UP | HOME

ltlcross

ltlcross is a tool for cross-comparing the output of LTL-to-Büchi translators. It is actually a Spot-based clone of LBTT, the LTL-to-Büchi Translator Testbench, that essentially performs the same sanity checks.

The main motivations for rewriting this tool were:

Although ltlcross performs the same sanity checks as LBTT, it does not implement any of the interactive features of LBTT. In our almost 10-year usage of LBTT, we never had to use its interactive features to understand bugs in our translation. Therefore ltlcross will report problems, but you will be on your own to investigate and fix them.

The core of ltlcross is a loop that does the following steps:

Table of Contents

Formula selection

Formulas to translate should be specified using the common input options. Standard input is read if no -f or -F option is given.

Configuring translators

Each translator should be specified as a string that use some of the following character sequences:

  %f,%s,%l,%w                the formula as a (quoted) string in Spot, Spin,
                             LBT, or Wring's syntax
  %F,%S,%L,%W                the formula as a file in Spot, Spin, LBT, or
                             Wring's syntax
  %N,%T                      the output automaton as a Never claim, or in
                             LBTT's format

For instance here is how we could cross-compare the never claims output by spin and ltl2tgba for the formulas GFa and X(a U b).

ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%N' 'spin -f %s >%N'

When ltlcross executes these commands, %s will be replaced by the formula in Spin's syntax, and %N will be replaced by a temporary file into which the output of the translator is redirected before it is read back by ltlcross.

([](<>(a)))
Running [P0]: ltl2tgba -s '([](<>(a)))' >'lck-o0-5ETnMU'
Running [P1]: spin -f '([](<>(a)))' >'lck-o1-7X6Yyv'
Running [N0]: ltl2tgba -s '(!([](<>(a))))' >'lck-o0-XPo7l6'
Running [N1]: spin -f '(!([](<>(a))))' >'lck-o1-30UfiH'
Performing sanity checks and gathering statistics...

(X((a) U (b)))
Running [P0]: ltl2tgba -s '(X((a) U (b)))' >'lck-o0-aJCvoi'
Running [P1]: spin -f '(X((a) U (b)))' >'lck-o1-pkzwDT'
Running [N0]: ltl2tgba -s '(!(X((a) U (b))))' >'lck-o0-Bmk2Su'
Running [N1]: spin -f '(!(X((a) U (b))))' >'lck-o1-SMGah6'
Performing sanity checks and gathering statistics...

No problem detected.

ltlcross can only read two kinds of output:

  • Never claims (only if they are restricted to representing an automaton using if, goto, and skip statements) such as those output by spin, ltl2ba, ltl3ba, or ltl2tgba --spin. These should be indicated using %N.
  • LBTT's format, which supports generalized Büchi automata with either state-based acceptance or transition-based acceptance. This output is used for instance by lbt, modella, or ltl2tgba --lbtt. These should be indicated using %T.

Of course all configured tools need not the same % sequences.

Getting statistics

Detailed statistics about the result of each translation, and the product of that resulting automaton with the random state-space, can be obtained using the --csv=FILE or --json=FILE option.

The following compare ltl2tgba, spin, and lbt on three random formula (where W and M operators have been rewritten away because they are not supported by spin and lbt).

randltl -n 2 a b |
ltlfilt --remove-wm |
ltlcross --csv=results.csv \
         'ltl2tgba -s %f >%N' \
         'spin -f %s >%N' \
         'lbt < %L >%T'
-:1: (G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))
Running [P0]: ltl2tgba -s '(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))' >'lck-o0-Dt28kK'
Running [P1]: spin -f '([](((p0) U ((p0) && ([](p1)))) V (([](p1)) || ((p0) U ((p0) && ([](p1)))))))' >'lck-o1-m3Stsz'
Running [P2]: lbt < 'lck-i0-pl2RkV' >'lck-o2-yfhxBo'
Running [N0]: ltl2tgba -s '(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))' >'lck-o0-uyGSU2'
Running [N1]: spin -f '(!([](((p0) U ((p0) && ([](p1)))) V (([](p1)) || ((p0) U ((p0) && ([](p1))))))))' >'lck-o1-3D4pbS'
Running [N2]: lbt < 'lck-i0-7hEcLd' >'lck-o2-6BU4sH'
Performing sanity checks and gathering statistics...

-:2: (!((G(F(p0))) -> (F(p1))))
Running [P0]: ltl2tgba -s '(!((G(F(p0))) -> (F(p1))))' >'lck-o0-MwmFzs'
Running [P1]: spin -f '(!((<>(p1)) || (!([](<>(p0))))))' >'lck-o1-jriyel'
Running [P2]: lbt < 'lck-i1-J7Am1z' >'lck-o2-uTg0Td'
Running [N0]: ltl2tgba -s '(G(F(p0))) -> (F(p1))' >'lck-o0-czmYfZ'
Running [N1]: spin -f '(<>(p1)) || (!([](<>(p0))))' >'lck-o1-UMCE2R'
Running [N2]: lbt < 'lck-i1-OveZz6' >'lck-o2-GxtQPK'
Performing sanity checks and gathering statistics...

No problem detected.

After this execution, the file results.csv contains the following:

"formula", "tool",  "states", "edges", "transitions", "acc", "scc", "nonacc_scc", "terminal_scc", "weak_scc", "strong_scc", "nondet_states", "nondet_aut", "terminal_aut", "weak_aut", "strong_aut", "time", "product_states", "product_transitions", "product_scc"
"(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "ltl2tgba -s %f >%N", 3, 5, 9, 1, 3, 2, 0, 1, 0, 2, 1, 0, 1, 0, 0.0455643, 401, 5136, 3
"(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "spin -f %s >%N", 6, 13, 18, 1, 3, 2, 0, 0, 1, 6, 1, 0, 0, 1, 0.0105849, 995, 14384, 5
"(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "lbt < %L >%T", 8, 41, 51, 1, 3, 2, 0, 0, 1, 8, 1, 0, 0, 1, 0.0032736, 1389, 42998, 5
"(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "ltl2tgba -s %f >%N", 4, 10, 16, 1, 3, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0.0442764, 797, 16340, 3
"(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "spin -f %s >%N", 7, 24, 63, 1, 4, 2, 1, 0, 1, 6, 1, 0, 0, 1, 0.00639257, 1400, 64668, 4
"(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "lbt < %L >%T", 39, 286, 614, 3, 28, 26, 1, 0, 1, 33, 1, 0, 0, 1, 0.00399757, 7592, 602204, 4400
"(!((G(F(p0))) -> (F(p1))))", "ltl2tgba -s %f >%N", 2, 4, 4, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0.0426758, 398, 4198, 1
"(!((G(F(p0))) -> (F(p1))))", "spin -f %s >%N", 2, 3, 5, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0.00338899, 398, 5227, 1
"(!((G(F(p0))) -> (F(p1))))", "lbt < %L >%T", 5, 10, 15, 1, 4, 3, 0, 0, 1, 5, 1, 0, 0, 1, 0.00313587, 409, 6401, 12
"(G(F(p0))) -> (F(p1))", "ltl2tgba -s %f >%N", 3, 5, 11, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.043401, 600, 11663, 3
"(G(F(p0))) -> (F(p1))", "spin -f %s >%N", 3, 5, 14, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.00303272, 600, 14840, 3
"(G(F(p0))) -> (F(p1))", "lbt < %L >%T", 11, 18, 54, 2, 11, 9, 1, 1, 0, 5, 1, 0, 1, 0, 0.00304955, 1253, 26891, 457

This can be loaded in any spreadsheet application. Although we only supplied 2 random generated formulas, the output contains 4 formulas because ltlcross had to translate the positive and negative version of each.

If we had used the option --json=results.json instead of --cvs=results.csv, the file results.json would have contained the following JSON output.

{
  "tool": [
    "ltl2tgba -s %f >%N",
    "spin -f %s >%N",
    "lbt < %L >%T"
  ],
  "formula": [
    "(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))",
    "(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))",
    "(!((G(F(p0))) -> (F(p1))))",
    "(G(F(p0))) -> (F(p1))"
  ],
  "fields":  [
  "formula", "tool", "states", "edges", "transitions", "acc", "scc", "nonacc_scc", "terminal_scc", "weak_scc", "strong_scc", "nondet_states", "nondet_aut", "terminal_aut", "weak_aut", "strong_aut", "time", "product_states", "product_transitions", "product_scc"
  ],
  "inputs":  [ 0, 1 ],
  "results": [
    [ 0, 0, 3, 5, 9, 1, 3, 2, 0, 1, 0, 2, 1, 0, 1, 0, 0.0455643, 401, 5136, 3 ],
    [ 0, 1, 6, 13, 18, 1, 3, 2, 0, 0, 1, 6, 1, 0, 0, 1, 0.0105849, 995, 14384, 5 ],
    [ 0, 2, 8, 41, 51, 1, 3, 2, 0, 0, 1, 8, 1, 0, 0, 1, 0.0032736, 1389, 42998, 5 ],
    [ 1, 0, 4, 10, 16, 1, 3, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0.0442764, 797, 16340, 3 ],
    [ 1, 1, 7, 24, 63, 1, 4, 2, 1, 0, 1, 6, 1, 0, 0, 1, 0.00639257, 1400, 64668, 4 ],
    [ 1, 2, 39, 286, 614, 3, 28, 26, 1, 0, 1, 33, 1, 0, 0, 1, 0.00399757, 7592, 602204, 4400 ],
    [ 2, 0, 2, 4, 4, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0.0426758, 398, 4198, 1 ],
    [ 2, 1, 2, 3, 5, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0.00338899, 398, 5227, 1 ],
    [ 2, 2, 5, 10, 15, 1, 4, 3, 0, 0, 1, 5, 1, 0, 0, 1, 0.00313587, 409, 6401, 12 ],
    [ 3, 0, 3, 5, 11, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.043401, 600, 11663, 3 ],
    [ 3, 1, 3, 5, 14, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.00303272, 600, 14840, 3 ],
    [ 3, 2, 11, 18, 54, 2, 11, 9, 1, 1, 0, 5, 1, 0, 1, 0, 0.00304955, 1253, 26891, 457 ]
  ]
}

Here the fields table describes the columns of the results table. The inputs tables lists the columns that are considered as inputs for the experiments. The values in the columns corresponding to the fields formula and tool contains indices relative to the formula and tool tables. This format is more compact when dealing with lots of translators and formulas, because they don't have to be repeated on each line as in the CSV version.

JSON data can be easily processed in any language. For instance the following Python3 script averages each column for each tool, and presents the results in a form that can almost be copied into a LaTeX table (the % in the tool names have to be taken care of). Note that for simplicity we assume that the first two columns are inputs, instead of reading the inputs field.

#!/usr/bin/python3
import json
data = json.load(open('results.json'))
datacols = range(2, len(data["fields"]))
# Index results by tool
results = { t:[] for t in range(0, len(data["tool"])) }
for l in data["results"]:
  results[l[1]].append(l)
# Average columns for each tool, and display them as a table
print("%-18s & count & %s \\\\" % ("tool", " & ".join(data["fields"][2:])))
for i in range(0, len(data["tool"])):
  c = len(results[i])
  sums = ["%6.1f" % (sum([x[j] for x in results[i]])/c)
          for j in datacols]
  print("%-18s & %3d & %s \\\\" % (data["tool"][i], c,
        " & ".join(sums)))
tool               & count & states & edges & transitions & acc & scc & nonacc_scc & terminal_scc & weak_scc & strong_scc & nondet_states & nondet_aut & terminal_aut & weak_aut & strong_aut & time & product_states & product_transitions & product_scc \\
ltl2tgba -s %f >%N &   4 &    3.0 &    6.0 &   10.0 &    1.0 &    2.5 &    1.0 &    0.5 &    0.5 &    0.5 &    0.8 &    0.5 &    0.0 &    0.5 &    0.5 &    0.0 &  549.0 & 9334.2 &    2.5 \\
spin -f %s >%N     &   4 &    4.5 &   11.2 &   25.0 &    1.0 &    2.8 &    1.2 &    0.5 &    0.2 &    0.8 &    3.5 &    1.0 &    0.0 &    0.2 &    0.8 &    0.0 &  848.2 & 24779.8 &    3.2 \\
lbt < %L >%T       &   4 &   15.8 &   88.8 &  183.5 &    1.8 &   11.5 &   10.0 &    0.5 &    0.2 &    0.8 &   12.8 &    1.0 &    0.0 &    0.2 &    0.8 &    0.0 & 2660.8 & 169623.5 & 1218.5 \\

The script bench/ltl2tgba/sum.py is a more evolved version of the above script that generates two kinds of LaTeX tables.

When computing such statistics, you should be aware that inputs for which a tool failed to generate an automaton (e.g. it crashed, or it was killed if you used ltlcross's --timeout option to limit run time) are not represented in the CSV or JSON files. However data for bogus automata are still included: as shown below ltlcross will report inconsistencies between automata as errors, but it does not try to guess who is incorrect.

Detecting problems

If a translator exits with a non-zero status code, or fails to output an automaton ltlcross can read, and error will be displayed and the result of the translation will be discarded.

Otherwise ltlcross performs the following checks on all translated formulas (\(P_i\) and \(N_i\) designate respectively the translation of positive and negative formulas by the ith translator).

  • Intersection check: \(P_i\otimes N_j\) must be empty for all pairs of \((i,j)\).

    A single failing translator might generate a lot of lines of the form:

    error: P0*N1 is nonempty
    error: P1*N0 is nonempty
    error: P1*N1 is nonempty
    error: P1*N2 is nonempty
    error: P1*N3 is nonempty
    error: P1*N4 is nonempty
    error: P1*N5 is nonempty
    error: P1*N6 is nonempty
    error: P1*N7 is nonempty
    error: P1*N8 is nonempty
    error: P1*N9 is nonempty
    error: P2*N1 is nonempty
    error: P3*N1 is nonempty
    error: P4*N1 is nonempty
    error: P5*N1 is nonempty
    error: P6*N1 is nonempty
    error: P7*N1 is nonempty
    error: P8*N1 is nonempty
    error: P9*N1 is nonempty
    

    In this example, translator number 1 looks clearly faulty (at least the other 9 translators do not contradict each other).

  • Cross-comparison checks: for some state-space \(S\), all \(P_i\otimes S\) are either all empty, or all non-empty. Similarly all \(N_i\otimes S\) are either all empty, or all non-empty.

    A cross-comparison failure could be displayed as:

    error: {P0,P2,P3,P4,P5,P6,P7,P8,P9} disagree with {P1} when evaluating the state-space
    
  • Consistency check:

    For each \(i\), the products \(P_i\otimes S\) and \(N_i\otimes S\) actually cover all states of \(S\). Because \(S\) does not have any deadlock, any of its infinite path must be accepted by \(P_i\) or \(N_i\) (or both).

    An error in that case is displayed as

    error: inconsistency between P1 and N1
    

The above checks are the same that are performed by LBTT.

If any problem was reported during the translation of one of the formulas, ltlcheck will exit with an exit status of 1. Statistics (if requested) are output nonetheless, and include any faulty automaton as well.

Miscellaneous options

--stop-on-error

The --stop-on-error will cause ltlcross to abort on the first detected error. This include failure to start some translator, read its output, or failure to passe the sanity checks. Timeouts are allowed.

One use for this option is when ltlcross is used in combination with randltl to check translators on an infinite stream of formulas.

For instance the following will cross-compare ltl2tgba against ltl3ba until it finds an error, or your interrupt the command, or it runs out of memory (the hash tables used by randltl and ltlcross to remove duplicate formulas will keep growing).

randltl -n -1 --tree-size 10..25 a b c | ltlcross --stop-on-error 'ltl2tgba --lbtt %f >%T' 'ltl3ba -f %s >%N'

--no-check

The --no-check option disables all sanity checks, and only use the supplied formulas in their positive form.

When checks are enabled, the negated formulas are intermixed with the positives ones in the results. Therefore the --no-check option can be used to gather statistics about a specific set of formulas.

Date: 2013-04-28T16:33+0200

Author: Alexandre Duret-Lutz

Org version 7.9.3f with Emacs version 24

Validate XHTML 1.0