![](bg2.png)
to check whether a system satisfies a postulated prop-
erty, we only need to check if the postulated prop-
erty is implied by the aforementioned strongest sys-
tem property. This in itself can be cast as a QE prob-
lem. Our QE based framework can derive the above
strongest system property automatically as we show
it later in the next section as part of review of our pre-
vious work.
This paper further extends our QE-based property
composition to the case of time-dependent or tempo-
ral properties, which can depend on a (finite) history
of input/output variables of a system and its compo-
nents. We show that the composed property may in-
volve a longer history, but no more than the cumu-
lative histories of all its components. Accordingly,
we introduce the notion of property order, deriva-
tion of system order, and the composition of given
properties along with their time-shifted replicas to in-
fer the strongest system property. We have imple-
mented our QE-based compositional verification ap-
proach in a prototype tool, ReLIC (Reduced Logic
Inference for Composition), based on the integra-
tion of Redlog (red, 2015) with AGREE (AGR, 2012;
Gacek et al., 2015; Stewart et al., 2017)—the for-
mer supports QE, while the latter supports descrip-
tion of a system and its components, their connec-
tivity, and properties in the modeling framework of
AADL (Feiler et al., 2006). Our integration uses only
the front-end of AGREE for specifying system architec-
ture/connectivity, components, and their properties in
AADL and AGREE annex, and also for reporting the
result of property composition to the user.
2 QE-BASED COMPOSITIONAL
VERIFICATION
Our QE-based compositional reasoning approach is
based upon introducing the notion of the “strongest
system property”, derived from the given component-
level properties. Consider a system S composed of
N components. Let X := {x
1
, . . . , x
n
} be the set of
all variables in S, X
int
:= {x
1
, . . . , x
m
} ⊆ X(m ≤ n),
be the set of internal variables, X
sys
:= X \ X
int
=
{x
m+1
, . . . , x
n
} be the set of external variables (namely,
the inputs and outputs of S), and C := {(x
p
, x
q
) | x
p
and x
q
are variables of connected ports in S} be
the set of connectivity relation among component in-
put/output variables. Suppose the i
th
component’s
property is described by an assume-guarantee style
contract (A
i
, G
i
) in first-order logic, meaning A
i
⇒ G
i
holds. We define the strongest system property and
present a result that provides a method to derive it.
The proof can be found in (Ren et al., 2016).
Definition 2.1. The strongest system property is the
system property that implies any other system proper-
ties established upon the given component properties
and the connectivity relation.
Theorem 2.1. The strongest system property of a
system S established upon its component contracts
{(A
i
, G
i
)|1 ≤ i ≤ N}, component connectivity relation
C = {(x
p
, x
q
)|x
p
and x
q
are connected ports in S},
and internal variables {x
i
, . . . , x
m
}, is given by,
∃x
1
. . . ∃x
m
N
^
i=1
(A
i
⇒ G
i
) ∧
^
(x
p
,x
q
)∈C
(x
p
= x
q
)
. (1)
Remark. Through (1) in Theorem 2.1, we have shown
that property composition, in a component-based
compositional framework, is an instance of a QE
problem. Based on this insight, we put forth a two-
step QE-based compositional verification procedure.
The first step is to generate the strongest system
property, through a QE process of (1), applied to
component contracts and connectivity relation. The
strongest system property upon QE, denoted φ
sys
,
contains only the system-level input/output variables
(as the internal variables get existentially quantified
and eliminated upon QE). The second step is to check
if φ
sys
implies any postulated system property φ
postl
that also contains only system-level input/output vari-
ables. For this we can employ yet another instance
of QE, this time over the external variables of S:
∀x
m+1
. . . ∀x
n
(φ
sys
⇒ φ
postl
) to reduce through QE ei-
ther to true or f alse.
3 RELIC FOR TIME-DEPENDENT
PROPERTY COMPOSITION
Complex systems often exhibit time-dependent fea-
tures through components such as PID controller,
delay, counter, or state-machine. In such cases, a
component property can be a constraint over its in-
put/internal/output variables at different time-steps.
Let x(k) denote the variable at the k
th
time step with
step 0 being the initial step, and for s, t ∈ Z
≥0
, s ≤ t :
X[s,t] := {x(k)|x ∈ X, k ∈ [s,t]} be the variables over
the time interval [s,t].
Example 3.1. Consider a cascade of two identi-
cal components with input/output pairs (u, x) and
(x, y), and with properties x(k) > u(k-1) and y(k) >
x(k-1) respectively, whereas the common variable x
represents the cascade connection. Then one can
see that composed system satisfies y(k) > u(k-2).
But a standard quantifier elimination as in (1) can-
not be employed to obtain the above final for-
mula since the term u(k-2) is not even present
“ReLIC: Reduced Logic Inference for Composition” for Quantifier Elimination based Compositional Reasoning
535