Chapter 5: Linear Temporal Logic

Transcription

1 Chapter 5: Linear Temporal Logic Prof. Ali Movaghar Verification of Reactive Systems Spring 94

2 Outline We introduce linear temporal logic (LTL), a logical formalism that is suited for specifying LT properties. Then we go through a model-checking algorithm for LTL based on Bϋchi automata. 2

3 Linear Temporal Logic Correctness of reactive systems depends on the execution of the system and on fairness issues. Temporal logic is a suitable formalism for treating these aspects. Temporal logic extends propositional or predicate logic by modalities to specify infinite behavior of a reactive system. 3

4 Linear Temporal Logic (Con.) The elementary modalities of temporal logics include the operators: eventually (eventually in the future) always (now and forever in the future). The nature of time in temporal logics can be either linear or branching: 4

5 Linear Temporal Logic (Con.) In the linear view, at each moment in time there is a single successor moment. LTL (Linear Temporal Logic) is based on lineartime perspective. In the branching view, it has a branching, tree-like structure, where time may split into alternative course. CTL (Computational Tree Logic) is based on a branching-time view. 5

6 Linear Temporal Logic (Con.) A temporal logic allows for the specification of the relative order of events. But it does not support any means to refer to the precise timing of events. The car stops once the driver pushes the brake. The message is received after it has been sent. 6

7 Linear Temporal Logic (Con.) LTL may be used to express the timing for the class of synchronous systems in which all components proceed in a lockstop fashions. In this setting, a transition corresponds to the advance of a single time-unit. The time domain is discrete: the present moment refers to current state and the next moment corresponds to the next state. 7

8 Linear Temporal Logic: syntax LTL formulae over the set AP of atomic proposition are formed according to the following grammar: ::= true a U 2 where a AP., next : holds at the current moment if holds in the next state. U, until : 1U 2 holds at the current moment, if there is some future for which holds and holds at all moments until future moment. 8

9 Linear Temporal Logic: syntax (Con.) The precedence order on operators is as follows. The unary operators bind stronger than the binary ones. and bind equally strong. The temporal operator U takes precedence over,, and. 9

10 Linear Temporal Logic: syntax (Con.) Using the Boolean connectives and, the full power of propositional logic is obtained. The until operator allows to derive the temporal modalities and as follows: = true U and = ensures that will be true eventually the in future. is satisfied iff it id not the case that eventually holds. 10

11 Linear Temporal Logic: syntax (Con.) The intuitive meaning of temporal modalities are illustrated below: 11

12 Linear Temporal Logic: syntax (Con.) By combining and, new temporal modalities are obtained: a describes the property stating that at any moment j there is a moment i j at which a-state is visited. Thus a-state is visited infinitely often. a expresses that from moment j, only a- state are visited. Thus a-state is visited eventually forever. 12

13 Linear Temporal Logic: syntax (Con.) Example 5.2: properties for mutual exclusion problem: Safety property stating that P 1 and P 2 never simultaneously have access to their critical section: ( crit 1 crit 2 ). Liveness property stating each process P i is infinitely often in its critical section: ( crit 1 ) ( crit 2 ). Read examples 5.3 and

14 Linear Temporal Logic: syntax (Con.) Let denote the length of LTL formula in terms of the number of operators in. This can be easily defined by induction on the structure of: a AP has length 0; a b has length 2 and ( a)u(a b) has length 4. 14

15 Linear Temporal Logic: semantics LTL formula stands for properties of paths. The semantics of LTL formula is defined by a LT property. Then it is extended to an interpretation over paths and states of a LTS. 15

16 Linear Temporal Logic: semantics (Con.) Definition: Let be an LTL formula over AP. The LT property induced by is Words( )={ (2 AP ) = } where = (2 AP ) LTL is the smallest relation with the properties: 16

17 Linear Temporal Logic: semantics (Con.) For the derived operators and the expected result is : Derive semantics of and! 17

18 Linear Temporal Logic: semantics (Con.) Definition 5.7: Let TS=(S,Act,,I,AP,L ) be a transition system without terminal state, and let be a LTL formula over AP. For infinite path fragments of TS, the satisfaction relation is defined by = iff trace( ) = 18

19 Linear Temporal Logic: semantics (Con.) For state s S, the satisfaction relation = is defined by: s = iff ( Paths(s). = ) TS satisfies, denoted TS =, if Traces(TS) Words( ). 19

20 Linear Temporal Logic: semantics (Con.) From this definition, it immediately follows that: Thus, TS = iff s 0 = for all initial states s 0 of TS. 20

21 Linear Temporal Logic: semantics (Con.) Example 5.8: Consider the LTS below with the set of propositions AP={a,b} TS = a TS (a b) TS = ( b (a b)) TS b U (a b) 21

22 Linear Temporal Logic: semantics (Con.) Semantics of Negation: For paths, it holds = iff. Since Words( )=(2 AP ) \Words( ). However statements TS and TS = are not equivalent. Instead TS = implies TS. Note that : 22

23 Linear Temporal Logic: semantics (Con.) Thus it is possible that a LTS satisfies neither nor : Consider the TS below with AP={a}: TS a, since the initial path s 0 (s 2 ) a. TS a, since the initial path s 0 (s 1 ) =a, and thus s 0 (s 1 ) a. 23

24 Linear Temporal Logic: specifying properties Example 5.11: A modulo 4 counter can be represented by a sequential circuit C, which outputs 1 every fourth cycle, otherwise 0. Let the evaluation of r 1 r 2 denote i=2.r 1 +r2 C is constructed such that the output bit y is set exactly for i=0 (hence r 1 =0,r 2 =0). So r1 =r 1 r 2, r2 = r 1, y = r 1 r 2. 24

25 Linear Temporal Logic: specifying properties (Con.) The circuit C and its transition system TS C is shown below: 25

26 Linear Temporal Logic: specifying properties (Con.) Let AP={r 1,r 2,y}. The following statement holds: TSC = (y r 1 r 2 ) TSC = (r 1 ( y y)) TSC = (y ( y y)). The property that at least during every four cycles the output 1 id obtained holds for TS C : TSC = (y y y y). 26

27 Linear Temporal Logic: specifying properties (Con.) The fact that these outputs are produced in a periodic manner where every fourth cycle yields the output 1 is expressed as: TSC = (y ( y y y)). Read example

28 Linear Temporal Logic: specifying properties (Con.) Example 5.13: Leader election protocol: Goal: a process with a higher identifier is elected. Processes are initially inactive, and may become active and then participate in the election (fairness: each process becomes active at some time). If an inactive process with higher id becomes active, a new leader election takes place. 28

29 Linear Temporal Logic: specifying properties (Con.) We use LTS to specify some properties. Let AP={leader i,active i 1 i,j N}. There is always one leader: (\/ 1 i N leader i /\ 1 j N,j i leader j ) Since initially no leader exists we modify it to: (\/ 1 i N leader i /\ 1 j N,j i leader j ) But this allows there to be more than one leader at a time temporarily, so: ( /\ 1 i N (leader i /\ 1 j N,j i leader j )) ( (\/ 1 i N leader i ) 29

30 Linear Temporal Logic: specifying properties (Con.) In the presence of an active process with a higher identity, the leader will resign at some time: (/\ 1 i,j N,i<j ((leader i leader j active j ) leader i )) A new leader will be an improvement over the previous one: (/\ 1 i,j N,i j (leader i leader i leader j )) Read Example

31 Linear Temporal Logic: specifying properties (Con.) For synchronous systems LTL can be used as a formalism to specify real-time properties: states that at the next time instant holds. K =.. : holds after k time instants. k = \/ 0 i k i : will hold at most k time instants. 31

32 Linear Temporal Logic: specifying properties (Con.) k = \/ 0 i k i : holds now and will hold during the next k time instants. But for asynchronous systems the nextstep operator should be used with care. 32

33 Linear Temporal Logic: equivalence of LTL formulae Two formulae are intuitively equivalent whenever they have the same truthvalue under all interpretations. Definition: LTL formulae 1, 2 are equivalent, denoted 1 2, if Words( 1 )=Words( 2 ). 33

34 Linear Temporal Logic: equivalence of LTL formulae (Con.) As LTL subsumes propositional logic, equivalences of propositional logic also hold for LTL. For temporal modalities we have: 34

35 Linear Temporal Logic: equivalence of LTL formulae (Con.) 35

36 Linear Temporal Logic: equivalence of LTL formulae (Con.) The duality rule shows that next-step operator is dual to itself: In the absorption law : infinitely often is equal to from a certain point of time on, is true infinitely often. 36

37 Linear Temporal Logic: equivalence of LTL formulae (Con.) The distributive laws for and disjunction, or and conjunction are dual to each other: ( ) and ( ) Recall that ( ) and ( ) But (a b) a b and (a b) a b (the same holds for and ): 37

38 Linear Temporal Logic: equivalence of LTL formulae (Con.) The expansion laws describe the temporal modalities U, and by means of a recursive equivalence: These equivalences assert something about the current, and about the director successor state. U ( ( U )): so U is a solution of the equivalence k ( k). is a special case of the expansion law for until: 38

39 Linear Temporal Logic: equivalence of LTL formulae (Con.) Lemma 5.18 (Until is least solution of the expansion law): For LTL formulae and, Words( U ) is the least LT property P (2 AP ) such that: Words( ) {A 0,A 1,A 2 Words( ) A 1 A 2 P} P (I) Moreover, Words( U ) agrees with the set: Words( ) {A 0,A 1,A 2 Words( ) A 1 A 2 Words( U )}. 39

40 Linear Temporal Logic: equivalence of LTL formulae (Con.) The formulation least LT property satisfying condition (I) means that the following conditions hold: (1) P= Words( U ) satisfies (I). Words( U ) P for all LT properties P satisfying condition (I). 40

41 Linear Temporal Logic: weak, release and positive normal form Any LTL formula can be transformed into a canonical form, called positive normal form (PNF), in which: Negations only occur adjacent to atomic propositions. Recall that PNF formulae in propositional logic are constructed from true, false, the literals a and a, and the operators and. 41

42 Linear Temporal Logic: weak, release and positive normal form (Con.) To transform any LTL formula into PNF, for each operator a dual operator is needed in the syntax: True and false, and. The next-step operator is a dual of itself. Consider the until operator: ( U ) (( ) U ( )) ( ) 42

43 Linear Temporal Logic: weak, release and positive normal form (Con.) The operator W, called weak until or unless, as the dual of U: W ( U ). Until and W are dual in the following sense: Note that W has the same expresivness to U. W and U satisfy the same expansion law. 43

44 Linear Temporal Logic: weak, release and positive normal form (Con.) Lemma 5.19 (weak-until is the greatest solution of the expansion law) For LTL formulae and, Words( W ) is the greatest LT property P (2 AP ) such that: Words( ) {A 0,A 1,A 2 Words( ) A 1 A 2 P} P (I) Moreover, Words( U ) agrees with the set: Words( ) {A 0,A 1,A 2 Words( ) A 1 A 2 Words( W )}. 44

45 Linear Temporal Logic: weak, release and positive normal form (Con.) The formulation greatest LT property satisfying condition (I) means that the following conditions hold: (1) P Words( W ) satisfies (I). Words( W ) P for all LT properties P satisfying condition (I). 45

46 Linear Temporal Logic: weak, release and positive normal form (Con.) Definition: For a AP, the set of LTL formulae in weak-until positive normal form (weak-until PNF) is given by: ::= true false a a U 2 1 W 2 Since W false and true U, and can be also considered as permitted operator of W-PNF. 46

47 Linear Temporal Logic: weak, release and positive normal form (Con.) We can convert each LTL formula to its W-PNF by using the following rewrite rules: 47

48 Linear Temporal Logic: weak, release and positive normal form (Con.) Example 5.21: convert LTL formula ((aub) c) to weak-until PNF: ((aub) c) ((aub) c) ( (aub) c) ( (a b) W ( a b) c) 48

49 Linear Temporal Logic: weak, release and positive normal form (Con.) Theorem 5.22: For each LTL formula there exists an equivalent LTL formula in weak-until PNF. The main draw-back of rewrite rules is that the length of the resulting formula may be exponential in the length of the original nonpnf LTL formula: The rewrite rule for U and W, duplicates the operands. 49

50 Linear Temporal Logic: weak, release and positive normal form (Con.) We can avoid this exponential blow-up by using another temporal modality as the dual of until, called release and defined by : R = ( U ) R holds for a word if always holds, a requirement that is released as soon as becomes valid. 50

51 Linear Temporal Logic: weak, release and positive normal form (Con.) The always operator is obtained from the release operator : false R. The weak-until and the until operator are obtained by: W ( ) R ( ) and vice versa R ( ) W ( ) U ( R ) 51

52 Linear Temporal Logic: weak, release and positive normal form (Con.) Definition: For a AP, the set of LTL formulae in release positive normal form (release PNF) is given by: ::= true false a a U 2 1 R 2 Thus the rewrite rules are: 52

53 Linear Temporal Logic: weak, release and positive normal form (Con.) Theorem 5.24: For any LTL formula there exists an equivalent LTL formula in release PNF with =O( ). 53

54 Linear Temporal Logic: Fairness in LTL Definition: Let and be propositional logic formula over AP. 1. An unconditional LTL fairness constraint is an LTL formula of the form ufair=. 2. A strong LTL fairness condition is an LTL formula of the form ufair=. 3. A weak LTL fairness constraint is an LTL formula of the form wfair=. an LTL fairness assumption is a conjunction of LTL fairness constraints. 54

55 Linear Temporal Logic: Fairness in LTL (Con.) For instance, a strong LTL fairness assumption denote a conjunction of strong LTL fairness constraints: sfair = /\ 0<i k ( i i ) for propositional logic formulae i and i over AP. Generally LTL fairness assumptions are: fair = ufair sfair wfair 55

56 Linear Temporal Logic: Fairness in LTL (Con.) Let FairPaths(s) denote the set of all fair paths starting in s and FairTraces(s) the set of all traces induced by fair paths starting in s: FairPaths(s) ={ Paths(s) =fair} FairTraces(s) = {Trace( ) FairPaths(s)} Above definitions can be lifted to TSs yielding FairPaths(TS) and FairTraces(TS). 56

57 Linear Temporal Logic: Fairness in LTL (Con.) Definition: For state s in TS (over AP) without terminal state, LTL formula and LTL fairness assumptions fair let s = fair iff FairPaths(s). = and TS = fair iff s 0 I.s 0 = fair. TS satisfies under the LTL fairness assumption fair if holds for all fair paths that originate from some initial state. 57

58 Linear Temporal Logic: Fairness in LTL (Con.) Example 5.27: Consider the mutual exclusion with randomized arbiter: 58

59 Linear Temporal Logic: Fairness in LTL (Con.) Arbiter tosses a coin, modeled by nondeterministic choice between heads and tails, to choose a process to enters its critical section. process P i is in its critical section infinitely often : TS 1 Arbiter TS 2 crit 1 (why?) TS 1 Arbiter TS 2 = fair crit 1 crit 2 where fair= heads tails. 59

60 Linear Temporal Logic: Fairness in LTL (Con.) In chapter 3, fairness was introduced using set of actions: An execution is unconditionally A-fair for a set of actions A, whenever each action A occurs infinitely often. However LTL-fairness is defined on atomic propositions, i.e., from a statebased perspective. 60

61 Linear Temporal Logic: Fairness in LTL (Con.) Action-based fairness assumptions can always be translated into analogous LTL fairness assumption. The intuition is Make a copy of each non-initial state s such that it is recorded which action was executed to enter s. The copied state <s, > indicates that state s has been reached by performing as last action. 61

62 Linear Temporal Logic: Fairness in LTL (Con.) Formally for TS=(S,Act,,I,AP,L) let TS =(S,Act,,I,AP,L ) where Act=Act {begin}, I =I {begin}, S =I (S Act), TS is defined by : 62

63 Linear Temporal Logic: Fairness in LTL (Con.) L is defined: L (<s, >)=L(s) {taken( )} {enabled( ) Act(s)} L (<s 0,begin>)=L(s 0 ) {enabled( ) Act(s 0 )}. It can be established that Traces AP (TS)=Traces AP (TS ). Thus strong fairness for A Act can be described by LTL fairness assumption: sfair A = enabled(a) taken(a) enabled(a)=\/ A enabled( ), taken(a)=\/ A taken( ) 63

64 Linear Temporal Logic: Fairness in LTL (Con.) The set of fair traces of action-based fairness assumption F for TS and its corresponding LTL fairness fair for TS coincides: {Trace AP ( ) Paths(TS), is F-fair}= {TraceAP( ) Paths(TS ), = fair} Thus FairTraces F (TS)=FairTraces fair (TS ): TS = F P iff TS = fair P. 64

65 Linear Temporal Logic: Fairness in LTL (Con.) Conversely, a (state-based) LTL fairness assumptions cannot always be represented as action-based fairness assumption. Because strong or weak LTL fairness assumptions need not be realizable while action-based can be realized by a scheduler. State-based LTL fairness assumptions are more general then action-based. 65

66 Linear Temporal Logic: Fairness in LTL (Con.) Theorem 5:30: For transition system TS without terminal state, LTL formula, and LTL fairness assumption fair: TS = fair iff TS =(fair ) Read Examples

67 Automata-Based LTL Model Checking Given a finite transition system TS and an LTL formula (a requirement on TS), an LTL model-checking algorithm checks TS = : If is refuted, an error trace needs to be returned. 67

68 Automata-Based LTL Model Checking (Con.) In following, we assume that TS is finite and has no terminal state. The model-checking algorithm that we are going to introduce is based on automata-based approach: Each LTL formula is represented by a nondeterministic büchi automaton (NBA). The basic idea is to disprove TS = by looking for a path in TS with =. 68

69 Automata-Based LTL Model Checking (Con.) If such a path is found, a prefix of is returned as error trace. If no such path is encountered, it is concluded that TS =. This Algorithm relies on following observation: 69

70 Automata-Based LTL Model Checking (Con.) Hence, for NBA A with L (A)=Words( ) we have : TS = if and only if Traces(TS) L (A)=. Thus, to check holds for TS, we first construct an NBA for the negation of the input formula and then look for their intersection TS A. 70

71 Automata-Based LTL Model Checking (Con.) Thus the LTL model-checking algorithm is: 71

72 Automata-Based LTL Model Checking (Con.) Now it remains to show that how a given LTL property can be presented by an NBA and such an NBA can be constructed algorithmically. Recall that the LTL semantics yields a language Words( ) (2 AP ). Thus the alphabet of NBA for LTL formulae is Σ=2 AP. We show that Words( ) is ω-regular, and hence, can be represented by a NBA. 72

73 Automata-Based LTL Model Checking (Con.) Example 5.32: The edges of a NBA can be represented symbolically by propositional logics over symbols a AP, true and Boolean connectors. Thus they can be interpreted over sets of propositions A =2 AP. If AP={a,b} then q a b q is a short notation for the three transitions: q {a} q, q {b} q, and q {a,b} q. 73

74 Automata-Based LTL Model Checking (Con.) The language of all words =A 0 A 1 2 AP satisfying the LTL formula green is accepted by the NBA below: A is in the accept state q 1 if and only if the last consumed symbol (the last set A i of the input word A 0 A 1 A 2... (2 AP ) ω ) contains the propositional symbol green. 74

75 Automata-Based LTL Model Checking (Con.) The liveness property: whenever event a occurs, event b will eventually occur. An associated NBA over the alphabet 2 {a,b} is shown below: 75

76 Automata-Based LTL Model Checking (Con.) To construct an NBA A satisfying L (A)=Words( ) for the LTL formula, first a generalized NBA is constructed for, which subsequently is transformed into an equivalent NBA. 76

77 Automata-Based LTL Model Checking (Con.) The whole picture of LTL model checking: 77

78 Automata-Based LTL Model Checking (Con.) Assume only contains the operators,, and U, i.e., the derived operators,,,, W and so on are assumed to be expressed in terms of the basic operators. Since =true is trivial, it may be assumed that true. 78

79 Automata-Based LTL Model Checking (Con.) The basic idea to construct a GNBA over the alphabet 2 AP for a given LTL formula (over AP), i.e., L (g )=Words( ) is: Let =A 0 A 1 A 2 Words( ). The sets A i AP are expanded by subformulae (and their negation) of such that an infinite word =B 0 B 1 B 2 with the following property arises: B i if and only if A i A i+1 A i+2 = i 79

80 Automata-Based LTL Model Checking (Con.) The GNBA g is constructed such that B i constitute its states. Moreover, the construction ensures that =B 0 B 1 B 2 is a run for = A 0 A 1 A 2 in G. The accepting conditions for g are chosen such that the run is accepting if and only if =. We encode the meaning of the logical operators into the states, transitions and acceptance sets of G. 80

81 Automata-Based LTL Model Checking (Con.) Let = au( a b) and ={a}{a,b}{b} : B i is a subset of the set of formulae {a,b, a, a b, } { b, ( a b), ). The set A 0 ={a} is extended with formulae b, ( a b) and, since all these formula hold in 0 = and all other subformulae in the above set are refuted by. The set A 1 ={a,b} is extended with the formulae ( a b) and, as they hold in 1 ={a,b}{b}. 81

82 Automata-Based LTL Model Checking (Con.) The A 2 ={b} is extended with a, a b and as they hold in 2 ={b}. These yield = {a, b, ( a b), } {a,b, ( a b), } { a,b, a b, } 82

83 Automata-Based LTL Model Checking (Con.) Definition: The closure of LTL formula is the set closure( ) consisting of all subformulae of and their negation (where and are identical). For instance, for = au( a b), the closure( )={a,b, a, b, a b, ( a b),, }. closure( ) O( ) 83

84 Automata-Based LTL Model Checking (Con.) B is consistent with respect to propositional logic, i.e., for all ϕ 1 ϕ 2, ψ closure(ϕ): ϕ 1 ϕ 2 B ϕ 1 B and ϕ 2 B ψ B ψ B True closure(ϕ) true B. 84

85 Automata-Based LTL Model Checking (Con.) B is locally consistent with respect to the until operator, i.e., for all ϕ 1 Uϕ 2 closure(ϕ): Φ 2 B ϕ 1 Uϕ 2 B ϕ 1 Uϕ 2 B and ϕ 2 B ϕ 1 B. B is maximal, i.e., for all ψ closure(ϕ): ψ B ψ B. 85

86 Automata-Based LTL Model Checking (Con.) Definition: B closure( ) is elementary if it is consistent with respect to propositional logic, maximal, and locally consistent with respect to the until operator. 86

87 Automata-Based LTL Model Checking (Con.) Example 5.35: let =au( a b): B 0 ={a,b, } is consistent with respect to propositional logic and locally consistent with respect to the until operator. But it is not maximal. Why? B 1 ={a,b, a b, } is not consistent with respect to propositional logic. Why? B 2 ={a,b, ( a b), } is an elementary set. 87

88 Automata-Based LTL Model Checking (Con.) Let ϕ be an LTL formula over AP. Let G ϕ =(Q,2 AP,δ,Q 0,F ) be its corresponding GNBA, where Q is the set of all elementary sets of formulae B closure(ϕ), Q 0 ={B Q ϕ B}, F ={F ϕ1uϕ2 ϕ 1 Uϕ 2 closure(ϕ)} where F ϕ1uϕ2 ={B Q ϕ 1 Uϕ 2 B or ϕ 2 B}. 88

89 Automata-Based LTL Model Checking (Con.) The transition relation δ:q 2 AP 2 Q is given by: If A B AP, then δ(b,a)=. If A=B AP, then δ(b,a) is the set of all elementary sets of formulae B satisfying i. for every ψ closure(ϕ): ψ B ψ B, and ii. For every ϕ 1 Uϕ 2 closure(ϕ): ϕ 1 Uϕ 2 B (ϕ 2 B (ϕ 1 B ϕ 1 Uϕ 2 B )). 89

90 Automata-Based LTL Model Checking (Con.) The conditions (i) and (ii) reflect the semantics of the next step and the until operator, respectively. Rule (ii) is justified by the expansion rule: ϕ 1 Uϕ 2 ϕ 2 (ϕ 1 (ϕ 1 Uϕ 2 )). 90

91 Automata-Based LTL Model Checking (Con.) To model the semantics of U, an acceptance set F ψ is introduced for every subformula ψ=ϕ 1 Uϕ 2 of ϕ. Thus every run B 0 B 1 B 2... for which ψ B 0, we have ϕ 2 B j (for some j 0) and ϕ 1 B i for all i<j. The requirement that a word ζ satisfies ϕ 1 Uϕ 2 only if ϕ 2 will actually eventually become true is ensured by the accepting set F ϕ1uϕ2. 91

92 Automata-Based LTL Model Checking (Con.) Example 5.38: let = a. It corresponding GNBA G is: Q = {B 1,B 2,B 3,B 4 } where B 1 ={a, a}, B 2 ={a, a}, B 3 ={ a, a}, B 4 ={ a, a}, Q 0 ={B 1,B 3 } since a B 1,B 3, 2 {a} ={,{a}} and is defined: B 1 {a}={a}, so (B 1,{a})={B 1,B 2 } since a B 1 and B 1 and B 2 are the only states that contain a. B 1 =, so (B 1, )=. 92

93 Automata-Based LTL Model Checking (Con.) The resulting GNBA is shown below: Read Example

94 Automata-Based LTL Model Checking (Con.) Any state of the GNBA for an LTL formula ϕ contains either ψ or its negation ψ for every subformula ψ of ϕ. This is somewhat redundant. It suffices to represent state B closure(ϕ) by the propositional symbols a B AP, and the formulae ψ or ϕ 1 Uϕ 2 B. 94

95 Automata-Based LTL Model Checking (Con.) Having constructed a GNBA G ϕ for a given LTL formula ϕ, an NBA for ϕ can be obtained by the transformation GNBA NBA described Chapter 4. 95

96 Automata-Based LTL Model Checking (Con.) Theorem: For any LTL formula ϕ (over AP) there exists an NBA A ϕ with Words(ϕ)=L ω (A ϕ ) which can be constructed in time and space 2 O( ϕ ). It should be noted that the size of the resulting GNBA grows up exponentially with respect to the size of formula. 96

97 Complexity of the LTL Modelchecking problem As explained before, the essential idea behind the automata-based modelchecking algorithm for LTL is based upon the following relations: 97

98 Complexity of the LTL Modelchecking problem (Con.) The GNBA G ϕ has at most 2 ϕ states with ϕ accepting states (the number of untilsubformulas in ϕ). The NBA A ϕ can thus be constructed in exponential time: O(2 ϕ ϕ )=O(2 ϕ +log ϕ ). Thus an upper bound for the time-and space-complexity of LTL model checking is O( TS 2 ϕ ). 98

99 Complexity of the LTL Modelchecking problem (Con.) In general, the problem can be shown to be PSPACE-complete, the proof of which is rather involved. It is easy to show that the problem is conp-hard. 99

100 Complexity of the LTL Modelchecking problem (Con.) Consider an arbitrary directed graph G = (V, A) where V = {v 1,, v n }. We show that the problem of determining whether G has a directed Hamiltonian path is reducible to the problem of determining TS ϕ where TS and ϕ are to be defined later. 100

101 Complexity of the LTL Modelchecking problem (Con.) ϕ is the formula (using the atomic propositions p 1,, p n ): ϕ = [ p 1 p n (p 1 p 1 ) (p n p n )] 101

102 Complexity of the LTL Modelchecking problem (Con.) Let the transition system TS = (W, {η},, {w 1 }, AP, L) consist of: W = V U {w 1, w 2 } where (w 1,w 2 V). = {(u, η, v) (u, v) A} U {(w 1,η, v i ) v i ε V} U {(v i, η, w 2 ) v i ε V} U {(w 2, η, w 2 ) } AP = {p 1, p n } L is an assignment of propositions to states such that p i is true in v i for 1 i n p j is false in v i for 1 i, j n, i j p i is false in w 1, w 2 for 1 i n 102

103 Complexity of the LTL Modelchecking problem (Con.) It is easy to show that TS ϕ if and only if there is a directed infinite path in TS starting at w 1 that goes through all v i ε V exactly once and ends in the loop through w

104 LTL Model Checking with Fairness As a consequence of Theorem 5.30, the model-checking problem for LTL with fairness assumptions can be reduced to the model-checking problem for plain LTL. In order to check the formula ϕ under fairness assumption fair, it suffices to verify the formula fair ϕ with an LTL model-checking algorithm. 104

105 LTL Model Checking with Fairness (Con.) The drawback of this approach is that the length fair can have an exponential influence on the run-time of the algorithm. The construction of an NBA for the negated formula (fair ϕ) is exponential in (fair ϕ) = fair + ϕ. To avoid this, a modified persistence check can be exploited to analyze TS A ϕ (instead of TS A (fair ϕ) ). 105