Vacuity in practice: temporal antecedent failure

Abstract

Different definitions of vacuity in temporal logic model checking have been suggested along the years. Examining them closely, however, reveals an interesting phenomenon. On the one hand, some of the definitions require high-complexity vacuity detection algorithms. On the other hand, studies in the literature report that not all vacuities detected in practical applications are considered a problem by the system verifier. This brings vacuity detection into an undesirable situation where the user of the model checking tool may find herself waiting a long time for results that are of no interest for her. In this paper we restrict our attention to practical usage of vacuity detection. We define Temporal Antecedent Failure, an extension of antecedent failure to temporal logic, which refines the notion of vacuity. According to our experience, this type of vacuity always indicates a problem in the model, environment or property. We show how vacuity information can be derived from the automaton built for the original property, and we introduce the notion of vacuity explanation. Our experiments demonstrate that this type of vacuity as well as its reasons can be computed with a negligible increase in the overall runtime.Shoham Ben-David is grateful to the Azrieli Foundation for the award of an Azrieli Fellowship.

Foundations of Fine-Grained Explainability

“…On the contrary, is there a part of the input that never explains the production of the output, regardless of the input? This latter question could shed a different light on an existing notion called vacuity [6], expressed not in terms of elements of the specification, but on the parts of the input it is evaluated on. More generally, explainability can be viewed as a particular form of static analysis for functions; it would therefore be interesting to recast our model in the abstract interpretation framework [35,39] in order to further assess its strengths and weaknesses.…”

“…Triangle Areas. Given a list of arbitrary vectors, this task checks that each vector contains the lengths of the three sides of a valid triangle; if so, it computes their area using Heron's formula 6 and sums the area of all valid triangles. It was chosen because it involves multiple if-then-else cases to verify the sides of a triangle.…”

Formal Requirement Debugging for Testing and Verification of Cyber-Physical Systems

“…In the following, we consider the redundancy removal algorithm provided in [14] for LTL formulas and we extend it to support MITL formulas. 10] p. This method can detect both issues and report them to the user. Algorithm 3 finds redundant conjuncts in the conjunction operation of the following levels:…”

“…It has been proven in [11] that CLTLoc is equivalent to timed automata [16]. Moreover, it can be polynomially reduced to decidable Satisfiability Modulo Theories which are solvable by many SMT solvers such as Z3 10 . The satisfiability of CLTLoc is PSPACE-complete [13] and the translation from MITL to CLTLoc in the worst case can be exponential [12].…”

“…The simulation time for the system is set to 30 seconds; therefore, we can use bounded MITL formulas for the requirements. If the ω is always less than 4500, then the v can not 2 [0,30] (ω ≤ 4500) ⇒ 2 [0,10] (v ≤ 85) exceed 85 in less than 10 sec. φ AT 4 Within 10 sec.…”