Μ-calculus Research Articles

A Game-Based Axiomatization of μ-Calculus

A Game-Based Axiomatization of μ-Calculus

A system for the static analysis of XPath

XPath is the standard language for navigating XML documents and returning a set of matching nodes. We present a sound and complete decision procedure for containment of XPath queries, as well as other related XPath decision problems such as satisfiability, equivalence, overlap, and coverage. The considered XPath fragment covers most of the language features used in practice. Specifically, we propose a unifying logic for XML, namely, the alternation-free modal μ-calculus with converse. We show how to translate major XML concepts such as XPath and regular XML types (including DTDs) into this logic. Based on these embeddings, we show how XPath decision problems, in the presence or absence of XML types, can be solved using a decision procedure for μ-calculus satisfiability. We provide a complexity analysis of our system together with practical experiments to illustrate the efficiency of the approach for realistic scenarios.

Automata Games for Multiple-model Checking

3-valued models have been advocated as a means of system abstraction such that verifications and refutations of temporal-logic properties transfer from abstract models to the systems they represent. Some application domains, however, require multiple models of a concrete or virtual system. We build the mathematical foundations for 3-valued property verification and refutation applied to sets of common concretizations of finitely many models. We show that validity checking for the modal mu-calculus has the same cost (EXPTIME-complete) on such sets as on all 2-valued models, provide an efficient algorithm for checking whether common concretizations exist for a fixed number of models, and propose using parity games on variants of tree automata to efficiently approximate validity checks of multiple models. We prove that the universal topological model in [M. Huth, R. Jagadeesan, and D. A. Schmidt. A domain equation for refinement of partial systems. Mathematical Structures in Computer Science, 14(4):469–505, 5 August 2004] is not bounded complete. This confirms that the approximations aforementioned are reasonably precise only for tree-automata-like models, unless all models are assumed to be deterministic.

π-AAL

A key aspect of the design of any software system is its architecture. An architecture description, from a runtime perspective, provides a formal representation of the architecture in terms of its components and connectors, their ports and behaviours, and how they are composed together. In the past decade, several Architecture Description Languages (ADLs) have been defined for representing the structure and behaviour of software architectures. However, describing the structure and behaviour of an architecture in terms of a configuration of components and connectors is needed, but it is not enough. Indeed, in addition to representing software architectures, we need to rigorously specify their required and desired architectural properties, in particular related to completeness, consistency and correctness. This article presents π-AAL, a novel Architecture Analysis Language (AAL) that has been designed in the ArchWare European Project to address formal analysis of software architectures. It is a formal, well-founded theoretically language based on the modal μ-calculus designed to enable the specification of structural and behavioural properties and their verification using an analytical toolset based on theorem proving and model checking techniques.

A fixpoint calculus for local and global program flows

We define a new fixpoint modal logic, the visibly pushdown μ-calculus (VP-μ), as an extension of the modal μ-calculus. The models of this logic are execution trees of structured programs where the procedure calls and returns are made visible. This new logic can express pushdown specifications on the model that its classical counterpart cannot, and is motivated by recent work on visibly pushdown languages [4]. We show that our logic naturally captures several interesting program specifications in program verification and dataflow analysis. This includes a variety of program specifications such as computing combinations of local and global program flows, pre/post conditions of procedures, security properties involving the context stack, and interprocedural dataflow analysis properties. The logic can capture flow-sensitive and inter-procedural analysis, and it has constructs that allow skipping procedure calls so that local flows in a procedure can also be tracked. The logic generalizes the semantics of the modal μ-calculus by considering summaries instead of nodes as first-class objects, with appropriate constructs for concatenating summaries, and naturally captures the way in which pushdown models are model-checked. The main result of the paper is that the model-checking problem for VP-μ is effectively solvable against pushdown models with no more effort than that required for weaker logics such as CTL. We also investigate the expressive power of the logic VP-μ: we show that it encompasses all properties expressed by a corresponding pushdown temporal logic on linear structures ( caret [2]) as well as by the classical μ-calculus. This makes VP-μ the most expressive known program logic for which algorithmic software model checking is feasible. In fact, the decidability of most known program logics (μ-calculus, temporal logics LTL and CTL, caret , etc.) can be understood by their interpretation in the monadic second-order logic over trees. This is not true for the logic VP-μ, making it a new powerful tractable program logic.

Compositional analysis for verification of parameterized systems

Many safety-critical systems that have been considered by the verification community are parameterized by the number of concurrent components in the system, and hence describe an infinite family of systems. Traditional model checking techniques can only be used to verify specific instances of this family. In this paper, we present a technique based on compositional model checking and program analysis for automatic verification of infinite families of systems. The technique views a parameterized system as an expression in a process algebra (CCS) and interprets this expression over a domain of formulas (modal mu-calculus), considering a process as a property transformer. The transformers are constructed using partial model checking techniques. At its core, our technique solves the verification problem by finding the limit of a chain of formulas. We present a widening operation to find such a limit for properties expressible in a subset of modal mu-calculus. We describe the verification of a number of parameterized systems using our technique to demonstrate its utility.

CAESAR_SOLVE: A generic library for on-the-fly resolution of alternation-free Boolean equation systems

Boolean equation systems (Bess) provide a useful framework for modeling various verification problems on finite-state concurrent systems, such as equivalence checking and model checking. These problems can be solved on the fly (i.e., without constructing explicitly the state space of the system under analysis) by using a demand-driven construction and resolution of the corresponding Bes. In this article, we present a generic software library dedicated to on-the-fly resolution of alternation-free Bess. Four resolution algorithms are currently provided by the library: algorithms A1 and A2 are general, the latter being optimized to produce small-depth diagnostics, whereas algorithms A3 and A4 are specialized for handling acyclic and disjunctive/conjunctive Bess in a memory-efficient way. The library has been developed within the Cadp verification toolbox using the generic Open/Caesar environment and is currently used for three purposes: on-the-fly equivalence checking modulo five widely used equivalence relations, on-the-fly model checking of regular alternation-free modal μ-calculus, and on-the-fly reduction of state spaces based on τ-confluence .

Probabilistic temporal logics via the modal mu-calculus

This paper presents a mu-calculus-based modal logic for describing properties of reactive probabilistic labeled transition systems (RPLTSs) and develops a model-checking algorithm for determining whether or not states in finite-state RPLTSs satisfy formulas in the logic. The logic is based on the distinction between (probabilistic) “systems” and (nonprobabilistic) “observations”: using the modal mu-calculus, one may specify sets of observations, and the semantics of our logic then enable statements to be made about the measures of such sets at various system states. The logic may be used to encode a variety of probabilistic modal and temporal logics; in addition, the model-checking problem for it may be reduced to the calculation of solutions to systems of non-linear equations. Finally, the logic induces an equivalence on RPLTSs that coincides with accepted notions of probabilistic bisimulation in the literature.

On Modal μ-Calculus and Non-Well-Founded Set Theory

A finitary characterization for non-well-founded sets with finite transitive closure is established in terms of a greatest fixpoint formula of the modal μ-calculus. This generalizes the standard result in the literature where a finitary modal characterization is provided only for wellfounded sets with finite transitive closure. The proof relies on the concept of automaton, leading then to new interlinks between automata theory and non-well-founded sets.

An optimizing compiler for batches of temporal logic formulas

Model checking based on validating temporal logic formulas has proven practical and effective for numerous software engineering applications. As systems based on this approach have become more mainstream, a need has arisen to deal effectively with large batches of formulas over a common model. Presently, most systems validate formulas one at a time, with little or no interaction between validation of separate formulas. This is the case despite the fact that, for a wide range of applications, a certain level of redundancy between domain-related formulas can be anticipated.This paper presents an optimizing compiler for batches of temporal logic formulas. A component of the Carnauba model checking system, this compiler addresses the need to handle batches of temporal logic formulas by leveraging the framework common to optimizing programming language compilers. Just as traditional optimizing compilers attempt to exploit redundancy and other solvable properties in a program to reduce the demand on a runtime system, this compiler exploits similar properties in groups of formulas to reduce the demand on a model checking engine. Optimizations are performed via a set of distinct, interchangeable optimization passes operating on a common intermediate representation. The intermediate representation captures the full modal mu-calculus, and the optimization techniques are applicable to any temporal logic subsumed by that logic. The compiler offers a unified framework for expressing some well understood single-formula optimizations as well as numerous inter-formula optimizations that capitalize on redundancy, logical implication, and, optionally, model-specific knowledge. It is capable of working either in place of, or as a preprocessor for, other optimization algorithms. The result is a system that, when applied to a potentially heterogeneous collection of formulas over a common problem domain, is able to measurably reduce the time and space requirements of the subsequent model checking engine.

Towards the hierarchical verification of reactive systems

The hierarchical design approach for action based systems that is known as action refinement has been studied in the literature extensively. In a paper of M. Huhn published in CONCUR 1996 a refinement operator on a linear time logic is presented that mimics precisely a semantic action refinement on synchronisation structures. We present here an alternative approach where our starting point is a process algebraic setting with a syntactic action refinement. We present a refinement operator on the Modal Mu-calculus that conforms with the process algebraic refinement in the following sense: Provided some reasonable conditions are met, the transition system induced by a process term P satisfies a Modal Mu-Calculus-specification ϕ if and only if the system which is induced by a refinement of P satisfies a particular refinement of ϕ . Alleviating these conditions, we show that each of the two implications in the equivalence assertion above can be separately proven valid for a particular fragment of the Modal Mu-calculus. We demonstrate that the obtained results can indeed be used as a hierarchical verification technique. As a further application of our results, we explain how they can be employed as an abstraction technique in order to enhance model checking techniques.

Inflationary fixed points in modal logic

We consider an extension of modal logic with an operator for constructing inflationary fixed points, just as the modal μ-calculus extends basic modal logic with an operator for least fixed points. Least and inflationary fixed-point operators have been studied and compared in other contexts, particularly in finite model theory, where it is known that the logics IFP and LFP that result from adding such fixed-point operators to first-order logic have equal expressive power. As we show, the situation in modal logic is quite different, as the modal iteration calculus (MIC), we introduce has much greater expressive power than the μ-calculus. Greater expressive power comes at a cost: the calculus is algorithmically much less manageable.

An intensional fixed point theory over first order arithmetic

The purpose of this article is to present a new theory IPA(σ) for fixed points over arithmetic which allows the building up of fixed points in a very nested and entangled way. But in spite of its great expressive power we can show that the proof-theoretic strength of our theory—which is intensional in a meaning to be described below—is characterized by the Feferman–Schütte ordinal Γ 0. Our approach is similar to the building up of fixed points over state spaces in the propositional modal μ-calculus.

Towards the hierarchical verification of reactive systems

The hierarchical design approach for action based systems that is known as action refinement has been studied in the literature extensively. In a paper of M. Huhn published in CONCUR 1996 a refinement operator on a linear time logic is presented that mimics precisely a semantic action refinement on synchronisation structures. We present here an alternative approach where our starting point is a process algebraic setting with a syntactic action refinement. We present a refinement operator on the Modal Mu-calculus that conforms with the process algebraic refinement in the following sense: Provided some reasonable conditions are met, the transition system induced by a process term P satisfies a Modal Mu-Calculus-specification ϕ if and only if the system which is induced by a refinement of P satisfies a particular refinement of ϕ. Alleviating these conditions, we show that each of the two implications in the equivalence assertion above can be separately proven valid for a particular fragment of the Modal Mu-calculus. We demonstrate that the obtained results can indeed be used as a hierarchical verification technique. As a further application of our results, we explain how they can be employed as an abstraction technique in order to enhance model checking techniques.

On temporal logic versus datalog

We provide a direct and modular translation from the temporal logics CTL, ETL, FCTL (CTL extended with the ability to express fairness) and the Modal μ-calculus to Monadic inf-Datalog with built-in predicates. We call it inf-Datalog because the semantics we provide is a little different from the conventional Datalog least fixed point semantics, in that some recursive rules (corresponding to least fixed points) are allowed to unfold only finitely many times, whereas others (corresponding to greatest fixed points) are allowed to unfold infinitely many times. We characterize the fragments of Monadic inf-Datalog that have the same expressive power as Modal Logic (resp. CTL, alternation-free Modal μ-calculus and Modal μ-calculus). Our translation is interesting because it is direct and succinct. Moreover the fragments of Monadic inf-Datalog that we have exhibited have very simple syntactic characterizations as subsets of what we call Modal inf-Datalog programs.

Games for synthesis of controllers with partial observation

The synthesis of controllers for discrete event systems, as introduced by Ramadge and Wonham, amounts to computing winning strategies in parity games. We show that in this framework it is possible to extend the specifications of the supervised systems as well as the constraints on the controllers by expressing them in the modal μ-calculus. In order to express unobservability constraints, we propose an extension of the modal μ-calculus in which one can specify whether an edge of a graph is a loop. This extended μ-calculus still has the interesting properties of the classical one. In particular it is equivalent to automata with loop testing. The problems such as emptiness testing and elimination of alternation are solvable for such automata. The method proposed in this paper to solve a control problem consists in transforming this problem into a problem of satisfiability of a μ-calculus formula so that the set of models of this formula is exactly the set of controllers that solve the problem. This transformation relies on a simple construction of the quotient of automata with loop testing by a deterministic transition system. This is enough to deal with centralized control problems. The solution of decentralized control problems uses a more involved construction of the quotient of two automata. This work extends the framework of Ramadge and Wonham in two directions. We consider infinite behaviours and arbitrary regular specifications, while the standard framework deals only with specifications on the set of finite paths of processes. We also allow dynamic changes of the sets of observable and controllable events.

On the equational definition of the least prefixed point

We propose a method to axiomatize by equations the least prefixed point of an order preserving function. We discuss its domain of application and show that the Boolean modal μ-calculus has a complete equational axiomatization. The method relies on the existence of a “closed structure” and its relationship to the equational axiomatization of Action Logic is made explicit. The implication operation of a closed structure is not monotonic in one of its variables; we show that the existence of such a term that does not preserve the order is an essential condition for defining by equations the least prefixed point. We stress the interplay between closed structures and fixed point operators by showing that the theory of Boolean modal μ-algebras is not a conservative extension of the theory of modal μ-algebras. The latter is shown to lack the finite model property.

Almost-certain eventualities and abstract probabilities in the quantitative temporal logic qTL

‘Almost-certain eventualities’ are liveness properties that hold with probability 1. ‘Abstract probabilities’ in transition systems are those known only to be bounded away from zero and one. Vardi (Proceedings of the 26th IEEE Symposium on Foundations of Computer Science, Portland, 1985, p. 327) showed that almost-certain properties in linear temporal logic depend only on abstract probabilities rather than on the probabilities’ precise values. We discuss the extent to which a similar result holds in the quantitative temporal logic qTL derived from the quantitative modal μ-calculus qMμ (Proceedings the Formal Methods Pacific ’97, Springer, Singapore, 1997, also available http://web.comlab.ox.ac.uk/oucl/research/areas/probs/bibliography.html; logic J, IGPL 7(6) (1999) 779, http://www3.oup.co.uk/igp1/Volume_07/Issue_06, http://web.comlab.ox.ac.uk/oucl/research/areas/probs/bibliography.html), and we show how to specialise the logic to these cases. The aim is to provide a simpler calculus than the full logic, one that is in a certain sense complete for proving almost-certain eventualities from abstract-probabilistic assumptions. We conclude by considering the complexity of the specialised logic.

Game Logic is Strong Enough for Parity Games

We investigate the expressive power of Parikh's Game Logic interpreted in Kripke structures, and show that the syntactical alternation hierarchy of this logic is strict. This is done by encoding the winning condition for parity games of rank n. It follows that Game Logic is not captured by any finite level of the modal μ-calculus alternation hierarchy. Moreover, we can conclude that model checking for the μ-calculus is efficiently solvable iff this is possible for Game Logic

The finite graph problem for two-way alternating automata

Two-way alternating automata on infinite trees were introduced by Vardi (Reasoning about the part with two way automata, Lecture Notes in Computer Science, vol. 11, Springer, Berlin, 1998, pp. 628–641). Here we consider alternating two-way automata on graphs and show the decidability of the following problem: “does a given automaton with the Büchi condition accept any finite graph?” Using this result we demonstrate the decidability of the finite model problem for a certain fragment of the modal μ-calculus with backward modalities.