COMPUTER SCIENCE TEMPORAL LOGICS NEED THEIR CLOCKS

Transcription

1 Bulletin of the Section of Logic Volume 18/4 (1989), pp reedition 2006 [original edition, pp ] Ildikó Sain COMPUTER SCIENCE TEMPORAL LOGICS NEED THEIR CLOCKS In this paper we solve some open problems raised in recent publications of the Computer Science Temporal Logic school represented by Manna-Pnueli [11], [12], Abadi-Manna [5], Abadi [1]-[4]. These problems concern the proof theoretic powers of the following inference systems: T 0 introduced in [11], [12] and reformulated in [1]-[4]; the resolution system R of [5]; and T 1, T 2 of [1]-[4]. We use first-order temporal logic (FTL) with modalities, [F ], and U denoting nexttime, always-in-the-future, and until respectively. Given a first-order similarity type or language L, the usual predicate etc. symbols of L are considered to be rigid, i.e. their meanings do not change in time. Similarly, individual variables x i (i ω) are rigid. To this we add an infinity y i (i ω) of flexible constants. That is, the meaning of y i is allowed to change in time. Other authors, see e.g. Abadi [1]-[4], add flexible predicates too, but we will not need them here though we will mention them occasionally. Our theorems remain true even if we allow flexible predicateand function symbols, as it will be very easy to see. F m(f T L) denotes the set of all FTL-formulas (of some fixed similarity type L) defined above. For semantic purposes, we use classical two-sorted models M = < T, D, f 0,..., f i,... > i ω where D is a classical first-order structure of similarity type L, T = < T, 0, suc,, +, > is a structure of the same similarity type as the standard model N = < ω, 0, suc,, +, > of arithmetic, and for i ω, f i, a function from T into D, serves to interpret the flexible constant y i. T is called the time-frame of M, and, except for its language, is arbitrary. Mod denotes the class of all models M of the above kind. (The members of Mod are basically the same as Kripke models known from the

2 154 Ildikó Sain traditional literature of FTL, cf. [10]. The next definition also agrees with the tradition of philosophical logic [10].) To associate meanings to FTL-formulas in models from M od, we define a translation function P : F m(f T L) F mc(mod), where F mc(m od) is the set of all classical (two-sorted) first-order formulas in the language of mod. In F mc(mod), x i (i ω) are the variables of sort D (data), and t i (i ω) are variables of sort T (time). We may assume that all occurrences of the flexible constants y i are of the form y i = x j in the FTL-formulas (every formula is easily seen to be equivalent with one of this form as it is well known, cf. [8]). For any ϕ F m(f T L), we let P (ϕ) def = t 0 [t 0 = 0 P (ϕ, t 0 )], where P : F m(f T L) {t i : i ω} F mc(mod) is defined as follows: For every t {t i : i ω} and ϕ, ψ F m(f T L), P (y i = x j, t) def = (f i (t) = x j ), P (ψ, t) def = ψ whenever ψ is atomic and does not contain flexible symbols, P preserves classical connectives and quantifiers (i.e.: P ( x i ϕ, t) def = x i P (ϕ, t) etc.), and P ( ϕ, t) def = t 1 [t 1 = suc(t) P (ϕ, t 1 )], P ([F ]ϕ, t) def = ( t 1 t)p (ϕ, t 1 ), P (ϕuψ, t) def = ( t 1 t)(p (ϕ, t 1 ) t 2 [t t 2 t 1 P (ψ, t 2 )]). This completes the definition (by recursion) of the translation functions P and P. We let M = ϕ def M = P (ϕ), for any ϕ F m(f T L). Here, M = P (ϕ) is understood in the usual classical sense. For any K Mod, we let K = ϕ def ( M K) M = ϕ. A model M = < T,... > is called a standard-time model iff T is the standard model N of arithmetic. For any ϕ F m(f T L), = ω ϕ is defined to hold iff ϕ is valid in every standard-time model. The semantics = ω ϕ is too restrictive, while Mod = ϕ is too general.

3 Computer Science Temporal Logics Need Their Clocks 155 Therefore, as usual in modal- and temporal logic, we introduce first-order axiomatizable subclasses of M od, and will use these for semantic purposes. To this end, we recall three sets Ind, T ord, T pa F mc(mod) of postulates called induction, ordering of time, and Peano s arithmetic for time respectively. These are used in the literature for singling out workable model classes (i.e. semantics) for FTL. Ind def = {ϕ(0) t[ϕ(t) ϕ(suc(t))] tϕ(t) : ϕ F mc(mod)}, where ϕ(0) is obtained from ϕ by replacing the free occurrences of t in ϕ with 0, and similarly for ϕ(suc(t)). Since ϕ(t) may contain free variables other than t, this induction allows the use of parametres. T pa denotes the usual set of Peano s axioms for the sort (or structure) T. T ord postulates the consequences of T pa for the reduct < T, 0, suc, > of T. So, the main difference between T ord and T pa is that T ord ignores + and. Thus when using (Ind + T ord) as semantics, we will pretend that + and are not there. See the 1977 version of [6] or [7] for more detail, where the present approach (including P and P ) to FTL was first introduced (adapting the standard methodology of philosophical logic to Computer Science Temporal Logics). Later Abadi [1]-[4] adopted the same definitions from [6] etc. with some notational differences to be indicated soon. For any T h F mc(mod) and ϕ F m(f T L), we let Mod(T h) def = {M Mod : M = T h}, and T h = ϕ def Mod(T h) = ϕ. Now, the two most frequently used semantics for FTL-formulas ϕ are (Ind + T ord) = ϕ and (Ind + T pa) = ϕ. Abadi [1]-[4] writes 0 P (ϕ) and P P (ϕ) for (Ind + T ord) = ϕ and (Ind + T pa) = ϕ respectively. Further, he writes = ϕ for our = ω ϕ. Next we will consider inference systems for FTL. Our theorems will be about arbitrary inference systems satisfying certain general conditions (see conditions (a), (a ), (b) in Theorem 1 below). However, as special cases of these, we will consider four concrete inference systems, T 0, R, T 1, and T 2 introduced in Manna-Pnueli [11], [12], Abadi-Manna [5], Abadi [1]-[4]. Our theorems solve, among others, open problems raised about these in the quoted papers. Let be an inference system for FTL. Let K Mod. We say that is

4 156 Ildikó Sain complete for (K =) iff ϕ F m(f T L)(K = ϕ = ϕ). We say that is sound for (K =) iff ϕ F m(f T L)(K = ϕ = ϕ). If Σ F mc(mod) then, instead of (M od(σ) =), we sometimes write (Σ =). That is, is complete (sound) for (Σ =) means that is complete (sound) for (Mod(Σ) =). For brevity, we often write K and Σ for the semantics (K =) and (Σ =) respectively. Let γ(x) F m(f T L) with x = x 0,..., x n as free variables. Recall from Parikh [13] and Abadi [1]-[4] that the clock condition C(γ) for γ is the FTL-formula C(γ) def = ([F ] xγ(x) [F ] x[γ(x) [F ] γ(x)]). Intuitively, C(γ) says that γ distinguishes different time instances from each other. Let be an arbitrary inference system for FTL. An FTL-formula ϕ is said to be arithmetical in iff there is γ F m(f T L) with ( (C(γ) ϕ) = ϕ), see Abadi [1]-[4]. That is, ϕ is not arithmetical in if C(γ) is really useful in proving ϕ, i.e. if (C(γ) ϕ) for all γ, but ϕ. Thus there are many arithmetical formulas: if ϕ or if (C(γ) ϕ) for some γ then ϕ is arithmetical in. Also, any formula of the form (C(γ) ϕ) is arithmetical (under very mild assumptions on ). A natural example for a non-arithmetical formula is x x 1 (x x 1 ). But this formula is not valid. It is much harder to find a non-arithmetical ϕ such that = ω ϕ. Indeed: 6 Clocks and arithmetical formulas of [2] contains a question asking for more subtle examples of non-arithmetical formulas. In Theorem 1 below we will answer this question by exhibiting a nonarithmetical (in any of T 0,..., T 2 ) temporal formula which is valid in all standard-time models. (We note, however, that among rigid formulas there are no more subtle examples in the sense that for any rigid formula ϕ, ϕ is not arithmetical in iff Mod = x 0... x n ( {x i x j : i < j n} ϕ) for some n ω but Mod = ϕ.) This quest for a more subtle nonarithmetical formula seems to be implicit in all of [1]-[4]. Namely, each of these papers contains a theorem stating that ( ) ϕ F m(f T L)[( = ω ϕ) = (ϕ is arithmetical in T 2 )]. (See Thm somewhere around p. 60 in [2], the theorem on p. 127 of [1], Thm on p. 75 of [3], the second theorem in 6 of [4], p. 12.)

5 Computer Science Temporal Logics Need Their Clocks 157 Unfortunately, ( ) turns out to be false below. Probably, it was the lack of a timely answer to the above quoted open problem which had lead to the belief in the truth of ( ) above. Unfortunately, the new discovery influences the status of the strongest available (by now) temporal inference system which was designed to be equivalent with Peano s arithmetic (cf. e.g. the Author s abstract and Capsule review at the beginning of the preprint version of [2], as well as Thm. 7.2 therein), but which turns out to be not yet strong enough for this purpose in Remark 3 way below. The more subtle example for a non-arithmetical temporal formula in Theorem 1 below is a formula valid in standard-time models, but not valid in (Ind + T pa). Also, in [1], [2], Abadi asks if T 1 is complete for (Ind + T ord). This, by using a theorem of Abadi, is equivalent with asking whether there is a formula not arithmetical in T 1 but valid in (Ind+T ord). The latter problem remains open. Theorem 1. (i) There is an FTL-sentence ψ such that = ω ψ, and ψ is not arithmetical in any of T 0, R, T 1, or T 2. (ii) There is an FTL-sentence ψ such that = ω ψ, and ψ is not arithmetical in any proof system satisfying (a) and (b) below. (a) is sound for (Ind + T pa). (b) is complete for Mod, for any ϕ F m(f T L), [ϕ [F ](ϕ ϕ)] [F ]ϕ, and [F ]ϕ (ϕ [F ]ϕ), further is closed under the rules of modus ponens and necessitation, i.e. ϕ implies both [F ]ϕ and ϕ. (iii) In (ii) above, (a) can be replaced with the following condition. (a ) The -provable formulas form a recursively enumerable set, and is sound for = ω. Outline of proof: Let P A 0 denote a sufficiently strong finite part of Peano s axioms (P A) for N = ω, 0, suc,, +,. E.g.: P A 0 states that is a linear discrete ordering, its usual relationship with suc, 0, and +, further the recursive definition of + and from suc. Let (P A b) be obtained from P A 0 by replacing the axiom stating that there is no greatest element by { x(x b), suc(b) = b}. So, (P A b) states that b is the greatest element, but arithmetic (+,, etc.) between 0 and b is the usual. Let ϕ 0 be the following temporal sentence:

6 158 Ildikó Sain (P A b) y 0 = 0 [F ] x[x = y 0 y 0 = suc(x)] F y 0 = b. Let δ(x) be a Σ 0 -formula in the language of P A, such that xδ(x) is the usual formalization of Con(P A) in P A. We define ψ to be the temporal sentence ϕ 0 ( x < b)δ(x). We claim that ψ satisfies the conclusion of (ii). Of this, = ω ψ and ψ are not hard to prove. The proof of C(γ) ψ goes by temporal induction. The inductive hypothesis is x(x = y 0 F [F ]( x x)γ(x)). Now, (i) follows from (ii). In the proof of (iii) we choose δ differently. We recall from Abadi [1]-[4] (see the Open questions sections), that adding a clock to is defined as introducing a new rule ( (C(c(x) ϕ) ϕ), where c is a flexible predicate symbol not occurring in ϕ F m(f T L). We call such a rule a clock rule. The reason we did not allow flexible predicate symbols in our language was only to keep things simple: It is straightforward how to introduce flexible predicate symbols, and give meanings to them. The reader not wanting to change the language introduced so far may replace, in the definition of a clock rule, c(x) with y i = x 0 where y i does not occur in ϕ. Theorem 2 below is true for both versions. As pointed out in the quoted papers, a clock rule can be sound for models having infinite data domains ( D ω) only. Hence, whenever clock rules are considered, we automatically restrict the semantical considerations to models with infinite data domains. So when considering clock rules we will use the semantics (Ind + T pa+ D ω ) instead of the original (Ind + T pa), and similarly for T ord. It is proved in Abadi [1]-[4] that T 1 and T 2 are complete for (Ind + T ord) and (Ind + T pa) respectively, if we consider arithmetical formulas only. Hence, if we add clocks to T 1 and T 2, then the new systems become complete for (Ind + T ord) and (Ind + T pa) respectively. However, we have to pay an unexpected price for this: by Theorem 2 (iii) below, the new systems are not sound for (Ind + T pa + D ω ), while the original ones were sound. This seems to contradict 9 Open questions of [1], [2], where Abadi writes that adding a clock to T 1 is harmless. The last sentence in the Open questions sections of [1]-[4] asks if a clock adds power to T 1 or R. (The question is understood modulo infinite data domains, of course.) Theorem 2 below answers this question in the affirmative. Ti, and R denote provability in T i and R respectively (i {0, 1, 2}).

7 Computer Science Temporal Logics Need Their Clocks 159 Theorem 2. (i) The inference systems R and T 1 become stronger if we add clocks to them. That is, for { R, T1 }, ( ) there is a ϕ F m(f T L) with = ω, ϕ, but (C(c(x)) ϕ). (ii) Adding a clock adds power to any proof system satisfying (a ) and (b) of Theorem 1. I.e.: ( ) above holds for any satisfying (a ) and (b). (iii) If we add a clock rule to any satisfying (b) in Theorem 1, then the so reinforced system is not sound for (Ind + T pa + D ω ). In particular, if we add clocks to R or T1 then the so reinforced system is not sound for the semantics denoted by 0 or for the one denoted by P in Abadi [1]-[4] (even if 0 and P are restricted to infinite data domains). Remark 3. Theorem 1 (i) above proves that Thm. 6.2 of Abadi [2] and the theorem on p. 127 of [1] which is basically the same as Thm on p. 75 of [3] saying that: ( ) ( = ω ϕ) = (ϕ is arithmetical in T 2 ) are not true. The main result of these works, completeness of the inference system T2, for Abadi s semantics P (which is our (Ind + T pa =) ) is based on the above disproved theorem. In more detail, ( ) is used in all three papers to prove the main completeness theorem (for T 2 ) which is the second statement of Thm. 7.2 in Abadi [2]. Unfortunately, this application of ( ) turns out to be essential for proving completeness of T 2. Namely, a modified version of our counterexample ψ constructed in the proof of Theorem 1 (i), (ii) can be used to show that T 2 is indeed not complete for Abadi s P that is for (Ind + T pa =). This modified version of ψ is analogous to the counterexample in Biró-Sain [9]. Open problem. Find a nice, Hilbert-style inference system for FTL which is sound and complete for (Ind + T pa =) i.e. for Abadi s P. References [1] M. Abadi, The power of temporal proofs, Proceedings of the Second Annual IEEE Symposium on Logic in Computer Science, Ithaca, NY, USA (1987), pp , full version of this is: [2].

8 160 Ildikó Sain [2] M. Abadi, The power of temporal proofs, Theoretical Computer Science Vol 64 (1989), pp [3] M. Abadi, Temporal-Logic Theorem Proving, Dissertation, Stanford Univ., Dept. of Comp. Sci. (1987). [4] M. Abadi, Temporal logic was incomplete only temporarily, Preprint. [5] M. Abadi, Z. Manna, A timely resolution, First Annual Symposium on Logic in Computer Science (1986), pp [6] H. Andréka, I. Németi, I. Sain, Henkin-type semantics for program schemes to turn negative results to positive, [in:] Fundamentals of Computation Theory 79, ed.: L. Budach (Proc. Conf. Berlin 1979) Akademie Verlag, Berlin Band 2 (1979), pp [7] H. Andréka, I. Németi, I. Sain, A complete logic for reasoning about programs via nonstandard model theory, Parts I-II, Theoretical Computer Science Vol 17 No 2, 3 (1982), pp and pp [8] J. L. Bell, M. Machower, A course in mathematical logic, North-Holland (1977). [9] B. Biró, I. Sain, Peano Arithmetic for the Time Scale of Nonstandard Models for Logics of Programs, Annals of Pure and Applied Logic, to appear. [10] D. Gabbay, F. Guenther, (eds), Handbook of philosophical logic Vol II, D.Reidel Publ. Co. (1984). [11] Z. Manna, A. Pnueli, The modal of programs, International Colloquium on Automata, Languages and Programming 79, Graz, Springer Lecture Notes in Computer Science Vol 71 (1979), pp [12] Z. Manna, A. Pnueli, Verification of concurrent programs: A temporal proof system, Report No. STAN-CS , Comp. Sci. Dept., Stanford Univ. (June 1983). [13] R. Parikh, A decidability result for second order process logic, IEEE Symp. on Foundation of Computer Science (1978), pp This work has been supported by the Hungarian National Foundation for Scientific Research Grant No Mathematical Institute Hungarian Academy of Sciences Budapest, Pf. 127 H-1364 Hungary