A Game Based Approach to CTL* Model Checking

We introduce a definition of model checking games for the full branching time logic CTL∗ and sketch a proof of their correctness. These games are a helpful technique for using model checking in the verification of concurrent systems, because they may not only show that a specified property is violated, but also why it is. 1 Verification of Concurrent Systems Mathematically, model checking is the process of deciding whether a structure as an interpretation satisfies a formula. This makes it a useful and broadly accepted technique for verifying parallel processes. However, verification of concurrent systems is often done in combination with specification in the framework of developing them. For such a process a simple yes/no answer, that a model checking algorithm usually yields, is not sufficient. Moreover, techniques that show why or where a certain property is violated, are required. 2 The Game Based Approach Model checking games being played by two players on the structure and the formula provide the feature that has been outlined in the first section. Answering the question about the property being fulfilled turns out to be equivalent to finding a winning strategy for one of the players. Once such a strategy is found, i.e. computed by a verification tool for example, it can be used to enable an interactive play between the tool and the developer. In this case we will deal with transition systems and the full branching time logic CTL [2] only, although there are other models for concurrency, too. CTL subsumes other temporal logics like LTL [5] and CTL [1] syntactically, and thus the results on the games for CTL easily carry over to these other logics as well. On the other hand, CTL can be translated into the modal μ-calculus [3], for which such model checking games already exist [6]. However, using those games for checking properties being specified in CTL exhibits a major disadvantage. The play does not proceed on subformulas of the original formula. That makes it hard to understand why a certain property is violated. After recalling the syntax and semantics of CTL, we will give a definition of how model checking games for CTL may look like. The first goal is to prove their correctness, i.e. to show that the mentioned equivalence between winning strategies on the games’ side and the satisfaction on the logical side really holds. The proof of this theorem is expected to be constructive, so that it already sketches an algorithm for deciding the model checking problem. The algorithm ought to be local, i.e. it must be possible to expand the transition system step by step throughout the model checking process. Its time complexity is expected to be exponential, for the problem was shown to be PSPACE-complete [4]. The desired interactive games that can be played by a verification tool and its user usually rely on the data structures that were used by the model checking algorithm. In this case playing means following a path through a graph, following the game rules and a winning strategy. Yet it is not known whether the strategies for these games are history free or not. There is a fairly simple way of defining games for CTL following exactly the semantics. This would involve players to choose whole paths in the transition system which contradicts the locality and would result in a horrendous space complexity as well. Hence, another requirement to the games is the ability to choose paths stepwise. Indeed, we will call this the main requirement. 3 Model Checking Games for CTL Let Prop = {tt, ff, Q1, Q1, . } be a set of propositional constants. A transition system T is a triple (S, T, L) with (S, T ) being a directed graph. L : S → 2 labels the states, such that for all s ∈ S: tt ∈ L(s), ff 6∈ L(s) and Q ∈ L(s) iff Q 6∈ L(s). We assume that every state in the graph has a successor. The syntax of CTL is defined by φ ::= Q | φ ∧ φ | φ ∨ φ | Xφ | φUφ | φRφ | Eφ | Aφ where Q ranges over Prop. The set of subformulas Sub(φ) for a given φ is defined in the usual way. Additionally, X(φUψ), φ∧X(φUψ), ψ∨(φ∧X(φUψ)) are subformulas of φUψ, too. Similarily,X(φRψ), φ∨X(φRψ), ψ∧(φ∨X(φRψ)) are subformulas of φRψ as well. The semantics of a CTL formula is explained using paths π = s0s1 . sn . of a transition system. With π we denote the suffix of π beginning with the the state si.