Chapter 5: Linear Temporal Logic

Transcription

1 Chapter 5: Linear Temporal Logic Prof. Ali Movaghar Verification of Reactive Systems Spring 91

2 Outline We introduce linear temporal logic (LTL), a logical formalism that is suited for specifying LT properties. Then we go through a model-checking algorithm for LTL based on Bϋchi automata. 2

3 Linear Temporal Logic Correctness of reactive systems depends on the execution of the system and on fairness issues. Temporal logic is a suitable formalism for treating these aspects. Temporal logic extends propositional or predicate logic by modalities to specify infinite behavior of a reactive system. 3

4 Linear Temporal Logic (Con.) The elementary modalities of temporal logics include the operators: eventually (eventually in the future) always (now and forever in the future). The nature of time in temporal logics can be either linear or branching: 4

5 Linear Temporal Logic (Con.) In the linear view, at each moment in time there is a single successor moment. LTL (Linear Temporal Logic) is based on lineartime perspective. In the branching view, it has a branching, tree-like structure, where time may split into alternative course. CTL (Computational Tree Logic) is based on a branching-time view. 5

6 Linear Temporal Logic (Con.) A temporal logic allows for the specification of the relative order of events. But it does not support any means to refer to the precise timing of events. The car stops once the driver pushes the brake. The message is received after it has been sent. 6

7 Linear Temporal Logic (Con.) LTL may be used to express the timing for the class of synchronous systems in which all components proceed in a lockstop fashions. In this setting, a transition corresponds to the advance of a single time-unit. The time domain is discrete: the present moment refers to current state and the next moment corresponds to the next state. 7

8 Linear Temporal Logic: syntax LTL formulae over the set AP of atomic proposition are formed according to the following grammar: ϕ ::= true a ϕ 1 ϕ 2 ϕ ϕ ϕ 1 Uϕ 2 where a AP., next : ϕ holds at the current moment if ϕ holds in the next state. U, until : ϕ1uϕ2 holds at the current moment, if there is some future for which ϕ holds and ϕ holds at all moments until future moment. 8

9 Linear Temporal Logic: syntax (Con.) The precedence order on operators is as follows. The unary operators bind stronger than the binary ones. and bind equally strong. The temporal operator U takes precedence over,, and. 9

10 Linear Temporal Logic: syntax (Con.) Using the Boolean connectives and, the full power of propositional logic is obtained. The until operator allows to derive the temporal modalities and as follows: ϕ= true U ϕ and ϕ= ϕ ϕ ensures that ϕ will be true eventually the in future. ϕ is satisfied iff it id not the case that eventually ϕ holds. 10

11 Linear Temporal Logic: syntax (Con.) The intuitive meaning of temporal modalities are illustrated below: 11

12 Linear Temporal Logic: syntax (Con.) By combining and, new temporal modalities are obtained: a describes the property stating that at any moment j there is a moment i j at which a-state is visited. Thus a-state is visited infinitely often. a expresses that from moment j, only a- state are visited. Thus a-state is visited eventually forever. 12

13 Linear Temporal Logic: syntax (Con.) Example 5.2: properties for mutual exclusion problem: Safety property stating that P 1 and P 2 never simultaneously have access to their critical section: ( crit 1 crit 2 ). Liveness property stating each process P i is infinitely often in its critical section: ( crit 1 ) ( crit 2 ). Read examples 5.3 and

14 Linear Temporal Logic: syntax (Con.) Let ϕ denote the length of LTL formula ϕ in terms of the number of operators in ϕ. This can be easily defined by induction on the structure of: a AP has length 0; a b has length 2 and ( a)u(a b) has length 4. 14

15 Linear Temporal Logic: semantics LTL formula stands for properties of paths. The semantics of LTL formula is defined by a LT property. Then it is extended to an interpretation over paths and states of a LTS. 15

16 Linear Temporal Logic: semantics (Con.) Definition: Let ϕ be an LTL formula over AP. The LT property induced by ϕ is Words(ϕ)={σ (2 AP ) ω σ =ϕ} where = (2 AP ) ω LTL is the smallest relation with the properties: 16

17 Linear Temporal Logic: semantics (Con.) For the derived operators and the expected result is : Derive semantics of and! 17

18 Linear Temporal Logic: semantics (Con.) Definition 5.7: Let TS=(S,Act,,I,AP,L ) be a transition system without terminal state, and let ϕ be a LTL formula over AP. For infinite path fragments π of TS, the satisfaction relation is defined by π = ϕ iff trace(π) =ϕ 18

19 Linear Temporal Logic: semantics (Con.) For state s S, the satisfaction relation = is defined by: s =ϕ iff ( π Paths(s).π =ϕ) TS satisfies ϕ, denoted TS =ϕ, if Traces(TS) Words(ϕ). 19

20 Linear Temporal Logic: semantics (Con.) From this definition, it immediately follows that: Thus, TS =ϕ iff s 0 = ϕ for all initial states s 0 of TS. 20

21 Linear Temporal Logic: semantics (Con.) Example 5.8: Consider the LTS below with the set of propositions AP={a,b} TS = a TS (a b) TS = ( b (a b)) TS b U (a b) 21

22 Linear Temporal Logic: semantics (Con.) Semantics of Negation: For paths, it holds π =ϕ iff π ϕ. Since Words( ϕ)=(2 AP ) ω \Words(ϕ). ϕ However statements TS ϕ and TS = ϕ are not equivalent. Instead TS = ϕ implies TS ϕ. Note that : 22

23 Linear Temporal Logic: semantics (Con.) Thus it is possible that a LTS satisfies neither nor: Consider the TS below with AP={a}: TS a, since the initial path s 0 (s 2 ) ω a. TS a, since the initial path s 0 (s 1 ) ω =a, and thus s 0 (s 1 ) ω a. 23

24 Linear Temporal Logic: specifying properties Example 5.11: A modulo 4 counter can be represented by a sequential circuit C, which outputs 1 every fourth cycle, otherwise 0. Let the evaluation of r 1 r 2 denote i=2.r 1 +r2 C is constructed such that the output bit y is set exactly for i=0 (hence r 1 =0,r 2 =0). So δ r1 =r 1 r 2, δ r2 = r 1, λ y = r 1 r 2. 24

25 Linear Temporal Logic: specifying properties (Con.) The circuit C and its transition system TS C is shown below: 25

26 Linear Temporal Logic: specifying properties (Con.) Let AP={r 1,r 2,y}. The following statement holds: TSC = (y r 1 r 2 ) TSC = (r 1 ( y y)) TSC = (y ( y y)). The property that at least during every four cycles the output 1 id obtained holds for TS C : TSC = (y y y y). 26

27 Linear Temporal Logic: specifying properties (Con.) The fact that these outputs are produced in a periodic manner where every fourth cycle yields the output 1 is expressed as: TSC = (y ( y y y)). Read example

28 Linear Temporal Logic: specifying properties (Con.) Example 5.13: Leader election protocol: Goal: a process with a higher identifier is elected. Processes are initially inactive, and may become active and then participate in the election (fairness: each process becomes active at some time). If an inactive process with higher id becomes active, a new leader election takes place. 28

29 Linear Temporal Logic: specifying properties (Con.) We use LTS to specify some properties. Let AP={leader i,active i 1 i,j N}. There is always one leader: (\/ 1 i N leader i /\ 1 j N,j i leader j ) Since initially no leader exists we modify it to: (\/ 1 i N leader i /\ 1 j N,j i leader j ) But this allows there to be more than one leader at a time temporarily, so: ( /\ 1 i N (leader i /\ 1 j N,j i leader j )) ( (\/ 1 i N leader i ) 29

30 Linear Temporal Logic: specifying properties (Con.) In the presence of an active process with a higher identity, the leader will resign at some time: /\ 1 i,j N,i<j ((leader i leader j active j ) leader i ) A new leader will be an improvement over the previous one: (/\ 1 i,j N,i j (leader i leader i leader j )) Read Example

31 Linear Temporal Logic: specifying properties (Con.) For synchronous systems LTL can be used as a formalism to specify real-time properties: ϕ states that at the next time instant ϕ holds. K ϕ =.. : ϕ holds after k time instants. k ϕ= \/ 0 i k i ϕ : ϕ will hold at most k time instants. 31

32 Linear Temporal Logic: specifying properties (Con.) k ϕ= \/ 0 i k i ϕ : ϕ holds now and will hold during the next k time instants. But for asynchronous systems the nextstep operator should be used with care. 32

33 Linear Temporal Logic: equivalence of LTL formulae Two formulae are intuitively equivalent whenever they have the same truth- value under all interpretations. Definition: LTL formulae ϕ 1,ϕ 2 are equivalent, denoted ϕ 1 ϕ 2, if Words(ϕ 1 )=Words(ϕ 2 ). 33

34 Linear Temporal Logic: equivalence of LTL formulae (Con.) As LTL subsumes propositional logic, equivalences of propositional logic also hold for LTL. For temporal modalities we have: 34

35 Linear Temporal Logic: equivalence of LTL formulae (Con.) 35

36 Linear Temporal Logic: equivalence of LTL formulae (Con.) The duality rule ϕ ϕ shows that next-step operator is dual to itself: In the absorption law ϕ ϕ : infinitely often ϕ is equal to from a certain point of time on, ϕ is true infinitely often. 36

37 Linear Temporal Logic: equivalence of LTL formulae (Con.) The distributive laws for and disjunction, or and conjunction are dual to each other: (ϕ ψ) ϕ ψ and (ϕ ψ) ϕ ψ Recall that (ϕ ψ) ϕ ψ and (ϕ ψ) ϕ ψ But (a b) a b and (a b) a b (the same holds for and ): 37

38 Linear Temporal Logic: equivalence of LTL formulae (Con.) The expansion laws describe the temporal modalities U, and by means of a recursive equivalence: These equivalences assert something about the current, and about the director successor state. ϕ U ψ ψ (ϕ (ϕuψ)): so ϕ U ψ is a solution of the equivalence k ψ (ϕ k). ψ ψ ψ is a special case of the expansion law for until: 38

39 Linear Temporal Logic: equivalence of LTL formulae (Con.) Lemma 5.18 (Until is least solution of the expansion law): For LTL formulae ϕ and ψ, Words(ϕUψ) is the least LT property P (2 AP ) ω such that: Words(ψ) {A 0,A 1,A 2 Words(ϕ) A 1 A 2 P} P (I) Moreover, Words(ϕUψ) agrees with the set: Words(ψ) {A 0,A 1,A 2 Words(ϕ) A 1 A 2 Words(ϕUψ)}. 39

40 Linear Temporal Logic: equivalence of LTL formulae (Con.) The formulation least LT property satisfying condition (I) means that the following conditions hold: (1) P= Words(ϕUψ) satisfies (I). Words(ϕUψ) P for all LT properties P satisfying condition (I). 40

41 Linear Temporal Logic: weak, release and positive normal form Any LTL formula can be transformed into a canonical form, called positive normal form (PNF), in which: Negations only occur adjacent to atomic propositions. Recall that PNF formulae in propositional logic are constructed from true, false, the literals a and a, and the operators and. 41

42 Linear Temporal Logic: weak, release and positive normal form (Con.) To transform any LTL formula into PNF, for each operator a dual operator is needed in the syntax: True and false, and. The next-step operator is a dual of itself. Consider the until operator: (ϕuψ) ((ϕ ψ) U ( ϕ ψ)) (ϕ ψ) 42

43 Linear Temporal Logic: weak, release and positive normal form (Con.) The operator W, called weak until or unless, as the dual of U: ϕwψ (ϕuψ) ϕ. Until and W are dual in the following sense: Note that W has the same expresivness to U. W and U satisfy the same expansion law. 43

44 Linear Temporal Logic: weak, release and positive normal form (Con.) Lemma 5.19 (weak-until is the greatest solution of the expansion law) For LTL formulae ϕ and ψ, Words(ϕWψ) is the greatest LT property P (2 AP ) ω such that: Words(ψ) {A 0,A 1,A 2 Words(ϕ) A 1 A 2 P} P (I) Moreover, Words(ϕUψ) agrees with the set: Words(ψ) {A 0,A 1,A 2 Words(ϕ) A 1 A 2 Words(ϕWψ)}. 44

45 Linear Temporal Logic: weak, release and positive normal form (Con.) The formulation greatest LT property satisfying condition (I) means that the following conditions hold: (1) P Words(ϕWψ) satisfies (I). Words(ϕWψ) P for all LT properties P satisfying condition (I). 45

46 Linear Temporal Logic: weak, release and positive normal form (Con.) Definition: For a AP, the set of LTL formulae in weak-until positive normal form (weak-until PNF) is given by: ϕ::= true false a a ϕ 1 ψ 2 ϕ 1 ψ 2 ϕ ϕ 1 Uψ 2 ϕ 1 Wψ 2 Since ϕ ϕ W false and ϕ true U ϕ, and can be also considered as permitted operator of W-PNF. 46

47 Linear Temporal Logic: weak, release and positive normal form (Con.) We can convert each LTL formula to its W-PNF by using the following rewrite rules: 47

48 Linear Temporal Logic: weak, release and positive normal form (Con.) Example 5.21: convert LTL formula ((aub) c) to weak-until PNF: ((aub) c) ((aub) c) ( (aub) c) ( (a b) W ( a b) c) 48

49 Linear Temporal Logic: weak, release and positive normal form (Con.) Theorem 5.22: For each LTL formula there exists an equivalent LTL formula in weak-until PNF. The main draw-back of rewrite rules is that the length of the resulting formula may be exponential in the length of the original nonpnf LTL formula: The rewrite rule for U and W, duplicates the operands. 49

50 Linear Temporal Logic: weak, release and positive normal form (Con.) We can avoid this exponential blow-up by using another temporal modality as the dual of until, called release and defined by : ϕrψ = ( ϕ U ψ) ϕrψ holds for a word if ψ always holds, a requirement that is released as soon as ϕ becomes valid. 50

51 Linear Temporal Logic: weak, release and positive normal form (Con.) The always operator is obtained from the release operator : ϕ false R ϕ. The weak-until and the until operator are obtained by: ϕwψ ( ϕ ψ) R (ϕ ψ) and vice versa ϕrψ ( ϕ ψ) W (ϕ ψ) ϕuψ ( ϕ R ψ) 51

52 Linear Temporal Logic: weak, release and positive normal form (Con.) Definition: For a AP, the set of LTL formulae in release positive normal form (release PNF) is given by: ϕ::= true false a a ϕ 1 ψ 2 ϕ 1 ψ 2 ϕ ϕ 1 Uψ 2 ϕ 1 Rψ 2 Thus the rewrite rules are: 52

53 Linear Temporal Logic: weak, release and positive normal form (Con.) Theorem 5.24: For any LTL formula ϕ there exists an equivalent LTL formula ϕ in release PNF with ϕ =O( ϕ ). 53

54 Linear Temporal Logic: Fairness in LTL Definition: Let Φ and Ψ be propositional logic formula over AP. 1. An unconditional LTL fairness constraint is an LTL formula of the form ufair= Ψ. 2. A strong LTL fairness condition is an LTL formula of the form ufair= Φ Ψ. 3. A weak LTL fairness constraint is an LTL formula of the form wfair= Φ Ψ. an LTL fairness assumption is a conjunction of LTL fairness constraints. 54

55 Linear Temporal Logic: Fairness in LTL (Con.) For instance, a strong LTL fairness assumption denote a conjunction of strong LTL fairness constraints: sfair = /\ 0<i k ( Φ i Ψ i ) for propositional logic formulae Φ i and Ψ i over AP. Generally LTL fairness assumptions are: fair = ufair sfair wfair 55

56 Linear Temporal Logic: Fairness in LTL (Con.) Let FairPaths(s) denote the set of all fair paths starting in s and FairTraces(s) the set of all traces induced by fair paths starting in s: FairPaths(s) ={π Paths(s) π =fair} FairTraces(s) = {Trace(π) π FairPaths(s)} Above definitions can be lifted to TSs yielding FairPaths(TS) and FairTraces(TS). 56

57 Linear Temporal Logic: Fairness in LTL (Con.) Definition: For state s in TS (over AP) without terminal state, LTL formula ϕ and LTL fairness assumptions fair let s = fair ϕ iff π FairPaths(s). π = ϕ and TS = fair ϕ iff s 0 I.s 0 = fair ϕ. TS satisfies ϕ under the LTL fairness assumption fair if ϕ holds for all fair paths that originate from some initial state. 57

58 Linear Temporal Logic: Fairness in LTL (Con.) Example 5.27: Consider the mutual exclusion with randomized arbiter: 58

59 Linear Temporal Logic: Fairness in LTL (Con.) Arbiter tosses a coin, modeled by nondeterministic choice between heads and tails, to choose a process to enters its critical section. process P i is in its critical section infinitely often : TS 1 Arbiter TS 2 crit 1 (why?) TS 1 Arbiter TS 2 = fair crit 1 crit 2 where fair= heads tails. 59

60 Linear Temporal Logic: Fairness in LTL (Con.) In chapter 3, fairness was introduced using set of actions: An execution is unconditionally A-fair for a set of actions A, whenever each action α A occurs infinitely often. However LTL-fairness is defined on atomic propositions, i.e., from a statebased perspective. 60

61 Linear Temporal Logic: Fairness in LTL (Con.) Action-based fairness assumptions can always be translated into analogous LTL fairness assumption. The intuition is Make a copy of each non-initial state s such that it is recorded which action was executed to enter s. The copied state <s,α> indicates that state s has been reached by performing α as last action. 61

62 Linear Temporal Logic: Fairness in LTL (Con.) Formally for TS=(S,Act,,I,AP,L) let TS =(S,Act,,I,AP,L ) where Act=Act {begin}, I =I {begin}, S =I (S Act), TS is defined by : 62

63 Linear Temporal Logic: Fairness in LTL (Con.) L is defined: L (<s,α>)=l(s) {taken(α)} {enabled(β) β Act(s)} L (<s 0,begin>)=L(s 0 ) {enabled(β) β Act(s 0 )}. It can be established that Traces AP (TS)=Traces AP (TS ). Thus strong fairness for A Act can be described by LTL fairness assumption: sfair A = enabled(a) taken(a) enabled(a)=\/ α A enabled(α), taken(a)=\/ α A taken(α) 63

64 Linear Temporal Logic: Fairness in LTL (Con.) The set of fair traces of action-based fairness assumption F for TS and its corresponding LTL fairness fair for TS coincides: {Trace AP (π) π Paths(TS), π is F-fair}= {TraceAP(π ) π Paths(TS ), π = fair} Thus FairTraces F (TS)=FairTraces fair (TS ): TS = F P iff TS = fair P. 64

65 Linear Temporal Logic: Fairness in LTL (Con.) Conversely, a (state-based) LTL fairness assumptions cannot always be represented as action-based fairness assumption. Because strong or weak LTL fairness assumptions need not be realizable while action-based can be realized by a scheduler. State-based LTL fairness assumptions are more general then action-based. 65

66 Linear Temporal Logic: Fairness in LTL (Con.) Theorem 5:30: For transition system TS without terminal state, LTL formula ϕ, and LTL fairness assumption fair: TS = fair ϕ iff TS =(fair ϕ) Read Examples

67 Automata-Based LTL Model Checking Given a finite transition system TS and an LTL formula ϕ (a requirement on TS), an LTL model-checking algorithm checks TS = ϕ: If ϕ is refuted, an error trace needs to be returned. 67

68 Automata-Based LTL Model Checking (Con.) In following, we assume that TS is finite and has no terminal state. The model-checking algorithm that we are going to introduce is based on automata-based approach: Each LTL formula ϕ is represented by a nondeterministic büchi automaton (NBA). The basic idea is to disprove TS = ϕ by looking for a path π in TS with π = ϕ. 68

69 Automata-Based LTL Model Checking (Con.) If such a path is found, a prefix of π is returned as error trace. If no such path is encountered, it is concluded that TS =ϕ. This Algorithm relies on following observation: 69

70 Automata-Based LTL Model Checking (Con.) Hence, for NBA A with L ω (A)=Words( ϕ) we have : TS = ϕ if and only if Traces(TS) L ω (A)=. Thus, to check ϕ holds for TS, we first construct an NBA for the negation of the input formula ϕ and then look for their intersection TS A ϕ. 70

71 Automata-Based LTL Model Checking (Con.) Definition: A nondeterministic Büchi automaton (NBA) A is a tuple A=(Q,Σ,δ,Q 0,F) where: Q is a finite set of states, Σ is an alphabet, δ:q Σ 2 Q is a transition function, Q 0 Q is a set of initial states, and F Q is a set of accept (or:final) states, called the acceptance set. 71

72 Automata-Based LTL Model Checking (Con.) A run for σ=a 0 A 1 A 2... Σ ω denotes an infinite sequence q 0 q 1 q 2... of states in A such that q 0 Q 0 and q i Ai q i+1 for i 0. Run q 0 q 1 q 2... is accepting if q i F for infinitely many indices i IN. The accepted language of A is: L ω (A)={σ Σ ω there exists an accepting run for σ in A}. The size of A, denoted A, is defined as the number of states and transitions in A. 72

73 Automata-Based LTL Model Checking (Con.) Since the states Q of an NBA A is finite, each run for an infinite word σ Σ ω is infinite, and hence visits some state q Q infinitely often. Acceptance of a run depends on whether or not the set of all states that appear infinitely often in the given run contains an accept state. If F=, no run is accepting and L ω (A)=. 73

74 Automata-Based LTL Model Checking (Con.) Example: consider the NBA below with the alphabet Σ={A,B,C}: The language accepted by this NBA is given by the ω-regular expression: C AB(B + +BC AB) ω. Read Examples

75 Criterion for the Nonemptiness of an NBA Lemma 4.41: Let A = (Q,Σ,δ,Q 0,F) be an NBA. Then the following two statements are equivalent: L ω (A) Ø, There exists a reachable accept q that belongs to a cycle in A. Formally q 0 Q 0 q F w Σ* v Σ +. q δ*(q 0,w) δ*(q,v) 75

76 Checking Emptiness for NBA Theorem 4.42: The emptiness problem for NBA A can be solved in time O( A ). 76

77 Automata-Based LTL Model Checking (Con.) Definition: Let A=(Q,Σ,δ,Q 0,F) be an NBA. A is called nonblocking if δ(q,a) for all states q and all symbols A Σ. Note that for a given nonblocking NBA A and input word σ Σ ω, there is at least one (infinite) possibly non-accepting run for σ in A. Thus it is not a restriction to assume a NBA is nonblocking. 77

78 Automata-Based LTL Model Checking (Con.) Definition: A persistence property over AP is an LT property P pers (2 AP ) ω eventually forever Φ for some propositional logic formula Φ over AP: P pers ={A 0 A 1 A 2... (2 AP ) ω j.a j =Φ} where j is short for i 0. j i. Formula Φ is called a persistence (or state) condition of P pers. 78

79 Automata-Based LTL Model Checking (Con.) Intuitively, a persistence property eventually forever Φ ensures the tenacity of the state property given by the persistence condition Φ. In other words Φ is an invariant after a while; i.e., from a certain point on all states satisfy Φ. 79

80 Automata-Based LTL Model Checking (Con.) The formula eventually forever Φ is true for a path if and only if almost all,i.e., all except for finitely many, states satisfy the proposition Φ. Our goal is to show that the question whether Traces(TS) L ω (A)= holds can be reduced to the question whether a certain persistence property holds in the product of TS and A. 80

81 Automata-Based LTL Model Checking (Con.) Defintion: Let TS=(S,Act,,I,AP,L) be a transition system without terminal states and A=(Q,2 AP,δ,Q 0,F) a non-blocking NBA. Then, product TS and A is: TS A=(S Q,Act,,I,AP,L ) where is the smallest relation defined by the rule: α L(t) s t q p α s,q t, p 81

82 Automata-Based LTL Model Checking (Con.) where I={ s 0,q s 0 I q 0 Q 0.q 0 L(s0) q}, AP =Q and L :S Q 2 Q is given by L ( s,q ) ={q}. Furthermore, let P pers (A) be the persistence property over AP =Q given by eventually forever F where F denotes the propositional formula /\ q F q over AP =Q. 82

83 Verification of ω-regular Properties Theorem 4.63: Let TS be a finite transition system without terminal states over AP and let P be an ω-regular property over AP. Furthermore, let A be a nonblocking NBA with the alphabet 2 AP and L ω (A)= (2 AP ) ω \P. Then, the following statements are equivalent: TS =P Traces(TS) L ω (A)= TS A = P pers (A). 83

84 Persistence Checking and Cycle Detection Theorem 4.65: Let TS be a finite transition system without terminal states over AP, Φ be a propositional formula over AP, and P pers the persistence property eventually forever Φ. Then, the following statements are equivalent: TS P pers There exists a reachable Φ state s which belongs to a cycle. Formally: s Reach(TS). s Φ s is on a cycle in G(TS). 84

85 Naïve Persistence Checking 85

86 Cycle Detection 86

87 Persistence Checking by nested depth-first search 87

88 Time Complexity of Persistence Checking Theorem 4.70: The worst-case time complexity of Algorithm 8 is O((N+M)+N. Φ ) where N is the number of reachable states, and M the number of transitions between the reachable states. 88

89 Automata-Based LTL Model Checking (Con.) Thus the LTL model-checking algorithm is: 89

90 Automata-Based LTL Model Checking (Con.) Now it remains to show that how a given LTL property can be presented by a NBA and such an NBA can be constructed algorithmically. Recall that the LTL semantics yields a language Words(ϕ) (2 AP ) ω. Thus the alphabet of NBA for LTL formulae is Σ=2 AP. We show that Words(ϕ) is ω-regular, and hence, can be represented by a NBA. 90

91 Automata-Based LTL Model Checking (Con.) Example 5.32: The edges of a NBA can be represented symbolically by propositional logics over symbols a AP, true and Boolean connectors. Thus they can be interpreted over sets of propositions A Σ=2 AP. If AP={a,b} then q a b q is a short notation for the three transitions: q {a} q, q {b} q, and q {a,b} q. 91

92 Automata-Based LTL Model Checking (Con.) The language of all words σ=a 0 A 1 2 AP satisfying the LTL formula green is accepted by the NBA below: A is in the accept state q 1 if and only if the last consumed symbol (the last set A i of the input word A 0 A 1 A 2... (2 AP ) ω ) contains the propositional symbol green. 92

93 Automata-Based LTL Model Checking (Con.) The liveness property: whenever event a occurs, event b will eventually occur. An associated NBA over the alphabet 2 {a,b} is shown below: 93

94 Automata-Based LTL Model Checking (Con.) To construct an NBA A satisfying L ω (A)=Words(ϕ) for the LTL formula ϕ, first a generalized NBA is constructed for ϕ, which subsequently is transformed into an equivalent NBA. 94

95 Automata-Based LTL Model Checking (Con.) The whole picture of LTL model checking: 95

96 Automata-Based LTL Model Checking (Con.) Definition: A generalized NBA is a tuple G=(Q,Σ,δ,Q 0,F ) where Q, Σ, δ, Q 0 are defined as for NBA and F is a subset of 2 Q. The elements of F are called acceptance sets. 96

97 Automata-Based LTL Model Checking (Con.) The accepted language L ω (G) consists of all infinite words in (2 AP ) ω that have at least one infinite run q 0 q 1 q 2... in G such that for each acceptance set F F there are infinitely many indices i with q i F. A GNBA for which F is a singleton set can be regarded as an NBA. 97

98 Automata-Based LTL Model Checking (Con.) Assume ϕ only contains the operators,, and U, i.e., the derived operators,,,, W and so on are assumed to be expressed in terms of the basic operators. Since ϕ=true is trivial, it may be assumed that ϕ true. 98

99 Automata-Based LTL Model Checking (Con.) The basic idea to construct a GNBA over the alphabet 2 AP for a given LTL formula ϕ (over AP), i.e., L ω (g ϕ )=Words(ϕ) is: Let σ=a 0 A 1 A 2 Words(ϕ). The sets A i AP are expanded by subformulae ψ (and their negation) of ϕ such that an infinite word σ=b 0 B 1 B 2 with the following property arises: ψ B i if and only if A i A i+1 A i+2 =ψ σ i 99

100 Automata-Based LTL Model Checking (Con.) The GNBA g ϕ is constructed such that B i constitute its states. Moreover, the construction ensures that σ=b 0 B 1 B 2 is a run for σ= A 0 A 1 A 2 in G ϕ. The accepting conditions for g ϕ are chosen such that the run σ is accepting if and only if σ =ϕ. We encode the meaning of the logical operators into the states, transitions and acceptance sets of G ϕ. 100

101 Automata-Based LTL Model Checking (Con.) Let ϕ= au( a b) and σ={a}{a,b}{b} : B i is a subset of the set of formulae {a,b, a, a b,ϕ} { b, ( a b), ϕ). ϕ ϕ The set A 0 ={a} is extended with formulae b, ( a b) and ϕ, since all these formula hold in σ 0 =σ and all other subformulae in the above set are refuted by σ. The set A 1 ={a,b} is extended with the formulae ( a b) and ϕ, as they hold in σ 1 ={a,b}{b}. 101

102 Automata-Based LTL Model Checking (Con.) The A 2 ={b} is extended with a, a b and ϕ as they hold in σ 2 ={b}. These yield σ= {a, b, ( a b),ϕ} {a,b, ( a b),ϕ} { a,b, a b,ϕ} 102

103 Automata-Based LTL Model Checking (Con.) Definition: The closure of LTL formula ϕ is the set closure(ϕ) consisting of all subformulae ψ of ϕ and their negation ψ (where ψ and ψ are identical). For instance, for ϕ= au( a b), the closure(ϕ)={a,b, a, b, a b, ( a b),ϕ, ϕ}. closure(ϕ) O( ϕ ) 103

104 Automata-Based LTL Model Checking (Con.) B is consistent with respect to propositional logic, i.e., for all ϕ 1 ϕ 2, ψ closure(ϕ): ϕ 1 ϕ 2 B ϕ 1 B and ϕ 2 B ψ B ψ B True closure(ϕ) true B. 104

105 Automata-Based LTL Model Checking (Con.) B is locally consistent with respect to the until operator, i.e., for all ϕ 1 Uϕ 2 closure(ϕ): Φ 2 B ϕ 1 Uϕ 2 B ϕ 1 Uϕ 2 B and ϕ 2 B ϕ 1 B. B is maximal, i.e., for all ψ closure(ϕ): ψ B ψ B. 105

106 Automata-Based LTL Model Checking (Con.) Definition: B closure(ϕ) is elementary if it is consistent with respect to propositional logic, maximal, and locally consistent with respect to the until operator. 106

107 Automata-Based LTL Model Checking (Con.) Example 5.35: let ϕ=au( a b): B 0 ={a,b,ϕ} is consistent with respect to propositional logic and locally consistent with respect to the until operator. But it is not maximal. Why? B 1 ={a,b, a b,ϕ} is not consistent with respect to propositional logic. Why? B 2 ={a,b, ( a b), ϕ} is an elementary set. 107

108 Automata-Based LTL Model Checking (Con.) Let ϕ be an LTL formula over AP. Let G ϕ =(Q,2 AP,δ,Q 0,F ) be its corresponding GNBA, where Q is the set of all elementary sets of formulae B closure(ϕ), Q 0 ={B Q ϕ B}, F ={F ϕ1uϕ2 ϕ 1 Uϕ 2 closure(ϕ)} where F ϕ1uϕ2 ={B Q ϕ 1 Uϕ 2 B or ϕ 2 B}. 108

109 Automata-Based LTL Model Checking (Con.) The transition relation δ:q 2 AP 2 Q is given by: If A B AP, then δ(b,a)=. If A=B AP, then δ(b,a) is the set of all elementary sets of formulae B satisfying i. for every ψ closure(ϕ): ψ B ψ B, and ii. For every ϕ 1 Uϕ 2 closure(ϕ): ϕ 1 Uϕ 2 B (ϕ 2 B (ϕ 1 B ϕ 1 Uϕ 2 B )). 109

110 Automata-Based LTL Model Checking (Con.) The conditions (i) and (ii) reflect the semantics of the next step and the until operator, respectively. Rule (ii) is justified by the expansion rule: ϕ 1 Uϕ 2 ϕ 2 (ϕ 1 (ϕ 1 Uϕ 2 )). 110

111 Automata-Based LTL Model Checking (Con.) To model the semantics of U, an acceptance set F ψ is introduced for every subformula ψ=ϕ 1 Uϕ 2 of ϕ. Thus every run B 0 B 1 B 2... for which ψ B 0, we have ϕ 2 B j (for some j 0) and ϕ 1 B i for all i<j. The requirement that a word σ satisfies ϕ 1 Uϕ 2 only if ϕ 2 will actually eventually become true is ensured by the accepting set F ϕ1uϕ2. 111

112 Automata-Based LTL Model Checking (Con.) Example 5.38: let ϕ= a. It corresponding GNBA G ϕ is: Q = {B 1,B 2,B 3,B 4 } where B 1 ={a, a}, B 2 ={a, a}, B 3 ={ a, a}, B 4 ={ a, a}, Q 0 ={B 1,B 3 } since a B 1,B 3, 2 {a} ={,{a}} and δ is defined: B 1 {a}={a}, so δ(b 1,{a})={B 1,B 2 } since a B 1 and B 1 and B 2 are the only states that contain a. B 1 =, so δ(b 1, )=. 112

113 Automata-Based LTL Model Checking (Con.) The resulting GNBA is shown below: Read Example

114 Automata-Based LTL Model Checking (Con.) Any state of the GNBA for an LTL formula ϕ contains either ψ or its negation ψ for every subformula ψ of ϕ. This is somewhat redundant. It suffices to represent state B closure(ϕ) by the propositional symbols a B AP, and the formulae ψ or ϕ 1 Uϕ 2 B. 114

115 Automata-Based LTL Model Checking (Con.) Having constructed a GNBAG ϕ for a given LTL formula ϕ, an NBA for ϕ can be obtained by the transformation GNBA NBA described in following. 115

116 Automata-Based LTL Model Checking (Con.) Let G=(Q,Σ,δ,Q 0,F ) be a GNBA. Let F ={F 1,...,F k } where k 1. The basic idea of the construction of A is to create k copies of G such that the acceptance set F i of the ith copy is connected to the corresponding states of the (i+1)th copy. 116

117 Automata-Based LTL Model Checking (Con.) The accepting condition for A consists of the requirement that an accepting state of the first copy is visited infinitely often: This ensures that all other accepting sets F i of the k copies are visited infinitely often too: 117

118 Automata-Based LTL Model Checking (Con.) Formally, let A=(Q,Σ,δ,Q 0,F ) be the corresponding NBA,where: Q =Q {1,...,k}, Q 0 =Q 0 {1}={ q 0,1 q 0 Q 0 }, F =F 1 {1}={ q F,1 q F F 1 }, The transition function δ is given by δ'( q,i,a)= { q,i q δ(q,a)} if q Fi { q,i+1 q δ(q,a)} otherwise We identify q,1 and q,k

119 Automata-Based LTL Model Checking (Con.) Theorem: For each GNBA G there exists an NBA A with L ω (G)=L ω (A) and A =O( G F ) where F denotes the set of acceptance sets in G. F denotes the number of copies. In transforming the GNBA of a LTL formula ϕ to its NBA, the number of copies that we need is the number of until subformulae of ϕ. 119

120 Automata-Based LTL Model Checking (Con.) Theorem: For any LTL formula ϕ (over AP) there exists an NBA A ϕ with Words(ϕ)=L ω (A ϕ ) which can be constructed in time and space 2 O( ϕ ). It should be noted that the size of the resulting GNBA grows up exponentially with respect to the size of formula. 120

121 Complexity of the LTL Modelchecking problem As explained before, the essential idea behind the automata-based model- checking algorithm for LTL is based upon the following relations: 121

122 Complexity of the LTL Modelchecking problem (Con.) The GNBA G ϕ has at most 2 ϕ states with ϕ accepting states (the number of untilsubformulas in ϕ). The NBA A ϕ can thus be constructed in exponential time: O(2 ϕ ϕ )=O(2 ϕ +log ϕ ). Thus an upper bound for the time-and space-complexity of LTL model checking is O( TS 2 ϕ ). 122

123 LTL Model Checking with Fairness As a consequence of Theorem 5.30, the model-checking problem for LTL with fairness assumptions can be reduced to the model-checking problem for plain LTL. In order to check the formula ϕ under fairness assumption fair, it suffices to verify the formula fair ϕ with an LTL model-checking algorithm. 123

124 LTL Model Checking with Fairness (Con.) The drawback of this approach is that the length fair can have an exponential influence on the run-time of the algorithm. The construction of an NBA for the negated formula (fair ϕ) is exponential in (fair ϕ) = fair + ϕ. To avoid this, a modified persistence check can be exploited to analyze TS A ϕ (instead of TS A (fair ϕ) ). 124