A well-structured transition system (WSTS) is an infinite well-quasi-ordered set of states equipped with transition relations satisfying one of various possible monotonicity properties. WSTS were introduced in [Fin87] for the purpose of capturing properties common to a wide range of formal models used in verification. Since their inception, much of the work on WSTS has been dedicated to identifying generic classes of WSTS for which verification problems are decidable. Such problems include termination, boundedness [Fin87, Fin90, FPS01] and coverability [ACJT96, ACJT00, BFM17, BFM18]. In general, verifying safety and liveness properties corresponds respectively to deciding the coverability and the repeated control-state reachability problems. Coverability can be decided for WSTS by two different algorithms: the backward algorithm [ACJT96, ACJT00] and by combining two forward semi-procedures, one of which enumerates all downwards-closed invariants [GRB06, BFM17, BFM18]. Repeated control-state reachability is undecidable for general WSTS, but decidable for Petri nets by use of the Karp-Miller coverability tree [KM67] and the detection of increasing sequences. That technique fails on well-structured extensions of Petri nets: generating the Karp-Miller tree does not always terminate on -Petri nets [RMdF11], on reset Petri nets [DFS98], on transfer Petri nets, on broadcast protocols, and on the depth-bounded -calculus [HMM14, RM12, ZWH12] which can simulate reset Petri nets. This is perhaps why little research has been conducted on coverability tree algorithms and model checking of liveness properties for general WSTS. Nonetheless, some recent Petri nets extensions, -Petri nets [GHPR15] and unordered data Petri nets [HLL16], benefit from algorithms in the style of Karp and Miller. Hence, there is hope of finding a general framework of WSTS with Karp-Miller-like algorithms.
1.2. The Karp-Miller coverability procedure
In 1967, Karp and Miller [KM67] proposed what is now known as the Karp-Miller coverability tree algorithm, which computes a finite representation (the clover) of the downward closure (the cover) of the reachability set of a Petri net. In 1978, Valk extended the Karp-Miller algorithm to post-self-modifiying nets [Val78], a strict extension of Petri nets. In 1987, the second author proposed a generalization of the Karp-Miller algorithm that applies to a class of finitely branching WSTS with strong-strict monotonicity, and having a WSTS completion in which least upper bounds replace the original Petri nets -accelerations [Fin87, Fin90]. In 2004, Finkel, McKenzie and Picaronny [FMP04] applied the framework of [Fin90] to the construction of Karp-Miller trees for strongly increasing -recursive nets, a class generalizing post-self-modifiying nets. In 2005, Verma and the third author [VG05]
showed that the construction of Karp-Miller trees can be extended to branching vector addition systems with states. In 2009, the second and the third authors[FG12] proposed a non-terminating procedure that computes the clover of any complete WSTS; this procedure terminates exactly on so-called cover-flattable systems. Recently, this framework has been used for defining computable accelerations in non-terminating Karp-Miller algorithms for both the depth-bounded -calculus [HMM14] and for -Petri nets; terminating Karp-Miller trees are obtained for strict subclasses.
1.3. Model checking WSTS
In 1994, Esparza [Esp94] showed that model checking the linear time -calculus is decidable for Petri nets by using both the Karp-Miller algorithm and a decidability result due to Valk and Jantzen [VJ85] on infinite -continual sequences in Petri nets. LTL is undecidable for Petri net extensions such as lossy channel systems [AJ94] and lossy counter machines [Sch10]. In 1998, Emerson and Namjoshi [EN98] studied the model checking of liveness properties for complete WSTS, but their procedure is not guaranteed to terminate. In 2004, Kouzmin, Shilov and Sokolov [KSS04] gave a generic computability result for a fragment of the -calculus; in 2006 and 2013, Bertrand and Schnoebelen [BBS06, BS13] studied fixed points in well-structured regular model checking; both [KSS04] and [BS13] are concerned with formulas with upwards-closed atomic propositions, and do not subsume LTL. In 2011, Chambart, Finkel and Schmitz [CFS11, CFS16] showed that LTL is decidable for the recursive class of trace-bounded complete WSTS; a class which does not contain all Petri nets.
1.4. Our contributions
We define very-well-structured transition systems (very-WSTS); a class defined in terms of WSTS completions, and which encompasses models such as Petri nets, -Petri nets, post-self-modifying nets and strongly increasing -recursive nets. We show that coverability sets of very-WSTS are computable as finite sets of ideals.
The general clover algorithm of [FG12], based on the ideal completion studied in [FG09], does not necessarily terminate and uses an abstract acceleration enumeration. We give an algorithm, the Ideal Karp-Miller algorithm, which organizes accelerations within a tree. We show that this algorithm terminates under natural order-theoretic and effectiveness conditions, which we make explicit. This allows us to unify various versions of Karp-Miller algorithms in particular classes of WSTS.
We identify the crucial notion of acceleration level of an ideal, and relate it to ordinal ranks of sets of reachable states in the completion. We show, notably, that termination is equivalent to the rank being strictly smaller than
. This classifies WSTS into those with high rank (the bad ones), among which those whose sets of states consist of words (, lossy channel systems) or multisets; and those with low rank (the good ones), among which Petri nets and post-self-modifying nets.
We show that the downward closure of the trace language of a very-WSTS is computable, again as a finite union of ideals. This shows that downward traces inclusion is decidable for very-WSTS.
Finally, we prove the decidability of model checking liveness properties for very-WSTS under some effectiveness hypotheses.
1.5. Differences between very-WSTS and WSTS of [Fin90]
The class of WSTS of [Fin90, Def. 4.17] is reminiscent of very-WSTS. It requires WSTS to be finitely branching and strictly monotone, whereas our definition allows infinite branching and requires the completion to be strictly monotone. Moreover, [Fin90, Thm. 4.18], which claims that its Karp-Miller procedure terminates, is incorrect since it does not terminate on transfer Petri nets and broadcast protocols [EFM99], which are finitely branching and strictly monotone WSTS. Finally, some assumptions required to make the Karp-Miller procedure of [Fin90] effective are missing.
We write for set inclusion and for strict set inclusion. A relation over a set is a quasi-ordering if it is reflexive and transitive, and a partial ordering if it is antisymmetric as well. It is well-founded if it has no infinite descending chain. A quasi-ordering is a well-quasi-ordering (resp. well partial order), wqo (resp. wpo) for short, if for every infinite sequence , there exist such that . This is strictly stronger than being well-founded.
One example of well-quasi-ordering is the componentwise ordering of tuples over . More formally, is well-quasi-ordered by where, for every , if and only if for every . We extend to where for every . ordered componentwise is also well-quasi-ordered. Let be a finite alphabet. We denote the set of finite words and infinite words over respectively by and . For every , we write if is a subword of , can be obtained from by removing zero, one or multiple letters. is well-quasi-ordered by .
2.1. Transition systems
A (labeled and ordered) transition system is a triple such that is a set, is a finite alphabet, for every , and is a quasi-ordering on . Elements of are called the states of , each is a transition relation of , and is the ordering of . A class of transition systems is any set of transition systems. We extend transition relations to sequences over , for every , , and if there exists such that . We write (resp. ) if there exists (resp. ) such that . The finite and infinite traces of a transition system from a state are respectively defined as
We define the immediate successors and immediate predecessors of a state under some sequence as
The successors and predecessors of are
These notations are naturally extended to sets, .
We say that is deterministic if for every and . When is deterministic, each induces a partial function such that for each such that . For readability, we simply write for , . For every , we write for if .
2.2. Well-structured transition systems
A (labeled and ordered) transition system is a well-structured transition system (WSTS) if is a well-quasi-ordering and is monotone, for all and such that and , there exists such that and . Many other types of monotonicities were defined in the literature (see e.g. [FPS01]), but, for our purposes, we only need to introduce strong monotonicities. We say that has strong monotonicity if for all and , and implies for some . We say that has strong-strict monotonicity111Strong-strict monotonicity should not be confused with strong and strict monotonicities. Here strongness and strictness have to hold at the same time. if it has strong monotonicity and for all and , and implies for some .
2.3. Verification problems
We say that a target state is coverable from an initial state if there exists such that . The coverability problem asks whether a target state is coverable from an initial state . The repeated coverability problem asks whether a target state is coverable infinitely often from an initial state ; whether there exist such that and for every .
3. An investigation of the Karp-Miller algorithm
In order to present our Karp-Miller algorithm for WSTS, we first highlight the key components of the Karp-Miller algorithm for vector addition systems. A -dimensional vector addition system (-VAS) is a WSTS induced by a finite set and the rules:
Vector addition systems are deterministic and have strong-strict monotonicity. Given a -VAS and a vector , the Karp-Miller algorithm initializes a rooted tree whose root is labeled by . For every such that , a child labeled by is added to the root. This process is repeated successively to the new nodes. If a newly added node has an ancestor such , then it is not explored furthermore. If a newly added node has an ancestor such , then is relabeled by the vector such that if and if . The latter operation is called an acceleration of .
A vector is coverable from if and only if the resulting tree contains a node such that . Similarly, is repeatedly coverable from if and only if contains a node that has an ancestor that was accelerated, and such that .
3.1. Ideals and completions
One feature of the Karp-Miller algorithm is that it works over instead of . Intuitively, vectors containing some correspond to “limit” elements. For a generic WSTS , a similar extension of is not obvious. Let us present one, called the completion of in [FG12]. Instead of operating over , the completion of operates over the so-called ideals of . In particular, the ideals of are isomorphic to .
Let be a set quasi-ordered by . The downward closure of is defined as
A subset is downwards-closed if . An ideal is a downwards-closed subset that is additionally directed: is non-empty and for all , there exists such that and (equivalently, every finite subset of has an upper bound in ). We denote the set of ideals of by , .
It is known that
Therefore, every ideal of is naturally represented by some vector of , and vice versa. We write for this representation, for every . For example, the ideal is represented by .
Downwards-closed subsets can often be represented by finitely many ideals: [[ET43, Bon75, Pou79, PZ85, Fra86, LMP87]] Let be a well-quasi-ordered set. For every downwards-closed subset , there exist s.t. .
This theorem gives rise to a canonical decomposition of downwards-closed sets. The ideal decomposition of a downwards-closed subset is the set of maximal ideals contained in with respect to inclusion. We denote the ideal decomposition of by . By Theorem 3.1, is finite, and . In [FG12, BFM18], the notion of ideal decomposition is used to define the completion of unlabeled WSTS. We slightly extend this notion to labeled WSTS:
Let be a labeled WSTS. The completion of is the labeled transition system such that
The completion of a WSTS enjoys numerous properties. In particular, it has strong monotonicity, and it is finitely branching [BFM18], is finite for every and . Note that if has strong-strict monotonicity, then this property is not necessarily preserved by [BFM18]. Moreover, the completion of a WSTS may not be a WSTS since is not always well-quasi-ordered by . However, for the vast majority of models used in formal verification, is well-quasi-ordered, and hence completions remain well-structured. Indeed, is well-quasi-ordered if and only if is a so-called -wqo, and widespread wqos, except possibly graphs under minor embedding, are -wqo, as discussed in [FG12]. The traces of a WSTS are closely related to those of its completion:
[[BFM18]] The following holds for every WSTS :
For all and , if , then for every ideal , there exists an ideal such that .
For all and , if , then for every , there exist and such that and . If has strong monotonicity, then .
if has strong monotonicity, then for all and .
if has strong monotonicity, then and for every .
By induction on . When , the claim is obvious. Otherwise, write as where , , , and let , for some state . Certainly is in , hence in . Write the ideal decomposition of the latter as . For some , , is in , and by definition . By induction hypothesis, for some ideal containing , whence the result.
By induction of again. The case is obvious, too. Otherwise, write as , where , , . There is an ideal such that , and the induction hypothesis gives us elements and , and a word such that and . (Moreover, if has strong monotonicity, then .) By definition of , is included in , so there are elements and with such that . Since is monotonic, there is a further element and a further word such that . (If is strongly monotonic, , so .) This entails that , and if is strongly monotonic, .
Let and let . By (2), there exist and such that and . Thus, . Conversely, let . There exist and such that and . By (1), there exists an ideal such that . Thus, and .
For every , there is a state such that . Use (1) on : we obtain an ideal such that , showing that . Conversely, for every , there is an ideal such that , where . Ideals are non-empty, so pick . By (2), there are states and such that . The fact that is in , namely that , allows us to invoke strong monotonicity and obtain a state such that . In particular, is in .
Let . Let , and let be such that . Let . By (1), there exists an ideal such that . This process can be repeated using (1) to obtain with for every . ∎
It is worth noting that if is infinitely branching, then an infinite trace of from is not necessarily an infinite trace of from (e.g. see [BFM18]).
Whenever the completion of a WSTS is deterministic, we will often write for if the latter is nonempty and if there is no ambiguity with .
3.2. Levels of ideals
The Karp-Miller algorithm terminates for the following reasons: is well-quasi-ordered and ’s can only be added to vectors along a branch at most times. Loosely speaking, the latter property means that has “levels”. Here, we generalize this notion. We say that an infinite sequence of ideals is an acceleration candidate if . An acceleration candidate is below if for every , and it goes through a set if for some .
The level of is defined as
When is clear from the context, we will simply write instead of . For the specific case of , it can be shown that:
Hence, for all :
Therefore, we have which corresponds to the fact that has different levels. In particular, if we identify with , the set of its -representations, then is equivalent to for every . More formally:
is the set of -tuples with less than components equal to .
Using the fact that grows as grows, it suffices to show the claim for . This is shown by induction on . The case is obvious.
Let . If has at least components equal to , we obtain an acceleration candidate by picking an index such that , and forming the tuples for . By induction hypothesis, these tuples have at least components equal to and therefore cannot be in . This entails that cannot be in .
Conversely, assume that has less than components equal to , say at positions (the general case is obtained by applying a permutation of the indices). There are only finitely many tuples that have their first components equal to . Therefore any acceleration candidate below , being infinite, must contain a tuple with at most components equal to . Since , by induction hypothesis it must go through , showing that . ∎
In general, we observe that ideal levels are monotonic and downwards-closed with respect to ideal inclusion: The following holds for every :
for every , if and , then ,
Let . If , then both claims follow immediately. Therefore, let us assume that .
Let and let be such that . We must show that . Let be an acceleration candidate below . We have for every . Therefore, is also below . Since , we conclude that goes through , and hence that .
Let . For the sake of contradiction, suppose . By assumption, there exists an acceleration candidate below that does not go through . Note that for every . By (1), this implies that for every . Therefore, we conclude that goes through , which is a contradiction. ∎
We have seen that has only levels, i.e. . We generalize this notion as follows:
has finitely many levels if there exists such that .
In the forthcoming sections, we will be interested in sets of ideals that have finitely many levels. It is however worth mentioning that there are natural sets whose ideals do not have finitely many levels of ideals, even if is assumed to be countable and well-quasi-ordered. We postpone this discussion to Section 5 where we will study ideal levels in more details and in a more abstract setting.
The last key aspect of the Karp-Miller algorithm is the possibility to accelerate nodes. In order to generalize this notion, let us briefly develop some intuition. Recall that a newly added node is accelerated if it has an ancestor such that . Consider the non-empty sequence labeling the path from to . Since -VAS have strong-strict monotonicity, both over and , is defined for every . For example, if is encountered, is replaced by . This represents the fact that for every , there exists some reachable marking . Note that an acceleration increases the number of occurrences of . In our example, the ideal , which is of level , is replaced by , which is of level . Based on these observations, we extend the notion of acceleration to completions:
Let be a WSTS such that is deterministic, let , and let be such that . The acceleration of under is defined as:
In other words, if can be accelerated by repeatedly applying , then its acceleration is the least upper bound of . This least upper bound is also an ideal: Let be a WSTS such that is deterministic. We have for every and such that .
If , then the claim trivially holds. Thus, we may assume that is an acceleration candidate. Since is a union of downwards-closed sets, it is readily seen to be downwards-closed. Let us show that it is also directed. Let . There exist such that and . Therefore, both and are elements of . Since is an ideal, there exists such that and . ∎
Recall that in the Karp-Miller algorithm for vector addition systems, the level of an ideal remains unchanged when applying a transition, and increases when accelerated. This holds because the completion of a vector addition system has strong-strict monotonicity. We introduce a more general (weaker) type of monotonicity that essentially yields the same behaviour.
Let be a WSTS. We define the level of an ideal as follows. If for some , then is the smallest such , and otherwise . We say that the completion of has leveled-strong-strict monotonicity if for every and such that , the following holds:
In other words, leveled-strong-strict monotonicity only requires strong-strict monotonicity to hold between ideals of the same level. Let us remark that completions of Petri nets have strong-strict monotonicity, but -Petri nets only have leveled-strong-strict monotonicity.
Let us recall the model of post-self-modifying nets [Val78] for which there is a Karp-Miller algorithm. In a post-self-modifying nets, transitions consume tokens as in Petri nets but they may add the result of applying a (different) positive affine function in each place. It has been shown [FMP04] that post-self-modifying nets are WSTS with strong-strict monotonicity on and their completions are still WSTS with strong monotonicity on , but they are not strictly monotone on (contrary to Figure 3 in [FMP04]). Let us show here that completions of post-self-modifying nets are not strictly monotone. Let us consider a post-self-modifying net with two places and an unique transition that adds the content of into . Consider the two -markings in and fire transition , extended on , from both -markings; we obtain and transition is not strictly increasing on , even if is strictly increasing on ; hence the completion of does not satisfy strict monotonicity.
We may now show the following: Let be a WSTS such that is deterministic and has leveled-strong-strict monotonicity. Let and be such that and . The following holds:
if , then ,
We prove the claim by induction on . If , then the claim trivially holds since and hence for every ideal . Suppose that and that the claim holds for levels smaller than . For the sake of contradiction, assume that . Since and is the smallest such that , there exists an acceleration candidate below such that for every .
For the sake of contradiction, suppose that for some . The sequence is an acceleration candidate below . Therefore, there exists such that , which is a contradiction. Therefore, there exist infinitely many indices such that . Let be these indices. We have
Moreover, by induction hypothesis, for every . Thus, by (1), leveled-strong-strict monotonicity and determinism of , we have
By definition of levels, there exists such that . Thus, we derive
which is a contradiction since by induction hypothesis.
Assume . For the sake of contradiction, suppose that . Since , the sequence is an acceleration candidate. By definition of , this acceleration candidate is below . Moreover, it goes through , and hence there exists such that . This contradicts (1). ∎
4. The Ideal Karp-Miller algorithm
We have now introduced all the concepts necessary to present our generalization of the Karp-Miller algorithm. This algorithm applies to a new class222Note that the definition of very-WSTS given here is slightly more general than the one that appeared in the preliminary version of this paper [BFGL17]. More precisely, strong-strict monotonicity is replaced here with leveled-strong-strict monotonicity, which allows to encompass models such as -Petri nets. of WSTS that enjoy all of the generalized properties of vector addition systems:
A very-WSTS is a labeled WSTS such that:
has strong monotonicity,
is a deterministic WSTS with leveled-strong-strict monotonicity,
has finitely many levels.
We claim that the class of very-WSTS includes vector addition systems, vector addition systems with states, Petri nets, -Petri nets [GHPR15], post-self-modifying nets [Val78] and strongly increasing -recursive nets [FMP04] for which Karp-Miller algorithms were known.
Recall that a strongly increasing function is a nondecreasing function defined on an upward closed set of that satisfies the following strongly increasing property:
where the ordering is defined by
A strongly increasing recursive net is a finite set of strongly increasing recursive functions. A strongly increasing -recursive net is a strongly increasing recursive net such that the continuous extensions of the functions satisfy the previous strongly increasing property but over instead (see, , [FG12] for a definition of continuous extension). Let us write for the transition system naturally associated with a net . We may observe that .
Since nondecreasing functions of post-self-modifying nets and of strongly increasing -recursive nets are incomparable, we define another class of nondecreasing functions that subsumes the two previous ones. Let us identify the nondecreasing functions over that are strictly increasing, but only on the subset of such that and have the same number of ’s.
A leveled-increasing partial function is a nondecreasing partial function such that its continuous extension satisfies the following property: for every such that and contain the same number of (in terms of ideals, and have the same level), the following holds:
A leveled-increasing recursive net is a finite set of leveled-increasing recursive partial functions.
Let us remark that the composition of two leveled-increasing partial functions is still a leveled-increasing partial function, hence the associated transition system is a WSTS with leveled-strong-strict monotonicity.
Leveled-increasing recursive nets are very-WSTS.
Let be a leveled-increasing recursive net. By hypothesis, has strong monotonicity since the partial functions of are nondecreasing. Moreover, can be shown to be a deterministic WSTS, and is a deterministic WSTS with leveled-strong-strict monotonicity because finite composition of partial functions in is leveled-increasing. Finally, the set of states is and we know that has finitely many levels. Therefore, is a very-WSTS. ∎
Since vector addition systems, vector addition systems with states, Petri nets and strongly increasing -recursive nets are leveled-increasing recursive nets by definition, to prove our claim it is sufficient to prove that post-self-modifying nets and -Petri nets are leveled increasing recursive nets.
Post-self-modifying nets are leveled increasing recursive nets.
Let be a post-self-modifying net. Let us prove that each partial function occurring on a transition of is leveled-increasing. Recall that where
is greater or equal to the identity matrix componentwise, and.
Recall that we want to show that for every