Methodology and system for practical formal verification of reactive hardware

2009

Form Methods Syst Des

157

Liveness temporal properties state that something "good" eventually happens, e.g., every request is eventually granted. In Linear Temporal Logic (LTL), there is no a priori bound on the "wait time" for an eventuality to be fulfilled. That is, Fθ asserts that θ holds eventually, but there is no bound on the time when θ will hold. This is troubling, as designers tend to interpret an eventuality Fθ as an abstraction of a bounded eventuality F ≤k θ , for an unknown k, and satisfaction of a liveness property is often not acceptable unless we can bound its wait time. We introduce here PROMPT-LTL, an extension of LTL with the prompteventually operator F p . A system S satisfies a PROMPT-LTL formula ϕ if there is some bound k on the wait time for all prompt-eventually subformulas of ϕ in all computations of S. We study various problems related to PROMPT-LTL, including realizability, model checking, and assume-guarantee model checking, and show that they can be solved by techniques that are quite close to the standard techniques for LTL.

Section: Prompt Linear Temporal Logicmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

From liveness to promptness

Kupferman

Piterman

2009

Form Methods Syst Des

157

“…Temporal logic has led to the development of algorithmic methods for reasoning about reactive systems [CGP99]. In particular, temporal logic model checking enjoys a substantial and growing use in industrial applications [BBG¨94].…”

Section: ¢ ¥ ¤ ¦ ¡ § £mentioning

confidence: 99%

Extended Temporal Logic Revisited

Kupferman

Piterman

Lecture Notes in Computer Science

2001

Abstract.A key issue in the design of a model-checking tool is the choice of the formal language with which properties are specified. It is now recognized that a good language should extend linear temporal logic with the ability to specify all -regular properties. Also, designers, who are familiar with finite-state machines, prefer extensions based on automata than these based on fixed points or propositional quantification. Early extensions of linear temporal logic with automata use nondeterministic Büchi automata. Their drawback has been inability to refer to the past and the asymmetrical structure of nondeterministic automata. In this work we study an extension of linear temporal logic, called ETL © , that uses two-way alternating automata as temporal connectives. Two-way automata can traverse the input word back and forth and they are exponentially more succinct than one-way automata. Alternating automata combine existential and universal branching and they are exponentially more succinct than nondeterministic automata. The rich structure of two-way alternating automata makes ETL © a very powerful and convenient logic. We show that ETL © formulas can be translated to nondeterministic Büchi automata with an exponential blow up. It follows that the satisfiability and model-checking problems for ETL © are PSPACEcomplete, as are the ones for LTL and its earlier extensions with automata. So, in spite of the succinctness of two-way and alternating automata, the advantages of ETL © are obtained without a major increase in space complexity. The recent acceptance of alternating automata by the industry and the development of symbolic procedures for handling them make us optimistic about the practicality of ETL © .

“…This has given rise to formalisms in which the eventually operator F is replaced by a bounded-eventually operator F ≤k . The operator is parameterized by some k ≥ 0, and it bounds the wait time to k [8,33]. In the context of discrete-time systems, the operator F ≤k is simply syntactic sugar for an expression in which the next operator X is nested.…”

Section: Digression: What Is Linear Time Logic?mentioning

confidence: 99%

Branching vs. Linear Time: Semantical Perspective

Nain

Lecture Notes in Computer Science

Abstract. The discussion in the computer-science literature of the relative merits of linear-versus branching-time frameworks goes back to early 1980s. One of the beliefs dominating this discussion has been that the linear-time framework is not expressive enough semantically, making linear-time logics lacking in expressiveness. In this work we examine the branching-linear issue from the perspective of process equivalence, which is one of the most fundamental notions in concurrency theory, as defining a notion of process equivalence essentially amounts to defining semantics for processes. Over the last three decades numerous notions of process equivalence have been proposed. Researchers in this area do not anymore try to identify the "right" notion of equivalence. Rather, focus has shifted to providing taxonomic frameworks, such as "the linear-branching spectrum", for the many proposed notions and trying to determine suitability for different applications. We revisit this issue here from a fresh perspective. We postulate three principles that we view as fundamental to any discussion of process equivalence. First, we borrow from research in denotational semantics and take contextual equivalence as the primary notion of equivalence. This eliminates many testing scenarios as either too strong or too weak. Second, we require the description of a process to fully specify all relevant behavioral aspects of the process. Finally, we require observable process behavior to be reflected in its input/output behavior. Under these postulates the distinctions between the linear and branching semantics tend to evaporate. As an example, we apply these principles to the framework of transducers, a classical notion of state-based processes that dates back to the 1950s and is well suited to hardware modeling. We show that our postulates result in a unique notion of process equivalence, which is trace based, rather than tree based.