Rename is_safety_automaton() as is_guarantee_automaton() and

implement is_safety_mwdba().

Note: I swapped the name of safety and guarantee when I
implemented is_safety_automaton() on 2010-03-20.  Fortunately,
is_safety_automaton() was only used where is_guarantee_automaton()
would have been correct.

* src/tgbaalgos/safety.cc (is_guarantee_automaton): Rename as ...
(is_guarantee_automaton): ... this.
(is_safety_mwdba): New function.
* src/tgbaalgos/safety.hh: Adjust and add documentation.
* src/tgbaalgos/minimize.cc: Use is_guarantee_automaton() instead
of is_safety_automaton().
* src/tgbatests/safety.test: Rename as ...
* src/tgbatests/obligation.test: ... this, and augment the
test.
* src/tgbatest/Makefile.am: Adjust.
* src/tgbatest/ltl2tgba.cc (-O): Display whether a formula
represent a safety, guarantee, or obligation property.
* NEWS: Adjust.

src/tgbaalgos/minimize.cc

@@ -610,9 +610,9 @@ namespace spot
   {
     tgba_explicit_number* min_aut_f = minimize_wdba(aut_f);
 
-    // If aut_f is a safety automaton, the WDBA minimization must be
+    // If aut_f is a guarantee automaton, the WDBA minimization must be
     // correct.
-    if (is_safety_automaton(aut_f))
+    if (is_guarantee_automaton(aut_f))
       {
 	return min_aut_f;
       }
@@ -640,9 +640,9 @@ namespace spot
 	to_free = aut_neg_f = tmp;
       }
 
-    // If the negation is a safety automaton, then the
+    // If the negation is a guarantee automaton, then the
     // minimization is correct.
-    if (is_safety_automaton(aut_neg_f))
+    if (is_guarantee_automaton(aut_neg_f))
       {
 	delete to_free;
 	return min_aut_f;

src/tgbaalgos/safety.cc

@@ -19,11 +19,13 @@
 // 02111-1307, USA.
 
 #include "safety.hh"
+#include "misc/hash.hh"
+#include <deque>
 
 namespace spot
 {
   bool
-  is_safety_automaton(const tgba* aut, const scc_map* sm)
+  is_guarantee_automaton(const tgba* aut, const scc_map* sm)
   {
     // Create an scc_map of the user did not give one to us.
     bool need_sm = !sm;
@@ -69,6 +71,60 @@ namespace spot
     return result;
   }
 
+  bool is_safety_mwdba(const tgba* aut)
+  {
+    typedef Sgi::hash_set<const state*,
+			  state_ptr_hash, state_ptr_equal> seen_map;
+    seen_map seen;		   // States already seen.
+    std::deque<const state*> todo; // A queue of states yet to explore.
+
+    {
+      state* s = aut->get_init_state();
+      todo.push_back(s);
+      seen.insert(s);
+    }
+
+    bdd all_acc = aut->all_acceptance_conditions();
+
+    bool all_accepting = true;
+    while (all_accepting && !todo.empty())
+      {
+	const state* s = todo.front();
+	todo.pop_front();
+
+	tgba_succ_iterator* it = aut->succ_iter(s);
+	for (it->first(); !it->done(); it->next())
+	  {
+	    bdd acc = it->current_acceptance_conditions();
+	    if (acc != all_acc)
+	      {
+		all_accepting = false;
+		break;
+	      }
+	    state* d = it->current_state();
+	    if (seen.find(d) != seen.end())
+	      {
+		d->destroy();
+	      }
+	    else
+	      {
+		seen.insert(d);
+		todo.push_back(d);
+	      }
+	  }
+	delete it;
+      }
+
+    seen_map::const_iterator it = seen.begin();
+    while (it != seen.end())
+      {
+	seen_map::const_iterator old = it;
+	++it;
+	(*old)->destroy();
+      }
+
+    return all_accepting;
+  }
 
 
 

src/tgbaalgos/safety.hh

@@ -1,4 +1,4 @@
-// Copyright (C) 2010 Laboratoire de Recherche et Développement de
+// Copyright (C) 2010, 2011 Laboratoire de Recherche et Développement de
 // l'Epita (LRDE)
 //
 // This file is part of Spot, a model checking library.
@@ -25,20 +25,40 @@
 
 namespace spot
 {
-  /// \brief Whether an automaton is a safety property.
+  /// \brief Whether an automaton represents a guarantee property.
   ///
-  /// An automaton is an safety if any accepting path ends on an
-  /// accepting state with only one transition that is a self-loop
-  /// labelled by true.  Note that this is only a sufficient
-  /// condition.  Some safety automata might not be recognized with
-  /// this check because of some non-determinism in the automaton.
+  /// A weak deterministic TGBA represents a guarantee property if any
+  /// accepting path ends on an accepting state with only one
+  /// transition that is a self-loop labelled by true.
+  ///
+  /// Note that in the general case, this is only a sufficient
+  /// condition : some guarantee automata might not be recognized with
+  /// this check e.g. because of some non-determinism in the
+  /// automaton.  In that case, you should interpret a \c false return
+  /// value as "I don't know".
+  ///
+  /// If you apply this function on a weak deterministic TGBA
+  /// (e.g. after a successful minimization with
+  /// minimize_obligation()), then the result leaves no doubt: false
+  /// really means that the automaton is not a guarantee property.
   ///
   /// \param aut the automaton to check
   ///
   /// \param sm an scc_map of the automaton if available (it will be
   /// built otherwise.  If you supply an scc_map you should call
   /// build_map() before passing it to this function.
-  bool is_safety_automaton(const tgba* aut, const scc_map* sm = 0);
+  bool is_guarantee_automaton(const tgba* aut, const scc_map* sm = 0);
+
+  /// \brief Whether a minimized WDBA represents a safety property.
+  ///
+  /// A minimized WDBA (as returned by a successful run of
+  /// minimize_obligation()) represent safety property if it contains
+  /// only accepting transitions.
+  ///
+  /// \param aut the automaton to check
+  bool is_safety_mwdba(const tgba* aut);
+
+
 }
 
 #endif // SPOT_TGBAALGOS_SAFETY_HH