FORMAL METHODS LECTURE IV: COMPUTATION TREE LOGIC (CTL)

Transcription

1 Alessandro Artale (FM First Semester 2007/2008) p. 1/37 FORMAL METHODS LECTURE IV: COMPUTATION TREE LOGIC (CTL) Alessandro Artale Faculty of Computer Science Free University of Bolzano artale/ Some material (text, figures) displayed in these slides is courtesy of: M. Benerecetti, A. Cimatti, M. Fisher, F. Giunchiglia, M. Pistore, M. Roveri, R.Sebastiani.

2 Alessandro Artale (FM First Semester 2007/2008) p. 2/37 Summary of Lecture IV Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

3 Alessandro Artale (FM First Semester 2007/2008) p. 3/37 Computation Tree logic Vs. LTL LTL implicitly quantifies universally over paths. KM,s = φ iff for every path π starting at s KM,π = φ Properties that assert the existence of a path cannot be expressed. In particular, properties which mix existential and universal path quantifiers cannot be expressed. The Computation Tree Logic, CTL, solves these problems! CTL explicitly introduces path quantifiers! CTL is the natural temporal logic interpreted over Branching Time Structures.

4 Alessandro Artale (FM First Semester 2007/2008) p. 4/37 CTL at a glance CTL is evaluated over branching-time structures (Trees). CTL explicitly introduces path quantifiers: All Paths: P Exists a Path: P. Every temporal operator ( path quantifier ( P or P ).,,,U ) preceded by a Universal modalities: P, P, P, P U The temporal formula is true in all the paths starting in the current state. Existential modalities: P, P, P, P U The temporal formula is true in some path starting in the current state.

5 Alessandro Artale (FM First Semester 2007/2008) p. 5/37 Summary Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

6 Alessandro Artale (FM First Semester 2007/2008) p. 6/37 CTL: Syntax Countable set Σ of atomic propositions: p,q,... the set FORM of formulas is: ϕ,ψ p ϕ ϕ ψ ϕ ψ P ϕ P ϕ P ϕ P (ϕu ψ) P ϕ P ϕ P ϕ (ϕu P ψ)

7 Alessandro Artale (FM First Semester 2007/2008) p. 7/37 CTL: Semantics We interpret our CTL temporal formulas over Kripke Models linearized as trees (e.g. P done).!done!done done!done done done!done done!done done done done Universal modalities ( P, P, P, P U ): the temporal formula is true in all the paths starting in the current state. Existential modalities ( P, P, P, P U ): the temporal formula is true in some path starting in the current state.

8 Alessandro Artale (FM First Semester 2007/2008) p. 8/37 CTL: Semantics (Cont.) Let Σ be a set of atomic propositions. We interpret our CTL temporal formulas over Kripke Models: KM = S,I,R,Σ,L The semantics of a temporal formula is provided by the satisfaction relation: =: (KM S FORM) {true,false}

9 Alessandro Artale (FM First Semester 2007/2008) p. 9/37 CTL Semantics: The Propositional Aspect We start by defining when an atomic proposition is true at a state/time s i KM, s i = p iff p L(s i ) (for p Σ) The semantics for the classical operators is as expected: KM, s i = ϕ iff KM, s i = ϕ KM, s i = ϕ ψ iff KM, s i = ϕ andkm, s i = ψ KM, s i = ϕ ψ iff KM, s i = ϕ orkm, s i = ψ KM, s i = ϕ ψ iff ifkm, s i = ϕ thenkm, s i = ψ KM, s i = KM, s i =

10 Alessandro Artale (FM First Semester 2007/2008) p. 10/37 CTL Semantics: The Temporal Aspect Temporal operators have the following semantics where π=(s i,s i+1,...) is a generic path outgoing from state s i inkm. KM,s i = P ϕ iff π = (s i,s i+1,...) KM,s i+1 = ϕ KM,s i = P ϕ iff π = (s i,s i+1,...) KM,s i+1 = ϕ KM,s i = P ϕ iff π = (s i,s i+1,...) j i.km,s j = ϕ KM,s i = P ϕ iff π = (s i,s i+1,...) j i.km,s j = ϕ KM,s i = P ϕ iff π = (s i,s i+1,...) j i.km,s j = ϕ KM,s i = P ϕ iff π = (s i,s i+1,...) j i.km,s j = ϕ KM,s i = P (ϕu ψ) iff π = (si,s i+1,...) j i.km,s j = ψ and i k < j : M,s k = ϕ KM,s i = P (ϕu ψ) iff π = (si,s i+1,...) j i.km,s j = ψ and i k < j :KM,s k = ϕ

11 Alessandro Artale (FM First Semester 2007/2008) p. 11/37 CTL Semantics: Intuitions CTL is given by the standard boolean logic enhanced with temporal operators. Necessarily Next. P successor state s t+1 ϕ is true in s t iff ϕ is true in every Possibly Next. P ϕ is true in s t iff ϕ is true in one successor state s t+1 Necessarily in the future (or Inevitably ). P ϕ is true in s t iff ϕ is inevitably true in some s t with t t Possibly in the future (or Possibly ). P ϕ is true in s t iff ϕ may be true in some s t with t t

12 Alessandro Artale (FM First Semester 2007/2008) p. 12/37 CTL Semantics: Intuitions (Cont.) Globally (or always ). P ϕ is true in s t iff ϕ is true in all s t with t t Possibly henceforth. P ϕ is true in s t iff ϕ is possibly true henceforth Necessarily Until. (ϕu P ψ) is true in s t iff necessarily ϕ holds until ψ holds. Possibly Until. (ϕu P ψ) is true in s t iff possibly ϕ holds until ψ holds.

13 Alessandro Artale (FM First Semester 2007/2008) p. 13/37 CTL Alternative Notation Alternative notations are used for temporal operators. P E there Exists a path P A in All paths F sometime in the Future G Globally in the future X nextime

14 Alessandro Artale (FM First Semester 2007/2008) p. 14/37 CTL Semantics: Intuitions (Cont.) finally P globally P next P P until q AFP AGP AXP A[ P U q ] EFP EGP EXP E[ P U q ]

15 Alessandro Artale (FM First Semester 2007/2008) p. 15/37 A Complete Set of CTL Operators All CTL operators can be expressed via: P, P, P U P P ϕ P ϕ P ϕ P ϕ ( U P ϕ) P ϕ P ϕ ( U P ϕ) (ϕu P ψ) P ψ ( ψu P ( ϕ ψ))

16 Alessandro Artale (FM First Semester 2007/2008) p. 16/37 Summary Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

17 Alessandro Artale (FM First Semester 2007/2008) p. 17/37 Safety Properties Safety: something bad will not happen Typical examples: P (reactor_temp > 1000) P (one_way P other_way) P ((x = 0) P P P (y = z/x)) and so on... Usually: P...

18 Alessandro Artale (FM First Semester 2007/2008) p. 18/37 Liveness Properties Liveness: something good will happen Typical examples: P rich P (x > 5) P (start P terminate) and so on... Usually: P...

19 Alessandro Artale (FM First Semester 2007/2008) p. 19/37 Fairness Properties Often only really useful when scheduling processes, responding to messages, etc. Fairness: something is successful/allocated infinitely often Typical example: P ( P enabled) Usually: P P...

20 Alessandro Artale (FM First Semester 2007/2008) p. 20/37 Summary Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

21 Alessandro Artale (FM First Semester 2007/2008) p. 21/37 The CTL Model Checking Problem The CTL Model Checking Problem is formulated as: KM = φ Check ifkm,s 0 = φ, for every initial state, s 0, of the Kripke structurekm.

22 Alessandro Artale (FM First Semester 2007/2008) p. 22/37 Example 1: Mutual Exclusion (Safety) N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P (C 1 C 2 )? T1, C2

23 Alessandro Artale (FM First Semester 2007/2008) p. 22/37 Example 1: Mutual Exclusion (Safety) N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P (C 1 C 2 )? T1, C2 YES: There is no reachable state in which (C 1 C 2 ) holds! (Same as the (C 1 C 2 ) in LTL.)

24 Alessandro Artale (FM First Semester 2007/2008) p. 23/37 Example 2: Liveness N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 T1, C2 KM = P (T 1 P C 1 )?

25 Alessandro Artale (FM First Semester 2007/2008) p. 23/37 Example 2: Liveness N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P (T 1 P C 1 )? T1, C2 YES: every path starting from each state where T 1 holds passes through a state where C 1 holds. (Same as (T 1 C 1 ) in LTL)

26 Alessandro Artale (FM First Semester 2007/2008) p. 24/37 Example 3: Fairness N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P P C 1? T1, C2

27 Alessandro Artale (FM First Semester 2007/2008) p. 24/37 Example 3: Fairness N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P P C 1? T1, C2 NO: e.g., in the initial state, there is the blue cyclic path in which C 1 never holds! (Same as C 1 in LTL)

28 Alessandro Artale (FM First Semester 2007/2008) p. 25/37 Example 4: Non-Blocking N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 T1, C2 KM = P (N 1 P T 1 )?

29 Alessandro Artale (FM First Semester 2007/2008) p. 25/37 Example 4: Non-Blocking N = noncritical, T = trying, C = critical N1, N2 User 1 User 2 turn=0 T1, N2 N1, T2 C1, N2 T1, T2 T1, T2 N1, C2 C1, T2 KM = P (N 1 P T 1 )? T1, C2 YES: from each state where N 1 holds there is a path leading to a state where T 1 holds. (No corresponding LTL formulas)

30 Alessandro Artale (FM First Semester 2007/2008) p. 26/37 Summary Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

31 Alessandro Artale (FM First Semester 2007/2008) p. 27/37 LTL Vs. CTL: Expressiveness Many CTL formulas cannot be expressed in LTL (e.g., those containing paths quantified existentially) E.g., P (N 1 P T 1 ) Many LTL formulas cannot be expressed in CTL E.g., T 1 C 1 (Strong Fairness in LTL) i.e, formulas that select a range of paths with a property ( p q Vs. P (p P q)) Some formluas can be expressed both in LTL and in CTL (typically LTL formulas with operators of nesting depth 1) E.g., (C 1 C 2 ), C 1, (T 1 C 1 ), C 1

32 Alessandro Artale (FM First Semester 2007/2008) p. 28/37 LTL Vs. CTL: Expressiveness (Cont.) CTL and LTL have incomparable expressive power. The choice between LTL and CTL depends on the application and the personal preferences. LTL CTL

33 Alessandro Artale (FM First Semester 2007/2008) p. 29/37 Summary Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.

34 Alessandro Artale (FM First Semester 2007/2008) p. 30/37 The Computation Tree Logic CTL* CTL* is a logic that combines the expressive power of LTL and CTL. Temporal operators can be applied without any constraints. P ( ϕ ϕ). Along all paths, ϕ is true in the next state or the next two steps. P ( ϕ). There is a path along which ϕ is infinitely often true.

35 Alessandro Artale (FM First Semester 2007/2008) p. 31/37 CTL*: Syntax Countable set Σ of atomic propositions: p,q,... we distinguish between States Formulas (evaluated on states): ϕ,ψ p ϕ ϕ ψ ϕ ψ P α P α and Path Formulas (evaluated on paths): α,β ϕ α α β α β α α α (αu β) The set of CTL* formulas FORM is the set of state formulas.

36 Alessandro Artale (FM First Semester 2007/2008) p. 32/37 CTL* Semantics: State Formulas We start by defining when an atomic proposition is true at a state s 0 KM, s 0 = p iff p L(s 0 ) (for p Σ) The semantics for State Formulas is the following where π = (s 0,s 1,...) is a generic path outgoing from state s 0 : KM, s 0 = ϕ iff KM, s 0 = ϕ KM, s 0 = ϕ ψ iff KM, s 0 = ϕ andkm, s 0 = ψ KM, s 0 = ϕ ψ iff KM, s 0 = ϕ orkm, s 0 = ψ KM, s 0 = P α iff π = (s 0,s 1,...)such thatkm,π = α KM, s 0 = P α iff π = (s 0,s 1,...)thenKM,π = α

37 Alessandro Artale (FM First Semester 2007/2008) p. 33/37 CTL* Semantics: Path Formulas The semantics for Path Formulas is the following where π = (s 0,s 1,...) is a generic path outgoing from state s 0 and π i denotes the suffix path (s i,s i+1,...): KM, π = ϕ iff KM, s 0 = ϕ KM, π = α iff KM, π = α KM, π = α β iff KM, π = α andkm, π = β KM, π = α β iff KM, π = α orkm, π = β KM, π = α iff i 0such thatkm,π i = α KM, π = α iff i 0thenKM,π i = α KM, π = α iff KM,π 1 = α KM, π = αu β iff i 0such thatkm,π i = β and j.(0 j i) thenkm,π j = α

38 Alessandro Artale (FM First Semester 2007/2008) p. 34/37 CTLs Vs LTL Vs CTL: Expressiveness CTL* subsumes both CTL and LTL ϕ in CTL = ϕ in CTL* (e.g., P (N 1 P T 1 )) ϕ in LTL = P ϕ in CTL* (e.g., P ( T 1 C 1 )) LTL CTL CTL* (e.g., P ( p q)) CTL* LTL CTL

39 Alessandro Artale (FM First Semester 2007/2008) p. 35/37 CTL* Vs LTL Vs CTL: Complexity The following Table shows the Computational Complexity of checking Satisbiability Logic LTL CTL CTL* Complexity PSpace-Complete ExpTime-Complete 2ExpTime-Complete

40 Alessandro Artale (FM First Semester 2007/2008) p. 36/37 CTL* Vs LTL Vs CTL: Complexity (Cont.) The following Table shows the Computational Complexity of Model Checking (M.C.) Since M.C. has 2 inputs the model,m, and the formula, ϕ we give two complexity measures. Logic Complexity w.r.t. ϕ Complexity w.r.t. M LTL PSpace-Complete P (linear) CTL P-Complete P (linear) CTL* PSpace-Complete P (linear)

41 Alessandro Artale (FM First Semester 2007/2008) p. 37/37 Summary of Lecture IV Computation Tree Logic: Intuitions. CTL: Syntax and Semantics. CTL in Computer Science. CTL and Model Checking: Examples. CTL Vs. LTL. CTL*.