Duration Calculus Introduction

Transcription

1 Duration Calculus Introduction Michael R. Hansen Informatics and Mathematical Modelling Technical University of Denmark Computability and Semantics, Spring 05, c Michael R. Hansen p.1/26

2 Overview Background Short introduction Decidability results Undecidability results Computability and Semantics, Spring 05, c Michael R. Hansen p.2/26

3 Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

4 Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli, Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

5 Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli,... Duration of states Duration Calculus Zhou Hoare Ravn Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

6 Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli,... Duration of states Duration Calculus Zhou Hoare Ravn 91 an Interval Temporal Logic Halpern Moszkowski Manna Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

7 Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli,... Duration of states Duration Calculus Zhou Hoare Ravn 91 an Interval Temporal Logic Halpern Moszkowski Manna Logical Calculi, Applications, Mechanical Support Duration Calculus: A formal approach to real-time systems Zhou Chaochen and Michael R. Hansen Springer Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

8 Gas Burner example: Requirements State variables modelling Gas and Flame: G, F : Time {0, 1} State expression modelling that gas is Leaking L = G F Requirement Gas must at most be leaking 1/20 of the elapsed time (e b) 60 s 20 e L(t)dt (e b) b Computability and Semantics, Spring 05, c Michael R. Hansen p.4/26

9 Gas Burner example: Design decisions Leaks are detectable and stoppable within 1s: where c, d : b c < d e.(l[c, d] (d c) 1 s) P [c, d] = d P (t) = (d c) > 0 c which reads P holds throughout [c, d] Computability and Semantics, Spring 05, c Michael R. Hansen p.5/26

10 Gas Burner example: Design decisions Leaks are detectable and stoppable within 1s: where c, d : b c < d e.(l[c, d] (d c) 1 s) P [c, d] = d P (t) = (d c) > 0 c which reads P holds throughout [c, d] At least 30s between leaks: c, d, r, s : b c < r < s < d e. (L[c, r] L[r, s] L[s, d]) (s r) 30 s Computability and Semantics, Spring 05, c Michael R. Hansen p.5/26

11 Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

12 Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop φ : Intv {tt,ff} Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

13 Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop φ : Intv {tt,ff} Chop: φ ψ {}}{ b m e } {{ }} {{ } φ ψ for some m : b m e Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

14 Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop Chop: φ ψ {}}{ b m e } {{ }} {{ } φ ψ φ : Intv {tt,ff} for some m : b m e In DC: Intv = { [a, b] a, b R a b} Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

15 Duration Calculus [Zhou Hoare Ravn 91] State variables P : Time {0, 1} Finite Variablilty State expressions S ::= 0 1 P S S 1 S 2 S : Time {0, 1} pointwise defined Computability and Semantics, Spring 05, c Michael R. Hansen p.7/26

16 Duration Calculus [Zhou Hoare Ravn 91] State variables P : Time {0, 1} Finite Variablilty State expressions S ::= 0 1 P S S 1 S 2 S : Time {0, 1} pointwise defined Durations S : Intv R defined on [b, e] by e b S(t)dt Temporal variables with a structure Computability and Semantics, Spring 05, c Michael R. Hansen p.7/26

17 Example: Gas Burner Requirement l L l Design decisions D 1 = ( L l 1) D 2 = (( L L L ) l 30) where l denotes the length of the interval, and φ = true φ true for some sub-interval: φ φ = φ for all sub-intervals: φ P = P = l l > 0 P holds throughout a non-point inter Computability and Semantics, Spring 05, c Michael R. Hansen p.8/26

18 Example: Gas Burner Requirement l L l Design decisions D 1 = ( L l 1) D 2 = (( L L L ) l 30) where l denotes the length of the interval, and φ = true φ true for some sub-interval: φ φ = φ for all sub-intervals: φ P = P = l l > 0 P holds throughout a non-point inter succinct formulation no interval endpoints Computability and Semantics, Spring 05, c Michael R. Hansen p.8/26

19 Correctness informal interval reasoning We must establish: (D 1 D 2 ) l L l Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

20 Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l {}}{ b e We must establish: (D 1 D 2 ) l L l Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

21 Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l {}}{ b e Note that (D 1 D 2 ) (l 30 L 1): L 1 {}}{ L 1 L 1 {}}{... L 1 {}}{}}{ b e }{{} L n + 1 We must establish: (D 1 D 2 ) l L l Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

22 Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l {}}{ b e Note that (D 1 D 2 ) (l 30 L 1): L 1 {}}{ L 1 L 1 {}}{... L 1 {}}{}}{ b e }{{} L n + 1 Since n 2 20 (n + 1) 30 n we have (D 1 D 2 ) l L l Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

23 Decidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Computability and Semantics, Spring 05, c Michael R. Hansen p.10/26

24 Decidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Skakkebæk Sestoft 94, Pandya 01, Fränzle 02, Gomez Bowman Computability and Semantics, Spring 05, c Michael R. Hansen p.10/26

25 Decidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Skakkebæk Sestoft 94, Pandya 01, Fränzle 02, Gomez Bowman 03 Even small extensions give undecidable subsets RDC 1 (Cont. time) RDC 2 RDC 3 l = r, S φ, φ ψ, φ ψ S 1 = S 2 φ, φ ψ, φ ψ l = x, S φ, φ ψ, φ ψ, ( x)φ Computability and Semantics, Spring 05, c Michael R. Hansen p.10/26

26 Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

27 Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N. We consider only discrete intervals [b, e] Intv where b, e N Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

28 Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N. We consider only discrete intervals [b, e] Intv where b, e N. The semantics of chop is { I, [b, e] = φ ψ iff I, [b, m] = φ and I, [m, e] = ψ, for some m [b, e] where m N } Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

29 Discrete- vs Continuous-Time DC The formula l = 1 1 ( 1 1 ) is valid for discrete time; but not for continuous time Computability and Semantics, Spring 05, c Michael R. Hansen p.12/26

30 Discrete- vs Continuous-Time DC The formula l = 1 1 ( 1 1 ) is valid for discrete time; but not for continuous time The formula S ( S S ) is valid for continuous time; but not for discrete time Computability and Semantics, Spring 05, c Michael R. Hansen p.12/26

31 Restricted Duration Calculus (RDC) 1. if S is a state expression, then S RDC, and 2. if φ, ψ RDC, then φ, φ ψ, φ ψ RDC Computability and Semantics, Spring 05, c Michael R. Hansen p.13/26

32 Restricted Duration Calculus (RDC) 1. if S is a state expression, then S RDC, and 2. if φ, ψ RDC, then φ, φ ψ, φ ψ RDC. Expressiveness of RDC for Discrete Time: l = 0 1 S = 0 S l = 0 l = 1 1 ( 1 1 ) S = 1 ( S = 0) ( S l = 1) ( S = 0) S = k + 1 ( S = k) ( S = 1) S k ( S = k) true S > k ( S k) ( S = k) S k ( S > k) S < k ( S k) ( S = k) Computability and Semantics, Spring 05, c Michael R. Hansen p.13/26

33 Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

34 Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

35 Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P 3 Discrete time one letter corresponds to one time unit L( S ) = (DNF (S)) + L(ϕ ψ) = L(ϕ) L(ψ) L( ϕ) = Σ \ L(ϕ) L(ϕ ψ) = L(ϕ) L(ψ) Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

36 Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P 3 Discrete time one letter corresponds to one time unit L( S ) = (DNF (S)) + L(ϕ ψ) = L(ϕ) L(ψ) L( ϕ) = Σ \ L(ϕ) L(ϕ ψ) = L(ϕ) L(ψ) L( φ ) is regular φ is satisfiable iff L( φ Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

37 Example Is the formula ( P P ) P valid for discrete time? Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

38 Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}} Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

39 Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}}. We have ( P P ) P is valid iff iff (( P P ) P ) is not satisfiable ( P P ) P is not satisfiable iff L 1 ( P P ) L 1 ( P ) = {} iff {{P } i i 2} (Σ \ {{P } i i 1}) = {} The last equality holds Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

40 Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}}. We have ( P P ) P is valid iff iff (( P P ) P ) is not satisfiable ( P P ) P is not satisfiable iff L 1 ( P P ) L 1 ( P ) = {} iff {{P } i i 2} (Σ \ {{P } i i 1}) = {} The last equality holds. Therefore, the formula is valid for discrete time Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

41 Undecidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Appearrently small extensions give undecidable subsets RDC 1 (Cont. time) RDC 2 RDC 3 l = r, S φ, φ ψ, φ ψ S 1 = S 2 φ, φ ψ, φ ψ l = x, S φ, φ ψ, φ ψ, ( x)φ Computability and Semantics, Spring 05, c Michael R. Hansen p.16/26

42 Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

43 Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

44 Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

45 Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) Halting problem is undecidable Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

46 Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) Halting problem is undecidable Assume deterministic machine with one halting state q fin Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

47 Undecidability 1: Continuous time only 1. the formula l = r belongs to RDC 1 (r), 2. if S is a state expression, then S belongs to RDC 1 (r), and 3. if φ and ψ belong to RDC 1 (r), then so do φ, φ ψ, and φ ψ Computability and Semantics, Spring 05, c Michael R. Hansen p.18/26

48 Undecidability 1: Continuous time only 1. the formula l = r belongs to RDC 1 (r), 2. if S is a state expression, then S belongs to RDC 1 (r), and 3. if φ and ψ belong to RDC 1 (r), then so do φ, φ ψ, and φ ψ. Encoding of two-counter machine M: one state variable Q i for each label q i. Let Q = {Q 0,..., Q fin } two state variables C 1 and C 2 to represent the counter values two auxiliary state variables B and L, used as delimiters Computability and Semantics, Spring 05, c Michael R. Hansen p.18/26

49 Undecidability 1: Continuous time only 1. the formula l = r belongs to RDC 1 (r), 2. if S is a state expression, then S belongs to RDC 1 (r), and 3. if φ and ψ belong to RDC 1 (r), then so do φ, φ ψ, and φ ψ. Encoding of two-counter machine M: one state variable Q i for each label q i. Let Q = {Q 0,..., Q fin } two state variables C 1 and C 2 to represent the counter values two auxiliary state variables B and L, used as delimiters A configuration (q, n 1, n 2 ) is encoded on an interval of length 4r: Q Val }{{} 1 }{{}}{{} L Val 2 }{{} r r r r where Val j represents the value of counter c j Computability and Semantics, Spring 05, c Michael R. Hansen p.18/26

50 Undecidability 1 Abbreviations = 1 true = 1 l < r = ((l = r) true) l = 4r = (l = 2r) (l = 2r) S r = S (l = r) φ ψ = (φ ( ψ)) S r reads S has value one for a duration of r φ ψ reads if the interval starts with φ, it must end immediately with or with ψ φ leads to ψ Computability and Semantics, Spring 05, c Michael R. Hansen p.19/26

51 Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

52 Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B. The computation of M is simulated by a formula F (M) For example, the following formula copies the C 1 sections to the same place in the next configuration. C 1 true Q i r (l < r) C 1 ( C 1 true) l = 4r exploits precision of length Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

53 Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B. The computation of M is simulated by a formula F (M) For example, the following formula copies the C 1 sections to the same place in the next configuration. C 1 true Q i r (l < r) C 1 ( C 1 true) l = 4r M halts iff F (M) is satisfiable exploits precision of length satisfiability is undecidable for the subset under consideration Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

54 Remarks l = 1 is not expressible in RDC for continuous time. Relaxing punctuality, replacing l = r with l < r does not give decidability. Relaxing punctuality, replacing l = r with l > r? Computability and Semantics, Spring 05, c Michael R. Hansen p.21/26

55 Undecidability 2: Discrete and Cont. Time 1. if S 1 and S 2 are state expressions, then S 1 = S 2 belongs to RDC 2, and 2. if φ and ψ belong to RDC 2, then so do φ, φ ψ and ψ ψ Computability and Semantics, Spring 05, c Michael R. Hansen p.22/26

56 Undecidability 2: Discrete and Cont. Time 1. if S 1 and S 2 are state expressions, then S 1 = S 2 belongs to RDC 2, and 2. if φ and ψ belong to RDC 2, then so do φ, φ ψ and ψ ψ. Encoding 1. two state variables C + i and C i for each counter c i 2. state variables Q = {Q 0,..., Q fin } corresponding to the labels Computability and Semantics, Spring 05, c Michael R. Hansen p.22/26

57 Undecidability 2: Discrete and Cont. Time 1. if S 1 and S 2 are state expressions, then S 1 = S 2 belongs to RDC 2, and 2. if φ and ψ belong to RDC 2, then so do φ, φ ψ and ψ ψ. Encoding 1. two state variables C + i and C i for each counter c i 2. state variables Q = {Q 0,..., Q fin } corresponding to the labels Idea the value of c i is represented by the value of C + i C i a computation s 0 s 1 s 2 is represented by a sequence QE 0 C 0 QE 1 C 1 QE 2 C 2 QE k is a state expression of Q C k is a state expression of {C + 1, C + 2, C 1, C 2 } Computability and Semantics, Spring 05, c Michael R. Hansen p.22/26

58 Undecidability 2: Abbreviations C = C + 1 C 1 C + 2 C 2 S = ( S = 1) ( 0 = 1) Incr 1 = C + 1 (C 1 C + 2 C 2 ) S > 0 = S = 1 true = 1 φ ψ = (φ ( ψ)) p φ = φ true reads: for some prefix interval: φ p φ = ( p ( φ)) reads: for all prefix intervals: φ Computability and Semantics, Spring 05, c Michael R. Hansen p.23/26

59 Undecidability 2: Encoding Instructions The instruction q j : c + i q k is encoded as follows (true C ) ( Q j C ) Qj = C Q k ( Q k Incr i ) ( Q k Incr i Q true) remaining instructions follows similar pattern mutual exclusive sections and sections of equal size undecidability of RDC Computability and Semantics, Spring 05, c Michael R. Hansen p.24/26

60 Undecidability 3 1. if S is a state expression, then S belongs to RDC 3, 2. if x is a global variable, then l = x belongs to RDC 3, and 3. if φ and ψ belong to RDC 3, then so do φ, φ ψ, φ ψ and ( x)φ, where x is any global variable. A configuration of the machine is represented by a sequence of sections Q, L and C, all of the same length: Q C C L }{{} 1 C C L }{{} 2 n 1 n 2 The initial configuration, (q 0, 0, 0), is represented by Q 0 L 1 L 2 : x.( Q 0 (l = x)) ( L 1 (l = x)) ( L 2 (l = x)) true Computability and Semantics, Spring 05, c Michael R. Hansen p.25/26

61 Undecidability 3: Encoding Instructions An abbreviation: S x = ( S ) (l = x) An instruction q j : c + 1 q k transforms configurations as follows: Q j C C L }{{} 1 C C L }{{} 2 = Q k C C C L }{{} 1 C C L }{{} 2 n 1 n 2 n 1 +1 n 2 Encoding x, y, z. ( Q j x C y L 1 x C z L 2 x (l = 4x + y + z)) (l = 3x + y + z) Q k x C x C y L 1 x C z L 2 x undecidability of RDC Computability and Semantics, Spring 05, c Michael R. Hansen p.26/26