CTL May Be Ambiguous When Model Checking Moore Machines

Cédric Roux (1) , Emmanuelle Encrenaz (1)

1 ASIM - Architecture des Systèmes intégrés et Micro électronique

The model checking problem is defined over Kripke structures. However, hardware designers often handle other models, such as Moore machines. When model checking their designs using CTL as a logic, they must translate them into Kripke structures. A given CTL property may be believed to be true (conversely false) over the Moore machine and in fact be false (conversely true) on the derived Kripke structure. This may lead to ambiguities if the designer does not fully understand the translation scheme he uses, which may be the case if he uses automatic tools. We present iCTL, a logic specifically designed to work with Moore machines, which extends CTL to help the designer removing possible ambiguities when model checking Moore machines. We show that it is strictly more expressive than CTL.

Domaines: Informatique [cs]

Cédric Roux, Emmanuelle Encrenaz. CTL May Be Ambiguous When Model Checking Moore Machines. CHARME 2003 - 12th IFIP WG 10.5 Advanced Research Working Conference on Correct Hardware Design and Verification Methods, Oct 2003, L'Aquila, Italy. pp.164-169, ⟨10.1007/978-3-540-39724-3_16⟩. ⟨hal-01529835⟩