The Complexity of Coverage

The Complexit y of Co v erage ∗ Krishnendu Chatterjee § Luca de Alfaro § Rupak Ma jumdar † § CE, Univ ersit y of California, San ta Cruz, USA † CS, Univ ersity of California, Los Angeles, USA { c krish,lu ca } @soe.ucs c.edu, rupak@cs. ucla.edu Abstract W e study the problem of generating a tes t sequence that achiev es maxima l cov era ge for a reactive system under tes t. W e formulate the pr oblem as a rep ea ted game b etw een the tester and the system, where the s ystem state space is partitioned acc o rding to some cov er age cr iterion a nd the ob jectiv e of the tester is to maximize the set of pa r titions (or cov er a ge goals) visited during the game. W e show the complexity of the maximal coverage pro blem fo r non-deterministic systems is P SP ACE-complete, but is NP-co mplete for deterministic systems. F or the sp ecial case of no n-deterministic systems with a re-initializing “reset” action, which r epresent r unning a new test input on a re-initialized system, we show that the complex ity is a g ain co-NP -complete. Our pr o of tec hnique for reset games uses rando mized testing strategies that cir c um ven t the exp onentially large memory r equirement in the deterministic case . 1 In tro duction Co de co ve rage is a common metric in soft ware and hardware testing that measures the d egree to whic h an implemen tation has b een tested with r esp ect to some criterion. In its simplest f orm, one starts with a mo del of the program, and a p artition of th e b eha viors of the mo del into c over age go als [3]. A test is a sequence of inputs that determines a b ehavio r of the program. The aim of testing is to exp lore as man y co v erage goals as p ossible, ideally as qu ic kly as p ossible. In this pap e r, w e give complexit y r esu lts for several co v erage p r oblems. The p roblems are very b asic in nature: they consist in d eciding whether a certain lev el of co verage can b e attained in a giv en system. It is th us somewhat s u rprisin g that the problems h av e not b e en considered pr eviously in the literature. Finite-state directed graphs h a ve b een used as p r ogram mo d els for test generation of reactiv e systems for a long time (see [15, 6] for s u rv eys). A co verage goal is a partition of the states of the graph, and a test is a sequence of lab els that determine a path in th e graph. The maximal co verage test generation problem is to hit as man y p artitions as p o ssible using a minimum n um b er of tests. In th e sp ecia l case the partitions coincide with the states, the maximal co v erage problem reduces to the Chinese p ostman pr oblem f or whic h there are efficien t (p olynomial time) algorithms [7]. In this pap er, we sho w that the m aximal co verag e pr oblem b ecome s NP-complete for graphs w ith general partitions. W e also distinguish b et w een system c omplexity (the complexit y of the p r oblem in terms of the size of the graph) and the c over age c omplexity (the complexit y of the problem in terms of ∗ This researc h w as supp ored in part by the NSF grants CCR-0132780 and CNS-0720884. the n um b er of co v erage goals). Th en, the problem is NLOGSP ACE in the size of th e graph (bu t that algorithm uses space p olynomial in the num b er of prop osit ions). W e consider the sp e cial case where the graph has a sp e cial “reset” action that tak es it b ack to the initial state. This corresp onds in a testing setting to the case wh ere the s y s tem can b e re- initialized b efo re runnin g a test. In this case, the maximal co v erage p roblem remains p olynomial, ev en with general partitions. Directed graphs f orm a conv enien t representat ion for deterministic systems, in wh ic h all the c hoices are un der the con trol of the tester. T esting of non-deterministic systems in whic h certain actions are con trollable (under the con trol of the tester) and other actions are u n con tr ollable lead to game gr aphs [14]. A game graph is a directed lab eled graph wh ere the n o des are partitioned in to tester-no d es a nd system-nodes, and while the te ster c an c ho ose the next input at a tester no de, the sy s tem non-deterministically c h o o ses th e next state at a system no de. Then, the test generation p roblem is to generate a test set that achiev es maximal co verag e n o matter ho w th e system mo ve s. F or general game graph s, w e show the complexity of the maximal co verag e p roblem is PSP A C E-complete. Ho w ev er, there is an algorithm th at ru ns in time linear in the size of the game graph b u t exp o nen tial in the num b e r of co verage goals. Again, the r e-initializa bilit y assu mption reduces the complexit y of co verag e: in case there is a re-initializatio n strategy of the tester from an y system state, the maximal cov erage p roblem for games is co-NP-complete . D ually , we sh o w that the problem of w hether it is p o ssible to win a safety game wh ile visiting few er than a sp e cified n um b er of partitions is NP-complete. Finally , we consider the co v erage problem in b ounded time, consisting in chec king whether a sp ecified n um b er of partitions can b e visited in a pr e-established num b er of steps. W e sho w that the problem is NP-complete for graphs, and is PSP A CE-complete for game graphs. Optimization problems arising out of test generation hav e b een stu died b efore in the con text of b oth graph s and games [1, 10, 14, 5]. Ho wev er, to the b est of our k n o w ledge, the complexities of the co v erage problems studied here ha v e escap ed atten tion so f ar. While we develo p our theo ry for t he fin ite-state, d iscrete case, w e ca n der ive similar results for more general mo dels, suc h as those incorp orating incomplete information (the tester can only observ e part of the system state) or timing. F or timed systems mo deled as timed au tomata, the maximal co v erage p roblem is PS P A CE-complete. F or timed games as w ell as for (finite state) game graphs with incomplete information, the maximal co v erage p roblem b ecomes E XPT IME-complete. 2 Definitions In this section w e defi ne lab ele d gr aphs and lab ele d g ames , and then define the tw o decision problems of co verage , namely , maximal c over age problem and c over age with b ounde d time pr oblem. W e start with d efinition of graphs and games. Definition 1 ( L ab eled graphs) A lab eled graph G = (( V , E ) , v in , AP , L ) c onsists of the fol lowing c omp onent: 1. A finite dir e cte d gr aph with ve rtex set V and e dge set E ; 2. the initial vertex v in ; 3. a finite set of atomic pr op ositions AP ; 2 4. a lab eling function L that assigns to e ach ve rtex v the set L ( v ) of atomic pr op ositions true at s . F or te chnic al c onvenienc e we wil l assume that for al l vertic es v ∈ V , ther e exists u ∈ V su c h that ( v , u ) ∈ E , i.e., e ach vertex has at le ast one out-going e dge. P aths in graphs and reac habilit y . Give n a lab e led graph G , a p ath ω in G is a infi nite sequence of vertic es h v 0 , v 1 , v 2 . . . i starting from the in itial v ertex v in (i.e., v 0 = v in ) such that for all i ≥ 0 w e ha ve ( v i , v i +1 ) ∈ E . A vertex v i is reac hable from v in if there is a p ath ω = h v 0 , v 1 , v 2 . . . i in G and j ≥ 0 su c h that the v ertex v j in ω is the ve rtex v i . Definition 2 ( L ab eled game graphs) A lab eled game graph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ) c onsists of the c omp onents of a lab ele d gr aph along with a p artition of the finite vertex set V into ( V 1 , V 2 ) . The vertic es in V 1 ar e player 1 vertic es wher e player 1 cho oses outgoing e dges, and analo gously, the ve rtic es in V 2 ar e player 2 ve rtic es wher e player 2 cho oses outgoing e dges. A gain for te chnic al c onvenienc e we wil l assume that for al l vertic es v ∈ V , ther e exists u ∈ V such that ( v , u ) ∈ E , i.e., e ach vertex has at le ast one out-going e dge. Pla ys and strategies in games. A play in a game graph is a path in th e u nderlying graph of th e game. A str ategy for a play er in a game is a r ecip e to sp ecify h o w to extend the prefix of a p la y . F ormally , a strategy π 1 for p la yer 1 is a fu nction π 1 : V ∗ · V 1 → V that take s a finite sequence of v ertices w · v ending in a pla ye r 1 v ertex v , where w ∈ V ∗ and v ∈ V 1 , represent ing th e h istory of the pla y so f ar, an d sp ecifies th e next vertex π 1 ( w · v ) c h o osing an out-going edge (i.e., ( v , π 1 ( w · v )) ∈ E . A strategy π 2 : V ∗ · V 2 → V is defined analogously . W e d enote b y Π 1 and Π 2 the set of all strategies for pla yer 1 and pla ye r 2, resp ec tiv ely . Given strategies π 1 and π 2 for pla y er 1 and p la yer 2, there is a uniqu e pla y (or a path) ω ( v in , π 1 , π 2 ) = h v 0 , v 1 , v 2 , . . . suc h that (a) v 0 = v in ; (b) for all i ≥ 0, if v i ∈ V 1 , then π 1 ( v 0 · v 1 . . . · v i ) = v i +1 ; and if v i ∈ V 2 , then π 2 ( v 0 · v 1 . . . · v i ) = v i +1 . Con trollably recurren t graphs and games. Along with general lab ele d graphs and games, w e will also consider graphs and games that are c ontr ol lably r e curr ent . A lab el ed graph G is c ontr ol lably r e curr ent if for ev ery vertex v i that is reac hab le from v in , there is a path starting from v i that reac hes v in . A lab el ed game graph G is c ontr ol lably r e curr ent if f or ev er y ve rtex v i that is reac hable f rom v in in the underlying graph, ther e is a strategy π 1 for play er 1 su ch that against all play er 2 strategies π 2 , the p ath starting from v i giv en the strategies π 1 and π 2 reac hes v in . Con trollable recurrence mo dels the natural requirement that systems und er test are r e-i ni tializable , that is, from an y reac h able state of the system, there is alw ays a wa y to brin g the system bac k to its initial state no matter how the system b eha v es. The ma ximal cov erage problem. The maximal c over age pr oblem asks w hether at least m differen t prop ositions can b e visited. W e no w define the problem formally for graphs and games. Giv en a path ω = h v 0 , v 1 , v 2 , . . . i , let L ( ω ) = S i ≥ 0 L ( v i ) b e the set of prop o sitions that app ear in ω . Giv en a lab el ed graph G and 0 ≤ m ≤ | AP | , the maximal co ve rage p r oblem asks whether there is path ω suc h th at |L ( ω ) | ≥ m . Give n a lab eled game graph G and 0 ≤ m ≤ | AP | , the maximal co ve rage p roblem asks wh ether pla yer 1 can ensur e that at least m prop ositi ons are visited, i.e., whether sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 )) | ≥ m. 3 It ma y b e noted that su p π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 )) | ≥ m iff there exists a play er 1 strategy π ∗ 1 suc h that for all play er 2 strategies π ∗ 2 w e ha v e |L ( ω ( v in , π ∗ 1 , π ∗ 2 )) | ≥ m . The maximal state c over age problem is the sp ecial case of the maximal co v erage p roblem where AP = V and for eac h v ∈ V w e ha v e L ( v ) = { v } . That is, eac h state h as its o w n lab el, and there are | V | singleton partitions. The co v erage with b ounded time problem. The c over age with b ounde d time pr oblem asks whether at least m different prop ositions can b e visited within k -st eps. W e no w define the problem formally f or graphs and games. Give n a p ath ω = h v 0 , v 1 , v 2 , . . . i and k ≥ 0, we d enote by ω ↾ k th e prefix of the p ath of length k + 1, i.e., ω ↾ k = h v 0 , v 1 , . . . , v k i . Giv en a path ω = h v 0 , v 1 , v 2 , . . . i and k ≥ 0, we denote b y L ( ω ↾ k ) = S 0 ≤ i ≤ k L ( v i ). Give n a lab eled graph G and 0 ≤ m ≤ | AP | and k ≥ 0, the co v erage with b ound ed time p roblem asks whether there is path ω such that |L ( ω ↾ k ) | ≥ m . Giv en a lab eled game graph G and 0 ≤ m ≤ | A P | , the maximal co ve rage problem asks whether pla yer 1 can ensure that at least m prop ositions are visited within k -steps, i.e., wh ether sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 ) ↾ k ) | ≥ m. It ma y b e noted that sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 ) ↾ k ) | ≥ m iff there exists a pla y er 1 s trategy π ∗ 1 suc h that for all play er 2 strategies π ∗ 2 w e ha v e |L ( ω ( v in , π ∗ 1 , π ∗ 2 ) ↾ k ) | ≥ m . System-tester game. A system S = ( Q, Σ , q in , ∆ , A P , L ) consists of the follo wing comp onents: • A finite set Q of states with the starting state q in . • A finite alphab et Σ of input letters. • A transition r elation ∆ ⊆ Q × Σ × Q . • A finite set of atomic prop osit ions AP and a lab eling function L that assigns to eac h state q the set of atomic p rop ositions true at q . W e consider total s ystems suc h that for all q ∈ Q and σ ∈ Σ, there exists q ′ ∈ Q suc h that ( q , σ, q ′ ) ∈ ∆. A system is deterministic if f or all q ∈ Q and σ ∈ Σ, there exists exactly one q ′ suc h that ( q , σ, q ′ ) ∈ ∆. Th e tester selects an input letter at ev ery stage and the system resolv es the non-determinism in transition to c h o ose the successor state. The goal of the tester is to visit as man y different prop ositions as p ossible. T he int eraction b et ween the s ystem and the tester can b e reduced to a lab eled game graph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ′ ) as follo ws: • V ertic es and p artition. V = Q ∪ Q × Σ; V 1 = Q and V 2 = Q × Σ; and v in = q in . • Edges. E = { ( q , ( q , σ )) | q ∈ Q, σ ∈ Σ } ∪ { (( q , σ ) , q ′ ) | ( q , σ, q ′ ) ∈ ∆ } . • L ab eling. L ′ ( q ) = L ( q ) and L ′ (( q , σ )) = L ′ ( q ). The co v erage question for game b etw een tester and system can b e answered by answ ering the question in the game graph. Also observe th at if the system is d eterministic, then f or all pla yer 2 v ertices in the game graph, ther e is exactly one out-going edge, and hence the game can b e reduced to a lab eled graph . In this pap e r we will p resen t all the resu lts f or th e lab eled graph and game mo del. All the up p er b ounds we pro vide follo w also f or the game b et w een tester and system. All the lo we r b o unds we presen t can also b e easily adapted to the mo del of the game b et w een system and tester. 4 3 The Complexit y of Maximal Co v erage Problems In this section w e study th e complexit y of the maximal co verage pr oblem. I n subsection 3.1 w e study the complexit y for graph s, and in subsection 3.2 we study the complexit y for game graphs . 3.1 Graphs W e fi rst show that th e maximal co v erage problem for lab eled graphs is NP-complete. Theorem 1 The maximal c over age pr oblem for lab ele d gr aphs is NP- c omplete. Pro of. The p ro of consists of t w o p arts. W e present them b elo w. 1. In NP. T he maximal co v erage problem is in NP can b e prov ed as follo ws . Giv en a lab el ed game graph G , let n = | V | . W e sho w fir st that if there is a path ω in G s uc h that |L ( ω ) | ≥ m , then there is a path ω ′ in G suc h th at |L ( ω ′ ↾ m · n ) | ≥ m . If ω visits at least m pr op ositions, and there is a cycle in ω that d o es not v isit a new p rop osition that is already visited in th e prefix, then the cycle segment can b e remo ved from ω and still the resulting path visits m prop ositions. Hence if the answ er to the maximal co verag e problem is “Y es”, th en there is a path ω ′ of length at m ost m · n that is a w itness to the “Y es” ans w er. Since m ≤ | AP | , it follo ws th at the problem is in NP . 2. NP-har dness. No w we sho w that the maximal co verage problem is NP-hard, and w e presen t a reduction from the SA T-problem. Consider a S A T f ormula Φ, and let X = { x 1 , x 2 , . . . , x n } b e the set of v ariables and C 1 , C 2 , . . . , C m b e the set of clauses. F or a v ariable x j ∈ X , let (a) t ( x j ) = { ℓ | x j ∈ C ℓ } b e the set of ind ices of the set of clauses C ℓ that is satisfied if x j is set to b e tru e; and (b) f ( x j ) = { ℓ | x j ∈ C ℓ } b e the s et of indices of the set of clauses C ℓ that is satisfied if x j is set to b e false. Without loss of generalit y , we assu me that t ( x j ) and f ( x j ) are non-emp t y for all 1 ≤ j ≤ n (this is b ec ause, for example, if f ( x j ) = ∅ , then w e ca n set x j to b e true and r educe the problem wh ere the v ariable x j is not p resen t). F or a fin ite set F ⊆ N of natural num b ers, let max( F ) and m in( F ) d enote the maxim u m and minimum num b er of F , resp ec tiv ely , f or an elemen t f ∈ F th at is n ot the maximal elemen t let next ( f , F ) denote the next h ighest element to f that b elongs to F ; i.e., (a) next ( f , F ) ∈ F ; (b) f < next ( f , F ); and (c) if j ∈ F and f < j , then next ( f , F ) ≤ j . W e constru ct a lab ele d game graph G Φ as follo w s. W e first p resen t an in tuitiv e description: there are states lab eled x 1 , x 2 , . . . , x n , x n +1 , and all of them are lab eled b y a single prop o sition. Th e state x n +1 is an abs orbing state (state with a self-lo op only), and all other x i state has tw o successors. T h e starting is x 1 . In ev ery state x i giv en th e right c hoice we visit in a line a set of states that are lab e led b y clauses that are tr u e if x i is true; and given the left c hoice we visit in a line a set of states th at are lab eled b y clauses that are true if x i is false; and then we mo ve to state x i +1 . W e now formally describ e ev ery comp o nen t of the lab eled graph G Φ = h ( V Φ , E Φ ) , v Φ in , AP Φ , L Φ i . 5 x j, next ( i, f ( x j )) x 1 x j x j +1 x n +1 x j,i x j, min( f ( x j )) x j, max( f ( x j )) x j, min( t ( x j )) x j,i x j, next ( i, t ( x j )) x j, max( t ( x j )) Figure 1: The NP-hardness red uction in picture. (a) The set of v er tices is V Φ = { x i | 1 ≤ i ≤ n + 1 } ∪ { x j,i | 1 ≤ j ≤ n, i ∈ t ( x j ) } ∪ { x j,i | 1 ≤ j ≤ n, i ∈ f ( x j ) } . There is a vertex for ev ery v ariable, and a vertex x n +1 . There is a v ertex x j,i iff C i ∈ t ( x j ), and there is a v er tex x j,i iff C i ∈ f ( x j ), (b) The set of edges is E Φ = { ( x n +1 , x n +1 ) } ∪ { ( x j, max( t ( x j )) , x j +1 ) , ( x j, max( f ( x j )) , x j +1 ) | 1 ≤ j ≤ n } ∪ { ( x j , x j, min( t ( x j )) ) , ( x j , x j, min( f ( x j )) ) | 1 ≤ j ≤ n } ∪ { ( x j,i , x j, next ( i, t ( x j )) | 1 ≤ j ≤ n, i < max( t ( x j )) } ∪ { ( x j,i , x j, f ( i, t ( x j )) | 1 ≤ j ≤ n, i < max( f ( x j )) } . W e no w explain the r ole if e ac h set of edges. The first edge is the self-lo op at x n +1 . The seco nd set of edges sp ecifies that from x j, max( t ( x j )) the next ve rtex is x j +1 and 6 similarly , from x j, max( f ( x j )) the n ext v ertex is again x j +1 . The third s et of edges sp ecifies that from x j there are t w o successors that are x j,i and x j,i ′ where i = min( t ( x j )) and i ′ = min( f ( x j )). The final sets of edges s p ecifies (a) to mov e in a line from x j, min( t ( x j )) to visit the clauses that are satisfied by setting x j as tru e, and (b) to mo ve in a lin e from x j, f ( t ( x j )) to visit the clauses that are satisfied b y setting x j as false. Fig 1 giv es a p ictorial view of the reduction. (c) The in itial v ertex is v Φ in = x 1 . (d) AP Φ = { C 1 , C 2 , . . . , C m , X } , i.e., there is a p rop osition C i for eac h clause C i and there is a prop o sition X for all v ariables; (e) L Φ ( x j ) = X ; i.e., eve ry v ariable sta te is labeled b y th e prop osition X ; and w e ha v e L Φ ( x j,i ) = C i and L Φ ( x j,i ) = C i , i.e., eac h state x j,i and x j,i is lab el ed by the corre- sp ond ing clause that is indexes. The num b e r of states in G Φ is O ( n · m ), and the r ed uction is p o lynomial in Φ. In this graph the maximal num b e r of prop ositi ons visited is exactly equal to th e maximal num b er of satisfiable clauses plus 1 (since along with th e prop o sitions for clauses the p r op osition X for all v ariables is alw a ys visited). Th e pro of of the ab o ve claim is as follo ws. Giv en a path ω in G Φ w e construct an assignment A for the v ariables as follo ws: if th e c hoice at a v ertex x j is x j, min( t ( x j )) , then w e set x j as true in A , else we set x j as false. Hence if a path in G Φ visits a set P ⊆ AP Φ of r prop ositions, then the assignment A s atisfies r − 1 clauses (namely , P \ { X } ). Con versely , giv en an assignment A of the v ariables, we constru ct a path ω A in G Φ as follo ws: if x j is true in the assignmen t A , then the path ω A c ho o ses x j, min( t ( x j )) at x j , otherwise, it c h o oses x j, min( f ( x j )) at x j . If A satisfies a set Q of r − 1 clauses, th en ω A visits r + 1 prop ositions (namely , th e set Q ∪ { X } of prop ositions). Hence Φ is satisfiable iff the answ er to the maximal co v erage problem with inp ut G Φ and m + 1 is tr u e. The d esired r esult follo ws. Hardness of appro ximation. W e n ote that from the pro of Theorem 1 it follo ws that the MAX- SA T problem (i.e., computing the maximal num b er of clauses satisfiable for a SA T form ula) can b e reduced to the problem of computing the exact num b er for the maximal co verage pr oblem. F rom hardness of approximat ion of the MAX-SA T problem [4], it follo w s that th e m aximal c o verag e problem for lab eled graphs is h ard to appro ximate. Theorem 2 The maximal c over age pr oblem for lab ele d gr aphs that ar e c ontr ol l ably r e curr ent c an b e de cide d in PTIM E . Pro of. T o solv e the maximal co v erage p roblem for lab eled graphs th at are con trollably recurrent, w e compu te the maximal s trongly connected comp on ent C that v in b elongs to. Since th e graph is con trollably recurrent, all states that are r eac hable from v in b elong to C . Hence the answ er to the maximal cov erage pr oblem is “Y es” iff | S v ∈ C L ( v ) | ≥ m . Th e result follo w s . 3.2 Game gr aphs Theorem 3 The maximal c over age pr oblem for lab ele d game gr aphs is P SP ACE-c omplete. 7 Pro of. The p ro of consists of t w o p arts. W e present them b elo w. 1. In P SP ACE. W e argu e that the maximal co verag e problem for lab eled game graph can b e reduced to the co v erage in b oun ded time pr oblem. Th e r eason is as follo ws: in a la b eled game graph with n ve rtices, if pla y er 1 can visit m prop o sitions, then p la yer 1 can visit m prop ositions within at most m · n steps; because p la yer 1 can alw a ys pla y a strategy from the current p osition that visits a new pr op osition that is not visited and neve r needs to go through a cycle without visiting a new prop osit ion unless the maximal co v erage is ac hiev ed. Hence it follo ws that the maximal co verage problems for games reduces to the co v erage in b ound ed time problem. The PS P A CE inclusion will follo w from the result of Theorem 7 where w e sho w that the co verag e in b ound ed time problem is in PSP A CE. 2. PSP ACE-har dness. Th e maximal cov erage p r oblem for game graphs is PS P A CE-complete, ev en if the u nderlying graph is s trongly connected. The pro o f is a reduction fr om QBF (truth of quanti fied b oolean form u las) that is kno wn to b e PSP A CE-complete [12], and it is a m o dification of the reduction of Th eorem 1. Consider a QBF formula Φ = ∃ x 1 . ∀ x 2 . ∃ x 3 . . . ∃ x n .C 1 ∧ C 2 ∧ . . . C m ; defined on the set X = { x 1 , x 2 , . . . , x n } of v ariables, and C 1 , C 2 , . . . , C m are the clauses of the formula. W e apply the redu ction of T heorem 1 w ith the follo wing mo dification to obtain the lab e led game graph G Φ : the partition ( V Φ 1 , V Φ 2 ) of V Φ is as follo ws. F or a v ariable x j if the quant ifier b e fore x j is existen tial, then x j ∈ V Φ 1 (i.e., for existen tially qu an tified v ariable, pla yer 1 c ho oses th e out-going edges denoting whether to set th e v ariable true or false); and for a v ariable x j if th e quanti fier b efore x j is u niv ersal, then x j ∈ V Φ 2 (i.e., for u niv ersally quan tified v ariable, the opp o sing pla y er 2 chooses th e out-going ed ges denoting whether to set th e v ariable tru e or false). The state x n +1 is a p la yer 2 v ertex, and all other v ertex has an single out-going ed ges and can b e p la yer 1 state. Giv en this game graph we ha ve Φ is true iff pla y er 1 can ensur e that all the prop o sitions can b e visited in G Φ . F orm ally , let Π Φ 1 and Π Φ 2 denote the s et of all strategies for pla y er 1 and pla y er 2, resp ec tiv ely , in G Φ . Then Φ is true iff sup π 1 ∈ Π Φ 1 inf π 2 ∈ Π Φ 2 |L Φ ( ω ( x 1 , π 1 , π 2 )) | ≥ m + 1. Observe th at since x n +1 is a pla y er 2 state if w e add an edge from x n +1 to x 1 , p la yer 2 will neve r c ho o se the edge x n +1 to x 1 (since the ob jec tiv e for play er 2 is to minimize the co v erage). Ho w ev er, adding th e edge from x n +1 to x 1 mak es the under lyin g graph strongly connected (i.e., the und erlying graph of the game graph b ecomes controll ably r ecurrent; but pla y er 1 do es n ot ha v e a strategy to ensu re th at x 1 is reac hed, so the game is not con trollably recurrent). The d esired r esult follo ws. Complexit y of maximal co v erage in con trollably recurren t games. W e will now con- sider maximal co verage in controlla bly recurr en t games. Ou r analysis will u se fi xing memoryless r andomize d strategy for pla yer 1, and fixing a memoryless randomized strategy in lab eled game graph we get a lab eled Mark o v decision p ro cess (MDP). A lab eled MDP consists of the same comp onent s a s a lab eled game graph, and f or v ertices in V 1 (whic h are randomized ve rtices in the MDP) the successors are c hosen u niformly at random (i.e., p la yer 1 d o es not ha ve a pr op er c hoice of the su ccessor but chooses all of them uniformly at random). Giv en a lab eled game graph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ) we denote by Unif ( G ) the MDP in terp retation of G where p la yer 1 8 v ertices chooses all successors uniformly at ran d om. An end c omp onent in Unif ( G ) is a set U of v ertices suc h that (i) U is s tr ongly connected and (ii) U is play er 1 close d , i.e., for all u ∈ U ∩ V 1 , for all u ′ suc h that ( u, u ′ ) ∈ E w e ha ve u ′ ∈ U (in other w ords, for all pla y er 1 vertic es, all the out-going ed ges are con tained in U ). Lemma 1 L et G b e a lab ele d game gr aph and let Unif ( G ) b e the MDP interpr etation of G . Then the fol lowing assertions hold. 1. L et U b e an end-c omp onent in Unif ( G ) with v in ∈ U . Then sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 )) | ≤ | S u ∈ U L ( u ) | . 2. Ther e exists an end-c omp onent U ∈ U nif ( G ) with v in ∈ U such that | S u ∈ U L ( u ) | ≤ sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 )) | . Pro of. W e p ro v e b oth the claims b elo w . 1. If U is an end-comp o nen t in Unif ( G ), then consider a memoryless strategy π ∗ 2 for play er 2, that for all vertic es u ∈ U ∩ V 2 , c ho oses a s uccessor u ′ ∈ U (such a successor exists s ince U is strongly connected). Since U is pla yer 1 closed (i.e., f or all play er 1 out-going edges from U , the end-p oint is in U ), it follo ws that f or all strategies of pla yer 1 , giv en the strategy π ∗ 2 for pla yer 2, the v ertices visited in a play is con tained in U . The desired result follo ws. 2. An optimal str ategy π ∗ 1 for p la yer 1 in G is as follo ws: (a) Let Z 0 = { v ∈ V | L ( v ) = L ( v in ) } and i = 0; (b) A t iteration i , let Z i represent s the set of prop ositions already visited. A t iteration i , pla yer 1 pla ys a strategy to reac h a state in V \ Z i (if suc h a strategy exists), and then reac hes bac k v in (a strategy to reac h b ac k v in alw ays exists since the game is control lably recurrent) . (c) If a new prop osition p i is visited at iteration i , then let Z i +1 = Z i ∪ { v ∈ V | L ( v ) = p i } . Goto step (b) for i + 1 iteration with Z i +1 . If no state in V \ Z i can b e reac h ed, then stop. The strategy π ∗ 1 is optimal, and let the ab o ve iteration stop w ith Z i = Z ∗ . Let X = V \ Z ∗ , and let X ∗ b e the set of v ertices such that p la yer 1 can r eac h X . Let U ∗ = V \ X ∗ . Then v in ∈ U ∗ and pla y er 2 can ensu re that from v in the game c an b e confined to U ∗ . Hence the f ollo wing conditions must hold: (a) for all u ∈ U ∗ ∩ V 2 , there exists u ′ ∈ U ∗ suc h that ( u, u ′ ) ∈ E ; and (b) for all u ∈ U ∗ ∩ V 1 , for all u ′ ∈ V suc h that ( u, u ′ ) ∈ E we ha v e u ′ ∈ U ∗ . Consider the sub -graph G ′ where pla y er 2 restricts itself t o edges only in U ∗ . A b ottom maximal strongly connected comp onent U ⊆ U ∗ in the sub -graph is an end -comp onent in Unif ( G ), and w e hav e | [ u ∈ U L ( u ) | ≤ | [ u ∈ U ∗ L ( u ) | ≤ | [ u ∈ Z ∗ L ( u ) | . It follo ws that U is a w itness end -comp onent to prov e the r esu lt. The d esired r esult follo ws. 9 Theorem 4 The maximal c over age pr oblem for lab ele d game gr aphs that ar e c ontr o al lably r e curr ent is c oNP- c omplete. Pro of. W e p ro v e the follo wing tw o claims to establish the r esult. 1. In c oNP . The fact that the problem is in coNP can b e prov ed usin g Lemm a 1. Give n a lab eled game graph G , if the answer to the m aximal cov erage problem (i.e., whether sup π 1 ∈ Π 1 inf π 2 ∈ Π 2 |L ( ω ( v in , π 1 , π 2 )) | ≥ m ) is NO, then by Lemma 1, there exists an end- comp onent U in Unif ( G ) such that | S u ∈ U L ( u ) | < m . Th e witness end-comp onent U is a p olynomial witness and it can b e guessed and v er ifi ed in p olynomial time. The verificatio n that U is the correct witness is as f ollo ws: we c h ec k (a) U is s tr ongly conn ected; (b) for all u ∈ U ∩ V 1 and for all u ′ ∈ V such that ( u, u ′ ) ∈ E we ha ve u ′ ∈ U ; and (c) | S u ∈ U L ( u ) | < m . Hence the result follo ws. 2. c oNP ha r dness. W e pro v e hardn ess usin g a redu ction from the complemen t of the V ertex Cover problem. Gi v en a graph G = ( V , E ), a set U ⊆ V is a vertex c over if f or all edges e = ( u 1 , u 2 ) ∈ E we hav e either u 1 ∈ U or u 2 ∈ U . Giv en a graph G w hether there is a vertex co ver U of size at most m (i.e., | U | ≤ m ) is NP-complete [8]. W e no w present a reduction of the complement of the v ertex co v er problem to the maximal co v erage problem in con troallably recurrent games. Gi v en a graph G = ( V , E ) w e construct a lab eled game graph G as follo ws. Let the set E of edges b e en u merated as { e 1 , e 2 , . . . , e ℓ } , i.e., there are ℓ edges. The lab eled game graph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ) is as follo ws. (a) V ertex set and p artition. The vertex set V is as follo ws: V = { v in } ∪ E ∪ { e j i | 1 ≤ i ≤ ℓ, 1 ≤ j ≤ 2 } . All states in E are pla yer 2 states, and the other states are pla ye r 1 states, i.e., V 2 = E , and V 1 = V \ V 2 . (b) Edges. Th e set E of edges are as follo ws: E = { ( v in , e j ) | 1 ≤ j ≤ ℓ } ∪ { ( e i , e j i ) | 1 ≤ i ≤ ℓ, 1 ≤ j ≤ 2 } ∪{ ( e j i , v in ) | 1 ≤ i ≤ ℓ, 1 ≤ j ≤ 2 } . In tuitiv ely , the edges in the game graph are as follo ws: from the initial ve rtex v in , pla yer 1 can c ho ose an y of the edges e i ∈ E . F or a vertex e i in V , play er 2 can c ho ose b et w een t wo v ertices e 1 i and e 2 i (whic h will ev entually repr esen t the tw o end-p oints of the edge e i ). F r om v ertices of the form e 1 i and e 2 i , for 1 ≤ i ≤ ℓ , th e next v ertex is the initial v ertex v in . It follo ws that fr om all vertex the game alw a ys comes b ac k to v in and hence w e hav e controlla bly recurrent game. (c) Pr op ositions and lab el ling. AP = V ∪ { $ | $ 6∈ V } , i.e., there is a prop osition for ev ery v ertex in V and a sp ecial p rop osition $. The vertex v in and vertice s in E are lab eled b y the sp ecial pr op osition $, i.e., L ( v in ) = $ ; and for all e i ∈ E w e ha ve L ( e i ) = $. F or a ve rtex e j i , let e i = ( u 1 i , u 2 i ), where u 1 i , u 2 i are v ertices in V , then L ( e 1 i ) = u 1 i and L ( e 2 i ) = u 2 i . Note that the ab ov e prop osition assignment ensur es that at ev ery v er tex that r epresen ts an edge, pla yer 2 has th e c h oices of vertice s that form the end-p oints of the edge. 10 The f ollo wing case analysis completes the pro of. • Giv en a v ertex cov er U , consider a pla yer 2 strategy , th at at a v ertex e i ∈ V , choose a successor e j i suc h that L ( e j i ) ∈ U . The strategy for pla yer 2 ensures that pla ye r 1 visits only prop ositions in U ∪ { $ } , i.e., at most | U | + 1 prop ositions. • Consider a strategy for pla y er 1 that from v in visits all states e 1 , e 2 , . . . , e ℓ in order. Consider any counter-strat egy for play er 2 a nd let U ⊆ V be the set of prop ositions other than $ visited. S ince all the edges are chosen, it follo w s that U is a vertex co v er. Hence if all vertex co ve r in G is of size at least m , then p lay er 1 can visit at least m + 1 prop ositions. Hence there is a v ertex co v er in G of size at most m if and only if the answe r to the maximal co ve rage p roblem in G with m + 1 is NO. It follo ws that the m aximal co verage problem in con trollably recurrent games is coNP-hard. The d esired r esult follo ws. Complexit y of minimal safety games. As a corollary of the pr o of of Theorem 4 we obtain a complexit y result ab out minimal safety games . Giv en a lab eled game graph G and m , the minimal safet y game pr oblem asks, wh ether there exists a set U su c h that a play er can confine the game in U and U conta ins at m ost m p rop ositions. An easy consequence of the hardness pro of of Theorem 4 is minimal safety games are NP-hard, and also it is easy to argue that minimal safet y games are in NP . Hence w e obtain that the min im al safet y game pr oblem is NP-complete. 4 The Complexit y of Co v erage in Bounded Time Pr ob lem In this section w e study the complexit y of the cov erage in b ounded time problem. In su bsection 4.1 w e stud y the complexit y for graph s , and in sub section 4.2 we study th e complexity for game graphs. 4.1 Graphs Theorem 5 The c over age in b ounde d time pr oblem for b oth lab ele d gr aphs and c ontr ol lably r e cur- r e nt lab ele d gr aphs is NP-c omplete. Pro of. W e p ro v e the completeness r esult in tw o parts b elo w. 1. In NP. Giv en a lab eled graph with n v ertices, if th ere a path ω such th at |L ( ω ↾ k ) | ≥ m , then there is path ω ′ suc h that |L ( ω ′ ↾ m · n ) | ≥ m . T he ab o v e claim follo ws since an y cycle that do es not visit any new pr op osition can b e omitted. Hence a path of length j = min( k , m · n ) can b e guessed and it can b e then chec k ed in p olynomial time if the path of length j visits at least m prop ositions. 2. In NP- har d. W e reduce the Hamiltonian-p ath (H A M-P A TH) [8] pr oblem to the co verage in b ound ed time problem for lab eled graph s. Giv en a d irected graph G = ( V , E ) and an initial v ertex v , we consider the lab eled graph G with the d ir ected graph G , with v as the initial state and AP = V and L ( u ) = u for all u ∈ V , i.e., eac h vertex is lab eled with an un ique prop osition. T he answ er to the co verag e is b ounded time with k = n and m = n , for n = | V | is “YES” iff there is a HAM-P A TH in G starting from v . 11 The d esired r esult follo ws. Complexit y in size of the graph. W e n o w argue that the maximal co v erage and the co v erage in b oun ded time problem on lab eled graph s can b e solv ed in non-deterministic log-space in the size of the graph, and p olynomial space in the size of the atomic p rop ositions. Giv en a lab eled graph G , with n v ertices, we argued in T heorem 1 that if m prop ositions can b e visited, th en there is a path of length at most m · n , that visits m prop ositions. The p ath of length m · n , can b e visited, storing th e current vertex, and guessing the next v ertex, can c hecking the s et of prop ositions already visited. Hence this can b e ac hieve d in non-deterministic log-space in the size of the graph , and p olynomial space in the size of the prop osition set. A similar argument holds for the co ve rage in b ound ed time problem. T h is gives us the follo wing result. Theorem 6 Given a lab ele d gr aph G = (( V , E ) , v in , AP , L ) , the maximal c over age pr oblem and the c over age in b ounde d time pr oblem c an b e de cide d in N LOGSP ACE in | V | + | E | , and in PSP ACE in | AP | . 4.2 Game gr aphs Theorem 7 The c over age in b ounde d time pr oblem for lab ele d game gr aphs is PSP ACE-c omplete. Pro of. W e p ro v e the follo wing tw o cases to prov e the r esult. 1. PSP ACE-har dness . It follo w s from the pro of of Theorem 3 that the maximal co v erage prob- lem for lab eled game graphs redu ces to the cov erage in b oun ded time p r oblem for lab eled game graphs. Sin ce the maximal co verage problem for lab eled game graphs is PSP A C E-hard (Theorem 3), the result follo ws. 2. In PSP ACE. W e sa y t hat an exp lor ation game tr e e for a labeled g ame graph is a r o oted, lab eled tree w hic h r epresen ts an un f olding of the graph. Ev ery no de α of th e tree is lab eled with a p air ( v , b ), where v is a no de of the game graph, and b ⊆ AP is th e set of pr op ositions that hav e b een visited in a branch leading from the ro ot of th e tree to α . T h e ro ot of the tree is lab eled with ( v in , L ( v in )). A tree with lab el ( v, b ) has one d escendan t for eac h u w ith ( v , u ) ∈ E ; the lab el of the descendan t is ( u, b ∪ L ( u )). In order to chec k if m different prop ositions can b e visited within k -steps, the PSP A CE algorithm tra verses the game tree in d epth fi rst order. Eac h b ranc h is explored up to one of the t w o follo wing conditions is met: (i) depth k is reac hed, or (ii) a no d e is reac h ed, w hic h has the s ame lab el as an ancestor in the tree. The b ottom no des, w here conditions (i) or (ii) are met, are th us the lea ve s of the tree. In the course of the tra versal, the algorithm computes in b ottom-up fashion the value of the tree no des. T he v alue of a leaf no d e lab eled ( v , b ) is | b | . F or play er-1 no des, the v alue is the m axim u m of the v alues of the su ccessors; for pla yer-2 no des, the v alue is the minimum of the v alue of the su ccessors. Thus, the v alue of a tree n o de α r epresent s the minim um num b er of prop ositions that p lay er 1 can ensure are visited, in the course of a pla y of th e game that has follo w ed a path fr om the ro ot of the tree to α , and th at can last at m ost k steps. The algorithm returns Y es if th e v alue at the ro ot is at least m , and no otherwise. T o obtain the PS P A CE b ound, n otice that if a no de with lab el ( v , b ) is an ancestor of a no de with lab el ( v ′ , b ′ ) in the tree, we h a ve b ⊆ b ′ : thus, along a b ranc h, the set of p rop ositions 12 app earing in th e lab els increases mon otonically . Bet w een t w o in creases, there can b e at most |G | no d es, due to the termin ation condition (ii). T h us, eac h b r anc h n eeds to b e tra versed at most to depth 1 + |G | · ( | AP | + 1), and the p ro cess requires only p olynomial space. The r esult follo ws. Theorem 8 The c over age in b ounde d time pr oblem for lab ele d game gr aphs that ar e c ontr ol lably r e c u rr ent is b oth NP-har d and c oNP- har d, and c an b e de cide d in PSP ACE. Pro of. It follo ws from the (PSP A CE-inclusion) argument of T heorem 3 that the maximal co v erage problem for lab eled game graphs that are control lably recurrent can b e reduced to the co verage in b ound ed time prob lem for lab eled game graphs that are con trollably recur ren t. Hence th e coNP- hardness follo ws from Theorem 4, and the NP-hardn ess follo ws from hardness in lab eled graphs that are controlla bly recurrent (Theorem 5). The P S P A CE-in clus ion follo ws fr om the general case of lab eled game graphs (Th eorem 7). Theorem 8 sh o w s th at for con tr ollably recurrent game graphs, th e co v erage in b ounded time problem is b oth NP-hard a nd coNP-hard, and can be d ecided in PSP ACE. A tight complexit y b ound r emains an op en problem. Complexit y in the size of the game. The maximal co ve rage p roblem can alternately b e solv ed in time linear in the siz e of the game graph and exp onentia l in the num b er of prop osi- tions. Given a game graph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ), construct the game graph G ′ = (( V ′ , E ′ ) , ( V ′ 1 , V ′ 2 ) , v ′ in , AP , L ′ ) where V ′ = V × 2 AP , (( v , b ) , ( v ′ , b ′ )) ∈ E ′ iff ( v , v ′ ) ∈ E and b ′ = b ∪ L ( v ′ ), V i = { ( v , b ) | v ∈ V i } for i ∈ { 1 , 2 } , v ′ in = ( v in , L ( v in )), and L ′ ( v , b ) = L ′ ( v ). Clearly , the size of the game graph G ′ is linear in G and exp onent ial in AP . Now consider a reac h - abilit y g ame on G ′ with the goal { ( v , b ) | v ∈ V and | b | ≥ m } . Pla yer-1 w ins this game iff the maximal co verag e problem is tru e for G and m prop ositions. Since a reac hability game can b e solv ed in time linear in the game, the result f ollo ws. A similar construction, w here we addition- ally trac k th e length of th e game so far, sho ws th at the maximal co v erage problem with b ound ed time can b e solv ed in time lin ear in the size of the game graph and exp onentia l in the num b er of prop ositions. Theorem 9 Given a lab ele d game gr aph G = (( V , E ) , ( V 1 , V 2 ) , v in , AP , L ) the maximal c over age and the c over age in b ounde d time pr oblem c an b e solve d in line ar-time in O ( | V | + | E | ) and in exp onential time in | A P | . 5 Extensions Somewhat sur prisingly , despite the cen tral imp ortance of graph co v erage in system v erification, sev eral basic complexit y questions ha ve remained op en. Th e basic setting of this pap er on graphs and games can b e extended in v arious directions, enabling the mo deling of other system features. W e m ention tw o suc h directions. 13 Incomplete I nformation. So far, w e h a ve assumed that at eac h step, the tester h as complete information ab out the state of the system un d er test . In practice, th is ma y n ot b e true, and the tester migh t b e able t o observ e only a part of the state. This lea ds to graphs a nd games of imp erfe ct i nformation [13]. T he maximal co verage and the co verage in b ounded time prob lem for games of imp erfect information can b e s olved in EXPTIME. Th e algorithm first constructs a p erfect-information game graph by subset construction [13], and then run the algorithm of The- orem 9 , th at is linear in the size game graph and exp onen tial in the num b er of prop ositions, on the p erfect-information game graph. Thus, the complexit y of this algorithm is EXPTIME. The reac habilit y problem for imp erfect-information games is already EXPT IME-hard [13], hence we obtain an optimal EXPTIME-complete complexit y . Timed Systems. Second, while we ha v e s tudied the problem in the discrete, finite-state setting, similar questions can b e studied for timed systems mo deled as timed automata [2] or timed game graphs [11]. Suc h problems w ould arise in the testing of real-time systems. W e omit the standard definitions of timed automata and timed games. The maximal co ve rage pr oblem for timed automata (resp ectiv ely , timed games) take s as inpu t a timed automaton T (resp ective ly , a timed game T ), with the lo cations lab eled b y a set AP of prop ositions, and a n um b er m , and asks whether m differen t prop ositions can b e visited. An algorithm for the maximal co ve rage problem for timed automata constru cts the region graph of the automaton [2] and runs the algorithm of T heorem 6 on the lab eled r egion graph. T his give s us a PSP A C E algo rithm. S ince th e r eac habilit y p roblem f or timed automata is PSP A CE-hard, we obtain a P S P A CE-complete complexit y . Similar result holds for the co v erage in b oun ded time problem for timed automata. Similarly , the maximal co v erage and co ve rage in b ounded time prob lem for timed games can b e solve d in exp onentia l time b y runn in g the algorithm of Theorem 9 on the region game graph. Th is giv es an exp onen tial time algorithm. Again, since game reac hability on timed games is EXPT IME-hard [9], w e obtain that ma ximal co ve rage and co v erage in b oun ded time in timed games is EXPTIME-complete. References [1] R. Alur, C . Courcoub etis, and M. Y annak akis. Distinguish ing tests for n ondeterministic and probabilistic mac hines. In Pr o c. 27th ACM Symp. The ory of Comp. , 1995. [2] R. Alur and D. Dill. The theory of timed automata. In R e al-Time: The ory in Pr actic e , v olume 600 of L e ct. N otes in Comp. Sci. , pages 45–73. Sprin ger-V erlag, 1991. [3] P . Ammann and J. Offu tt. Intr o duction to softwar e testing . Cambridge Unive rsit y Press, 2008. [4] S. Arora, C. Lun d , R. Mot w an i, M. Sudan, and M. Szegedy . P r o of verificatio n and the hardn ess of appr o ximation pr oblems. J. ACM , 45(3):501– 555, 1998. [5] A. Blass, Y. Gur evic h, L. Nac hm anson, and M. V eanes. Pla y to test. In F A TES , v olume 3997 of L e ctur e Notes in Computer Scie nc e , pages 32–46. Springer, 2005 . [6] E. Brinksm a and J. T retmans. T esting transition s y s tems: An an n otated bibliography . In MOVEP 00: Mo deling and V erific ation of Par al lel Pr o c esses , v olume 206 7 of L e ctu r e Notes in Computer Scienc e , pages 187 –195. Sprin ger, 2000. 14 [7] J. Edmonds and E. L. Johnson. Matc hing, Euler tours and the Chinese p ostman. Math. Pr o g. , 5:88–1 24, 1973. [8] M.R. Garey and D.S. John son. Computers and Intr actability: A Guide to the The ory of N P- Completeness . F reeman and Co., 1979. [9] T. Henzinger and P . Kopk e. Discrete-time con trol for r ectangular h ybrid automata. The or etic al Computer Scienc e , 221:36 9–392 , 1999. [10] D. Lee and M. Y annak akis. Optimization p roblems fr om feature testing of comm unication pro- to cols. In ICNP: International Confer enc e on N etwork Pr oto c ols , pages 66–75 . IEEE Compu ter So ciet y , 1996. [11] O. Maler, A. Pn ueli, and J. Sifakis. O n the syn thesis of discrete cont rollers for timed systems. In Pr o c. of 12th Annual Symp. on The or. A sp. of Comp. Sci. , volume 900 of L e ct. Notes in Comp. Sci. Sprin ger-V erlag, 1995. [12] C.H. P apadim itriou. Computatio nal Complexity . Addison-W esley , 1993. [13] J.H. Reif. Th e comp exity of t wo -pla yer games of incomplete information. J ournal of Computer and System Scienc es , 29:274–30 1, 1984. [14] M. Y annak akis. T esting, optimiza ton, and games. In LICS , pag es 78–88. IE E E Computer So ciet y , 2004. [15] M. Y annak akis and D. Lee. T esting f or fi nite state sys tems. In CSL 98: Computer Scienc e L o gic , vol ume 1584 of L e ctur e Notes in Computer Scienc e , pages 29–4 4. Spr in ger, 1998. 15