ltlcross.org 75.2 KB
Newer Older
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
1
# -*- coding: utf-8 -*-
2
#+TITLE: =ltlcross=
3
#+DESCRIPTION: Spot command-line tool for cross-comparing the output of LTL translators.
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
4
#+INCLUDE: setup.org
5
#+HTML_LINK_UP: tools.html
6
7
#+PROPERTY: header-args:sh :results verbatim :exports both
#+PROPERTY: header-args:R :session :results output :exports both
8

9
=ltlcross= is a tool for cross-comparing the output of LTL-to-automata
10
11
12
13
translators.  It is actually a Spot-based clone of [[http://www.tcs.hut.fi/Software/lbtt/][LBTT]], the
/LTL-to-Büchi Translator Testbench/, that essentially performs the
same sanity checks.

14
15
16
17
The main differences with LBTT are:
  - *support for PSL formulas in addition to LTL*
  - support for (non-alternating) automata with *any type of acceptance condition*,
  - support for *weak alternating automata*,
18
19
  - additional intersection *checks with the complement* allowing to
    check equivalence of automata more precisely,
20
  - *more statistics*, especially:
21
22
23
24
    - the number of logical transitions represented by each physical edge,
    - the number of deterministic states and automata
    - the number of SCCs with their various strengths (nonaccepting, terminal, weak, strong)
    - the number of terminal, weak, and strong automata
25
  - an option to *reduce counterexamples* by attempting to mutate and
26
    shorten troublesome formulas (option =--grind=),
27
28
29
  - statistics output in *CSV* for easier post-processing,
  - *more precise time measurement* (LBTT was only precise to
    1/100 of a second, reporting most times as "0.00s").
30

31
Although =ltlcross= performs similar sanity checks as LBTT, it does
32
33
34
not implement any of the interactive features of LBTT.  In our almost
10-year usage of LBTT, we never had to use its interactive features to
understand bugs in our translation.  Therefore =ltlcross= will report
35
problems, maybe with a counterexample, but you will be on your own to
36
37
investigate and fix them (the =--grind= option may help you reduce the
problem to a shorter formula).
38
39
40
41
42

The core of =ltlcross= is a loop that does the following steps:
  - Input a formula
  - Translate the formula and its negation using each configured translator.
    If there are 3 translators, the positive and negative translations
43
44
45
46
    will be denoted =P0=, =N0=, =P1=, =N1=, =P2=, =N2=.
  - Optionally build complemented automata denoted =Comp(P0)=, =Comp(N0)=, etc.
    (By default, this is done only for small automata, but see options =-D=,
    =--determinize-max-states= and =--determinize-max-edges=.)
47
  - Perform sanity checks between all these automata to detect any problem.
48
  - Optionally build the products of these automata with a random state-space (the same
49
50
    state-space for all translations).  (If the =--products=N= option is given,
    =N= products are performed instead.)
51
52
53
54
  - Gather statistics if requested.

* Formula selection

55
56
57
Formulas to translate should be specified using the [[file:ioltl.org][common input
options]].  Standard input is read if it is not connected to a terminal,
and no =-f= or =-F= options are given.
58
59
60

* Configuring translators

61
62
** Translator specifications

63
64
65
Each translator should be specified as a string that use some of the
following character sequences:

66
#+BEGIN_SRC sh :exports results
67
  ltlcross --help | sed -n '/character sequences:/,/^$/p' | sed '1d;$d'
68
69
#+END_SRC
#+RESULTS:
70
:   %%                         a single %
71
72
73
74
:   %f,%s,%l,%w                the formula as a (quoted) string in Spot, Spin,
:                              LBT, or Wring's syntax
:   %F,%S,%L,%W                the formula as a file in Spot, Spin, LBT, or
:                              Wring's syntax
75
76
:   %O                         the automaton output in HOA, never claim, LBTT, or
:                              ltl2dstar's format
77
78
79
80

For instance here is how we could cross-compare the never claims
output by =spin= and =ltl2tgba= for the formulas =GFa= and =X(a U b)=.

81
#+BEGIN_SRC sh :exports code
82
ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%O' 'spin -f %s >%O'
83
84
85
86
#+END_SRC
#+RESULTS:

When =ltlcross= executes these commands, =%s= will be replaced
87
by the formula in Spin's syntax, and =%O= will be replaced by a
88
89
90
temporary file into which the output of the translator is redirected
before it is read back by =ltlcross=.

91
#+BEGIN_SRC sh :exports results
92
ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%O' 'spin -f %s >%O' 2>&1
93
94
95
96
#+END_SRC
#+RESULTS:
#+begin_example
([](<>(a)))
97
98
99
100
Running [P0]: ltl2tgba -s '([](<>(a)))' >'lcr-o0-hvzgTC'
Running [P1]: spin -f '([](<>(a)))' >'lcr-o1-iYh45L'
Running [N0]: ltl2tgba -s '(!([](<>(a))))' >'lcr-o0-z6nzjV'
Running [N1]: spin -f '(!([](<>(a))))' >'lcr-o1-8JB5F4'
101
102
103
Performing sanity checks and gathering statistics...

(X((a) U (b)))
104
105
106
107
Running [P0]: ltl2tgba -s '(X((a) U (b)))' >'lcr-o0-rqfB6d'
Running [P1]: spin -f '(X((a) U (b)))' >'lcr-o1-OUNHEn'
Running [N0]: ltl2tgba -s '(!(X((a) U (b))))' >'lcr-o0-qzVvdx'
Running [N1]: spin -f '(!(X((a) U (b))))' >'lcr-o1-eUfHTG'
108
109
Performing sanity checks and gathering statistics...

110
No problem detected.
111
112
#+end_example

113
114
115
116
117
118
119
120
To handle tools that do not support some LTL operators, the character
sequences ~%f~, ~%s~, ~%l~, ~%w~, ~%F~, ~%S~, ~%L~, and ~%W~ can be
"infixed" by a bracketed list of operators to rewrite away.  For
instance if a tool reads LTL formulas from a file in LBT's syntax, but
does not support operators ~M~ (strong until) and ~W~ (weak until),
use ~%[WM]L~ instead of just ~%L~; this way operators ~W~ and ~M~ will
be rewritten using the other supported operators.

121
=ltlcross= can only read four kinds of output:
122
123
  - Never claims (only if they are restricted to representing an
    automaton using =if=, =goto=, and =skip= statements) such as those
124
    output by [[http://spinroot.com/][=spin=]], [[http://www.lsv.ens-cachan.fr/~gastin/ltl2ba/][=ltl2ba=]], [[https://sourceforge.net/projects/ltl3ba/][=ltl3ba=]], or =ltl2tgba --spin=.  The
125
126
    newer syntax introduced by Spin 6.24, using =do= instead of =if=,
    is also supported.
127
128
129
  - [[http://www.tcs.hut.fi/Software/lbtt/doc/html/Format-for-automata.html][LBTT's format]], which supports generalized Büchi automata with
    either state-based acceptance or transition-based acceptance.
    This output is used for instance by [[http://www.tcs.hut.fi/Software/maria/tools/lbt/][=lbt=]], [[http://web.archive.org/web/20080607170403/http://www.science.unitn.it/~stonetta/modella.html][=modella=]], or =ltl2tgba
130
    --lbtt=.
131
132
  - Non-alternating automata in [[file:http://adl.github.io/hoaf/][the HOA format]] with any acceptance
    condition.
133
  - [[file:concepts.org::#property-flags][Weak]] alternating automata in [[file:http://adl.github.io/hoaf/][the HOA format]].
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
134
  - [[http://www.ltl2dstar.de/docs/ltl2dstar.html][=ltl2dstar='s format]], which supports deterministic Rabin or Streett
135
136
137
138
139
    automata.

Files in any of these format should be indicated with =%O=.  (Past
versions of =ltlcross= used different letters for each format, but the
four parsers have been merged into a single one.)
140
141
142
143
144

Of course all configured tools need not use the same =%= sequences.
The following list shows some typical configurations for some existing
tools:

145
146
147
148
  - '=spin -f %s >%O='
  - '=ltl2ba -f %s >%O='
  - '=ltl3ba -M0 -f %s >%O=' (less deterministic output, can be smaller)
  - '=ltl3ba -M1 -f %s >%O=' (more deterministic output)
149
  - '=modella -r12 -g -e %[MWei^]L %O='
Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
150
  - '=/path/to/script4lbtt.py %L %O=' (script supplied by [[http://web.archive.org/web/20070214050826/http://estragon.ti.informatik.uni-kiel.de/~fritz/][ltl2nba]] for
151
    its interface with LBTT)
152
153
154
155
  - '=ltl2tgba -s %f >%O=' (smaller output, Büchi automaton)
  - '=ltl2tgba -s -D %f >%O=' (more deterministic output, Büchi automaton)
  - '=ltl2tgba -H %f >%O=' (smaller output, TGBA)
  - '=ltl2tgba -H -D %f >%O=' (more deterministic output, TGBA)
156
  - '=lbt <%L >%O='
157
  - '~ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD
158
    --output-format=hoa %[MW]L %O~' deterministic Rabin output in HOA, as
159
160
    supported since version 0.5.2 of =ltl2dstar=.
  - '~ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD --automata=streett
161
    --output-format=hoa %[MW]L %O~' deterministic Streett output in HOA,
162
    as supported since version 0.5.2 of =ltl2dstar=.
163
  - '=ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD %[MW]L %O=' (Rabin
164
165
    output in DSTAR format, as supported in older versions of
    =ltl2dstar=.
166
  - '=ltl2dstar --ltl2nba=spin:path/to/ltl2tgba@-sD %L - | dstar2tgba
167
    -s >%O=' (external conversion from Rabin to Büchi done by
168
169
    =dstar2tgba= for more reduction of the Büchi automaton than what
    =ltlcross= would provide)
170
  - '=java -jar Rabinizer.jar -ltl2dstar %[MW]F %O; mv %O.dst %O=' (Rabinizer
171
172
    uses the last =%O= argument as a prefix to which it always append =.dst=,
    so we have to rename =%O.dst= as =%O= so that =ltlcross= can find the file)
173
  - '~java -jar rabinizer3.1.jar -in=formula -silent -out=std -format=hoa -auto=tr %[MWRei^]f >%O~'
174
    (rabinizer 3.1 can output automata in the HOA format)
175
  - '=ltl3dra -f %s >%O=' (The HOA format is the default for =ltl3dra=.)
176
  - '=ltl3tela -f %s >%O=' (The HOA format is the default for =ltl3tela=.)
177

178
179
180
181
To simplify the use of some of the above tools, a set of predefined
shorthands are available.  Those can be listed with the
=--list-shorthands= option.

182
#+BEGIN_SRC sh
183
184
185
186
187
188
189
ltlcross --list-shorthands
#+END_SRC
#+RESULTS:
#+begin_example
If a COMMANDFMT does not use any %-sequence, and starts with one of
the following words, then the string on the right is appended.

190
  delag        %f>%O
191
192
  lbt          <%L>%O
  ltl2ba       -f %s>%O
193
  ltl2da       %f>%O
194
  ltl2dgra     %f>%O
195
  ltl2dpa      %f>%O
196
  ltl2dra      %f>%O
197
  ltl2ldba     %f>%O
198
  ltl2dstar    --output-format=hoa %[MW]L %O
199
200
  ltl2tgba     -H %f>%O
  ltl3ba       -f %s>%O
201
  ltl3dra      -f %s>%O
202
  ltl3hoa      -f %f>%O
203
  ltl3tela     -f %f>%O
204
  modella      %[MWei^]L %O
205
  spin         -f %s>%O
206
207
208
209

Any {name} and directory component is skipped for the purpose of
matching those prefixes.  So for instance
  '{DRA} ~/mytools/ltl2dstar-0.5.2'
210
211
will be changed into
  '{DRA} ~/mytools/ltl2dstar-0.5.2 --output-format=hoa %[MW]L %O'
212
213
214
#+end_example

What this implies is that running =ltlcross ltl2ba ltl3ba ...= is
215
the same as running =ltlcross 'ltl2ba -f %s>%O' 'ltl3ba -f %s>%O' ...=
216
217
218

Because only the prefix of the actual command is checked, you can
still specify some options.  For instance =ltlcross 'ltl2tgba -D' ...=
219
is short for =ltlcross 'ltl2tgba -D -H %F>%O' ...=
220

221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
** Trusted and untrusted translators

By default, all translators specified are not trusted.  This means
that =ltlcross= will cross-compare the output of all translators,
possibly yielding a quadratic number of tests.

It is possible to declare that certain translators should be trusted
by specifying them with the =--reference=COMMANDFMT= option.  This has
a few implications:
  - the automata output by reference translators are not tested
  - a pair of positive and negative reference automata are selected
    from the reference translators (the smallest automata, in case
    multiple references are available), and all other translators will
    only be compared to these reference automata.

Consequently, the number of test performed is now linear in the number
of untrusted references.  The easiest way to observe the effect of
=--reference= is to run the =ltlcross= with the [[#verbose][=--verbose= option]],
with and without some =--reference= translators.

241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
* Detecting problems
   :PROPERTIES:
   :CUSTOM_ID: checks
   :END:

If a translator exits with a non-zero status code, or fails to output
an automaton =ltlcross= can read, and error will be displayed and the
result of the translation will be discarded.

Otherwise =ltlcross= performs the following checks on all translated
formulas ($P_i$ and $N_i$ designate respectively the translation of
positive and negative formulas by the ith translator).

  - Intersection check: $P_i\otimes N_j$ must be empty for all
    pairs of $(i,j)$.

    A single failing translator might generate a lot of lines of
    the form:

    : error: P0*N1 is nonempty; both automata accept the infinite word:
    :        cycle{p0 & !p1}
    : error: P1*N0 is nonempty; both automata accept the infinite word:
    :        p0; !p1; cycle{p0 & p1}
    : error: P1*N1 is nonempty; both automata accept the infinite word:
    :        p0; cycle{!p1 & !p0}
    : error: P1*N2 is nonempty; both automata accept the infinite word:
    :        p0; !p1; cycle{p0 & p1}
    : error: P1*N3 is nonempty; both automata accept the infinite word:
    :        p0; !p1; cycle{p0 & p1}
    : error: P1*N4 is nonempty; both automata accept the infinite word:
    :        p0; cycle{!p1 & !p0}
    : error: P2*N1 is nonempty; both automata accept the infinite word:
    :        p0; !p1; !p0; cycle{!p1 & !p0; p0 & !p1; !p1; !p1; p0 & !p1}
    : error: P3*N1 is nonempty; both automata accept the infinite word:
    :        p0; !p1; !p1 & !p0; cycle{p0 & !p1}
    : error: P4*N1 is nonempty; both automata accept the infinite word:
    :        p0; !p1; !p1 & !p0; cycle{p0 & !p1}

    In this example, translator number =1= looks clearly faulty
    (at least the other 4 translators do not contradict each other).

    Examples of infinite words that are accepted by both automata
    always have the form of a lasso: a (possibly empty) finite prefix
    followed by a cycle that should be repeated infinitely often.
    The cycle part is denoted by =cycle{...}=.

  - Complemented intersection check.  If $P_i$ and $N_i$ are
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
    deterministic or if they are small enough, =ltlcross= attempts to
    build their complements, $Comp(P_i)$ and $Comp(N_i)$.

    Complementation is not always attempted, especially when it
    requires a determinization-based construction.  The conditions
    specifying when the complement automata are constructed can be
    modified with the =--determinize-max-states=N= and
    =--determinize-max-edges=M= options, which abort the
    complementation if it would produce an automaton with more than
    =N= states (500 by default) or more than =M= edges (5000 by
    default).  Alternatively, use =--determinize= (a.k.a. =-D=) to
    force the complementation of all automata.

    If both complement automata could be computed, =ltlcross= ensures that
    $Comp(P_i)\otimes Comp(N_i)$ is empty.

    If only one automaton has been complemented, for instance $P_i$,
    =ltlcross= checks that $P_j\otimes Comp(P_i)$ for all $j \ne i$;
    likewise if it's $N_i$ that is deterministic.
307
308
309
310

    When validating a translator with =ltlcross= without using the
    =--determinize= option we highly recommend to include a translator
    with good deterministic output to augment test coverage.  Using
311
312
313
314
315
    '=ltl2tgba -D %f >%O=' will produce deterministic automata for all
    obligation properties and many recurrence properties.  Using
    '=ltl2tgba -PD %f >%O=' will systematically produce a
    deterministic Parity automaton (that =ltlcross= can complement
    easily).
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335

  - Cross-comparison checks: for some state-space $S$,
    all $P_i\otimes S$ are either all empty, or all non-empty.
    Similarly all $N_i\otimes S$ are either all empty, or all non-empty.

    A cross-comparison failure could be displayed as:

    : error: {P0,P2} disagree with {P1} when evaluating the state-space
    :        the following word(s) are not accepted by {P1}:
    :  P0 accepts: p0 & !p1 & !p2 & p3; p0 & p1 & !p2 & p3; p0 & p1 & p2 & p3; cycle{p0 & p1 & p2 & p3; p0 & p1 & !p2 & !p3; p0 & p1 & p2 & !p3; p0 & p1 & !p2 & !p3}
    :  P2 accepts: p0 & !p1 & !p2 & p3; cycle{p0 & p1 & !p2 & !p3; p0 & p1 & p2 & p3; p0 & p1 & !p2 & p3}

    If =--products=N= is used with =N= greater than one, the number of
    the state-space is also printed.  This number is of no use by
    itself, except to explain why you may get multiple disagreement
    between the same sets of automata.

    These products tests may sometime catch errors that were not
    captured by the first two tests if one non-deterministic automaton
    recognize less words than what it should.  If the input automata
336
    are all deterministic or the =--determinize= option is used, this test
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
    is redundant and can be disabled.  (In fact, the =--determinize=
    option implies option =--product=0= to do so.)

  - Consistency check:

    For each $i$, the products $P_i\otimes S$ and $N_i\otimes S$
    actually cover all states of $S$.  Because $S$ does not have any
    deadlock, any of its infinite path must be accepted by $P_i$ or
    $N_i$ (or both).

    An error in that case is displayed as

    : error: inconsistency between P1 and N1

    If =--products=N= is used with =N= greater than one, the number of
    the state-space in which the inconsistency was detected is also
    printed.

    This test may catch errors that were not captured by the first two
    tests if one non-deterministic automaton recognize less words than
    what it should.  If the input automata are deterministic or the
    =--determinize= option is used, this test is redundant and can be
    disabled.  (In fact, the =--determinize= option implies option
    =--product=0= to do so.)

The above checks are similar to those that are performed by [[http://www.tcs.hut.fi/Software/lbtt/][LBTT]],
except for the complemented intersection check, which is only done in
=ltlcross=.

If any problem was reported during the translation of one of the
formulas, =ltlcheck= will exit with an exit status of =1=.  Statistics
(if requested) are output nonetheless, and include any faulty
automaton as well.

371
372
373
374
375
376
* Getting statistics

Detailed statistics about the result of each translation, and the
product of that resulting automaton with the random state-space, can
be obtained using the =--csv=FILE= or =--json=FILE= option.

377
378
** CSV or JSON output (or both!)

379
The following compare =ltl2tgba=, =spin=, and =lbt= on three random
380
formulas (where =W= and =M= operators have been rewritten away because
381
they are not supported by =spin= and =lbt=).
382
383

#+BEGIN_SRC sh :results verbatim :exports code
384
randltl -n 3 --seed=5 a b |
385
386
ltlfilt --remove-wm |
ltlcross --csv=results.csv \
387
388
389
         'ltl2tgba -s %f >%O' \
         'spin -f %s >%O' \
         'lbt < %L >%O'
390
391
392
393
#+END_SRC
#+RESULTS:

#+BEGIN_SRC sh :results verbatim :exports results
394
randltl -n 3 --seed=5 a b | ltlfilt --remove-wm |
395
ltlcross --csv=results.csv --json=results.json \
396
397
         'ltl2tgba -s %f >%O' \
         'spin -f %s >%O' \
398
         'lbt < %L >%O' 2>&1
399
400
#+END_SRC

401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
#+RESULTS:
#+begin_example
-:1: G(!((!(p0)) & ((X(p0)) | (F((p1) R (X(p0)))))))
Running [P0]: ltl2tgba -s 'G(!((!(p0)) & ((X(p0)) | (F((p1) R (X(p0)))))))' >'lcr-o0-UWmAOs'
Running [P1]: spin -f '[](!((!(p0)) && ((X(p0)) || (<>((p1) V (X(p0)))))))' >'lcr-o1-UALknk'
Running [P2]: lbt < 'lcr-i0-7JlcYb' >'lcr-o2-Yqa4y3'
Running [N0]: ltl2tgba -s '!(G(!((!(p0)) & ((X(p0)) | (F((p1) R (X(p0))))))))' >'lcr-o0-O9vcaV'
Running [N1]: spin -f '!([](!((!(p0)) && ((X(p0)) || (<>((p1) V (X(p0))))))))' >'lcr-o1-jwQ2NM'
Running [N2]: lbt < 'lcr-i0-eDh8rE' >'lcr-o2-kjYd6v'
Performing sanity checks and gathering statistics...

-:2: F(p0)
Running [P0]: ltl2tgba -s 'F(p0)' >'lcr-o0-yDowOn'
Running [P1]: spin -f '<>(p0)' >'lcr-o1-zxU8yf'
Running [P2]: lbt < 'lcr-i1-l78Dj7' >'lcr-o2-NcC93Y'
Running [N0]: ltl2tgba -s '!(F(p0))' >'lcr-o0-5xUjPQ'
Running [N1]: spin -f '!(<>(p0))' >'lcr-o1-fD4OCI'
Running [N2]: lbt < 'lcr-i1-G0kdqA' >'lcr-o2-ZsPBds'
Performing sanity checks and gathering statistics...

-:3: (X(p0)) U ((!(p0)) & (X(p0)))
Running [P0]: ltl2tgba -s '(X(p0)) U ((!(p0)) & (X(p0)))' >'lcr-o0-I2461j'
Running [P1]: spin -f '(X(p0)) U ((!(p0)) && (X(p0)))' >'lcr-o1-IxFTSb'
Running [P2]: lbt < 'lcr-i2-02hRJ3' >'lcr-o2-yl6OAV'
Running [N0]: ltl2tgba -s '!((X(p0)) U ((!(p0)) & (X(p0))))' >'lcr-o0-yTDisN'
Running [N1]: spin -f '!((X(p0)) U ((!(p0)) && (X(p0))))' >'lcr-o1-CUj4lF'
Running [N2]: lbt < 'lcr-i2-xWC2fx' >'lcr-o2-aHi19o'
Performing sanity checks and gathering statistics...

No problem detected.
#+end_example

433
434
After this execution, the file =results.csv= contains the following:

435
436
437
438
439
440
441
442
443
444
#+BEGIN_SRC sh :results output raw :exports results
sed 's/"//g
s/|/\\vert{}/g
s/--/@@html:--@@/g
1a\
|-|
s/^/| /
s/$/ |/
s/,/|/g
' results.csv
445
#+END_SRC
446
447

#+ATTR_HTML: :class csv-table
448
#+RESULTS:
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
| formula                                                  | tool               | exit_status | exit_code |        time | states | edges | transitions | acc | scc | nondet_states | nondet_aut | complete_aut | product_states | product_transitions | product_scc |
|----------------------------------------------------------+--------------------+-------------+-----------+-------------+--------+-------+-------------+-----+-----+---------------+------------+--------------+----------------+---------------------+-------------|
| G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))    | ltl2tgba -s %f >%O | ok          |         0 |   0.0125294 |      2 |     3 |           3 |   1 |   2 |             0 |          0 |            0 |            400 |                6276 |           2 |
| G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))    | spin -f %s >%O     | ok          |         0 |   0.0127994 |      7 |    21 |          35 |   1 |   2 |             7 |          1 |            0 |           1200 |               29442 |           4 |
| G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))    | lbt < %L >%O       | ok          |         0 |  0.00127784 |      6 |    14 |          28 |   1 |   5 |             6 |          1 |            0 |           1000 |               20970 |         403 |
| !(G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))) | ltl2tgba -s %f >%O | ok          |         0 |   0.0130485 |      3 |     5 |           6 |   1 |   3 |             0 |          0 |            1 |            600 |               12633 |           3 |
| !(G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))) | spin -f %s >%O     | ok          |         0 |  0.00115759 |      6 |    13 |          32 |   1 |   5 |             4 |          1 |            0 |           1200 |               33622 |         204 |
| !(G(!((!(p0)) & ((X(p0)) \vert{} (F((p1) R (X(p0)))))))) | lbt < %L >%O       | ok          |         0 |  0.00120846 |     13 |    28 |          67 |   2 |  13 |             7 |          1 |            0 |           2400 |               59006 |        1604 |
| F(p0)                                                    | ltl2tgba -s %f >%O | ok          |         0 |   0.0124681 |      2 |     3 |           4 |   1 |   2 |             0 |          0 |            1 |            400 |                8264 |           2 |
| F(p0)                                                    | spin -f %s >%O     | ok          |         0 | 0.000771485 |      2 |     3 |           5 |   1 |   2 |             1 |          1 |            1 |            400 |               10323 |           2 |
| F(p0)                                                    | lbt < %L >%O       | ok          |         0 |  0.00188293 |      4 |     6 |          10 |   1 |   4 |             2 |          1 |            1 |            601 |               14487 |         203 |
| !(F(p0))                                                 | ltl2tgba -s %f >%O | ok          |         0 |   0.0125541 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2073 |           1 |
| !(F(p0))                                                 | spin -f %s >%O     | ok          |         0 | 0.000802091 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2073 |           1 |
| !(F(p0))                                                 | lbt < %L >%O       | ok          |         0 |  0.00127165 |      2 |     2 |           2 |   0 |   2 |             0 |          0 |            0 |            201 |                2081 |           2 |
| (X(p0)) U ((!(p0)) & (X(p0)))                            | ltl2tgba -s %f >%O | ok          |         0 |   0.0121934 |      3 |     3 |           4 |   1 |   3 |             0 |          0 |            0 |            208 |                4118 |           9 |
| (X(p0)) U ((!(p0)) & (X(p0)))                            | spin -f %s >%O     | ok          |         0 | 0.000795817 |      4 |     6 |           7 |   1 |   4 |             1 |          1 |            0 |            408 |                6159 |          10 |
| (X(p0)) U ((!(p0)) & (X(p0)))                            | lbt < %L >%O       | ok          |         0 |   0.0011121 |      6 |     7 |          10 |   1 |   6 |             1 |          1 |            0 |            484 |                7467 |          86 |
| !((X(p0)) U ((!(p0)) & (X(p0))))                         | ltl2tgba -s %f >%O | ok          |         0 |   0.0122315 |      3 |     4 |           5 |   1 |   3 |             0 |          0 |            0 |            208 |                4128 |           9 |
| !((X(p0)) U ((!(p0)) & (X(p0))))                         | spin -f %s >%O     | ok          |         0 | 0.000903485 |      4 |     8 |          10 |   1 |   3 |             2 |          1 |            0 |            800 |               20222 |         203 |
| !((X(p0)) U ((!(p0)) & (X(p0))))                         | lbt < %L >%O       | ok          |         0 |  0.00182082 |      9 |    17 |          23 |   0 |   9 |             4 |          1 |            0 |           1601 |               34445 |        1004 |
469

470
471
472
473
474
This file can be loaded in any spreadsheet or statistical application.

Although we only supplied 2 random generated formulas, the output
contains 4 formulas because =ltlcross= had to translate the positive
and negative version of each.
475

476
477
478
If we had used the option =--json=results.json= instead of (or in
addition to) =--cvs=results.csv=, the file =results.json= would have
contained the following [[http://www.json.org/][JSON]] output.
479

480
#+BEGIN_SRC sh :exports results :wrap SRC json
481
482
483
cat results.json
#+END_SRC
#+RESULTS:
484
#+begin_SRC json
485
{
486
  "tool": [
487
488
489
    "ltl2tgba -s %f >%O",
    "spin -f %s >%O",
    "lbt < %L >%O"
490
  ],
491
  "formula": [
492
493
494
495
496
497
    "G(!((!(p0)) & ((X(p0)) | (F((p1) R (X(p0)))))))",
    "!(G(!((!(p0)) & ((X(p0)) | (F((p1) R (X(p0))))))))",
    "F(p0)",
    "!(F(p0))",
    "(X(p0)) U ((!(p0)) & (X(p0)))",
    "!((X(p0)) U ((!(p0)) & (X(p0))))"
498
  ],
499
  "fields":  [
500
  "formula","tool","exit_status","exit_code","time","states","edges","transitions","acc","scc","nondet_states","nondet_aut","complete_aut","product_states","product_transitions","product_scc"
501
  ],
502
  "inputs":  [ 0, 1 ],
503
  "results": [
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
    [ 0,0,"ok",0,0.0132415,2,3,3,1,2,0,0,0,400,6276,2 ],
    [ 0,1,"ok",0,0.0129795,7,21,35,1,2,7,1,0,1200,29442,4 ],
    [ 0,2,"ok",0,0.00126994,6,14,28,1,5,6,1,0,1000,20970,403 ],
    [ 1,0,"ok",0,0.0130197,3,5,6,1,3,0,0,1,600,12633,3 ],
    [ 1,1,"ok",0,0.00115913,6,13,32,1,5,4,1,0,1200,33622,204 ],
    [ 1,2,"ok",0,0.00120161,13,28,67,2,13,7,1,0,2400,59006,1604 ],
    [ 2,0,"ok",0,0.012826,2,3,4,1,2,0,0,1,400,8264,2 ],
    [ 2,1,"ok",0,0.000675097,2,3,5,1,2,1,1,1,400,10323,2 ],
    [ 2,2,"ok",0,0.0011281,4,6,10,1,4,2,1,1,601,14487,203 ],
    [ 3,0,"ok",0,0.0122189,1,1,1,1,1,0,0,0,200,2073,1 ],
    [ 3,1,"ok",0,0.000746496,1,1,1,1,1,0,0,0,200,2073,1 ],
    [ 3,2,"ok",0,0.00124168,2,2,2,0,2,0,0,0,201,2081,2 ],
    [ 4,0,"ok",0,0.0130605,3,3,4,1,3,0,0,0,208,4118,9 ],
    [ 4,1,"ok",0,0.000788826,4,6,7,1,4,1,1,0,408,6159,10 ],
    [ 4,2,"ok",0,0.0012278,6,7,10,1,6,1,1,0,484,7467,86 ],
    [ 5,0,"ok",0,0.0124917,3,4,5,1,3,0,0,0,208,4128,9 ],
    [ 5,1,"ok",0,0.000906358,4,8,10,1,3,2,1,0,800,20222,203 ],
    [ 5,2,"ok",0,0.00129181,9,17,23,0,9,4,1,0,1601,34445,1004 ]
522
523
  ]
}
524
#+end_SRC
525

526
527
528
529
530
531
532
Here the =fields= table describes the columns of the =results= table.
The =inputs= tables lists the columns that are considered as inputs
for the experiments.  The values in the columns corresponding to the
fields =formula= and =tool= contains indices relative to the =formula=
and =tool= tables.  This format is more compact when dealing with lots
of translators and formulas, because they don't have to be repeated on
each line as in the CSV version.
533
534

JSON data can be easily processed in any language.  For instance the
535
536
537
538
539
following Python3 script averages each column (except the first four)
for each tool, and presents the results in a form that can almost be
copied into a LaTeX table (the =%= in the tool names have to be taken
care of).  Note that for simplicity we assume that the first two
columns are inputs, instead of reading the =inputs= field.
540
541
542
543
544

#+BEGIN_SRC python :results output :exports both
#!/usr/bin/python3
import json
data = json.load(open('results.json'))
545
datacols = range(4, len(data["fields"]))
546
# Index results by tool
547
results = { t:[] for t in range(0, len(data["tool"])) }
548
549
for l in data["results"]:
  results[l[1]].append(l)
550
# Average columns for each tool, and display them as a table
551
print("%-18s & count & %s \\\\" % ("tool", " & ".join(data["fields"][4:])))
552
for i in range(0, len(data["tool"])):
553
  c = len(results[i])
554
  sums = ["%6.1f" % (sum([x[j] for x in results[i]])/c)
555
          for j in datacols]
556
557
  print("%-18s & %3d & %s \\\\" % (data["tool"][i], c,
        " & ".join(sums)))
558
559
#+END_SRC
#+RESULTS:
560
: tool               & count & time & states & edges & transitions & acc & scc & nondet_states & nondet_aut & complete_aut & product_states & product_transitions & product_scc \\
561
562
563
: ltl2tgba -s %f >%O &   6 &    0.0 &    2.3 &    3.2 &    3.8 &    1.0 &    2.3 &    0.0 &    0.0 &    0.3 &  336.0 & 6248.7 &    4.3 \\
: spin -f %s >%O     &   6 &    0.0 &    4.0 &    8.7 &   15.0 &    1.0 &    2.8 &    2.5 &    0.8 &    0.2 &  701.3 & 16973.5 &   70.7 \\
: lbt < %L >%O       &   6 &    0.0 &    6.7 &   12.3 &   23.3 &    0.8 &    6.5 &    3.3 &    0.8 &    0.2 & 1047.8 & 23076.0 &  550.3 \\
564

Alexandre Duret-Lutz's avatar
Alexandre Duret-Lutz committed
565
566
The script =bench/ltl2tgba/sum.py= is a more evolved version of the
above script that generates two kinds of LaTeX tables.
567
568
569
570

When computing such statistics, you should be aware that inputs for
which a tool failed to generate an automaton (e.g. it crashed, or it
was killed if you used =ltlcross='s =--timeout= option to limit run
571
572
573
574
575
576
577
578
time) will appear as mostly empty lines in the CSV or JSON files,
since most statistics cannot be computed without an automaton...
Those lines with missing data can be omitted with the =--omit-missing=
option (this used to be the default up to Spot 1.2).

However data for bogus automata are still included: as shown below
=ltlcross= will report inconsistencies between automata as errors, but
it does not try to guess who is incorrect.
579

580
581
** Description of the columns

582
583
584
585
586
587
588
589
The number of column output in the CSV or JSON outputs depend on the
options passed to =ltlcross=. Additional columns will be output if
=--strength=, =--ambiguous=, =--automata=, or =--product=+N= are used.

Columns =formula= and =tool= contain the formula translated and the
command run to translate it.  In the CSV, these columns contain the
actual text.  In the JSON output, these column contains an index into
the =formula= and =tool= table declared separately.
590

591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
=exit_status= and =exit_code= are used to indicate if the translator
successfully produced an automaton, or if it failed.  On successful
translation, =exit_status= is equal to "=ok=" and =exit_code= is 0.
If the translation took more time than allowed with the =--timeout=
option, =exit_status= will contain "=timeout=" and =exit_code= will be
set to -1.  Other values are used to diagnose various issues: please
check the man-page for =ltlcross= for a list of them.

=time= obviously contains the time used by the translation.  Time is
measured with some high-resolution clock when available (that's
nanosecond accuracy under Linux), but because translator commands are
executed through a shell, it also includes the time to start a shell.
(This extra cost apply identically to all translators, so it is not unfair.)


All the values that follow will be missing if =exit_status= is not
607
equal to "=ok=".  (You may instruct =ltlcross= not to output lines with
608
609
such missing data with the option =--omit-missing=.)

610
=states=, =edges=, =transitions=, =acc= are size measures for the
611
612
613
614
615
automaton that was translated.  =acc= counts the number of acceptance
sets.  When building (degeneralized) Büchi automata, it will always be
=1=, so its value is meaningful only when evaluating translations to
generalized Büchi automata.  =edges= counts the actual number of edges
in the graph supporting the automaton; an edge (labeled by a Boolean
616
formula) [[file:concepts.org::#trans-edge][might actually represent several transitions]] (each labeled by
617
618
619
620
621
assignment of all atomic propositions).  For instance in an automaton
where the atomic proposition are $a$ and $b$, one edge labeled by
$a\lor b$ actually represents three transitions $a b$, $a\bar b$, and
$\bar a b$.

622
623
=scc= counts the number of strongly-connected components in the
automaton.
624
625

If option =--strength= is passed to =ltlcross=, these SCCs are
626
627
also partitioned on four sets based on their strengths:
- =nonacc_scc= for non-accepting SCCs (such as states A1 and A2 in the
628
629
630
631
632
633
634
635
  previous picture).
- =terminal_scc= for accepting SCCs where all states or edges belong
  to the same acceptance sets, and that are complete (i.e., any state
  in a terminal SCC accepts the universal language).  States
  B1 and B2 in the previous picture are two terminal SCCs.
- =weak_scc= for accepting SCCs where all states or edges belong
  to the same acceptance sets, but that are not complete.
- =strong_scc= for accepting SCCs that are not weak.
636
637
638
639
640
641
642
643
644
645

These SCC strengths can be used to compute the strength of the
automaton as a whole:
- an automaton is terminal if it contains only non-accepting or
  terminal SCCs,
- an automaton is weak if it it contains only non-accepting,
  terminal, or weak SCCs,
- an automaton is strong if it contains at least one strong SCC.

This classification is used to fill the =terminal_aut=, =weak_aut=,
646
647
648
649
=strong_aut= columns with Boolean values (still only if option
=--strength= is passed).  Only one of these should contain =1=.  We
usually prefer terminal automata over weak automata, and weak automata
over strong automata, because the emptiness check of terminal (and
650
651
652
weak) automata is easier.  When working with alternating automata, all
those strength-related columns will be empty, because the routines
used to compute those statistic do not yet support universal edges.
653
654
655
656
657
658
659
660
661

=nondetstates= counts the number of non-deterministic states in the
automaton.  =nondeterministic= is a Boolean value indicating if the
automaton is not deterministic.  For instance in the previous picture
showing two automata for =a U b=, the first automaton is deterministic
(these two fields will contain 0), while the second automaton contain
a nondeterministic state (state A2 has two possible successors for the
assignment $ab$) and is therefore not deterministic.

662
If option =--ambiguous= was passed to =ltlcross=, the column
663
=ambiguous_aut= holds a Boolean indicating whether the automaton is
664
ambiguous, i.e., if there exists a word that can be accepted by at
665
666
least two different runs.  (This information is not yet available for
alternating automata.)
667

668
669
670
671
=complete_aut= is a Boolean indicating whether the automaton is
complete.

Columns =product_states=, =product_transitions=, and =product_scc=
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
count the number of state, transitions and strongly-connect components
in the product that has been built between the translated automaton
and a random model.  For a given formula, the same random model is of
course used against the automata translated by all tools.  Comparing
the size of these product might give another indication of the
"conciseness" of a translated automaton.

There is of course a certain "luck factor" in the size of the product.
Maybe some translator built a very dumb automaton, with many useless
states, in which just a very tiny part is translated concisely.  By
luck, the random model generated might synchronize with this tiny part
only, and ignore the part with all the useless states.  A way to
lessen this luck factor is to increase the number of products
performed against the translated automaton.  If option =--products=N=
is used, =N= products are builds instead of one, and the fields
=product_states=, =product_transitions=, and =product_scc= contain
average values.

690
691
692
693
694
695
696
697
If the option =--products=+N= is used (with a =+= in front of the
number), then no average value is computed.  Instead, three columns
=product_states=, =product_transitions=, and =product_scc= are output
for each individual product (i.e., $3\times N$ columns are output).
This might be useful if you want to compute different kind of
statistic (e.g., a median instead of a mean) or if you want to build
scatter plots of all these products.

698
699
700
701
Finally, if the =--automata= option was passed to =ltlcross=, the CSV
or JSON output will contain a column named =automaton= encoding each
produced automaton in the HOA format.

702
703
704
705
706
707
** Changing the name of the translators

By default, the names used in the CSV and JSON output to designate the
translators are the command specified on the command line.

For instance in the following, =ltl2tgba= is run in two
708
709
configurations, and the strings =ltl2tgba -s --small %f >%O= and
=ltl2tgba -s --deter %f >%O= appear verbatim in the output:
710

711
712
#+NAME: ltlcross-unnamed
#+BEGIN_SRC sh :exports code
713
ltlcross -f a -f Ga 'ltl2tgba -s --small %f >%O' 'ltl2tgba -s --deter %f >%O' --csv
714
#+END_SRC
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731

#+BEGIN_SRC sh :results output raw :exports results :noweb yes
sed 's/"//g
s/|/\\vert{}/g
s/--/@@html:--@@/g
s/^/| /
s/$/ |/
s/,/|/g
$d
1a\
|-|
' <<EOF
<<ltlcross-unnamed()>>
EOF
#+END_SRC

#+ATTR_HTML: :class csv-table
732
#+RESULTS:
733
734
735
736
737
738
739
740
741
742
| formula | tool                                | exit_status | exit_code |      time | states | edges | transitions | acc | scc | nondet_states | nondet_aut | complete_aut | product_states | product_transitions | product_scc |
|---------+-------------------------------------+-------------+-----------+-----------+--------+-------+-------------+-----+-----+---------------+------------+--------------+----------------+---------------------+-------------|
| a       | ltl2tgba -s @@html:--@@small %f >%O | ok          |         0 |  0.045425 |      2 |     2 |           3 |   1 |   2 |             0 |          0 |            0 |            201 |                4144 |           2 |
| a       | ltl2tgba -s @@html:--@@deter %f >%O | ok          |         0 | 0.0452103 |      2 |     2 |           3 |   1 |   2 |             0 |          0 |            0 |            201 |                4144 |           2 |
| !(a)    | ltl2tgba -s @@html:--@@small %f >%O | ok          |         0 | 0.0475807 |      2 |     2 |           3 |   1 |   2 |             0 |          0 |            0 |            201 |                4149 |           2 |
| !(a)    | ltl2tgba -s @@html:--@@deter %f >%O | ok          |         0 | 0.0441754 |      2 |     2 |           3 |   1 |   2 |             0 |          0 |            0 |            201 |                4149 |           2 |
| G(a)    | ltl2tgba -s @@html:--@@small %f >%O | ok          |         0 | 0.0453961 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2059 |           1 |
| G(a)    | ltl2tgba -s @@html:--@@deter %f >%O | ok          |         0 | 0.0467509 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2059 |           1 |
| !(G(a)) | ltl2tgba -s @@html:--@@small %f >%O | ok          |         0 | 0.0459274 |      2 |     3 |           4 |   1 |   2 |             0 |          0 |            1 |            400 |                8264 |           2 |
| !(G(a)) | ltl2tgba -s @@html:--@@deter %f >%O | ok          |         0 |   0.04534 |      2 |     3 |           4 |   1 |   2 |             0 |          0 |            1 |            400 |                8264 |           2 |
743
744
745
746
747
748
749

To present these results graphically, or even when analyzing these
data, it might be convenient to give each configured tool a shorter
name.  =ltlcross= supports the specification of such short names by
looking whether the command specification for a translator has the
form "={short name}actual command=".

750
751
For instance:
#+BEGIN_SRC sh :prologue "exec 2>&1"
752
753
754
genltl --and-f=1..5 |
ltlcross '{small} ltl2tgba -s --small %f >%O' \
         '{deter} ltl2tgba -s --deter %f >%O' --csv=ltlcross.csv
755
#+END_SRC
756

757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
#+RESULTS:
#+begin_example
-:1: F(p1)
Running [P0: small]: ltl2tgba -s --small 'F(p1)' >'lcr-o0-gizrt5'
Running [P1: deter]: ltl2tgba -s --deter 'F(p1)' >'lcr-o1-E2Y2os'
Running [N0: small]: ltl2tgba -s --small '!(F(p1))' >'lcr-o0-LiBWmP'
Running [N1: deter]: ltl2tgba -s --deter '!(F(p1))' >'lcr-o1-ztzWmc'
Performing sanity checks and gathering statistics...

-:2: (F(p1)) & (F(p2))
Running [P0: small]: ltl2tgba -s --small '(F(p1)) & (F(p2))' >'lcr-o0-DCyLpz'
Running [P1: deter]: ltl2tgba -s --deter '(F(p1)) & (F(p2))' >'lcr-o1-MeEivW'
Running [N0: small]: ltl2tgba -s --small '!((F(p1)) & (F(p2)))' >'lcr-o0-X5oXCj'
Running [N1: deter]: ltl2tgba -s --deter '!((F(p1)) & (F(p2)))' >'lcr-o1-APddNG'
Performing sanity checks and gathering statistics...

-:3: (F(p1)) & (F(p2)) & (F(p3))
Running [P0: small]: ltl2tgba -s --small '(F(p1)) & (F(p2)) & (F(p3))' >'lcr-o0-D8un13'
Running [P1: deter]: ltl2tgba -s --deter '(F(p1)) & (F(p2)) & (F(p3))' >'lcr-o1-njT4hr'
Running [N0: small]: ltl2tgba -s --small '!((F(p1)) & (F(p2)) & (F(p3)))' >'lcr-o0-YNmfBO'
Running [N1: deter]: ltl2tgba -s --deter '!((F(p1)) & (F(p2)) & (F(p3)))' >'lcr-o1-2bGzWb'
Performing sanity checks and gathering statistics...

-:4: (F(p1)) & (F(p2)) & (F(p3)) & (F(p4))
Running [P0: small]: ltl2tgba -s --small '(F(p1)) & (F(p2)) & (F(p3)) & (F(p4))' >'lcr-o0-rlrmnz'
Running [P1: deter]: ltl2tgba -s --deter '(F(p1)) & (F(p2)) & (F(p3)) & (F(p4))' >'lcr-o1-KobkRW'
Running [N0: small]: ltl2tgba -s --small '!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)))' >'lcr-o0-5DFKnk'
Running [N1: deter]: ltl2tgba -s --deter '!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)))' >'lcr-o1-8IIcXH'
Performing sanity checks and gathering statistics...

-:5: (F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))
Running [P0: small]: ltl2tgba -s --small '(F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))' >'lcr-o0-h7sYE5'
Running [P1: deter]: ltl2tgba -s --deter '(F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))' >'lcr-o1-ypOBqt'
Running [N0: small]: ltl2tgba -s --small '!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5)))' >'lcr-o0-2rJtfR'
Running [N1: deter]: ltl2tgba -s --deter '!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5)))' >'lcr-o1-qK2p7e'
Performing sanity checks and gathering statistics...

No problem detected.
#+end_example

When =ltlcross= is running, the short name is now displayed on stderr
before the command.  Furthermore, the file =ltlcross.csv= now use the
short name in the =tool= column:

801
802
803
804
805
806
807
808
809
810
811
812
813
814
#+BEGIN_SRC sh :results output raw :exports results
sed 's/"//g
s/|/\\vert{}/g
s/--/@@html:--@@/g
s/^/| /
s/$/ |/
s/,/|/g
$d
1a\
|-|
' ltlcross.csv
#+END_SRC

#+ATTR_HTML: :class csv-table
815
#+RESULTS:
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
| formula                                            | tool  | exit_status | exit_code |      time | states | edges | transitions | acc | scc | nondet_states | nondet_aut | complete_aut | product_states | product_transitions | product_scc |
|----------------------------------------------------+-------+-------------+-----------+-----------+--------+-------+-------------+-----+-----+---------------+------------+--------------+----------------+---------------------+-------------|
| F(p1)                                              | small | ok          |         0 | 0.0143077 |      2 |     3 |           4 |   1 |   2 |             0 |          0 |            1 |            400 |                8272 |           3 |
| F(p1)                                              | deter | ok          |         0 | 0.0143547 |      2 |     3 |           4 |   1 |   2 |             0 |          0 |            1 |            400 |                8272 |           3 |
| !(F(p1))                                           | small | ok          |         0 | 0.0146721 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2055 |           2 |
| !(F(p1))                                           | deter | ok          |         0 | 0.0145825 |      1 |     1 |           1 |   1 |   1 |             0 |          0 |            0 |            200 |                2055 |           2 |
| (F(p1)) & (F(p2))                                  | small | ok          |         0 | 0.0147275 |      4 |     9 |          16 |   1 |   4 |             0 |          0 |            1 |            798 |               16533 |           5 |
| (F(p1)) & (F(p2))                                  | deter | ok          |         0 | 0.0144936 |      4 |     9 |          16 |   1 |   4 |             0 |          0 |            1 |            798 |               16533 |           5 |
| !((F(p1)) & (F(p2)))                               | small | ok          |         0 | 0.0147704 |      3 |     5 |           7 |   1 |   3 |             0 |          0 |            0 |            598 |                7367 |           4 |
| !((F(p1)) & (F(p2)))                               | deter | ok          |         0 | 0.0146198 |      3 |     5 |           7 |   1 |   3 |             0 |          0 |            0 |            598 |                7367 |           4 |
| (F(p1)) & (F(p2)) & (F(p3))                        | small | ok          |         0 | 0.0153116 |      8 |    27 |          64 |   1 |   8 |             0 |          0 |            1 |           1587 |               33068 |          34 |
| (F(p1)) & (F(p2)) & (F(p3))                        | deter | ok          |         0 | 0.0156095 |      8 |    27 |          64 |   1 |   8 |             0 |          0 |            1 |           1587 |               33068 |          34 |
| !((F(p1)) & (F(p2)) & (F(p3)))                     | small | ok          |         0 |  0.015041 |      4 |     6 |          24 |   1 |   4 |             1 |          1 |            0 |            601 |                6171 |           4 |
| !((F(p1)) & (F(p2)) & (F(p3)))                     | deter | ok          |         0 | 0.0151199 |      7 |    19 |          37 |   1 |   7 |             0 |          0 |            0 |           1387 |               18792 |          33 |
| (F(p1)) & (F(p2)) & (F(p3)) & (F(p4))              | small | ok          |         0 | 0.0166691 |     16 |    81 |         256 |   1 |  16 |             0 |          0 |            1 |           2727 |               57786 |          74 |
| (F(p1)) & (F(p2)) & (F(p3)) & (F(p4))              | deter | ok          |         0 | 0.0161634 |     16 |    81 |         256 |   1 |  16 |             0 |          0 |            1 |           2727 |               57786 |          74 |
| !((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)))           | small | ok          |         0 | 0.0167047 |      5 |     8 |          64 |   1 |   5 |             1 |          1 |            0 |            801 |                8468 |           5 |
| !((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)))           | deter | ok          |         0 | 0.0160785 |     15 |    65 |         175 |   1 |  15 |             0 |          0 |            0 |           2527 |               37226 |          73 |
| (F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))    | small | ok          |         0 |  0.018485 |     32 |   243 |        1024 |   1 |  32 |             0 |          0 |            1 |           5330 |              114068 |         350 |
| (F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))    | deter | ok          |         0 | 0.0209914 |     32 |   243 |        1024 |   1 |  32 |             0 |          0 |            1 |           5330 |              114068 |         350 |
| !((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5))) | small | ok          |         0 | 0.0196063 |      6 |    10 |         160 |   1 |   6 |             1 |          1 |            0 |           1000 |               10707 |           6 |
837

838
839
In this last example, we saved the CSV output to =ltlcross.csv= so we
can play with it in the next section.
840

841
** Working with these CSV files in R
842

843
844
The produced CSV should be directly readable by R's CSV input functions like
=read.csv()=, =readr::read_csv()=, or =data.table::fread()=.
845

846
#+BEGIN_SRC R
847
848
849
850
851
852
library(data.table)
dt <- fread('ltlcross.csv')
str(dt)
#+END_SRC
#+RESULTS:
#+begin_example
853
854
data.table 1.12.0  Latest news: r-datatable.com

855
856
857
858
859
Classes ‘data.table’ and 'data.frame':	20 obs. of  16 variables:
 $ formula            : chr  "F(p1)" "F(p1)" "!(F(p1))" "!(F(p1))" ...
 $ tool               : chr  "small" "deter" "small" "deter" ...
 $ exit_status        : chr  "ok" "ok" "ok" "ok" ...
 $ exit_code          : int  0 0 0 0 0 0 0 0 0 0 ...
860
 $ time               : num  0.0284 0.0283 0.0283 0.0282 0.029 ...
861
862
863
864
865
866
867
868
869
870
871
872
873
 $ states             : int  2 2 1 1 4 4 3 3 8 8 ...
 $ edges              : int  3 3 1 1 9 9 5 5 27 27 ...
 $ transitions        : int  4 4 1 1 16 16 7 7 64 64 ...
 $ acc                : int  1 1 1 1 1 1 1 1 1 1 ...
 $ scc                : int  2 2 1 1 4 4 3 3 8 8 ...
 $ nondet_states      : int  0 0 0 0 0 0 0 0 0 0 ...
 $ nondet_aut         : int  0 0 0 0 0 0 0 0 0 0 ...
 $ complete_aut       : int  1 1 0 0 1 1 0 0 1 1 ...
 $ product_states     : int  400 400 200 200 798 798 598 598 1587 1587 ...
 $ product_transitions: int  8272 8272 2055 2055 16533 16533 7367 7367 33068 33068 ...
 $ product_scc        : int  3 3 2 2 5 5 4 4 34 34 ...
 - attr(*, ".internal.selfref")=<externalptr>
#+end_example
874

875
876
877
Currently the data frame shows one line per couple (formula, tool).
This makes comparing tools quite difficult, as their results are on
different lines.
878

879
880
881
A common transformation is to group the results of all tools on the
same line: using exactly one line per formula.  This is easily
achieved using =dcast()= from the =data.table= library.
882

883
#+BEGIN_SRC R
884
885
886
dt2 <- dcast(dt, formula ~ tool, value.var=names(dt)[-(1:2)], sep=".")
str(dt2)
#+END_SRC
887

888
889
#+RESULTS:
#+begin_example
890

891
892
893
894
895
896
Classes ‘data.table’ and 'data.frame':	10 obs. of  29 variables:
 $ formula                  : chr  "!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)) & (F(p5)))" "!((F(p1)) & (F(p2)) & (F(p3)) & (F(p4)))" "!((F(p1)) & (F(p2)) & (F(p3)))" "!((F(p1)) & (F(p2)))" ...
 $ exit_status.deter        : chr  "ok" "ok" "ok" "ok" ...
 $ exit_status.small        : chr  "ok" "ok" "ok" "ok" ...
 $ exit_code.deter          : int  0 0 0 0 0 0 0 0 0 0
 $ exit_code.small          : int  0 0 0 0 0 0 0 0 0 0
897
898
 $ time.deter               : num  0.0172 0.0212 0.02 0.0191 0.0282 ...
 $ time.small               : num  0.0172 0.0221 0.0203 0.0195 0.0283 ...
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
 $ states.deter             : int  31 15 7 3 1 4 8 16 32 2
 $ states.small             : int  6 5 4 3 1 4 8 16 32 2
 $ edges.deter              : int  211 65 19 5 1 9 27 81 243 3
 $ edges.small              : int  10 8 6 5 1 9 27 81 243 3
 $ transitions.deter        : int  781 175 37 7 1 16 64 256 1024 4
 $ transitions.small        : int  160 64 24 7 1 16 64 256 1024 4
 $ acc.deter                : int  1 1 1 1 1 1 1 1 1 1
 $ acc.small                : int  1 1 1 1 1 1 1 1 1 1
 $ scc.deter                : int  31 15 7 3 1 4 8 16 32 2
 $ scc.small                : int  6 5 4 3 1 4 8 16 32 2
 $ nondet_states.deter      : int  0 0 0 0 0 0 0 0 0 0
 $ nondet_states.small      : int  1 1 1 0 0 0 0 0 0 0
 $ nondet_aut.deter         : int  0 0 0 0 0 0 0 0 0 0
 $ nondet_aut.small         : int  1 1 1 0 0 0 0 0 0 0
 $ complete_aut.deter       : int  0 0 0 0 0 1 1 1 1 1
 $ complete_aut.small       : int  0 0 0 0 0 1 1 1 1 1
 $ product_states.deter     : int  5130 2527 1387 598 200 798 1587 2727 5330 400
 $ product_states.small     : int  1000 801 601 598 200 798 1587 2727 5330 400
 $ product_transitions.deter: int  82897 37226 18792 7367 2055 16533 33068 57786 114068 8272
 $ product_transitions.small: int  10707 8468 6171 7367 2055 16533 33068 57786 114068 8272
 $ product_scc.deter        : int  349 73 33 4 2 5 34 74 350 3
 $ product_scc.small        : int  6 5 4 4 2 5 34 74 350 3
 - attr(*, ".internal.selfref")=<externalptr>
 - attr(*, "sorted")= chr "formula"
#+end_example
924

925
926
927
928
929
Using the above form, it is easy to compare two tools on some given
measurement, as we just need to plot two columns.  For example to
compare the number of states produced by the two configurations of
=ltl2tgba= for each formula, we just need to plot column
=dt2$state.small= against =dt2$state.deter=.
930

931
#+BEGIN_SRC R :results output graphics :width 5 :height 5 :file ltlcross-r.svg
932
933
934
935
library(ggplot2)
ggplot(dt2, aes(x=states.small, y=states.deter)) +
   geom_abline(colour='white') + geom_point()
#+END_SRC
936

937
938
#+RESULTS:
[[file:ltlcross-r.svg]]
939
940


941
942
We should probably print the formulas for the cases where the two
sizes differ.
943

944
#+BEGIN_SRC R :results output graphics :width 5 :height 5 :file ltlcross-r2.svg
945
946
ggplot(dt2, aes(x=states.small, y=states.deter)) +
   geom_abline(colour='white') + geom_point() +
947
   geom_text(data=subset(dt2, states.small != states.deter),
948
949
             aes(label=formula), hjust=0, nudge_x=.5)
#+END_SRC
950

951
952
#+RESULTS:
[[file:ltlcross-r2.svg]]
953
954
955
956
957

* Miscellaneous options

** =--stop-on-error=

958
959
960
The =--stop-on-error= option will cause =ltlcross= to abort on the
first detected error.  This include failure to start some translator,
read its output, or failure to passe the sanity checks.  Timeouts are
961
allowed unless =--fail-on-time= is also given.
962
963
964
965
966
967
968
969
970

One use for this option is when =ltlcross= is used in combination with
=randltl= to check translators on an infinite stream of formulas.

For instance the following will cross-compare =ltl2tgba= against
=ltl3ba= until it finds an error, or your interrupt the command, or it
runs out of memory (the hash tables used by =randltl= and =ltlcross=
to remove duplicate formulas will keep growing).

971
#+BEGIN_SRC sh :exports code :eval no
972
randltl -n -1 --tree-size 10..25 a b c | ltlcross --stop-on-error 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
973
974
#+END_SRC

975
976
977
978
979
** =--save-bogus=FILENAME=

The =--save-bogus=FILENAME= will save any formula for which an error
was detected (either some translation failed, or some problem was
detected using the resulting automata) in =FILENAME=.  Again, timeouts
980
981
are not considered to be errors and therefore not reported in this
file, unless =--fail-on-timeout= is given.
982
983
984
985
986
987

The main use for this feature is in conjunction with =randltl='s
generation of random formulas.  For instance the following command
will run the translators on an infinite number of formulas, saving
any problematic formula in =bugs.ltl=.

988
#+BEGIN_SRC sh :exports code :eval no
989
randltl -n -1 --tree-size 10..25 a b c | ltlcross --save-bogus=bugs.ltl 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
990
991
992
993
994
#+END_SRC

You can periodically check the contents of =bugs.ltl=, and then run
=ltlcross= only on those formulas to look at the problems:

995
#+BEGIN_SRC sh :exports code :eval no
996
ltlcross -F bugs.ltl 'ltl2tgba --lbtt %f >%O' 'ltl3ba -f %s >%O'
997
998
#+END_SRC

999
** =--grind=FILENAME=
1000

1001
1002
1003
This option tells =ltlcross= that, when a problem is detected, it
should try to find a smaller formula that still exhibits the
problem.
1004

1005
1006
1007
1008
1009
1010
1011
Here is the procedure used:
   - internally list the mutations of the bogus formula and sort
     them by length (as [[file:ltlgrind.org][=ltlgrind --sort=]] would do)
   - process every mutation until one is found that exhibit the bug
   - repeat the process with this new formula, and again until a formula
     is found for which no mutation exhibit the bug
   - output that last formula in =FILENAME=
1012

1013
1014
1015
1016
If =--save-bogus=OTHERFILENAME= is provided, every bogus formula found
during the process will be saved in =OTHERFILENAME=.

Example:
1017
#+BEGIN_SRC sh :prologue "exec 2>&1" :epilogue true
1018
ltlcross -f '(G!b & (!c | F!a)) | (c & Ga & Fb)' "modella %L %O" \
1019
1020
1021
1022
  --save-bogus=bogus \
  --grind=bogus-grind
#+END_SRC
#+RESULTS:
1023
1024
#+begin_example
| & G ! p0 | ! p1 F ! p2 & & p1 G p2 F p0
1025
1026
Running [P0]: modella 'lcr-i0-Nc8B1P' 'lcr-o0-CDjvYF'
Running [N0]: modella 'lcr-i0-Io4LVv' 'lcr-o0-C482Sl'
1027
Performing sanity checks and gathering statistics...
1028
error: P0*N0 is nonempty; both automata accept the infinite word:
1029
1030
       cycle{!p0 & !p1}

1031
1032
Trying to find a bogus mutation of (G!b & (!c | F!a)) | (c & Ga & Fb)...
Mutation 1/22: & & p0 G p1 F p2
1033
1034
Running [P0]: modella 'lcr-i1-EmhjSb' 'lcr-o0-q1GzR1'
Running [N0]: modella 'lcr-i1-mwR1QR' 'lcr-o0-gEcuQH'
1035
1036
Performing sanity checks and gathering statistics...

1037
Mutation 2/22: & G ! p0 | ! p1 F ! p2
1038
1039
Running [P0]: modella 'lcr-i2-4UoNQx' 'lcr-o0-W9W6Qn'
Running [N0]: modella 'lcr-i2-h5IDRd' 'lcr-o0-VDFaS3'
1040
1041
Performing sanity checks and gathering statistics...

1042
Mutation 3/22: | G ! p0 & & p1 G p2 F p0
1043
1044
Running [P0]: modella 'lcr-i3-bkvvTT' 'lcr-o0-wMAQUJ'
Running [N0]: modella 'lcr-i3-qoYoWz' 'lcr-o0-ILwXXp'
1045
Performing sanity checks and gathering statistics...
1046
error: P0*N0 is nonempty; both automata accept the infinite word:
1047
1048
       cycle{!p0 & !p1}

1049
1050
Trying to find a bogus mutation of G!b | (c & Ga & Fb)...
Mutation 1/16: t
1051
1052
Running [P0]: modella 'lcr-i4-avS30f' 'lcr-o0-MYCa45'
Running [N0]: modella 'lcr-i4-vJss7V' 'lcr-o0-ItCKaM'
1053
1054
Performing sanity checks and gathering statistics...

1055
Mutation 2/16: G ! p0
1056
1057
Running [P0]: modella 'lcr-i5-TG7leC' 'lcr-o0-N6UXhs'
Running [N0]: modella 'lcr-i5-KwJJli' 'lcr-o0-kbRvp8'
1058
1059
Performing sanity checks and gathering statistics...

1060
Mutation 3/16: & & p0 G p1 F p2
1061
1062
1063
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1064
Mutation 4/16: | G ! p0 & p1 F p0
1065
1066
Running [P0]: modella 'lcr-i6-otaRtY' 'lcr-o0-bRLcyO'
Running [N0]: modella 'lcr-i6-3DMJCE' 'lcr-o0-v04gHu'
1067
Performing sanity checks and gathering statistics...
1068
error: P0*N0 is nonempty; both automata accept the infinite word:
1069
1070
       cycle{!p0 & !p1}

1071
1072
Trying to find a bogus mutation of G!b | (c & Fb)...
Mutation 1/10: t
1073
1074
1075
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1076
Mutation 2/10: G ! p0
1077
1078
1079
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1080
Mutation 3/10: & p0 F p1
1081
1082
Running [P0]: modella 'lcr-i7-gKcHMk' 'lcr-o0-UPD7Ra'
Running [N0]: modella 'lcr-i7-4HUKX0' 'lcr-o0-Dpno3Q'
1083
1084
Performing sanity checks and gathering statistics...

1085
Mutation 4/10: | p0 G ! p1
1086
1087
Running [P0]: modella 'lcr-i8-H6GH9G' 'lcr-o0-xyO1fx'
Running [N0]: modella 'lcr-i8-w3vxmn' 'lcr-o0-wgw3sd'
1088
1089
Performing sanity checks and gathering statistics...

1090
Mutation 5/10: | G ! p0 F p0
1091
1092
Running [P0]: modella 'lcr-i9-vt8eA3' 'lcr-o0-982qHT'
Running [N0]: modella 'lcr-i9-qrbNOJ' 'lcr-o0-ceD9Vz'
1093
1094
Performing sanity checks and gathering statistics...

1095
Mutation 6/10: | ! p0 & p1 F p0
1096
1097
Running [P0]: modella 'lcr-i10-6upQ3p' 'lcr-o0-EStxbg'
Running [N0]: modella 'lcr-i10-7nUoj6' 'lcr-o0-e4DgrW'
1098
1099
Performing sanity checks and gathering statistics...

1100
Mutation 7/10: | & p1 F p0 G p0
1101
1102
Running [P0]: modella 'lcr-i11-ohXyzM' 'lcr-o0-bozRHC'
Running [N0]: modella 'lcr-i11-6wYkQs' 'lcr-o0-TCxOYi'
1103
1104
Performing sanity checks and gathering statistics...

1105
Mutation 8/10: | & p0 p1 G ! p0
1106
1107
Running [P0]: modella 'lcr-i12-51Vd88' 'lcr-o0-uWKDhZ'
Running [N0]: modella 'lcr-i12-0OkfrP' 'lcr-o0-aEdRAF'
1108
1109
Performing sanity checks and gathering statistics...

1110
Mutation 9/10: | G ! p0 & p0 F p0
1111
1112
Running [P0]: modella 'lcr-i13-vy57Kv' 'lcr-o0-lcfpVl'
Running [N0]: modella 'lcr-i13-D7SQ5b' 'lcr-o0-k8Hig2'
1113
Performing sanity checks and gathering statistics...
1114
error: P0*N0 is nonempty; both automata accept the infinite word:
1115
1116
       cycle{!p0}

1117
1118
Trying to find a bogus mutation of G!c | (c & Fc)...
Mutation 1/7: t
1119
1120
1121
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1122
Mutation 2/7: G ! p0
1123
1124
1125
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1126
Mutation 3/7: & p0 F p0
1127
1128
Running [P0]: modella 'lcr-i14-AvSorS' 'lcr-o0-AZkvCI'
Running [N0]: modella 'lcr-i14-Hd7LNy' 'lcr-o0-pM82Yo'
1129
1130
Performing sanity checks and gathering statistics...

1131
Mutation 4/7: | p0 G ! p0
1132
1133
Running [P0]: modella 'lcr-i15-tygKaf' 'lcr-o0-YHFrm5'
Running [N0]: modella 'lcr-i15-GL9iyV' 'lcr-o0-riOaKL'
1134
1135
Performing sanity checks and gathering statistics...

1136
Mutation 5/7: | G ! p0 F p0
1137
1138
1139
warning: This formula or its negation has already been checked.
         Use --allow-dups if it should not be ignored.

1140
Mutation 6/7: | ! p0 & p0 F p0
1141
1142
Running [P0]: modella 'lcr-i16-M0RHWB' 'lcr-o0-iVlf9r'
Running [N0]: modella 'lcr-i16-WD4Xli' 'lcr-o0-Ez6Gy8'
1143
1144
Performing sanity checks and gathering statistics...

1145
Mutation 7/7: | G p0 & p0 F p0
1146
1147
Running [P0]: modella 'lcr-i17-F1BLLY' 'lcr-o0-Z9nQYO'
Running [N0]: modella 'lcr-i17-efo5bF' 'lcr-o0-fFzkpv'
1148
1149
Performing sanity checks and gathering statistics...

1150
Smallest bogus mutation found for (G!b & (!c | F!a)) | (c & Ga & Fb) is G!c | (c & Fc).
1151
1152
1153
1154

error: some error was detected during the above runs.
       Check file bogus for problematic formulas.
#+end_example
1155

1156
#+BEGIN_SRC sh
1157
1158
1159
1160
1161
1162
1163
1164
1165
cat bogus
#+END_SRC

#+RESULTS:
: (G!b & (!c | F!a)) | (c & Ga & Fb)
: G!b | (c & Ga & Fb)
: G!b | (c & Fb)
: G!c | (c & Fc)

1166
#+BEGIN_SRC sh
1167
1168
1169
1170
1171
cat bogus-grind
#+END_SRC

#+RESULTS:
: G!c | (c & Fc)
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181

** =--no-check=

The =--no-check= option disables all sanity checks, and only use the supplied
formulas in their positive form.

When checks are enabled, the negated formulas are intermixed with the
positives ones in the results.  Therefore the =--no-check= option can
be used to gather statistics about a specific set of formulas.

1182
** =--verbose=
1183
1184
1185
   :PROPERTIES:
   :CUSTOM_ID: verbose
   :END:
1186
1187
1188
1189
1190

The verbose option can be useful to troubleshoot problems or simply
follow the list of transformations and tests performed by =ltlcross=.

For instance here is what happens if we try to cross check =ltl2tgba=
1191
1192
1193
and =ltl3ba -H1= on the formula =FGa=.  Note that =ltl2tgba= will
produce transition-based generalized Büchi automata, while =ltl3ba
-H1= produces co-Büchi alternating automata.
1194

1195
#+BEGIN_SRC sh :prologue "export SPOT_HOA_TOLERANT=1; exec 2>&1"
1196
ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --verbose
1197
1198
1199
1200
1201
#+END_SRC

#+RESULTS:
#+begin_example
F(G(a))
1202
1203
1204
1205
Running [P0]: ltl2tgba -H 'F(G(a))'>'lcr-o0-ltzvEc'
Running [P1]: ltl3ba -H1 -f '<>([](a))'>'lcr-o1-dqnX28'
Running [N0]: ltl2tgba -H '!(F(G(a)))'>'lcr-o0-wmIXr5'
Running [N1]: ltl3ba -H1 -f '!(<>([](a)))'>'lcr-o1-yJesT1'
1206
1207
1208
1209
info: collected automata:
info:   P0	(2 st.,3 ed.,1 sets)
info:   N0	(1 st.,2 ed.,1 sets) deterministic complete
info:   P1	(2 st.,3 ed.,1 sets)
1210
info:   N1	(3 st.,5 ed.,1 sets) univ-edges complete
1211
Performing sanity checks and gathering statistics...
1212
1213
info: getting rid of universal edges...
info:   N1	(3 st.,5 ed.,1 sets) -> (2 st.,4 ed.,1 sets)
1214
1215
1216
1217
1218
info: complementing automata...
info:   P0	(2 st.,3 ed.,1 sets) -> (2 st.,4 ed.,1 sets)	Comp(P0)
info:   N0	(1 st.,2 ed.,1 sets) -> (1 st.,2 ed.,1 sets)	Comp(N0)
info:   P1	(2 st.,3 ed.,1 sets) -> (2 st.,4 ed.,1 sets)	Comp(P1)
info:   N1	(2 st.,4 ed.,1 sets) -> (2 st.,4 ed.,1 sets)	Comp(N1)
1219
1220
info: getting rid of any Fin acceptance...
info:	Comp(N0)	(1 st.,2 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1221
info:	     P1 	(2 st.,3 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1222
1223
1224
1225
1226
1227
1228
info:	Comp(N1)	(2 st.,4 ed.,1 sets) -> (3 st.,6 ed.,1 sets)
info: check_empty P0*N0
info: check_empty Comp(N0)*Comp(P0)
info: check_empty P0*N1
info: check_empty P1*N0
info: check_empty P1*N1
info: check_empty Comp(N1)*Comp(P1)
1229
info: cross_checks and consistency_checks unnecessary
1230
1231
1232
1233
1234

No problem detected.
#+end_example

First =FGa= and its negations =!FGa= are translated with the two
1235
tools, resulting in four automata: two positive automata =P0= and =P1=
1236
1237
for =FGa=, and two negative automata =N0= and =N1=.

1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
Some basic information about the collected automata are displayed.
For instance we can see that although =ltl3ba -H1= outputs co-Büchi
alternating automata, only automaton =N1= uses universal edges: the
automaton =P1= can be used like a non-alternating co-Büchi automaton.

=ltlcross= then proceeds to transform alternating automata (only weak
alternating automata are supported) into non-alternating automata.
Here only =N1= needs this transformation.

Then =ltlcross= computes the complement of these four
1248
automata.
1249
1250
1251
1252
1253
1254

Now that =ltlcross= has four complemented automata, it has to make
sure they use only =Inf= acceptance because that is what our emptiness
check procedure can handle.  So there is a new pass over all automata,
rewriting them to get rid of any =Fin= acceptance.

1255
After this preparatory work, it is time to actually compare these
1256
1257
1258
1259
1260
1261
automata.  Together, the tests =P0*N0= and =Comp(N0)*Comp(P0)= ensure
that the automaton =N0= is really the complement of =P0=.  Similarly
=P1*N1= and =Comp(N1)*Comp(P1)= ensure that =N1= is the complement of
=P1=.  Finally =P0*N1= and =P1*N0= ensure that =P1= is equivalent to
=P0= and =N1= is equivalent to =N0=.

1262
1263
1264
Note that if we reduce =ltlcross='s ability to determinize
automata for complementation, the procedure
can look slightly more complex:
1265

1266
#+BEGIN_SRC sh :prologue "export SPOT_HOA_TOLERANT=1; exec 2>&1"
1267
ltlcross -f 'FGa' ltl2tgba 'ltl3ba -H1' --determinize-max-states=1 --verbose
1268
1269
1270
1271
1272
#+END_SRC

#+RESULTS:
#+begin_example
F(G(a))
1273
1274
1275
1276
Running [P0]: ltl2tgba -H 'F(G(a))'>'lcr-o0-HHyVWR'
Running [P1]: ltl3ba -H1 -f '<>([](a))'>'lcr-o1-scKnIH'
Running [N0]: ltl2tgba -H '!(F(G(a)))'>'lcr-o0-6Wloux'
Running [N1]: ltl3ba -H1 -f '!(<>([](a)))'>'lcr-o1-MQ7Rin'
1277
1278
1279
1280
info: collected automata:
info:   P0	(2 st.,3 ed.,1 sets)
info:   N0	(1 st.,2 ed.,1 sets) deterministic complete
info:   P1	(2 st.,3 ed.,1 sets)
1281
info:   N1	(3 st.,5 ed.,1 sets) univ-edges complete
1282
Performing sanity checks and gathering statistics...
1283
1284
info: getting rid of universal edges...
info:   N1	(3 st.,5 ed.,1 sets) -> (2 st.,4 ed.,1 sets)
1285
1286
1287
1288
1289
info: complementing automata...
info:   P0	not complemented (more than 1 states required)
info:   N0	(1 st.,2 ed.,1 sets) -> (1 st.,2 ed.,1 sets)	Comp(N0)
info:   P1	not complemented (more than 1 states required)
info:   N1	(2 st.,4 ed.,1 sets) -> (2 st.,4 ed.,1 sets)	Comp(N1)
1290
1291
info: getting rid of any Fin acceptance...
info:	Comp(N0)	(1 st.,2 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1292
info:	     P1 	(2 st.,3 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
1293
1294
1295
1296
1297
1298
1299
info:	Comp(N1)	(2 st.,4 ed.,1 sets) -> (3 st.,6 ed.,1 sets)
info: check_empty P0*N0
info: check_empty P0*N1
info: check_empty Comp(N0)*N1
info: check_empty P1*N0
info: check_empty Comp(N1)*N0
info: check_empty P1*N1
1300
1301
1302
info: complements were not computed for some automata
info: continuing with cross_checks and consistency_checks
info: building state-space #1/1 of 200 states with seed 0
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
info: state-space has 4136 edges
info: building product between state-space and P0 (2 st., 3 ed.)
info:   product has 400 st., 8298 ed.
info:               2 SCCs
info: building product between state-space and P1 (2 st., 3 ed.)
info:   product has 400 st., 8298 ed.
info:               2 SCCs
info: building product between state-space and N0 (1 st., 2 ed.)
info:   product has 200 st., 4136 ed.
info:               1 SCCs
info: building product between state-space and N1 (2 st., 4 ed.)
info:   product has 400 st., 8272 ed.
info:               1 SCCs
info: cross_check {P0,P1}, state-space #0/1
info: cross_check {N0,N1}, state-space #0/1
info: consistency_check (P0,N0), state-space #0/1
info: consistency_check (P1,N1), state-space #0/1

No problem detected.
#+end_example

In this case, =ltlcross= does not have any complement automaton for
=P0= and =P1=, so it cannot make sure that =P0= and =P1= are
equivalent.  If we imagine for instance that =P0= has an empty
language, we can see that the six =check_empty= tests would still
succeed.

So =ltlcross= builds a random state-space of 200 states, synchronize
it with the four automata, and then performs additional checks
(=cross_check= and =consistency_check=) on these products as described
[[#checks][earlier]].  While these additional checks do not make a proof that =P0=
and =P1= are equivalent, they can catch some problems, and would
easily catch the case of an automaton with an empty language by
mistake.
1337
1338
1339
1340
1341
1342

Here is the same example, if we declare that =ltl3ba= is a reference
implementation that should not be checked, and we just want to check
the output of =ltl2tgba= against this reference.  See how the number
of tests performed has been reduced.

1343
#+BEGIN_SRC sh  :prologue "export SPOT_HOA_TOLERANT=1; exec 2>&1"
1344
1345
1346
1347
1348
1349
ltlcross -f 'FGa' ltl2tgba --reference 'ltl3ba -H1' --verbose
#+END_SRC

#+RESULTS:
#+begin_example
F(G(a))
1350
1351
1352
1353
Running [P0]: ltl3ba -H1 -f '<>([](a))'>'lcr-o0-bh9PHg'
Running [P1]: ltl2tgba -H 'F(G(a))'>'lcr-o1-LvvYEm'
Running [N0]: ltl3ba -H1 -f '!(<>([](a)))'>'lcr-o0-bcUDEs'
Running [N1]: ltl2tgba -H '!(F(G(a)))'>'lcr-o1-Pw1REy'
1354
1355
1356
1357
1358
1359
1360
1361
info: collected automata:
info:   P0	(2 st.,3 ed.,1 sets)
info:   N0	(3 st.,5 ed.,1 sets) univ-edges complete
info:   P1	(2 st.,3 ed.,1 sets)
info:   N1	(1 st.,2 ed.,1 sets) deterministic complete
Performing sanity checks and gathering statistics...
info: getting rid of universal edges...
info:   N0	(3 st.,5 ed.,1 sets) -> (2 st.,4 ed.,1 sets)
1362
1363
1364
info: complementing automata...
info:   P1	(2 st.,3 ed.,1 sets) -> (2 st.,4 ed.,1 sets)	Comp(P1)
info:   N1	(1 st.,2 ed.,1 sets) -> (1 st.,2 ed.,1 sets)	Comp(N1)
1365
1366
1367
1368
1369
1370
1371
info: getting rid of any Fin acceptance...
info:	     P0 	(2 st.,3 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
info:	Comp(N1)	(1 st.,2 ed.,1 sets) -> (2 st.,3 ed.,1 sets)
info: P0 and N0 assumed correct and used as references
info: check_empty P0*N1
info: check_empty P1*N0
info: check_empty P1*N1
1372
1373
info: check_empty Comp(N1)*Comp(P1)
info: cross_checks and consistency_checks unnecessary
1374
1375
1376

No problem detected.
#+end_exampl