2.2 Model checking
2.2.5 Complexity results for model checking
Traditionally, given a formula ϕ and a model M = (S, R, V ), the complexity of temporal logics model checking is expressed as a function of the size of the model |M | and of the size of the formula ϕ, where |M | is defined as the sum of the number of states in S and the number of elements in R, while |ϕ| is defined as the number of symbols appearing in ϕ.
CTL. The algorithm presented in Figure 2.4 provides an upper bound for the complexity of CTL model checking. Indeed, the algorithm always terminates after at most |M | · |ϕ| steps, and thus model checking for CTL is in P [Clarke et al., 1986]. A proof for the P-hardness of CTL model checking is presented in [Schnoebelen, 2003], which allows to conclude that the problem of model checking for CTL is P-complete.
Logic Complexity CTL [Clarke et al., 1986, Schnoebelen, 2003] P-complete
LTL [Sistla and Clarke, 1985] PSPACE-complete CTL* [Clarke et al., 1986, Sistla and Clarke, 1985] PSPACE-complete
µ-calculus [Kupferman et al., 2000] ∈ NP ∩ co-NP Table 2.7: The complexity of model checking for some temporal logics.
LTL. The complexity of LTL model checking was investigated in [Sistla and Clarke, 1985]. Given a formula ϕ and a model M , the problem of model checking for LTL is reduced to the satisfiability problem for an LTL formula. Intuitively, an LTL formula ϕM is constructed in polynomial time to encode the valid runs of M , and it is shown
that M |= ϕ iff ϕM =⇒ ϕ is a valid LTL formula. Therefore, Theorem 2.1.5 provides
a PSPACE upper bound for LTL model checking. A corresponding lower bound is presented in [Sistla and Clarke, 1985], which allows to conclude that the problem of model checking for LTL is PSPACE-complete.
The complexity of model checking for CTL, for LTL, and for other temporal logics is presented in Table 2.7.
The results presented above, however, do not apply to the verification of programs written in one of the languages presented in the previous section (i.e., PROMELA, Reactive- Modules, and SMV). In these practical instances, states and relations of temporal models are not listed explicitly. Instead, a compact description is usually given. Thus, the com- plexity of model checking needs to be investigated in terms of the size of the formula and of the size of the program representing the model.
Among others, concurrent programs [Kupferman et al., 2000] offer a suitable framework to investigate the complexity of model checking when compact representations are used, because various languages can be reduced to concurrent programs. Formally, a program is a tuple D = hAP, AC, S, ∆, s0, Li, where AP is a set of atomic propositions, AC is a set of
actions, S is a set of states, ∆ : S × AC → S is a transition function, s0 is an initial state, and L : S → 2AP is a valuation function. Given n programs D
i= hAPi, ACi, Si,∆i, s0i, Lii
(i ∈ {1, . . . , n}), a concurrent program DC = hAPC, ACC, SC,∆C, s0C, LCi is defined as
the parallel composition of the n programs Di, as follows:
• APC = ∪1≤i≤nAPi;
• ACC = ∪1≤i≤nACi;
• SC =Q1≤i≤nSi;
• (s, a, s′) ∈ ∆ C iff
nent of a state s ∈ S. – if a 6∈ ACi, then s[i] = s′[i];
• LC(s) = ∪iLi(s[i]).
(in the remainder, the subscript C is dropped when this is clear from the context). CTL formulae can be interpreted in a (concurrent) program D by using the standard Kripke semantics for CTL formulae in a model M = (S, R, V ). For this, define the set of states S of M to be set of states S of D, the temporal relation R to be ∆, and the evaluation function V to be L (more details can be found in [Kupferman et al., 2000]). By slight abuse of notation, the term “Kripke models” is used occasionally below when referring to the programs Di and to D.
The program complexity of model checking is defined as the complexity of model check- ing for a given, fixed formula. Program complexity results for some temporal logics are presented in Table 2.8.
Logic Program complexity CTL NLOGSPACE-complete CTL∗ NLOGSPACE-complete µ-calculus P-complete
Table 2.8: Program complexity of model checking for some temporal logics, from [Kupferman et al., 2000].
By analysing the program complexity of model checking concurrent programs, the authors of [Kupferman et al., 2000] obtain complexity results for various temporal logics. Their results are based on the definition of various kind of automata, extending the concepts presented in Section 2.2.2.4. Table 2.9 presents their main results.
Logic Program complexity Overall complexity CTL PSPACE-complete PSPACE-complete CTL∗ PSPACE-complete PSPACE-complete µ-calculus EXP-complete EXP
Table 2.9: Program complexity and complexity of model checking for some temporal logics using concurrent programs [Kupferman et al., 2000].
The complexity of model checking tools and techniques. The results presented above provide a lower bound for the problem of model checking temporal models specified using PROMELA, ReactiveModules, and SMV. Indeed, a generic concurrent program Dcan be encoded using any of the languages above. For instance, an SMV module can be associated to each program Di appearing in D, and a similar approach can be employed
for PROMELA and ReactiveModules. Upper bound results for model checking some programming languages for multi-agent systems are provided in Section 6.5.5, page 125.
Also, the worst case complexity of model checking tools can be analysed.
• SPIN implements the automata-based techniques presented in Section 2.2.2.4; their complexity is linear in the size of the model [Clarke et al., 1986]. However, the size of the model is exponential in the number of processes used in the PROMELA specification. Thus, although many optimisation techniques have been implemented in SPIN, in the worst case the complexity of model checking a PROMELA program using SPIN requires exponential time.
• SMV and MOCHA use (an extension of) the labelling algorithm presented in Fig- ure 2.4, whose complexity is linear in the size of the model. As above, however, the model has a size exponential in the number of modules employed in the program- ming language. On average, obdd-based techniques may reduce the space required by the labelling algorithm (and, thus, the time required to perform model checking), but it was shown [Bryant, 1991] that for certain problems obdds have an exponen- tial size, irrespective of the chosen ordering of the variables. Some operations on obdds, such as reduction to canonical form and composition, require time linear in the size of the obdds; Boolean quantification, instead, may require exponential time. These results imply that in the worst case obdd-based model checking may require a double-exponential time.
• NuSMV implements SAT-based techniques for LTL, as presented in Section 2.2.2.3. It has been shown in [Clarke et al., 2004b] that the Boolean formulae generated using SAT-based techniques may have a number of variables which is exponential in the size of the input program. Algorithms for Boolean satisfiability may require, in the worst case, an exponential time; thus, SAT-based techniques for model checking are, in the worst case, doubly exponential in the size of the input.