Model Checking Analysis ToolLTL · Infinite State Systems

MoAT

LTL model checking of infinite state systems via fair termination.

MoAT reduces the LTL model checking problem to fair termination using the well-known automata-based approach, and then calls the termination tools KoAT and LoAT in the backend to prove or disprove it.

Verification Pipeline

  1. 1ProgramInteger Transition System P
  2. 2LTL FormulaProperty φ to verify
  3. 3Büchi AutomatonB for ¬φ built with Spot
  4. 4Synchronized ProductConstruct P ⊗ B
  5. 5Fair TerminationChecked by KoAT and LoAT

About

Existing tools for termination analysis are extremely well suited for LTL model checking of infinite state systems. MoAT (Model Checking Analysis Tool) is a framework which builds on this observation: it uses the well-known automata-based approach and reduces the LTL model checking problem to fair termination.

Linear temporal logic is widely used to express properties of software — local or global invariants, but also properties like termination. While there is a wealth of work on deciding LTL properties for finite state systems, the abstraction step from general programs to finite state systems naturally results in a loss of precision. MoAT therefore targets infinite state systems directly, modeled as integer transition systems (ITSs).

To decide the resulting fair termination problem, MoAT calls the termination tools KoAT and LoAT in the backend. While fair termination is undecidable in general, MoAT benefits from integrating these tools, which can often prove or refute the property for a wide range of practical programs.

Our experiments show that in this way, MoAT is on par with existing state-of-the-art tools for LTL model checking of infinite state systems. This demonstrates that state-of-the-art tools for termination analysis are also very suitable for applications in other areas.

Results at a glance

MoAT was compared against MuVal, nuXmv, Ultimate, and LTL-VerP on 318 C programs from SV-COMP and TermComp, using four LTL property classes and a 60 s timeout per example.

1222

benchmarks solved

most of all compared tools

> 96 %

coverage

across all four property classes

1.11 s

average runtime

fastest tool in the comparison

318

C programs

from SV-COMP and TermComp

Backends

MoAT does not implement its own termination analysis. It delegates to two mature tools, each handling one direction of the problem.

KoAT

answers “Yes”

KoAT infers a termination argument for each transition individually. Because of this modularity, proving fair termination only requires looking at its result on the incoming transitions of fair locations. It uses multiphase-linear ranking functions, a dedicated technique for triangular weakly non-linear loops, and control-flow refinement.

koat.verify.rwth-aachen.de

LoAT

answers “No”

LoAT proves non-termination by searching for reachable non-terminating cycles via an acceleration driven clause learning calculus. This calculus is suitable for arbitrary forms of ITSs, including ITSs with nested loops. To disprove fair termination, it runs until it finds such a cycle that contains a fair location.

LoAT project page

Contact

MoAT is developed at LuFG Informatik 2, RWTH Aachen University. If you encounter any difficulties, please get in touch or open an issue on GitHub.

MoAT

LTL model checking of infinite state systems via fair termination, using the termination tools KoAT and LoAT in the backend.