# Generation of Minimum Tree-Like Witnesses for Existential CTL

## Abstract

An advantage of model checking is its ability to generate witnesses or counterexamples. Approaches exist to generate small or minimum witnesses for simple unnested formulas, but no existing method guarantees minimality for general nested ones. Here, we give a definition of witness size, use edge-valued decision diagrams to recursively compute the minimum witness size for each subformula, and describe a general approach to build minimum tree-like witnesses for existential CTL. Experimental results show that for some models, our approach is able to generate minimum witnesses while the traditional approach is not.

## 1 Introduction

Model checking is an automated technique to rigorously establish the correctness of a system by exploring its computation graph, explicitly or symbolically. Instead of merely answering “yes” or “no”, model checkers may be able to return a witness or counterexample to verify satisfaction or violation of a specification. Since witnesses and counterexamples provide important debugging information and may be inspected by engineers, smaller ones are always preferable.

Computation Tree Logic (CTL) is widely used to express temporal properties due to its simple yet expressive semantics. Although much work has been published on witness or counterexample generation [8, 11, 14], to the best of our knowledge, no existing method guarantees their minimality for a general CTL formula with nested temporal quantifiers. Clarke et al. [7] showed that the general form of a counterexample to a universal CTL formula is tree-like; of course, for CTL, counterexample generation for a universal formula can be converted to witness generation for an existential formula, thus we choose to limit our discussion to witness generation for the existential fragment of CTL. The use of backward exploration to verify \({\mathbf {\mathsf{{EX}}}}\), \({\mathbf {\mathsf{{EF}}}}\), and \({\mathbf {\mathsf{{EU}}}}\) properties inherently guarantees minimality of their linear witnesses, while a minimum lasso-shaped \({\mathbf {\mathsf{{EG}}}}\) witness can be generated by computing transitive closures, for example using the saturation algorithm [17]. However, these approaches do not extend to general tree-like witnesses, i.e., local minimality does not imply global minimality.

By recursively computing local fixpoints, the saturation algorithm [3] has clear advantages over traditional symbolic breadth-first approaches for state-space generation. It has also been applied to the computation of minimum \({\mathbf {\mathsf{{EF}}}}\) [4] and \({\mathbf {\mathsf{{EG}}}}\) [17] witnesses. Here, we extend these ideas into a global approach to build minimum witnesses for arbitrary existential CTL formulas.

Our paper is organized as follows. Section 2 summarizes background on CTL, decision diagrams, and symbolic CTL model checking. Section 3 defines the witness size and formalizes the computation of its minimum. Section 4 proposes saturation-based algorithms to symbolically encode minimum witness sizes for each existential temporal operator, needed to obtain an overall minimum witness size. Section 5 describes how to generate a witness from the computed witness size functions. Section 6 presents experimental results, Sect. 7 comments on our definition of witness size, and Sect. 8 concludes and outlines future work.

## 2 Background

We denote sets using calligraphic letters (e.g., \(\mathcal {A}\), \(\mathcal {B}\), \(\mathcal {C}\)), except for the booleans \(\mathbb {B}= \{0,1\}\), the natural numbers \(\mathbb {N}= \{0,1,2...\}\), and \(\mathbb {N}_{\infty }= \mathbb {N}\cup \{\infty \}\).

### 2.1 Kripke Structures, CTL, and Witnesses

A Kripke structure is a tuple \((\mathcal {S},\mathcal {S}_{init},\mathcal {N}, \mathcal {A},\mathcal {L})\), where \(\mathcal {S}\) is the state space, \(\mathcal {S}_{init} \subseteq \mathcal {S}\) are the initial states, \(\mathcal {N}\!:\!\mathcal {S}\!\rightarrow \! 2^{\mathcal {S}}\) is the next-state function, \(\mathcal {A}\) is a set of atomic propositions, and \(\mathcal {L}:\mathcal {S}\rightarrow 2^{\mathcal {A}}\) is a labeling that gives the atomic propositions holding in each state (subject to \( true \in \mathcal {A}\) holding in every state).

We assume \(\mathcal {S}\) to be the product \(\mathcal {S}_{1} \times \cdots \times \mathcal {S}_{L}\) of *L* finite state spaces, i.e., each *global* state \(\mathbf {i}\in \mathcal {S}\) is a tuple \((i_1,...,i_L)\), where \(i_k \in \mathcal {S}_k\) is the *local* state for the \(k^{\mathrm {th}}\) submodel. We also assume \(\mathcal {N}\) to be disjunctively partitioned according to a set \(\mathcal {E}\) of *asynchronous* events, i.e., \(\mathcal {N}= \bigcup _{e \in \mathcal {E}} \mathcal {N}_e\) and, for each \(e \in \mathcal {E}\), \(\mathcal {N}_e\!:\!\mathcal {S}\!\rightarrow \! 2^{\mathcal {S}}\). \(\mathcal {N}_e(\mathbf {i})\) contains the states that can be nondeterministically reached in one step when event *e* occurs in state \(\mathbf {i}\). Correspondingly, we let \(\mathcal {N}^{-1}_e\) denote the previous-state function, i.e., \(\mathcal {N}_e^{-1}(\mathbf {j}) = \{\mathbf {i}: \mathbf {j}\in \mathcal {N}_e(\mathbf {i})\}\), the set of states that can reach \(\mathbf {j}\) in one step through the occurrence of event *e*, and we let \(\mathcal {N}^{-1} = \bigcup _{e \in \mathcal {E}} \mathcal {N}_e^{-1}\).

Let \(\mathcal {P}(\mathbf {i})\) be the set of paths starting at \(\mathbf {i}\in \mathcal {S}\), i.e., finite sequences \((\mathbf {i}_0,\mathbf {i}_1,...,\mathbf {i}_n)\) for \(n \ge 0\), or infinite sequences \((\mathbf {i}_0,\mathbf {i}_1,...)\), where \(\mathbf {i}_0 = \mathbf {i}\) and \(\mathbf {i}_m \in \mathcal {N}(\mathbf {i}_{m-1})\) for all applicable *m*. Let \(\mathcal {C}(\mathbf {i}) \subseteq \mathcal {P}(\mathbf {i})\) be the set of cycles starting at \(\mathbf {i}\), i.e., finite paths \((\mathbf {i}_0,\mathbf {i}_1,...,\mathbf {i}_n)\) with \(n > 0\) and \(\mathbf {i}_0 = \mathbf {i}_n = \mathbf {i}\).

*a*is an atomic proposition):

Since the state space \(\mathcal {S}\) is finite, all infinite paths contain a cycle. Thus, path \((\mathbf {i}_0,\mathbf {i}_1,...)\) demonstrating \(\mathbf {i}\, \models \, {\mathbf {\mathsf{{EG}}}}\phi \) must have a finite prefix \((\mathbf {i}_0,...,\mathbf {i}_m,...,\mathbf {i}_n)\), for some \(m \ge 0\) and \(n > m\), where \(\mathbf {i}_m = \mathbf {i}_n\), that is, it is a “lasso” formed by merging (on state \(\mathbf {i}_m\)) a possibly empty “handle” \((\mathbf {i}_0,...,\mathbf {i}_m)\) and a “cycle” \((\mathbf {i}_m,...,\mathbf {i}_n)\).

We focus on witness generation, i.e., the computation of “tree-like” subgraphs demonstrating how a state satisfies an ECTL formula. This also serves to generate counterexamples for ACTL, the universal fragment of CTL, since a counterexample to \({\mathbf {\mathsf{{AX}}}}\phi \), \({\mathbf {\mathsf{{AG}}}}\phi \), or \({\mathbf {\mathsf{{A}}}}[\phi {\mathbf {\mathsf{{U}}}}\rho ]\) is a witness to \({\mathbf {\mathsf{{EX}}}}(\lnot \phi )\), \({\mathbf {\mathsf{{EF}}}}(\lnot \phi )\), or \({\mathbf {\mathsf{{E}}}}[\lnot \rho {\mathbf {\mathsf{{U}}}}(\lnot \phi \wedge \lnot \rho )] \vee {\mathbf {\mathsf{{EG}}}}(\lnot \rho )\), respectively (where the negation \(\lnot \) can be “pushed down” to atomic propositions), i.e., the negation of an ACTL formula is an ECTL formula.

### 2.2 Decision Diagrams

We encode sets and relations symbolically with (ordered) *multiway decision diagrams* (MDDs) [10]. An *L*-level MDD over \(\mathcal {S}= \mathcal {S}_1 \times \cdots \times \mathcal {S}_L\) is an acyclic directed edge-labeled level graph with *terminal* nodes 0 and 1, at level 0, while each *nonterminal* node *p* is at some level \(p. lvl = k \in \{1,...,L\}\), and, for \(i_k \in \mathcal {S}_k\), has an outgoing edge labeled with \(i_k\) and pointing to a child \(p[i_k]\) at level \(p[i_k]. lvl < k\).

MDD node *p* at level *k* encodes function \(f_p : \mathcal {S}\rightarrow \mathbb {B}\), recursively defined by \(f_p(i_1,...,i_L) = f_{p[i_k]}(i_1,...,i_L)\), with base case \(f_p(i_1,...,i_L) = p\) when \(k = 0\). Interpreting \(f_p\) as an indicator function, *p* encodes set \(\mathcal {X}_p = \{\mathbf {i}: f_p(\mathbf {i}) = 1\} \subseteq \mathcal {S}\). To encode relations over \(\mathcal {S}\), we use 2*L*-level MDDs over \((\mathcal {S}_1 \times \mathcal {S}_1) \times \cdots \times (\mathcal {S}_L \times \mathcal {S}_L)\), where the first set in each pair corresponds to a “*from*”, or “*unprimed*”, local state and the second set corresponds to a “*to*”, or “*primed*”, local state.

We use instead (ordered) *additive edge-valued MDDs*, (EV\(^+\)MDDs) [4] to encode partial integer-valued functions. An EV\(^+\)MDD is an acyclic directed edge-labeled and edge-valued level graph with terminal node \(\varOmega \), at level 0, while each nonterminal node *p* is at some level \(p. lvl = k \in \{1,...,L\}\), and, for \(i_k \in \mathcal {S}_k\), has an outgoing edge with label \(i_k\), pointing to a child \(p[i_k].c\) at a level \(p[i_k].c. lvl < k\), and value \(p[i_k].v \in \mathbb {N}_{\infty }\). We write \(p[i_k] = \langle {p[i_k].v}, {p[i_k].c}\rangle \).

EV\(^+\)MDD node *p* at level *k* encodes function \(f_p: \mathcal {S}\rightarrow \mathbb {N}_{\infty }\) recursively defined by \(f_p(i_1,...,i_L) = p[i_k].v + f_{p[i_k].c}(i_1,...,i_L)\), with base case \(f_{\varOmega }(i_1,...,i_L) = 0\).

For efficiency, we restrict ourselves to *canonical* forms of decision diagrams, where each function that can be encoded by a given class of decision diagrams has a unique representation in that class. All such forms forbid *duplicate nodes*: if \(p. lvl = q. lvl = k > 0\) and \(\forall i_k \in \mathcal {S}_k, p[i_k] = q[i_k]\), then \(p = q\). For ease of exposition, we only consider the *quasi-reduced* form in this paper, achieved by forbidding *skipped levels*: all roots (nodes without parent nodes) are at level *L* and, if \(p. lvl = k\), then all *p*’s children are at level \(k-1\). For EV\(^+\)MDDs, in addition, we require *normalized nodes*: each nonterminal node must have at least one edge with value 0 and all edges with value \(\infty \) must point to \(\varOmega \). This means that the minimum value of the function encoded by any node is 0, but we can encode any partial function \(g : \mathcal {S}\rightarrow \mathbb {N}_{\infty }\) with a “root edge” \(\langle {\sigma }, {p}\rangle \), where \(\sigma \) is the minimum value assumed by *g*, while *p* at level *L* satisfies \(f_p = g - \sigma \).

However, our algorithms are actually implemented using the more efficient *fully-identity-reduced* form for 2*L*-level MDDs and EV\(^+\)MDDs (indicated MDD2 and EV\(^+\)MDD2 in our algorithms, respectively) [5]. This form allows us to exploit independence of events from local states: given \(e \in \mathcal {E}\), let \( Top (e) = k\) if *e* affects or depends on the \(k^{\mathrm {th}}\) local state but not the \(l^{\mathrm {th}}\) one, for any \(l > k\). In the following, we then define \(\mathcal {N}_k = \bigcup _{e : Top (e) = k} \mathcal {N}_e\).

Procedure \( Min \) in Fig. 1 shows the classic recursive manipulation of decision diagrams. Given functions \(f, g: \mathcal {S}\rightarrow \mathbb {N}_{\infty }\), let \( Min _{f,g}: \mathcal {S}\rightarrow \mathbb {N}_{\infty }\) be their element-wise minimum: for \(\mathbf {i}\in \mathcal {S}\), \( Min _{f,g}(\mathbf {i}) = \min \{f(\mathbf {i}), g(\mathbf {i})\}\). Given two EV\(^+\)MDDs \( \langle {\alpha }, {p}\rangle \) and \( \langle {\beta }, {q}\rangle \) encoding *f* and *g*, procedure \( Min \) returns the EV\(^+\)MDD encoding \( Min _{f, g}\). As the EV\(^+\)MDDs are quasi-reduced, \(p. lvl \!=\! q. lvl \) unless \(\alpha \!=\! \infty \) or \(\beta \!=\! \infty \).

Procedure \( Normalize \) (line 8) normalizes a node *u* by subtracting the minimum edge value \(\mu \) from all its edge values, so that at least one is 0, stores the normalized *u* in the unique table (if not already there), and returns \(\langle {\mu }, {u}\rangle \).

### 2.3 Symbolic CTL Algorithms

McMillan proposed symbolic CTL model checking based on binary decision diagrams (BDDs) [12]. Given the BDDs encoding the set of states satisfying \(\phi \) and \(\rho \), algorithms to compute the BDD encoding the set of states satisfying \({\mathbf {\mathsf{{EX}}}}\phi \), \({\mathbf {\mathsf{{E}}}}\phi {\mathbf {\mathsf{{U}}}}\rho \), and \({\mathbf {\mathsf{{EG}}}}\phi \) suffice, since all CTL formulas can be expressed using these three CTL operators, plus the standard logical operations of negation, conjunction, and disjunction. Using MDDs instead of BDDs is a relatively obvious extension.

Clarke et al. [8] proposed the first symbolic approach to CTL witness generation. Considering first unnested CTL formulas, a witness for \({\mathbf {\mathsf{{EX}}}}a\) can be generated by one image computation, and is by definition minimum since all witnesses have size two. Using a symbolic breadth-first search, witness generation for \({\mathbf {\mathsf{{E}}}}a {\mathbf {\mathsf{{U}}}}b\) also guarantees minimality, while minimality is more difficult to satisfy for \({\mathbf {\mathsf{{EG}}}}a\), where a witness is a path from an initial state to a cycle, such that all states along that path and on the cycle satisfy *a*. In other words, a state \(\mathbf {i}\) satisfying \({\mathbf {\mathsf{{EG}}}}a\) must have a successor also satisfying \({\mathbf {\mathsf{{EG}}}}a\); thus, we can incrementally build a path of states satisfying \({\mathbf {\mathsf{{EG}}}}a\), which must finally lead to a state already on the path, closing the cycle and resulting in a witness. A witness generation algorithm for (weakly fair) \({\mathbf {\mathsf{{EG}}}}\) was proposed in [8] based on this idea. Since \(\mathbf {i}\) might have multiple successors satisfying \({\mathbf {\mathsf{{EG}}}}a\), the algorithm is nondeterministic and the size of the witness depends on the state chosen at each step. While the algorithm uses a symbolic encoding, the approach is largely explicit, as it follows a single specific path. Decision diagrams help by efficiently encoding all states satisfying \({\mathbf {\mathsf{{EG}}}}\), but offer no help at all when deciding which of the states in \(\mathcal {N}(\mathbf {i})\) satisfying \({\mathbf {\mathsf{{EG}}}}\) should be chosen next, to continue the path from \(\mathbf {i}\).

Witness generation for arbitrarily nested CTL formulas is much harder. Of course, we cannot exhibit witnesses for universal formulas, only counterexamples, thus the presence of both existential and universal (non-negated) quantifiers in a CTL formula \(\phi \) means that we can neither provide a witness (in case \(\phi \) holds) nor a counterexample (in case \(\phi \) does not hold). The most general approach to date is by Clarke et al. [7] for general (nested) ACTL formulas, which proposed algorithms to generate tree-like counterexamples, or witnesses for general (nested) ECTL formulas. However, their work did not address minimality.

## 3 Defining the Minimum Witness Size

*minimum*witnesses for general (nested) ECTL formulas. As discussed by Clarke et al. [7], these witnesses are finite tree-like Kripke structures and complete for ECTL. To discuss their size, we unfold these witnesses, i.e., the same state may appear multiple times and each appearance contributes to the count defining the size of the witness. For example, consider the (portion of a) Kripke structure shown in Fig. 2(a), satisfying formula \({\mathbf {\mathsf{{E}}}}({\mathbf {\mathsf{{EG}}}}a) {\mathbf {\mathsf{{U}}}}b\) (state are identified by numbers and the atomic propositions holding in each state are listed close to it). An unfolded tree-like witness for this formula is shown in Fig. 2(b), where state 5’s self-loop is repeated three times, once for each of the states 1, 2, and 3, since we need to show that each of them satisfies \({\mathbf {\mathsf{{EG}}}}a\) (for clarity, a cycle is represented as a linear path along which the first and the last states are the same; dashed nodes represent the states closing cycles). Another way to think of this witness is that the first states of paths \([\![{1,5,\overline{5}}]\!]\), \([\![{2,5,\overline{5}}]\!]\), and \([\![{3,5,\overline{5}}]\!]\), each satisfying the inner formula \(\phi ' = {\mathbf {\mathsf{{EG}}}}a\), are “glued” onto the first three states of path \([\![{1,2,3,4}]\!]\), satisfying the outermost formula \({\mathbf {\mathsf{{E}}}}\phi ' {\mathbf {\mathsf{{U}}}}\phi ''\), as is the first (and only) state of path \([\![{4}]\!]\), satisfying the (atomic) inner formula \(\phi '' = b\). We write \(\overline{5}\) for the last state of the \({\mathbf {\mathsf{{EG}}}}\) witnesses to stress that state 5 does not need to have its witness repeated, since it is just closing the cycle. We define the

*size*of a witness as the number of nodes in the resulting tree-like graph. Thus, a witness for

*a*is path \([\![{1}]\!]\), of size 1, a witness for \({\mathbf {\mathsf{{EX}}}}a\) is path \([\![{1,2}]\!]\), of size 2, a witness for \({\mathbf {\mathsf{{E}}}}a {\mathbf {\mathsf{{U}}}}b\) is path \([\![{1, 2, 3, 4}]\!]\), of size 4, and a witness to \({\mathbf {\mathsf{{E}}}}({\mathbf {\mathsf{{EG}}}}a) {\mathbf {\mathsf{{U}}}}b\) is the three-like graph \([\![{[\![{1,5,\overline{5}}]\!], [\![{2,5,\overline{5}}]\!], [\![{3,5,\overline{5}}]\!], 4}]\!]\), of size 10. For conjunction, we need additional path notation: a witness for \({\mathbf {\mathsf{{EX}}}}a \wedge {\mathbf {\mathsf{{E}}}}a {\mathbf {\mathsf{{U}}}}b\) is a tree-like graph \([\![{[\![{1,5}]\!] \Diamond [\![{1, 2, 3, 4}]\!]}]\!]\), of size 5, where the separator \(\Diamond \) indicates that the tree-like graphs to its left and its right are to be merged on their root.

where \(\mathcal {C}(\mathbf {i})\) is the set of cycles starting at \(\mathbf {i}\), and \(\chi _{\phi }(\mathbf {i})\) is the minimum witness size among cycles satisfying \({\mathbf {\mathsf{{EG}}}}\phi \) and starting at \(\mathbf {i}\). In the sum for \(\chi _{\phi }(\mathbf {i})\), we exclude \({\pi }_{\phi }(\mathbf {i}_0)\) and add 1 because state \(\mathbf {i}= \mathbf {i}_0 = \mathbf {i}_n\) starting and ending the cycle appears twice, but we should not count the witness for \(\mathbf {i}\,\models \, \phi \) twice.

## 4 Computing the Minimum Witness Size

The first and most complex step to generate a minimum tree-like witness for an arbitrary ECTL formula \({\phi ^*}\) is to build: (1) for each subformula \(\phi \) of \({\phi ^*}\), starting from the innermost atomic propositions, an EV\(^+\)MDD encoding the size \({\pi }_{\phi }(\mathbf {i})\) of a minimum witness for \(\phi \) starting from each state \(\mathbf {i}\), and (2) for each subformula \({\mathbf {\mathsf{{EG}}}}\phi \) of \({\phi ^*}\), an EV\(^+\)MDD2 encoding the size, \(TC_{\phi }(\mathbf {i},\mathbf {j})\), of a minimum witness for a path of states satisfying \(\phi \) from each state \(\mathbf {i}\) to each state \(\mathbf {j}\).

We present algorithms to compute the minimum witness size for \({\mathbf {\mathsf{{EU}}}}\) and \({\mathbf {\mathsf{{EG}}}}\), while we omit the simpler ones for logical operators, \({\mathbf {\mathsf{{EX}}}}\), and atomic propositions.

### 4.1 Computing the Minimum Witness Size for \({\mathbf {\mathsf{{EU}}}}\) Formulas

\( EUSat \) in Fig. 3 is the top-level procedure to compute \({\pi }_{{\mathbf {\mathsf{{E}}}}\phi {\mathbf {\mathsf{{U}}}}\rho }\), given \(\langle {\alpha _{\rho }}, {p_{\rho }}\rangle \) encoding \({\pi }_{\rho }\) and \(\langle {\beta _{\phi }}, {q_{\phi }}\rangle \) encoding \({\pi }_{\phi }\) (both obtained by computing the minimum witness size function of subformulas). \( ConsSat \) computes a fixpoint for the subfunction encoded by \(\langle {\alpha }, {p}\rangle \), under constraint \(\langle {\beta }, {q}\rangle \), w.r.t. events affecting variables up to *p*’s level. \( ConsRelProdSat \) first recursively computes the \(\langle {\beta }, {q}\rangle \)-constrained relational product of \(\langle {\alpha }, {p}\rangle \) and *r* (specifically, it serves as a constrained version of the pre-image operation since we use the previous-state function), then it saturates the resulting node to ensure that it reaches a local fixpoint.

When exploring the pre-image of state \(\mathbf {i}\), we compute, for each predecessor \(\mathbf {j}\in \mathcal {N}(\mathbf {i})\), the sum of \({\pi }_{\rho }(\mathbf {j})\) and the value currently associated to \(\mathbf {i}\) (line 3 in \( ConsRelProdSat \)), and use it to reduce the value associated to \(\mathbf {j}\), if smaller (line 12 in \( ConsSat \) and line 8 in \( ConsRelProdSat \)). Upon reaching a fixpoint, we have the size of the minimum tree-like \({\mathbf {\mathsf{{E}}}}\phi {\mathbf {\mathsf{{U}}}}\rho \) witness for each state \(\mathbf {i}\) (\(\infty \) if Open image in new window ).

The hash-key for the cache entries of \( ConsSat \) and \( ConsRelProdSat \) consists of two nodes, *p* and *q*, plus the value \(\beta \) attached to the edge for *q*, representing the constraint. Storing the *difference* \(\alpha - \beta \), as done for \( Min \), would be incorrect because saturation computes local fixpoints and thus may fire an event multiple times in one call, and \(\alpha \) just serves as an offset to all the values in the final function, while, for each individual state, it does not affect whether the new value obtained from one firing is smaller than the currently associated value. In other words, if it is known that \( ConsSat (\langle {0}, {p}\rangle ,\langle {\beta }, {q}\rangle ) = \langle {\gamma }, {u}\rangle \), then we can conclude that \( ConsSat (\langle {\alpha }, {p}\rangle ,\langle {\beta }, {q}\rangle ) = \langle {\alpha +\gamma }, {u}\rangle \), for any \(\alpha > 0\).

### 4.2 Computing the Minimum Witness Size for \({\mathbf {\mathsf{{EG}}}}\) Formulas

A witness of \({\mathbf {\mathsf{{EG}}}}p\) is a lasso-shaped infinite path consisting of a finite prefix leading to a cycle [1]. Thus, two steps are needed to compute a minimum tree-like witness for \({\mathbf {\mathsf{{EG}}}}\phi \): (1) identify all states in cycles of states satisfying \(\phi \), and their minimum witness size; (2) starting from these states, explore the model backward to find all states satisfying \({\mathbf {\mathsf{{EG}}}}p\), and their minimum witness size. This second step is essentially an \({\mathbf {\mathsf{{EU}}}}\) computation, thus we focus on the first step.

Given a graph, the transitive closure (TC) describes the reachability between any pair of nodes. Computing TCs was deemed infeasible for large models [13], but recent attempts using saturation to compute TCs symbolically have been successful [16, 17]. We generalize this approach so that, for \({\mathbf {\mathsf{{EG}}}}\phi \), the size of a minimum \(\phi \) witness for each state in a \(\phi \) cycle contributes to the cycle size.

We compute function \(TC_{\phi }: \mathcal {S}\times \mathcal {S}\rightarrow \mathbb {N}_{\infty }\) s.t. \(TC_{\phi }(\mathbf {i}, \mathbf {j})\) is the minimum size of any path \(\mathbf {i}, \mathbf {i}_1, \cdots , \mathbf {j}\), computed as \({\pi }_{\phi }(\mathbf {i}_1) + \cdots + {\pi }_{\phi }(\mathbf {j})\), or \(\infty \) if no such path exists. We do not include \({\pi }_{\phi }(\mathbf {i})\) because we compute \(TC_{\phi }\) to obtain the minimum witness size of cycles, \(\chi _{\phi }(\mathbf {i}) = TC_{\phi }(\mathbf {i}, \mathbf {i}) + 1\), and \({\pi }_{\phi }(\mathbf {i})\) should not be added twice.

This iteration never increases the value of \(\lambda _{\phi }\), thus it terminates, and when it does the resulting fixpoint is \(TC_{\phi }\). Procedures \( TCSat \) and \( TCRelProdSat \) in Fig. 4 are similar to \( ConsSat \) and \( ConsRelProdSat \) in Fig. 3, except that they apply saturation to an EV\(^+\)MDD2. \( TCMin \) (line 14 in \( TCSat \), line 11 in \( TCRelProdSat \)) is an implementation of \( Min \) over pairs of states: for each \(\mathbf {i}, \mathbf {j}\in \mathcal {S}\), \( TCMin _{f,g}(\mathbf {i}, \mathbf {j}) = \min \{ f(\mathbf {i}, \mathbf {j}), g(\mathbf {i}, \mathbf {j}) \}\).

Finally, we compute \({\pi }_{{\mathbf {\mathsf{{EG}}}}\phi }\) with procedure *EGSat*, where \(\langle {\beta _{\phi }}, {q_{\phi }}\rangle \) encodes \({\pi }_{\phi }\). \( BuildLambda \) (line 1) builds an EV\(^+\)MDD2 encoding function \(\lambda _{\phi }\), to initialize the computation of \(TC_{\phi }\). \( ExtractCycles \) (line 2) returns an EV+MDD encoding \(\chi _{\phi }(\mathbf {i})\) by extracting elements \(TC_{\phi }(\mathbf {i}, \mathbf {i})\) from \(TC_{\phi }\), for \(\mathbf {i}\in \mathcal {S}\), and adding 1 to them.

## 5 Generating a Minimum Tree-Like Witness

Recall that, if function *f* is encoded as an EV\(^+\)MDD, one can retrieve \( MinVal (f)\), the minimum value of *f*, in constant time (as the value labeling the edge pointing to the root node) and \( MinState (f)\), a state achieving that minimum value, in time proportional to the number of levels *L* (follow a path of 0-valued edges from the root to \(\varOmega \)). Evaluating \(f(\mathbf {i})\) for a given state \(\mathbf {i}\) also requires just *L* steps.

## 6 Experimental Results

Performance comparison of MinWit and Wit.

Model (parms) | #States | #Trans | Time (s) | Memory (MB) | Size | |||||
---|---|---|---|---|---|---|---|---|---|---|

MinWit | Wit | MinWit | Wit | MinWit | Wit | |||||

min | avg | max | ||||||||

\({\mathbf {\mathsf{{EG}}}}( {\mathbf {\mathsf{{EF}}}}( ( Section\_2 = 1 ) \wedge ( Section\_3 = 1 ) ) )\) | ||||||||||

CircularTrain(12) | \(2.0 \cdot 10^{2}\) | \(5.0 \cdot 10^{2}\) | 0.4 | 0.0 | 20.6 | 4.8 | | 32 | 71 | 275 |

CircularTrain(24) | \(8.7 \cdot 10^{4}\) | \(4.1 \cdot 10^{5}\) | 2244.9 | 4.6 | 2924.5 | 11.8 | | 91 | 404 | 889 |

\({\mathbf {\mathsf{{E}}}}( {\mathbf {\mathsf{{EF}}}}(ERKPP> 5) \,{\mathbf {\mathsf{{U}}}}\, {\mathbf {\mathsf{{EG}}}}(RKIPP\_RP > 5) )\) | ||||||||||

ERK(20) | \(1.7 \cdot 10^{6}\) | \(1.6 \cdot 10^{7}\) | 93.9 | 3.8 | 591.0 | 6.5 | | 258 | 313 | 391 |

ERK(22) | \(2.8 \cdot 10^{6}\) | \(2.7 \cdot 10^{7}\) | 224.1 | 4.4 | 932.1 | 6.9 | | 246 | 314 | 393 |

ERK(25) | \(5.7 \cdot 10^{6}\) | \(5.4 \cdot 10^{7}\) | 793.4 | 5.0 | 1800.6 | 8.0 | | 256 | 315 | 397 |

\({\mathbf {\mathsf{{EF}}}}( ( P1 = 3 ) \wedge {\mathbf {\mathsf{{EG}}}}( ( P1> P2 ) \wedge ( P2 > P3 ) ) )\) | ||||||||||

FMS(5) | \(2.9 \cdot 10^{6}\) | \(3.2 \cdot 10^{7}\) | 0.6 | 2.7 | 21.0 | 7.6 | 13 | 13 | 48 | 193 |

FMS(8) | \(2.5 \cdot 10^{8}\) | \(3.6 \cdot 10^{9}\) | 31.6 | 17.5 | 447.6 | 13.7 | 22 | 22 | 51 | 201 |

FMS(10) | \(2.5 \cdot 10^{9}\) | \(4.1 \cdot 10^{10}\) | 458.9 | 30.6 | 1510.1 | 23.5 | 28 | 28 | 54 | 217 |

\({\mathbf {\mathsf{{EF}}}}( ( P1 < P2 ) \wedge {\mathbf {\mathsf{{EG}}}}( P1 = P4 ) )\) | ||||||||||

Kanban(20) | \(8.1 \cdot 10^{11}\) | \(1.1 \cdot 10^{13}\) | 18.4 | 1530.3 | 269.6 | 289.0 | 10 | 10 | 10 | 11 |

Kanban(22) | \(2.1 \cdot 10^{12}\) | \(2.9 \cdot 10^{13}\) | 28.6 | 2297.8 | 395.9 | 410.4 | 10 | 10 | 10 | 11 |

Kanban(25) | \(7.7 \cdot 10^{12}\) | \(1.1 \cdot 10^{14}\) | 53.9 | 4224.4 | 691.6 | 707.9 | 10 | 10 | 10 | 11 |

\({\mathbf {\mathsf{{E}}}}( {\mathbf {\mathsf{{EF}}}}( Phase1 < Phase2 ) \,{\mathbf {\mathsf{{U}}}}\, ( Phase2 > Phase3 ) )\) | ||||||||||

MAPK(8) | \(6.1 \cdot 10^{6}\) | \(7.9 \cdot 10^{7}\) | 14.0 | 2.0 | 353.0 | 6.1 | | 126 | 126 | 126 |

MAPK(12) | \(3.2 \cdot 10^{8}\) | \(5.0 \cdot 10^{9}\) | 1881.4 | 6.2 | 1764.2 | 8.7 | | 204 | 204 | 204 |

\({\mathbf {\mathsf{{EF}}}}( ( Think\_1 = 0 ) \wedge {\mathbf {\mathsf{{EG}}}}( Eat\_1 = 0 ) )\) | ||||||||||

Philosophers(20) | \(3.5 \cdot 10^{9}\) | \(5.4 \cdot 10^{10}\) | 1.3 | 2.1 | 52.4 | 9.2 | 5 | 5 | 8 | 22 |

Philosophers(50) | \(7.2 \cdot 10^{23}\) | \(2.8 \cdot 10^{25}\) | 44.9 | 10.8 | 763.5 | 29.1 | 5 | 5 | 7 | 20 |

Philosophers(100) | \(5.2 \cdot 10^{47}\) | \(4.0 \cdot 10^{49}\) | timeout | 52.1 | − | 94.0 | − | 5 | 7 | 28 |

\({\mathbf {\mathsf{{E}}}}( {\mathbf {\mathsf{{EF}}}}( P\_client\_ack\_1 = 1 ) \,{\mathbf {\mathsf{{U}}}}\, ( ( P\_server\_ack\_1 = 1 ) \wedge ( P\_server\_ack\_2 = 1 ) ) )\) | ||||||||||

SimpleLoadBal(2) | \(8.3 \cdot 10^{2}\) | \(3.4 \cdot 10^{3}\) | 0.1 | 0.8 | 9.0 | 5.9 | 23 | 23 | 32 | 44 |

SimpleLoadBal(5) | \(1.2 \cdot 10^{5}\) | \(7.5 \cdot 10^{5}\) | 37.6 | 19.2 | 1032.6 | 41.0 | | 26 | 69 | 80 |

\({\mathbf {\mathsf{{E}}}}( {\mathbf {\mathsf{{EF}}}}( TaskOnDisk< CPUUnit ) \,{\mathbf {\mathsf{{U}}}}\, ( CPUUnit < DiskControllerUnit ) )\) | ||||||||||

SmallOS(64,32) | \(9.1 \cdot 10^{6}\) | \(6.8 \cdot 10^{7}\) | 17.5 | 1987.7 | 374.6 | 401.6 | | 694 | 1189 | 1552 |

SmallOS(128,64) | \(2.6 \cdot 10^{8}\) | \(2.0 \cdot 10^{9}\) | 294.4 | 53522.2 | 3228.4 | 1850.0 | | 2430 | 4698 | 5920 |

\({\mathbf {\mathsf{{EF}}}}( {\mathbf {\mathsf{{EG}}}}( Undress < InBath ) )\) | ||||||||||

SwimmingPool(1) | \(9.0 \cdot 10^{4}\) | \(4.5 \cdot 10^{5}\) | 109.7 | 4.7 | 1334.9 | 6.6 | 16 | 16 | 24 | 43 |

SwimmingPool(2) | \(3.4 \cdot 10^{6}\) | \(2.0 \cdot 10^{7}\) | timeout | 39.1 | − | 22.3 | − | 16 | 24 | 53 |

For MinWit, we run each model instance with a timeout of one hour, and report the runtime, the peak memory consumption, and the size of the minimum witness. For Wit, we run each instance 100 times and report the total runtime, the peak memory consumption, and the minimum, average and maximum size among the all the generated witnesses. The minimum witness size is in bold when Wit did not manage to generate a minimum witness in any of the 100 runs. Obviously, the choice of \(R = 100\) runs is arbitrary: the larger *R* is, the more likely Wit is to generate smaller witnesses, possibly a minimum one, but, on the other hand, the overall time Wit spends for witness generation is roughly proportional to *R*. Fundamentally, however, we have no easy way to know if the smallest witness generated by Wit is a minimum one, regardless of how large *R* is, while MinWit guarantees minimality.

A few observations are in order. First, it is not surprising that MinWit is sometimes orders of magnitude slower and requires more memory than Wit. Building EV\(^+\)MDDs or EV\(^+\)MDD2s encoding both states and size information is much more expensive than the image computations on MDDs used to just run the model checking phase, as Wit does. However, this is offset by a minimality guarantee. Interestingly, there are cases where MinWit completes with a runtime and memory consumption comparable to a single run of Wit (e.g., Kanban) or even faster (e.g., SmallOS). We give credit to the saturation algorithm for its efficient locality-exploiting exploration.

Second, for models where small, simple witnesses exist, Wit may be able to generate a minimum witness. Since the backward exploration guarantees the local minimality of subwitnesses for \({\mathbf {\mathsf{{EX}}}}\), \({\mathbf {\mathsf{{EF}}}}\) and \({\mathbf {\mathsf{{EU}}}}\) segments, such greedy strategy may result in a global minimum witness, determined by the structure of the model. But this occurrence cannot be guaranteed, regardless of whether we use 100 runs or 10,000 runs, so that, even when Wit happens to generate a minimum witness, users do not know that this is indeed the case.

Third, for models where only large, complex witnesses exist, generating a minimum witness is almost impossible for Wit, while the witness from MinWit can be only 40% as large as the smallest one generated by Wit (e.g., CircularTrain with \(N=24\)). Additionally, Wit’s greedy strategy may trap itself into a local optimum. For example, the ECTL formula used for model MAPK does not contain \({\mathbf {\mathsf{{EG}}}}\), and the minimum, average, and maximum witness sizes generated by Wit are equal, implying that Wit is unaware of other possibilities when it chooses branching states. Adopting a probabilistic non-optimal strategy like simulated annealing may alleviate this problem, but it still would not provide guarantees and would likely require many more runs.

The main limitation of MinWit is that, since computing the minimum witness size function is computationally intensive, long runtimes and large amounts of memory are required as the model complexity scales up. However, engineers usually debug models with small scaling parameters first, perhaps running model checking tools overnight, thus, the resource requirement of MinWit may often be acceptable in practice. In real-world applications, we believe that MinWit and Wit can complement each other. Wit generates a large number of witnesses in a short time, but if all the witnesses are complex, MinWit can be run to find a smaller, easier-to-inspect one. Conversely, if MinWit fails to generate a minimum witness due to time or memory limitation, Wit can be run to obtain not-necessarily-minimum ones by running it repeatedly, as many times as one can afford. The best approach, given enough resources and in the presence of critical deadlines, may well be to run both methods in parallel, so that we can be sure to have a minimum witness if MinWit completes, but we have at least some witnesses from Wit, if MinWit fails to complete in time.

## 7 A Comment About Our Definition of Witness Size

## 8 Conclusions

We presented a definition of witness size and an approach to compute minimum tree-like witnesses for ECTL formulas, based on edge-valued decision diagrams to capture a global view of witness size. Experimental results demonstrate that our approach is able to generate minimum witnesses (with a guarantee that it is doing so) for some models, while the traditional approach is not. While the runtime and memory requirements of our approach tend to be higher, sometimes they are comparable to that of the traditional approach.

There are several directions for future work to improve this approach itself or extend its applicability. One interesting possibility is to selectively employ our approach or the traditional approach for different subformulas; this would not guarantee witness minimality, but could generate smaller witness than with the traditional approach alone, while being faster than using our approach alone. Especially for \({\mathbf {\mathsf{{EG}}}}\) formulas, the traditional approach has no global view about the size of witnesses it generates, while, for formulas where the minimum witness size from each state varies widely, the EV\(^+\)MDDs and EV\(^+\)MDD2s built by our method tend to be large and costly to compute. Thus, heuristics that consider both the structure of the model and of the formula are needed.

Finally, our approach could be further extended by generalizing the concept of “size” to “weight”. Specifically, by assigning a weight to each state, engineers could convey their preference to model checkers, which would then tend to generate witnesses containing the desired states and subpaths, instead of just counting the number of states in the witness. The algorithmic difference in doing so would be negligible, the only additional cost could be a potential growth in the size of the corresponding EV\(^+\)MDDs and EV\(^+\)MDD2s, as the functions being encoded might have less sharing of nodes.

## Notes

### Data Availability Statement and Acknowledgments

The datasets we utilized are available in the figshare repository [9]. This work was supported in part by the National Science Foundation under grant ACI-1642397.

## References

- 1.Biere, A., Cimatti, A., Clarke, E., Zhu, Y.: Symbolic model checking without BDDs. In: Cleaveland, W.R. (ed.) TACAS 1999. LNCS, vol. 1579, pp. 193–207. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-49059-0_14CrossRefGoogle Scholar
- 2.Ciardo, G., Jones, R.L., Miner, A.S., Siminiceanu, R.: Logical and stochastic modeling with SMART. Perf. Eval.
**63**, 578–608 (2006)Google Scholar - 3.Ciardo, G., Marmorstein, R., Siminiceanu, R.: The saturation algorithm for symbolic state space exploration. Software Tools for Technology Transfer
**8**(1), 4–25 (2006)CrossRefGoogle Scholar - 4.Ciardo, G., Siminiceanu, R.: Using edge-valued decision diagrams for symbolic generation of shortest paths. In: Aagaard, M.D., O’Leary, J.W. (eds.) FMCAD 2002. LNCS, vol. 2517, pp. 256–273. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-36126-X_16CrossRefGoogle Scholar
- 5.Ciardo, G., Yu, A.J.: Saturation-based symbolic reachability analysis using conjunctive and disjunctive partitioning. In: Borrione, D., Paul, W. (eds.) CHARME 2005. LNCS, vol. 3725, pp. 146–161. Springer, Heidelberg (2005). https://doi.org/10.1007/11560548_13CrossRefGoogle Scholar
- 6.Clarke, E.M., Emerson, E.A.: Design and synthesis of synchronization skeletons using branching time temporal logic. In: Kozen, D. (ed.) Logic of Programs 1981. LNCS, vol. 131, pp. 52–71. Springer, Heidelberg (1982). https://doi.org/10.1007/BFb0025774CrossRefGoogle Scholar
- 7.Clarke, E., Jha, S., Lu, Y., Veith, H.: Tree-like counterexamples in model checking. In: Proceedings of the LICS, pp. 19–29. IEEE Computer Society Press (2002)Google Scholar
- 8.Clarke, E.M., Grumberg, O., McMillan, K., Zhao, X.: Efficient generation of counterexamples and witnesses in symbolic model checking. In: 32nd Design Automation Conference (DAC 1995), pp. 427–432 (1995)Google Scholar
- 9.Jiang, C., Ciardo, G.: Generation of minimum tree-like witnesses for existential CTL. Figshare (2018). https://doi.org/10.6084/m9.figshare.5926555.v1
- 10.Kam, T., Villa, T., Brayton, R.K., Sangiovanni-Vincentelli, A.: Multi-valued decision diagrams: theory and applications. Multiple-Valued Logic
**4**(1–2), 9–62 (1998)MathSciNetzbMATHGoogle Scholar - 11.Kashyap, S., Garg, V.K.: Producing short counterexamples using “crucial events”. In: Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 491–503. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-70545-1_47CrossRefGoogle Scholar
- 12.McMillan, K.L.: Symbolic model checking: an approach to the state explosion problem. Ph.D. thesis, School of Computer Science, Carnegie Mellon University, May 1992. CMU-CS-92-131Google Scholar
- 13.Ravi, K., Bloem, R., Somenzi, F.: A comparative study of symbolic algorithms for the computation of fair cycles. In: Hunt, W.A., Johnson, S.D. (eds.) FMCAD 2000. LNCS, vol. 1954, pp. 162–179. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-40922-X_10CrossRefGoogle Scholar
- 14.Tan, J., Avrunin, G.S., Clarke, L.A., Zilberstein, S., Leue, S.: Heuristic-guided counterexample search in FLAVERS. In: Proceedings of the SIGSOFT, pp. 201–210. ACM (2004)CrossRefGoogle Scholar
- 15.Zhao, Y., Ciardo, G.: Symbolic CTL model checking of asynchronous systems using constrained saturation. In: Liu, Z., Ravn, A.P. (eds.) ATVA 2009. LNCS, vol. 5799, pp. 368–381. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04761-9_27CrossRefGoogle Scholar
- 16.Zhao, Y., Ciardo, G.: Symbolic computation of strongly connected components using saturation. In: Proceedings of the 2nd NASA Formal Methods Symposium (NFM 2010), NASA/CP-2010-216215, pp. 201–211. NASA (2010)Google Scholar
- 17.Zhao, Y., Jin, X., Ciardo, G.: A symbolic algorithm for shortest EG witness generation. In: Proceedings of the TASE, pp. 68–75. IEEE Computer Society Press (2011)Google Scholar

## Copyright information

<SimplePara><Emphasis Type="Bold">Open Access</Emphasis> This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.</SimplePara> <SimplePara>The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.</SimplePara>