 •Contents
 •Foreword to the first edition
 •Preface to the second edition
 •Our motivation for (re)writing this book
 •What’s new and what’s gone
 •The interdependence of chapters and prerequisites
 •Acknowledgements
 •Added for second edition
 •1 Propositional logic
 •1.1 Declarative sentences
 •1.2 Natural deduction
 •1.2.1 Rules for natural deduction
 •1.2.2 Derived rules
 •1.2.3 Natural deduction in summary
 •1.2.4 Provable equivalence
 •1.2.5 An aside: proof by contradiction
 •1.3 Propositional logic as a formal language
 •1.4 Semantics of propositional logic
 •1.4.1 The meaning of logical connectives
 •1.4.2 Mathematical induction
 •1.4.3 Soundness of propositional logic
 •1.4.4 Completeness of propositional logic
 •1.5 Normal forms
 •1.5.1 Semantic equivalence, satisfiability and validity
 •1.5.2 Conjunctive normal forms and validity
 •1.5.3 Horn clauses and satisfiability
 •1.6 SAT solvers
 •1.6.1 A linear solver
 •1.6.2 A cubic solver
 •1.7 Exercises
 •1.8 Bibliographic notes
 •2 Predicate logic
 •2.1 The need for a richer language
 •2.2 Predicate logic as a formal language
 •2.2.1 Terms
 •2.2.2 Formulas
 •2.2.3 Free and bound variables
 •2.2.4 Substitution
 •2.3 Proof theory of predicate logic
 •2.3.1 Natural deduction rules
 •2.3.2 Quantifier equivalences
 •2.4 Semantics of predicate logic
 •2.4.1 Models
 •2.4.2 Semantic entailment
 •2.4.3 The semantics of equality
 •2.5 Undecidability of predicate logic
 •2.6 Expressiveness of predicate logic
 •2.6.1 Existential secondorder logic
 •2.6.2 Universal secondorder logic
 •2.7 Micromodels of software
 •2.7.1 State machines
 •2.7.2 Alma – revisited
 •2.7.3 A software micromodel
 •2.8 Exercises
 •2.9 Bibliographic notes
 •3 Verification by model checking
 •3.1 Motivation for verification
 •3.2 Lineartime temporal logic
 •3.2.1 Syntax of LTL
 •3.2.2 Semantics of LTL
 •3.2.3 Practical patterns of specifications
 •3.2.4 Important equivalences between LTL formulas
 •3.2.5 Adequate sets of connectives for LTL
 •3.3 Model checking: systems, tools, properties
 •3.3.1 Example: mutual exclusion
 •3.3.2 The NuSMV model checker
 •3.3.3 Running NuSMV
 •3.3.4 Mutual exclusion revisited
 •3.3.5 The ferryman
 •3.3.6 The alternating bit protocol
 •3.4 Branchingtime logic
 •3.4.1 Syntax of CTL
 •3.4.2 Semantics of computation tree logic
 •3.4.3 Practical patterns of specifications
 •3.4.4 Important equivalences between CTL formulas
 •3.4.5 Adequate sets of CTL connectives
 •3.5.1 Boolean combinations of temporal formulas in CTL
 •3.5.2 Past operators in LTL
 •3.6 Modelchecking algorithms
 •3.6.1 The CTL modelchecking algorithm
 •3.6.2 CTL model checking with fairness
 •3.6.3 The LTL modelchecking algorithm
 •3.7 The fixedpoint characterisation of CTL
 •3.7.1 Monotone functions
 •3.7.2 The correctness of SATEG
 •3.7.3 The correctness of SATEU
 •3.8 Exercises
 •3.9 Bibliographic notes
 •4 Program verification
 •4.1 Why should we specify and verify code?
 •4.2 A framework for software verification
 •4.2.1 A core programming language
 •4.2.2 Hoare triples
 •4.2.3 Partial and total correctness
 •4.2.4 Program variables and logical variables
 •4.3 Proof calculus for partial correctness
 •4.3.1 Proof rules
 •4.3.2 Proof tableaux
 •4.3.3 A case study: minimalsum section
 •4.4 Proof calculus for total correctness
 •4.5 Programming by contract
 •4.6 Exercises
 •4.7 Bibliographic notes
 •5 Modal logics and agents
 •5.1 Modes of truth
 •5.2 Basic modal logic
 •5.2.1 Syntax
 •5.2.2 Semantics
 •Equivalences between modal formulas
 •Valid formulas
 •5.3 Logic engineering
 •5.3.1 The stock of valid formulas
 •5.3.2 Important properties of the accessibility relation
 •5.3.3 Correspondence theory
 •5.3.4 Some modal logics
 •5.4 Natural deduction
 •5.5 Reasoning about knowledge in a multiagent system
 •5.5.1 Some examples
 •5.5.2 The modal logic KT45n
 •5.5.3 Natural deduction for KT45n
 •5.5.4 Formalising the examples
 •5.6 Exercises
 •5.7 Bibliographic notes
 •6 Binary decision diagrams
 •6.1 Representing boolean functions
 •6.1.1 Propositional formulas and truth tables
 •6.1.2 Binary decision diagrams
 •6.1.3 Ordered BDDs
 •6.2 Algorithms for reduced OBDDs
 •6.2.1 The algorithm reduce
 •6.2.2 The algorithm apply
 •6.2.3 The algorithm restrict
 •6.2.4 The algorithm exists
 •6.2.5 Assessment of OBDDs
 •6.3 Symbolic model checking
 •6.3.1 Representing subsets of the set of states
 •6.3.2 Representing the transition relation
 •6.3.4 Synthesising OBDDs
 •6.4 A relational mucalculus
 •6.4.1 Syntax and semantics
 •6.5 Exercises
 •6.6 Bibliographic notes
 •Bibliography
 •Index
6.3 Symbolic model checking 
387 
x1 
x1 
x1 
x2 
x2 
x2 
x2 
0 1
Figure 6.28. An OBDD for the transition relation of Example 6.13.
[x1, x1, x2, x2] rather than [x1, x2, x1, x2]. Figure 6.27 (right) shows the truth table redrawn with the interleaved ordering of the columns and the rows
reordered lexicographically. The resulting OBDD is shown in Figure 6.28.
6.3.3 Implementing the functions pre and pre
It remains to show how an OBDD for pre (X) and pre (X) can be computed, given OBDDs BX for X and B→ for the transition relation →. First we observe that pre can be expressed in terms of complementation and pre , as follows: pre (X) = S − pre (S − X), where we write S − Y for the set of all s S which are not in Y . Therefore, we need only explain how to compute the OBDD for pre (X) in terms of BX and B→. Now (6.4) suggests that one should proceed as follows:
1.Rename the variables in BX to their primed versions; call the resulting OBDD
BX .
2.Compute the OBDD for exists(ˆx , apply(·, B→, BX )) using the apply and exists algorithms (Sections 6.2.2 and 6.2.4).
6.3.4 Synthesising OBDDs
The method used in Example 6.13 for producing an OBDD for the transition relation was to compute ﬁrst the truth table and then an OBDD which might not be in its fully reduced form; hence the need for a ﬁnal call to
388 6 Binary decision diagrams
the reduce function. However, this procedure would be unacceptable if applied to realistically sized systems with a large number of variables, for the truth table’s size is exponential in the number of boolean variables. The key idea and attraction of applying OBDDs to ﬁnite systems is therefore to take a system description in a language such as SMV and to synthesise the OBDD directly, without having to go via intermediate representations (such as binary decision trees or truth tables) which are exponential in size.
SMV allows us to deﬁne the next value of a variable in terms of the current values of variables (see the examples of code in Section 3.3.2)3. This can be compiled into a set of boolean functions fi, one for each variable xi, which deﬁne the next value of xi in terms of the current values of all the variables. In order to cope with nondeterministic assignment (such as the assignment to status in the example on page 192), we extend the set of variables by adding unconstrained variables which model the input. Each xi is a deterministic function of this enlarged set of variables; thus, xi ↔ fi, where f ↔ g = 1 if, and only if, f and g compute the same values, i.e. it is
a shorthand for f g.
The boolean function representing the transition relation is therefore of
the form 




xi ↔ fi, 
(6.6) 


1≤i≤n 





where 
1≤i≤n gi is a shorthand for g1 · g2 · . . . · gn. Note that the 
ranges 

only 
over the noninput variables. So, if u is an input variable, the boolean 




function does not contain any u ↔ fu.
Figure 6.22 showed how the reduced OBDD could be computed from the parse tree of such a boolean function. Thus, it is possible to compile SMV programs into OBDDs such that their speciﬁcations can be executed according to the pseudocode of the function SAT, now interpreted over OBDDs. On page 396 we will see that this OBDD implementation can be extended to simple fairness constraints.
Modelling sequential circuits As a further application of OBDDs to veriﬁcation, we show how OBDDs representing circuits may be synthesised.
Synchronous circuits. Suppose that we have a design of a sequential circuit such as the one in Figure 6.29. This is a synchronous circuit (meaning that
3SMV also allows next values to be deﬁned in terms of next values, i.e. the keyword next to appear in expressions on the righthand side of :=. This is useful for describing synchronisations, for example, but we ignore that feature here.
6.3 Symbolic model checking 
389 
x1 
x2 
Figure 6.29. A simple synchronous circuit with two registers.
all the state variables are updated synchronously in parallel) whose functionality can be described by saying what the values of the registers x1 and x2 in the next state of the circuit are. The function f → coding the possible next states of the circuits is
(x1 ↔ 

1) · (x2 ↔ x1 x2). 
(6.7) 
x 
This may now be translated into an OBDD by the methods summarised in Figure 6.22.
Asynchronous circuits. The symbolic encoding of synchronous circuits is in its logical structure very similar to the encoding of f → for CTL models; compare the codings in (6.7) and (6.6). In asynchronous circuits, or processes in SMV, the logical structure of f → changes. As before, we can construct functions fi which code the possible next state in the local component, or the SMV process, i. For asynchronous systems, there are two principal ways of composing these functions into global system behaviour:
In a simultaneous model, a global transition is one in which any number of components may make their local transition. This is modelled as
n 



i 
↔ fi) + (xi 
↔ xi)) . 
(6.8) 
f → = ((xi 

def 



=1 



In an interleaving model, exactly one local component makes a local transition;