Automata-theoretic Approach Research Articles

Model checking distributed temporal logic

Abstract The distributed temporal logic (DTL) is a logic for reasoning about temporal properties of distributed systems from the local point of view of the system’s agents, which are assumed to execute sequentially and to interact by means of synchronous event sharing. Different versions of DTL have been provided over the years for a number of different applications, reflecting different perspectives on how non-local information can be accessed by each agent. In this paper, we propose an automata-theoretic model checking algorithm for DTL. To this end, we propose a notion of distributed transition system that will be used to specify the system to be verified. The properties that the system should meet are specified in DTL. In order to capture the models of these properties, we propose the notions of generalized distributed Büchi automaton and of distributed Büchi automaton. With these concepts, we are able to adapt results from automata-theoretic approaches to model checking in LTL to the distributed case.

An automata theoretic approach to observer design for switched linear systems

We present an approach for designing asymptotic observers for discrete-time switched linear systems. We first give an automata theoretic characterization of switching signals containing an infinite number of reconstructible sequences, i.e. sequences allowing to estimate the state of the system. We show that such switching signals can be generated by a deterministic Büchi automaton whose construction is given in the paper. Then, we present a methodology to design switched observers. These observers have an internal discrete state variable whose dynamics is given by the transition map of the Büchi automaton. We then present two approaches to design observer gains such that the observer is convergent for all switching signals whose occurrence rate of reconstructible sequences is higher than a tunable threshold. The first approach gives an explicit construction of the observer gains while the second one is based on linear matrix inequalities. For switched systems with invertible state matrices, we show that the proposed observer structure is universal in the sense that it is always possible to design an observer of the proposed form. We use a simple example to illustrate our methodology and then consider a case study in which we design an observer for a multicellular converter.

Context-aware environment online monitoring for safety autonomous vehicle systems: an automata-theoretic approach

Intelligent Transport System (ITS) is a typical class of Cyber-Physical Systems (CPS), and due to the special characteristics of such systems, higher requirements are placed on system security. Runtime verification is a lightweight verification technique which is used to improve the security of such systems. However, current runtime verification methods often ignore the effects of the physical environment (e.g., the effects of rain, snow, and other weather changes on road conditions), which results in the inability of the monitor to effectively monitor the system according to the changes in the environment. To address this problem, this paper proposes a method for constructing a runtime monitor with environmental context-awareness capability. First, the physical environment factors affecting the system are formally described and constructed into an environment model, then the system statute is transformed into a Büchi automaton, and then a synthesis algorithm combining the environment model and the Büchi automaton is designed based on the network of automatons, and the corresponding monitor is generated. Finally, the proposed method is applied and verified on simulation and real objects. The experimental results show that the monitors generated based on the method of this paper can effectively monitor unsafe events in different environments, thus improving the safety of intelligent driving systems.

Blockchain Based Auditable Access Control For Business Processes With Event Driven Policies.

The use of blockchain technology has been proposed to provide auditable access control for individual resources. Unlike the case where all resources are owned by a single organization, this work focuses on distributed applications such as business processes and distributed workflows. These applications are often composed of multiple resources/services that are subject to the security and access control policies of different organizational domains. Here, blockchains provide an attractive decentralized solution to provide auditability. However, the underlying access control policies may have event-driven constraints and can be overlapping in terms of the component conditions/rules as well as events. Existing work cannot handle event-driven constraints and does not sufficiently account for overlaps leading to significant overhead in terms of cost and computation time for evaluating authorizations over the blockchain. In this work, we propose an automata-theoretic approach for generating a cost-efficient composite access control policy. We reduce this composite policy generation problem to the standard weighted set cover problem. We show that the composite policy correctly captures all the local access control policies and reduces the policy evaluation cost over the blockchain. We have implemented the initial prototype of our approach using Ethereum as the underlying blockchain and empirically validated the effectiveness and efficiency of our approach. Ablation studies were conducted to determine the impact of changes in individual service policies on the overall cost.

Monitoring hybrid process specifications with conflict management: An automata-theoretic approach

Complexity of medical treatments can vary from prescribing medicine for a specific ailment to managing a complex set of simultaneous medical issues. In the latter case, doctors are assisted by clinical guidelines which outline standard medical procedures, tests, treatments, etc. To facilitate the use of such guidelines, they can be digitized as processes and adopted in complex process engines offering additional help to health providers such as decision support while monitoring active treatments so as to detect flaws in treatment procedures and suggest possible reactions on them. For example, a patient may present symptoms of multiple diseases simultaneously (requiring multiple clinical guidelines to be followed), while also being allergic to some often-used drugs (requiring additional constraints to be respected). This can easily lead to treating a patient based on a set of process specifications which are not fully compatible with each other. While a scenario like that commonly occurs in practice, research in that direction has thus far given little consideration to how to specify multiple clinical guidelines and how to automatically combine their specifications in the context of the monitoring task. In our previous work [2], we presented a conceptual framework for handling the above cases in the context of monitoring. In this paper, we present the algorithms necessary for implementing key components of this conceptual framework. More specifically, we provide formal languages for representing clinical guideline specifications and formalize a solution for monitoring the interplay of such specifications expressed as a combination of (data-aware) Petri nets and temporal logic rules. The proposed solution seamlessly handles combination of the input process specifications and provides both early conflict detection and decision support during process execution. We also discuss a proof-of-concept implementation of our approach and present the results of extensive scalability experiments.

Bounded model checking distributed temporal logic

Abstract The distributed temporal logic (DTL) is a logic for reasoning about temporal properties of distributed systems from the local point of view of the system’s agents, which are assumed to execute sequentially and to interact by means of synchronous event sharing. Different versions of DTL have been proposed over the years for a number of different applications, reflecting different perspectives on how non-local information can be accessed by each agent. In a recent paper, an automata-theoretic approach to model check DTL was proposed Subtil et al. (2020, Technical Report). Herein, we follow a different approach and adapt the bounded model-checking (BMC) algorithm for linear temporal logic to the case of DTL (see Biere et al. (2003, Adv. Comput., 58, 117–148) and Biere et al. (1999, TACAS 1999, 193–207)). For that purpose, a new notion of bounded semantics for DTL is proposed. In the BMC approach, the witness problem is translated to the satisfiability of a propositional formula that can be addressed (efficiently) by SAT solvers. An important application for this approach is verification of security protocols (Basin et al. (2011, Theoret. Comput. Sci., 412, 4007–4043); Caleiro et al. (2005, Electron. Notes Theor. Comput. Sci., 125, 67–89)).

Automata-Theoretic Approach to Verification of MPLS Networks Under Link Failures

Automata-Theoretic Approach to Verification of MPLS Networks Under Link Failures

Strategy Logic with Imperfect Information

We introduce an extension of Strategy Logic for the imperfect-information setting, called SL ii and study its model-checking problem. As this logic naturally captures multi-player games with imperfect information, this problem is undecidable; but we introduce a syntactical class of “hierarchical instances” for which, intuitively, as one goes down the syntactic tree of the formula, strategy quantifications are concerned with finer observations of the model, and we prove that model-checking SL ii restricted to hierarchical instances is decidable. This result, because it allows for complex patterns of existential and universal quantification on strategies, greatly generalises the decidability of distributed synthesis for systems with hierarchical information. It allows us to easily derive new decidability results concerning strategic problems under imperfect information such as the existence of Nash equilibria or rational synthesis. To establish this result, we go through an intermediary, “low-level” logic much more adapted to automata techniques. QCTL * is an extension of CTL * with second-order quantification over atomic propositions that has been used to study strategic logics with perfect information. We extend it to the imperfect information setting by parameterising second-order quantifiers with observations. The simple syntax of the resulting logic, QCTL * ii , allows us to provide a conceptually neat reduction of SL ii to QCTL * ii that separates concerns, allowing one to forget about strategies and players and focus solely on second-order quantification. While the model-checking problem of QCTL * ii is, in general, undecidable, we identify a syntactic fragment of hierarchical formulas and prove, using an automata-theoretic approach, that it is decidable.

Safety Verification of IEC 61131-3 Structured Text Programs

With the development of the industrial control system, programmable logic controllers (PLCs) are increasingly adopted in the process automation. Moreover, many PLCs play key roles in safety-critical systems, such as nuclear power plants, where robust and reliable control programs are required. To ensure the quality of programs, testing and verification methods are necessary. In this article, we present a novel methodology which applies model checking to verifying PLC programs. Specifically, we focus on the structured text (ST) language which is a widely used, high-level programming language defined in the electro-technical commission (IEC) 61131-3 standard. A formal model named behavior model (BM) is defined to specify the behavior of ST programs. An algorithm based on variable state analysis for automatically extracting the BM from an ST program is given. An algorithm based on the automata-theoretic approach is proposed to verify linear temporal logic properties on the BM. Finally, a real-life case study is presented.

LTL model checking for communicating concurrent programs

We present in this paper a new approach to the static analysis of concurrent programs with procedures. To this end, we model multi-threaded programs featuring recursive procedure calls and synchronization by rendezvous between parallel threads with communicating pushdown systems (from now on CPDSs). The reachability problem for this particular class of automata is unfortunately undecidable. However, it has been shown that an efficient abstraction of the execution traces language can nonetheless be computed. To this end, an algebraic framework to over-approximate context-free languages has been introduced by Bouajjani et al. In this paper, we combine this framework with an automata-theoretic approach in order to approximate an answer to the model checking problem of the linear-time temporal logic (from now on LTL) on CPDSs. We then present an algorithm that, given a single-indexed or stutter-invariant LTL formula, allows us to prove that no run of a CPDS verifies this formula if the procedure ends.

Multi-player games with LDL goals over finite traces

Linear Dynamic Logic on finite traces (LDLF) is a powerful logic for reasoning about the behaviour of concurrent and multi-agent systems. In this paper, we investigate techniques for both the characterisation and verification of equilibria in multi-player games with goals/objectives expressed using logics based on LDLF. This study builds upon a generalisation of Boolean games, a logic-based game model of multi-agent systems where players have goals succinctly represented in a logical way. Because LDLF goals are considered, in the settings we study—Reactive Modules games and iterated Boolean games with goals over finite traces—players' goals can be defined to be regular properties while achieved in a finite, but arbitrarily large, trace. In particular, using alternating automata, the paper investigates automata-theoretic approaches to the characterisation and verification of (pure strategy Nash) equilibria, shows that the set of Nash equilibria in multi-player games with LDLF objectives is regular, and provides complexity results for the associated automata constructions.

Practical synthesis of reactive systems from LTL specifications via parity games

The synthesis of reactive systems from linear temporal logic (LTL) specifications is an important aspect in the design of reliable software and hardware. We present our adaption of the classic automata-theoretic approach to LTL synthesis, implemented in the tool Strix which has won the two last synthesis competitions (Syntcomp2018/2019). The presented approach is (1) structured, meaning that the states used in the construction have a semantic structure that is exploited in several ways, it performs a (2) forward exploration such that it often constructs only a small subset of the reachable states, and it is (3) incremental in the sense that it reuses results from previous inconclusive solution attempts. Further, we present and study different guiding heuristics that determine where to expand the on-demand constructed arena. Moreover, we show several techniques for extracting an implementation (Mealy machine or circuit) from the witness of the tree-automaton emptiness check. Lastly, the chosen constructions use a symbolic representation of the transition functions to reduce runtime and memory consumption. We evaluate the proposed techniques on the Syntcomp2019 benchmark set and show in more detail how the proposed techniques compare to the techniques implemented in other leading LTL synthesis tools.

An Automata‐Theoretic Approach to L ‐valued Computation Tree Logic Model Checking

Translating computation tree logic formulas into Buchi tree automata has been proven to be an effective approach for implementing branching-time model checking. For a more generalized class of lattice-valued (L-valued, for short) computation tree logic formulas, the revelent study has not proceeded yet. We introduce the notion of L-valued alternating Buchi tree automata and achieve the goal of associating each L-valued computation tree logic formula with an L-valued Buchi tree automaton. We show that a satisfiability problem for an L-valued computation tree logic formula can be reduced to one for the language accepted by an L-valued Buchi tree automaton. L-valued alternating Buchi tree automata are the key to the automata-theoretic approach to L-valued computation tree logics, and we also study their expressive power and closure properties.

Model checking with generalized Rabin and Fin-less automata

In the automata theoretic approach to explicit state LTL model checking, the synchronized product of the model and an automaton that represents the negated formula is checked for emptiness. In practice, a (transition-based generalized) Büchi automaton (TGBA) is used for this procedure. This paper investigates whether using a more general form of acceptance, namely a transition-based generalized Rabin automaton (TGRA), improves the model checking procedure. TGRAs can have significantly fewer states than TGBAs; however, the corresponding emptiness checking procedure is more involved. With recent advances in probabilistic model checking and LTL to TGRA translators, it is only natural to ask whether checking a TGRA directly is more advantageous in practice. We designed a multi-core TGRA checking algorithm and performed experiments on a subset of the models and formulas from the 2015 Model Checking Contest and generated LTL formulas for models from the BEEM database. While we found little to no improvement by checking TGRAs directly, we show how various aspects of a TGRA’s structure influences the model checking performance. In this paper, we also introduce a Fin-less acceptance condition, which is a disjunction of TGBAs. We show how to convert TGRAs into automata with Fin-less acceptance and show how a TGBA emptiness procedure can be extended to check Fin-less automata.

Completeness for the modal μ-calculus: Separating the combinatorics from the dynamics

The modal mu-calculus is a very expressive formalism extending basic modal logic with least and greatest fixpoint operators. In the seminal paper introducing the formalism in the shape known today, Kozen also proposed an elegant axiom system, and he proved a partial completeness result with respect to the Kripke-style semantics of the logic. The problem of proving Kozen's axiom system complete for the full language remained open for about a decade, until it was finally resolved by Walukiewicz. In this paper we develop a framework that will let us clarify and simplify parts of Walukiewicz' proof.Our main contribution is to take the automata-theoretic viewpoint, already implicit in Walukiewicz' proof, much more seriously by bringing automata explicitly into the proof theory. Thus we further develop the theory of modal parity automata as a mathematical framework for proving results about the modal mu-calculus. Once the connection between automata and derivations is in place, large parts of the completeness proof can be reformulated as purely automata-theoretic theorems. From a conceptual viewpoint, our automata-theoretic approach lets us distinguish two key aspects of the mu-calculus: the one-step dynamics encoded by the modal operators, and the combinatorics involved in dealing with nested fixpoints. This “deconstruction” allows us to work with these two features in a largely independent manner.More in detail, prominent roles in our proof are played by two classes of modal automata: next to the disjunctive automata that are known from the work of Janin & Walukiewicz, we introduce here the class of semi-disjunctive automata that roughly correspond to the fragment of the mu-calculus for which Kozen proved completeness. We will establish a connection between the proof theory of Kozen's system, and two kinds of games involving modal automata: a satisfiability game involving a single modal automaton, and a consequence game relating two such automata. In the key observations on these games we bring the dynamics and combinatorics of parity automata together again, by proving some results that witness the nice behaviour of disjunctive and semi-disjunctive automata in these games. As our main result we prove that every formula of the modal mu-calculus provably implies the translation of a disjunctive automaton; from this the completeness of Kozen's axiomatization is immediate.

What is decidable about string constraints with the ReplaceAll function

The theory of strings with concatenation has been widely argued as the basis of constraint solving for verifying string-manipulating programs. However, this theory is far from adequate for expressing many string constraints that are also needed in practice; for example, the use of regular constraints (pattern matching against a regular expression), and the string-replace function (replacing either the first occurrence or all occurrences of a ``pattern'' string constant/variable/regular expression by a ``replacement'' string constant/variable), among many others. Both regular constraints and the string-replace function are crucial for such applications as analysis of JavaScript (or more generally HTML5 applications) against cross-site scripting (XSS) vulnerabilities, which motivates us to consider a richer class of string constraints. The importance of the string-replace function (especially the replace-all facility) is increasingly recognised, which can be witnessed by the incorporation of the function in the input languages of several string constraint solvers. Recently, it was shown that any theory of strings containing the string-replace function (even the most restricted version where pattern/replacement strings are both constant strings) becomes undecidable if we do not impose some kind of straight-line (aka acyclicity) restriction on the formulas. Despite this, the straight-line restriction is still practically sensible since this condition is typically met by string constraints that are generated by symbolic execution. In this paper, we provide the first systematic study of straight-line string constraints with the string-replace function and the regular constraints as the basic operations. We show that a large class of such constraints (i.e. when only a constant string or a regular expression is permitted in the pattern) is decidable. We note that the string-replace function, even under this restriction, is sufficiently powerful for expressing the concatenation operator and much more (e.g. extensions of regular expressions with string variables). This gives us the most expressive decidable logic containing concatenation, replace, and regular constraints under the same umbrella. Our decision procedure for the straight-line fragment follows an automata-theoretic approach, and is modular in the sense that the string-replace terms are removed one by one to generate more and more regular constraints, which can then be discharged by the state-of-the-art string constraint solvers. We also show that this fragment is, in a way, a maximal decidable subclass of the straight-line fragment with string-replace and regular constraints. To this end, we show undecidability results for the following two extensions: (1) variables are permitted in the pattern parameter of the replace function, (2) length constraints are permitted.

An automata-theoretic approach to the verification of distributed algorithms

We introduce an automata-theoretic method for the verification of distributed algorithms running on ring networks. In a distributed algorithm, an arbitrary number of processes cooperate to achieve a common goal (e.g., elect a leader). Processes have unique identifiers (pids) from an infinite, totally ordered domain. An algorithm proceeds in synchronous rounds, which allow processes to exchange pids, store them in registers, and compare their register contents. To specify correctness properties, we introduce a logic that can reason about processes and pids. We show that model checking distributed algorithms can be reduced to satisfiability in propositional dynamic logic with loop and converse. Using this reduction, we provide an automata-theoretic approach to proving distributed algorithms correct up to a given number of rounds. Overall, we show that round-bounded verification of distributed algorithms over rings is PSPACE-complete, provided the number of rounds is given in unary.

On the Complexity of ATL and ATL* Module Checking

Module checking has been introduced in late 1990s to verify open systems, i.e., systems whose behavior depends on the continuous interaction with the environment. Classically, module checking has been investigated with respect to specifications given as CTL and CTL* formulas. Recently, it has been shown that CTL (resp., CTL*) module checking offers a distinctly different perspective from the better-known problem of ATL (resp., ATL*) model checking. In particular, ATL (resp., ATL*) module checking strictly enhances the expressiveness of both CTL (resp., CTL*) module checking and ATL (resp. ATL*) model checking. In this paper, we provide asymptotically optimal bounds on the computational cost of module checking against ATL and ATL*, whose upper bounds are based on an automata-theoretic approach. We show that module-checking for ATL is EXPTIME-complete, which is the same complexity of module checking against CTL. On the other hand, ATL* module checking turns out to be 3EXPTIME-complete, hence exponentially harder than CTL* module checking.

On the complexity of ω-pushdown automata

Finite automata over infinite words (called $\omega$-automata) play an important role in the automata-theoretic approach to system verification.Different types of $\omega$-automata differ in their succinctness and complexity of their emptiness problems, as a result, theory of $\omega$-automata hasreceived considerable research attention. Pushdown automata over infinite words (called $\omega$-PDAs), a generalization of $\omega$-automata, are a naturalmodel of recursive programs. Our goal in this paper is to conduct a relatively complete investigation on the complexity of the emptiness problems for variantsof $\omega$-PDAs. For this purpose, we consider $\omega$-PDAs of five standard acceptance types: Buchi, Parity, Rabin, Streett and Muller acceptances.Based on the transformation for $\omega$-automata and the efficient algorithm proposed by Esparza et al. in CAV00 for verifying the emptiness problem of $\omega$-PDAswith Buchi acceptance, it is trivial to check the emptiness problem of other $\omega$-PDAs. However, this naive approach is not optimal. In this paper,we propose novel algorithms for the emptiness problem of $\omega$-PDAs based on the observations of the structure of accepting runs. Our algorithms outperform algorithmsthat go through Buchi PDAs. In particular, the space complexity of the algorithm for Streett acceptance that goes through Buchi acceptance is exponential,while ours is polynomial. The algorithm for Parity acceptance that goes through Buchi acceptance is in ${\boldsymbol O}(k^3n^2m)$ time and ${\boldsymbol O}(k^2nm)$ space,while ours is in ${\boldsymbol O}(kn^2m)$ time and ${\boldsymbol O}(nm)$ space, where $n$ (resp. $m$ and $k$) is the number of control states (resp. transitions and index).Finally, we show that our algorithms yield a better solution for the pushdown model checking problem against linear temporal logic with fairness.

Information rate of some classes of non-regular languages: An automata-theoretic approach

We show that the information rate of the language accepted by a reversal-bounded deterministic counter machine is computable. For the nondeterministic case, we provide computable upper bounds. For the class of languages accepted by multi-tape deterministic finite automata, the information rate is computable as well.