ltlcross.org 49.7 KB
Newer Older
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
1
# -*- coding: utf-8 -*-
2
#+TITLE: =ltlcross=
3
#+DESCRIPTION: Spot command-line tool for cross-comparing the output of LTL translators.
4
5
#+SETUPFILE: setup.org
#+HTML_LINK_UP: tools.html
6

7
=ltlcross= is a tool for cross-comparing the output of LTL-to-automata
8
9
10
11
translators.  It is actually a Spot-based clone of [[http://www.tcs.hut.fi/Software/lbtt/][LBTT]], the
/LTL-to-Büchi Translator Testbench/, that essentially performs the
same sanity checks.

12
13
14
15
16
17
18
The main differences with LBTT are:
  - *support for PSL formulas in addition to LTL*
  - support for (non-alternating) automata with *any type of acceptance condition*,
  - support for *weak alternating automata*,
  - additional intersection *checks with the complement*, allowing
    to check equivalence of automata more precisely,
  - *more statistics*, especially:
19
20
21
22
    - the number of logical transitions represented by each physical edge,
    - the number of deterministic states and automata
    - the number of SCCs with their various strengths (nonaccepting, terminal, weak, strong)
    - the number of terminal, weak, and strong automata
23
24
25
26
27
  - an option to *reduce counterexample* by attempting to mutate and
    shorten troublesome formulas,
  - statistics output in *CSV* for easier post-processing,
  - *more precise time measurement* (LBTT was only precise to
    1/100 of a second, reporting most times as "0.00s").
28
29

Although =ltlcross= performs the same sanity checks as LBTT, it does
30
31
32
not implement any of the interactive features of LBTT.  In our almost
10-year usage of LBTT, we never had to use its interactive features to
understand bugs in our translation.  Therefore =ltlcross= will report
33
34
problems, maybe with a conterexample, but you will be on your own to
investigate and fix them.
35
36
37
38
39

The core of =ltlcross= is a loop that does the following steps:
  - Input a formula
  - Translate the formula and its negation using each configured translator.
    If there are 3 translators, the positive and negative translations
40
41
42
    will be denoted =P0=, =N0=, =P1=, =N1=, =P2=, =N2=.  Optionally
    build complemented automata denoted =Comp(P0)=, =Comp(N0)=, etc.
  - Perform sanity checks between all these automata to detect any problem.
43
  - Build the products of these automata with a random state-space (the same
44
45
    state-space for all translations).  (If the =--products=N= option is given,
    =N= products are performed instead.)
46
47
48
49
  - Gather statistics if requested.

* Formula selection

50
51
52
Formulas to translate should be specified using the [[file:ioltl.org][common input
options]].  Standard input is read if it is not connected to a terminal,
and no =-f= or =-F= options are given.
53
54
55
56
57
58
59

* Configuring translators

Each translator should be specified as a string that use some of the
following character sequences:

#+BEGIN_SRC sh :results verbatim :exports results
60
  ltlcross --help | sed -n '/character sequences:/,/^$/p' | sed '1d;$d'
61
62
#+END_SRC
#+RESULTS:
63
:   %%                         a single %
64
65
66
67
:   %f,%s,%l,%w                the formula as a (quoted) string in Spot, Spin,
:                              LBT, or Wring's syntax
:   %F,%S,%L,%W                the formula as a file in Spot, Spin, LBT, or
:                              Wring's syntax
68
69
:   %O                         the automaton is output in HOA, never claim, LBTT,
:                              or ltl2dstar's format
70
71
72
73
74

For instance here is how we could cross-compare the never claims
output by =spin= and =ltl2tgba= for the formulas =GFa= and =X(a U b)=.

#+BEGIN_SRC sh :results verbatim :exports code
75
ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%O' 'spin -f %s >%O'
76
77
78
79
#+END_SRC
#+RESULTS:

When =ltlcross= executes these commands, =%s= will be replaced
80
by the formula in Spin's syntax, and =%O= will be replaced by a
81
82
83
84
temporary file into which the output of the translator is redirected
before it is read back by =ltlcross=.

#+BEGIN_SRC sh :results verbatim :exports results
85
ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%O' 'spin -f %s >%O' 2>&1
86
87
88
89
#+END_SRC
#+RESULTS:
#+begin_example
([](<>(a)))
90
91
92
93
Running [P0]: ltl2tgba -s '([](<>(a)))' >'lcr-o0-hvzgTC'
Running [P1]: spin -f '([](<>(a)))' >'lcr-o1-iYh45L'
Running [N0]: ltl2tgba -s '(!([](<>(a))))' >'lcr-o0-z6nzjV'
Running [N1]: spin -f '(!([](<>(a))))' >'lcr-o1-8JB5F4'
94
95
96
Performing sanity checks and gathering statistics...

(X((a) U (b)))
97
98
99
100
Running [P0]: ltl2tgba -s '(X((a) U (b)))' >'lcr-o0-rqfB6d'
Running [P1]: spin -f '(X((a) U (b)))' >'lcr-o1-OUNHEn'
Running [N0]: ltl2tgba -s '(!(X((a) U (b))))' >'lcr-o0-qzVvdx'
Running [N1]: spin -f '(!(X((a) U (b))))' >'lcr-o1-eUfHTG'
101
102
Performing sanity checks and gathering statistics...

103
No problem detected.
104
105
#+end_example

106
107
108
109
110
111
112
113
To handle tools that do not support some LTL operators, the character
sequences ~%f~, ~%s~, ~%l~, ~%w~, ~%F~, ~%S~, ~%L~, and ~%W~ can be
"infixed" by a bracketed list of operators to rewrite away.  For
instance if a tool reads LTL formulas from a file in LBT's syntax, but
does not support operators ~M~ (strong until) and ~W~ (weak until),
use ~%[WM]L~ instead of just ~%L~; this way operators ~W~ and ~M~ will
be rewritten using the other supported operators.

114
=ltlcross= can only read four kinds of output:
115
116
  - Never claims (only if they are restricted to representing an
    automaton using =if=, =goto=, and =skip= statements) such as those
117
    output by [[http://spinroot.com/][=spin=]], [[http://www.lsv.ens-cachan.fr/~gastin/ltl2ba/][=ltl2ba=]], [[https://sourceforge.net/projects/ltl3ba/][=ltl3ba=]], or =ltl2tgba --spin=.  The
118
119
    newer syntax introduced by Spin 6.24, using =do= instead of =if=,
    is also supported.
120
121
122
  - [[http://www.tcs.hut.fi/Software/lbtt/doc/html/Format-for-automata.html][LBTT's format]], which supports generalized Büchi automata with
    either state-based acceptance or transition-based acceptance.
    This output is used for instance by [[http://www.tcs.hut.fi/Software/maria/tools/lbt/][=lbt=]], [[http://web.archive.org/web/20080607170403/http://www.science.unitn.it/~stonetta/modella.html][=modella=]], or =ltl2tgba
123
    --lbtt=.
124
125
  - Non-alternating automata in [[file:http://adl.github.io/hoaf/][the HOA format]] with any acceptance
    condition.
126
  - [[file:concepts.org::#property-flags][Weak]] alternating automata in [[file:http://adl.github.io/hoaf/][the HOA format]].
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
127
  - [[http://www.ltl2dstar.de/docs/ltl2dstar.html][=ltl2dstar='s format]], which supports deterministic Rabin or Streett
128
129
130
131
132
    automata.

Files in any of these format should be indicated with =%O=.  (Past
versions of =ltlcross= used different letters for each format, but the
four parsers have been merged into a single one.)
133
134
135
136
137

Of course all configured tools need not use the same =%= sequences.
The following list shows some typical configurations for some existing
tools:

138
139
140
141
  - '=spin -f %s >%O='
  - '=ltl2ba -f %s >%O='
  - '=ltl3ba -M0 -f %s >%O=' (less deterministic output, can be smaller)
  - '=ltl3ba -M1 -f %s >%O=' (more deterministic output)
142
  - '=modella -r12 -g -e %[MWei^]L %O='
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
143
  - '=/path/to/script4lbtt.py %L %O=' (script supplied by [[http://web.archive.org/web/20070214050826/http://estragon.ti.informatik.uni-kiel.de/~fritz/][ltl2nba]] for
144
    its interface with LBTT)
145
146
147
148
  - '=ltl2tgba -s %f >%O=' (smaller output, Büchi automaton)
  - '=ltl2tgba -s -D %f >%O=' (more deterministic output, Büchi automaton)
  - '=ltl2tgba -H %f >%O=' (smaller output, TGBA)
  - '=ltl2tgba -H -D %f >%O=' (more deterministic output, TGBA)
149
  - '=lbt <%L >%O='
150
  - '~ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD
151
    --output-format=hoa %[MW]L %O~' deterministic Rabin output in HOA, as
152
153
    supported since version 0.5.2 of =ltl2dstar=.
  - '~ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD --automata=streett
154
    --output-format=hoa %[MW]L %O~' deterministic Streett output in HOA,
155
    as supported since version 0.5.2 of =ltl2dstar=.
156
  - '=ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD %[MW]L %O=' (Rabin
157
158
    output in DSTAR format, as supported in older versions of
    =ltl2dstar=.
159
  - '=ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD %L - | dstar2tgba
160
    -s >%O=' (external conversion from Rabin to Büchi done by
161
162
    =dstar2tgba= for more reduction of the Büchi automaton than what
    =ltlcross= would provide)
163
  - '=java -jar Rabinizer.jar -ltl2dstar %[MW]F %O; mv %O.dst %O=' (Rabinizer
164
165
    uses the last =%O= argument as a prefix to which it always append =.dst=,
    so we have to rename =%O.dst= as =%O= so that =ltlcross= can find the file)
166
  - '~java -jar rabinizer3.1.jar -in=formula -silent -out=std -format=hoa -auto=tr %[MWRei^]f >%O~'
167
    (rabinizer 3.1 can output automata in the HOA format)
168
169
  - '=ltl3dra -f %s >%O=' (The HOA format is the default for =ltl3dra=.)
  - '=ltl3hoa -f %s >%O=' (The HOA format is the default for =ltl3hoa=.)
170

171
172
173
174
175
176
177
178
179
180
181
182
To simplify the use of some of the above tools, a set of predefined
shorthands are available.  Those can be listed with the
=--list-shorthands= option.

#+BEGIN_SRC sh :results verbatim :exports both
ltlcross --list-shorthands
#+END_SRC
#+RESULTS:
#+begin_example
If a COMMANDFMT does not use any %-sequence, and starts with one of
the following words, then the string on the right is appended.

183
184
  lbt          <%L>%O
  ltl2ba       -f %s>%O
185
186
187
  ltl2da       %f>%O
  ltl2dpa      %f>%O
  ltl2ldba     %f>%O
188
  ltl2dstar    --output-format=hoa %[MW]L %O
189
190
  ltl2tgba     -H %f>%O
  ltl3ba       -f %s>%O
191
  ltl3dra      -f %s>%O
192
  ltl3hoa      -f %f>%O
193
  modella      %[MWei^]L %O
194
  spin         -f %s>%O
195
196
197
198
199

Any {name} and directory component is skipped for the purpose of
matching those prefixes.  So for instance
  '{DRA} ~/mytools/ltl2dstar-0.5.2'
will changed into
200
  '{DRA} ~/mytools/ltl2dstar-0.5.2 --output-format=hoa %[MR]L %O'
201
202
203
#+end_example

What this implies is that running =ltlcross ltl2ba ltl3ba ...= is
204
the same as running =ltlcross 'ltl2ba -f %s>%O' 'ltl3ba -f %s>%O' ...=
205
206
207

Because only the prefix of the actual command is checked, you can
still specify some options.  For instance =ltlcross 'ltl2tgba -D' ...=
208
is short for =ltlcross 'ltl2tgba -D -H %F>%O' ...=
209

210
211
212
213
214
215
* Getting statistics

Detailed statistics about the result of each translation, and the
product of that resulting automaton with the random state-space, can
be obtained using the =--csv=FILE= or =--json=FILE= option.

216
217
** CSV or JSON output (or both!)

218
The following compare =ltl2tgba=, =spin=, and =lbt= on three random
219
formulas (where =W= and =M= operators have been rewritten away because
220
they are not supported by =spin= and =lbt=).
221
222

#+BEGIN_SRC sh :results verbatim :exports code
223
randltl -n 3 a b |
224
225
ltlfilt --remove-wm |
ltlcross --csv=results.csv \
226
227
228
         'ltl2tgba -s %f >%O' \
         'spin -f %s >%O' \
         'lbt < %L >%O'
229
230
231
232
#+END_SRC
#+RESULTS:

#+BEGIN_SRC sh :results verbatim :exports results
233
randltl -n 3 a b | ltlfilt --remove-wm |
234
ltlcross --csv=results.csv --json=results.json \
235
236
237
         'ltl2tgba -s %f >%O' \
         'spin -f %s >%O' \
         'lbt < %L >%O' --csv=results.csv 2>&1
238
239
240
#+END_SRC
#+RESULTS:
#+begin_example
241
242
243
244
245
246
247
-:1: 0
Running [P0]: ltl2tgba -s '0' >'lcr-o0-HIoc9n'
Running [P1]: spin -f 'false' >'lcr-o1-69Gi3B'
Running [P2]: lbt < 'lcr-i0-cYhaYP' >'lcr-o2-CZe2S3'
Running [N0]: ltl2tgba -s '1' >'lcr-o0-9YEpOh'
Running [N1]: spin -f 'true' >'lcr-o1-exCCOv'
Running [N2]: lbt < 'lcr-i0-DMSnRJ' >'lcr-o2-E0H9TX'
248
249
Performing sanity checks and gathering statistics...

250
251
252
253
254
255
256
-:2: !((1) U (F(!(p0))))
Running [P0]: ltl2tgba -s '!((1) U (F(!(p0))))' >'lcr-o0-ubhgZb'
Running [P1]: spin -f '!((true) U (<>(!(p0))))' >'lcr-o1-wBnwcq'
Running [P2]: lbt < 'lcr-i1-D3WcqE' >'lcr-o2-i3VTDS'
Running [N0]: ltl2tgba -s '(1) U (F(!(p0)))' >'lcr-o0-8F2eS6'
Running [N1]: spin -f '(true) U (<>(!(p0)))' >'lcr-o1-focrcl'
Running [N2]: lbt < 'lcr-i1-VgW9wz' >'lcr-o2-GbdTRN'
257
258
259
Performing sanity checks and gathering statistics...

-:3: (1) U ((G(p0)) | (F(p1)))
260
261
262
263
264
265
Running [P0]: ltl2tgba -s '(1) U ((G(p0)) | (F(p1)))' >'lcr-o0-jj8Ih2'
Running [P1]: spin -f '(true) U (([](p0)) || (<>(p1)))' >'lcr-o1-JarYMg'
Running [P2]: lbt < 'lcr-i2-yq4yiv' >'lcr-o2-Lw29NJ'
Running [N0]: ltl2tgba -s '!((1) U ((G(p0)) | (F(p1))))' >'lcr-o0-mHp6jY'
Running [N1]: spin -f '!((true) U (([](p0)) || (<>(p1))))' >'lcr-o1-pA7KVc'
Running [N2]: lbt < 'lcr-i2-ZxXHBr' >'lcr-o2-YadFhG'
266
267
Performing sanity checks and gathering statistics...

268
No problem detected.
269
270
271
272
273
274
275
276
277
#+end_example

After this execution, the file =results.csv= contains the following:

#+BEGIN_SRC sh :results verbatim :exports results
cat results.csv
#+END_SRC
#+RESULTS:
#+begin_example
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
"formula","tool","exit_status","exit_code","time","states","edges","transitions","acc","scc","nondet_states","nondet_aut","complete_aut","product_states","product_transitions","product_scc"
"0","ltl2tgba -s %f >%O","ok",0,0.0299298,1,1,0,1,1,0,0,0,1,0,1
"0","spin -f %s >%O","ok",0,0.00396246,2,2,1,1,2,0,0,0,1,0,1
"0","lbt < %L >%O","ok",0,0.00262385,1,0,0,0,1,0,0,0,1,0,1
"1","ltl2tgba -s %f >%O","ok",0,0.0261614,1,1,1,1,1,0,0,1,200,4199,1
"1","spin -f %s >%O","ok",0,0.0137128,2,2,2,1,2,0,0,1,201,4220,2
"1","lbt < %L >%O","ok",0,0.00792516,3,3,3,0,3,0,0,1,222,4653,23
"!((1) U (F(!(p0))))","ltl2tgba -s %f >%O","ok",0,0.043858,1,1,1,1,1,0,0,0,200,2059,1
"!((1) U (F(!(p0))))","spin -f %s >%O","ok",0,0.00202537,1,1,1,1,1,0,0,0,200,2059,1
"!((1) U (F(!(p0))))","lbt < %L >%O","ok",0,0.00331618,2,2,2,0,2,0,0,0,201,2071,2
"(1) U (F(!(p0)))","ltl2tgba -s %f >%O","ok",0,0.031689,2,3,4,1,2,0,0,1,400,8264,2
"(1) U (F(!(p0)))","spin -f %s >%O","ok",0,0.0026263,2,3,5,1,2,1,1,1,400,10337,2
"(1) U (F(!(p0)))","lbt < %L >%O","ok",0,0.00266354,7,13,22,2,7,4,1,1,1201,35191,604
"(1) U ((G(p0)) | (F(p1)))","ltl2tgba -s %f >%O","ok",0,0.0287222,3,5,11,1,3,1,1,0,600,11358,3
"(1) U ((G(p0)) | (F(p1)))","spin -f %s >%O","ok",0,0.00167423,4,8,24,1,4,2,1,0,800,24920,4
"(1) U ((G(p0)) | (F(p1)))","lbt < %L >%O","ok",0,0.0016987,9,17,52,2,9,4,1,0,1601,41559,805
"!((1) U ((G(p0)) | (F(p1))))","ltl2tgba -s %f >%O","ok",0,0.0308937,2,4,4,1,1,0,0,0,395,3964,1
"!((1) U ((G(p0)) | (F(p1))))","spin -f %s >%O","ok",0,0.0230605,6,18,17,1,4,5,1,0,592,8891,1
"!((1) U ((G(p0)) | (F(p1))))","lbt < %L >%O","ok",0,0.00280787,3,6,9,1,2,3,1,0,397,5957,2
297
298
#+end_example

299
300
301
302
303
This file can be loaded in any spreadsheet or statistical application.

Although we only supplied 2 random generated formulas, the output
contains 4 formulas because =ltlcross= had to translate the positive
and negative version of each.
304

305
306
307
If we had used the option =--json=results.json= instead of (or in
addition to) =--cvs=results.csv=, the file =results.json= would have
contained the following [[http://www.json.org/][JSON]] output.
308
309
310
311
312
313
314

#+BEGIN_SRC sh :results verbatim :exports results
cat results.json
#+END_SRC
#+RESULTS:
#+begin_example
{
315
  "tool": [
316
317
318
    "ltl2tgba -s %f >%O",
    "spin -f %s >%O",
    "lbt < %L >%O"
319
  ],
320
  "formula": [
321
322
323
    "0",
    "1",
    "!((1) U (F(!(p0))))",
324
325
    "(1) U (F(!(p0)))",
    "(1) U ((G(p0)) | (F(p1)))",
326
    "!((1) U ((G(p0)) | (F(p1))))"
327
  ],
328
  "fields":  [
329
  "formula","tool","exit_status","exit_code","time","states","edges","transitions","acc","scc","nondet_states","nondet_aut","complete_aut","product_states","product_transitions","product_scc"
330
  ],
331
  "inputs":  [ 0, 1 ],
332
  "results": [
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
    [ 0,0,"ok",0,0.0299298,1,1,0,1,1,0,0,0,1,0,1 ],
    [ 0,1,"ok",0,0.00396246,2,2,1,1,2,0,0,0,1,0,1 ],
    [ 0,2,"ok",0,0.00262385,1,0,0,0,1,0,0,0,1,0,1 ],
    [ 1,0,"ok",0,0.0261614,1,1,1,1,1,0,0,1,200,4199,1 ],
    [ 1,1,"ok",0,0.0137128,2,2,2,1,2,0,0,1,201,4220,2 ],
    [ 1,2,"ok",0,0.00792516,3,3,3,0,3,0,0,1,222,4653,23 ],
    [ 2,0,"ok",0,0.043858,1,1,1,1,1,0,0,0,200,2059,1 ],
    [ 2,1,"ok",0,0.00202537,1,1,1,1,1,0,0,0,200,2059,1 ],
    [ 2,2,"ok",0,0.00331618,2,2,2,0,2,0,0,0,201,2071,2 ],
    [ 3,0,"ok",0,0.031689,2,3,4,1,2,0,0,1,400,8264,2 ],
    [ 3,1,"ok",0,0.0026263,2,3,5,1,2,1,1,1,400,10337,2 ],
    [ 3,2,"ok",0,0.00266354,7,13,22,2,7,4,1,1,1201,35191,604 ],
    [ 4,0,"ok",0,0.0287222,3,5,11,1,3,1,1,0,600,11358,3 ],
    [ 4,1,"ok",0,0.00167423,4,8,24,1,4,2,1,0,800,24920,4 ],
    [ 4,2,"ok",0,0.0016987,9,17,52,2,9,4,1,0,1601,41559,805 ],
    [ 5,0,"ok",0,0.0308937,2,4,4,1,1,0,0,0,395,3964,1 ],
    [ 5,1,"ok",0,0.0230605,6,18,17,1,4,5,1,0,592,8891,1 ],
    [ 5,2,"ok",0,0.00280787,3,6,9,1,2,3,1,0,397,5957,2 ]
351
352
353
354
  ]
}
#+end_example

355
356
357
358
359
360
361
Here the =fields= table describes the columns of the =results= table.
The =inputs= tables lists the columns that are considered as inputs
for the experiments.  The values in the columns corresponding to the
fields =formula= and =tool= contains indices relative to the =formula=
and =tool= tables.  This format is more compact when dealing with lots
of translators and formulas, because they don't have to be repeated on
each line as in the CSV version.
362
363

JSON data can be easily processed in any language.  For instance the
364
365
366
367
368
following Python3 script averages each column (except the first four)
for each tool, and presents the results in a form that can almost be
copied into a LaTeX table (the =%= in the tool names have to be taken
care of).  Note that for simplicity we assume that the first two
columns are inputs, instead of reading the =inputs= field.
369
370
371
372
373

#+BEGIN_SRC python :results output :exports both
#!/usr/bin/python3
import json
data = json.load(open('results.json'))
374
datacols = range(4, len(data["fields"]))
375
# Index results by tool
376
results = { t:[] for t in range(0, len(data["tool"])) }
377
378
for l in data["results"]:
  results[l[1]].append(l)
379
# Average columns for each tool, and display them as a table
380
print("%-18s & count & %s \\\\" % ("tool", " & ".join(data["fields"][4:])))
381
for i in range(0, len(data["tool"])):
382
  c = len(results[i])
383
  sums = ["%6.1f" % (sum([x[j] for x in results[i]])/c)
384
          for j in datacols]
385
386
  print("%-18s & %3d & %s \\\\" % (data["tool"][i], c,
        " & ".join(sums)))
387
388
#+END_SRC
#+RESULTS:
389
390
391
392
: tool               & count & time & states & edges & transitions & acc & scc & nondet_states & nondet_aut & complete_aut & product_states & product_transitions & product_scc \\
: ltl2tgba -s %f >%O &   6 &    0.0 &    1.7 &    2.5 &    3.5 &    1.0 &    1.5 &    0.2 &    0.2 &    0.3 &  299.3 & 4974.0 &    1.5 \\
: spin -f %s >%O     &   6 &    0.0 &    2.8 &    5.7 &    8.3 &    1.0 &    2.5 &    1.3 &    0.5 &    0.3 &  365.7 & 8404.5 &    1.8 \\
: lbt < %L >%O       &   6 &    0.0 &    4.2 &    6.8 &   14.7 &    0.8 &    4.0 &    1.8 &    0.5 &    0.3 &  603.8 & 14905.2 &  239.5 \\
393

Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
394
395
The script =bench/ltl2tgba/sum.py= is a more evolved version of the
above script that generates two kinds of LaTeX tables.
396
397
398
399

When computing such statistics, you should be aware that inputs for
which a tool failed to generate an automaton (e.g. it crashed, or it
was killed if you used =ltlcross='s =--timeout= option to limit run
400
401
402
403
404
405
406
407
time) will appear as mostly empty lines in the CSV or JSON files,
since most statistics cannot be computed without an automaton...
Those lines with missing data can be omitted with the =--omit-missing=
option (this used to be the default up to Spot 1.2).

However data for bogus automata are still included: as shown below
=ltlcross= will report inconsistencies between automata as errors, but
it does not try to guess who is incorrect.
408

409
410
** Description of the columns

411
412
413
414
415
416
417
418
The number of column output in the CSV or JSON outputs depend on the
options passed to =ltlcross=. Additional columns will be output if
=--strength=, =--ambiguous=, =--automata=, or =--product=+N= are used.

Columns =formula= and =tool= contain the formula translated and the
command run to translate it.  In the CSV, these columns contain the
actual text.  In the JSON output, these column contains an index into
the =formula= and =tool= table declared separately.
419

420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
=exit_status= and =exit_code= are used to indicate if the translator
successfully produced an automaton, or if it failed.  On successful
translation, =exit_status= is equal to "=ok=" and =exit_code= is 0.
If the translation took more time than allowed with the =--timeout=
option, =exit_status= will contain "=timeout=" and =exit_code= will be
set to -1.  Other values are used to diagnose various issues: please
check the man-page for =ltlcross= for a list of them.

=time= obviously contains the time used by the translation.  Time is
measured with some high-resolution clock when available (that's
nanosecond accuracy under Linux), but because translator commands are
executed through a shell, it also includes the time to start a shell.
(This extra cost apply identically to all translators, so it is not unfair.)


All the values that follow will be missing if =exit_status= is not
436
equal to "=ok=".  (You may instruct =ltlcross= not to output lines with
437
438
such missing data with the option =--omit-missing=.)

439
=states=, =edges=, =transitions=, =acc= are size measures for the
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
automaton that was translated.  =acc= counts the number of acceptance
sets.  When building (degeneralized) Büchi automata, it will always be
=1=, so its value is meaningful only when evaluating translations to
generalized Büchi automata.  =edges= counts the actual number of edges
in the graph supporting the automaton; an edge (labeled by a Boolean
formula) might actually represent several transitions (each labeled by
assignment of all atomic propositions).  For instance in an automaton
where the atomic proposition are $a$ and $b$, one edge labeled by
$a\lor b$ actually represents three transitions $a b$, $a\bar b$, and
$\bar a b$.

The following picture displays two automata for the LTL formula =a U
b=.  They both have 2 states and 3 edges, however they differ in the
number of transitions (7 versus 8), because the initial self-loop is
more constrained in the first automaton.  A smaller number of
transition is therefore an indication of a more constrained automaton.

#+BEGIN_SRC dot :file edges.png :cmdline -Tpng :exports results
digraph G {
  0 [label="", style=invis, height=0]
  0 -> 1
  1 [label="A1"]
  1 -> 2 [label="b\n"]
  1 -> 1 [label="a & !b\n"]
  2 [label="B1", peripheries=2]
  2 -> 2 [label="1"]

  3 [label="", style=invis, height=0]
  3 -> 4
  4 [label="A2"]
  4 -> 5 [label="b\n"]
  4 -> 4 [label="a\n"]
  5 [label="B2", peripheries=2]
  5 -> 5 [label="1"]
}
#+END_SRC

#+RESULTS:
[[file:edges.png]]


481
482
483
=scc= counts the number of strongly-connected components in the automaton.

If option =--strength= is passed to =ltlcross=, these SCCs are
484
485
also partitioned on four sets based on their strengths:
- =nonacc_scc= for non-accepting SCCs (such as states A1 and A2 in the
486
487
488
489
490
491
492
493
  previous picture).
- =terminal_scc= for accepting SCCs where all states or edges belong
  to the same acceptance sets, and that are complete (i.e., any state
  in a terminal SCC accepts the universal language).  States
  B1 and B2 in the previous picture are two terminal SCCs.
- =weak_scc= for accepting SCCs where all states or edges belong
  to the same acceptance sets, but that are not complete.
- =strong_scc= for accepting SCCs that are not weak.
494
495
496
497
498
499
500
501
502
503

These SCC strengths can be used to compute the strength of the
automaton as a whole:
- an automaton is terminal if it contains only non-accepting or
  terminal SCCs,
- an automaton is weak if it it contains only non-accepting,
  terminal, or weak SCCs,
- an automaton is strong if it contains at least one strong SCC.

This classification is used to fill the =terminal_aut=, =weak_aut=,
504
505
506
507
=strong_aut= columns with Boolean values (still only if option
=--strength= is passed).  Only one of these should contain =1=.  We
usually prefer terminal automata over weak automata, and weak automata
over strong automata, because the emptiness check of terminal (and
508
509
510
weak) automata is easier.  When working with alternating automata, all
those strength-related columns will be empty, because the routines
used to compute those statistic do not yet support universal edges.
511
512
513
514
515
516
517
518
519

=nondetstates= counts the number of non-deterministic states in the
automaton.  =nondeterministic= is a Boolean value indicating if the
automaton is not deterministic.  For instance in the previous picture
showing two automata for =a U b=, the first automaton is deterministic
(these two fields will contain 0), while the second automaton contain
a nondeterministic state (state A2 has two possible successors for the
assignment $ab$) and is therefore not deterministic.

520
521
If option =--aumbiguous= was passed to =ltlcross=, the column
=ambiguous_aut= holds a Boolean indicating whether the automaton is
522
ambiguous, i.e., if there exists a word that can be accepted by at
523
524
least two different runs.  (This information is not yet available for
alternating automata.)
525

526
527
528
529
=complete_aut= is a Boolean indicating whether the automaton is
complete.

Columns =product_states=, =product_transitions=, and =product_scc=
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
count the number of state, transitions and strongly-connect components
in the product that has been built between the translated automaton
and a random model.  For a given formula, the same random model is of
course used against the automata translated by all tools.  Comparing
the size of these product might give another indication of the
"conciseness" of a translated automaton.

There is of course a certain "luck factor" in the size of the product.
Maybe some translator built a very dumb automaton, with many useless
states, in which just a very tiny part is translated concisely.  By
luck, the random model generated might synchronize with this tiny part
only, and ignore the part with all the useless states.  A way to
lessen this luck factor is to increase the number of products
performed against the translated automaton.  If option =--products=N=
is used, =N= products are builds instead of one, and the fields
=product_states=, =product_transitions=, and =product_scc= contain
average values.

548
549
550
551
552
553
554
555
If the option =--products=+N= is used (with a =+= in front of the
number), then no average value is computed.  Instead, three columns
=product_states=, =product_transitions=, and =product_scc= are output
for each individual product (i.e., $3\times N$ columns are output).
This might be useful if you want to compute different kind of
statistic (e.g., a median instead of a mean) or if you want to build
scatter plots of all these products.

556
557
558
559
Finally, if the =--automata= option was passed to =ltlcross=, the CSV
or JSON output will contain a column named =automaton= encoding each
produced automaton in the HOA format.

560
561
562
563
564
565
** Changing the name of the translators

By default, the names used in the CSV and JSON output to designate the
translators are the command specified on the command line.

For instance in the following, =ltl2tgba= is run in two
566
567
configurations, and the strings =ltl2tgba -s --small %f >%O= and
=ltl2tgba -s --deter %f >%O= appear verbatim in the output:
568
569

#+BEGIN_SRC sh :results verbatim :exports both
570
ltlcross -f a -f Ga 'ltl2tgba -s --small %f >%O' 'ltl2tgba -s --deter %f >%O' --csv
571
572
#+END_SRC
#+RESULTS:
573
574
575
576
577
578
579
580
581
: "formula","tool","exit_status","exit_code","time","states","edges","transitions","acc","scc","nonacc_scc","terminal_scc","weak_scc","strong_scc","nondet_states","nondet_aut","terminal_aut","weak_aut","strong_aut","product_states","product_transitions","product_scc"
: "(a)","ltl2tgba -s --small %f >%O","ok",0,0.043876,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4208,2
: "(a)","ltl2tgba -s --deter %f >%O","ok",0,0.0432137,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4208,2
: "(!(a))","ltl2tgba -s --small %f >%O","ok",0,0.0400653,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4205,2
: "(!(a))","ltl2tgba -s --deter %f >%O","ok",0,0.0450417,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4205,2
: "(G(a))","ltl2tgba -s --small %f >%O","ok",0,0.0429628,1,1,1,1,1,0,0,1,0,0,0,0,1,0,200,2077,1
: "(G(a))","ltl2tgba -s --deter %f >%O","ok",0,0.0478663,1,1,1,1,1,0,0,1,0,0,0,0,1,0,200,2077,1
: "(!(G(a)))","ltl2tgba -s --small %f >%O","ok",0,0.0436822,2,3,4,1,2,1,1,0,0,0,0,1,0,0,400,8442,2
: "(!(G(a)))","ltl2tgba -s --deter %f >%O","ok",0,0.039919,2,3,4,1,2,1,1,0,0,0,0,1,0,0,400,8442,2
582
583
584
585
586
587
588
589
590

To present these results graphically, or even when analyzing these
data, it might be convenient to give each configured tool a shorter
name.  =ltlcross= supports the specification of such short names by
looking whether the command specification for a translator has the
form "={short name}actual command=".

For instance:
#+BEGIN_SRC sh :results verbatim :exports both
591
ltlcross -f a -f Ga '{small} ltl2tgba -s --small %f >%O' '{deter} ltl2tgba -s --deter %f >%O' --csv
592
593
#+END_SRC
#+RESULTS:
594
595
596
597
598
599
600
601
602
: "formula","tool","exit_status","exit_code","time","states","edges","transitions","acc","scc","nonacc_scc","terminal_scc","weak_scc","strong_scc","nondet_states","nondet_aut","terminal_aut","weak_aut","strong_aut","product_states","product_transitions","product_scc"
: "(a)","small","ok",0,0.0433468,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4208,2
: "(a)","deter","ok",0,0.0429179,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4208,2
: "(!(a))","small","ok",0,0.0400513,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4205,2
: "(!(a))","deter","ok",0,0.040167,2,2,3,1,2,1,1,0,0,0,0,1,0,0,201,4205,2
: "(G(a))","small","ok",0,0.0447826,1,1,1,1,1,0,0,1,0,0,0,0,1,0,200,2077,1
: "(G(a))","deter","ok",0,0.0439892,1,1,1,1,1,0,0,1,0,0,0,0,1,0,200,2077,1
: "(!(G(a)))","small","ok",0,0.0444007,2,3,4,1,2,1,1,0,0,0,0,1,0,0,400,8442,2
: "(!(G(a)))","deter","ok",0,0.0396312,2,3,4,1,2,1,1,0,0,0,0,1,0,0,400,8442,2
603

604
* Detecting problems
605
606
607
   :PROPERTIES:
   :CUSTOM_ID: checks
   :END:
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622

If a translator exits with a non-zero status code, or fails to output
an automaton =ltlcross= can read, and error will be displayed and the
result of the translation will be discarded.

Otherwise =ltlcross= performs the following checks on all translated
formulas ($P_i$ and $N_i$ designate respectively the translation of
positive and negative formulas by the ith translator).

  - Intersection check: $P_i\otimes N_j$ must be empty for all
    pairs of $(i,j)$.

    A single failing translator might generate a lot of lines of
    the form:

623
    : error: P0*N1 is nonempty; both automata accept the infinite word:
624
    :        cycle{p0 & !p1}
625
    : error: P1*N0 is nonempty; both automata accept the infinite word:
626
    :        p0; !p1; cycle{p0 & p1}
627
    : error: P1*N1 is nonempty; both automata accept the infinite word:
628
    :        p0; cycle{!p1 & !p0}
629
    : error: P1*N2 is nonempty; both automata accept the infinite word:
630
    :        p0; !p1; cycle{p0 & p1}
631
    : error: P1*N3 is nonempty; both automata accept the infinite word:
632
    :        p0; !p1; cycle{p0 & p1}
633
    : error: P1*N4 is nonempty; both automata accept the infinite word:
634
    :        p0; cycle{!p1 & !p0}
635
    : error: P2*N1 is nonempty; both automata accept the infinite word:
636
    :        p0; !p1; !p0; cycle{!p1 & !p0; p0 & !p1; !p1; !p1; p0 & !p1}
637
    : error: P3*N1 is nonempty; both automata accept the infinite word:
638
    :        p0; !p1; !p1 & !p0; cycle{p0 & !p1}
639
    : error: P4*N1 is nonempty; both automata accept the infinite word:
640
    :        p0; !p1; !p1 & !p0; cycle{p0 & !p1}
641
642

    In this example, translator number =1= looks clearly faulty
643
644
645
646
647
648
    (at least the other 4 translators do not contradict each other).

    Examples of infinite words that are accepted by both automata
    always have the form of a lasso: a (possibly empty) finite prefix
    followed by a cycle that should be repeated infinitely often.
    The cycle part is denoted by =cycle{...}=.
649

650
  - Complemented intersection check.  If $P_i$ and $N_i$ are
651
    deterministic, =ltlcross= builds their complements, $Comp(P_i)$
652
653
654
655
    and $Comp(N_i)$, and then ensures that $Comp(P_i)\otimes
    Comp(N_i)$ is empty.  If only one of them is deterministic, for
    instance $P_i$, we check that $P_j\otimes Comp(P_i)$ for all $j
    \ne i$; likewise if it's $N_i$ that is deterministic.
656

657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
    By default this check is only done for deterministic automata,
    because complementation is relatively cheap is that case (at least
    it is cheap for simple acceptance conditions).  Using option
    =--determinize=, =ltlcross= can be instructed to perform
    complementation of non-deterministic automata as well, ensuring
    precise equivalence checks between all automata.  However be aware
    that this determinization + complementation may generate large
    automata.

    When validating a translator with =ltlcross= without using the
    =--determinize= option we highly recommend to include a translator
    with good deterministic output to augment test coverage.  Using
    '=ltl2tgba -lD %f >%O=' will produce deterministic automata for
    all obligation properties and many recurrence properties.  Using
    '=ltl2dstar --ltl2nba=spin:pathto/ltl2tgba@-Ds %L %O=' will
    systematically produce a deterministic Rabin automaton (that
    =ltlcross= can complement easily).
674

675
676
677
678
679
680
  - Cross-comparison checks: for some state-space $S$,
    all $P_i\otimes S$ are either all empty, or all non-empty.
    Similarly all $N_i\otimes S$ are either all empty, or all non-empty.

    A cross-comparison failure could be displayed as:

681
682
683
684
    : error: {P0,P2} disagree with {P1} when evaluating the state-space
    :        the following word(s) are not accepted by {P1}:
    :  P0 accepts: p0 & !p1 & !p2 & p3; p0 & p1 & !p2 & p3; p0 & p1 & p2 & p3; cycle{p0 & p1 & p2 & p3; p0 & p1 & !p2 & !p3; p0 & p1 & p2 & !p3; p0 & p1 & !p2 & !p3}
    :  P2 accepts: p0 & !p1 & !p2 & p3; cycle{p0 & p1 & !p2 & !p3; p0 & p1 & p2 & p3; p0 & p1 & !p2 & p3}
685

686
687
688
689
690
    If =--products=N= is used with =N= greater than one, the number of
    the state-space is also printed.  This number is of no use by
    itself, except to explain why you may get multiple disagreement
    between the same sets of automata.

691
692
693
694
695
696
697
    These products tests may sometime catch errors that were not
    captured by the first two tests if one non-deterministic automaton
    recognize less words than what it should.  If the input automata
    are deterministic or the =--determinize= option is used, this test
    is redundant and can be disabled.  (In fact, the =--determinize=
    option implies option =--product=0= to do so.)

698
699
700
701
702
703
704
705
706
707
708
  - Consistency check:

    For each $i$, the products $P_i\otimes S$ and $N_i\otimes S$
    actually cover all states of $S$.  Because $S$ does not have any
    deadlock, any of its infinite path must be accepted by $P_i$ or
    $N_i$ (or both).

    An error in that case is displayed as

    : error: inconsistency between P1 and N1

709
710
711
712
    If =--products=N= is used with =N= greater than one, the number of
    the state-space in which the inconsistency was detected is also
    printed.

713
714
715
716
717
718
719
    This test may catch errors that were not captured by the first two
    tests if one non-deterministic automaton recognize less words than
    what it should.  If the input automata are deterministic or the
    =--determinize= option is used, this test is redundant and can be
    disabled.  (In fact, the =--determinize= option implies option
    =--product=0= to do so.)

720
721
722
The above checks are similar to those that are performed by [[http://www.tcs.hut.fi/Software/lbtt/][LBTT]],
except for the complemented intersection check, which is only done in
=ltlcross=.
723
724
725
726
727
728
729
730
731
732

If any problem was reported during the translation of one of the
formulas, =ltlcheck= will exit with an exit status of =1=.  Statistics
(if requested) are output nonetheless, and include any faulty
automaton as well.

* Miscellaneous options

** =--stop-on-error=

733
734
735
The =--stop-on-error= option will cause =ltlcross= to abort on the
first detected error.  This include failure to start some translator,
read its output, or failure to passe the sanity checks.  Timeouts are
736
737
738
739
740
741
742
743
744
745
allowed.

One use for this option is when =ltlcross= is used in combination with
=randltl= to check translators on an infinite stream of formulas.

For instance the following will cross-compare =ltl2tgba= against
=ltl3ba= until it finds an error, or your interrupt the command, or it
runs out of memory (the hash tables used by =randltl= and =ltlcross=
to remove duplicate formulas will keep growing).

746
#+BEGIN_SRC sh :exports code :eval no
747
randltl -n -1 --tree-size 10..25 a b c | ltlcross --stop-on-error 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
748
749
#+END_SRC

750
751
752
753
754
755
756
757
758
759
760
761
762
** =--save-bogus=FILENAME=

The =--save-bogus=FILENAME= will save any formula for which an error
was detected (either some translation failed, or some problem was
detected using the resulting automata) in =FILENAME=.  Again, timeouts
are not considered to be errors, and therefore not reported in this
file.

The main use for this feature is in conjunction with =randltl='s
generation of random formulas.  For instance the following command
will run the translators on an infinite number of formulas, saving
any problematic formula in =bugs.ltl=.

763
#+BEGIN_SRC sh :exports code :eval no
764
randltl -n -1 --tree-size 10..25 a b c | ltlcross --save-bogus=bugs.ltl 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
765
766
767
768
769
#+END_SRC

You can periodically check the contents of =bugs.ltl=, and then run
=ltlcross= only on those formulas to look at the problems:

770
#+BEGIN_SRC sh :exports code :eval no
771
ltlcross -F bugs.ltl 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
772
773
#+END_SRC

774
** =--grind=FILENAME=
775

776
777
778
This option tells =ltlcross= that, when a problem is detected, it
should try to find a smaller formula that still exhibits the
problem.
779

780
781
782
783
784
785
786
Here is the procedure used:
   - internally list the mutations of the bogus formula and sort
     them by length (as [[file:ltlgrind.org][=ltlgrind --sort=]] would do)
   - process every mutation until one is found that exhibit the bug
   - repeat the process with this new formula, and again until a formula
     is found for which no mutation exhibit the bug
   - output that last formula in =FILENAME=
787

788
789
790
791
792
If =--save-bogus=OTHERFILENAME= is provided, every bogus formula found
during the process will be saved in =OTHERFILENAME=.

Example:
#+BEGIN_SRC sh :exports code :results verbatim
793
ltlcross -f '(G!b & (!c | F!a)) | (c & Ga & Fb)' "modella %L %O" \
794
795
796
  --save-bogus=bogus \
  --grind=bogus-grind
#+END_SRC
797
#+BEGIN_SRC sh :exports results :results verbatim
798
ltlcross -f '(G!b & (!c | F!a)) | (c & Ga & Fb)' "modella %L %O" \
799
800
801
  --save-bogus=bogus --grind=bogus-grind 2>&1
true
#+END_SRC
802
#+RESULTS:
803
804
#+begin_example
| & G ! p0 | ! p1 F ! p2 & & p1 G p2 F p0
805
806
Running [P0]: modella 'lcr-i0-FUPmeY' 'lcr-o0-F3bZRp'
Running [N0]: modella 'lcr-i0-ebjQwR' 'lcr-o0-20eIbj'
807
Performing sanity checks and gathering statistics...
808
error: P0*N0 is nonempty; both automata accept the infinite word:
809
810
       cycle{!p0 & !p1}

811
812
Trying to find a bogus mutation of (G!b & (!c | F!a)) | (c & Ga & Fb)...
Mutation 1/22: & & p0 G p1 F p2
813
814
Running [P0]: modella 'lcr-i1-zXEyXK' 'lcr-o0-RsypJc'
Running [N0]: modella 'lcr-i1-Ux7xvE' 'lcr-o0-x19Gh6'
815
816
Performing sanity checks and gathering statistics...

817
Mutation 2/22: & G ! p0 | ! p1 F ! p2
818
819
Running [P0]: modella 'lcr-i2-syS74x' 'lcr-o0-wPRySZ'
Running [N0]: modella 'lcr-i2-x9DdGr' 'lcr-o0-fgHStT'
820
821
Performing sanity checks and gathering statistics...

822
Mutation 3/22: | G ! p0 & & p1 G p2 F p0
823
824
Running [P0]: modella 'lcr-i3-rVOAil' 'lcr-o0-jU2i7M'
Running [N0]: modella 'lcr-i3-KATfWe' 'lcr-o0-2UOcLG'
825
Performing sanity checks and gathering statistics...
826
error: P0*N0 is nonempty; both automata accept the infinite word:
827
828
       cycle{!p0 & !p1}

829
830
Trying to find a bogus mutation of G!b | (c & Ga & Fb)...
Mutation 1/16: t
831
832
Running [P0]: modella 'lcr-i4-OJk2B8' 'lcr-o0-VVCSsA'
Running [N0]: modella 'lcr-i4-nKwTj2' 'lcr-o0-npMUau'
833
834
Performing sanity checks and gathering statistics...

835
Mutation 2/16: G ! p0
836
837
Running [P0]: modella 'lcr-i5-Waoe2V' 'lcr-o0-9wsyTn'
Running [N0]: modella 'lcr-i5-M0R2KP' 'lcr-o0-uhmxCh'
838
839
Performing sanity checks and gathering statistics...

840
Mutation 3/16: & & p0 G p1 F p2
841
842
843
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

844
Mutation 4/16: | G ! p0 & p1 F p0
845
846
Running [P0]: modella 'lcr-i6-OtIGuJ' 'lcr-o0-qBEQmb'
Running [N0]: modella 'lcr-i6-MGbcfD' 'lcr-o0-t93x74'
847
Performing sanity checks and gathering statistics...
848
error: P0*N0 is nonempty; both automata accept the infinite word:
849
850
       cycle{!p0 & !p1}

851
852
Trying to find a bogus mutation of G!b | (c & Fb)...
Mutation 1/10: t
853
854
855
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

856
Mutation 2/10: G ! p0
857
858
859
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

860
Mutation 3/10: & p0 F p1
861
862
Running [P0]: modella 'lcr-i7-4oa00w' 'lcr-o0-3IEsUY'
Running [N0]: modella 'lcr-i7-vyy5Nq' 'lcr-o0-nXOIHS'
863
864
Performing sanity checks and gathering statistics...

865
Mutation 4/10: | p0 G ! p1
866
867
Running [P0]: modella 'lcr-i8-Kt48Bk' 'lcr-o0-xeIzwM'
Running [N0]: modella 'lcr-i8-ye5are' 'lcr-o0-3QMMlG'
868
869
Performing sanity checks and gathering statistics...

870
Mutation 5/10: | G ! p0 F p0
871
872
Running [P0]: modella 'lcr-i9-Bpmah8' 'lcr-o0-38lycA'
Running [N0]: modella 'lcr-i9-cQJ771' 'lcr-o0-yUcH3t'
873
874
Performing sanity checks and gathering statistics...

875
Mutation 6/10: | ! p0 & p1 F p0
876
877
Running [P0]: modella 'lcr-i10-mYtDZV' 'lcr-o0-nCdAVn'
Running [N0]: modella 'lcr-i10-d1fIRP' 'lcr-o0-oAsQNh'
878
879
Performing sanity checks and gathering statistics...

880
881
882
Mutation 7/10: | & p1 F p0 G p0
Running [P0]: modella 'lcr-i11-petsKJ' 'lcr-o0-Z3U4Gb'
Running [N0]: modella 'lcr-i11-bmFSDD' 'lcr-o0-P1DGA5'
883
884
Performing sanity checks and gathering statistics...

885
Mutation 8/10: | & p0 p1 G ! p0
886
887
Running [P0]: modella 'lcr-i12-eUjByx' 'lcr-o0-DZAwwZ'
Running [N0]: modella 'lcr-i12-v3JCur' 'lcr-o0-IzWIsT'
888
889
Performing sanity checks and gathering statistics...

890
Mutation 9/10: | G ! p0 & p0 F p0
891
892
Running [P0]: modella 'lcr-i13-Sb2Arl' 'lcr-o0-kBwtqN'
Running [N0]: modella 'lcr-i13-Tctwpf' 'lcr-o0-hvIzoH'
893
Performing sanity checks and gathering statistics...
894
error: P0*N0 is nonempty; both automata accept the infinite word:
895
896
       cycle{!p0}

897
898
Trying to find a bogus mutation of G!c | (c & Fc)...
Mutation 1/7: t
899
900
901
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

902
Mutation 2/7: G ! p0
903
904
905
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

906
Mutation 3/7: & p0 F p0
907
908
Running [P0]: modella 'lcr-i14-iDAoo9' 'lcr-o0-6vSdoB'
Running [N0]: modella 'lcr-i14-WMIdo3' 'lcr-o0-NxEdov'
909
910
Performing sanity checks and gathering statistics...

911
Mutation 4/7: | p0 G ! p0
912
913
Running [P0]: modella 'lcr-i15-lS5FoX' 'lcr-o0-XFX8op'
Running [N0]: modella 'lcr-i15-8IdNpR' 'lcr-o0-0Bxrqj'
914
915
Performing sanity checks and gathering statistics...

916
Mutation 5/7: | G ! p0 F p0
917
918
919
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

920
Mutation 6/7: | ! p0 & p0 F p0
921
922
Running [P0]: modella 'lcr-i16-7boQrL' 'lcr-o0-wsIftd'
Running [N0]: modella 'lcr-i16-tk8OuF' 'lcr-o0-9wQow7'
923
924
Performing sanity checks and gathering statistics...

925
926
927
Mutation 7/7: | G p0 & p0 F p0
Running [P0]: modella 'lcr-i17-wnlkyz' 'lcr-o0-MAjgA1'
Running [N0]: modella 'lcr-i17-qFLnCt' 'lcr-o0-45gvEV'
928
929
Performing sanity checks and gathering statistics...

930
Smallest bogus mutation found for (G!b & (!c | F!a)) | (c & Ga & Fb) is G!c | (c & Fc).
931
932
933
934

error: some error was detected during the above runs.
       Check file bogus for problematic formulas.
#+end_example
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951

#+BEGIN_SRC sh :exports both :results verbatim
cat bogus
#+END_SRC

#+RESULTS:
: (G!b & (!c | F!a)) | (c & Ga & Fb)
: G!b | (c & Ga & Fb)
: G!b | (c & Fb)
: G!c | (c & Fc)

#+BEGIN_SRC sh :exports both :results verbatim
cat bogus-grind
#+END_SRC

#+RESULTS:
: G!c | (c & Fc)
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970

** =--no-check=

The =--no-check= option disables all sanity checks, and only use the supplied
formulas in their positive form.

When checks are enabled, the negated formulas are intermixed with the
positives ones in the results.  Therefore the =--no-check= option can
be used to gather statistics about a specific set of formulas.


#  LocalWords:  ltlcross num toc LTL Büchi LBTT Testbench PSL SRC sed
#  LocalWords:  automata LBT LBTT's ltl tgba GFa lck iDGV sA FYp BYY
#  LocalWords:  ClVQg wyErP UNE dQ coM tH eHPoQy goto ba lbt modella
#  LocalWords:  lbtt csv json randltl ltlfilt wm eGEYaZ nYpFBX fGdZQ
#  LocalWords:  CPs kXiZZS ILLzR wU CcMCaQ IOckzW tsT RZ TJXmT jb XRO
#  LocalWords:  nxqfd hS vNItGg acc scc nondetstates nondeterministic
#  LocalWords:  cvs LaTeX datacols len ith otimes ltlcheck eval setq
#  LocalWords:  setenv concat getenv
971
972
973
974
975
976
** =--verbose=

The verbose option can be useful to troubleshoot problems or simply
follow the list of transformations and tests performed by =ltlcross=.

For instance here is what happens if we try to cross check =ltl2tgba=
977
978
979
and =ltl3ba -H1= on the formula =FGa=.  Note that =ltl2tgba= will
produce transition-based generalized Büchi automata, while =ltl3ba
-H1= produces co-Büchi alternating automata.
980
981

#+BEGIN_SRC sh :results verbatim :exports code
982
ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --determinize --verbose
983
984
985
#+END_SRC

#+BEGIN_SRC sh :results verbatim :exports results
986
SPOT_HOA_TOLERANT=1 ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --determinize --verbose 2>&1
987
988
989
990
991
#+END_SRC

#+RESULTS:
#+begin_example
F(G(a))
992
993
994
995
Running [P0]: ltl2tgba -H 'F(G(a))'>'lcr-o0-opbyhq'
Running [P1]: ltl3ba -H1 -f '<>([](a))'>'lcr-o1-aP47sS'
Running [N0]: ltl2tgba -H '!(F(G(a)))'>'lcr-o0-UV1eFk'
Running [N1]: ltl3ba -H1 -f '!(<>([](a)))'>'lcr-o1-bFSrTM'
996
997
998
999
info: collected automata:
info:   P0	(2 st.,3 ed.,1 sets)
info:   N0	(1 st.,2 ed.,1 sets) deterministic complete
info:   P1	(2 st.,3 ed.,1 sets)
1000
info:   N1	(3 st.,5 ed.,1 sets) univ-edges complete
1001
Performing sanity checks and gathering statistics...
1002
1003
info: getting rid of universal edges...
info:   N1	(3 st.,5 ed.,1 sets) -> (2 st.,4 ed.,1 sets)
1004
1005
1006
1007
info: complementing non-deterministic automata via determinization...
info:   P0	(2 st.,3 ed.,1 sets) -> (2 st.,4 ed.,2 sets)	Comp(P0)
info:   P1	(2 st.,3 ed.,1 sets) -> (2 st.,4 ed.,2 sets)	Comp(P1)
info: getting rid of any Fin acceptance...
1008
info:	Comp(P0)	(2 st.,4 ed.,2 sets) -> (2 st.,4 ed.,1 sets)
1009
info:	Comp(N0)	(1 st.,2 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1010
info:	     P1 	(2 st.,3 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1011
info:	Comp(P1)	(2 st.,4 ed.,2 sets) -> (2 st.,4 ed.,1 sets)
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
info:	Comp(N1)	(2 st.,4 ed.,1 sets) -> (3 st.,6 ed.,1 sets)
info: check_empty P0*N0
info: check_empty Comp(N0)*Comp(P0)
info: check_empty P0*N1
info: check_empty P1*N0
info: check_empty P1*N1
info: check_empty Comp(N1)*Comp(P1)

No problem detected.
#+end_example

First =FGa= and its negations =!FGa= are translated with the two
1024
tools, resulting in four automata: two positive automata =P0= and =P1=
1025
1026
for =FGa=, and two negative automata =N0= and =N1=.

1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
Some basic information about the collected automata are displayed.
For instance we can see that although =ltl3ba -H1= outputs co-Büchi
alternating automata, only automaton =N1= uses universal edges: the
automaton =P1= can be used like a non-alternating co-Büchi automaton.

=ltlcross= then proceeds to transform alternating automata (only weak
alternating automata are supported) into non-alternating automata.
Here only =N1= needs this transformation.

Then =ltlcross= computes the complement of these four
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
automata.  Since =P0= and =P1= are nondeterministic and the
=--determinize= option was given, a first pass determinize and
complete these two automata, creating =Comp(P0)= and =Comp(P1)=.

Apparently =N0= and =N1= are already deterministic, so their
complement could be obtained by just complementing their acceptance
condition (this is not written -- we only deduce so because they do
not appear in the list of automata that had to be determinized).

Now that =ltlcross= has four complemented automata, it has to make
sure they use only =Inf= acceptance because that is what our emptiness
check procedure can handle.  So there is a new pass over all automata,
rewriting them to get rid of any =Fin= acceptance.

After this preparatory work, it is time for actually comparing these
automata.  Together, the tests =P0*N0= and =Comp(N0)*Comp(P0)= ensure
that the automaton =N0= is really the complement of =P0=.  Similarly
=P1*N1= and =Comp(N1)*Comp(P1)= ensure that =N1= is the complement of
=P1=.  Finally =P0*N1= and =P1*N0= ensure that =P1= is equivalent to
=P0= and =N1= is equivalent to =N0=.



Note that if we had not used the =--determinize= option, the procedure
would look slightly more complex:

#+BEGIN_SRC sh :results verbatim :exports code
1064
ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --verbose
1065
1066
1067
#+END_SRC

#+BEGIN_SRC sh :results verbatim :exports results
1068
SPOT_HOA_TOLERANT=1 ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --verbose 2>&1
1069
1070
1071
1072
1073
#+END_SRC

#+RESULTS:
#+begin_example
F(G(a))
1074
1075
1076
1077
Running [P0]: ltl2tgba -H 'F(G(a))'>'lcr-o0-cq9s5c'
Running [P1]: ltl3ba -H1 -f '<>([](a))'>'lcr-o1-Fb0iii'
Running [N0]: ltl2tgba -H '!(F(G(a)))'>'lcr-o0-X5dGvn'
Running [N1]: ltl3ba -H1 -f '!(<>([](a)))'>'lcr-o1-tLO5Ks'
1078
1079
1080
1081
info: collected automata:
info:   P0	(2 st.,3 ed.,1 sets)
info:   N0	(1 st.,2 ed.,1 sets) deterministic complete
info:   P1	(2 st.,3 ed.,1 sets)
1082
info:   N1	(3 st.,5 ed.,1 sets) univ-edges complete
1083
Performing sanity checks and gathering statistics...
1084
1085
info: getting rid of universal edges...
info:   N1	(3 st.,5 ed.,1 sets) -> (2 st.,4 ed.,1 sets)
1086
1087
info: getting rid of any Fin acceptance...
info:	Comp(N0)	(1 st.,2 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1088
info:	     P1 	(2 st.,3 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
info:	Comp(N1)	(2 st.,4 ed.,1 sets) -> (3 st.,6 ed.,1 sets)
info: check_empty P0*N0
info: check_empty P0*N1
info: check_empty Comp(N0)*N1
info: check_empty P1*N0
info: check_empty Comp(N1)*N0
info: check_empty P1*N1
info: building state-space #0/1 of 200 states with seed 0
info: state-space has 4136 edges
info: building product between state-space and P0 (2 st., 3 ed.)
info:   product has 400 st., 8298 ed.
info:               2 SCCs
info: building product between state-space and P1 (2 st., 3 ed.)
info:   product has 400 st., 8298 ed.
info:               2 SCCs
info: building product between state-space and N0 (1 st., 2 ed.)
info:   product has 200 st., 4136 ed.
info:               1 SCCs
info: building product between state-space and N1 (2 st., 4 ed.)
info:   product has 400 st., 8272 ed.
info:               1 SCCs
info: cross_check {P0,P1}, state-space #0/1
info: cross_check {N0,N1}, state-space #0/1
info: consistency_check (P0,N0), state-space #0/1
info: consistency_check (P1,N1), state-space #0/1

No problem detected.
#+end_example

In this case, =ltlcross= does not have any complement automaton for
=P0= and =P1=, so it cannot make sure that =P0= and =P1= are
equivalent.  If we imagine for instance that =P0= has an empty
language, we can see that the six =check_empty= tests would still
succeed.

So =ltlcross= builds a random state-space of 200 states, synchronize
it with the four automata, and then performs additional checks
(=cross_check= and =consistency_check=) on these products as described
[[#checks][earlier]].  While these additional checks do not make a proof that =P0=
and =P1= are equivalent, they can catch some problems, and would
easily catch the case of an automaton with an empty language by
mistake.