ltlcross
ltlcross
is a tool for cross-comparing the output of LTL-to-Büchi
translators. It is actually a Spot-based clone of LBTT, the
LTL-to-Büchi Translator Testbench, that essentially performs the
same sanity checks.
The main motivations for rewriting this tool were:
- support for PSL formulas in addition to LTL
- more statistics, especially:
- the number of logical transitions represented by each physical edge,
- the number of deterministic states and automata
- the number of SCCs with their various strengths (nonaccepting, terminal, weak, strong)
- the number of terminal, weak, and strong automata
- output in a format that can be more easily be post-processed,
- more precise time measurement (LBTT was only precise to 1/100 of a second, reporting most times as "0.00s").
Although ltlcross
performs the same sanity checks as LBTT, it does
not implement any of the interactive features of LBTT. In our almost
10-year usage of LBTT, we never had to use its interactive features to
understand bugs in our translation. Therefore ltlcross
will report
problems, but you will be on your own to investigate and fix them.
The core of ltlcross
is a loop that does the following steps:
- Input a formula
- Translate the formula and its negation using each configured translator.
If there are 3 translators, the positive and negative translations
will be denoted
P0
,N0
,P1
,N1
,P2
,N2
. - Build the products of these automata with a random state-space (the same state-space for all translations).
- Perform sanity checks between all these automata to detect any problem.
- Gather statistics if requested.
Table of Contents
Formula selection
Formulas to translate should be specified using the common input options.
Standard input is read if no -f
or -F
option is given.
Configuring translators
Each translator should be specified as a string that use some of the following character sequences:
%f,%s,%l,%w the formula as a (quoted) string in Spot, Spin, LBT, or Wring's syntax %F,%S,%L,%W the formula as a file in Spot, Spin, LBT, or Wring's syntax %N,%T the output automaton as a Never claim, or in LBTT's format
For instance here is how we could cross-compare the never claims
output by spin
and ltl2tgba
for the formulas GFa
and X(a U b)
.
ltlcross -f 'GFa' -f 'X(a U b)' 'ltl2tgba -s %s >%N' 'spin -f %s >%N'
When ltlcross
executes these commands, %s
will be replaced
by the formula in Spin's syntax, and %N
will be replaced by a
temporary file into which the output of the translator is redirected
before it is read back by ltlcross
.
([](<>(a))) Running [P0]: ltl2tgba -s '([](<>(a)))' >'lck-o0-5ETnMU' Running [P1]: spin -f '([](<>(a)))' >'lck-o1-7X6Yyv' Running [N0]: ltl2tgba -s '(!([](<>(a))))' >'lck-o0-XPo7l6' Running [N1]: spin -f '(!([](<>(a))))' >'lck-o1-30UfiH' Performing sanity checks and gathering statistics... (X((a) U (b))) Running [P0]: ltl2tgba -s '(X((a) U (b)))' >'lck-o0-aJCvoi' Running [P1]: spin -f '(X((a) U (b)))' >'lck-o1-pkzwDT' Running [N0]: ltl2tgba -s '(!(X((a) U (b))))' >'lck-o0-Bmk2Su' Running [N1]: spin -f '(!(X((a) U (b))))' >'lck-o1-SMGah6' Performing sanity checks and gathering statistics... No problem detected.
ltlcross
can only read two kinds of output:
- Never claims (only if they are restricted to representing an
automaton using
if
,goto
, andskip
statements) such as those output byspin
,ltl2ba
,ltl3ba
, orltl2tgba --spin
. These should be indicated using%N
. - LBTT's format, which supports generalized Büchi automata with
either state-based acceptance or transition-based acceptance.
This output is used for instance by
lbt
,modella
, orltl2tgba --lbtt
. These should be indicated using%T
.
Of course all configured tools need not the same %
sequences.
Getting statistics
Detailed statistics about the result of each translation, and the
product of that resulting automaton with the random state-space, can
be obtained using the --csv=FILE
or --json=FILE
option.
The following compare ltl2tgba
, spin
, and lbt
on three random
formula (where W
and M
operators have been rewritten away because
they are not supported by spin
and lbt
).
randltl -n 2 a b | ltlfilt --remove-wm | ltlcross --csv=results.csv \ 'ltl2tgba -s %f >%N' \ 'spin -f %s >%N' \ 'lbt < %L >%T'
-:1: (G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))) Running [P0]: ltl2tgba -s '(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))' >'lck-o0-Dt28kK' Running [P1]: spin -f '([](((p0) U ((p0) && ([](p1)))) V (([](p1)) || ((p0) U ((p0) && ([](p1)))))))' >'lck-o1-m3Stsz' Running [P2]: lbt < 'lck-i0-pl2RkV' >'lck-o2-yfhxBo' Running [N0]: ltl2tgba -s '(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))' >'lck-o0-uyGSU2' Running [N1]: spin -f '(!([](((p0) U ((p0) && ([](p1)))) V (([](p1)) || ((p0) U ((p0) && ([](p1))))))))' >'lck-o1-3D4pbS' Running [N2]: lbt < 'lck-i0-7hEcLd' >'lck-o2-6BU4sH' Performing sanity checks and gathering statistics... -:2: (!((G(F(p0))) -> (F(p1)))) Running [P0]: ltl2tgba -s '(!((G(F(p0))) -> (F(p1))))' >'lck-o0-MwmFzs' Running [P1]: spin -f '(!((<>(p1)) || (!([](<>(p0))))))' >'lck-o1-jriyel' Running [P2]: lbt < 'lck-i1-J7Am1z' >'lck-o2-uTg0Td' Running [N0]: ltl2tgba -s '(G(F(p0))) -> (F(p1))' >'lck-o0-czmYfZ' Running [N1]: spin -f '(<>(p1)) || (!([](<>(p0))))' >'lck-o1-UMCE2R' Running [N2]: lbt < 'lck-i1-OveZz6' >'lck-o2-GxtQPK' Performing sanity checks and gathering statistics... No problem detected.
After this execution, the file results.csv
contains the following:
"formula", "tool", "states", "edges", "transitions", "acc", "scc", "nonacc_scc", "terminal_scc", "weak_scc", "strong_scc", "nondet_states", "nondet_aut", "terminal_aut", "weak_aut", "strong_aut", "time", "product_states", "product_transitions", "product_scc" "(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "ltl2tgba -s %f >%N", 3, 5, 9, 1, 3, 2, 0, 1, 0, 2, 1, 0, 1, 0, 0.0455643, 401, 5136, 3 "(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "spin -f %s >%N", 6, 13, 18, 1, 3, 2, 0, 0, 1, 6, 1, 0, 0, 1, 0.0105849, 995, 14384, 5 "(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "lbt < %L >%T", 8, 41, 51, 1, 3, 2, 0, 0, 1, 8, 1, 0, 0, 1, 0.0032736, 1389, 42998, 5 "(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "ltl2tgba -s %f >%N", 4, 10, 16, 1, 3, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0.0442764, 797, 16340, 3 "(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "spin -f %s >%N", 7, 24, 63, 1, 4, 2, 1, 0, 1, 6, 1, 0, 0, 1, 0.00639257, 1400, 64668, 4 "(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "lbt < %L >%T", 39, 286, 614, 3, 28, 26, 1, 0, 1, 33, 1, 0, 0, 1, 0.00399757, 7592, 602204, 4400 "(!((G(F(p0))) -> (F(p1))))", "ltl2tgba -s %f >%N", 2, 4, 4, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0.0426758, 398, 4198, 1 "(!((G(F(p0))) -> (F(p1))))", "spin -f %s >%N", 2, 3, 5, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0.00338899, 398, 5227, 1 "(!((G(F(p0))) -> (F(p1))))", "lbt < %L >%T", 5, 10, 15, 1, 4, 3, 0, 0, 1, 5, 1, 0, 0, 1, 0.00313587, 409, 6401, 12 "(G(F(p0))) -> (F(p1))", "ltl2tgba -s %f >%N", 3, 5, 11, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.043401, 600, 11663, 3 "(G(F(p0))) -> (F(p1))", "spin -f %s >%N", 3, 5, 14, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.00303272, 600, 14840, 3 "(G(F(p0))) -> (F(p1))", "lbt < %L >%T", 11, 18, 54, 2, 11, 9, 1, 1, 0, 5, 1, 0, 1, 0, 0.00304955, 1253, 26891, 457
This can be loaded in any spreadsheet application. Although we only
supplied 2 random generated formulas, the output contains 4 formulas because
ltlcross
had to translate the positive and negative version of each.
If we had used the option --json=results.json
instead of
--cvs=results.csv
, the file results.json
would have contained the
following JSON output.
{ "tool": [ "ltl2tgba -s %f >%N", "spin -f %s >%N", "lbt < %L >%T" ], "formula": [ "(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1)))))))", "(!(G(((p0) U ((p0) & (G(p1)))) R ((G(p1)) | ((p0) U ((p0) & (G(p1))))))))", "(!((G(F(p0))) -> (F(p1))))", "(G(F(p0))) -> (F(p1))" ], "fields": [ "formula", "tool", "states", "edges", "transitions", "acc", "scc", "nonacc_scc", "terminal_scc", "weak_scc", "strong_scc", "nondet_states", "nondet_aut", "terminal_aut", "weak_aut", "strong_aut", "time", "product_states", "product_transitions", "product_scc" ], "inputs": [ 0, 1 ], "results": [ [ 0, 0, 3, 5, 9, 1, 3, 2, 0, 1, 0, 2, 1, 0, 1, 0, 0.0455643, 401, 5136, 3 ], [ 0, 1, 6, 13, 18, 1, 3, 2, 0, 0, 1, 6, 1, 0, 0, 1, 0.0105849, 995, 14384, 5 ], [ 0, 2, 8, 41, 51, 1, 3, 2, 0, 0, 1, 8, 1, 0, 0, 1, 0.0032736, 1389, 42998, 5 ], [ 1, 0, 4, 10, 16, 1, 3, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0.0442764, 797, 16340, 3 ], [ 1, 1, 7, 24, 63, 1, 4, 2, 1, 0, 1, 6, 1, 0, 0, 1, 0.00639257, 1400, 64668, 4 ], [ 1, 2, 39, 286, 614, 3, 28, 26, 1, 0, 1, 33, 1, 0, 0, 1, 0.00399757, 7592, 602204, 4400 ], [ 2, 0, 2, 4, 4, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0.0426758, 398, 4198, 1 ], [ 2, 1, 2, 3, 5, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0.00338899, 398, 5227, 1 ], [ 2, 2, 5, 10, 15, 1, 4, 3, 0, 0, 1, 5, 1, 0, 0, 1, 0.00313587, 409, 6401, 12 ], [ 3, 0, 3, 5, 11, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.043401, 600, 11663, 3 ], [ 3, 1, 3, 5, 14, 1, 3, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0.00303272, 600, 14840, 3 ], [ 3, 2, 11, 18, 54, 2, 11, 9, 1, 1, 0, 5, 1, 0, 1, 0, 0.00304955, 1253, 26891, 457 ] ] }
Here the fields
table describes the columns of the results
table.
The inputs
tables lists the columns that are considered as inputs
for the experiments. The values in the columns corresponding to the
fields formula
and tool
contains indices relative to the formula
and tool
tables. This format is more compact when dealing with lots
of translators and formulas, because they don't have to be repeated on
each line as in the CSV version.
JSON data can be easily processed in any language. For instance the
following Python3 script averages each column for each tool, and
presents the results in a form that can almost be copied into a LaTeX
table (the %
in the tool names have to be taken care of). Note that
for simplicity we assume that the first two columns are inputs,
instead of reading the inputs
field.
#!/usr/bin/python3 import json data = json.load(open('results.json')) datacols = range(2, len(data["fields"])) # Index results by tool results = { t:[] for t in range(0, len(data["tool"])) } for l in data["results"]: results[l[1]].append(l) # Average columns for each tool, and display them as a table print("%-18s & count & %s \\\\" % ("tool", " & ".join(data["fields"][2:]))) for i in range(0, len(data["tool"])): c = len(results[i]) sums = ["%6.1f" % (sum([x[j] for x in results[i]])/c) for j in datacols] print("%-18s & %3d & %s \\\\" % (data["tool"][i], c, " & ".join(sums)))
tool & count & states & edges & transitions & acc & scc & nonacc_scc & terminal_scc & weak_scc & strong_scc & nondet_states & nondet_aut & terminal_aut & weak_aut & strong_aut & time & product_states & product_transitions & product_scc \\ ltl2tgba -s %f >%N & 4 & 3.0 & 6.0 & 10.0 & 1.0 & 2.5 & 1.0 & 0.5 & 0.5 & 0.5 & 0.8 & 0.5 & 0.0 & 0.5 & 0.5 & 0.0 & 549.0 & 9334.2 & 2.5 \\ spin -f %s >%N & 4 & 4.5 & 11.2 & 25.0 & 1.0 & 2.8 & 1.2 & 0.5 & 0.2 & 0.8 & 3.5 & 1.0 & 0.0 & 0.2 & 0.8 & 0.0 & 848.2 & 24779.8 & 3.2 \\ lbt < %L >%T & 4 & 15.8 & 88.8 & 183.5 & 1.8 & 11.5 & 10.0 & 0.5 & 0.2 & 0.8 & 12.8 & 1.0 & 0.0 & 0.2 & 0.8 & 0.0 & 2660.8 & 169623.5 & 1218.5 \\
The script bench/ltl2tgba/sum.py
is a more evolved version of the
above script that generates two kinds of LaTeX tables.
When computing such statistics, you should be aware that inputs for
which a tool failed to generate an automaton (e.g. it crashed, or it
was killed if you used ltlcross
's --timeout
option to limit run
time) are not represented in the CSV or JSON files. However data for
bogus automata are still included: as shown below ltlcross
will
report inconsistencies between automata as errors, but it does not try
to guess who is incorrect.
Detecting problems
If a translator exits with a non-zero status code, or fails to output
an automaton ltlcross
can read, and error will be displayed and the
result of the translation will be discarded.
Otherwise ltlcross
performs the following checks on all translated
formulas (\(P_i\) and \(N_i\) designate respectively the translation of
positive and negative formulas by the ith translator).
- Intersection check: \(P_i\otimes N_j\) must be empty for all
pairs of \((i,j)\).
A single failing translator might generate a lot of lines of the form:
error: P0*N1 is nonempty error: P1*N0 is nonempty error: P1*N1 is nonempty error: P1*N2 is nonempty error: P1*N3 is nonempty error: P1*N4 is nonempty error: P1*N5 is nonempty error: P1*N6 is nonempty error: P1*N7 is nonempty error: P1*N8 is nonempty error: P1*N9 is nonempty error: P2*N1 is nonempty error: P3*N1 is nonempty error: P4*N1 is nonempty error: P5*N1 is nonempty error: P6*N1 is nonempty error: P7*N1 is nonempty error: P8*N1 is nonempty error: P9*N1 is nonempty
In this example, translator number
1
looks clearly faulty (at least the other 9 translators do not contradict each other). - Cross-comparison checks: for some state-space \(S\),
all \(P_i\otimes S\) are either all empty, or all non-empty.
Similarly all \(N_i\otimes S\) are either all empty, or all non-empty.
A cross-comparison failure could be displayed as:
error: {P0,P2,P3,P4,P5,P6,P7,P8,P9} disagree with {P1} when evaluating the state-space
- Consistency check:
For each \(i\), the products \(P_i\otimes S\) and \(N_i\otimes S\) actually cover all states of \(S\). Because \(S\) does not have any deadlock, any of its infinite path must be accepted by \(P_i\) or \(N_i\) (or both).
An error in that case is displayed as
error: inconsistency between P1 and N1
The above checks are the same that are performed by LBTT.
If any problem was reported during the translation of one of the
formulas, ltlcheck
will exit with an exit status of 1
. Statistics
(if requested) are output nonetheless, and include any faulty
automaton as well.
Miscellaneous options
--stop-on-error
The --stop-on-error
will cause ltlcross
to abort on the first
detected error. This include failure to start some translator, read
its output, or failure to passe the sanity checks. Timeouts are
allowed.
One use for this option is when ltlcross
is used in combination with
randltl
to check translators on an infinite stream of formulas.
For instance the following will cross-compare ltl2tgba
against
ltl3ba
until it finds an error, or your interrupt the command, or it
runs out of memory (the hash tables used by randltl
and ltlcross
to remove duplicate formulas will keep growing).
randltl -n -1 --tree-size 10..25 a b c | ltlcross --stop-on-error 'ltl2tgba --lbtt %f >%T' 'ltl3ba -f %s >%N'
--no-check
The --no-check
option disables all sanity checks, and only use the supplied
formulas in their positive form.
When checks are enabled, the negated formulas are intermixed with the
positives ones in the results. Therefore the --no-check
option can
be used to gather statistics about a specific set of formulas.