From Church and Prior to PSL

One of the surprising developments in the area of program verification is how ideas introduced originally by logicians in the 1950s ended up yielding by 2003 an industrial-standard property-specification language called PSL. This development was enabled by the equally unlikely transformation of the mathematical machinery of automata on infinite words, introduced in the early 1960s for second-order arithmetics, into effective algorithms for model-checking tools. This paper attempts to trace the tangled threads of this development. 1 Thread I: Classical Logic of Time 1.1 Reasoning about Sequential Circuits The field of hardware verification seems to have been started in a little known 1957 paper by Alonzo Church, 1903–1995, in which he described the use of logic to specify sequential circuits [24]. A sequential circuit is a switching circuit whose output depends not only upon its input, but also on what its input has been in the past. A sequential circuit is a particular type of finite-state machine, which became a subject of study in mathematical logic and computer science in the 1950s. Formally, a sequential circuit C = (I,O,R, f, g, r0) consists of a finite set I of Boolean input signals, a finite set O of Boolean output signals, a finite set R of Boolean sequential elements, a transition function f : 2 × 2 → 2, an output function g : 2 → 2, and an initial state r0 ∈ 2. (We refer to elements of I ∪ O ∪ R as circuit elements, and assume that I , O, andR are disjoint.) Intuitively, a state of the circuit is a Boolean assignment to the sequential elements. The initial state is r0. In a state r ∈ 2, the Boolean assignment to the output signals is g(r). When the circuit is in state r ∈ 2 and it reads an input assignment i ∈ 2 , it changes its state to f(i, r). A trace over a set V of Boolean variables is an infinite word over the alphabet 2 , i.e., an element of (2 ). A trace of the sequential circuit C is a trace over I ∪ O ∪R that satisfies some conditions. Specifically, a sequence τ = (i0, r0,o0), (i1, r1,o1), . . ., where ij ∈ 2 , oj ∈ 2, and rj ∈ 2, is a trace of C if rj+1 = f(ij , rj) and oj = g(rj), for j ≥ 0. Thus, in modern terminology, Church was following the linear-time approach [81] (see discussion in Section 2.1). The set of traces of C is denoted by traces(C). ⋆ Supported in part by NSF grants CCR-9988322, CCR-0124077, CCR-0311326, and ANI0216467, by BSF grant 9800096, and by a gift from the Intel Corporation. The “Y” in the author’s middle name stands for “Ya’akov”