CTL Model Update for System Modifications

Transcription

1 Journal o Ariicial Inelligence Research 31 (2008) Submied 08/07; published 01/08 CTL Model Updae or Sysem Modiicaions Yan Zhang Inelligen Sysems Laboraory School o Compuing and Mahemaics Universiy o Wesern Sydney, Ausralia Yulin Ding Deparmen o Compuer Science Universiy o Adelaide, Ausralia yan@scm.uws.edu.au yulin@cs.adelaide.edu.au Absrac Model checking is a promising echnology, which has been applied or veriicaion o many hardware and soware sysems. In his paper, we inroduce he concep o model updae owards he developmen o an auomaic sysem modiicaion ool ha exends model checking uncions. We deine primiive updae operaions on he models o Compuaion Tree Logic (CTL) and ormalize he principle o minimal change or CTL model updae. These primiive updae operaions, ogeher wih he underlying minimal change principle, serve as he oundaion or CTL model updae. Essenial semanic and compuaional characerizaions are provided or our CTL model updae approach. We hen describe a ormal algorihm ha implemens his approach. We also illusrae wo case sudies o CTL model updaes or he well-known microwave oven example and he Andrew File Sysem 1, rom which we urher propose a mehod o opimize he updae resuls in complex sysem modiicaions. 1. Inroducion Model checking is one o he mos eecive echnologies or auomaic sysem veriicaions. In he model checking approach, he sysem behaviours are modeled by a Kripke srucure, and speciicaion properies ha we require he sysem o mee are expressed as ormulas in a proposiional emporal logic, e.g., CTL. Then he model checker, e.g., SMV, akes he Kripke model and a ormula as inpu, and veriies wheher he ormula is saisied by he Kripke model. I he ormula is no saisied in he Kripke model, he sysem will repor errors, and possibly provides useul inormaion (e.g., counerexamples). Over he pas decade, he model checking echnology has been considerably developed, and many eecive model checking ools have been demonsraed hrough provision o horough auomaic error diagnosis in complex designs e.g., (Amla, Du, Kuehlmann, Kurshan, & McMillan, 2005; Berard, Bidoi, Finkel, Laroussinie, Pei, Perucci, & Schnoebelen, 2001; Boyer & Sighireanu, 2003; Chauhan, Clarke, Kukula, Sapra, Veih, & Wang, 2002; Wing & Vaziri-Farahani, 1995). Some curren sae-o-he-ar model checkers, such as SMV (Clarke, Grumberg, & Peled, 1999), NuSMV (Cimai, Clarke, Giunchiglia, & Roveri, 1999) and Cadence SMV (McMillan & Amla, 2002), employ SMV speciicaion language or boh Compuaional Tree Logic (CTL) and Linear Temporal Logic (LTL) varians (Clarke e al., 1999; Huh & Ryan, 2004). Oher model checkers, such as SPIN (Holzmann, 2003), use Promela speciicaion language or on-he-ly LTL model checking. Addiionally, he c 2008 AI Access Foundaion. All righs reserved.

2 Zhang & Ding MCK (Gammie & van der Meyden, 2004) model checker was developed by inegraing a knowledge operaor ino CTL model checking o veriy knowledge-relaed properies o securiy proocols. Alhough model checking approaches have been used or veriicaion o problems in large complex sysems, one major limiaion o hese approaches is ha hey can only veriy he correcness o a sysem speciicaion. In oher words, i errors are ideniied in a sysem speciicaion by model checking, he ask o correcing he sysem is compleely le o he sysem designers. Tha is, model checking is generally used only o veriy he correcness o a sysem, no o modiy i. Alhough he idea o repair has been indeed proposed or modelbased diagnosis, repairing a sysem is only possible or speciic cases (Dennis, Monroy, & Nogueira, 2006; Sumpner & Woawa, 1996). 1.1 Moivaion Since model checking can handle complex sysem veriicaion problems and as i may be implemened via as algorihms, i is quie naural o consider wheher we can develop associaed algorihms so ha hey can handle sysem modiicaion as well. The idea o inegraing model checking and auomaic modiicaion has been invesigaed in recen years. Buccaurri, Eier, Golob, and Leone (1999) have proposed an approach whereby AI echniques are combined wih model checking such ha he enhanced algorihm can no only ideniy errors or a concurren sysem, bu also provide possible modiicaions or he sysem. In he above approach, a sysem is described as a Kripke srucure M, and a modiicaion Γ or M is a se o sae ransiions ha may be added o or removed rom M. I a CTL ormula ϕ is no saisied in M i.e., he sysem conains errors wih respec o propery ϕ, hen M will be repaired by adding new sae ransiions or removing exising ones speciied in Γ. As a resul, he new Kripke srucure M will hen saisy ormula ϕ. The approach o Buccaurri e al. (1999) inegraes model checking and abducive heory revision o perorm sysem repairs. They also demonsrae how heir approach can be applied o repair concurren programs. I has been observed ha his ype o sysem repair is quie resriced, as only relaion elemens (i.e., sae ransiions) in a Kripke model can be changed 1. This implies ha errors can only be ixed by changing sysem behaviors. In ac, as we will show in his paper, allowing change o boh saes and relaion elemens in a Kripke srucure signiicanly enhances he sysem repair process in mos siuaions. Also, since providing all admissible modiicaions (i.e., he se Γ) is a pre-condiion o any repair, he approach o Buccaurri e al. lacks lexibiliy. Indeed, as saed by he auhors hemselves, heir approach may no be general enough or oher sysem modiicaions. On he oher hand, knowledge-base updae has been he subjec o exensive sudy in he AI communiy since he lae 1980s. Winsle s Possible Model Approach (PMA) is viewed as pioneering work owards a model-based minimal change approach or knowledgebase updae (Winsle, 1988). Many researchers have since proposed dieren approaches o knowledge sysem updae (e.g., see reerences rom Eier & Golob, 1992; Herzig & 1. NB: No sae changes occur in he speciied sysem repairs (see Deiniions 3.2 and 3.3 in Buccaurri e al., 1999). 114

3 CTL Model Updae or Sysem Modiicaions Rii, 1999). O hese works, Harris and Ryan (2002, 2003) considered using an updae approach or sysem modiicaion, where hey designed updae operaions o ackle eaure inegraion, perorming heory change and belie revision. However, heir sudy ocused mainly on he heoreical properies o sysem updae, and pracical implemenaion o heir approach in sysem modiicaion remains unclear. Baral and Zhang (2005) recenly developed a ormal approach o knowledge updae based on single-agen S5 Kripke srucures observing ha sysem modiicaion is closely relaed o knowledge updae. From he knowledge dynamics perspecive, we can view he inie ransiion sysem, which represens a real ime complex sysem, o be a model o a knowledge se (i.e., a Kripke model). Thus he problem o sysem modiicaion is reduced o he problem o updaing his model so ha a new updaed model saisies he knowledge ormula. This observaion moivaed he iniial developmen o a general approach o updaing Kripke models, which can be inegraed ino model checking echnology, owards a more general auomaic sysem modiicaion. Ding and Zhang s work (2005) may be viewed as he irs aemp o apply his idea o LTL model updae. The LTL model updae modiies he exising LTL model o an absraced sysem o auomaically correc he errors occurring wihin his model. Based on he invesigaion described above, we inend o inegrae knowledge updae and CTL model checking o develop a pracical model updaer, which represens a general mehod or auomaic sysem repairs. 1.2 Conribuions o This Paper The overall aim o our work is o design a model updaer ha improves model checking uncion by adding error repair (see schemaic in Figure 1). The oucome rom he updaer is a correced Kripke model. The model updaer s uncion is o auomaically correc errors repored (possibly as counerexamples) by a model checking compiler. Evenually, he model updaer is inended o be a universal compiler ha can be used in cerain common siuaions or model error deecion and correcion. Sysem Design CTL Kripke Model Correced Kripke Model Model checking & Updaing Figure 1: CTL model updae. The main conribuions o his paper are described as ollows: 115

4 Zhang & Ding 1. We propose a ormal ramework or CTL model updae. Firsly, we deine primiive CTL model updae operaions and, based on hese operaions, speciy a minimal change principle or he CTL model updae. We hen sudy he relaionship beween he proposed CTL model updae and radiional proposiional belie updae. Ineresingly, we prove ha our CTL model updae obeys all Kasuno and Mendelzon updae posulaes (U1) - (U8). We urher provide imporan characerizaions or special CTL model updae ormulas such as EXφ, AGφ and EGφ. These characerizaions play an imporan role in opimizaion o he updae procedure. Finally, we sudy he compuaional properies o CTL model updae and show ha, in general, he model checking problem or CTL model updae is co-np-complee. We also classiy a useul subclass o CTL model updae problems ha can be perormed in polynomial ime. 2. We develop a ormal algorihm or CTL model updae. In principle, our algorihm can perorm an updae on a given CTL Kripke model wih an arbirary saisiable CTL ormula and generae a model ha saisies he inpu ormula and has a minimal change wih respec o he original model. The model hen can be viewed as a possible correcion on he original sysem speciicaion. Based on his algorihm, we implemen a sysem prooype o CTL model updaer in C code in Linux. 3. We demonsrae imporan applicaions o our CTL model updae approach by wo case sudies o he well-known microwave oven example (Clarke e al., 1999) and he Andrew File Sysem 1 (Wing & Vaziri-Farahani, 1995). Through hese case sudies, we urher propose a new updae principle o minimal change wih maximal reachable saes, which can signiicanly improve he updae resuls in complex sysem modiicaion scenarios. In summary, our work presened in his paper is an iniial sep owards he ormal sudy o he auomaic sysem modiicaion. This approach may be inegraed ino exising model checkers so ha we may develop a uniied mehodology and sysem or model checking and model correcion. In his sense, our work will enhance he curren model checking echnology. Some resuls presened in his paper were published in ECAI 2006 (Ding & Zhang, 2006). The res o he paper is organized as ollows. An overview o CTL synax and semanics is provided in Secion 2.1. Primiive updae operaions on CTL models are deined in Secion 3, and a minimal change principle or CTL model updae is hen developed. Secion 4 consiss o a sudy o he relaionship beween CTL model updae and Kasuno and Mendelzon s updae posulaes (U1) - (U8), and various characerizaions or some special CTL model updaes. In Secion 5, a general compuaional complexiy resul o CTL model updae is proved, and a useul racable subclass o CTL model updae problems is ideniied. A ormal algorihm or he proposed CTL model updae approach is described in Secion 6. In Secion 7, wo updae case sudies are illusraed o demonsrae applicaions o our CTL model updae approach. Secion 8 proposes an improved CTL model updae approach which can signiicanly opimize he updae resuls in complex sysem modiicaion scenarios. Finally, he paper concludes wih some uure work discussions in Secion

5 CTL Model Updae or Sysem Modiicaions 2. Preliminaries In his secion, we briely review he synax and semanics o Compuaion Tree Logic and basic conceps o belie updae, which are he oundaion or our CTL model updae. 2.1 CTL Synax and Semanics To begin wih, we briely review CTL synax and semanics (reer o Clarke e al., 1999 and Huh & Ryan, 2004 or deails). Deiniion 1 Le AP be a se o aomic proposiions. A Kripke model M over AP is a riple M = (S, R, L) where: 1. S is a inie se o saes; 2. R S S is a binary relaion represening sae ransiions; 3. L : S 2 AP is a labeling uncion ha assigns each sae wih a se o aomic proposiions. An example o a inie Kripke model is represened by he graph in Figure 2, where each node represens a sae in S, which is aached o a se o proposiional aoms being assigned by he labeling uncion, and an edge represens a sae ransiion - a relaion elemen in R describing a sysem ransiion rom one sae o anoher. p, q S0 S2 q, r r S1 Figure 2: Transiion sae graph. Compuaion Tree Logic (CTL) is a emporal logic allowing us o reer o he uure. I is also a branching-ime logic, meaning ha is model o ime is a ree-like srucure in which he uure is no deermined bu consiss o dieren pahs, any one o which migh be he acual pah ha is evenually realized (Huh & Ryan, 2004). Deiniion 2 CTL has he ollowing synax given in Backus-Naur orm: φ ::= p ( φ) (φ 1 φ 2 ) (φ 1 φ 2 ) φ ψ AXφ EXφ AGφ EGφ AFφ EFφ A[φ 1 Uφ 2 ] E[φ 1 Uφ 2 ] where p is any proposiional aom. 117

6 Zhang & Ding A CTL ormula is evaluaed on a Kripke model. A pah in a Kripke model rom a sae is a(n) (ininie) sequence o saes. Noe ha or a given pah, he same sae may occur an ininie number o imes in he pah (i.e., he pah conains a loop). To simpliy our ollowing discussions, we may ideniy saes in a pah wih dieren posiion subscrips, alhough saes occurring in dieren posiions in he pah may be he same. In his way, we can say ha one sae precedes anoher in a pah wihou much conusion. Now we can presen useul noions in a ormal way. Le M = (S, R, L) be a Kripke model and s S. A pah in M saring rom s is denoed as π = [s 0, s 1,, s i 1, s i, s i+1, ], where s 0 = s and (s i, s i+1 ) R holds or all i 0. We wrie s i π i s i is a sae occurring in he pah π. I a pah π = [s 0, s 1,, s i,, s j, ] and i < j, we also denoe s i < s j. Furhermore or a given pah π, we use noion s s i o denoe a sae s ha is he sae s i or s < s i. For simpliciy, we may use succ(s) o denoe sae s i here is a relaion elemen (s, s ) in R. Deiniion 3 Le M = (S, R, L) be a Kripke model or CTL. Given any s in S, we deine wheher a CTL ormula φ holds in M a sae s. We denoe his by (M, s) = φ. The saisacion relaion = is deined by srucural inducion on all CTL ormulas: 1. (M, s) = and (M, s) = or all s S. 2. (M, s) = p i p L(s). 3. (M, s) = φ i (M, s) = φ. 4. (M, s) = φ 1 φ 2 i (M, s) = φ 1 and (M, s) = φ (M, s) = φ 1 φ 2 i (M, s) = φ 1 or (M, s) = φ (M, s) = φ 1 φ 2 i (M, s) = φ 1, or (M, s) = φ (M, s) = AXφ i or all s 1 such ha (s, s 1 ) R, (M, s 1 ) = φ. 8. (M, s) = EXφ i or some s 1 such ha (s, s 1 ) R, (M, s 1 ) = φ. 9. (M, s) = AGφ i or all pahs π = [s 0, s 1, s 2, ] where s 0 = s and s i, s i π, (M, s i ) = φ. 10. (M, s) = EGφ i here is a pah π = [s 0, s 1, s 2, ] where s 0 = s and s i, s i π, (M, s i ) = φ. 11. (M, s) = AFφ i or all pahs π = [s 0, s 1, s 2, ] where s 0 = s and s i, s i π, (M, s i ) = φ. 12. (M, s) = EFφ i here is a pah π = [s 0, s 1, s 2, ] where s 0 = s and s i, s i π, (M, s i ) = φ. 13. (M, s) = A[φ 1 Uφ 2 ] i or all pahs π = [s 0, s 1, s 2, ] where s 0 = s, s i π, (M, s i ) = φ 2 and or each j < i, (M, s j ) = φ (M, s) = E[φ 1 Uφ 2 ] i here is a pah π = [s 0, s 1, s 2, ] where s 0 = s, s i π, (M, s i ) = φ 2 and or each j < i, (M, s j ) = φ

7 CTL Model Updae or Sysem Modiicaions From he above deiniion, we can see ha he inuiive meaning o A, E, X, and G are quie clear: A means or all pahs, E means ha here exiss a pah, X reers o he nex sae and G means or all saes globally. Then he semanics o a CTL ormula is easy o capure as ollows. In he irs six clauses, he ruh value o he ormula in he sae depends on he ruh value o φ 1 or φ 2 in he same sae. For example, he ruh value o φ in a sae only depends on he ruh value o φ in he same sae. This conrass wih clauses 7 and 8 or AX and EX. For insance, he ruh value o AXφ in a sae s is deermined no by φ s ruh value in s, bu by φ s ruh values in saes s where (s, s ) R; i (s, s) R, hen his value also depends on he ruh value o φ in s. The nex our clauses (9-12) also exhibi his phenomenon. For example, he ruh value o AGφ involves looking a he ruh value o φ no only in he immediaely relaed saes, bu in indirecly relaed saes as well. In he case o AGφ, we mus examine he ruh value o φ in every sae relaed by any number o orward links (pahs) o he curren sae s. In clauses 13 and 14, symbol U may be explained as unil : a pah π = [s 0, s 1, s 2, ] saisies φ 1 Uφ 2 i here is a sae s i π such ha or all s < s i, (M, s) = φ 1 unil (M, s i ) = φ 2. Clauses 9-14 above reer o compuaion pahs in models. I is, hereore, useul o visualize all possible compuaion pahs rom a given sae s by unwinding he ransiion sysem o obain an ininie compuaion ree. This grealy aciliaes deciding wheher a sae saisies a CTL ormula. The unwound ree o he graph in Figure 2 is depiced in Figure 3 (noe ha we assume s 0 is he iniial sae in his Kripke model). p, q S0 q,r S1 r S2 p,q S0 r S2 S2 r q,r S1 r S2 r S2 Figure 3: Unwinding he ransiion sae graph as an ininie ree. In Figure 3, i φ = r, hen AXr is rue; i φ = q, hen EXq is rue. In he same igure, i φ = r, hen AFr is rue because some saes on all pahs will saisy r some ime in he uure. I φ = q, EFq is rue because some saes on some pahs will saisy q some ime in he uure. The clauses or AG and EG can be explained in Figure 4. In his ree, all saes saisy r. Thus, AGr is rue in his Kripke model. There is one pah where all saes saisy φ = q. Thus, EGq is rue in his Kripke model. 119

8 Zhang & Ding AG φ EG φ When φ = r; When φ= q. p, q, r S0 q,r S1 r S2 p,q, r S0 r S2 S2 r q,r S1 r S2 r S2 Figure 4: AGφ and EGφ in an unwound ree. The ollowing De Morgan rules and equivalences (Huh & Ryan, 2004) will be useul or our CTL model updae algorihm implemenaion: AFφ EG φ; EFφ AG φ; AXφ EX φ; AFφ A[ Uφ]; EFφ E[ Uφ]; A[φ 1 Uφ 2 ] (E[ φ 2 U( φ 1 φ 2 )] EG φ 2 ). In he res o his paper, wihou explici declaraion, we will assume ha all CTL ormulas occurring in our conex will be saisiable. For insance, i we consider updaing a Kripke model o saisy a CTL ormula φ, we already assume ha φ is saisiable. From Deiniion 3, we can see ha or a given CTL Kripke model M = (S, R, L), i (M, s) = φ and φ is a proposiional ormula, hen φ s ruh value solely depends on he labeling uncion L s assignmen on sae s. In his case we may simply wrie L(s) = φ i here is no conusion rom he conex. 2.2 Belie Updae Belie change has been a primary research opic in he AI communiy or almos wo decades e.g., (Gardenors, 1988; Winsle, 1990). Basically, i sudies he problem o how an agen can change is belies when i wans o bring new belies ino is belie se. There are wo ypes o belie changes, namely belie revision and belie updae. Inuiively, belie revision is used o modiy a belie se in order o accep new inormaion abou he saic world, 120

9 CTL Model Updae or Sysem Modiicaions while belie updae is o bring he belie se up o dae when he world is described by is changes. Kasuno and Mendelzon (1991) have discovered ha he original AGM revision posulaes canno precisely characerize he eaure o belie updae. They proposed he ollowing alernaive updae posulaes, and argued ha any proposiional belie updae operaors should saisy hese posulaes. In he ollowing (U1) - (U8) posulaes, all occurrences o T, µ, α, ec. are proposiional ormulas. (U1) T µ = µ. (U2) I T = µ hen T µ T. (U3) I boh T and µ are saisiable hen T µ is also saisiable. (U4) I T 1 T 2 and µ 1 µ 2 hen T µ 1 T 2 µ 2. (U5) (T µ) α = T (µ α). (U6) I T µ 1 = µ 2 and T µ 2 = µ 1 hen T µ 1 T µ 2. (U7) I T is complee (i.e., has a unique model) hen (T µ 1 ) (T µ 2 ) = T (µ 1 µ 2 ). (U8) (T 1 T 2 ) µ (T 1 µ) (T 2 µ). As shown by Kasuno and Mendelzon (1991), posulaes (U1) - (U8) precisely capure he minimal change crierion or updae ha is deined based on cerain parial ordering on models. As a ypical model based belie updae approach, here we briely inroduce Winsle s Possible Models Approach (PMA) (Winsle, 1990). We consider a proposiional language L. Le I 1 and I 2 be wo Herband inerpreaions o L. The symmeric dierence beween I 1 and I 2 is deined as di(i 1, I 2 ) = (I 1 I 2 ) (I 2 I 1 ). Then or a given inerpreaion I, we deine a parial ordering I as ollows: I 1 I I 2 i and only i di(i, I 1 ) di(i, I 2 ). Le I be a collecion o inerpreaions, we denoe Min(I, M ) o be he se o all minimal models rom I wih respec o ordering M, where model M is ixed. Now le φ and µ be wo proposiional ormulas, he updae o φ wih µ using he PMA, denoed as φ pma µ, is deined as ollows: Mod(φ pma µ) = M Mod(φ) Min(Mod(µ), M ), where Mod(ψ) denoes he se o all models o ormula ψ. I can be proved ha he PMA updae operaor pma saisies all posulaes (U1) - (U8). Our work o CTL model updae has a close connecion o he idea o belie updae. As will be shown in his paper, in our approach, we view a CTL Kripke model as a descripion o he world ha we are ineresed in, i.e., he descripion o a sysem o dynamic behaviours, and he updae on his Kripke model occurs when he seing o he sysem o dynamic behaviours has o change o accommodae some desired properies. Alhough here is a signiican dierence beween classical proposiional belie updae and our CTL model updae, we will show ha Kasuno Mendelzon s updae posulaes (U1) - (U8) are also suiable o characerize he minimal change principle or our CTL model updae. 3. Minimal Change or CTL Model Updae We would like o exend he idea o minimal change in belie updae o our CTL model updae. In principle, when we need o updae a CTL Kripke model o saisy a CTL ormula, 121

10 Zhang & Ding we expec he updaed model o reain as much inormaion as possible represened in he original model. In oher words, we preer o change he model in a minimal way o achieve our goal. In his secion, we will propose ormal merics o minimal change or CTL model updae. 3.1 Primiive Updae Operaions Given a CTL Kripke model and a (saisiable) CTL ormula, we consider how his model can be updaed in order o saisy he given ormula. From he discussion in he previous secion, we ry o incorporae a minimal change principle ino our updae approach. As he irs sep owards his aim, we should have a way o measure he dierence beween wo CTL Kripke models in relaion o a given model. We irs illusrae our iniial consideraion o his aspec hrough an example. Example 1 Consider a simple CTL model M = ({s 0, s 1, s 2 }, {(s 0, s 0 ), (s 0, s 1 ), (s 0, s 2 ), (s 1, s 1 ), (s 2, s 2 ), (s 2, s 1 )}, L), where L(s 0 ) = {p, q}, L(s 1 ) = {q, r} and L(s 2 ) = {r}. M is described as in Figure 5. p,q s0 s1 q,r r s2 Figure 5: Model M. Now consider ormula AGp. Clearly, (M, s 0 ) = AGp. One way o updae M o saisy AGp is o updae saes s 1 and s 2 so ha boh updaed saes saisy p 2. Thereore, we obain a new CTL model M = ({s 0, s 1, s 2 }, {(s 0, s 0 ), (s 0, s 1 ), (s 0, s 2 ), (s 1, s 1 ), (s 2, s 2 ), (s 2, s 1 )}, L ), where L (s 0 ) = L(s 0 ) = {p, q}, L (s 1 ) = {p, q, r} and L (s 2 ) = {p, r}. In his updae, we can see ha he labeling uncion has been changed o associae dieren ruh assignmens wih saes s 1 and s 2. Anoher way o updae M o saisy ormula AGp is o simply remove relaion elemens (s 0, s 1 ) and (s 0, s 2 ) rom M, his gives (M, s 0 ) = AGp, where M = ({s 0, s 1, s 2 }, {(s 0, s 0 ), (s 1, s 1 ), (s 2, s 2 ), (s 2, s 1 )}, L). This more closely resembles he approach o Buccaurri e al. (Buccaurri e al., 1999), where no sae changes occur. I is ineresing o noe ha he irs o he updaed models reains he same srucure as he original, while i is signiicanly changed in he second. These wo possible resuls are described in Figure Precisely, we updae he labeling uncion L ha changes he ruh assignmens o s 1 and s

11 CTL Model Updae or Sysem Modiicaions p,q s0 p,q s0 p,q,r p,r q,r r s1 s2 s1 s2 Figure 6: Two possible resuls o updaing M wih AGp. The above example shows ha in order o updae a CTL model o saisy a ormula, we may apply dieren kinds o operaions o change he model. From all possible operaions applicable o a CTL model, we consider ive basic ones where all changes on a CTL model can be achieved. PU1: Adding one relaion elemen Given M = (S, R, L), is updaed model M = (S, R, L ) is obained rom M by adding only one new relaion elemen. Tha is, S = S, L = L, and R = R {(s i, s j )}, where (s i, s j ) R or wo saes s i, s j S. PU2: Removing one relaion elemen Given M = (S, R, L), is updaed model M = (S, R, L ) is obained rom M by removing only one exising relaion elemen. Tha is, S = S, L = L, and R = R {(s i, s j )}, where (s i, s j ) R or wo saes s i, s j S. PU3: Changing labeling uncion on one sae Given M = (S, R, L), is updaed model M = (S, R, L ) is obained rom M by changing labeling uncion on a paricular sae. Tha is, S = S, R = R, s (S {s }), s S, L (s) = L(s), and L (s ) is a se o rue variable assigned in sae s where L (s ) L(s ). PU4: Adding one sae Given M = (S, R, L), is updaed model M = (S, R, L ) is obained rom M by adding only one new sae. Tha is, S = S {s }, s S, R = R, and s S, L (s) = L(s) and L (s ) is a se o rue variables assigned in s. PU5: Removing one isolaed sae Given M = (S, R, L), is updaed model M = (S, R, L ) is obained rom M by removing only one isolaed sae: S = S {s }, where s S and s S such ha s s, neiher (s, s ) nor (s, s) is no in R, R = R, and s S, L (s) = L(s). We call he above ive operaions primiive since hey express all kinds o changes o a CTL model. Figure 7 illusraes examples o applying some o hese operaions on a model. In he above ive operaions, PU1, PU2, PU4 and PU5 represen he mos basic operaions on a graph. Generally, using hese our operaions, we can perorm any changes o a CTL model. For insance, i we wan o subsiue a sae in a CTL model, we do he 123

12 Zhang & Ding ollowing: (1) remove all relaion elemens associaed o his sae, (2) remove his isolaed saes, (3) add a sae ha we wan o replace he original one, and (4) add all relevan relaion elemens associaed o his new sae. Alhough hese our operaions are suicien enough o represen all changes on a CTL model, hey someimes complicae he measure on he changes o CTL models. Consider he case o a sae subsiuion. Given a CTL model M, i one CTL model M has exacly he same graphical srucure as M excep ha M only has one paricular sae dieren rom M, hen we end o hink ha M is obained rom M wih a single change o sae replacemen, insead o rom a sequence o operaions PU1, PU2, PU4 and PU5. This moivaes us o have operaion PU3. PU3 has an eec o sae subsiuion, bu i is undamenally dieren rom he combinaion o PU1, PU2, PU4 and PU5, because PU3 does no change he sae name and relaion elemens in he original model, i only assigns a dieren se o proposiional aoms o ha sae in he original model. In his sense, he combinaion o PU1, PU2, PU4 and PU5 canno replace operaion PU3. Using PU3 o represen sae subsiuion signiicanly simpliies our measure on he model dierence as will be illusraed in Deiniion 4. In he res o he paper, we assume ha all sae subsiuions in a CTL model will be achieved hrough PU3 so ha we have a unique way o measure he dierences on CTL model changes in relaion o saes subsiuions. We should also noe ha having operaion PU3 as a way o subsiue a sae in a CTL model, PU5 becomes unnecessary, because we acually do no need o remove an isolaed sae rom a model. All we need is o remove relevan relaion elemen(s) in he model, so ha his sae becomes unreachable rom he iniial sae. Neverheless, o remain our discussions o be coheren wih all primiive operaions described above, in he ollowing deiniion on he CTL minimal change, we sill consider he measure on changes caused by applying PU5 in a CTL model updae. S0 S0 S0 S3 S1 S3 S1 S3 S1 M S2 M1 Aer PU2 is applied o M. S2 M2 S2 Aer PU2, PU2, PU5, PU4, PU1 and PU1 are applied o M. Figure 7: Illusraion o primiive updaes. 3.2 Deining Minimal Change Following radiional belie updae principle, in order o make a CTL model o saisy some propery, we would expec ha he given CTL model is changed as lile as possible. By using primiive updae operaions, a CTL Kripke model may be updaed in dieren ways: 124

13 CTL Model Updae or Sysem Modiicaions adding or removing sae ransiions, adding new saes, and changing he labeling uncion or some sae(s) in he model. Thereore, we irs need o have a mehod o measure he changes o CTL models, rom which we can develop a minimal change crierion or CTL model updae. Given wo CTL models M = (S, R, L) and M = (S, R, L ), or each operaion P Ui (i = 1,, 5), Di P Ui (M, M ) denoes he dierences beween he wo models where M is an updaed model rom M, which makes clear ha several operaions o ype P Ui have occurred. Since PU1 and PU2 only change relaion elemens, we deine Di P U1 (M, M ) = R R (adding relaion elemens only) and Di P U2 (M, M ) = R R (removing relaion elemens only). For operaion PU3, since only labeling uncion is changed, he dierence measure beween M and M or PU3 is deined as Di P U3 (M, M ) = {s s S S and L(s) L (s)}. For operaions PU4 and PU5, on he oher hand, we deine Di P U4 (M, M ) = S S (adding saes) and Di P U5 (M, M ) = S S (removing saes). Le M = (M, s) and M = (M, s ), or convenience, we also denoe Di (M, M ) = (Di P U1 (M, M ), Di P U2 (M, M ), Di P U3 (M, M ), Di P U4 (M, M ), Di P U5 (M, M )). I is worh menioning ha given wo CTL Kripke models M and M, here is no ambiguiy o compue Di P Ui (M, M ) (i = 1,, 5), because each primiive operaion will only cause one ype o changes (saes, relaion elemens, or labeling uncion) in he models no maer how many imes i has been applied. Now we can precisely deine he ordering M on CTL models. Deiniion 4 (Closeness ordering) Le M, M 1 and M 2 be hree CTL Kripke models. We say ha M 1 is a leas as close o M as M 2, denoed as M 1 M M 2, i and only i or each se o PU1-PU5 operaions ha ransorm M o M 2, here exiss a se o PU1-PU5 operaions ha ransorm M o M 1 such ha he ollowing condiions hold: (1) or each i (i = 1,, 5), Di P Ui (M, M 1 ) Di P Ui (M, M 2 ), and (2) i Di P U3 (M, M 1 ) = Di P U3 (M, M 2 ), hen or each s Di P U3 (M, M 1 ), di(l(s), L 1 (s)) di(l(s), L 2 (s)). We denoe M 1 < M M 2 i M 1 M M 2 and M 2 M M 1. Deiniion 4 presens a measure on he dierence beween wo models wih respec o a given model. Inuiively, we say ha model M 1 is closer o M relaive o model M 2, i (1) M 1 is obained rom M by applying all primiive updae operaions ha cause ewer changes han hose applied o obain model M 2 ; and (2) i he se o saes in M 1 aeced by applying PU3 is he same as ha in M 2, hen we ake a closer look a he dierence on he se o proposiional aoms associaed wih he relevan saes. Having he ordering speciied in Deiniion 4, we can deine a CTL model updae ormally. Deiniion 5 (Admissible updae) Given a CTL Kripke model M = (S, R, L), M = (M, s 0 ) where s 0 S, and a CTL ormula φ, a CTL Kripke model Updae(M, φ) is called an admissible model (or admissible updaed model) i he ollowing condiions hold: (1) Updae(M, φ) = (M, s 0 ), (M, s 0 ) = φ, where M = (S, R, L ) and s 0 S ; and, (2) here does no exis anoher updaed model M = (S, R, L ) and s 0 S such ha (M, s 0 ) = φ and M < M M. We use Poss(Updae(M, φ)) o denoe he se o all possible admissible models o updaing M o saisy φ. 125

14 Zhang & Ding Example 2 In Figure 8, model M is updaed in wo dieren ways. Model M 1 is he resul o updaing M by applying PU1. Model M 2 is anoher updae o M resuling by applying PU1, PU2 and PU5. Then we have Di P U1 (M, M 1 ) = {(s 0, s 2 )}, and Di P U1 (M, M 2 ) = {(s 1, s 0 ), (s 0, s 2 )}, which resuls in Di P U1 (M, M 1 ) Di P U1 (M, M 2 ). Also, i is easy o see ha Di P U2 (M, M 1 ) = and Di P U2 (M, M 2 ) = {(s 3, s 0 ), (s 2, s 3 )}, so Di P U2 (M, M 1 ) Di P U2 (M, M 2 ). Similarly, we can see ha Di P U3 (M, M 1 ) = Di P U3 (M, M 2 ) =, and Di P U4 (M, M 1 ) = Di P U4 (M, M 2 ) =. Finally, we have Di P U5 (M, M 1 ) = and Di P U5 (M, M 2 ) = {s 3 }. According o Deiniion 4, we have M 1 < M M 2. s0 s0 s0 s3 s1 s3 s1 s1 M s2 M1 s2 s2 M2 Figure 8: Illusraion o minimal change rules. We should noe ha in a CTL model updae, i we can simply replace he iniial sae by anoher exising sae in he model o saisy he ormula, hen his model acually has no been changed, and i is he unique admissible model according o Deiniion 5. In his case, all oher updaes will be ruled ou by Deiniion 5. For example, consider he CTL model M described in Figure 9: I we wan o updae (M, s 0 ) wih AXp, we can see ha S0 S1 p S2 Figure 9: A special model updae scenario. (M, s 1 ) becomes he only admissible updaed model according o our deiniion: we simply replace he iniial sae s 0 by s 1. Neverheless, we would expec ha some oher updae 126

15 CTL Model Updae or Sysem Modiicaions may also be equally reasonable. For insance, we may change he labeling uncion o M o make L (s 1 ) = {p}. In boh updaes, we have changed somehing in M, bu he change caused by he irs updae is no represened in our minimal change deiniion. We can overcome his diiculy by creaing a dummy sae ino a CTL Kripke model M, and or each iniial sae s in M, we add relaion elemen (, s) ino M. In his way, a change o iniial sae rom s o s will imply a removal o relaion elemen (, s) and an addiion o a new relaion elemen (, s ). Such changes will be measured by our minimal change deiniion. Wih his reamen, boh updaed models described above are admissible. In he res o he paper, wihou explici declaraion, we will assume ha each CTL Kripke model conains a dummy sae and special sae ransiions rom o all iniial saes. 4. Semanic Properies In his secion, we irs explore he relaionship beween our CTL model updae and radiional belie updae, and hen provide useul semanic characerizaions on some ypical CTL model updae cases. 4.1 Relaionship o Proposiional Belie Updae Firs we show he ollowing resul abou ordering M deined in Deiniion 4. Proposiion 1 M is a parial ordering. Proo: From Deiniion 4, i is easy o see ha M is relexive and anisymmeric. Now we show ha M is also ransiive. Suppose M 1 M M 2 and M 2 M M 3. According o Deiniion 4, we have Di P Ui (M, M 1 ) Di P Ui (M, M 2 ), and Di P Ui (M, M 2 ) Di P Ui (M, M 3 ) (i = 1,, 5). Consequenly, we have Di P Ui (M, M 1 ) Di P Ui (M, M 3 ) (i = 1,, 5). So Condiion 1 in Deiniion 4 holds. Now consider Condiion 2 in he deiniion. The only case we need o consider is ha Di P U3 (M, M 1 ) = Di P U3 (M, M 2 ) and Di P U3 (M, M 2 ) = Di P U3 (M, M 3 ) (noe ha all oher cases will direcly imply Di P U3 (M, M 1 ) Di P U3 (M, M 3 ) and Di P U3 (M, M 1 ) Di P U3 (M, M 3 )). In his case, i is obvious ha or all s Di P U3 (M, M 1 ) = Di P U3 (M, M 3 ), di(l(s), L 1 (s)) di(l(s), L 3 (s)). So we have M 1 M M 3. I is also ineresing o consider a special case o our CTL model updae where he updae ormula is a classical proposiional ormula. The ollowing proposiion indicaes ha when only proposiional ormula is considered in CTL model updae, he admissible model can be obained hrough he radiional model based belie updae approach (Winsle, 1988). Proposiion 2 Le M = (S, R, L) be a CTL model and s 0 S. Suppose ha φ is a saisiable proposiional ormula and (M, s 0 ) = φ, hen an admissible model o updaing (M, s 0 ) o saisy φ is (M, s 0 ), where M = (S, R, L ), or each s (S {s 0 }), L (s) = L(s), L (s 0 ) = φ, and here does no exis anoher M = (S, R, L ) such ha L (s 0 ) = φ and di(l(s 0 ), L (s 0 )) di(l(s 0 ), L (s 0 )). Proo: Since φ is a proposiional ormula, he updae on (M, s 0 ) o saisy φ will no aec any relaion elemens and all oher saes excep s 0. Since L(s 0 ) = φ, i is obvious ha 127

16 Zhang & Ding by applying PU3, we can change he labeling uncion L o L ha assigns s 0 a new se o proposiional aoms o saisy φ. Then rom Deiniion 5, we can see ha he model speciied in he proposiion is indeed a minimally changed CTL model wih respec o ordering M. We can see ha he problem addressed by our CTL model updae is essenially dieren rom he problem concerned in radiional proposiional belie updae. Neverheless, he idea o model based minimal change or CTL model updae is closely relaed o belie updae. Thereore, i is worh invesigaing he relaionship beween our CTL model updae and radiional proposiional belie updae posulaes (U1) - (U8). In order o make such a comparison possible, we should li he updae operaor occurring in posulaes (U1) - (U8) beyond he proposiional logic case. For his purpose, we irs inroduce some noions. Given a CTL ormula φ and Kripke model M = (S, R, L), le Ini(S) S be he se o all iniial saes in M. (M, s) is called a model o φ i (M, s) = φ, where s Ini(S). We use Mod(φ) o denoe he se o all models o φ. Now we speciy an updae operaor c o impose on CTL ormulas as ollows: given wo CTL ormulas ψ and φ, we deine ha ψ c φ o be a CTL ormula whose models are deined as: Mod(ψ c φ) = (M,s) Mod(ψ) Poss(Updae((M, s), φ)). Theorem 1 Operaor c saisies all Kasuno and Mendelzon updae posulaes (U1) - (U8). Proo: From Deiniions 4 and 5, i is easy o veriy ha c saisies (U1)-(U4). We prove ha c saisies (U5). To prove (ψ c µ) α = ψ c (µ α), i is suicien o prove ha or each model (M, s) Mod(ψ), Poss(Updae((M, s), µ)) Mod(α) Poss(Updae((M, s), µ α)). In paricular, we need o show ha or any (M, s ) Poss(Updae((M, s), µ)) Mod(α), (M, s ) Poss(Updae((M, s), µ α)). Suppose (M, s ) Poss(Updae((M, s), µ α)). Then we have (1) (M, s ) = µ α; or (2) here exiss a dieren admissible model (M, s ) Mod(µ α) such ha M < M M. I i is case (1), hen (M, s ) Poss(Updae((M, s), µ)) Mod(α). So he resul holds. I i is case (2), i also implies ha (M, s ) = µ and M < M M. Tha means, (M, s ) Poss(Updae((M, s), µ)). The resul sill holds. Now we prove ha c saisies (U6). To prove his resul, i is suicien o prove ha or any (M, s) Mod(ψ), i Poss(Updae((M, s), µ 1 )) Mod(µ 2 ) and Poss(Updae((M, s), µ 2 )) Mod(µ 1 ), hen Poss(Updae((M, s), µ 1 )) = Poss(Updae((M, s), µ 2 )). We irs prove Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 2 )). Le (M, s ) Poss(Updae((M, s), µ 1 )). Then (M, s ) = µ 2. Suppose (M, s ) Poss(Updae((M, s), µ 2 )). Then here exiss a dieren admissible model (M, s ) Poss(Updae((M, s), µ 2 )) such ha M < M M. Also noe ha (M, s ) = µ 1. This conradics he ac ha (M, s ) Poss(Updae((M, s), µ 1 )). So we have Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 2 )). Similarly, we can prove ha Poss(Updae((M, s), µ 2 )) Poss(Updae((M, s), µ 1 )). To prove ha c saisies (U7), i is suicien o prove ha Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 1 µ 2 )), where (M, s) is he unique model o T (noe ha T is complee). Le (M, s ) Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 1 )). Suppose (M, s ) Poss(Updae((M, s), µ 1 µ 2 )). Then here exiss an admissible model (M, s ) Poss(Updae((M, s), µ 1 µ 2 )) such ha M < M M. Noe ha 128

17 CTL Model Updae or Sysem Modiicaions (M, s ) = µ 1 µ 2. I (M, s ) = µ 1, hen i implies ha (M, s ) Poss(Updae((M, s), µ 1 )). I (M, s ) = µ 2, hen i implies (M, s ) Poss(Updae((M, s), µ 2 )). In boh cases, we have (M, s ) Poss(Updae((M, s), µ 1 )) Poss(Updae((M, s), µ 1 )). This proves he resul. Finally, we show ha c saisies (U8). From Deiniion 5, we have ha Mod((ψ 1 ψ 2 ) c µ) = (M,s) Mod(ψ 1 ψ 2 ) Poss(Updae((M, s), µ)) = (M,s) Mod(ψ 1 ) Poss(Updae((M, s), µ)) (M,s) Mod(ψ 2 ) Poss(Updae((M, s), µ)) = Mod(ψ 1 c µ) Mod(ψ 2 c µ). This complees our proo. From Theorem 1, i is eviden ha Kasuno and Mendelzon s updae posulaes (U1) - (U8) characerize a wide range o updae ormulaions beyond he proposiional logic case, where model based minimal change principle is employed. In his sense, we can view ha Kasuno and Mendelzon s updae posulaes (U1) - (U8) are essenial requiremens or any model based updae approaches. 4.2 Characerizing Special CTL Model Updaes From previous descripion, we observe ha, or a given CTL Kripke model M and ormula φ, here may be many admissible models saisying φ, where some are simpler han ohers. In his secion, we provide various resuls ha presen possible soluions o achieve admissible updaes under cerain condiions. In general, in order o achieve admissible updae resuls, we may have o combine various primiive operaions during an updae process. Neverheless, as will be shown below, a single ype primiive operaion will be enough o achieve an admissible updaed model in many siuaions. These characerizaions also play an essenial role in simpliying CTL model updae implemenaion. Firsly, he ollowing proposiion simply shows ha during a CTL updae only reachable saes will be aken ino accoun in he sense ha unreachable sae will never be removed or newly inroduced. Proposiion 3 Le M = (S, R, L) be a CTL Kripke model, s 0 S an iniial sae o M, φ a saisiable CTL ormula and (M, s 0 ) = φ. Suppose (M, s 0 ) is an admissible model aer updaing (M, s 0 ) wih φ, where M = (S, R, L ). Then he ollowing properies hold: 1. i s is a sae in M (i.e. s S) and is no reachable rom s 0 (i.e. here does no exis a pah π = [s 0, ] in M such ha s π), hen s mus also be a sae in M (i.e. s S ); 2. i s is a sae in M and is no reachable rom s 0, hen s mus also be a sae in M. Proo: We only give he proo o resul 1 since he proo or resul 2 is similar. Suppose s is no in M. Tha is, s has been removed rom M during he generaion o (M, s 0 ). From Deiniions 4 and 5, we know ha he only way o remove s rom M is o apply operaion PU5 (and possibly oher associaed operaions such as PU2 - removing ransiion relaions, i s is conneced o oher saes). Now we consruc a new CTL Kripke model M in such a way ha M is exacly he same as M excep ha s is also in M. Tha is, M = (S, R, L ), where S = S {s}, R = R, or all s S, L (s ) = L (s ), and L (s) = L(s). Noe ha in M, sae s is 129

18 Zhang & Ding an isolaed sae, no connecing o any oher saes. Since s is in M, rom Deiniion 4 we can see ha M < M M. Now we will show ha (M, s 0 ) = φ. We prove his by showing a bi more general resul: Resul: For any saisiable CTL ormula φ and any sae s S, (M, s ) = φ i (M, s ) = φ. This can be showed by inducion on he srucure o φ. (a) Suppose φ is a proposiional ormula. In his case, (M, s ) = φ i L (s ) = φ. Since L (s ) = L (s ), and (M, s ) = φ i L (s ) = φ, we have (M, s ) = φ i (M, s ) = φ. (b) Assume ha he resul holds or ormula φ. (c) We consider variours cases or ormulas consruced rom φ. (c.1) Suppose φ is o he orm AGφ. (M, s ) = AGφ i or every pah rom s π = [s,, ], and or every sae s π, (M, s ) = φ. From he consrucion o M, i is obvious ha every pah rom s in M mus be also a pah in M, and vice versa. Also rom he inducion assumpion, we have (M, s ) = φ i (M, s ) = φ. This ollows ha (M, s ) = AGφ i (M, s ) = AGφ. Proos or oher cases such as AFφ, EGφ, ec. are similar. Thus, we can ind anoher model M such ha (M, s 0 ) = φ and M < M M. This conradics o he ac ha (M, s 0 ) is an admissible model rom he updae o (M, s 0) by φ. Theorem 2 Le M = (S, R, L) be a Kripke model and M = (M, s 0 ) = EXφ, where s 0 S and φ is a proposiional ormula. Le M = Updae(M, EXφ) be he model obained rom he updae o M wih EXφ hrough he ollowing 1 or 2, hen M is an admissible model. 1. PU3 is applied o one succ(s 0 ) o make L (succ(s 0 )) = φ and di (L(succ(s 0 )), L (succ(s 0 ))) minimal, or, PU4 and PU1 are applied once successively o add a new sae s such ha L (s ) = φ and a new relaion elemen (s 0, s ); 2. i here exiss some s i S such ha L(s i ) = φ and s i succ(s 0 ), PU1 is applied once o add a new relaion elemen (s 0, s i ). Proo: Consider case 1 irs. Aer PU3 is applied o change he assignmen on succ(s 0 ), or PU4 and PU1 are applied o add a new sae s and a relaion elemen (s 0, s ), he new model M conains a succ(s 0 ) such ha L (succ(s 0 )) = φ. Thus, M = (M, s 0 ) = EXφ. I PU3 is applied once, hen Di (M, M ) = (,, {succ(s 0 )},, ); i PU4 and PU1 are applied once successively, Di (M, M ) = ({(s 0, s )},,, {, s }, ). Thus, updaes by a single applicaion o PU3 or applicaions o PU4 and PU1 once successively are no compaible wih each oher. For PU3, i any oher updae is applied in combinaion, Di (M, M ) will eiher be no compaible wih Di (M, M ) or conain Di (M, M ) (e.g., anoher PU3 ogeher wih is predecessor). A similar siuaion occurs wih he applicaions o PU4 and PU1. Thus, applying eiher PU3 once or PU4 and PU1 once successively represens a minimal change. For case 2, aer PU1 is applied o connec s 0 and L(s i ) = φ, he new model M has a successor which saisies φ. Thus, M = (M, s 0 ) = EXφ. I PU1 is applied, Di (M, M ) = ({(s 0, s i )},,,, ). Noe ha his case remains a minimal change o he relaion elemen on he original model M and is no compaible wih case 1. Hence, case 2 130

19 CTL Model Updae or Sysem Modiicaions also represens a minimal change. Theorem 2 provides wo cases where admissible CTL model updae resuls can be achieved or ormula EXφ. I is imporan o noe ha here we resric φ o be a proposiional ormula. The irs case says ha we can eiher selec one o he successor saes o s 0 and change is assignmen minimally o saisy φ (i.e., apply PU3 once), or simply add a new sae and a new relaion elemen ha saisies φ as a successor o s 0 (i.e., apply PU4 and PU1 once successively). The second case indicaes ha i some sae s i in S already saisies φ, hen i is enough o simply add a new relaion elemen (s 0, s i ) o make i a successor o s 0. Clearly, boh cases will yield new CTL models ha saisy EXφ. Theorem 3 Le M = (S, R, L) be a Kripke model and M = (M, s 0 ) = AGφ, where s 0 S, φ is a proposiional ormula and s 0 = φ. Le M = Updae(M, AGφ) be a model obained rom he updae o M wih AGφ hrough he ollowing way, hen M is an admissible model. For each pah saring rom s 0 : π = [s 0,, s i, ]: 1. i or all s < s i in π, L(s) = φ bu L(s i ) = φ, PU2 is applied o remove relaion elemen (s i 1, s i ); or 2. PU3 is applied o all saes s in π no saisying φ o change heir assignmens such ha L (s) = φ and di (L(s), L (s)) is minimal. Proo: Case 1 is simply o cu pah π rom he irs sae s i ha does no saisy φ. Clearly, here is only one minimal way o cu π: remove relaion elemen (s i 1, s) (i.e., apply PU2 once). Case 2 is o minimally change he assignmens or all saes belonging o π ha do no saisy φ. Since he changes imposed by case 1 and case 2 are no compaible wih each oher, boh will generae admissible updae resuls. In Theorem 3, case 1 considers a special orm o he pah π where he irs i saes saring rom s 0 already saisy ormula φ. Under his condiion, we can simply cu o he pah o disconnec all oher saes no saisying φ. Case 2 is sraighorward: we minimally modiy he assignmens o all saes belonging o π ha do no saisy ormula φ. Theorem 4 Le M = (S, R, L) be a Kripke model, M = (M, s 0 ) = EGφ, where s 0 S and φ is a proposiional ormula. Le M = Updae(M, EGφ) be a model obained rom he updae o M wih EGφ hrough he ollowing way, hen M is an admissible model: Selec a pah π = [s 0, s 1,, s i,, s j, ] rom M which conains minimal number o dieren saes no saisying φ 3, and hen 1. i or all s π such ha L(s ) = φ, here exis s i, s j π saisying s i < s < s j and s s i or s s j, L(s) = φ, hen PU1 is applied o add a relaion elemen (s i, s j ), or PU4 and PU1 are applied o add a sae s such ha L (s ) = φ and new relaion elemens (s i, s ) and (s, s j ); 2. i s i π such ha s s i, L(s) = φ, and s k π, where π = [s 0,, s k, ] such ha s s k and L(s) = φ, hen PU1 is applied o connec s i and s k ; 3. Noe ha alhough a pah may be ininie, i will only conain inie number o dieren saes. 131

20 Zhang & Ding 3. i s i π (i > 1) such ha or all s < s i, L(s ) = φ, L(s i ) = φ, hen, a. PU1 is applied o connec s i 1 and s o orm a new ransiion (s i 1, s ); b. i s i is he only successor o s i 1, hen PU2 is applied o remove relaion elemen (s i 1, s i ); 4. i s π, such ha L(s ) = φ, hen PU3 is applied o change he assignmens or all saes s such ha L (s ) = φ and di (L(s), L (s )) is minimal. Proo: In case 1, wihou loss o generaliy, we assume or he seleced pah π, here exis saes s ha do no saisy φ, and all oher saes in π saisy φ. We also assume ha such s are in he middle o pah π. Thereore, here are wo oher saes s i, s j in π such ha s i < s < s j. Tha is, π = [s 0,, s i 1, s i,, s,, s j, s j+1, ]. We irs consider applying PU1. I is clear ha by applying PU1 o add a new relaion elemen (s i, s j ), a new pah is ormed: π = [s 0,, s i 1, s i, s j, s j+1, ]. Noe ha each sae in π is also in pah π and s π. Accordingly, we know ha EGφ holds in he new model M = (S, R {(s i, s j )}, L) a sae s 0. Consider M = (M, s 0 ) and M = (M, s 0 ). Clearly, Di (M, M ) = ({(s i, s j )},,,, ), which implies ha (M, s 0 ) mus be a minimally changed model wih respec o M ha saisies EGφ. Now we consider applying PU4 and PU1. In his case, we will have a new model M = (S {s }, R {(s i, s ), (s, s j )}, L ) where L is an exension o L on new sae s ha saisies φ. We can see ha π = [s 0,, s i, s, s j, ] is a pah in M which shares all saes wih pah π excep he sae s in π and hose saes beween s i+1 and s j 1 including s in π. So we also have (M, s 0 ) = EGφ. Furhermore, we have Di (M, M ) = ({(s i, s ), (s, s j )},,, {s }, ). Obviously, (M, s 0 ) is a minimally changed model wih respec o M ha saisies EGφ. I is worh menioning ha in case 1, he model obained by only applying PU1 is no comparable o he model obained by applying PU4 and PU1, because no se inclusion relaion holds or he changes on relaion elemens caused by hese wo dieren ways. In case 2, consider wo dieren pahs π = [s 0,, s i, ] and π = [s 0,, s k, ] such ha all saes beore sae s i in pah π saisy φ, and all saes aer sae s k in pah π saisy φ, hen PU1 is applied o orm a new ransiion (s i, s k ). This ransiion hereore connecs all saes rom s 0 o s i in pah π and all saes aer s k in pah π. Hence all saes in he new pah [s 0,, s i, s k ] saisy φ. Thus, M = EGφ. Such change is also minimal, because aer PU1 is applied, Di (M, M ) = ({(s i, s k )},,,, ) is minimum and (M, s 0 ) is a minimally changed model wih respec o M ha saisies EGφ. In case 3, here are wo siuaions. (a) I PU1 is applied o orm a new ransiion (s i 1, s ), hen a new pah conaining [s 0,, s,, s i 1, s,, s i 1, s, ] consiss o Srongly Conneced Componens where all saes saisy φ, and Di (M, M ) = ({(s i 1, s )},,,, ) is minimum. Thus, (M, s 0 ) is a minimally changed model wih respec o M ha saisies EGφ. (b) I PU2 is applied, hen, a new pah π conaining [s 0,, s,, s i 1 ] is derived where all saes saisy φ and Di(M, M ) = (, {(s i 1, s i )},,, ) is minimal. Obviously, (M, s 0 ) is a minimally changed model wih respec o M ha saisies EGφ. In case 4, suppose ha here are n saes on he seleced pah π ha do no saisy φ. Aer PU3 is applied o all hese saes, Di (M, M ) = (,, {s 1, s 2,, s n },, ), where or each s {s 1,, s n }, di(l(s ), L (s )) is minimal. Di (M, M ) in his case is no 132

21 CTL Model Updae or Sysem Modiicaions compaible wih hose in cases 1, 2 and 3. Thus, (M, s 0 ) is a minimally changed model wih respec o M ha saisies EGφ. Theorem 4 characerizes our ypical siuaions or he updae wih ormula EGφ where φ is a proposiional ormula. Basically, his heorem says ha in order o make ormula EGφ rue, we irs selec a pah, hen we can eiher make a new pah based on his pah so ha all saes in he new pah saisy φ (i.e., case 1, case 2 and case 3(a)), or rim he pah rom he sae where all previous saes saisy φ (i.e., case 3(b)), i he previous sae has only his sae as is successor; or simply change he assignmens or all saes no saisying φ in he pah (i.e., case 4). Our proo shows ha models obained rom hese operaions are admissible. I is possible o provide urher semanic characerizaions or updaes wih oher special CTL ormulas such as EFφ, AXφ, and E[φUψ]. In ac, in our prooype implemenaion, such characerizaions have been used o simpliy he updae process whenever cerain condiions hold. We should also indicae ha all characerizaion heorems presened in his secion only provide suicien condiions o compue admissible models. There are oher admissible models which will no be capured by hese heorems. 5. Compuaional Properies In his secion, we sudy compuaional properies or our CTL model updae approach in some deail. We will irs presen a general complexiy resul, and hen we ideniy a useul subclass o CTL model updaes which can always be achieved in polynomial ime. 5.1 The General Complexiy Resul Theorem 5 Given wo CTL Kripke models M = (S, R, L) and M = (S, R, L ), where s 0 S and s 0 S, and a CTL ormula φ, i is co-np-complee o decide wheher (M, s 0 ) is an admissible model o he updae o (M, s 0 ) o saisy φ. The hardness holds even i φ is o he orm EXψ where ψ is a proposiional ormula. Proo: Membership proo: Firsly, we know rom Clarke e al. (1999) ha checking wheher (M, s 0 ) saisies φ or no can be perormed in ime O( φ ( S + R )). In order o check wheher (M, s 0 ) is an admissible updae resul, we need o check wheher M is a minimally updaed model wih respec o ordering M. For his purpose, we consider he complemen o he problem by checking wheher M is no a minimally updaed model. Thereore, we do wo hings: (1) guess anoher updaed model o M: M = (S, R, L ) saisying φ or some s S ; and, (2) es wheher M < M M. Sep (1) can be done in polynomial ime. To check M < M M, we irs compue di(s, S ), di(s, S ), di(r, R ) and di(r, R ). All hese can be compued in polynomial ime. Then, according o hese ses, we ideniy Di P Ui (M, M ) and Di P Ui (M, M ) (i = 1,, 5) in erms o PU1 o PU5. Again, hese seps can also be compleed in polynomial ime. Finally, by checking Di P Ui (M, M ) Di P Ui (M, M ) (i = 1,, 5), and di(l(s), L (s)) di(l(s), L (s)) or all s Di P U3 (M, M ) (i Di P U3 (M, M ) = Di P U3 (M, M )), 133