A Parameterised Boolean Equation System (PBES) [14, 11, 13] is a set of equations denoting some sets as the least and/or greatest fixed-points. PBESs can be used as a powerful tool for solving a variety of problems such as process equivalences , model checking [14, 12], and so on.
We explain PBESs by an example PBES , which consists of the following two equations:
denotes that is a natural number and a formal parameter of . Each of the predicate variables and represents a set of natural numbers regarding that is true if and only if is in . These sets are determined by the equations, where (resp. ) is a least (resp. greatest) fixed-point operator. In the PBES , is an empty set since is the least set satisfying that for any . Similarly, is equal to since is the greatest set satisfying that for any . A PBES is regarded as a declarative program defining predicates. In this example, an execution of the program for an input outputs true.
The membership problem for PBESs is undecidable in general . Undecidability is proved by a reduction of the model checking problem for the modal -calculus with data. Some techniques have been proposed to solve the problem for some subclasses of PBESs: one by instantiating a PBES to a Boolean Equation System (BES) , one by calculating invariants , and one by constructing a proof graph . In the last method, the membership problem is reduced to an existence of a proof graph. If there exists a finite proof graph for a given instance of the problem, it is not difficult to find it mechanically. However, finite proof graphs do not always exist. A technique is proposed in  that possibly produces a finite reduced proof graph, which represents an infinite proof graph. The technique manages the disjunctive PBESs, in which data-quantifiers are not allowed.
In this paper, we propose a more general subclass, named existential PBESs, and extend the notion of dependency spaces. We discuss the relation between extended dependency spaces and the existence of proof graphs. Dependency spaces are, however, infinite graphs in most cases. Thus we reduce a dependency space for the existential class to a finite one in a more sophisticated way based on the existing technique in . We also give a procedure to construct a reduced dependency space and show the soundness of the procedure. We explain its implementation and an experiment on some examples.
2 PBESs and Proof Graphs
We assume a set of data sorts. For every data sort , we assume a set of data variables and a semantic domain corresponding to it. In this paper, we assume corresponding to the Boolean domain and the natural numbers , respectively. We use to represent a sort in , for the semantic domain corresponding to , and and as a data variable in . We assume appropriate data functions according to operators, and use to represent a value obtained by the evaluation of a data expression under a data environment . A data expression interpreted to a value in is called a Boolean expression. We write or by using boldfaced font or an arrow to represent a sequence of objects. Especially, is an abbreviation of a sequence . We write as a product of appropriate domains. In this paper, we use usual operators and constants like , , , , , , , and so on, along with expected data functions.
A Parameterised Boolean Equation System (PBES) is a sequence of well-sorted equations:
where is a predicate formula defined by the following BNF, and is either one of the quantifiers used to indicate the least and greatest fixed-points, respectively ().
Here is a predicate variable with fixed arity, is a Boolean expression, is a data variable in , and is a sequence of data expressions. We say is closed if it does neither contain free predicate variables nor free data variables. Note that the negation is allowed only in expressions or as a data function.
A PBES is given as follows:
Since the definition of the semantics is complex, we omit it and we will explain it by an example. The formal definition can be found in . The meaning of a PBES is determined in the bottom-up order. Considering a PBES in Example 1, we first look at the second equation, which defines a set . The set is fixed depending on the free variable , i.e., the equation should be read as that is the least set satisfying the condition “” for any . Thus the set is fixed as if ; otherwise, i.e., “” for any . Next, we replace the occurrence of in the first equation of with , which results in “”, if we simplify it. The set is fixed as the greatest set satisfying that for any . All in all, we obtain and . The solution of a closed PBES is a function which takes a predicate variable, and returns a function on that represents the corresponding predicate determined by the PBES. For instance, in the example PBES , is the function on that returns if and only if an even number is given, and is the function on that returns
if and only if an odd number is given.
The membership problem for PBESs is a problem that answers whether holds (more formally ) or not for a given predicate variable and a value . The membership problem is characterized by proof graphs introduced in . For a PBES the rank of () is the number of alternations of and in the sequence . Note that the rank of bound with is even and the rank of bound with is odd. For Example 1, and . Bound variables are predicate variables that occur in the left-hand sides of equations in . The set of bound variables is denoted by . The signature in is defined by . We use to represent . We use some graph theory terminology to introduce proof graphs. In a directed graph , the postset of a vertex is the set .
Let be a PBES, , , and . The tuple is called a proof graph for the PBES if both of the following conditions hold:
For any , is evaluated to under the assumption that the signatures in the postset of are and the other signatures are , where is the predicate formula that defines .
For any infinite sequence in the graph, the minimum rank of is even, where is the set of that occurs infinitely often in the sequence.
We say that a proof graph proves if and only if . In the sequel, we consider the case that . The case will derive dual results.
Consider the following graph with and in Example 1:
This graph is a proof graph, which is justified from the following observations:
The graph satisfies the condition (1). For example, for a vertex , the predicate formula is assuming that = .
The graph satisfies the condition (2). For example, for an infinite sequence , the minimum rank of is .
The next theorem states the relation between proof graphs and the membership problem on a PBES.
Theorem 4 ()
For a PBES and a , the existence of a proof graph such that coincides with .
3 Extended Dependency Spaces
This paper discusses an existential subclass of PBESs where universal-quantifiers are not allowed 111This restriction can be relaxed so that universal-quantifiers emerge in of Proposition 5, which does not affect the arguments of this paper. . This class properly includes disjunctive PBESs . Existential PBESs can be represented in simpler forms as shown in the next proposition.
For every existential PBES , there exists an existential PBES satisfying for all , and where is of the following form:
where is either or , is a sequence of data expressions possibly containing variables , and is a Boolean expression containing no free variables except for .
In contrast, a disjunctive PBES is of the following form:
We can easily see that disjunctive PBESs are subclass of existential PBESs. As a terminology, we use -th clause for to refer to .
Hereafter, we extend the notion of dependency spaces , which is designed for disjunctive PBESs, to those for existential PBESs. The dependency space for a PBES contains all its minimal proof graphs and hence is valuable to find a proof graph. The dependency space for a disjunctive PBES is a graph consisting of the vertices labelled with for each data and the edges for all dependencies meaning that . Here means that the predicate formula of holds under the assumption that holds. A proof graph, if it exists, is found as its subgraph by seeking an infinite path satisfying a condition (2) of Definition 2. This corresponds to choosing one out-going edge for each vertex. In this sense, the dependency space consists of -vertices. This framework makes sense because a disjunctive PBES contains exactly one predicate variable in each clause.
On the other hand an existential PBES generally contains more than one predicate variable in each clause defining , which induces dependencies for any data such that and . Hence -vertices are necessary. Therefore, we extend the notion of dependency spaces by introducing -vertices. Such dependencies vary according to the clauses. Thus, we need additional parameters for -vertices in keeping track of the -th clause of . For these reasons, each -vertex is designed to be a quadruple .
We illustrate the idea by an example. Consider an existential PBES :
The dependencies induced from the equation are for each and even . Observing the case , the dependency exists for each . In order to show that holds, it is enough that we choose one of these dependencies for constructing a proof graph. Suppose that we will show , we must find some such that both and hold. Thus it is natural to introduce a -vertex having edges to -vertices corresponding to values. Each -vertex has out-going edges to and . This is represented in Figure 1, where -vertices are oval and newly-introduced -vertices are rectangular.
Each -vertex is labelled with where and come from -th clause for .
Generally the extended graph consists of -vertices for all and and -vertices for all , , , and . Each -th clause for constructs edges:
for every and such that holds (see the figure below).
From now on, we write dependency spaces to refer to the extended one by abbreviating “extended”.
We formalize dependency spaces. The dependency space for a given PBES is a labeled directed graph such that
is a set of vertices,
is a set of edges with , which is determined from the above discussion, and
is a function which assigns / to all vertices.
For the dependency of the PBES , the next graph is a proof graph of . We get this proof graph by choosing for every vertex.
We can see that this proof graph is obtained by removing some vertices and collapsing -vertices into the vertex from the dependency space of (Figure 1).
We show that this property holds in general.
For a given existential PBES, if there exist proof graphs of , then one of them is obtained from its dependency space by removing some /-vertices and collapsing -vertices into the vertex .
Thus in order to obtain a proof graph from the dependency space, we encounter the problem that chooses one out-going edge for each -node so that the condition (2) of Definition 2 is satisfied. This problem corresponds to a problem known as parity games (see Lemma 16 in the appendix for details, and parity games with finite nodes are decidable in NP. Moreover, there is a solver, named PGSolver , which efficiently solves many practical problems.
Unfortunately, since dependency spaces have infinite vertices, it is difficult to apply parity game solvers. Thus we need a way to reduce a dependency space to a finite one as shown in the next section.
4 Reduced Dependency Space
Given a PBES , we define functions and for each -th clause for as follows, where refers to :
Intuitively, is a function that takes a -vertex and returns -vertices as the successors. On the other hand, is a function that takes a -vertex and returns -vertices as the successors. In other words, and indicate the dependencies.
A reduced dependency space is a graph divided by the congruence relation on the algebra that contains operators . We formalize this relation.
Let be an equivalence relation on and respectively. The pair of relations is feasible if all these conditions hold:
For all , if then for any .
For all and , if then for any .
For all , if or then for any .
For all , if then .
Here, we extend the notion of an equivalence relation on some set for the equivalence relation on in this way:
We define a reduced dependency space using a feasible pair of relations and dependency space.
Let be a dependency space of . For a feasible pair of relations, an equivalence relation on is defined as . The reduced dependency space for a given feasible pair of relations is , where .
Note that is well-defined from the definition of .
Next theorem states that the membership problem is reduced to the problem finding a finite reduced dependency space.
Given a finite reduced dependency space of a PBES, then the membership problem of the PBES is decidable.
5 Construction of Reduced Dependency Spaces
In this section, we propose a procedure to construct a feasible pair of relations, i.e., reduced dependency spaces, whose basic idea follows the one in . This seems to be similar to minimization algorithm of automata, but the main difference is on that vertices are infinitely many. Here we use a logical formula to represent (possibly) infinitely many vertices in a single vertex. We start from the most degenerated vertices, which corresponds to a pair of coarse equivalence relations, and divide each vertex until the pair becomes feasible. More specifically, we start from the -vertices and -vertices . The procedure keeps track of a partition of the set for each and a partition of the set for each , and makes partitions finer.
Recall that a partition of a set is a family of sets satisfying and . For a given PBES , we call a family of partitions is a partition family of if has the form , and satisfies the following conditions:
is a partition of for every , and
is a partition of for every .
Every element of a partition family is a partition of or , hence we naturally define an equivalence relation on and on .
We define a function that takes a partition family and returns another partition family obtained by doing necessary division operations to its elements. The procedure repeatedly applies to the initial partition family until it saturates. If it halts, the resulting tuple induces a reduced dependency space. In the procedure, functions (resp. ) represented by Boolean expressions with lambda binding are used to represent an infinite subset of a data domain (resp. ), In other words, a function (resp. ) can be regarded as a set (resp. ). In the sequel, we write Boolean functions for the corresponding sets.
The division function consists of two steps, the division of and . We give an intuitive explanation of the division by a set , where assuming that appears in a PBES as . Recall that the function is defined by and the parameter is quantified by in existential PBESs. We have to divide the data domain into its intersection with and the rest, i.e., and , where denotes the complement of a set . This division is necessary because the feasibility condition requires that the mapped values of are also in the same set, and hence we must separate according to whether is empty or not.
Next, suppose is divided into two blocks and in the first step. We assume that a formula appears in the predicate formula of a PBES. Then, we have to divide into and . This is because the feasibility condition requires that the mapped values of are also in the same set.
Now we formalize these operations. We must divide each set in a partition according to a set in a partition , and similarly divide each set in a partition according to a set in a partition . For the definition, we prepare some kind of the inverse operation for and .
Then the division operations are given as follows:
The operator obviously satisfies , thus we can naturally extend it on sets of formulas as follows:
Also, it is easily shown that if is a partition of , then is also a partition for a set of formulas. These facts are the same in the case of operator .
We unify these operators in a function that refines a given partition family.
Let be . The partition functions for each and are defined as follows:
We bundle these functions as and by composition .
We define the partition procedure that applies the partition function to the trivial partition family until it saturates. We write the family of the partitions obtained from the procedure as .
Consider the existential PBES given as follows:
The reduced dependency space for is:
where and for each and .
In order to construct this, we apply to the initial partition . First, we apply :
We write as for readability. Next, we apply :
The resulting partition family is a fixed-point of , and hence the procedure stops. This partition family induces the set of vertices in the reduced dependency space.
We show that the procedure returns a partition family which induces a feasible pair of relations, i.e., reduced dependency space.
Suppose the procedure terminates and returns a partitions family . Then, the pair and is feasible.
6 Implementation and an Example: Downsized McCarthy 91 Function
This section states implementation issues of the procedure presented in Section 5 and a bit more complex example, which is inspired by the McCarthy 91 function.
We describe the overview of our implementation. For a given PBES, the first step calculates a partitions family by repeatedly applying the function in Definition 10. This step requires a lot of SMT-solver calls. We’ll explain the implementation in the next paragraph. Once the procedure terminates, the obtained partitions family determines a feasible pair and by Theorem 12. Considering the finite dependency space constructed from the pair as a parity game, the second step constructs a proof graph by using PGSolver, which is justified by the proof of Theorem 9. (See Lemma 16 and Lemma 18 stating that the existence of a proof graph can be checked by solving a parity game on a reduced dependency space.)
The key to the implementation of is the operators and used in the function . We focus on this and discuss how to implement these operators. We use Boolean expressions with lambda binding to represent subsets of data domains and as used for the intuitive explanation of the procedure and Example 11. Then it seems as if it would be simple to implement the procedure. It, however, induces non-termination without help of SMT solvers. Let us look more closely at the division operation . Suppose that is given as an argument of . The resulting function is presented as where By using a set of functions to represent a partition , each division of in by is simply implemented; it produces two functions and . This simple symbolic treatment always causes non-termination of the procedure without removing an empty set from the partition. Since the set represented by a function is empty if and only if is unsatisfiable, this can be done by using an SMT solver. An incomplete unsatisfiability check easily causes a non-termination of the procedure, even if the procedure with complete unsatisfiability check terminates. Thus, the unsatisfiability check of Boolean expressions is one of the most important issues in implementing the procedure. For instance, the examples illustrated in this paper are all in the class of Presburger arithmetic, which is the first-order theory of the natural numbers with addition. It is known that the unsatisfiability check of Boolean expressions in this class is decidable .
Consider the following function on determined by a given :
The function returns if , and returns otherwise. The latter property for