checking runs interleaved with the execution of the component to be checked in a pipelined manner. The technique applied is based on on-the-fly model checking. More specifically for ACTL formulae this means on-the-fly solution of the NHORNSAT problem while in the case of LTL the emptiness checking method is applied.

ACTL strong negation and its application to hybrid systems verification

Model checking procedures for verifying properties of hybrid dynamic systems are based on the construction of finite-state abstractions. If the property is not satisfied by the abstraction, the verification is inconclusive and the abstraction needs to be refined so that a less conservative model can be checked. If the hybrid system does not satisfy the property, this verify–refine procedure usually will not terminate. This paper introduces the concept of strong negation for ACTL formulas as an auxiliary condition that can be verified to obtain a conclusive negative verification result from a finite-state abstraction in certain cases. The concepts are illustrated with an example from automotive powertrain control.

On ACTL Formulas Having Linear Counterexamples

In case an ACTL formula φ fails over a transition graph M, it is most useful to provide a counterexample, i.e., a computation tree of M, witnessing the failure. If there exists a single path in M which by itself witnesses the failure of φ, then φ has a linear counterexample. We show that, given M and φ, where M⊭φ, it is NP-hard to determine whether there exists a linear counterexample. Moreover, it is PSPACE-hard to decide whether an ACTL formula φ always admits a linear counterexample if it fails. This means that there exists no simple characterization of the ACTL formulas that guarantee linear counterexamples. Consequently, we study templates of ACTL formulas, i.e., skeletons of modal formulas whose atoms are disregarded. We identify the (unique) maximal set LIN of templates whose instances (obtained by replacing atoms with arbitrary pure state formulas) always guarantee linear counterexamples. We show that for each ACTL formula φ which is an instance of a template γ★∈LIN, and for each Kripke structure M such that M⊭φ, a single path of M witnessing the failure by itself can be computed in polynomial time.

Efficient Detection of Vacuity in Temporal Model Checking

The ability to generate a counter-example is an important feature of model checking tools, because a counter-example provides information to the user in the case that the formula being checked is found to be non-valid. In this paper, we turn our attention to providing similar feedback to the user in the case that the formula is found to be valid, because valid formulas can hide real problems in the model. For instance, propositional logic formulas containing implications can suffer from antecedent failure, in which the formula is trivially valid because the pre-condition of the implication is not satisfiable. We call this vacuity, and extend the definition to cover other kinds of trivial validity. For non-vacuously valid formulas, we define an interesting witness as a non-trivial example of the validity of the formula. We formalize the notions of vacuity and interesting witness, and show how to detect vacuity and generate interesting witnesses in temporal model checking. Finally, we provide a practical solution for a useful subset of ACTL formulas.

The Interval Domain: A Matchmaker for aCTL and aPCTL

We present aPCTL, a version of PCTL with an action-based semantics which coincides with the ordinary PCTL in case of a sole action type. We point out what aspects of aPCTL may be improved for its application as a probabilistic logic in a tool modeling large probabilistic system. We give a non-standard semantics to the action-based temporal logical aCTL, where the propositional clauses are interpreted in a fuzzy and the modalities in a probabilistic way; the until-construct is evaluated as a least fixed-point over these meanings. We view aCTL formulas ⊘ as templates for aPCTL formulas (which still need vectors of thresholds as annotations for all subformulas which are path formulas). Since [⊘]s, our non-standard meaning of ø at state s, is an interval [a, b], we may craft aPCTL formulas ø from using the information a and b respectively. This results in two aPCTL formulas ø and ø1. This translation defines a critical region of such thresholds for ⊘ in the following sense: if a > 0 then a satisfies the aPCTL formula ø1 dually, if b < 1 then s does not satisfy the formula ø1. Thus, any interesting probabilistic dynamics of aPCTL formulas with “pattern” ⊘ has to happen within the n-dimensional interval determined by out non-standard aCTL semantics [⊘].we would like to thank Martín Hötzel Escardó for suggesting to look at the interval domain at the LICS'97 meeting in Warsaw. He also pointed to work in his PhD thesis about the universality of I. we also acknowledge Marta Kwaitkowska, Christel Baier, Rance Cleaveland, and Scott Smolka for fruitful discussion on this subject matter.