Scalability in Model Checking through Relational Databases

Florin Stoica
International Journal of Logic and Computation (IJLP), Volume (4) : Issue (1) : 2016 1
Scalability in Model Checking through Relational Databases
Florin Stoica florin.stoica@ulbsibiu.ro
Department of Mathematics and Computer Science
“Lucian Blaga” University
Sibiu, 550012, Romania
Abstract
In this paper we present a new ATL model checking tool used for verification of open systems. An
open system interacts with its environment and its behavior depends on the state of the system
as well as the behavior of the environment. The Alternating-Time Temporal Logic (ATL) logic is
interpreted over concurrent game structures, considered as natural models for compositions of
open systems. In contrast to previous approaches, our tool permits an interactive design of the
ATL models as state-transition graphs, and is based on client/server architecture: ATL Designer,
the client tool, allows an interactive construction of the concurrent game structures as a directed
multi-graphs and the ATL Checker, the core of our tool, represents the server part and is
published as Web service. The ATL Checker includes an algebraic compiler which was
implemented using ANTLR (Another Tool for Language Recognition). Our model checker tool
allows designers to automatically verify that systems satisfy specifications expressed by ATL
formulas. The original implementation of the model checking algorithm is based on Relational
Algebra expressions translated into SQL queries. Several database systems were used for
evaluating the system performance in verification of large ATL models.
Keywords: ATL, Model Checking, Web Services, Relational Algebra, SQL.
1. INTRODUCTION
Model checking is a technology widely used for the automated system verification and represents
a technique for verifying that finite state systems satisfy specifications expressed in the language
of temporal logics.
A Computation Tree Logic (CTL) specification is interpreted over Kripke structures, which are
graph-like structures, in which nodes represent states and arcs represent transitions between
states.
The set of all paths through a Kripke structure is assumed to correspond to the set of all
possible computations of a system. CTL logic is branching-time logic, meaning that its
formulas are interpreted over all paths beginning in a given state of the Kripke structure.
A CTL formula encodes properties that can occur along a particular temporal path as well as
to the set of all possible paths. A path in a CTL model is interpreted as sequences of
successive states of computations. The CTL syntax includes several operators for describing
temporal properties of systems: A (for all paths), E (there is a path), ○ (at the next moment), ◊
(in future), □ (always) and U (until).
A Kripke structure offers a natural model for the computations of a closed system, whose
behaviour is completely determined by the state of the system. The compositional modelling and
design of reactive systems requires each component to be viewed as an open system.
The branching time temporal logic CTL has a limited value when applied to open systems [1],
although it can be used successfully for domain oriented applications [2]. An open system is
a system that interacts with its environment and whose behaviour depends on the state of the

Florin Stoica
system as well as the behaviour of the environment. In order to construct models suitable for
open systems, the Alternating-time Temporal Logic (ATL) was defined [3]. ATL represents an
extension of CTL, which is interpreted over concurrent game structures (CGS).
ATL replaces path quantifiers A and E by cooperation modalities of the form 〈〈A〉〉 ϕ (where
A is a group of agents). Informally, 〈〈A〉〉 ϕ means that agents A have a collective strategy to
enforce ϕ, regardless of the actions of all the other agents [4].
The model checking problem for ATL is to determine whether a given model satisfies a given
ATL formula.
Two most common methods of performing model checking are explicit enumeration of states of
the model and respectively the use of symbolic methods.
Symbolic model checkers analyse the state space symbolically using Ordered Binary Decision
Diagrams (OBDDs), which were introduced in [5]. The binary decision diagram is a data structure
for representing Boolean functions. With appropriate labelling of each state of the CGS structure,
any expression on the Boolean variables represents a set of states of the structure. In contrast
with explicit-state model checking, states in symbolic model checking are represented implicitly,
as a solution to a logical equation. This approach saves space in memory since syntactically
small equations can represent comparatively large sets of states [6]. A symbolic model checker
represents the CGS structure itself symbolically using OBDDs to represent transition relations by
Boolean expressions. The key to symbolic model checking is to perform all calculations directly
using these Boolean expressions, rather than using the CGS structure explicitly.
An efficient representation of the CGS structures using OBDDs can potentially allow much larger
structures to be checked.
ATL has been implemented in several symbolic tools for the analysis of open systems.
In [2] is presented a verification environment called MOCHA for the modular verification of
heterogeneous systems. The input language of MOCHA is a machine readable variant of reactive
modules. Reactive modules provide a semantic glue that allows the formal embedding and
interaction of components with different characteristics [7].
In [8] is described MCMAS, a symbolic model checker specifically tailored to agent-based
specifications and scenarios. MCMAS supports specifications based on CTL and ATL,
implements OBDD-based algorithms optimized for interpreted systems and supports fairness,
counter-example generation, and interactive execution (both in explicit and symbolic mode).
MCMAS has been used in a variety of scenarios including web-services, diagnosis, and security.
MCMAS takes a dedicated programming language called ISPL (Interpreted Systems
Programming Language) as model input language. An ISPL file fully describes a multi-agent
system (both the agents and the environment).
The aim of our research was to develop a reliable, easy to maintain, scalable model checker tool
to improve applicability of ATL model checking in design of general-purpose computer software.
In the following we will present a short justification for the choice of the explicit-state model
technique.
In [9] is presented a comparison between RULEBASE, a symbolic model checker developed at
IBM Haifa Research Laboratory and the explicit LTL (Linear Temporal Logic) model checker
SPIN [10]. The software verified was a distributed storage subsystem software application. The

Florin Stoica
state space size handled by SPIN was 10
8
in a 3-process model. Using symbolic model checking,
RULEBASE keeps a compressed representation of the state space and thus was able to manage
10
150
states. On the other hand, because of the limit on state size, RULEBASE could not
represent a state large enough to include the information needed for more than 2-process
configuration [9].
Most hardware designs are based on a clocked-approach and thus are synchronous. For these
systems, the symbolic model checking approach is more appropriate [11].
On the other hand, for nondeterministic, high-level models of hardware protocols, it has
previously been argued that explicit model checking is better than symbolic model checking [12];
this is because the communication mechanisms inherent in protocols tend to cause the BDDs in
symbolic model checking to blow up [13].
In their basic form, symbolic approaches tend to perform poorly on asynchronous models where
concurrent interleaving are the main source of explosion of the BDD representation, and explicit-
state model-checkers have been the preferred approach for such models [13].
Concurrent software is asynchronous as the different components might be running on different
processors or be interleaved by the scheduler of the operating system. Taking into account the
above considerations, in our tool we are using an explicit-state model technique.
The most pressing challenge in model checking today is scalability [6]. A model-checking tool
must be efficient, in terms of the size of the models it can reason about and the time and space it
requires, in order to scaling its verification ability to handle real-world applications.
An orthogonal approach to increase the capacity of an explicit-state model checker tool is to
exploit the memory and computational resources of multiple computers in a distributed computing
environment [13]. Following this idea, our tool is based on Web Services technology to address
the time constraints in verification of large models.
In this paper we will present a model-checking algorithm based on procedure from [3]. For a
set A of agents and a set Θ of states, implementation of almost all ATL operators imply the
computation of function Pre(A, Θ) – the set of states from which agents A can enforce the
system into some state in Θ in one move [7]. Our main contribution presented in this paper is
the implementation of function Pre(A,Θ) using Relational Algebra expressions, translated
then into SQL statements. Other original approach is represented by the generation of an
ATL model checker using ANTLR (Another Tool for Language Recognition) from our
specification grammar of ATL.
The ATL semantics is implemented in our model checker tool by attaching of specific actions
to grammatical constructions within specification grammar of ATL. The actions are written in
target language of the generated parser, in this case Java. These actions are incorporated in
source code of the parser and are activated whenever the parser recognizes a valid syntactic
construction in the translated ATL formula.
The paper is organized as follows. In section 2 we present the definition of the concurrent game
structure. In section 3 is defined the ATL syntax, and section 4 contains ATL semantics. In
section 5 is described the implementation of an ATL model checker in ANTLR. In section 6 we
introduce some relational algebra concepts which are used in our implementation of the ATL
model checking algorithm. These concepts are applied in section 7. In section 8 are presented
several examples of computations based on results obtained in section 7. In section 9 is
described the architecture of our ATL model checker tool: the server part, published as a Web
service and a GUI client developed in C#. A performance analysis of our ATL model checker is
made in section 10. Conclusions are presented in section 11.

Florin Stoica
2. THE CONCURRENT GAME STRUCTURE
A concurrent game structure is defined in [3] as a tuple S=〈Λ,Q,Γ,γ,M,d,δ〉 with the following
components: a nonempty finite set of all agents Λ = {1, …, k}; a finite set of states Q; a finite set
of propositions (or observables) Γ; the labelling (or observation) function γ; a nonempty finite set
of moves M; the alternative moves function d and the transition function δ. For each state
q∈Q, γ (q) ⊆ Γ is the set of propositions true at q. For each player a∈{1,…,k} and each state q∈Q,
the alternative moves function d: Λ×Q → 2
M
associates the set of available moves of agent a at
state q. In the following, the set d(a,q) will be denoted by da(q). For each state q∈Q, a tuple
〈j1,…,jk〉 such that ja∈da(q) for each player a∈Λ, represents a move vector at q. We define the
move function D : Q → 2M
, with M the set of all move vectors such that D(q)⊆d1(q)
×…×dk(q) is the set of move vectors at q. We write
( )a a
q Q
D d q
∈
= U (1)
for the set of available moves of agent a within the game structure S.
The transition function δ(q,j1,…,jk), associates to each state q∈Q and each move vector 〈j1,…,jk〉 ∈
D(q) the state that results from state q if every player a∈{1,…,k} chooses move ja.
A computation of S is an infinite sequence λ =q0, q1,… such that qi+1 is the successor of qi , ∀i ≥ 0
[3]. A q-computation is a computation starting at state q.
For a computation λ and a position i ≥0, we denote by λ [i ], λ [0,i ], and λ [i,∞ ] the i-th state of λ,
the finite prefix q0, q1,…,qi of λ, and the infinite suffix qi , qi+1 … of λ, respectively [3].
3. ATL SYNTAX
We denote by FS
(A) the set of all syntactically correct ATL formulas, defined over a concurrent
game structure S and a set of agents A ⊆ Λ.
Each formula from FS
(A) can be obtained using the following rules:
(R1) if p∈Γ then p∈ FS
(A);
(R2) if {ϕ, ϕ1, ϕ2} ⊆ FS
(A) then {¬ ϕ, ϕ1∨ϕ2} ⊆ FS
(A);
(R3) if {ϕ, ϕ1, ϕ2} ⊆ FS
(A) then {〈〈A〉〉○ϕ, 〈〈A〉〉□ϕ, 〈〈A〉〉 ϕ1 U ϕ2} ⊆ FS
(A).
The logic ATL is similar to the branching time temporal logic CTL, with difference that path
quantifiers are parameterized by sets of players from Λ. The operator 〈〈 〉〉 is a path quantifier, and
○ (next), ◊ (future), □ (always) and U (until) are temporal operators. A formula 〈〈A〉〉 ϕ
expresses that the team A has a collective strategy to enforce ϕ [14]. Boolean connectives can
be defined from ¬ and ∨ in the usual way. The ATL formula 〈〈A〉〉 ◊ ϕ is equivalent with 〈〈A〉〉 true
U ϕ.
4. ATL SEMANTICS
Consider a game structure S=〈Λ,Q,Γ,γ,M,d,δ〉 with Λ={1,…,k} the set of players.
A strategy for player a∈Λ is a function fa: Q
+
→Da that maps every nonempty finite state sequence
λ=q0,q1,…qn, n≥0, to a move of agent a denoted by fa(λ)∈Da ⊆ M. Thus, the strategy fa determines
for every finite prefix λ of a computation a move fa(λ) for player a in the last state of λ.

Florin Stoica
Given a set A ⊆ {1,…,k} of players, the set of all strategies of agents from A is denoted by FA ={
fa | a∈ A }. The outcome of FA is defined as Fout A
: Q → P(Q
+
), where ( )F
out q
A
represents q-
computations that the players from A are enforcing when they follow the strategies from FA. In
the following, for ( )Fout qA
we will use the notation ( , )out q FA . A computation λ=q0,q1,q2,… is in
( , )out q FA if q0=q and for all positions i≥0, there is a move vector 〈j1,…,jk〉 ∈ D(qi) such that [3]:
• ja=fa(λ[0,i]) for all players a∈ A, and
• δ(qi, j1,…,jk)= qi+1.
For a game structure S, we write q⊨ϕ to indicate that the formula ϕ is satisfied in the state q of
the structure S.
For each state q of S, the satisfaction relation ⊨ is defined inductively as follows:
• for p∈ Γ, q⊨ p ⇔ p∈ γ(q)
• q⊨¬ϕ ⇔ q⊭ ϕ
• q⊨ ϕ1∨ϕ2 ⇔ q⊨ ϕ1 or q⊨ ϕ2
• q⊨ 〈〈A〉〉 ○ φ ⇔ there exists a set FA of strategies, such that for all computations λ∈out(q,
FA), we have λ[1] ⊨ ϕ (the formula ϕ is satisfied in the successor of q within computation
λ).
• q⊨ 〈〈A〉〉 □ φ ⇔ there exists a set FA of strategies, such that for all computations λ∈out(q,
FA), and all positions i≥0, we have λ[i] ⊨ ϕ (the formula ϕ is satisfied in all states of
computation λ).
• q⊨ 〈〈A〉〉 φ1 U φ2 ⇔ there exists a set FA of strategies, such that for all computations
λ∈out(q, FA), there exists a position i≥0 such that λ[i] ⊨ ϕ2 and for all positions 0≤j<i, we
have λ[j] ⊨ ϕ1.
The path quantifiers A, E of CTL can be expressed in ATL with 〈〈∅〉〉 and 〈〈Λ〉〉 respectively. As a
consequence, the CTL duality axioms can be rewritten in ATL, and become validities in the basic
semantics: 〈〈∅〉〉□ ϕ ≡ ¬〈〈Λ〉〉◊ ¬ϕ, 〈〈∅〉〉◊ ϕ ≡ ¬〈〈Λ〉〉□¬ϕ, where the Λ∈{1,…,k} describe the set of
agents.
5. IMPLEMENTATION OF A MODEL CHECKER IN ANTLR
From a formal point of view, implementation of an ATL model checker will be accomplished
through the implementation of an algebraic compiler C in two steps [15].
First, we need a syntactic parser to verify the syntactic correctness of a formula ϕ. Second, we
should deal with the semantics of the ATL language, respectively with the implementation of the
ATL operators: ¬, ∨, ∧,→, ◊, ○, □ and U.
The algebraic compiler C translates the ATL formula ϕ to the set of nodes Q' over which formula ϕ
is satisfied. That is, C(ϕ)=Q' where Q'={q∈Q| q⊨ ϕ}.
We choose the ANTLR (Another Tool for Language Recognition) for implementation of the
algebraic compiler. ANTLR [16] is a compiler generator which takes as input a grammar, and
generates a recognizer for the language defined by the grammar.
Translation of a formula ϕ of an ATL model to the set of nodes Q' over which formula ϕ is
satisfied is accomplished by attaching of specific actions to grammatical constructions within
specification grammar of ATL. These actions are written in Java, the target language of the
generated parser. When ANTLR generates code using our ATL grammar as input, these actions
are incorporated in the source code of the parser and are activated whenever the parser

Florin Stoica
recognizes a valid syntactic construction in the translated ATL formula. In case of the algebraic
compiler C, the attached actions define the semantics of the ATL model checker, i.e., the
implementation of the ATL operators.
The model checker generated by ANTLR from our ATL specification grammar takes as input the
concurrent game structure S and the formula ϕ, and provides as output Q'={q∈Q| q ⊨ ϕ} – the set
of states where the formula ϕ is satisfied.
The algebraic compiler C implements the following ATL model checking algorithm [17], [3]:
Algorithm 1. ATL model checking algorithm
Input: the concurrent game structure S and the formula ϕ
Output: Q'={q∈Q| q ⊨ ϕ} – the set of states where the formula ϕ is satisfied.
function EvalA(ϕ) as set of states ⊆ Q
case ϕ=p:
return [p] = {q ∈ Q | p ∈ γ(q)};
case ϕ= ¬θ:
return Q EvalA(θ);
case ϕ=θ1∨θ2:
return EvalA(θ1)∪ EvalA(θ2);
case ϕ=θ1∧θ2:
return EvalA(θ1) ∩ EvalA(θ2) );
case ϕ=θ1→θ2:
return ( Q EvalA(θ1) ) ∪ EvalA(θ2);
case ϕ =〈〈A〉〉○θ:
return Pre(A,EvalA(θ));
case ϕ =〈〈A〉〉□θ:
ρ:=Q; τ:= EvalA(θ); τ0:= τ;
while ρ ⊈ τ do
ρ := τ; τ:=Pre(A, ρ)∩τ0;
wend
return ρ;
case ϕ = 〈〈A〉〉 θ1 U θ2:
ρ:= ∅; τ:= EvalA(θ2); τ0:= EvalA(θ1);
while τ ⊈ ρ do
ρ := ρ ∪ τ;
τ:=Pre(A, ρ)∩τ0;
wend
return ρ;
end function
The corresponding action included in the ANTLR grammar of ATL language for implementing the
□ operator is:
’<<A>> #’ f=formula
{
HashSet r=new HashSet(all_SetS);
HashSet p=$f.set;
while (!p.containsAll(r))
{
r=new HashSet(p);
p=Pre(r);
p.retainAll($f.set);
}
$set=r;
trace(”atlFormula”);
printSet(”<<A>>#”+$f.text,r);
}

Florin Stoica
For the □ ATL operator we use in ANTLR the # symbol. Also, we denote the ◊ ATL operator with
~ symbol and the ○ operator is replaced by @ symbol.
In our implementation the all_Set is Q, and means all states of the model. The formula represents
a term from a production of the ATL grammar, and p, r, f variables are sets used in the internal
implementation of the algebraic compiler. Functions trace() and printSet() are debugging
functions.
In case of large ATL models, with many states and agents, it is very important for the model
checker tool to have an efficient implementation for Pre(A, ρ) function – the set of states from
which agents A can enforce the system into some state in ρ in one move – which appears in
several ATL operators. In the following, we made an original formalization of the Pre() function
using Relational Algebra (RA) concepts. Then, we will translate the obtained relational algebra
expression into a SQL statement, which represents a concise implementation of the Pre()
function, ready to be executed using a very efficient query optimizer on a database server.
6. RELATIONAL ALGEBRA CONCEPTS
In the following we present all Relational Algebra concepts used in our algorithm described in the
next section. More detailed aspects can be found in [18].
In order to introduce the following definitions, we assume that a set D of data types is given, and
for each D ∈ D, the set of possible values of data type D is denoted by val(D), which is also
known as the domain of D.
A relation schema RS defines a (finite) sequence A1, . . . , An of distinct attribute names. The set
of given attribute names will be denoted by A = { A1, . . . , An}. Each attribute Ak has a data type
Dk, and a set of possible values represented by val(Dk), 1,k n= .
A relation schema RS may be written as RS = (A1 : D1, . . ., An : Dn).
A tuple t with respect to the relation schema RS = (A1 : D1, . . . , An : Dn) is a sequence (d1, . . . ,
dn) of n values such that di ∈ val(Di ), 1,i n= .
Relations are sets of tuples.
A relational database schema consists of a finite set of relation names R, and for every relation R
∈ R is also considered its relation schema sch(R).
The Relational Algebra (RA) consists from the set of all finite relations over which are defined
some operations. A query is an expression in the RA. The operations of RA can be nested to
arbitrary depth such that complex queries can be evaluated. The final result will be a relation.
For the purpose of this paper, in the following we present from the set of RA operations only
selection, projection (with renaming) and cartesian product.
The selection is denoted by σ and is parameterized by a simple predicate ω. The operation σω
acts like a filter and selects a subset of the tuples of a relation, namely those which satisfy the
predicate ω. The predicate ω has the form:
expr operator expr,
where expr is an expression built from attributes, constants, and data type operations (+, -, *, /,
etc) and operator can be:
• =, ≠

Florin Stoica
• <, <=, >, >=
• data type-dependent predicates (LIKE, IN or ∈, etc)
For a given relation R and a predicate ω, the expression σω(R) corresponds to the following
SQL query:
select distinct * from R where ω
More complex selection predicates may be constructed using the boolean connectives (∨,∧,¬).
The projection πL eliminates all attributes of the input relation excepting those mentioned in the
list L. If 1
, , mi iL A A= … the projection πL(R) produces for each input tuple ( )1 1: , , :n nA d A d… an
output tuple 1 1
( : , , : )m mi i i iA d A d… .
There are two useful generalized projection operators. The first one is used to provide attribute
renaming:
1 1
, ,i m im
B A B Aπ ← … ←
The projection 1 1
, , ( )i m im
B A B A Rπ ← … ← provide for each input tuple ( )1 1: , , :n nA d A d… an output tuple
11( : , , : )mi m iB d B d… .
The second generalized π operator is using computations to derive the values in new columns:
' '
, || @ ||
( )NAME EMAIL Account Domain
EMPLOYEEπ ←
where || operator represents string concatenation.
The relational algebra expression 1 , , ( )mA A Rπ … corresponds to the SQL query:
select distinct 1, , mA A… from R
and for the expression 1 1 , , ( )m mB A B A Rπ ← … ← the equivalent SQL query is
select distinct 1 1 m m, ,A as B A as B… from R.
In general, queries need to combine values from several relations. In RA, such queries are
formulated using the Cartesian product, denoted by symbol ×. The Cartesian product R × V of two
relations R, V is computed by concatenating each tuple r ∈ R with each tuple v ∈ V.
If ( )1 1: , , :n nr A a A a= … and ( )1 1: , , :m mv B b B b= … then
( )1 1 1 1: , , : , : , , :n n m mr v A a A a B b B b• = … …
where • denotes tuple concatenation. The attribute names must be unique within a tuple r v• .
R × V can be computed by the equivalent SQL query:
select R.*, V.* from R, V
The unique column name restriction is solved in SQL easily: a common attribute A of relations R
and V may uniquely be identified by R.A respectively V.A.
In RA, this solution is formalized by the renaming operator ρx(R). If R is a relation with schema
( ) ( )1 1: , , :n nsch R A D A D= … , then ( ) 1 1. , , . ( )n nx x A A x A AR Rρ π ← … ←= is a relation with schema
( )1 1. : , , . :n nx A D x A D… .

Florin Stoica
Because the combination of Cartesian product and selection in queries is frequently, a special
operator join has been introduced, denoted by ⋈θ:
R ⋈θ V ≡ σθ (R × V)
where the join predicate θ may refer to attribute names of R and V.
The join operator combines tuples from two relations and acts like a filter, removing tuples without
join partner:
x.A x.B
a1 b1
a2 b2
a3 b3
⋈x.B=y.B
y.B y.C
b3 c3
b4 c4
b5 c5
=
A B C
a3 b3 c3
In SQL language, the relational algebra expression R ⋈θ V can be written as:
select * from R join V on θ.
The left outer join operator denoted by θ, preserves all tuples in its left argument, even if a
tuple does not fit with a partner in the join:
x.A x.B
a1 b1
a2 b2
a3 b3
x.B=y.B
y.B y.C
b3 c3
b4 c4
b5 c5
=
A B C
a1 b1 null
a2 b2 null
a3 b3 c3
In the following the set of syntactically correct Relational Algebra (RA) expressions or queries is
defined recursively and the resulting schema of each expression is given.
1) For every relation R ∈ R, R is an RA expression with schema sch(R).
2) A relation constant {(A1 : d1, . . . , An : dn)} is an RA expression if di ∈ val(Di ), 1,=i n . The
schema of this expression is (A1 : D1, . . . , An : Dn).
Let ERA be an RA expression with schema RS = (A1 : D1, . . . , An : Dn).
3) ( )σ =i jA A RAE , with i, j ∈ {1, …, n} is an RA expression with schema RS.
4) ( )σ =iA d RAE , with i ∈ {1, …, n} and d ∈ val(Di ) is an RA expression with schema RS.
5) 1 1
, , ( )π ← … ←i m im
B A B A RAE for 1, , {1, , }… ∈ …mi i n and B1, …, Bm ∈ A such that Bj ≠ Bk for j≠k is
an RA expression with schema 11( : , , : )… mi m iB D B D .
7. USING RELATIONAL ALGEBRA IN MODEL CHECKING ALGORITHM
For a concurrent game structure S presented in section 2, can be defined a directed multi-graph
GS=(X,U), where X=Q, and (b,e) ∈ U ⇔ ∃ 〈j1,…,jk〉 ∈ D(b) such as δ(b,j1,…,jk) = e. The labelling
function for the graph GS is defined as follows: L:U → M , ∀ u = (b,e) ∈ U, L(u) = 〈j1,…,jk〉, where
δ(b,j1,…,jk) = e.
We define the relation schema (B:QB, M1:D1, …, Mk:Dk, E:QE) where QB = {b ∈ Q | ∃ e ∈ Q such
as (b, e) ∈ U}, QE = {e ∈ Q | ∃ b ∈ Q such as (b, e) ∈ U} and Di, i ∈ {1, …, k} = Λ was defined in
(1), such as if RS is a relation name with schema defined above, (B:b, M1:j1, …, Mk:jk, E:e) ∈ RS
⇔ 〈j1,…,jk〉 = L((b,e)).
For a set A of m agents, A ⊆ Λ, A = {i1, …, im}, we define:
1
, , , ,) ( )( π …= i im
S B M M E SR RA where , {1, , }∈ ∈ …li l mA and

Florin Stoica
1
, ,( () ( ))π ← °…°= i im
L B LABEL M M E SR RA A where the operator ° can be defined as follows: i ° j = i || ',' ||
j.
For a set Θ ⊆ QE, b ∈ Pre(A, Θ) ⇔ ∃ ,( ) , 1,∈ ∈ =l li i lj d i l mb A and ∃ e ∈ Θ such as
1
( , (, ))∈mi i Sb j ,…, j e R A
and ∄e'∈QE Θ such as
1
( ( )')∈mi i Sb, j ,…, j ,e R A
With other words, b ∈ Pre(A, Θ) ⇔ ∃ ,( ) , 1,∈ ∈ =l li i lj d i l mb A such as
1 1
: , , : {( : ) | }( )π = ∈Θm mE i i i i EB b M : j ,…,M : j E Q E e e
In the following, the set of states QE Θ is denoted by Q .
Now we can design an algorithm to compute the function Pre(A, Θ) using RA expressions:
Algorithm 2. Computing ( , )Pre A Q function using relational algebra expressions
Step1
, ( ) ) ( )( ( )π σ ∈Θ
Θ
=B LABEL E L LR RA A
, ( ) ) ( )( ( )π σ Θ
Θ∈
=B LABEL L LE
R RA A
Step2
(( ))ρ Θ
Lx R A ,
( ( )) ( )ρ ΘΘ Θ
=L Ly R RA A
. . . .= ∧ =x B y B x LABEL y LABEL
Step 3
, ,
. . , . ( )) ( )( ( )σ π Θ Θ
=
Θ
= null
LABEL null LABEL L Ly x B y R RA A
Step 4
,
.( , ) ( ( ))π Θ
Θ = null
x B LPre RA A
The above algorithm can be implemented in SQL language as follows:
Algorithm 3. Computing ( , )Pre QA function using SQL statements
select distinct B from
(
select distinct x.B, y.LABEL from
(
select distinct B, LABEL from model
where E in Θ
) x
left join
(
select distinct B, LABEL from model
where E not in Θ
) y
on x.B = y.B and x.LABEL = y.LABEL
where y.LABEL is null
) z

Florin Stoica
We tested the above algorithm on three database servers: MySql, H2 and Microsoft SQL Server.
Surprising, the MySQL and H2 deal much better with queries having the clause “IN” based on
many values. Rewriting the above query using temporary tables to hold elements of the set Θ,
was obtained a significant performance increase in all cases.
8. SOME EXAMPLES
In [19] is presented a CTL model for two processes competing for entrance into a critical section.
In the following, we present an ATL model for the critical section problem solved using a mutex.
Our solution improves the mentioned CTL model because it supports true concurrency: the two
processes can request simultaneously entrance into critical section, and their access is restricted
using a mutex managed by the operating system (represented in our model by an agent).
If we consider our model presented in Figure 1 as a concurrent game structure
S=〈Λ,Q,Γ,γ,M,d,δ〉, we will detail the semantics for the symbols from Γ - the set of propositions
(labels from nodes representing states) and M – the set of agents moves. We have Γ = {I1, I2, W1,
W2, E1, E2, L1, L2, F} with the following significations:
FIGURE 1: ATL model for two processes competing to entrance into a critical section.
• Ii – the process i is in Idle state, 1,2i = ;
• Wi – the process i is in Waiting state (it is waiting to enter in critical section), 1,2i = ;
• Ei – the process i is in Executing state (it is executing the code from critical section),
1,2i = ;
• Li – the mutex is owned (Locked) by the process i, 1,2i = ;
• F – the mutex is not owned by any process (it has Freed).
The symbols from the set M = {l, e, i, f} ∪ {pd, dp, p-, -p} have the following significations:
• l – a request to enter in critical section (lock the mutex);
• e – a request to execute code from the critical section;
• i – there is no a request (idle);
• f – release (free) the mutex, leave the critical section;
• pd – permission for agent 1, deny for agent 2;
• dp – permission for agent 2, deny for agent 1;

Florin Stoica
• p- – permission for agent 1, the agent 2 is idle (no request);
• -p – permission for agent 2, the agent 1 is idle (no request).
Using our model checking tool, we have verified that the following ATL formulas are satisfied by
the model presented above:
ATL formula Signification
not(<<A>>~(E1 and E2)) Safety – Processes are not running simultaneously statements from
the critical section
Wi => not (<<A>># (not Ei)), 1, 2i =
Warranty - each time one process tries to enter in critical section
(owning the mutex), in the future it will succeed.
not (<<A>>~ (not (Ii => << A>>@ Wi))),
1, 2i =
Nonblocking – each process can require any time to enter in the
critical section
<<A>>~ (E1 and (<<A>> E1 U (not E1
and (<<A>> not E2 U E1))))
<<A>>~ (E2 and (<<A>> E2 U (not E2
and (<<A>> not E1 U E2))))
Without imposed succession – the processes do not have the
restriction to enter alternating in the critical section
Ei => Li, 1, 2i =
Owning the mutex – One process can execute the critical section
only if it is owning the mutex
not(<<A>>~ (not ((L1 or L2) => not
(<<A>># (not F)))))
Releasing the mutex – If one of the processes is owning the mutex,
in the future it must release (free) the mutex
I1 and I2 => << A>>@ (W1 and W2) Concurrency – If there is no process into critical section, both
processes can request simultaneously to enter in the critical section,
without blocking.
TABLE 1: ATL Formulas Satisfied By Our Model.
In the following we will apply the Algorithm 3 for computing function Pre() with different arguments
passed in the process of checking of two ATL formulas from Table 1.
Example 1
For the ATL model presented above, we check the following ATL formula:
W1 => not (<<A>># (not E1)) (2)
with its signification described in Table 1. The model checking algorithm will require some calls of
function Pre() with certain arguments. In Table 2 are presented two computations of function
Pre():

Florin Stoica
{0,3,4,5,6,7,10}Q =
A={1} A={2}
,
. , . ( )LABEL Lx B y Rp QQ
A
B LABEL
0 NULL
0 l
2 NULL
3 NULL
4 NULL
5 NULL
6 NULL
9 NULL
10 NULL
B LABEL
0 l
2 NULL
3 NULL
4 NULL
5 NULL
6 NULL
9 NULL
10 NULL
( , )Pre QA {0,2,3,4,5,6,9,10} {2, 3, 4, 5,6, 9, 10}
TABLE 2: Computations of function ( , )Pre QA when checking the ATL formula (2).
For A = {1} because i∈d1(0), 1( :0, : , : ) {( :4)}π =E EB M i E Q E , and 4∈Θ ⇒ 0 ∈ Pre(A, Θ).
For A = {2}, d2(0) = {l, i}. We have 2( :0, : , : ) {( :8)}π =E EB M i E Q E , but 8 ∉ Θ.
Also, 2( :0, : , : ) {( :1),( :4),( :10)}π =E EB M l E Q E E E , but 1 ∉ Θ.
We conclude that 0 ∉ Pre(A, Θ).
Example 2
For the same ATL model, described in Figure 1, we consider the following formula:
not (<<A>>~ (not (I1 => <<A>>@ W1))) (3)
with its signification also described in Table 1. In Table 3 are presented computations of function
Pre() needed for checking the ATL formula (3):
{1,6,7,8,10}Q =
A={1} A={2}
,
.. , )(LABEL Lx B y Rp QQ
A
B LABEL
0 NULL
3 NULL
4 NULL
5 NULL
6 NULL
7 NULL
10 NULL
B LABEL
0 l
0 NULL
3 l
4 e
5 NULL
6 NULL
7 NULL
10 NULL
( , )Pre QA {0,3,4,5,6,7,10} {0,5,6,7,10}
TABLE 3: Computations of function ( , )Pre QA when checking the ATL formula (3).
For A = {2}, d2(3) = {l}. We have 2( :3, : , : ) {( :4),( :10)}π =E EB M l E Q E E , but 4∉Θ.

Florin Stoica
Also, we have d2(4) = {e}, and 2( :4, : , : ) {( :5),( :6)}π =E EB M e E Q E E , but 5∉Θ. Thus, 3 ∉
Pre(A, Θ) and 4 ∉ Pre(A, Θ).
9. PUBLISHING THE ATL MODEL CHECKER AS A WEB SERVICE
Web services represent a standardized way for applications to expose their functionality over the
Internet/Intranet, regardless of the platform or operating system upon which the service or the
client is implemented. A Web service is accessible on the Web through an URL, and use a XML
file, written using Web Service Definition Language (WSDL), to define its interfaces and bindings.
We choose to publish our implementation of the ATL model checker as a Web service in order to
make the core of our tool accessible to various clients.
Our implementation is based on GlassFish/Tomcat as a Web container, and relies on
• MySQL
• SQLServer
• H2
as a database server.
For testing purposes, the ATL model checker described in this paper is available online via a Web
service hosted by mcheck-useit.rhcloud.com.
The Web service will receive from a client the XML representation of a ATL model S and a ATL
formula ϕ. The original form of the ATL model S is passed then to the algebraic compiler C
generated by ANTLR using our ATL extended grammar. For a given ATL model (encoded as a
directed multi-graph described in section 7) and an ATL formula ϕ, the Web service will parse the
formula and will return to client the set of states in which the formula is satisfied if formula is
syntactically correct, or a message describing the error from an erroneous formula.
In order to notify the client about possible syntactical errors found in the verified ATL formula, we
must override the default behavior of the ANTLR error-handling. A custom error-handling in lexer
is installed as follows:
@lexer::members {
@Override
public void reportError(RecognitionException re) {
throw new RuntimeException("Lexical error!nn" +
"Position:" + re.line + ":" + re.charPositionInLine +
" erroneous character: '" + (char)re.c + "'");
}
}
A syntactical error is reported if we install our handler in parser:
@members {
@Override
public void reportError(RecognitionException re) {
throw new RuntimeException("Syntactical error!");
}
Finally, in case of occurrence of an error, we instruct ANTLR to throw that error, allowing the Web
service to send it to the client:
@rulecatch {
catch (RecognitionException err) { throw err; }
}

Florin Stoica
Our model checking tool is based on a C# GUI client who allows interactive graphical
development of the ATL models. For internal representation of an ATL model as a directed multi-
graph, our implementation is based on data structures provided by [20].
Thus, an ATL model encoding is based on symmetrically stored forward and backward adjacency
lists. This paradigm supports an edge-oriented way of handling graphs with multiple edges.
The functionality of the client part is accessible through a right-click contextual menu which
allows: adding nodes, labelling nodes, deleting nodes, adding arcs, display nodes numbers, etc.,
as we can see from the Figure 2.
In Figure 2, the labels of edges are associated with move vectors of agents depicted in Figure 1,
and can be assigned in the ATL Designer in a dedicated window.
An overview of the system architecture of the ATL checker tool presented in this paper is given by
the UML package diagram depicted in the Figure 3.
The ATL model checker tool contains the following packages:
• The algebraic compiler (ATL Compiler) invoked through the Web Service (ATL Checker);
• The GUI client application used for interactive construction of the ATL models as directed
multi-graphs (ATL Designer);
• The ATL non-GUI model package contains classes used for programmatic construction of
huge ATL models.
Are available ATL API Client libraries for Java and C#.
• The XML API for ATL models package contains classes needed to encode the ATL model
into XML.
It is based on our XSD schema for specification of the XML representation of an ATL model;
• The ATL GUI Model package is responsible with graphical representation of the ATL
concurrent game structures represented as directed multi-graphs.
FIGURE 2: ATL Designer – Checking The ATL Formulas (2) and (3).

Florin Stoica
FIGURE 3: The System Architecture of The ATL Model Checker Tool.
All components of our ATL model checker tool can be downloaded from http://use-it.ro.
10. PERFORMANCE ANALYSIS OF THE ATL MODEL CHECKER
In this section we evaluate the effectiveness of our approach in designing and implementing an
ATL model checker and we report some experimental results.
For the beginning we describe the usage of our model-checker to design a game strategy when
playing Tic-Tac-Toe (called TTT for short in the rest of this paper). Although the game
implemented is relatively simple, due to the large size of the structure representing the ATL
model at the first moves, it represents a good opportunity to study the impact of technologies
used to implement the model checker in its performance.
In [21] is showed that the model checking of computation tree logic (CTL) formulae can be used
for generating plans in deterministic as well as non-deterministic domains. Because ATL is an
extension of CTL that includes notions of agents, their abilities and strategies (conditional plans)
explicitly in its models, ATL is better suited for planning, especially in multi-agent systems [1].
ATL models generalize turn-based transition trees from game theory and thus it is not difficult to
encode a game in the formalism of concurrent game structures, by imposing that only one agent
makes a move at any given time step.
The game TTT is played by two opponents with a turn-based modality on a 3×3 board. The two
players take turns to put pieces on the board. A single piece is put for each turn and a piece once
put does not move. A player wins the game by first lining three of his or her pieces in a straight
line, no matter horizontal, vertical or diagonal.
The implemented algorithm looks for infallible conditional plans to achieve a winning strategy that
can be defined via ATL formulae.
We consider a computer program playing TTT game with a user (human) and the ATL model
checking algorithm is used to return a strategy to achieve a winning strategy for the computer.
The TTT is a turn-based synchronous game. In such a system, at every transition there is just
one agent that is permitted to make a choice (and hence determine the future).

Florin Stoica
Formally, a game structure S=〈Λ,Q,Γ,γ,M,d,δ〉 is turn-based synchronous if for every state q from
Q, there exist a player a from the set of all agents Λ such that |db(q)| = 1 for all players b∈Λ{a}.
State q is the turn of player a.
In the following we will show how to use the ATL formalizations in finding winning strategies in
case of TTT game.
10.1 Modelling The Game
We transform the original problem into an ATL model checking problem. More specifically, we
want to determine a strategy fa : Q
+
→ Da which leads the game into a winning state for the agent
a∈Λ representing the computer.
We suppose that positions of the board are numbered as in figure 4:
0 1 2
3 4 5
6 7 8
FIGURE 4: Labelling The Grids On The Board.
Formally, the turn-based synchronous game structure of TTT is defined as follows:
S=〈Λ,Q,Γ,γ,M,d,δ〉.
The set of agents is Λ ={1,2} and we consider that computer is represented by agent 1 and the
user is represented by the agent 2.
Values of the board locations are denoted by xi ∈ {0,1,2}, where i ∈ {0,1,...,8}. The value 0 means
an empty position, the value 1 denotes a previous move of the agent 1 and the value 2
represents a move of the player 2. For the sequence of values l m nx x x we define
min( ,1) min( ,1) min( ,1)l m n l m nx x x x x x= + +∑ where , , {0,1,...,8}l m n Î .
The set of propositions (or observables) Γ is defined as follows:
Γ = {( 1 2 3 6 0 4 8 2 4 60,3,6 0,1,2
, , , ,l l l l l ll l
x x x x x x x x x x x x T+ + + += =
) | {0,1,2}for 0,8 and {1,2}kx k TÎ = Î }.
A state labelled with value T = 1 signifies that is turn of the player 1 for making the move and if
T = 2 then the player 2 will make the next move.
The set of possible movements of agents is M={0,1,2,3,4,5,6,7,8,9}.
For the agent 1, the set of alternative movements in the state q∈Q, in case when movements are
still possible, is defined as:
1 2
0,3,6
1
1 2
0,3,6
{1,..., | 9 1, 1 ( )}
( )
{0 | 9 1, 2 ( )}
l l l
l
l l l
l
k k x x x q
d q
k x x x q
π
π
+ +
=
+ +
=
 = − ≥ ∈

= 
= − ≥ ∈

∑
∑
Analogue are defined the possible movements of the agent 2.
The game stops (so no moves are possible) if the board moves locations are full i.e.:
1 2
0,3,6
9l l l
l
x x x+ +
=
=∑
Another situation where the game is not continuing is when a player won. The state q is a winning
state for player 1 if 111 ( )qγ∈ and it is a winning state for player 2 if 222 ( )qγ∈ .

Florin Stoica
Alternation to move can be formalized as follows: for a transition ( )1 2, , 'q j j qδ = , there are the
following cases:
1 ( ) 2 ( ')q qγ γ∈ ⇒ ∈ or 2 ( ) 1 ( ')q qγ γ∈ ⇒ ∈
In order to win the game, the player 1 (the computer) must follow two rules:
1. Try to choose at next move a state from the set ⟪1⟫ ◊ (111), which favours the wining of
the game in the future.
2. Avoid to choose at next move a state from the set ⟪2⟫ ○ ( 222), to prevent the player 2 to
win on the next move.
10.2 Experimental Results
The major impact on performance of the ATL model checker is represented by the
implementation of the function Pre(), which was presented in detail in section 7 and is based
exclusively on the database server used.
In order to analyse their impact in the performance of the ATL model checker, were used three
different database servers to implement the Web service, namely MySql 5.5, H2 1.3 and
respectively Microsoft SQL Server 2008.
ATL-Designer permits the selection of one of the three database servers mentioned above:
FIGURE 5: The Selection of The Database Server.
We have found important performance penalty due to the clause IN from the query presented in
algorithm 2 from section 7, especially on Microsoft SQL Server 2008.
Thus the initial query was optimized by removing the clause IN and replacing it with JOIN
operations performed between tables.
First of all, with states of the set Θ was built a temporary table in database server using the query:
Database server Query syntax for building a table with states of the set Θ
SQL Server 2008 insert into #Θ
select distinct X.* from (values (q1), (q2), … (qn)) as X(E)
MySQL 5.5/ H2 1.3 insert into `Θ` (E) values (q1), (q2), … (qn)
TABLE 4: Specific queries to populate tables with given discrete values.
where , 1,iq i n∈Θ = .
Then, to implement sub-queries were used temporary tables which have defined primary keys for
fast access.
Supplementary optimizations were made for SQL Server:
• to reduce the transaction log and also to optimize insertions in tables of database
atl, was used the directive:
alter database atl set RECOVERY SIMPLE

Florin Stoica
• to optimize data transfer between the database server and Web server, was
maximized the dimension of packets for network data transfer with the directive:
EXEC sp_configure 'network packet size (B)', '32767';
The MySQL server was configured only during the installation process.
The H2 database supports the in-memory mode (the data is not persisted), well suited for high
performance operations. Also, H2 database can emulate the behavior of specific databases
(DB2, Oracle, MySQL, PostgreSQL, etc.). Using MySQL Compatibility Mode made it possible to
also use MySQL specific code / syntax for the H2 database.
Optimizations recommended in [22] are included in the following connection string for H2:
jdbc:h2:mem:db1;MODE=MySQL;LOG=0;LOCK_MODE=0;UNDO_LOG=0;DB_CLOSE_
DELAY=60
In Table 5 are presented the results showing the performance of our ATL model checker related
to database server used:
Total time necessary to determine the winning strategy (Tic-Tac-Toe game)
Intel Core I5, 2.5 GHz, 4Gb RAM
Number of
states
SQL Server 2008
(seconds)
MySQL 5.5
(seconds)
H2 1.3 (seconds)
4791 ≈3.97 ≈1.86 ≈1.33
4255 ≈3.37 ≈1.62 ≈1.17
3732 ≈2.66 ≈1.41 ≈0.99
3423 ≈2.32 ≈1.24 ≈0.90
3683 ≈2.21 ≈1.21 ≈0.85
2307 ≈1.97 ≈0.86 ≈0.58
2236 ≈1.93 ≈0.75 ≈0.56
TABLE 5: A comparative analysis of impact of database servers
in performance of ATL model checker.
In [23] is presented a comparison between Lurch (a random search model checker) and two well-
known model checker tools, SMV and SPIN, showing the time and memory required, and the
accuracy achieved by each tool when playing the tic-tac-toe game.
SPIN is a well-known explicit-state LTL (Linear Temporal Logic) model checker tool, and SMV is
a symbolic CTL (Computation Tree Logic) model checker.
Although the logics LTL and CTL have their natural interpretation over the computations of closed
systems and the logic ATL is used for the specification and verification of open systems, in theory
the expressive power of ATL beyond CTL (in the case of closed systems ATL degenerates to
CTL) comes at no cost - the model checking complexity of synchronous ATL is linear in the size
of the system and the length of the formula [3].
Results from [23] showed that both SMV and SPIN were able to find an optimal strategy for a
player in less than one second, on a 3x3 board.
As we can see from Table 5, the ATL model checker tool is not as fast as the CTL/LTL tools, but
we must take into consideration that an ATL model is more expressive (with ATL we can quantify
over the individual powers of one player or a cooperating team of players, ATL models capture
various notions of synchronous and asynchronous interaction between open systems, etc.).

Florin Stoica
In [24] the Tic-Tac-Toe was implemented in the Reactive Modules Language (RML). RML is the
model description language of the ATL model checker MOCHA, which was developed by Alur et
al. [7]. Experimental results showed that the time necessary to find a winning strategy for a
player, on a configuration with a Dural-Core 1.8Ghz CPU, was 1 minute and 6 seconds. Running
on the same configuration, our ATL checker tool is able to find a winning strategy in about 4
seconds using MySql as a database server and 2 seconds when H2 was used.
By using a database-based technology in the core of the ATL model checker, our tool provides a
good foundation for further improvement of its performance and scalability.
In the actual stage of the development, experimental results are encouraging, showing that our
tool is able to handle large systems efficiently.
11. CONCLUSIONS
In this paper we built an ATL model checking tool, based on robust technologies (Java, .NET,
SQL) and well-known standards (XML, SOAP, HTTP). The implementation of the ATL model
checking algorithm is based on Java code generated by ANTLR using an original ATL grammar
and provides error-handling for eventual lexical/syntax errors in formula to be analysed. The main
contribution of this paper consists in implementation of ATL operators using Relational Algebra
expressions translated into SQL queries.
The C# implementation of the client part of our new tool (ATL Designer) allows an interactive
graphical specification of the ATL model as a directed multi-graph.
The server component of our tool (ATL Checker) was published as a Web service, exposing its
functionality through standard XML interfaces.
The ATL Designer, a ready to be deployed Web Service package for Tomcat 7.x and ATL API
Client libraries for Java and C# can be downloaded from http://use-it.ro.
Further investigation on improving performance will be done using in-memory databases (H2,
HSQLDB). Also, we are planning to approach time constraints [25] in our ATL model checker.
Because the SQL queries used in verification a composite ATL formula might consist of many
subqueries that can be run in parallel, we would start looking at using the horizontal scalability
features such as Parallel Pipelined Table Functions (PTF) provided by Oracle databases.
12. REFERENCES
[1] W. Van der Hoek, M. Wooldridge. “Cooperation, Knowledge, and Time: Alternating-time
Temporal Epistemic Logic and its Applications”. Studia Logica 75, Kluwer Academic
Publishers, pp. 125-157 2003.
[2] F. L. Cacovean. “Using CTL Model Checker for Verification of Domain Application Systems”,
in Proceedings of the 11th International Conference on EVOLUTIONARY COMPUTING (EC
'10), 13-15 Jun., Iasi, Romania, ISSN: 1790-2769, ISBN: 978-960-474-194-6, 2010, pp. 262-
267.
[3] R. Alur, T. A. Henzinger, O. Kupferman. “Alternating-time Temporal Logic”. Journal of the
ACM, vol. 49, pp. 672–713, 2002.
[4] M. Kacprzak, W. Penczek. “Fully symbolic Unbounded Model Checking for Alternating-time
Temporal Logic”. Journal Autonomous Agents and Multi-Agent System, Volume 11 Issue 1,
pp. 69 – 89, 2005.
[5] R.E. Bryant. “Graph-based algorithms for boolean function manipulation”. IEEE Transactions
on Computers, C-35(8), pp. 677-691, 1986.

Florin Stoica
[6] K.Y. Rozier. “Survey: Linear Temporal Logic Symbolic Model Checking”. Computer Science
Review, Volume 5 Issue 2, pp. 163-203, 2011.
[7] R. Alur, T.A. Henzinger, F.Y.C. Mang, S. Qadeer, S.K. Rajamani, S. Tasiran. “Mocha:
Modularity in Model Checking”, in Proceedings of the Tenth International Conference on
Computer-Aided Verification (CAV), Lecture Notes in Computer Science 1427, Springer,
1998, pp. 521-525.
[8] Lomuscio, F. Raimondi. “MCMAS: A model checker for multi-agent systems”, in
Proceedings of TACAS 06, volume 3920 of Lect. Notes in Computer Science, Springer-
Verlag, 2006, pp. 450-454.
[9] C. Eisner, D. Peled. “Comparing Symbolic and Explicit Model Checking of a Software
System”, in Proceedings SPIN Workshop on Model Checking of Software, volume 2318 of
LNCS, Volume 55, pp. 230-239, 2002.
[10] G. Holzmann. “The model checker SPIN”. IEEE Trans. on Software Engineering, vol. 23, pp.
279–295, 1997.
[11] F. Lerda, N. Sinha, M. Theobald. “Symbolic Model Checking of Software”. Electronic Notes
in Theoretical Computer Science, Volume 89, Issue 3, pp. 480–498, 2003.
[12] A.J. Hu. “Techniques for Efficient Formal Verification Using Binary Decision Diagrams”. PhD
thesis, Stanford University. Internet: http://i.stanford.edu/pub/cstr/reports/cs/tr/95/1561/CS-
TR-95-1561.pdf, 1995 [Mar. 29, 2016].
[13] B. Bingham, J. Bingham, F. M. De Paula, J. Erickson, G. Singh, M. Reitblatt. “Industrial
Strength Distributed Explicit State Model Checking”, in Proceedings of the 2010 Ninth
International Workshop on Parallel and Distributed Methods in Verification, and Second
International Workshop on High Performance Computational Systems Biology (PDMC-HIBI
'10). IEEE Computer Society, Washington, DC, USA, 2010, pp. 28-36.
[14] W. Jamroga, N. Bulling. “Comparing variants of strategic ability”, in Proceedings of the
Twenty-Second international joint conference on Artificial Intelligence - Volume One, 2011,
pp. 252-257.
[15] F. L. Stoica, M. F. Boian. “Algebraic approach to implementing an ATL model checker”.
Studia Univ. Babes Bolyai, Informatica, Cluj-Napoca, Romania. Volume LVII, Number 2, pp.
73–82, 2012.
[16] T. Parr. The Definitive ANTLR Reference. Pragmatic Bookshelf, Dallas Texas, ISBN 0-
9787392-5-6, 2007.
[17] W. Jamroga. “Easy Yet Hard: Model Checking Strategies of Agents”. Computational Logic in
Multi-Agent Systems. Lecture Notes in Computer Science, Volume 5405, Springer Berlin
Heidelberg, pp. 1-12, 2009.
[18] M. Herschel. “Introduction to Database Management Systems”. Internet:
https://www.lri.fr/~herschel/courses_ws1314/resources/05_relational_algebra.pdf , 2013
[Mar. 29, 2016].
[19] T. Rus, E.V. Wyk, T. Halverson. “Generating Model Checkers from Algebraic
Specifications”. Journal Formal Methods in System Design archive, Volume 20, Issue 3, pp.
249 – 284, 2002.
[20] J. Ebert. “A Versatile Data Structure for Edge-Oriented Graph Algorithms”. Communications
of the ACM, Volume 30 Number 6, pp. 513-519, 1987.

Florin Stoica
[21] M. Pistore, P. Traverso. “Planning as model checking for extended goals in non-
deterministic domains”, in Proceedings of IJCAI, 2001, pp. 479-486.
[22] H2 Database Engine, Internet: http://www.h2database.com/html/performance.html, 2014
[Mar. 29, 2016].
[23] D. Owen, T. Menzies. “Lurch: a Lightweight Alternative to Model Checking”, in Proc.
Software Engineering and Knowledge Engineering (SEKE), 2003, pp. 158-165.
[24] J. Ruan. “Reasoning about Time, Action and Knowledge in Multi-Agent Systems”. Ph.D.
Thesis, University of Liverpool. Internet: http://ac.jiruan.net/thesis/, 2008 [Mar. 29, 2016].
[25] F. L. Cacovean. “An Algebraic Specification for CTL with Time Constraints”, in Proc. First
International Conference on Modelling and Development of Intelligent Systems, Oct. 22-25,
Sibiu, Romania, ISSN 2067 – 3965, 2009, pp. 46-55.

Scalability in Model Checking through Relational Databases

More Related Content

What's hot (15)

Viewers also liked (19)

Similar to Scalability in Model Checking through Relational Databases (20)

Recently uploaded (20)

Scalability in Model Checking through Relational Databases