Μ-calculus Research Articles

Formal Verification in a First-Order Extension of Modal μ-calculus

Formal Verification in a First-Order Extension of Modal μ-calculus

SWITCHING GRAPHS

Switching graphs are graphs that contain switches. A switch is a pair of edges that start in the same vertex and of which precisely one edge is enabled at any time. By using a Boolean function called a switch setting, the switches in a switching graph can be put in a fixed direction to obtain an ordinary graph. For many problems, switching graphs are a remarkable straightforward and natural model, but they have hardly been studied. We study the complexity of several natural questions in switching graphs of which some are polynomial, and others are NP-complete. We started investigating switching graphs because they turned out to be a natural framework for studying the problem of solving Boolean equation systems, which is equivalent to model checking of the modal µ-calculus and deciding the winner in parity games. We give direct, polynomial encodings of Boolean equation systems in switching graphs and vice versa, and prove correctness of the encodings.

On the Complexity of Semantic Self-minimization

Partial Kripke structures model only parts of a state space and so enable aggressive abstraction of systems prior to verifying them with respect to a formula of temporal logic. This partiality of models means that verifications may reply with true (all refinements satisfy the formula under check), false (no refinement satisfies the formula under check) or don't know . Generalized model checking is the most precise verification for such models (all don't know answers imply that some refinements satisfy the formula, some don't), but computationally expensive. A compositional model-checking algorithm for partial Kripke structures is efficient, sound (all answers true and false are truthful), but may lose precision by answering don't know instead of a factual true or false . Recent work has shown that such a loss of precision does not occur for this compositional algorithm for most practically relevant patterns of temporal logic formulas. Formulas that never lose precision in this manner are called semantically self-minimizing. In this paper we provide a systematic study of the complexity of deciding whether a formula of propositional logic, propositional modal logic or the propositional modal mu-calculus is semantically self-minimizing.

Using modal logics to express and check global graph properties

Graphs are among the most frequently used structures in Computer Science. Some of the properties that must be checked in many applications are connectivity, acyclicity and the Eulerian and Hamiltonian properties. In this work, we analyze how we can express these four properties with modal logics. This involves two issues: whether each of the modal languages under consideration has enough expressive power to describe these properties and how complex (computationally) it is to use these logics to actually test whether a given graph has some desired property. First, we show that these properties are not definable in a basic modal logic or in any bisimulation-invariant extension of it, like the modal μ-calculus. We then show that it is possible to express some of the above properties in a basic hybrid logic. Unfortunately, the Hamiltonian and Eulerian properties still cannot be efficiently checked. In a second attempt, we propose an extension of CTL∗ with nominals and show that the Hamiltonian property can be more efficiently checked in this logic than in the previous one. In a third attempt, we extend the basic hybrid logic with the ↓ operator and show that we can check the Hamiltonian property with optimal (NP) complexity in this logic. Finally, we tackle the Eulerian property in two different ways. First, we develop a generic method to express edge-related properties in hybrid logics and use it to express the Eulerian property. Second, we express a necessary and sufficient condition for the Eulerian property to hold using a graded modal logic.

Fixpoint Logics over Hierarchical Structures

Hierarchical graph definitions allow a modular description of graphs using modules for the specification of repeated substructures. Beside this modularity, hierarchical graph definitions also allow to specify graphs of exponential size using polynomial size descriptions. In many cases, this succinctness increases the computational complexity of decision problems. In this paper, the model-checking problem for the modal μ-calculus and (monadic) least fixpoint logic on hierarchically defined input graphs is investigated. In order to analyze the modal μ-calculus, parity games on hierarchically defined input graphs are investigated. Precise upper and lower complexity bounds are derived. A restriction on hierarchical graph definitions that leads to more efficient model-checking algorithms is presented.

Tool-supported enhancement of diagnosis in model-driven verification

We show on a case study from an autonomous aerospace context how to apply a game-based model-checking approach as a powerful technique for the verification, diagnosis, and adaptation of system behaviors based on temporal properties. This work is part of our contribution within the SHADOWS project, where we provide a number of enabling technologies for model-driven self-healing. We propose here to use GEAR, a game-based model checker, as a user-friendly tool that can offer automatic proofs of critical properties of such systems. Although it is a model checker for the full modal μ-calculus, it also supports derived, more user-oriented logics. With GEAR, designers and engineers can interactively investigate automatically generated winning strategies for the games, by this way exploring the connection between the property, the system, and the proof.

Model Checking Games for the Quantitative μ-Calculus

We investigate quantitative extensions of modal logic and the modal μ-calculus, and study the question whether the tight connection between logic and games can be lifted from the qualitative logics to their quantitative counterparts. It turns out that, if the quantitative μ-calculus is defined in an appropriate way respecting the duality properties between the logical operators, then its model checking problem can indeed be characterised by a quantitative variant of parity games. However, these quantitative games have quite different properties than their classical counterparts, in particular they are, in general, not positionally determined. The correspondence between the logic and the games goes both ways: the value of a formula on a quantitative transition system coincides with the value of the associated quantitative game, and conversely, the values of quantitative parity games are definable in the quantitative μ-calculus.

On Modal μ-Calculus and Gödel-Löb Logic

We show that the modal μ-calculus over GL collapses to the modal fragment by showing that the fixpoint formula is reached after two iterations and answer to a question posed by van Benthem in [4]. Further, we introduce the modal μ ~-calculus by allowing fixpoint constructors for any formula where the fixpoint variable appears guarded but not necessarily positive and show that this calculus over GL collapses to the modal fragment, too. The latter result allows us a new proof of the de Jongh, Sambin Theorem and provides a simple algorithm to construct the fixpoint formula.

Sequent Calculi for the Modal -Calculus over S5

We present two sequent calculi for the modal µ-calculus over S5 and prove their completeness by using classical methods. One sequent calculus has an analytical cut rule and could be used for a decision procedure the other uses a modified version of the induction rule.We also provide a completeness theorem for Kozen's Axiomatization over S5 without using the completeness result established byWalukiewicz for the modal µ-calculus over arbitrary models.

Types and higher-order recursion schemes for verification of higher-order programs

We propose a new verification method for temporal properties of higher-order functional programs, which takes advantage of Ong's recent result on the decidability of the model-checking problem for higher-order recursion schemes (HORS's). A program is transformed to an HORS that generates a tree representing all the possible event sequences of the program, and then the HORS is model-checked. Unlike most of the previous methods for verification of higher-order programs, our verification method is sound and complete. Moreover, this new verification framework allows a smooth integration of abstract model checking techniques into verification of higher-order programs. We also present a type-based verification algorithm for HORS's. The algorithm can deal with only a fragment of the properties expressed by modal mu-calculus, but the algorithm and its correctness proof are (arguably) much simpler than those of Ong's game-semantics-based algorithm. Moreover, while the HORS model checking problem is n-EXPTIME in general, our algorithm is linear in the size of HORS, under the assumption that the sizes of types and specification formulas are bounded by a constant.

Pre- and Post-Conditions Expressed in Variants of the Modal .MU.-Calculus

Properties of Kripke structures can be expressed by formulas of the modal µ-calculus. Despite its strong expressive power, the validity problem of the modal µ-calculus is decidable, and so are some of its variants enriched by inverse programs, graded modalities, and nominals. In this study, we show that the pre- and post-conditions of transformations of Kripke structures, such as addition/deletion of states and edges, can be expressed using variants of the modal µ-calculus. Combined with decision procedures we have developed for those variants, the properties of sequences of transformations on Kripke structures can be deduced. We show that these techniques can be used to verify the properties of pointer-manipulating programs.

Switching Graphs

Switching graphs are graphs containing switches. By using boolean functions called switch settings, these switches can be put in a fixed direction to obtain an ordinary graph. For many problems, switching graphs are a remarkable straightforward and natural model, but they have hardly been studied. We study the complexity of several natural questions in switching graphs of which some are polynomial, and others are NP-complete. We started investigating switching graphs because they turned out to be a natural framework for studying the problem of solving Boolean equation systems, which is equivalent to model checking of the modal μ-calculus and deciding the winner in parity games. We give direct, polynomial encodings of Boolean equation systems in switching graphs and vice versa, and prove correctness of the encodings.

A Multi-Core Solver for Parity Games

We describe a parallel algorithm for solving parity games, with applications in, e.g., modal μ-calculus model checking with arbitrary alternations, and (branching) bisimulation checking. The algorithm is based on Jurdzinski's Small Progress Measures. Actually, this is a class of algorithms, depending on a selection heuristics. Our algorithm operates lock-free, and mostly wait-free (except for infrequent termination detection), and thus allows maximum parallelism. Additionally, we conserve memory by avoiding storage of predecessor edges for the parity graph through strictly forward-looking heuristics. We evaluate our multi-core implementation's behaviour on parity games obtained from μ-calculus model checking problems for a set of communication protocols, randomly generated problem instances, and parametric problem instances from the literature.

On the Proof Theory of the Modal mu-Calculus

We study the proof-theoretic relationship between two deductive systems for the modal mu-calculus. First we recall an infinitary system which contains an omega rule allowing to derive the truth of a greatest fixed point from the truth of each of its (infinitely many) approximations. Then we recall a second infinitary calculus which is based on non-well-founded trees. In this system proofs are finitely branching but may contain infinite branches as long as some greatest fixed point is unfolded infinitely often along every branch. The main contribution of our paper is a translation from proofs in the first system to proofs in the second system. Completeness of the second system then follows from completeness of the first, and a new proof of the finite model property also follows as a corollary.

Modular Games for Coalgebraic Fixed Point Logics

We build on existing work on finitary modular coalgebraic logics [C. Cîrstea. A compositional approach to defining logics for coalgebras. Theoretical Computer Science, 327:45–69, 2004; C. Cîrstea and D. Pattinson. Modular construction of complete coalgebraic logics. Theoretical Computer Science, 388:83–108, 2007], which we extend with general fixed points, including CTL- and PDL-like fixed points, and modular evaluation games. These results are generalisations of their correspondents in the modal μ-calculus, as described e.g. in [C. Stirling. Modal and Temporal Properties of Processes. Springer, 2001]. Inspired by recent work of Venema [Y. Venema. Automata and fixed point logic: a coalgebraic perspective. Information and Computation, 204:637–678, 2006], we provide our logics with evaluation games that come equipped with a modular way of building the game boards. We also study a specific class of modular coalgebraic logics that allow for the introduction of an implicit negation operator.

Compositional verification of sequential programs with procedures

We present a method for algorithmic, compositional verification of control-flow-based safety properties of sequential programs with procedures. The application of the method involves three steps: (1) decomposing the desired global property into local properties of the components, (2) proving the correctness of the property decomposition by using a maximal model construction, and (3) verifying that the component implementations obey their local specifications. We consider safety properties of both the structure and the behaviour of program control flow. Our compositional verification method builds on a technique proposed by Grumberg and Long that uses maximal models to reduce compositional verification of finite-state parallel processes to standard model checking. We present a novel maximal model construction for the fragment of the modal μ-calculus with boxes and greatest fixed points only, and adapt it to control-flow graphs modelling components described in a sequential procedural language. We extend our verification method to programs with private procedures by defining an abstraction, presented as an inlining transformation. All algorithms have been implemented in a tool set automating all required verification steps. We validate our approach on an electronic purse case study.

Modal Expressiveness of Graph Properties

Graphs are among the most frequently used structures in Computer Science. In this work, we analyze how we can express some important graph properties such as connectivity, acyclicity and the Eulerian and Hamiltonian properties in a modal logic. First, we show that these graph properties are not definable in a basic modal language. Second, we discuss an extension of the basic modal language with fix-point operators, the modal μ-calculus. Unfortunately, even with all its expressive power, the μ-calculus fails to express these properties. This happens because μ-calculus formulas are invariant under bisimulations. Third, we show that it is possible to express some of the above properties in a basic hybrid logic. Fourth, we propose an extension of CTL* with nominals, that we call hybrid-CTL*, and then show that it can express the Hamiltonian property in a better way than the basic hybrid logic. Finally, we introduce a promising way of expressing properties related to edges and use it to express the Eulerian property.

Inf-datalog, Modal Logic and Complexities

Inf-Datalog extends the usual least fixpoint semantics of Datalog with greatest fixpoint semantics: we defined inf-Datalog and characterized the expressive power of various fragments of inf-Datalog in [CITE]. In the present paper, we study the complexity of query evaluation on finite models for (various fragments of) inf-Datalog. We deduce a unified and elementary proof that global model-checking (i.e. computing all nodes satisfying a formula in a given structure) has 1. quadratic data complexity in time and linear program complexity in space for CTL and alternation-free modal μ-calculus, and 2. linear-space (data and program) complexities, linear-time program complexity and polynomial-time data complexity for Lµk (modal μ-calculus with fixed alternation-depth at most k).

General Models and Completeness of First-Order Modal -calculus

There is no recursive axiomatization of first-order modal μ-calculus that is complete with respect to usual Kripke models. Then we introduce ‘general’ models, and we prove that the natural axiom system of first-order modal μ-calculus is complete with respect to general models.

Efficient static analysis of XML paths and types

We present an algorithm to solve XPath decision problems under regular tree type constraints and show its use to statically type-check XPath queries. To this end, we prove the decidability of a logic with converse for finite ordered trees whose time complexity is a simple exponential of the size of a formula. The logic corresponds to the alternation free modal μ-calculus without greatest fixpoint, restricted to finite trees, and where formulas are cycle-free. Our proof method is based on two auxiliary results. First, XML regular tree types and XPath expressions have a linear translation to cycle-free formulas. Second, the least and greatest fixpoints are equivalent for finite trees, hence the logic is closed under negation. Building on these results, we describe a practical, effective system for solving the satisfiability of a formula. The system has been experimented with some decision problems such as XPath emptiness, containment, overlap, and coverage, with or without type constraints. The benefit of the approach is that our system can be effectively used in static analyzers for programming languages manipulating both XPath expressions and XML type annotations (as input and output types).