FaieA

(1)

Alexandre Duret-Lutz

avril 2009

(2)

Hypotheseson the system to verify.

Youmay onsider fairness hypothesis anytime you have to deal

with a repeated hoie.

Messagessentover alossyhannel willbe deliveredafteranite

numberof retries(therepeatedhoie iswhether the hannel

willlosethe message)

Starvation-free resoure alloator: anybodyrequestingthe

resoure eventually getsit.

Two independent proessesrunningon the same hostgetarun

slie innitelyoften(therepeated hoieis doneby the

(3)

These hypotheses an beseen as onstraints for the emptiness hek.

Iftwo independent proesses running onthe same host shouldget a

runslie innitely often:

Wewanta ounterexamplewhere both proesses are progressing

innitelyoften.

Wean ignoreruns where one proess is stuk.

Do we reallyneed to modifythe emptiness hek algorithm?

(4)

To hekproposition prop underhypothesis fairness

we hekfairness

→

^prop.

(5)

we hekfairness

→

^prop.

A

^M

⊗ A ^¬ (

^fairness

→

prop

)

(6)

we hekfairness

→

^prop.

A

^M

⊗ A ^¬ (

^fairness

→

prop

)

A

^M

⊗ A

^fairness

^∧¬

^prop

A

^M

⊗ A

^fairness

⊗ A ^¬

^prop

(7)

unonditionalfairness Something will happen innitely often.

weak fairness If something happens ontinuously, something else will

happen innitely often.

strongfairness If something happens innitelyoften, something else

will happeninnitely often.

(8)

unonditionalfairness Something will happen innitely often. GFp

happen innitely often.

(9)

happen innitely often. FGe

→

^G^F^e

^′

(10)

→

^G^F^e

^′

will happeninnitely often. GFe

→

^G^F^e

^′

(11)

→

^G^F^e

^′

will happeninnitely often. GFe

→

^G^F^e

^′

Wehave

FGe

→

^G^F^e

^′ = ¬

^F^G^e

∨

^G^F^e

^′

=

^G^F

¬

^e

∨

^G^F^e

^′

=

^G^F

(¬

^e

∨

^e

^′ )

therefore weak fairness an beexpressed as unonditionalfairness.

(12)

fairness

Wemay want to applyseveral fairness hypotheses.

weak fairness strong fairness

n

V

ⁿ

i

=

¹^G^F

(¬

^enⁱ

∨

^oⁱ

) V

ⁿ

i

=

¹^G^F^enⁱ

→

^G^F^oⁱ

1 1 state 4 states

2 1 state 10states

3 1 state 28states

4 1 state 82states

.

(13)

Look of A

GF

(¬

^en

∨

^o

)

¬

^en

∨

^o ^en

∧ ¬

^o

Bühiaeptane onditions orrespond to formulæsuh as GFa.

(14)

Look of A

GF

(¬

^en

∨

^o

)

¬

^en

∨

^o ^en

∧ ¬

^o

Bühiaeptane onditions orrespond to formulæsuh as GFa.

A

M

⊗

^A^fairness

⊗

^A

^¬

^prop

(15)

Look of A

GFen

→

^G^F^o

¬

^en

o

¬

^en

⊤ ⊤

⊤

¬

^o o

¬

^en

¬

^en

⊤

¬

^en

¬

^o o

Note: Idon't know of anyLTLtranslator whois able to reate the

leftautomaton!

Withn fairness hypotheses, the left automatonreahes 3 n

states and

the right automatonreahes 3

n

+

¹^states.

(16)

fairness

Weakfairness:

V

ⁿ

i

=

¹^G^F

(¬

^enⁱ

∨

^oⁱ

)

Strongfairness:

V

ⁿ

i

=

¹^G^F^enⁱ

→

^G^F^oⁱ

(17)

fairness

Weakfairness:

V

ⁿ

i

=

¹^G^F

(¬

^enⁱ

∨

^oⁱ

)

GeneralizedBühi automataalways1 state,deterministi.

Weakfairness omesforfree ifyou haveageneralizedemptiness

hekforgeneralizedBühiautomata.

Strongfairness:

V

ⁿ

i

=

¹^G^F^enⁱ

→

^G^F^oⁱ

(18)

fairness

Weakfairness:

V

ⁿ

i

=

¹^G^F

(¬

^enⁱ

∨

^oⁱ

)

Strongfairness:

V

ⁿ

i

=

¹^G^F^enⁱ

→

^G^F^oⁱ

GeneralizedBühi automatawith 3

n

+

1states,

non-deterministi.

(19)

fairness

Weakfairness:

V

ⁿ

i

=

¹^G^F

(¬

^enⁱ

∨

^oⁱ

)

Strongfairness:

V

ⁿ

i

=

¹^G^F^enⁱ

→

^G^F^oⁱ

GeneralizedBühi automatawith 3

n

+

1states,

non-deterministi.

Streettautomata always1 state,deterministi.

(20)

Dierfrom Bühi automataonly in aeptane onditions.

Aeptane onditions look likeif a run sees innitely often,

then it will see innitelyoften (an be generalized to more

pairs of olors)

(21)

Dierfrom Bühi automataonly in aeptane onditions.

Aeptane onditions look likeif a run sees innitely often,

then it will see innitelyoften (an be generalized to more

pairs of olors)

Exatly whatis needed to reognize GFen

→

^G^F^o:

en

∧ ¬

^o

o

¬

^en

∧ ¬

^o

(with

⇒

⁾

(22)

For Bühi, we look for SCCswhose aeptane onditionsverify

∧ ∧ ∧

^.

For Streett they must verify something like

⇒ ∧ ⇒

^.

(23)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(24)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(25)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(26)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(27)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(28)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(29)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(30)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(31)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

Sine there isno in this SCC, westart again,but read as a

one-way barrier forbidding attemptsto ome bak.

(32)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(33)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(34)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(35)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(36)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(37)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(38)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(39)

∧ ∧ ∧

^.

⇒ ∧ ⇒

^.

(40)

To be orret, has to be ombined with a variantof heuristi H2

(orderingsuessors SCC-wise)

Barriers must be rossedonly after all normal suessors have

been visited.

Slowdown (w.r.t. generalized Bühi emptiness hek):

SCC arerevisited at worst m times ifm pairs of aeptane

onditions.

Comparewith the 3

m

+

¹^states ^of ^the ^Bühi^automaton ^for^the

(41)

Converting(generalized) Bühiautomatainto Streett automata?

ConvertingStreett automatainto (generalized) Bühiautomata?

(42)

Easy!

s s s

s

4 s

5

(43)

Easy!

s

1

s

2

s

3 s

4 s

5

with

⇒ ∧ ⇒

^.

ConvertingStreett automatainto (generalized) Bühiautomata?

(44)

Easy!

s s s

s

4 s

5

(45)

1 2 s

r

Client C

1

2 3

r

1

s

1

r

2

s

2

Server S

− ×

a

d

ChannelB

Synhronizationrules for the system

h

^C

,

^C

,

^S

,

^B

,

^B

,

^B

,

^B

i

^:

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i

(

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i

(

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i

(

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i

(

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i

(

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i

(

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i

(

⁸

) h

^. ^, ^. ^, ^s² ^, ^. ^, ^a ^, ^. ^, ^.

i

(46)

¯

r

1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

¯

d1

¯

d2

¯

r

1

¯

^r2 d1d2

¯

r

1

¯

^r2

¯

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

d

1

¯

d

2

¯

r1r2

¯

d

1

¯

d

2

r

1

¯

^r2

¯

d1d2

¯

^r1 r

2

d1

¯

d2

(47)

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i

(

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i

(

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i

(

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i

(

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i

(

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i

(

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i

(

⁸

) h

^. ^, ^. ^, ^s² ^, ^. ^, ^a ^, ^. ^, ^.

i

(48)

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i (

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i (

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i (

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i (

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i (

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i (

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i (

⁸

) h

^. ^, ^. ^, ^s² ^, ^. ^, ^a ^, ^. ^, ^.

i

Wewantthe hoie between transition (5)and (6)to befair.

Do we want strongor weakfairness?

(49)

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i (

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i (

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i (

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i (

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i (

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i (

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i (

⁸

) h

^. ^, ^. ^, ^s² ^, ^. ^, ^a ^, ^. ^, ^.

i

Wewantthe hoie between transition (5)and (6)to befair.

Do we want strongor weakfairness?

Ifboth (5)and (7)areenabled (= an our) and we pik (5), then

transition(7) will not be enabled until(6) ours. Therefore ifwe

alwayspik (5), (7)will not beenabled ontinuously: it will only be

enabledinnitely often.

(50)

¯

r

1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

¯

d1

¯

d2

¯

r

1

¯

^r2 d1d2

¯

r

1

¯

^r2

¯

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

d

1

¯

d

2

¯

r1r2

¯

d

1

¯

d

2

r

1

¯

^r2

¯

d1d2

¯

^r1 r

2

d1

¯

d2

(51)

Making the Kripke Struture fair (

⇒ ∧ ⇒

⁾

¯

r

1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

¯

d1

¯

d2

¯

r

1

¯

^r2 d1d2

¯

r

1

¯

^r2

¯

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

d

1

¯

d

2

¯

r1r2

¯

d

1

¯

d

2

r

1

¯

^r2

¯

d1d2

¯

^r1 r

2

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

^r1r2

¯

d

1

¯

d

2

r

1 r

2

¯ ¯

(52)

Theprevious example still allows senarioswhere onelient never

work. What ifwe want to disallow this?

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i (

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i (

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i (

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i (

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i (

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i (

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i

( ) h i

(53)

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i (

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i (

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i (

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i (

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i (

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i (

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i (

⁸

) h

^. ^, ^. ^, ^s² ^, ^. ^, ^a ^, ^. ^, ^.

i

Wewant(1)or (3) to our innitely often (i.e., lient 1progresses),

and (2)or (3) toour innitely often (i.e., lient 2 progresses too).

(54)

(

¹

) h

^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a ^, ^.

i (

²

) h

^. ^, ^s ^, ^. ^, ^. ^, ^. ^, ^. ^, ^a

i (

³

) h

^r ^, ^. ^, ^. ^,^d ^, ^. ^, ^. ^, ^.

i (

⁴

) h

^. ^, ^r ^, ^. ^, ^. ^, ^d ^, ^. ^, ^.

i (

⁵

) h

^. ^, ^. ^, ^r¹ ^, ^. ^, ^. ^, ^d ^, ^.

i (

⁶

) h

^. ^, ^. ^, ^s¹ ^, ^a ^, ^. ^, ^. ^, ^.

i (

⁷

) h

^. ^, ^. ^, ^r² ^, ^. ^, ^. ^, ^. ^, ^d

i

( ) h i

(55)

¯

r

1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

¯

d1

¯

d2

¯

r

1

¯

^r2 d1d2

¯

r

1

¯

^r2

¯

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

d

1

¯

d

2

¯

r1r2

¯

d

1

¯

d

2

r

1

¯

^r2

¯

d1d2

¯

^r1 r

2

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

^r1r2

¯

d

1

¯

d

2

r

1 r

2

¯ ¯

(56)

¯

r

1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

¯

d1

¯

d2

¯

r

1

¯

^r2 d1d2

¯

r

1

¯

^r2

¯

d1

¯

d2

r1

¯

^r2

¯

d

1

¯

d

2

¯

r1

¯

^r2

¯

d

1 d

2

¯

^r1

¯

^r2

d

1

¯

d

2

¯

r1r2

¯

d

1

¯

d

2

r

1

¯

^r2

¯

d1d2

¯

^r1 r

2

d1

¯

d2

(57)

(

^G^F^p⁰

→

^G^F^p¹

) ∧ (

^G^F^p²

→

^G^F^p⁰

) ∧

(

^G^F^p³

→

^G^F^p²

) ∧ (

^G^F^p⁴

→

^G^F^p²

) ∧ (

^G^F^p⁵

→

^G^F^p³

) ∧ (

^G^F^p⁶

→

^G^F

(

^p⁵

∨

^p⁴

)) ∧ (

^G^F^p⁷

→

^G^F^p⁶

) ∧ (

^G^F^p¹

→

^G^F^p⁷

)

→

^G^F^p⁸

How many states to enode the negation in a Bühi automaton?

(58)

(

^G^F^p⁰

→

^G^F^p¹

) ∧ (

^G^F^p²

→

^G^F^p⁰

) ∧

(

^G^F^p³

→

^G^F^p²

) ∧ (

^G^F^p⁴

→

^G^F^p²

) ∧ (

^G^F^p⁵

→

^G^F^p³

) ∧ (

^G^F^p⁶

→

^G^F

(

^p⁵

∨

^p⁴

)) ∧ (

^G^F^p⁷

→

^G^F^p⁶

) ∧ (

^G^F^p¹

→

^G^F^p⁷

)

→

^G^F^p⁸

How many states to enode the negation in a Bühi automaton?

Spot'sLTL to Bühitranslation without optimizations : 7291 states.

Withoptimizations : 1731 states.

(59)

(

^G^F^p⁰

→

^G^F^p¹

) ∧ (

^G^F^p²

→

^G^F^p⁰

) ∧ (

^G^F^p³

→

^G^F^p²

) ∧ (

^G^F^p⁴

→

^G^F^p²

) ∧ (

^G^F^p⁵

→

^G^F^p³

) ∧ (

^G^F^p⁶

→

^G^F

(

^p⁵

∨

^p⁴

)) ∧ (

^G^F^p⁷

→

^G^F^p⁶

) ∧ (

^G^F^p¹

→

^G^F^p⁷

)

→

^G^F^p⁸

How many states to enode the negation in a Streett automaton?

(60)

(

^G^F^p⁰

→

^G^F^p¹

) ∧ (

^G^F^p²

→

^G^F^p⁰

) ∧ (

^G^F^p³

→

^G^F^p²

) ∧ (

^G^F^p⁴

→

^G^F^p²

) ∧ (

^G^F^p⁵

→

^G^F^p³

) ∧ (

^G^F^p⁶

→

^G^F

(

^p⁵

∨

^p⁴

)) ∧ (

^G^F^p⁷

→

^G^F^p⁶

) ∧ (

^G^F^p¹

→

^G^F^p⁷

)

→

^G^F^p⁸

How many states to enode the negation in a Streett automaton?

Formula of the form

ψ → ϕ

^where

ψ

^is ^a ^strong ^fairness hypothesis.

A = A ⊗ A

FaieA

→

→

A

⊗ A ¬ (

→

)

→

A

⊗ A ¬ (

→

)

A

⊗ A

∧¬

A

⊗ A

⊗ A ¬

→

′

→

′

→

′

→

′

→

′

→

′ = ¬

∨

′

=

¬

∨

′

=

(¬

∨

′ )

V

=

(¬

∨

) V

=

→

(¬

∨

)

¬

∨

∧ ¬

(¬

∨

)

¬

∨

∧ ¬

⊗

⊗

¬

→

¬

¬

⊤ ⊤

⊤

¬

¬

¬

⊤

¬

¬

+

V

=

(¬

∨

)

V

FaieA

⊗ A ^¬ (

⊗ A ^¬ (

^∧¬

⊗ A ^¬

^′

^′

^′

^′

^′

^′ = ¬

^′

^′

^′ )

^¬