1 Introduction
This paper describes several new techniques to improve formal analysis of both propositional logic formulas and Linear temporal logic formulas. The new presented improvement techniques are mainly based on the notion of formula simplification table. A formula simplification table is a mathematical table that shows all possible simplified forms of the formula under different truth assignments of its variables. Constructing a simplification table of a formula has several advantages. First, it can be used to compute a logical influence weight of each variable in the formula, which is a metric that shows the importance of the variable to the outcome of the formula. Second, it can be used to identify variables in the specification that have the highest logical influence on its outcome. Third, it can be used to synthesize Boolean expressions for sets of configurations (i.e., assignments of variables) that yield the same simplified formulas of the original formula. Hence, formula simplification table can be used to optimize existing solutions of several fundamental software verification problems.
However, the scalability of formula simplification table requires controlling the size of the formula (i.e., the number of variables in the formula), as the size of the table grows exponentially with respect to the number of variables. To address this issue we present an algorithm for reducing large formulas to a simplified form by detecting and contracting variables whose logical influences on the outcome of the formula are equivalent. Instead of using specialized heuristics to control formula size, we present a systematic approach for simplifying LTL formulas that identifies variables with equivalent logical influences on the outcome of the formula. Hence, simplifications we perform in this paper cannot be obtained by detecting duplicates, syntactic contradictions or tautologies.
The presented simplifications are mainly based on the observation that most of large formulas contain variables with equivalent logical influences, and therefore one needs not to consider all the variables in the formula when constructing a formula simplification table. It is possible then to construct much smaller formula sufficient to prove the original property. In particular, given an input formula , our simplification technique produces a simplified formula while reducing and contracting variables whose logical influences on the outcome of the formula are equivalent. Then some sound logical extension rules are applied to draw valid conclusions about the original formula.
We demonstrate the effectiveness of formula simplification table in the context of software verification by developing efficient solution to the wellknown decentralized LTL monitoring problem. In decentralized LTL monitoring problem, a set of processes cooperate with each other in order to monitor a global LTL formula, where each process observes only subset of the variables of the main formula. The problem is to allow each process to monitor the formula through communicating with other processes. The goal is then to develop a solution that allows processes to detect violation of the global formula as early as possible and with least communication overhead. We develop an efficient solution to the problem by synthesizing efficient communication strategy for processes that allows them to propagate their observations in an optimal way.
2 The Decentralized LTL Monitoring Problem
A distributed program is a set of processes which cooperate with each other in order to achieve a certain task. Distributed monitoring is less developed and more challenging than local monitoring: they involve designing a distributed algorithm that monitors another distributed algorithm. In this work, we assume that no two processes share a common variable. Each process of the distributed system emits events at discrete time instances. Each event is a set of actions denoted by some atomic propositions from the set . We denote by and call it the alphabet of the system. We assume that the distributed system operates under the perfect synchrony hypothesis, and that each process sends and receives messages at discrete instances of time, which are represented using identifier . An event in a process , where , is either

internal event (i.e. an assignment statement),

message sent, where the local state of remains unchanged, or

message received, where the local state of remains unchanged.
Since each process sees only a projection of an event to its locally observable set of actions, we use a projection function to restrict atomic propositions to the local view of monitor attached to process , which can only observe those of process . For atomic propositions (local to process ), , and we denote , for all . For events, and we denote for all . We assume that and consequently . That is, events are local to the processes where they are monitored. The system’s global trace, can now be described as a sequence of pairwise unions of the local events of each process’s traces. We denote the set of all possible events in by and hence the set of all events of by . Finite traces over an alphabet are denoted by , while infinite traces are denoted by .
Definition 1
(LTL formulas [17]). The set of LTL formulas is inductively defined by the grammar
where is read as next, as eventually (in the future), as always (globally), as until, and is a propositional variable.
Definition 2
(LTL Semantics [17]). Let be a infinite word with being a position. Then we define the semantics of LTL formulas inductively as follows


iff

iff

iff or

iff for some

iff for all

iff with and with

iff
We now review the definition of threevalued semantics LTL that is used to interpret common LTL formulas, as defined in [5]. The semantics of LTL is defined on finite prefixes to obtain a truth value from the set .
Definition 3
(LTL semantics). Let denote a finite word. The truth value of a LTL formula with respect to , denoted by , is an element of defined as follows:
According to the semantics of LTL the outcome of the evaluation of can be inconclusive (?). This happens if the so far observed prefix itself is insufficient to determine how evaluates in any possible future continuation of .
Problem 1
(The decentralized monitoring problem). Given a distributed program , a finite globalstate trace , an property , and a set of monitor processes such that

monitor can read the local state of process , and

monitor can communicate with other monitor processes.
The problem is then to design an algorithm that allows each monitor to evaluate through communicating with other monitor processes. The problem can be studied under different settings and different assumptions. However, in this work, we make a number of assumptions about the class of systems that can be monitored in our framework.

A1: the monitored system is a synchronous timed system with a global clock;

A2: processes are reliable (i.e., no process is malicious).
It is interesting to note that the synchronous assumption imposed in our setting is by no means unrealistic, as in many realworld systems, communication occurs synchronously. We refer the reader to [6, 8] in which the authors discussed a number of interesting examples of protocols for safetycritical systems in which communication occurs synchronously.
3 Detecting Variables with Equivalent Logical Influences
In this section, we discuss techniques that can be used to detect variables in a Boolean formula or in an LTL formula whose logical influences on the outcome of the formula are equivalent. Given a formula with a set of propositional variables , we ask the following questions:

Does contain variables whose logical influences on the outcome of the formula are equivalent?

Can we develop tests to extract variables with equivalent logical influences?

Can we assign a value (a logical influence measure) to every variable in , corresponding to its importance in affecting the outcome of the formula?

Can we identify the variable that have the highest logical influence on the outcome of the formula ?
First we need to define what it means for variables to have equivalent logical influence. Consider the following simple propositional logic formula Do variables and have equivalent logical influence? Do variables and have equivalent logical influence? Which variable has the highest logical influence on the outcome of ? The answers to these questions depend on how the formula is simplified under different truth assignments of its variables. To answer questions (14) we introduce what we call a formula simplification table which shows how the formula gets simplified under different truth assignments of the variables. We first give a definition of formula simplification table and then give some examples by which we demonstrate how one can construct a simplification table for a formula.
Definition 4
(Formula simplification table). A simplification table is a mathematical table that shows all possible simplified forms of a given formula that result from different truth assignment of its variables. A simplification table has one column for each input variable, and one final column showing the simplified formula under the given combination of truth assignments. The variables take their truth values from the truth domain . Each row of the table contains one possible configuration of the variables and the formula that results from substituting truth values of the variables in the main formula.
A simplification table for the formula is given in Table 1. Before proceeding further, let us summarize the basic rules that one needs to follow when construction a simplification table of a formula.

Truth values of variables are taken from the truth domain .

Only variables with known truth values will be substituted in the formula.
a  b  c  Simplified formula  a  b  c  Simplified formula  a  b  c  Simplified formula 

?  ?  ?  ?  ?  ?  ?  
?  ?  ?  ?  
?  ?  ?  
?  ?  ?  
?  
?  ?  
?  ?  ?  ?  
?  
? 
The simplification table provides a rich source of information about the structure of formula and its simplifications under different truth assignments of its variables, that is not available from other data structures. In addition to providing key information about the importance of each variable in the formula, the table also allows one to detect variables with equivalent logical influence and configurations that lead to the same simplified formula. We first discuss the following two new notions: (1) variables with equivalent logical influences, and (2) the influence weight of a variable on the outcome of the formula.
Definition 5
(Variables with equivalent logical influences). Two variables in a formula are said to be equivalent in their logical influences on the outcome of the formula if under the same truth assignment they yield formulas with identical syntactic structure. Let be a formula and be the set of variables in . We say that the two variables have equivalent logical influences on (denoted as ) if the following condition holds
where is a function that returns a new formula of after substituting the truth value of in and is a function that replaces all instances of in to (i.e., changing the name of the variable to ). For example, and .
From the simplification table of (Table 1) we note that the two variables and have equivalent logical influence on the outcome of as and , while the variables and have inequivalent logical influence as .
Definition 6
(Influence weights of variables). The influence weight of a variable in a given formula is a metric that shows the importance of the variable in affecting the outcome of the formula. It can be computed from the simplification table of the formula. Let be a formula and be the set of variables of and . The influence weight of the variable (denoted as ) can be computed by taking the ratio of the number of formulas in the simplification table that appears in (let us denote by ) to the number of truth combinations of the variables in which has unknown truth value () (let us denote it by ). Hence, can be computed as follows
From Table 1 we note that , , and . It is easy to see that the variable has higher logical influence on the outcome of the formula than both and . This can be shown from the value of the influence weight of which is larger than the weights of both and . Note that the larger the influence weight of the variable, the more important the variable (i.e., the variable has higher influence on the outcome of the formula). As we discuss later there are several factors that can affect the influence weight of a variable in a given formula: (a) the number of times the variable appears in the formula, (b) the logical connectives used in the formula, and (c) the length of the formula.
Definition 7
(Equivalent configurations). Let be a formula with a set of propositional variables . We say that the two configurations and are equivalent if they lead to the same simplified formula, where . Formally, we say that the two configurations and are equivalent if
The simplification table of a formula can be used also to derive Boolean formulas characterizing the conditions under which the main formula can be simplified into some specific formulas. Deriving such Boolean formulas can be very useful for certain problems in formal verification such as the decentralized LTL monitoring problem, where processes can use such formulas to determine the minimal set of variables whose truth values need to be propagated. For example, for the formula one can see from the simplification table of that there are multiple configurations that lead to the same simplified formula. For instance, there are five different configurations that simplify the formula to the atomic formula . One can then derive a Boolean formula characterizing the cases under which can be simplified to , which will be in this case ). Note that is given here in its simplest form.
The technique can be used also for LTL formulas to compute the influence weights of variables in a given LTL formula. Note that for propositional logic formulas, we call the table as simplification table since the formula gets simplified once we substitute a truth value of a variable in the formula (i.e., the size of the formula is reduced). This is not always the case for temporal formulas, as the formula may be expanded at each state of the trace to express sets of obligations (requirements) that the system should fulfill for the remaining part of the trace. We therefore call the table as progression table rather than simplification table when dealing with LTL formulas. The key question is then how to deal with temporal operators when constructing a progression table. Let us construct a progression table for the temporal formula
Since we mainly use the progression table to measure the influence weights of the variables to the outcome of the formula, we choose to restrict the temporal operators to specific time step and use the classical expansion rules to express the semantics of the operators (i.e., ). It is interesting to note that restricting temporal operators to specific time step does not harm the analysis, it just simplifies it. From the definition of influence weights (see Definition 6) it is sufficient then to consider the temporal operators at single step to compute the logical influence of variables to the outcome of the formula.
However, before constructing a progression table for the formula we use Definition 5 to detect variables in the formula whose logical influences on the outcome of the formula are equivalent. This would help to reduce the size of the table. Using Definition 5 we conclude that and but . We therefore have two sets of variables whose logical influences are equivalent: and . In this case we do not need to construct a full progression table for the formula as and . We only need to compute the influence weights of the variables and .
From the progression table of the formula (Table 2) we can see that the variables and have higher logical influences on the outcome of the formula than the variables and , where and . This is mainly due to the semantics of the operators and and that the subformulas and are connected using the logical connective . This leads to the conclusion that the set of logical and temporal operators used in the formula affect the weights of the variables.
Observation 1
It is possible to have a variable in an LTL formula whose influence weight is one. For example, for the formula we notice that and that .
In addition to the length of the formula and the set of logical and temporal operators used in the formula, the number of times the variable appears in the formula can affect its influence weight on the outcome of the formula. Let us consider the following example to demonstrate this.
Example 1
Consider the following LTL formula Using Definition 5 we see that the formula has no variables with equivalent logical influences, where and and . Note that even the variables and appear within the scope of the operator and the variables and appear within the scope of the operator. This is simply because the variable appears twice in the formula which makes it the most important variable in the formula.
However, it is not possible to detect equivalent variables in large formulas using the progression table due to the memory explosion problem (i.e., the size of the table grows exponentially w.r.t. the number of variables). It is therefore necessary to develop an algorithm that can be used to detect equivalent variables. Since we deal with formulas with Boolean variables which take only two possible truth values, we can then develop an efficient algorithm for detecting equivalent variables in a given formula as shown in Algorithm 19. The algorithm takes advantage of the fact that the relation is reflexive, symmetric, and transitive.
4 Simplifications
When some variables are shown to be equivalent in their logical influences w.r.t. the outcome of a formula, then some of these variables can be replaced by one representative. We now describe the basic steps that can be followed to simplify a formula that contains variables with equivalent logical influences.

Detect sets of variables in the formula whose logical influences on the outcome of the formula are equivalent. This can be performed using Def. 5.

Fix the names of some variables (maybe 23 variables) in each derived set while replacing the names of the other variables to one of the fixed names.

Reconstruct the formula using the new set of variables names. This yields a formula with redundant variables.

Simplify the resulting formula by eliminating redundant variables.
The resulting simplified LTL formula has the same syntactic structure as the original formula but in a reduced form, as the number of variables in the simplified formula is less than that of the original formula.
Example 2
Consider the following LTL formula
Clearly, the formula contains variables whose logical influences are equivalent. To detect variables with equivalent logical influences we use Definition 5. According to Definition 5 the formula has two sets of variables with equivalent logical influences: and . Suppose that we choose to maintain the variables and from and replace the names of the other variables in by and and from and replace the names of the other variables in by . This yields the following formula
The formula contains redundant variables and hence can be simplified to
In this case, we reduce the number of variables in the formula from to 4 variables. Such simplification helps to construct efficiently a simplification table for and draw some valid conclusions about as we shall discuss later.
The above described simplification rules lead to reduce the size of formulas which contain variables with equivalent logical influences from to , where is the number of variables in the main formula, and is the number of sets of variables whose logical influences are equivalent.
5 From Simplified Formula to Original Formula
We now describe the basic steps that can be followed to draw correct logical conclusions about the original formula from the results obtained of the simplified formula. Given an LTL formula we simplify to by detecting and contracting variables with equivalent logical influences as described at Section 4. Note that the simplified formula contains only subset of the variables of the original formula and hence conclusions derived from the simplified formula need to be extended while considering missing variables in the original formula (i.e., variables that are in the original formula but not in the simplified formula).

Construct a progression table for the simplified formula .

Compute influence weights of the variables in the simplified formula .

Synthesize Boolean formulas for sets of configurations in the progression table of the formula that yield the same LTL formula.

Extend influence weights of the variables to the original formula .

Extend sets of synthesized Boolean formulas to the original formula .
Note that steps (13) of the above procedure can be performed as described in the previous section. We now describe how steps (45) can be implemented by developing rules for extending logical conclusions derived from the simplified formula. Let be a Boolean formula synthesized from the progression table of the formula for sets of configurations that yield the LTL formula . The general form of the Boolean formula can be expressed as follows
where each term has the form (a product of a set of variables), where is a set of propositional variables from . Let be the sets of variables with equivalent logical influence extracted from the formula . Note that for each set we maintain only two variables in the simplified formula. Let us denote the variables maintained from the set by and which we will use to formalize the extension rules given below. Extending sets of Boolean formulas from the simplified formula to the original formula can take one of the following forms: (i) extending by adding new variables to some terms in , and (ii) extending by adding new terms to . The application of extension rules depends mainly on the syntactic structure of the formula .

When none of the variables in the equivalent set appears in the formula . That is, for all we have . We have three cases here

if there exists a term in such that then for each variable in that is not in the short formula add a new term to that is identical to while replacing the variable by one from the set that is not in the short formula.

if there exists a term in such that then add all variables in that is not in the short formula to .

if none of the variables in appears in the terms of then the formula needs not to be extended with respect to the set .


When variables and appear in the formula . We have two case here

if variables and appear in the formula but none of them appears in the terms of the formula . In this case, we need to extend the formula by adding all variables in that are not in to while preserving the syntactic structure of the formula .

if variables and appear in the formula (i.e., ) and in the formula . Then the formula will be extended in two steps (i) add all variables in that are not in to while preserving the syntactic structure of , and (ii) use extension rules 1(a)1(b) to extend the formula .

Theorem 5.1
Extension rules 1(a)1(c) and 2(a)2(b) are sound rules.
Proof
The proof of the Theorem can be constructed by case analysis, where the shape (the syntactic structure) of the Boolean formula determines the way the formula will be extended. Let be an LTL formula and be a simplified form of obtained by detecting and contracting equivalent variables in as described at Section 4. Let be a set of variables of whose logical influences on the outcome of are equivalent. Suppose that we maintain two variables from in the simplified formula , let us denote them by and . Let be a Boolean formula synthesized from the progression table of that we aim to extend to the original formula . Note first that the general form of the Boolean formula can be expressed as follows
where each term has the form (a product of a set of variables), is a set of propositional variables from , and is an LTL formula. From the syntactic structure of the formula , one can see that the extension of to the original formula can take one of the following forms: (i) extending by adding new variables to some terms in , and (ii) extending by adding new terms to . The extension of depends on the way the variables and appear in , since the other variables that are not appeared in the simplified formula are equivalent to variables and in their logical influences on the outcome of the formula. There are two main cases to consider here

when none of the variables and appears in the formula . In this case, the extension of depends on the appearance of variables and in . The extension will be proceeded in an iterative way by examining the terms of the formula . For this case, there are several subcases to consider

if there exists a term in where both variables and are in then the variable must be added to the list , where is a variable in the original formula but not in the simplified formula whose logical influence to outcome of the formula is equivalent to and . It is easy to see the soundness of this rule as .

if there exists a term in where only variable or appears in . Then a new term will be added to with the same syntactic structure as while replacing the instance of or by . Again this is due to the observation that and hence they have the same logical influence on the outcome of the formula.

if neither nor appears in any of the terms in . Then obviously none of the missing variables that have equivalent influence on the outcome of the formula will appear in the terms of .


when variables and appear in the formula . There are two cases here

if and appear in but none of them appear in . In this case the variable must be added to formula , where is a variable in the original formula but not in the simplified formula whose logical influence on outcome of the formula is equivalent to and . However, since and do not appear in then needs not to be extended w.r.t. .

if and appear in and appear in . In this case the formula will be extended into two steps: (i) variable must be added to formula , and (ii) the terms of will be extended using rules 1(a) and 1(b). This is mainly because and hence they have equivalent logical influence on the outcome of the main formula.

Note that we synthesize Boolean formulas only for sets of configurations in formula progression table that yield same LTL formulas, and hence lot of configurations will not be considered when extending formulas. We consider here the cases that maybe encountered during analysis. The extension rules are in general straightforward rules as we deal with variables whose logical influences on the outcome are equivalent. However, one may need to develop further rules depending on the syntactic structure of synthesized Boolean formulas from simplified formula. We now discuss some basic properties of influence weights of variables and some useful lemmas that can be used to simplify the computation of influence weights of variables in formulas with large number of variables.
Definition 8
(Properties of influence weights of variables.) Let be an LTL formula with set of variables . The basic properties of logical influence weights of can be summarized as follows

for any variable we have .

when then but the converse in not true.

when we say that the variable has higher logical influence on the outcome of than the variable .

when we say that is a variable of weight one in the sense that a definite truth value of cannot be obtained without knowing .
Variables of weight one are key variables in the formula as satisfaction/falsification cannot be determined without knowing their truth values. Therefore, variables of weight one should receive higher priority than variables of weight less than one when considering solutions that are sensitive to variable ordering. For example the size of a Boolean Decision Diagram (BDD) for a given Boolean function is sensitive to the ordering of the variables in the BDD.
Lemma 1
Let be an LTL formula with a set of propositional variables . Let also be a simplified version of computed as described at Section 4. Then when we have as well.
Proof
From the definition of influence weighs of variables (Definition 6) and that we notice that the presence of all variables in the formula do not affect the weight of the variable . That is, the variable appears in all simplified formulas in the progression table of that result from the truth combinations in which . Note that the formula is a simplified version of ( has the same syntactic structure of but in a short from) in which two variables from each list of variables with equivalent logical influence from the formula are maintained. Let be a list of variables with equivalent logical influence derived from the formula and that variables have been chosen to be maintained in . It is easy to see that adding any new variable to such that will not affect the influence weight of as has equivalent logical influence to and and hence .
Theorem 5.2
Let be an LTL formula with a set of propositional variables . Let be a simplified formula of computed as described at Section 4. Suppose that all variables in have equivalent logical influence on the outcome of and that , where is the denominator of the fraction and is the denominator of the fraction. Then .
Proof
From the definition of influence weighs of variables (Definition 6) we know that is a fraction of the form and that , where the numerator represents the number of formulas in the progression table of the formula that appears in and the denominator represents the number of truth combinations of the variables of in which . Note that the denominator of the fraction has always the form and hence regardless of the syntactic structure of the formula. This is mainly because the variables take their truth values from the truth domain . Note that since all variables in have equivalent logical influence on the outcome of the formula then can be simplified to a formula with only two variables, let us denote them by and . However, since the progression table grows exponentially w.r.t. the number of variables and that all variables in the formula have equivalent logical influence (i.e., ) then it is easy to see that , where is the numerator of and is the number of variables in .
Lemma 1 states that variables of weight one do not get influenced by adding more variables to the formula as long as the syntactic structure of the formula is preserved. On the other hand, Theorem 5.2 states that for formulas whose variables are equivalent in their logical influences then the influence weights of these variables can be computed in a straightforward way using the formula , where is a variable in , is the numerator of the fraction and is the number of variables in the original formula .
Example 3
Consider the following LTL formula
Note that has two sets of variables with equivalent logical behavior: and . Using the simplification rules described at Section 4 we can simplify to . The progression table of the reduced formula is given in Table 2. We consider here the Boolean formulas for the the cases of configurations that lead to the simplified formulas and . The expressions can be given as follows
Extending the Boolean expression to the original formula can be performed using rule 2(c), while extending the expression to the original formula can be performed using rule 1(b) which yield the following formulas
Note that the influence weights of the variables and will be the same since their logical influences on the outcome of the formula are equivalent. From the progression table of the simplified formula we note that
Comments
There are no comments yet.