💻 computer science

Visualising CTL Witnesses and Counterexamples -- Extended Version

This extended paper introduces a formal model for visualizing CTL witnesses and counterexamples on explicit-state models to enhance human comprehension, providing characterizations of minimal evidence for each temporal operator and a concrete implementation, along with proofs of all results.

Original authors: Arend Rensink

Published 2026-04-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Arend Rensink

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a detective trying to solve a mystery about a complex machine. This machine can do many different things, and sometimes it behaves exactly as you hope, and sometimes it crashes or does something wrong.

In the world of computer science, this machine is a system, and the rules it's supposed to follow are called properties (like "the door must never open while the engine is running").

The Problem: Two Types of Logic

There are two main ways to write these rules, and they have very different personalities:

LTL (Linear Time): This is like watching a movie. It looks at one single path of events from start to finish. If the movie has a bad scene, you can just point to that specific scene and say, "See? This is why it failed." It's easy to explain.
CTL (Branching Time): This is like looking at a choose-your-own-adventure book. At every page, the story splits into multiple possible futures. The rules here are about all possible paths or some possible paths.
- The Problem: If the book fails to follow the rules, you can't just point to one page. You have to explain a whole tree of possibilities. "Why did it fail?" is much harder to answer because the failure might depend on a path that didn't happen, but could have.

The Solution: "Evidence"

The author of this paper, Arend Rensink, asks: "How do we explain to a human why a branching-time rule passed or failed, without drowning them in a sea of possibilities?"

He proposes a new concept called Evidence. Think of evidence as the smallest, most essential piece of the puzzle needed to prove a point.

If the rule is PASSED (A Witness): The evidence is the "smallest possible version" of the machine that still works. It's like showing a tiny, working prototype of a car engine to prove the design works, ignoring all the extra parts that aren't strictly necessary.
If the rule is FAILED (A Counterexample): The evidence is the "smallest possible version" of the machine that guarantees it will fail. It's like showing a specific broken gear and a specific path the car could take that leads to a crash.

The Secret Ingredient: "Closed States"

The paper introduces a clever trick to make these explanations small and clear. It uses something called Closed States.

Imagine you are drawing a map of a city.

Open State: You draw a dot (a location) but leave the roads leading out of it blank. It's like saying, "Here is a place, but we don't know where the roads go yet."
Closed State: You draw a dot and put a big red "X" or a wall around it. You are saying, "This is the end of the road. No paths go out from here."

Why is this useful?
In the "choose-your-own-adventure" book, if you want to prove that a bad thing never happens, you have to show that every possible path eventually hits a dead end or loops safely. By marking certain states as "Closed," you are telling the reader: "Stop looking here. There are no other paths to check. We have proven that no matter what, you can't escape this loop."

This allows the "evidence" to be tiny. Instead of drawing the whole infinite universe of possibilities, you just draw the specific path and put a "Closed" sign at the end to say, "And that's it, no other options exist."

Visualizing the Proof

The paper also talks about how to show this to a human.

Imagine you have a giant, messy flowchart of the machine's logic.

The "Proof" (The Tree): The computer calculates the answer.
The "Evidence" (The Highlight): The tool highlights only the parts of the flowchart that matter.
- If the machine won, it highlights the specific path that led to victory and fades everything else to gray.
- If the machine lost, it highlights the specific path that led to disaster and puts "Closed" signs on the branches that were blocked.

The paper introduces two ways to make this even clearer:

Local Closure: If a rule is simple (like "A and B"), show the result of A and B right there, so you don't have to jump around the page.
Natural Evidence: Sometimes the mathematically "smallest" proof looks weird to a human (like a path that is too short to make sense). The tool adds a little bit of extra context to make it look like a "natural" story, even if it's slightly bigger than the absolute minimum.

The Big Picture

The author built a tool (a "demonstrator") that lets you click on any part of a system and see:

"Here is the tiny, perfect proof that this works."
"Here is the tiny, perfect proof that this fails."

In summary:
This paper solves the problem of "Why did my complex system fail?" by creating a new way to build minimal, easy-to-read stories (evidence) that explain the answer. It uses "Closed States" (dead ends) to cut off unnecessary possibilities, turning a confusing, branching maze into a clear, straight line that a human can understand.

1. Problem Statement

The paper addresses a significant usability gap between Linear Temporal Logic (LTL) and Computational Tree Logic (CTL) in the context of model checking.

LTL: When a property is violated, the counterexample is a single linear trace (a sequence of states). This is intuitive, easy to visualize, and straightforward for humans to analyze.
CTL: Due to its "branching time" nature, a CTL property violation cannot be explained by a single trace. Instead, it requires a substructure of the state space (a set of paths and branching points) to demonstrate why a property fails or holds.
The Challenge: There is no standard, minimal, or easily visualizable notion of a "counterexample" or "witness" for CTL. Existing methods often produce complex structures that are difficult for humans to comprehend. Furthermore, in CTL, violating a property is equivalent to satisfying its negation, meaning the concepts of "witness" (for satisfaction) and "counterexample" (for violation) are duals of the same underlying structure.

The paper aims to answer two questions:

What is the simplest, most precise notion of evidence (witness or counterexample) for an arbitrary CTL formula?
How can this evidence be effectively visualized for human comprehension?

2. Methodology and Formal Framework

A. Formal Model of Evidence

The authors introduce a formal framework based on explicit-state models (Kripke structures) with a novel addition: Closed States.

Models: Defined as tuples $\langle S, C, R, L \rangle$ , where $S$ is states, $R$ is transitions, $L$ is a labeling function, and $C \subseteq S$ is a set of closed states.
Closed States: A state is "closed" if it has no outgoing transitions in the current model. This is crucial for counterexamples: if a state is closed, it guarantees that no supermodel (an extension of the current model) can add a transition from that state. This allows the model to formally prove the absence of a path, which is necessary for universal quantifiers (e.g., $AG$, $AX$).
Evidence Definition: A model $M$ $M$ is evidence for an assertion $(s, \phi, b)$ $(s, ϕ, b)$ (where $b \in \{0, 1\}$ $b \in {0, 1}$ ) if:
1. It contains only the necessary subformulas of $\phi$ .
2. For every sound supermodel $N$ of $M$ (a model that extends $M$ while preserving consistency), the assertion holds in $N$ .
- If $b=1$ , it is a witness.
- If $b=0$ , it is a counterexample.

B. Characterization of Minimal Evidence

The paper derives specific conditions for minimal evidence (models that are smallest with respect to the submodel relation $\sqsubseteq$ ) for each CTL operator.

Existential Operators ($EX, EU, EG$):
- Witnesses: Require a single path or a single transition to a satisfying state.
- Counterexamples: Require that all possible paths fail. This is achieved by making states closed (blocking further transitions) and ensuring all existing transitions lead to failing states.
Universal Operators (Duals): Handled via the duality of CTL (e.g., $AG \phi \equiv \neg EG \neg \phi$ ).
Necessity vs. Sufficiency: The authors define "constrained" vs. "unconstrained" formula sets. For unconstrained formulas (where subformulas don't force specific truth values), the syntactic conditions for minimal evidence are both necessary and sufficient.

C. Proof and Visualization Strategy

To visualize a complete model checking result, the authors define a Proof as a collection of evidence for every state/formula pair.

Visual Challenges: A full proof involves many overlapping subgraphs. Simply unioning them often creates a mess that is not evidence itself.
Solutions Proposed:
1. Local Closure: For non-temporal operators (like negation or conjunction), the evidence is local to the state. The visualization includes the evidence for children immediately, avoiding confusion.
2. Natural Evidence: Minimal formal evidence sometimes omits information about subformulas in non-terminal states (e.g., in an $EU$ witness, intermediate states might not show the status of the second operand). The authors introduce Natural Evidence, which includes full labeling for all children in non-terminal states. This is formally redundant but cognitively essential for human understanding.
3. Combined Evidence: Instead of showing a separate graph for every state, the authors show that for a fixed formula $\phi$ , there exists a single Combined Evidence model that covers all states. The minimal evidence for a specific state $s$ is simply the fragment of this combined model reachable from $s$ . This reduces the visualization from $N$ graphs (one per state) to just a few graphs (one per temporal operator).

3. Key Contributions

Formal Definition of CTL Evidence: A rigorous definition of evidence that unifies witnesses and counterexamples, utilizing closed states to capture negative information (absence of paths) formally.
Characterization of Minimality: A precise characterization of minimal evidence for all CTL operators (Table 2 in the paper), distinguishing between syntactic minimality and semantic minimality.
Concept of Natural Evidence: The identification that strictly minimal formal evidence is often unintuitive. "Natural evidence" adds necessary context (labeling of subformulas) to make the visualization comprehensible without sacrificing correctness.
Combined Evidence Construction: A method to merge evidence for all states of a system into a single static model per temporal operator, drastically reducing visual complexity.
Implementation: An interactive visualizer (demonstrator tool) that allows users to select a state and subformula to reveal the corresponding evidence, utilizing Abstract Syntax Trees (ASTs) colored by satisfaction status.

4. Results

Theoretical: The paper proves that for unconstrained formulas, the proposed syntactic conditions for minimal witnesses and counterexamples are necessary and sufficient. It establishes that proofs (collections of evidence) can be constructed as a byproduct of standard model checking algorithms with no extra computational cost.
Practical: The visualizer successfully demonstrates that complex CTL properties (e.g., $E(!d1 \ U \ win)$ $E (! d 1 U w in)$ and $EG(!win \ \& \ EF \ win)$ $E G (! w in & E F w in)$ ) can be understood by humans through the proposed visualization techniques.
- Example: For a game board model, the tool visualizes why a player cannot win without rolling a '1'. The counterexample shows a closed state where all paths loop or end in a loss, with no transitions leading to a win state.
Comparison: The approach is compared to existing work on linear evidence and proof graphs. The use of closed states allows the authors to handle full CTL (including universal quantifiers) more naturally than simulation-based approaches, which struggle with the "absence of transitions."

5. Significance

Bridging the Gap: This work significantly improves the usability of CTL model checking. By providing a visual, intuitive explanation for why a property holds or fails, it makes CTL accessible to practitioners who find the branching nature of the logic difficult to debug.
Human-Centric Design: The shift from "mathematically minimal" to "humanly comprehensible" (via Natural Evidence) is a major contribution to the field of formal methods. It acknowledges that the end-user of model checking is often a human engineer, not just a machine.
Scalability of Understanding: The concept of Combined Evidence solves the scalability problem of visualization. Instead of overwhelming the user with thousands of small graphs, it provides a holistic view where specific details can be zoomed in on, making large-scale system verification more manageable.
Foundation for Future Work: The paper opens avenues for extending these concepts to more expressive logics like $CTL^*$ and refining the relationship between evidence and simulation relations in the presence of closed states.

In summary, Rensink provides a complete pipeline from the formal definition of CTL evidence to its practical, human-readable visualization, solving the long-standing problem of "black box" results in branching-time model checking.