Model Checking Strategies from Synthesis Over Finite Traces
This provides the first evidence to prefer terminating transducers in LTLf synthesis for more feasible verification, addressing a verification bottleneck in reactive synthesis.
The paper tackles the problem of verifying strategies generated by LTLf synthesis tools by introducing LTLf model checking, showing that model checking non-terminating transducers is EXPSPACE-complete, while for terminating transducers it is PSPACE-complete, making the latter exponentially harder.
The innovations in reactive synthesis from {\em Linear Temporal Logics over finite traces} (LTLf) will be amplified by the ability to verify the correctness of the strategies generated by LTLf synthesis tools. This motivates our work on {\em LTLf model checking}. LTLf model checking, however, is not straightforward. The strategies generated by LTLf synthesis may be represented using {\em terminating} transducers or {\em non-terminating} transducers where executions are of finite-but-unbounded length or infinite length, respectively. For synthesis, there is no evidence that one type of transducer is better than the other since they both demonstrate the same complexity and similar algorithms. In this work, we show that for model checking, the two types of transducers are fundamentally different. Our central result is that LTLf model checking of non-terminating transducers is \emph{exponentially harder} than that of terminating transducers. We show that the problems are EXPSPACE-complete and PSPACE-complete, respectively. Hence, considering the feasibility of verification, LTLf synthesis tools should synthesize terminating transducers. This is, to the best of our knowledge, the \emph{first} evidence to use one transducer over the other in LTLf synthesis.