# Module checking

## Abstract

In computer system design, we distinguish between closed and open systems. A *closed system* is a system whose behavior is completely determined by the state of the system. An *open system* is a system that interacts with its environment and whose behavior depends on this interaction. The ability of temporal logics to describe an ongoing interaction of a reactive program with its environment makes them particularly appropriate for the specification of open systems. Nevertheless, model-checking algorithms used for the verification of closed systems are not appropriate for the verification of open systems. Correct model checking of open systems should check the system with respect to arbitrary environments and should take into account uncertainty regarding the environment. This is not the case with current model-checking algorithms and tools. In this paper we introduce and examine the problem of *model checking of open systems (module checking*, for short). We show that while module checking and model checking coincide for the linear-time paradigm, module checking is much harder than model checking for the branching-time paradigm. We prove that the problem of module checking is EXPTIME-complete for specifications in CTL and is 2EXPTIME-cornplete for specifications in CTL^{*}. This bad news is also carried over when we consider the program-complexity of module checking. As good news, we show that for the commonly-used fragment of CTL (universal, possibly, and always possibly properties), current model-checking tools do work correctly, or can be easily adjusted to work correctly, with respect to both closed and open systems.

## Keywords

Model Check Temporal Logic Linear Temporal Logic Atomic Proposition Program Complexity## References

- [ASSSV94]A. Aziz, T.R. Shiple, V. Singhal, and A.L. Sangiovanni-Vincentelli. Formula-dependent equivalence for compositional CTL model checking. In
*Proc. 6th Conf. on Computer Aided Verification*, Volume 818 of*Lecture Notes in Computer Science*, pages 324–337, Stanford, CA, June 1994. Springer-Verlag.Google Scholar - [BBG+94]I. Beer, S. Ben-David, D. Geist, R. Gewirtzman, and M. Yoeli. Methodology and system for practical formal verification of reactive hardware. In
*Proc. 6th Workshop on Computer Aided Verification*, volume 818 of*Lecture Notes in Computer Science*, pages 182–193, Stanford, June 1994.Google Scholar - [BCM+90]J.R. Burch, E.M. Clarke, K.L. McMillan, D.L. Dill, and L.J. Hwang. Symbolic model checking: 1020 states and beyond. In
*Proceedings of the 5th Symposium on Logic in Computer Science*, pages 428–439, Philadelphia, June 1990.Google Scholar - [BG94]O. Bernholtz and O. Grumberg. Buy one, get one free !!! In
*Proceedings of the First International Conference on Temporal Logic*, Volume 827 of*Lecture Notes in Artificial Intelligence*, pages 210–224, Bonn, July 1994. Springer-Vertag.Google Scholar - [Bro86]M.C. Browne. An improved algorithm for the automatic verification of finite state systems using temporal logic. In
*Proceedings of the First Symposium on Logic in Computer Science*, pages 260–266, Cambridge, June 1986.Google Scholar - [BVW94]O. Bernholtz, M.Y. Vardi, and P. Wolper. An automata-theoretic approach to branching-time model checking. In D. L. Dill, editor,
*Computer Aided Verification, Proc. 6th Int. Conference*, Volume 818 of*Lecture Notes in Computer Science*, pages 142–155, Stanford, June 1994. Springer-Verlag, Berlin.Google Scholar - [CE81]E.M. Clarke and E.A. Emerson. Design and synthesis of synchronization skeletons using branching time temporal logic. In
*Proc. Workshop on Logic of Programs*, volume 131 of*Lecture Notes in Computer Science*, pages 52–71. Springer-Verlag, 1981.Google Scholar - [CES86]E.M. Clarke, E.A. Emerson, and A.P. Sistla. Automatic verification of finite-state concurrent systems using temporal logic specifications.
*ACM Transactions on Programming Languages and Systems*, 8(2):244–263, January 1986.CrossRefGoogle Scholar - [CGL93]E.M. Clarke, O. Grumberg, and D. Long. Verification tools for finite-state concurrent systems. In J.W. de Bakker, W.-P. de Roever, and G. Rozenberg, editors,
*Decade of Concurrency — Reflections and Perspectives (Proceedings of REX School)*, Lecture Notes in Computer Science, pages 124–175. Springer-Verlag, 1993.Google Scholar - [Cle93]R. Cleaveland. A linear-time model-checking algorithm for the alternation-free modal
*μ*-calculus.*Formal Methods in System Design*, 2:121–147, 1993.CrossRefGoogle Scholar - [EH86]E.A. Emerson and J.Y. Halpern. Sometimes and not never revisited: On branching versus linear time.
*Journal of the ACM*, 33(1):151–178, 1986.CrossRefGoogle Scholar - [EJ88]E.A. Emerson and C. Jutla. The complexity of tree automata and logics of programs. In
*Proceedings of the 29th IEEE Symposium on Foundations of Computer Science*, White Plains, October 1988.Google Scholar - [EL85]E.A. Emerson and C.-L. Lei. Temporal model checking under generalized fairness constraints. In
*Proc. 18th Hawaii International Conference on System Sciences*, Hawaii, 1985.Google Scholar - [Eme90]E.A. Emerson. Temporal and modal logic.
*Handbook of theoretical computer science*, pages 997–1072, 1990.Google Scholar - [ES84]E.A. Emerson and A.P. Sistla. Deciding branching time logic. In
*Proceedings of the 16th ACM Symposium on Theory of Computing*, Washington, April 1984.Google Scholar - [FL79]M.J. Fischer and R.E. Ladner. Prepositional dynamic logic of regular programs.
*J. of Computer and Systems Sciences*, 18:194–211, 1979.CrossRefGoogle Scholar - [Flo67]R.W. Floyd. Assigning meaning to programs. In
*Proceedings Symposium on Applied Mathematics*, volume 19, 1967.Google Scholar - [FZ88]M.J. Fischer and L.D. Zuck. Reasoning about uncertainty in fault-tolerant distributed systems. In M. Joseph, editor,
*Proc. Symp. on Formal Techniques in Real-Time and Fault-Tolerant Systems*, pages 142–158. Springer-Verlag, 1988.Google Scholar - [GJ79]M. Garey and D.S. Johnson.
*Computers and Intractability: A Guide to the Theory of NP-completeness*. W. Freeman and Co., San Francisco, 1979.Google Scholar - [GL94]O. Grumberg and D.E. Long. Model checking and modular verification.
*ACM Trans. on Programming Languages and Systems*, 16(3): 843–871, 1994.CrossRefGoogle Scholar - [Gol77]L.M. Goldschlager. The monotone and planar circuit value problems are log space complete for p.
*SIGACT News*, 9(2):25–29, 1977.CrossRefGoogle Scholar - [Hoa69]C.A.R. Hoare. An axiomatic basis of computer programming.
*Communications of the ACM*, 12(10):576–583, 1969.CrossRefGoogle Scholar - [Hoa85]C.A.R. Hoare.
*Communicating Sequential Processes*. Prentice-Hall, 1985.Google Scholar - [HP85]D. Harel and A. Pnueli. On the development of reactive systems. In K. Apt, editor,
*Logics and Models of Concurrent Systems*, volume F-13 of*NATO Advanced Summer Institutes*, pages 477–498. Springer-Verlag, 1985.Google Scholar - [Kup95]O. Kupferman. Augmenting branching temporal logics with existential quantification over atomic propositions. In
*Computer Aided Verification, Proc. 7th Int. Workshop*, pages 325–338, Liege, July 1995.Google Scholar - [KV95]O. Kupferman and M.Y. Vardi. On the complexity of branching modular model checking. In
*Proc. 6th Conferance on Concurrency Theory*, pages 408–422, Philadelphia, August 1995.Google Scholar - [Lam80]L. Lamport. Sometimes is sometimes “not never” — on the temporal logic of programs. In
*Proceedings of the 7th ACM Symposium on Principles of Programming Languages*, pages 174–185, January 1980.Google Scholar - [Lar89]K.G. Larsen. Modal specifications. In
*Automatic Verification Methods for Finite State Systems, Proc. Int. Workshop, Grenoble*, volume 407, pages 232–246, Grenoble, June 1989. Lecture Notes in Computer Science, Springer-Verlag.Google Scholar - [Lon93]D.E. Long.
*Model checking, abstraction and compositional verification*. PhD thesis, Carnegie-Mellon University, Pittsburgh, 1993.Google Scholar - [LP85]O. Lichtenstein and A. Pnueli. Checking that finite state concurrent programs satisfy their linear specification. In
*Proceedings of the Twelfth ACM Symposium on Principles of Programming Languages*, pages 97–107, New Orleans, January 1985.Google Scholar - [LT88]K.G. Larsen and G.B. Thomsen. A modal process logic. In
*Proceedings of the 3th Symposium on Logic in Computer Science*, Edinburgh, 1988.Google Scholar - [McM93]K.L. McMillan.
*Symbolic model checking*. Kluwer Academic Publishers, 1993.Google Scholar - [MP92]Z. Manna and A. Pnueli. Temporal specification and verification of reactive modules. 1992.Google Scholar
- [Pnu77]A. Pnueli. The temporal logic of programs. In
*Proc. 18th IEEE Symposium on Foundation of Computer Science*, pages 46–57,1977.Google Scholar - [PR89]A. Pnueli and R. Rosner. On the synthesis of a reactive module. In
*Proceedings of the Sixteenth ACM Symposium on Principles of Programming Languages*, Austin, Januery 1989.Google Scholar - [QS81]J.P. Queille and J. Sifakis. Specification and verification of concurrent systems in Cesar. In
*Proc. 5th Int'l Symp. on Programming*, volume 137, pages 337–331. Springer-Verlag, Lecture Notes in Computer Science, 1981.Google Scholar - [Rab69]M.O. Rabin. Decidability of second order theories and automata on infinite trees.
*Transaction of the AMS*, 141:1–35, 1969.Google Scholar - [SC85]A.P. Sistla and E.M. Clarke. The complexity of propositional linear temporal logic.
*J. ACM*, 32:733–749, 1985.CrossRefGoogle Scholar - [Var95]M.Y. Vardi. On the complexity of modular model checking. In
*Proceedings of the 10th IEEE Symposium on Logic in Computer Science*, June 1995.Google Scholar - [VS85]M.Y. Vardi and L. Stockmeyer. Improved upper and lower bounds for modal logics of programs. In
*Proc 17th ACM Symp. on Theory of Computing*, pages 240–251, 1985.Google Scholar - [VW86a]M.Y. Vardi and P. Wolper. An automata-theoretic approach to automatic program verification. In
*Proceedings of the First Symposium on Logic in Computer Science*, pages 322–331, Cambridge, June 1986.Google Scholar - [VW86b]M.Y. Vardi and P. Wolper. Automata-theoretic techniques for modal logics of programs.
*Journal of Computer and System Science*, 32(2):182–221, April 1986.Google Scholar