Synthesizing a Lego Forklift Controller in GR(1): A Case Study

The paper deals with symbolic approaches to bounded model checking (BMC) for the existential fragment of linear temporal logic extended with the epistemic component (ELTLK), interpreted over interleaved interpreted systems. Two translations of BMC for ELTLK to SAT and to operations on BDDs are presented. The translations have been implemented, tested, and compared with each other as well as with another tool on several benchmarks for MAS. Our experimental results reveal advantages and disadvantages of SAT- versus BDD-based BMC for ELTLK.

Property specifications for workflow modelling

Manipulation planning from high-level task specifications, even though highly desirable, is a challenging problem. The large dimensionality of manipulators and complexity of task specifications make the problem computationally intractable. This work introduces a manipulation planning framework with linear temporal logic (LTL) specifications. The use of LTL as the specification language allows the expression of rich and complex manipulation tasks. The framework deals with the state-explosion problem through a novel abstraction technique. Given a robotic system, a workspace consisting of obstacles, manipulable objects, and locations of interest, and a co-safe LTL specification over the objects and locations, the framework computes a motion plan to achieve the task through a synergistic multi-layered planning architecture. The power of the framework is demonstrated through case studies, in which the planner efficiently computes plans for complex tasks. The case studies also illustrate the ability of the framework in intelligently moving away objects that block desired executions without requiring backtracking.

We consider the problem of computing the set of initial states of a dynamical system such that there exists a control strategy to ensure that the trajectories satisfy a temporal logic specification with probability 1 (almost-surely). We focus on discrete-time, stochastic linear dynamics and specifications given as formulas of the Generalized Reactivity(1) fragment of Linear Temporal Logic over linear predicates in the states of the system. We propose a solution based on iterative abstraction-refinement, and turn-based 2-player probabilistic games. While the theoretical guarantee of our algorithm after any finite number of iterations is only a partial solution, we show that if our algorithm terminates, then the result is the set of satisfying initial states. Moreover, for any (partial) solution our algorithm synthesizes witness control strategies to ensure almost-sure satisfaction of the temporal logic specification. We demonstrate our approach on an illustrative case study.

Software-controlled bots, also called social bots, are computer programs that act like human users on social media platforms. Recent work on detection of social bots is dominated by machine learning approaches. In this paper we explore bot detection as a model checking problem. We introduce Temporal Network Logic (TNL) which we use to specify social networks where agents can post and follow each other. In this logic we formalize different types of social bot behavior. These are formulas that are satisfied in a model of a network with bots. We provide a simple algorithm to extract a logical model from a real-life social network. We show that we can reduce TNL to a fragment of linear temporal logic with past and use this to establish the computational efficiency of model checking for social bot detection.

We present Rabinizer, a tool for translating formulae of the fragment of linear temporal logic with the operators F (eventually) and G (globally) into deterministic Rabin automata. Contrary to tools like ltl2dstar, which translate the formula into a Büchi automaton and apply Safra’s determinization procedure, Rabinizer uses a direct construction based on the logical structure of the formulae. We describe a number of optimizations of the basic procedure, crucial for the good performance of Rabinizer, and present an experimental comparison.KeywordsLinear Temporal LogicAcceptance ConditionLinear Time Temporal LogicFairness ConstraintDeterministic AutomatonThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

ASQ-IT: Interactive explanations for reinforcement-learning agents

We study the problem of efficiently computing all (usually infinitely many) facts which are entailed by a specification written in linear temporal logic (LTL)-a standard formalism for specifying and verifying properties of computations in reactive systems. This problem can be seen as a generalisation of the standard entailment checking, but whose output provides a much wider understanding of the system’s behaviour. We show that in full LTL the problem can be solved in doubly exponential time, whereas for Horn fragments of LTL, which can be seen as temporal logic programs, the problem can be solved in exponential or only quadratic time, depending on the allowed temporal operators in the input formula. Moreover, we show that all these bounds are optimal. We also implement and experimentally compare two techniques for solving the problem: an automata-based algorithm for full LTL and a materialisation-based algorithm for Horn fragments. The obtained results suggest practical usefulness of our approach.

Linear time temporal logic (LTL) has become a well established tool for specifying the dynamic behaviour of reactive systems with an interleaving semantics, and the automata-theoretic approach has proven to be a very useful mechanism for performing automatic verification in this setting. Especially alternating automata turned out to be a powerful tool in constructing efficient yet simple to understand decision procedures and directly yield further on-the-fly model checking procedures. In this paper we exhibit a decision procedure for LTL over Mazurkiewicz traces which generalises the classical automata-theoretic approach to a linear time temporal logic interpreted no longer over sequences but certain partial orders. Specifically, we construct a (linear) alternating Buchi automaton accepting the set of linearisations of traces satisfying the formula at hand. The salient point of our technique is to apply a notion of independence-rewriting to formulas of the logic. Furthermore, we show that the class of linear and trace-consistent alternating Buchi automata corresponds exactly to LTL formulas over Mazurkiewicz traces, lifting a similar result from Loding and Thomas formulated in the framework of LTL over words.

Reactive synthesis is an automated procedure to obtain a correct-by-construction reactive system from its temporal logic specification. Despite significant research progress in the past decades, reactive synthesis is still in early-stage of use. Previous studies found that the lack of development methods for reactive synthesis specifications is one barrier to its wider adoption. In this paper, we adapt two development methods, an incremental method and a modular method, to the context of reactive synthesis specifications. The methods are based on existing software development methods on the one hand and studies about reactive synthesis on the other hand. Then, we report on an exploratory case study in which participants developed specifications using the two methods. We evaluated the methods using a mixed-method analysis that combines grounded theory analysis of Slack communication with participants, quantitative exploratory data analysis of the synthesis IDE usage logs, and qualitative independent expert review of the final specifications. Our findings show clear benefits of modular specification development in terms of ease of planning, synthesis time, fewer unrealizability issues, and faster debugging. However, the incremental development method was more natural and easy to use, and specifications developed incrementally were also easier to validate during the development process.

The paper studies application of mutation analysis for validation of behavioral requirements for reactive systems. The novelty of the approach is that the suggested mutations are semantic-based and applied to natural language description of requirements. This allows to focus only on plausible potential faults and to avoid generation of mutants that are irrelevant to the intended meaning of requirements. In many cases the effect of semantic-based mutations just can't be reached by usual syntax-based mutation of LTL (Linear Temporal Logic) formulas associated with requirements. To make this approach feasible, it is applied to various types of requirements patterns presented in [1], so that mutants are themselves patterns. Formalization of patterns and their mutants in LTL enables their use for test generation, for test adequacy evaluation, and for synthesis of monitors used in run-time verification.

Distributed algorithms are present in our daily life and we depend on the correct functioning of complex distributed computing systems as, for instance, communication protocols for establishing sessions between a smartphone and a bank account or synchronisation and management of shared resources among competing processes. Generally, the design and the implementation of distributed algorithms are still error prone and it is mainly due to the relationship between the theory of distributed computing and practical techniques for designing and verifying the correctness of reliable distributed systems. Formal proofs of distributed algorithms are long, hard and tedious and the gap between the real algorithm and its formal proof is very important. In this talk, we consider the correct-by-construction approach based on the refinement of state-based models, which are progressively transformed, in order to obtain a state-based model that is translated into a distributed algorithm.The stepwise development of algorithms has been first initiated in the seminal works of Dijkstra [15], Back [7] or Morgan [23]. Next, UNITY [14] has proposed a rich framework for designing distributed algorithms combining a simple temporal logic for expressing required properties and a simple language for expressing actions modifying state variables under fairness assumption. TLA/TLA + [18] proposes a general modelling language based on a temporal ogic of actions combined with a set-theoretical modelling language for data and is extended by a specific algorithmic language namely PlusCAL, which is translated into TLA + and which is closer to the classical way to express a distributed algorithm. Finally, Event-B [2,12] is a modelling language which can describe state-based models and required safety properties. The main objective is to provide a technique for incremental and proof-based development of reactive systems. It integrates set-theoretical notations and a first-order predicate calculus, models called machines; it includes the concept of refinement expressing the simulation of machine by another one. An Event-B machine models a reactive system i.e. a system driven by its environment and reacting to its stimuli. An important property of these machines is that its events preserve the invariant properties defining a set of reachable states. The Event-B method has been developed from the classical B method [1] and it offers a general framework for developing the correct-by-construction systems by using an incremental approach for designing the models by refinement. Refinement [7,15] is a relationship relating two models such that one model is refining or simulating the other one. When an abstract model is refined by a concrete model, it means that the concrete model simulates the abstract model and that any safety property of the abstract model is also a safety property of the concrete model. In particular, the concrete model preserves the invariant properties of the abstract model. Event-B aims to express models of systems characterized by its invariant and by a list of safety properties. However, we can consider liveness properties as in UNITY [14] or TLA + [18,17] but in a restricted way.In our talk, we will summarize results related to proof-based patterns in Event-B (see for instance http://rimel.loria.fr) and ongoing works on translations of Event-B models into (distributed) algorithms. Proof-based patterns help for using refinement and for developing models from a very abstract one. The strategy for refining is a very crucial activity, when using Event-B, and the problem is to choose the abstract models that will be refined into implementable state-based models (see http://eb2all.loria.fr). We focus on the design of dustributed algorithms. For instance, the leader election protocol [3] is the kick-off case study which has led to questions on the use of Event-B for developing correct distributed algorithms: introduction of time constraints [13], probabilistic Event-B [16]. Moreover, the local computation model [25] (see http://visidia.labri.fr) has been integrated to the refinement-based approach. More recently, our joint work [21] leads to a general plugin for producing sequential algorithms from Event-B models and implement the call-as-event paradigm [19]. More recently, we extend the call-as-event paradigm by the service-as-event paradigm [22,6,4,5] and we take into account the design of distributed algorithms. Finally, we will compare the classical method [24] for verifying distributed programs and the refinement-based method that we have used in many case studies [11]. These results are used for lectures in school of cmputing engineering and master programmes and we will give some feedbacks from these experiences. Case studies [9,8,20] play a fundamental role for helping us to discover new strategies, namely proof-based patterns, for developing distributed algorithms.

A formal approach for run-time verification of web applications using scope-extended LTL

New tools and techniques are emerging to handle the complexities that might arise with the development of software systems. Reactive agent models are one such area that is emerging as a powerful paradigm in software engineering. This paper describes issues, trends, and approaches that exhibit the innovative characteristic of the reactive agent model and the design aspects of such a system. Engineering flexible agent systems has always been a challenging task. Development of such systems highlights the importance of formal specification methods. Descartes, an executable specification language, was taken into study with these complicated systems because of the importance of providing a satisfactory approach to software development. This approach enhances software development by providing a means of reduction of the gap between analysis and design. The paper concludes with proposed extensions to specification languages to support agent-based software engineering.

: This research is directed towards the implementation of a comprehensive toolkit for the development and verification of high assurance reactive systems, especially concurrent, real time, and hybrid systems. For this, we have designed and implemented the STeP (Stanford Temporal Prover) verification system. STeP is a tool for the computer aided formal verification of reactive systems, including real time and hybrid systems based on their temporal specification. STeP integrates model checking and deductive methods to allow the verification of a broad class of systems, including parameterized (N component) circuit designs, parameterized (N process) programs. and programs with infinite data domains.