Module checking

Orna Kupferman*, Moshe Y. Vardi, Pierre Wolper

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

130 Scopus citations


In computer system design, we distinguish between closed and open systems. A closed system is a system whose behavior is completely deter mined by the state of the system. An open system is a system that interacts with its environment and whose behavior depends on this interaction. The ability of temporal logics to describe an ongoing interaction of a reactive program with its environment makes them particularly appropriate for the specification of open systems. Nevertheless, model-checking algorithms used for the verification of closed systems are not appropriate for the verification of open systems. Correct model checking of open systems should check the system with respect to arbitrary environments and should take into account uncertainty regarding the environment. This is not the case with current model-checking algorithms and tools. In this paper we introduce and examine the problem of model checking of open systems (module checking, for short). We show that while module checking and model checking coincide for the linear-time paradigm, module checking is much harder than model checking for the branching-time paradigm. We prove that the problem of module checking is EXPTIME-complete for specifications in CTL and 2EXPTIME-complete for specifications in CTL*. This bad news is also carried over when we consider the program-complexity of module checking. As good news, we show that for the commonly-used fragment of CTL (universal, possibly, and always possibly properties), current model-checking tools do work correctly, or can be easily adjusted to work correctly, with respect to both closed and open systems.

Original languageAmerican English
Pages (from-to)322-344
Number of pages23
JournalInformation and Computation
Issue number2
StatePublished - 29 Jan 2001

Bibliographical note

Funding Information:
1URL: http: torna. 2URL: http: tvardi. Supported in part by NSF Grants CCR-9628400, CCR-9700061, and CCR-9988322, and by a grant from the Intel Corporation. 3URL: http: tpw. The work of this author was funded by an ‘‘Actions de recherche concertees’’ grant of the ‘‘Direction generale de l’Enseignement non obligatoire et de la Recherche Scientifique Departement de l’Education de la Recherche et de la Formation Communaute francaise de Belgique.’’


Dive into the research topics of 'Module checking'. Together they form a unique fingerprint.

Cite this