Ch5-Linear Temporal Logicce.sharif.edu/courses/96-97/2/ce665-1/resources/root... · 2018-05-01 ·...

Chapter 5:Linear Temporal Logic

Prof. Ali MovagharVerification of Reactive Systems

2

Outlinen We introduce linear temporal logic (LTL), a

logical formalism that is suited for specifying LT properties.

n Then we go through a model-checkingalgorithm for LTL based on Bϋchi automata.

3

Linear Temporal Logicn Correctness of reactive systems

depends on the execution of the system and on fairness issues.n Temporal logic is a suitable formalism for

treating these aspects.n Temporal logic extends propositional or

predicate logic by modalities to specify infinite behavior of a reactive system.

Linear Temporal Logic (Con.)n The elementary modalities of temporal

logics include the operators:n à “eventually” (eventually in the future)n □ “always” (now and forever in the future).

n The nature of time in temporal logics can be either linear or branching:

4

Linear Temporal Logic (Con.)n In the linear view, at each moment in time

there is a single successor moment.n LTL (Linear Temporal Logic) is based on linear-

time perspective.n In the branching view, it has a branching,

tree-like structure, where time may split into alternative course.

n CTL (Computational Tree Logic) is based on a branching-time view.

5

Linear Temporal Logic (Con.)n A temporal logic allows for the

specification of the relative order of events. But it does not support any means to refer to the precise timing of events.n “The car stops once the driver pushes the

brake”.n “The message is received after it has been

sent”.6

Linear Temporal Logic (Con.)n LTL may be used to express the timing

for the class of synchronous systems in which all components proceed in a lock-stop fashions. n In this setting, a transition corresponds to

the advance of a single time-unit.n The time domain is discrete: the present

moment refers to current state and the next moment corresponds to the next state.

7

Linear Temporal Logic: syntaxn LTL formulae over the set AP of atomic

proposition are formed according to the following grammar:n j ::= true | a | j1Ùj2 | ¬j | �j | j1Uj2

where aÎAP.n �, “next” : �j holds at the current moment if j holds in the next state.

n U, “until”: j1Uj2 holds at the current moment, if there is some future for which j holds and jholds at all moments until future moment.

8

Linear Temporal Logic: syntax (Con.)n The precedence order on operators is

as follows.n The unary operators bind stronger than the

binary ones.n � and ¬ bind equally strong.n The temporal operator U takes precedence

over Ù,Ú, and ®.

9

Linear Temporal Logic: syntax (Con.)n Using the Boolean connectives Ù and ¬,

the full power of propositional logic is obtained.

n The until operator allows to derive the temporal modalities à and □ as follows:n àj= true U j and □j= ¬à¬j

n àj ensures that j will be true eventually the in future.

n □j is satisfied iff it id not the case that eventually ¬j holds. 10

Linear Temporal Logic: syntax (Con.)n The intuitive meaning of temporal

modalities are illustrated below:

11

Linear Temporal Logic: syntax (Con.)n By combining □ and à, new temporal

modalities are obtained:n □àa describes the property stating that at

any moment j there is a moment i³j at which a-state is visited. Thus a-state is visited infinitely often.

n à□a expresses that from moment j, only a-state are visited. Thus a-state is visited eventually forever.

12

Linear Temporal Logic: syntax (Con.)n Example 5.2: properties for mutual

exclusion problem:n Safety property stating that P1 and P2

never simultaneously have access to their critical section: □(¬crit1Ú¬crit2).

n Liveness property stating each process Pi is infinitely often in its critical section: (□àcrit1)Ù (□àcrit2).

n Read examples 5.3 and 5.4.13

Linear Temporal Logic: syntax (Con.)n Let |j| denote the length of LTL

formula j in terms of the number of operators in j.

n This can be easily defined by inductionon the structure of:n aÎAP has length 0;n �aÚb has length 2 and (�a)U(aÙ¬b) has

length 4.14

Linear Temporal Logic: semanticsn LTL formula stands for properties of

paths.n The semantics of LTL formula is defined

by a LT property. Then it is extended to an interpretation over paths and statesof a LTS.

15

Linear Temporal Logic: semantics (Con.)n Definition: Let j be an LTL formula

over AP. The LT property induced by jis

Words(j)={sÎ(2AP)w| s|=j}where |= Í(2AP)w´LTL is the smallest

relation with the properties:

16

Linear Temporal Logic: semantics (Con.)

n For the derived operators and the expected result is :

n Derive semantics of à□ and □à!17


n Definition 5.7: Let TS=(S,Act,®,I,AP,L ) be a transition system without terminal state, and let j be a LTL formula over AP.n For infinite path fragments p of TS, the

satisfaction relation is defined by p |= j iff trace(p) |=j

18


n For state sÎS, the satisfaction relation |= is defined by:

s|=j iff ("pÎPaths(s).p|=j)n TS satisfies j, denoted TS |=j , if

Traces(TS)ÍWords(j).

19

Linear Temporal Logic: semantics (Con.)n From this definition, it immediately

follows that:

n Thus, TS |=j iff s0 |= j for all initial states s0 of TS.

20

Linear Temporal Logic: semantics (Con.)n Example 5.8: Consider the LTS below

with the set of propositions AP={a,b}

n TS |=□an TS | ¹ �(aÙb)n TS |= □(¬b ®□(aÙ¬b))n TS |¹ b U (aÙ¬b)

21

Linear Temporal Logic: semantics (Con.)n Thus it is possible that a LTS satisfies

neither j nor ¬j:n Consider the TS below with AP={a}:

n TS|¹ àa, since the initial path s0(s2)w|¹àa.n TS|¹ ¬àa, since the initial path s0(s1)w|=a,

and thus s0(s1)w|¹ ¬à a.23

Linear Temporal Logic: specifying propertiesn Example 5.11: A modulo 4 counter

can be represented by a sequential circuit C, which outputs 1 every fourth cycle, otherwise 0.n Let the evaluation of r1r2 denote i=2.r1+r2n C is constructed such that the output bit y

is set exactly for i=0 (hence r1=0,r2=0). Son dr1=r1År2, dr2=¬r1, ly=¬r1Ù¬r2.

24

Linear Temporal Logic: specifying properties (Con.)

n The circuit C and its transition system TSC is shown below:

25


n Let AP={r1,r2,y}. The following statement holds:

n TSC |= □(y « ¬r1Ù¬r2)n TSC |= □(r1 ® (�y Ú��y))n TSC |= □(y ®(�¬y Ù��¬y)).

n The property that at least during every four cycles the output 1 id obtained holds for TSC:

n TSC |= □(y Ú�yÚ��yÚ��y).

26


n The fact that these outputs are produced in a periodic manner where every fourth cycle yields the output 1 is expressed as:

n TSC |= □(y®(�¬y Ú ��¬y Ú��¬y)).

n Read example 5.12

27


n Example 5.13: Leader election protocol:n Goal: a process with a higher identifier is

elected.n Processes are initially inactive, and may

become active and then participate in the election (fairness: each process becomes active at some time).

n If an inactive process with higher id becomes active, a new leader election takes place.

28

Linear Temporal Logic: specifying properties (Con.)n We use LTS to specify some properties.

Let AP={leaderi,activei|1£i,j£N}.n There is always one leader:

n □(\/1£i£N leaderi Ù /\ 1£j£N,j¹i ¬leaderj)n Since initially no leader exists we modify it to: □à(\/1£i£N leaderi Ù /\ 1£j£N,j¹i ¬leaderj)

n But this allows there to be more than one leader at a time temporarily, so: (□ /\1£i£N(leaderi ® /\ 1£j£N,j¹i ¬leaderj)) Ù(□à(\/1£i£N leaderi )

29


n In the presence of an active process with a higher identity, the leader will resign at some time:

□(/\ 1£i,j£N,i<j ((leaderi Ù¬leaderj Ùactivej)®à¬leaderi))

n A new leader will be an improvement over the previous one:□¬ (/\ 1£i,j£N,i ³j (leaderi Ù¬�leaderi Ù �àleaderj))

n Read Example 5.14.30

Linear Temporal Logic: specifying properties (Con.)n For synchronous systems LTL can be

used as a formalism to specify real-time properties:n �j states that “at the next time instant j

holds”.n �Kj =�.. � : j holds after k time

instants.n à£k j= \/0£i£k�

ij : j will hold at most k time instants.

31


n □£k j= ¬\/0£i£k�i¬j : j holds now and will

hold during the next k time instants.n But for asynchronous systems the next-

step operator should be used with care.

32

Linear Temporal Logic: equivalence of LTL formulaen Two formulae are intuitively equivalent

whenever they have the same truth-value under all interpretations.

n Definition: LTL formulae j1,j2 are equivalent, denoted j1ºj2, if Words(j1)=Words(j2).

33

Linear Temporal Logic: equivalence of LTL formulae (Con.)

n As LTL subsumes propositional logic, equivalences of propositional logic also hold for LTL.

n For temporal modalities we have:

34


35


n The duality rule ¬�jº�¬j shows that next-step operator is dual to itself:

n In the absorption law à□àjº□àj : infinitely often j is equal to from a certain point of time on, j is true infinitely often.

36


n The distributive laws for and disjunction, or and conjunction are dual to each other:

n à(jÚy) ºàj Ú ày and □(jÙy) º□j Ù □yn Recall that $(jÚy) º $j Ú $y and "(jÙy) º "j Ù"y

n But à(aÙb) àa Ù àb and □(aÚb) □a Ú □b (the same holds for $ and "):

37

º º


n The expansion laws describe the temporal modalities U,à and □ by means of a recursive equivalence:

n These equivalences assert something about the current, and about the director successor state.

n j U yºy Ú (jÙ �(jUy)): so j U y is a solutionof the equivalence kºy Ú (jÙ �k).

n àyºy Ú �ày is a special case of the expansion law for until:

38


n Lemma 5.18 (Until is least solution of the expansion law): For LTL formulae jand y, Words(jUy) is the least LT property PÍ(2AP)w such that:n Words(y) È{A0,A1,A2…ÎWords(j)|A1

A2…ÎP}ÍP (I)n Moreover, Words(jUy) agrees with the

set: Words(y) È{A0,A1,A2…ÎWords(j)|A1A2…ÎWords(jUy)}.

39


n The formulation “least LT property satisfying condition (I)” means that the following conditions hold:n (1) P= Words(jUy) satisfies (I).n Words(jUy)ÍP for all LT properties P

satisfying condition (I).

40

Linear Temporal Logic: weak, release and positive normal form

n Any LTL formula can be transformedinto a canonical form, called positive normal form (PNF), in which:n Negations only occur adjacent to atomic

propositions.n Recall that PNF formulae in propositional

logic are constructed from true, false, the literals a and ¬a, and the operators Ù and Ú.

41

Linear Temporal Logic: weak, release and positive normal form (Con.)

n To transform any LTL formula into PNF, for each operator a dual operator is needed in the syntax:n True and false, Ù and Ú.n The next-step operator is a dual of itself.n Consider the until operator:¬(jUy)º((jÙ¬y) U (¬jÙ¬y)) Ú □(jÙ¬y)

42


n The operator W, called weak until or unless, as the dual of U: jWyº(jUy) Ú□j.

n Until and W are dual in the following sense:

n Note that W has the same expresivness to U.n W and U satisfy the same expansion law.

43


n Lemma 5.19 (weak-until is the greatest solution of the expansion law) For LTL formulae j and y, Words(jWy) is the greatest LT property PÍ(2AP)w such that:n Words(y) È{A0,A1,A2…ÎWords(j)|A1 A2…ÎP}ÊP

(I)n Moreover, Words(jWy) agrees with the set:

Words(y) È{A0,A1,A2…ÎWords(j)|A1A2…ÎWords(jWy)}.

44


n The formulation “greatest LT property satisfying condition (I)” means that the following conditions hold:n (1) P Ê Words(jWy) satisfies (I).n Words(jWy) Ê P for all LT properties P

satisfying condition (I).

45


n Definition: For aÎAP, the set of LTL formulae in weak-until positive normal form (weak-until PNF) is given by:n j::= true | false | a | ¬a | j1Ùy2 | j1Úy2 | �j | j1Uy2 | j1Wy2

n Since □j º j W false and àj º true U j, □and à can be also considered as permitted operator of W-PNF.

46


n We can convert each LTL formula to its W-PNF by using the following rewriterules:

47


n Example 5.21: convert LTL formula ¬□((aUb)Ú �c) to weak-until PNF:n ¬□((aUb)Ú �c) º à¬((aUb)Ú �c) º à (¬(aUb)Ù ¬�c) º à ( (aÙ ¬ b) W (¬a Ù¬b) Ù ¬�c)

48


n Theorem 5.22: For each LTL formula there exists an equivalent LTL formula in weak-until PNF.

n The main draw-back of rewrite rules is that the length of the resulting formula may be exponential in the length of the original nonPNF LTL formula:n The rewrite rule for U and W , duplicates

the operands. 49


n We can avoid this exponential blow-up by using another temporal modality as the dual of until, called release and defined by : n jRy = ¬(¬j U¬y)n jRy holds for a word if y always holds, a

requirement that is released as soon as jbecomes valid.

50


n The always operator is obtained from the release operator : □jºfalse R j.

n The weak-until and the until operator are obtained by:n jWyº (¬j Ú y) R (j Ú y) and vice versa jRyº (¬j Ù y) W (j Ù y)

n jUyº ¬(¬j R ¬y)

51


n Definition: For aÎAP, the set of LTL formulae in release positive normal form (release PNF) is given by:n j::= true | false | a | ¬a | j1Ùy2 | j1Úy2 | �j | j1Uy2 | j1Ry2

n Thus the rewrite rules are:

52


n Theorem 5.24: For any LTL formula jthere exists an equivalent LTL formula j’ in release PNF with |j’|=O(|j|).

53

Linear Temporal Logic: Fairness in LTL

n Definition: Let F and Y be propositional logic formula over AP.1. An unconditional LTL fairness constraint is

an LTL formula of the form ufair=□àY.2. A strong LTL fairness condition is an LTL

formula of the form ufair=□àF®□àY.3. A weak LTL fairness constraint is an LTL

formula of the form wfair= à□F®□àY.an LTL fairness assumption is a conjunction

of LTL fairness constraints. 54

Linear Temporal Logic: Fairness in LTL (Con.)n For instance, a strong LTL fairness

assumption denote a conjunction of strong LTL fairness constraints:

sfair = /\0<i£k(□àFi®□àYi)for propositional logic formulae Fi and Yi over AP.

n Generally LTL fairness assumptions are: fair = ufairÙsfair Ù wfair

55

Linear Temporal Logic: Fairness in LTL (Con.)n Let FairPaths(s) denote the set of all

fair paths starting in s and FairTraces(s) the set of all traces induced by fair paths starting in s:n FairPaths(s) ={pÎPaths(s) | p|=fair}n FairTraces(s) = {Trace(p)|pÎFairPaths(s)}

n Above definitions can be lifted to TSs yielding FairPaths(TS) and FairTraces(TS). 56

Linear Temporal Logic: Fairness in LTL (Con.)n Definition: For state s in TS (over AP)

without terminal state, LTL formula jand LTL fairness assumptions fair letn s |=fair j iff "pÎFairPaths(s). p|= j andn TS|=fair j iff s0ÎI.s0|=fair j.

n TS satisfies j under the LTL fairness assumption fair if j holds for all fair paths that originate from some initial state. 57

Linear Temporal Logic: Fairness in LTL (Con.)n Example 5.27: Consider the mutual

exclusion with randomized arbiter:

58

Linear Temporal Logic: Fairness in LTL (Con.)

n Arbiter tosses a coin, modeled by non-deterministic choice between heads and tails, to choose a process to enters its critical section.

n “process Pi is in its critical section infinitely often”:n TS1 || Arbiter || TS2 |¹ □à crit1 (why?)n TS1 || Arbiter || TS2 |=fair □àcrit1 Ù □àcrit2

where fair= □àheads Ù □àtails.59

Linear Temporal Logic: Fairness in LTL (Con.)n In chapter 3, fairness was introduced

using set of actions:n An execution is unconditionally A-fair for a

set of actions A, whenever each action aÎA occurs infinitely often.

n However LTL-fairness is defined on atomic propositions, i.e., from a state-based perspective.

60

Linear Temporal Logic: Fairness in LTL (Con.)n Action-based fairness assumptions can

always be translated into analogous LTL fairness assumption.

n The intuition is n Make a copy of each non-initial state s

such that it is recorded which action was executed to enter s.

n The copied state <s,a> indicates that state s has been reached by performing a as last action. 61

Linear Temporal Logic: Fairness in LTL (Con.)n Formally for TS=(S,Act,®,I,AP,L) let

TS’=(S’,Act’,®’,I’,AP’,L’) where n Act=ActÈ{begin},n I’=I´{begin},n S’=I’ È (S´Act),n TS’ is defined by :

62

Linear Temporal Logic: Fairness in LTL (Con.)n L’ is defined:

n L’(<s,a>)=L(s)È{taken(a)}È{enabled(b)|bÎAct(s)} n L’(<s0,begin>)=L(s0)È{enabled(b)|bÎAct(s0)}.

n It can be established thatn TracesAP(TS)=TracesAP(TS’).

n Thus strong fairness for AÍAct can be described by LTL fairness assumption:n sfairA=□àenabled(A)® □àtaken(A)

n enabled(A)=\/aÎAenabled(a), taken(A)=\/aÎAtaken(a)63

Linear Temporal Logic: Fairness in LTL (Con.)n The set of fair traces of action-based

fairness assumption F for TS and its corresponding LTL fairness fair for TS’ coincides:n {TraceAP(p)| pÎPaths(TS), p is F-fair}=

{TraceAP(p’)| p’ÎPaths(TS’), p’|= fair}n Thus FairTracesF(TS)=FairTracesfair(TS’):

n TS |=F P iff TS’ |=fair P.

64

Linear Temporal Logic: Fairness in LTL (Con.)n Conversely, a (state-based) LTL fairness

assumptions cannot always be represented as action-based fairness assumption.n Because strong or weak LTL fairness

assumptions need not be realizable while action-based can be realized by a scheduler.

n State-based LTL fairness assumptions are more general then action-based. 65

Linear Temporal Logic: Fairness in LTL (Con.)

n Theorem 5:30: For transition system TS without terminal state, LTL formula j, and LTL fairness assumption fair:n TS|=fair j iff TS|=(fair®j)

n Read Examples 5.28-30.

66

Automata-Based LTL Model Checkingn Given a finite transition system TS and

an LTL formula j (a requirement on TS), an LTL model-checking algorithm checks TS |= j:n If j is refuted, an error trace needs to be

returned.

67

Automata-Based LTL Model Checking (Con.)n In following, we assume that TS is finite

and has no terminal state.n The model-checking algorithm that we

are going to introduce is based on automata-based approach:n Each LTL formula j is represented by a

nondeterministic büchi automaton (NBA).n The basic idea is to disprove TS |= j by

looking for a path p in TS with p|= ¬j .68

Automata-Based LTL Model Checking (Con.)

n If such a path is found, a prefix of p is returned as error trace.

n If no such path is encountered, it is concluded that TS|=j.

n This Algorithm relies on following observation:

69


n Hence, for NBA A with Lw(A)=Words(¬j) we have :n TS |= j if and only if Traces(TS)ÇLw(A)=Æ.

n Thus, to check j holds for TS, we first construct an NBA for the negation of the input formula j and then look for their intersection TSÄA¬j.

70


n Thus the LTL model-checking algorithm is:

71


n Now it remains to show that how a given LTL property can be presented by an NBAand such an NBA can be constructedalgorithmically.n Recall that the LTL semantics yields a

language Words(j)Í(2AP)w. Thus the alphabet of NBA for LTL formulae is Σ=2AP.

n We show that Words(j) is ω-regular, and hence, can be represented by a NBA.

72

Automata-Based LTL Model Checking (Con.)n Example 5.32: The edges of a NBA

can be represented symbolically by propositional logics over symbols aÎAP, true and Boolean connectors. n Thus they can be interpreted over sets of

propositions AÎS=2AP.n If AP={a,b} then q aÚb q’ is a short

notation for the three transitions:n q {a} q’, q {b} q’, and q {a,b} q’ .

73


n The language of all words s=A0A1…Î2AP

satisfying the LTL formula □àgreen is accepted by the NBA below:

n A is in the accept state q1 if and only if the last consumed symbol (the last set Ai of the input word A0A1A2...∈(2AP)ω) contains the propositional symbol green.

74

Automata-Based LTL Model Checking (Con.)n The liveness property: “whenever event

a occurs, event b will eventually occur”. An associated NBA over the alphabet 2{a,b} is shown below:

75

Automata-Based LTL Model Checking (Con.)n To construct an NBA A satisfying

Lw(A)=Words(j) for the LTL formula j, first a generalized NBA is constructed for j, which subsequently is transformed into an equivalent NBA.

76


n The whole picture of LTL model checking:

77

Automata-Based LTL Model Checking (Con.)n Assume j only contains the operators Ù, ¬, � and U, i.e., the derived operators Ú, →, à, □, W and so on are assumed to be expressed in terms of the basic operators.n Since j=true is trivial, it may be assumed

that j¹true.

78

Automata-Based LTL Model Checking (Con.)n The basic idea to construct a GNBA over

the alphabet 2AP for a given LTL formula j (over AP), i.e., Lw(gj)=Words(j) is:n Let s=A0 A1 A2 …ÎWords(j).n The sets AiÍAP are expanded by

subformulae y (and their negation) of jsuch that an infinite word s=B0 B1 B2 … with the following property arises:

n yÎBi if and only if Ai Ai+1 Ai+2 …|=y79si

Automata-Based LTL Model Checking (Con.)n The GNBA gj is constructed such that Bi

constitute its states. n Moreover, the construction ensures that s=B0

B1 B2 … is a run for s= A0 A1 A2 … in Gj.n The accepting conditions for gj are chosen

such that the run s is accepting if and only if s|=j.

n We encode the meaning of the logical operators into the states, transitions and acceptance sets of Gj. 80

Automata-Based LTL Model Checking (Con.)n Let j= aU(¬aÙb) and s={a}{a,b}{b}…:

n Bi is a subset of the set of formulae {a,b,¬a,¬aÙb,j}È{¬b,¬(¬aÙb),¬j).

n The set A0={a} is extended with formulae ¬b, ¬(¬aÙb) and j, since all these formula hold in s0=s and all other subformulae in the above set are refuted by s.

n The set A1={a,b} is extended with the formulae ¬(¬aÙb) and j, as they hold in s1={a,b}{b}…. 81


n The A2={b} is extended with ¬a, ¬aÙb and j as they hold in s2={b}….

n These yield s= {a,¬b,¬(¬aÙb),j} {a,b,¬(¬aÙb),j} {¬a,b,¬aÙb,j}…

82

Automata-Based LTL Model Checking (Con.)n Definition: The closure of LTL formula j is the set closure(j) consisting of all subformulae y of j and their negation¬y (where y and ¬¬y are identical).n For instance, for j= aU(¬aÙb) , the

closure(j)={a,b,¬a,¬b, ¬aÙb,¬(¬aÙb),j, ¬j}.

n |closure(j)|ÎO(|j|)

83

Automata-Based LTL Model Checking (Con.)n B is consistent with respect to

propositional logic, i.e., for all ϕ1∧ϕ2,ψ∈closure(ϕ):n ϕ1∧ϕ2 ∈ B ⇒ ϕ1∈ B and ϕ2∈ Bn ψ∈B ⇒ ¬ψÏBn True ∈ closure(ϕ) ⇒ true ∈ B.

84


n B is locally consistent with respect to the until operator, i.e., for all ϕ1Uϕ2∈ closure(ϕ):n Φ2∈ B ⇒ ϕ1Uϕ2∈ Bn ϕ1Uϕ2∈ B and ϕ2 Ï B ⇒ ϕ1∈ B.

n B is maximal, i.e., for all ψ ∈ closure(ϕ):n ψÏB ⇒ ¬ψ∈B.

85

Automata-Based LTL Model Checking (Con.)n Definition: B⊆closure(j) is

elementary if it is consistent with respect to propositional logic, maximal, and locally consistent with respect to the until operator.

86

Automata-Based LTL Model Checking (Con.)n Example 5.35: let j=aU(¬aÙb):

n B0={a,b,j} is consistent with respect to propositional logic and locally consistent with respect to the until operator. But it is not maximal. Why?

n B1={a,b,¬aÙb,j} is not consistent with respect to propositional logic. Why?

n B2={a,b, ¬(¬aÙb), j} is an elementary set.

87

Automata-Based LTL Model Checking (Con.)n Let ϕ be an LTL formula over AP. Let

Gϕ=(Q,2AP,δ,Q0,F ) be its corresponding GNBA, where n Q is the set of all elementary sets of

formulae B⊆closure(ϕ),n Q0={B∈Q|ϕ∈B},n F ={Fϕ1Uϕ2|ϕ1Uϕ2∈closure(ϕ)} where

Fϕ1Uϕ2={B∈Q|ϕ1Uϕ2ÏB or ϕ2∈B}.

88


n The transition relation δ:Q×2AP→2Q is given by: n If A¹B∩AP, then δ(B,A)=∅. n If A=B∩AP, then δ(B,A) is the set of all

elementary sets of formulae B’ satisfying i. for every �ψ∈closure(ϕ): �ψ∈B⇔ψ∈B’, and ii. For every ϕ1Uϕ2∈closure(ϕ):

ϕ1Uϕ2∈B⇔(ϕ2∈B ∨ (ϕ1∈B ∧ϕ1Uϕ2∈B’)).

89

Automata-Based LTL Model Checking (Con.)n The conditions (i) and (ii) reflect the

semantics of the next step and the until operator, respectively. Rule (ii) is justified by the expansion rule:n ϕ1Uϕ2 º ϕ2∨ (ϕ1∧ �(ϕ1Uϕ2)).

90

Automata-Based LTL Model Checking (Con.)n To model the semantics of U, an

acceptance set Fψ is introduced for every subformula ψ=ϕ1Uϕ2 of ϕ.n Thus every run B0 B1 B2 ... for which

ψ∈B0, we have ϕ2∈Bj (for some j³0) and ϕ1∈Bi for all i<j.

n The requirement that a word σ satisfies ϕ1Uϕ2 only if ϕ2 will actually eventually become true is ensured by the accepting set Fϕ1Uϕ2. 91

Automata-Based LTL Model Checking (Con.)n Example 5.38: let j=�a. It

corresponding GNBA Gj is: n Q = {B1,B2,B3,B4} where B1={a,�a},

B2={a,¬�a}, B3={¬a,�a}, B4={¬a,¬�a},n Q0={B1,B3} since �aÎB1,B3,n 2{a}={Æ,{a}} and d is defined:

n B1Ç{a}={a}, so d(B1,{a})={B1,B2} since �aÎB1 and B1 and B2 are the only states that contain a.

n B1ÇÆ=Æ, so d(B1,Æ)=Æ. 92

Automata-Based LTL Model Checking (Con.)n The resulting GNBA is shown below:

n Read Example 5.39.93

Automata-Based LTL Model Checking (Con.)n Any state of the GNBA for an LTL

formula ϕ contains either ψ or its negation ¬ψ for every subformula ψ of ϕ.

n This is somewhat redundant. It suffices to represent state B∈closure(ϕ) by the propositional symbols a∈B∩AP, and the formulae �ψ or ϕ1Uϕ2∈B.

94

Automata-Based LTL Model Checking (Con.)n Having constructed a GNBA Gϕ for a

given LTL formula ϕ, an NBA for ϕ can be obtained by the transformation“GNBAàNBA” described Chapter 4.

95

Automata-Based LTL Model Checking (Con.)n Theorem: For any LTL formula ϕ (over

AP) there exists an NBA Aϕ with Words(ϕ)=Lω(Aϕ) which can be constructed in time and space 2O(|ϕ|).n It should be noted that the size of the

resulting GNBA grows up exponentiallywith respect to the size of formula.

96

Complexity of the LTL Model-checking problemn As explained before, the essential idea

behind the automata-based model-checking algorithm for LTL is based upon the following relations:

97

Complexity of the LTL Model-checking problem (Con.)

n The GNBA Gϕ has at most 2|ϕ| states with |ϕ| accepting states (the number of until-subformulas in ϕ).

n The NBA A¬ϕ can thus be constructed in exponential time: O(2|ϕ| ´|ϕ|)=O(2|ϕ|+log|ϕ|).

n Thus an upper bound for the time-and space-complexity of LTL model checking is O(|TS|´2|ϕ|).

98


n In general, the problem can be shown to be PSPACE-complete, the proof of which is rather involved.

n It is easy to show that the problem is coNP-hard.

99


n Consider an arbitrary directed graph G = (V, A) where V = {v1, …, vn}.

n We show that the problem of determining whether G has a directed Hamiltonian path is reducible to the problem of determining TS |¹ ϕ where TS and ϕ are to be defined later.

100


n ϕ is the formula (using the atomic propositions p1 , …, pn):

ϕ = ¬[àp1 Ù … Ù àpn Ù □(p1 → �□¬p1) Ù… Ù □(pn → �□¬pn)]

101


Let the transition system TS = (W, {τ}, ®, {w1}, AP, L) consist of:

§ W = V U {w1, w2} where ¬ (w1,w2 Î V).§ ® = {(u, τ, v) | (u, v) Î A} U {(w1,τ, vi) | vi ε V} U

{(vi, τ, w2) | vi ε V} U {(w2, τ, w2) } § AP = {p1, … pn}§ L is an assignment of propositions to states such that

• pi is true in vi for 1 ≤ i ≤ n• pj is false in vi for 1 ≤ i, j ≤ n, i ≠ j• pi is false in w1, w2 for 1 ≤ i ≤ n 102


n It is easy to show that TS |¹ ϕ if and only if there is a directed infinite path in TS starting at w1 that goes through all vi ε V exactly once and ends in the loop through w2.

103

LTL Model Checking with Fairnessn As a consequence of Theorem 5.30, the

model-checking problem for LTL with fairness assumptions can be reduced to the model-checking problem for plain LTL.n In order to check the formula ϕ under

fairness assumption fair, it suffices to verify the formula fair→ϕ with an LTL model-checking algorithm.

104

LTL Model Checking with Fairness (Con.)n The drawback of this approach is that

the length |fair| can have an exponential influence on the run-time of the algorithm.n The construction of an NBA for the

negated formula ¬(fair→ϕ) is exponential in |¬(fair→ϕ)|= |fair| + |ϕ|.

n To avoid this, a modified persistence check can be exploited to analyze TS⊗A¬ϕ (instead of TS⊗A¬(fair→ϕ)). 105

Ch5-Linear Temporal Logicce.sharif.edu/courses/96-97/2/ce665-1/resources/root... · 2018-05-01 ·...

Documents

Transcript of Ch5-Linear Temporal Logicce.sharif.edu/courses/96-97/2/ce665-1/resources/root... · 2018-05-01 ·...