Move the logic for detecting when the minimize() algorithm is

correct from ltl2tgba to the library.

* src/tgbaalgos/minimize.hh,
src/tgbaalgos/minimize.cc (minimize_obligation): New function.
* src/tgbatests/ltl2tgba.cc (main): Fix constness of automata,
and call minimize_obligation() for -R3b.

ChangeLog

+2011-01-04  Alexandre Duret-Lutz  <adl@lrde.epita.fr>
+
+	Move the logic for detecting when the minimize() algorithm is
+	correct from ltl2tgba to the library.
+
+	* src/tgbaalgos/minimize.hh,
+	src/tgbaalgos/minimize.cc (minimize_obligation): New function.
+	* src/tgbatests/ltl2tgba.cc (main): Fix constness of automata,
+	and call minimize_obligation() for -R3b.
+
 2010-12-26  Alexandre Duret-Lutz  <adl@lrde.epita.fr>
 
 	Make minimization of obligation properties and deterministic

src/tgbaalgos/minimize.cc

-// Copyright (C) 2010 Laboratoire de Recherche et Développement
+// Copyright (C) 2010, 2011 Laboratoire de Recherche et Développement
 // de l'Epita (LRDE).
 //
 // This file is part of Spot, a model checking library.
@@ -22,7 +22,13 @@
 #include "minimize.hh"
 #include "ltlast/allnodes.hh"
 #include "misc/hash.hh"
+#include "tgba/tgbaproduct.hh"
+#include "tgba/tgbatba.hh"
 #include "tgbaalgos/powerset.hh"
+#include "tgbaalgos/gtec/gtec.hh"
+#include "tgbaalgos/safety.hh"
+#include "tgbaalgos/sccfilter.hh"
+#include "tgbaalgos/ltl2tgba_fm.hh"
 
 namespace spot
 {
@@ -300,4 +306,87 @@ namespace spot
 
     return res;
   }
+
+  const tgba*
+  minimize_obligation(const tgba* aut_f,
+		      const ltl::formula* f, const tgba* aut_neg_f)
+  {
+    // WDBA minimization
+    tgba* min_aut_f = minimize(aut_f);
+
+    // If aut_f is a safety automaton, the WDBA minimization must be
+    // correct.
+    if (is_safety_automaton(aut_f))
+      {
+	return min_aut_f;
+      }
+
+    if (!f && !aut_neg_f)
+      {
+	// We do not now if the minimization is safe.
+	return 0;
+      }
+
+    const tgba* to_free = 0;
+
+    // Build negation automaton if not supplied.
+    if (!aut_neg_f)
+      {
+	assert(f);
+
+	ltl::formula* neg_f = ltl::unop::instance(ltl::unop::Not, f->clone());
+	aut_neg_f = ltl_to_tgba_fm(neg_f, aut_f->get_dict());
+	neg_f->destroy();
+
+	// Remove useless SCCs.
+	const tgba* tmp = scc_filter(aut_neg_f, true);
+	delete aut_neg_f;
+	to_free = aut_neg_f = tmp;
+      }
+
+    // If the negation is a safety automaton, then the
+    // minimization is correct.
+    if (is_safety_automaton(aut_neg_f))
+      {
+	delete to_free;
+	return min_aut_f;
+      }
+
+    bool ok = false;
+
+    tgba* p = new tgba_product(min_aut_f, aut_neg_f);
+    emptiness_check* ec = couvreur99(p);
+    emptiness_check_result* res = ec->check();
+    if (!res)
+      {
+	delete ec;
+	delete p;
+	tgba* min_aut_neg_f = minimize(aut_neg_f);
+	tgba* p = new tgba_product(aut_f, min_aut_neg_f);
+	emptiness_check* ec = couvreur99(p);
+	res = ec->check();
+
+	if (!res)
+	  // Finally, we are now sure that it was safe
+	  // to minimize the automaton.
+	  ok = true;
+
+	delete res;
+	delete ec;
+	delete p;
+	delete min_aut_neg_f;
+      }
+    else
+      {
+	delete res;
+	delete ec;
+	delete p;
+      }
+    delete to_free;
+
+    if (ok)
+      return min_aut_f;
+    delete min_aut_f;
+    return aut_f;
+  }
 }

src/tgbaalgos/minimize.hh

-// Copyright (C) 2009, 2010 Laboratoire de Recherche et Développement
+// Copyright (C) 2009, 2010, 2011 Laboratoire de Recherche et Développement
 // de l'Epita (LRDE).
 //
 // This file is part of Spot, a model checking library.
@@ -22,77 +22,129 @@
 # define SPOT_TGBAALGOS_MINIMIZE_HH
 
 # include "tgba/tgbaexplicit.hh"
+# include "ltlast/formula.hh"
 
 namespace spot
 {
-  // \brief Use the powerset construction to minimize a TGBA.
-  //
-  // If \a monitor is set of \c false (the default), then the
-  // minimized automaton is correct only for properties that belong to
-  // the class of "obligation properties".  This algorithm assumes
-  // that the given automaton expresses an obligation properties and
-  // will return an automaton that is bogus (i.e. not equivalent to
-  // the original) if that is not the case.
-  //
-  // Please see the following paper for a discussion of this
-  // technique.
-  //
-  // \verbatim
-  // @InProceedings{	  dax.07.atva,
-  //   author	= {Christian Dax and Jochen Eisinger and Felix Klaedtke},
-  //   title		= {Mechanizing the Powerset Construction for Restricted
-  // 		  Classes of {$\omega$}-Automata},
-  //   year		= 2007,
-  //   series	= {Lecture Notes in Computer Science},
-  //   publisher	= {Springer-Verlag},
-  //   volume	= 4762,
-  //   booktitle	= {Proceedings of the 5th International Symposium on
-  // 		  Automated Technology for Verification and Analysis
-  // 		  (ATVA'07)},
-  //   editor	= {Kedar S. Namjoshi and Tomohiro Yoneda and Teruo Higashino
-  // 		  and Yoshio Okamura},
-  //   month		= oct
-  // }
-  // \endverbatim
-  //
-  // Dax et al. suggest one way to check whether a property
-  // \f$\varphi\f$ expressed as an LTL formula is an obligation:
-  // translate the formula and its negation as two automata \f$A_f\f$
-  // and \f$A_{\lnot f}\f$, then minimize both automata and check that
-  // the two products $\f \mathrm{minimize(A_{\lnot f})\otimes A_f\f$
-  // and $\f \mathrm{minimize(A_f)\otimes A_{\lnot f}\f$ are empty.
-  // If that is the case, then the minimization was correct.
-  //
-  // You may also want to check if \$A_f\$ is a safety automaton using
-  // the is_safety_automaton() function.  Since safety properties are
-  // a subclass of obligation properties, you can apply the
-  // minimization without further test.  Note however that this is
-  // only a sufficient condition.
-  //
-  // If \a monitor is set to \c true, the automaton will be converted
-  // into minimal deterministic monitor.  All useless SCCs should have
-  // been previously removed (using scc_filter() for instance).  Then
-  // the automaton will be reduced as if all states where accepting
-  // states.
-  //
-  // For more detail about monitors, see the following paper:
-  // \verbatim
-  // @InProceedings{	  tabakov.10.rv,
-  //   author	= {Deian Tabakov and Moshe Y. Vardi},
-  //   title		= {Optimized Temporal Monitors for SystemC{$^*$}},
-  //   booktitle	= {Proceedings of the 10th International Conferance on
-  // 		  Runtime Verification},
-  //   pages		= {436--451},
-  //   year		= 2010,
-  //   volume	= {6418},
-  //   series	= {Lecture Notes in Computer Science},
-  //   month		= nov,
-  //   publisher	= {Spring-Verlag}
-  // }
-  // \endverbatim
-  // (Note: although the above paper uses Spot, this function did not
-  // exist at that time.)
+  /// \brief Use the powerset construction to minimize a TGBA.
+  ///
+  /// If \a monitor is set to \c false (the default), then the
+  /// minimized automaton is correct only for properties that belong
+  /// to the class of "obligation properties".  This algorithm assumes
+  /// that the given automaton expresses an obligation properties and
+  /// will return an automaton that is bogus (i.e. not equivalent to
+  /// the original) if that is not the case.
+  ///
+  /// Please see the following paper for a discussion of this
+  /// technique.
+  ///
+  /// \verbatim
+  /// @InProceedings{	  dax.07.atva,
+  ///   author	= {Christian Dax and Jochen Eisinger and Felix Klaedtke},
+  ///   title		= {Mechanizing the Powerset Construction for Restricted
+  /// 		  Classes of {$\omega$}-Automata},
+  ///   year		= 2007,
+  ///   series	= {Lecture Notes in Computer Science},
+  ///   publisher	= {Springer-Verlag},
+  ///   volume	= 4762,
+  ///   booktitle	= {Proceedings of the 5th International Symposium on
+  /// 		  Automated Technology for Verification and Analysis
+  /// 		  (ATVA'07)},
+  ///   editor	= {Kedar S. Namjoshi and Tomohiro Yoneda and Teruo Higashino
+  /// 		  and Yoshio Okamura},
+  ///   month		= oct
+  /// }
+  /// \endverbatim
+  ///
+  /// Dax et al. suggest one way to check whether a property
+  /// \f$\varphi\f$ expressed as an LTL formula is an obligation:
+  /// translate the formula and its negation as two automata \f$A_f\f$
+  /// and \f$A_{\lnot f}\f$, then minimize both automata and check
+  /// that the two products $\f \mathrm{minimize(A_{\lnot f})\otimes
+  /// A_f\f$ and $\f \mathrm{minimize(A_f)\otimes A_{\lnot f}\f$ are
+  /// empty.  If that is the case, then the minimization was correct.
+  ///
+  /// You may also want to check if \$A_f\$ is a safety automaton
+  /// using the is_safety_automaton() function.  Since safety
+  /// properties are a subclass of obligation properties, you can
+  /// apply the minimization without further test.  Note however that
+  /// this is only a sufficient condition.
+  ///
+  /// If \a monitor is set to \c true, the automaton will be converted
+  /// into minimal deterministic monitor.  All useless SCCs should
+  /// have been previously removed (using scc_filter() for instance).
+  /// Then the automaton will be reduced as if all states where
+  /// accepting states.
+  ///
+  /// For more detail about monitors, see the following paper:
+  /// \verbatim
+  /// @InProceedings{	  tabakov.10.rv,
+  ///   author	= {Deian Tabakov and Moshe Y. Vardi},
+  ///   title		= {Optimized Temporal Monitors for SystemC{$^*$}},
+  ///   booktitle	= {Proceedings of the 10th International Conferance
+  ///			   on Runtime Verification},
+  ///   pages		= {436--451},
+  ///   year		= 2010,
+  ///   volume	= {6418},
+  ///   series	= {Lecture Notes in Computer Science},
+  ///   month		= nov,
+  ///   publisher	= {Spring-Verlag}
+  /// }
+  /// \endverbatim
+  /// (Note: although the above paper uses Spot, this function did not
+  /// exist at that time.)
   tgba_explicit* minimize(const tgba* a, bool monitor = false);
+
+
+  /// \brief Minimize an automaton if it represents an obligation property.
+  ///
+  /// This function attempt to minimize the automaton \a aut_f using the
+  /// algorithm implemented in the minimize() function, and presented
+  /// by the following paper:
+  ///
+  /// \verbatim
+  /// @InProceedings{	  dax.07.atva,
+  ///   author	= {Christian Dax and Jochen Eisinger and Felix Klaedtke},
+  ///   title		= {Mechanizing the Powerset Construction for Restricted
+  /// 		  Classes of {$\omega$}-Automata},
+  ///   year		= 2007,
+  ///   series	= {Lecture Notes in Computer Science},
+  ///   publisher	= {Springer-Verlag},
+  ///   volume	= 4762,
+  ///   booktitle	= {Proceedings of the 5th International Symposium on
+  /// 		  Automated Technology for Verification and Analysis
+  /// 		  (ATVA'07)},
+  ///   editor	= {Kedar S. Namjoshi and Tomohiro Yoneda and Teruo Higashino
+  /// 		  and Yoshio Okamura},
+  ///   month		= oct
+  /// }
+  /// \endverbatim
+  ///
+  /// Because it is hard to determine if an automaton correspond
+  /// to an obligation property, you should supply either the formula
+  /// \a f expressed by the automaton \a aut_f, or \a aut_neg_f the negation
+  /// of the automaton \a aut_neg_f.
+  ///
+  /// \param aut_f the automaton to minimize
+  /// \param f the LTL formula represented by the automaton \a aut_f
+  /// \param aut_neg_f an automaton representing the negation of \a aut_f
+  /// \return a new tgba if the automaton could be minimized, aut_f if
+  /// the automaton cannot be minimized, 0 if we do not if if the
+  /// minimization is correct because neither \a f nor \a aut_neg_f
+  /// were supplied.
+  ///
+  /// The function proceeds as follows.  If the formula \a f or the
+  /// automaton \a aut can easily be proved to represent an obligation
+  /// formula, then the result of \code minimize(aut) is returned.
+  /// Otherwise, if \a aut_neg_f was not supplied but \a f was, \a
+  /// aut_neg_f is built from the negation of \a f.  Then we check
+  /// that \code product(aut,minimize(aut_neg_f)) and \code
+  /// product(aut_neg_f,minize(aut)) are both empty.  If they are, the
+  /// the minimization was sound.  (See the paper for full details.)
+  const tgba* minimize_obligation(const tgba* aut_f,
+				  const ltl::formula* f = 0,
+				  const tgba* aut_neg_f = 0);
+
 }
 
 #endif /* !SPOT_TGBAALGOS_MINIMIZE_HH */

src/tgbatest/ltl2tgba.cc

-// Copyright (C) 2007, 2008, 2009, 2010 Laboratoire de Recherche et
+// Copyright (C) 2007, 2008, 2009, 2010, 2011 Laboratoire de Recherche et
 // Dveloppement de l'Epita (LRDE).
 // Copyright (C) 2003, 2004, 2005, 2006, 2007 Laboratoire d'Informatique de
 // Paris 6 (LIP6), dpartement Systmes Rpartis
@@ -327,8 +327,8 @@ main(int argc, char** argv)
   spot::ltl::environment& env(spot::ltl::default_environment::instance());
   spot::ltl::atomic_prop_set* unobservables = 0;
   spot::tgba_explicit_string* system = 0;
-  spot::tgba* product = 0;
-  spot::tgba* product_to_free = 0;
+  const spot::tgba* product = 0;
+  const spot::tgba* product_to_free = 0;
   spot::bdd_dict* dict = new spot::bdd_dict();
   spot::timer_map tm;
   bool use_timer = false;
@@ -789,9 +789,9 @@ main(int argc, char** argv)
     }
   if (f || from_file)
     {
-      spot::tgba_bdd_concrete* concrete = 0;
-      spot::tgba* to_free = 0;
-      spot::tgba* a = 0;
+      const spot::tgba_bdd_concrete* concrete = 0;
+      const spot::tgba* to_free = 0;
+      const spot::tgba* a = 0;
 
       if (from_file)
 	{
@@ -867,7 +867,7 @@ main(int argc, char** argv)
 
       if (opt_monitor && ((reduc_aut & spot::Reduce_Scc) == 0))
 	{
-	  if (dynamic_cast<spot::tgba_bdd_concrete*>(a))
+	  if (dynamic_cast<const spot::tgba_bdd_concrete*>(a))
 	    symbolic_scc_pruning = true;
 	  else
 	    reduc_aut |= spot::Reduce_Scc;
@@ -875,8 +875,8 @@ main(int argc, char** argv)
 
       if (symbolic_scc_pruning)
         {
-	  spot::tgba_bdd_concrete* bc =
-	    dynamic_cast<spot::tgba_bdd_concrete*>(a);
+	  const spot::tgba_bdd_concrete* bc =
+	    dynamic_cast<const spot::tgba_bdd_concrete*>(a);
 	  if (!bc)
 	    {
 	      std::cerr << ("Error: Automaton is not symbolic: cannot "
@@ -890,14 +890,15 @@ main(int argc, char** argv)
 	    {
 	      tm.start("reducing A_f w/ symbolic SCC pruning");
 	      if (bc)
-		bc->delete_unaccepting_scc();
+		const_cast<spot::tgba_bdd_concrete*>(bc)
+		  ->delete_unaccepting_scc();
 	      tm.stop("reducing A_f w/ symbolic SCC pruning");
 	    }
 	}
 
       // Remove dead SCCs and useless acceptance conditions before
       // degeneralization.
-      spot::tgba* aut_scc = 0;
+      const spot::tgba* aut_scc = 0;
       if (reduc_aut & spot::Reduce_Scc)
 	{
 	  tm.start("reducing A_f w/ SCC");
@@ -905,8 +906,8 @@ main(int argc, char** argv)
 	  tm.stop("reducing A_f w/ SCC");
 	}
 
-      spot::tgba_tba_proxy* degeneralized = 0;
-      spot::tgba_sgba_proxy* state_labeled = 0;
+      const spot::tgba_tba_proxy* degeneralized = 0;
+      const spot::tgba_sgba_proxy* state_labeled = 0;
 
       unsigned int n_acc = a->number_of_acceptance_conditions();
       if (echeck_inst
@@ -923,74 +924,31 @@ main(int argc, char** argv)
         a = state_labeled = new spot::tgba_sgba_proxy(a);
       }
 
-      spot::tgba_explicit* minimized = 0;
+      const spot::tgba* minimized = 0;
       if (opt_minimize)
 	{
-	  tm.start("WDBA-minimization");
-	  minimized = minimize(a);
-	  tm.stop("WDBA-minimization");
-	  tm.start("WDBA-check");
-	  // If A is a safety automaton, the WDBA minimization
-	  // must be correct.
-	  if (is_safety_automaton(a))
-	    {
-	      a = minimized;
-	    }
-	  else // We don't know if A is a safety automaton.
+	  tm.start("obligation minimization");
+	  minimized = minimize_obligation(a, f);
+	  tm.stop("obligation minimization");
+
+	  if (minimized == 0)
 	    {
-	      if (!f)
+	      // if (!f)
 		{
 		  std::cerr << "Error: Without a formula I cannot make "
 			    << "sure that the automaton built with -Rm\n"
 			    << "       is correct." << std::endl;
 		  exit(2);
 		}
-	      // Let's make sure that A recognizes the same language
-	      // as MINIMIZED.
-	      spot::ltl::formula* neg =
-		spot::ltl::unop::instance(spot::ltl::unop::Not, f->clone());
-	      spot::tgba* n = spot::ltl_to_tgba_fm(neg, dict, fm_exprop_opt,
-						   fm_symb_merge_opt,
-						   post_branching,
-						   fair_loop_approx,
-						   unobservables, fm_red);
-	      neg->destroy();
-	      spot::tgba* nscc = spot::scc_filter(n, true);
-	      // If the negation is a safety automaton,
-	      // then the minimization is correct.
-	      if (is_safety_automaton(n))
-		{
-		  a = minimized;
-		}
-	      else
-		{
-		  spot::tgba* p = new spot::tgba_product(minimized, nscc);
-		  spot::emptiness_check* ec = couvreur99(p);
-		  spot::emptiness_check_result* res = ec->check();
-		  if (!res)
-		    {
-		      delete ec;
-		      delete p;
-		      spot::tgba* nm = minimize(nscc);
-		      p = new spot::tgba_product(a, nm);
-		      ec = couvreur99(p);
-		      res = ec->check();
-		      if (!res)
-			{
-			  // Finally, we are now sure that it was safe
-			  // to minimize the automaton.
-			  a = minimized;
-			}
-		      delete nm;
-		    }
-		  delete res;
-		  delete ec;
-		  delete p;
-		}
-	      delete nscc;
-	      delete n;
 	    }
-	  tm.stop("WDBA-check");
+	  else if (minimized == a)
+	    {
+	      minimized = 0;
+	    }
+	  else
+	    {
+	      a = minimized;
+	    }
 	}
 
       if (opt_monitor)
@@ -1059,7 +1017,7 @@ main(int argc, char** argv)
 	    }
 	}
 
-      spot::tgba_explicit* expl = 0;
+      const spot::tgba_explicit* expl = 0;
       switch (dupexp)
 	{
 	case NoneDup:
@@ -1072,7 +1030,7 @@ main(int argc, char** argv)
 	  break;
 	}
 
-      spot::tgba* product_degeneralized = 0;
+      const spot::tgba* product_degeneralized = 0;
 
       if (system)
         {