The Maude LTL LBMC Tool Tutorial Kyungmin Bae 1 , Santiago Escobar 2 , and Jos´ e Meseguer 1 1 University of Illinois at Urbana-Champaign, IL, USA 2 Universidad Polit´ ecnica de Valencia, Spain Abstract. A concurrent system can be naturally specified as a rewrite theory. The Maude LTL logical bounded model checker (LBMC) tool is an LTL model checker for a rewrite theory, which can verify infinite- state systems using narrowing and folding relations, where the system’s initial states are represented by terms with logical variables. This tutorial describes the main features and commands of the Maude LTL LBMC tool, illustrated by several examples. 1 Introduction Rewriting is a very flexible formalism for specifying concurrent systems. A rewrite theory R =(Σ,E,R) with equations E and rules R specifies a con- current system whose states are axiomatized as the initial algebra T Σ/E , and whose concurrent transitions are axiomatized by the rewrite rules R. Rewriting techniques can also be very useful for model checking verification of such systems, particularly when they are infinite-state. Specifically, narrowing 3 with rules R modulo the equations E offers many advantages as a technique for infinite-state model checking. For the case of reachability analysis this was shown in [8], and for the more general case of LTL model checking in [4]. A very appealing feature of narrowing-based model checking is the logical nature of its state space. That is, we do not represent concrete states (i.e., ground terms), but state patterns, that is, terms t(X 1 ,...,X n ) with logical variables X 1 ,...,X n . What t(X 1 ,...,X n ) stands for is not a single state, but the set of all concrete states that are its ground instances. This is very useful to deal with initial states which are not a single state but a (possibly infinite) set of concrete states, which can often be described by patterns t(X 1 ,...,X n ). Likewise, the states reached by narrowing are patterns with logical variables. As argued in [4], this logical state space already affords a huge abstraction, since each concrete state is abstracted by a pattern. An even greater abstraction (sometimes making the system finite-state) is afforded by folding the state space by means of a folding relation such as, for example, renaming or subsumption. In [4] we gave methods allowing LTL model checking verification when the folded logical state space is finite. But in general a folded logical state space need not be finite. The Maude LTL logical bounded model checker (LBMC) tool is the first narrowing-based LTL model checker for infinite-state systems we are aware of. 3 Narrowing [6] generalizes term rewriting by allowing free variables in terms and by performing unification instead of matching.