Basics of Linear Temporal Proper2es

Transcription

1 Basics of Linear Temporal Proper2es Robert B. France State vs ac2on view Ac2on view abstracts out states; focus only on ac2on labels State view: focus only on states and the proposi2ons that are true in states Introduction 1

2 Defini2ons Post(s) consists of all the target states associated with s via transi2ons from s The state graph of a TS = (S, Act, - >, I, AP, L), G(TS) is the digraph (V, E) with ver2ces V = S and edges E = {(s,s ) S x S s Post(s)} G(TS) is obtained by omitng all atomic proposi2ons in states, and all ac2on labels. Ini2al states are not dis2nguished in a state graph Mul2ple transi2ons between two states are represented by one edge in a state graph Post*(s): the set of states that are reachable from s in a state graph If C is a set of states then Post*(C) = U s C Post*(s) Path fragments A path fragment is a path s0, s1, s2, where s1 in Post(s0), s2 in Post(s1) etc. Can be finite or infinite A maximal path fragment is a path that cannot be prolonged, i.e., it is either infinite or ends in a state, sfinal, in which Post(sfinal) is empty (terminal state) A path is ini2al if its first state is an ini2al state A path of a transi2on system is an ini2al, maximal path fragment Path(s) is the set of maximal path fragments in which the first element is s Introduction 2

3 Execu2ons of a TS TS Execu2ons formalize the no2on of behavior in a modeled system A finite execu4on fragment of a TS is a sequence of state transi2ons. For example, s0- act1- >s1, s1- act2- >s3, is wri`en as an alterna2ng sequence of states and ac2ons that ends in a state, s0,act1,s1,act2,s3 An infinite execu4on fragment is an infinite sequence of transi2ons A maximal execu4on fragment is either a finite execu2on fragment that ends in a final state, or an infinite execu2on fragment. An execu2on fragment is called ini2al if it starts in an ini2al state. An execu2on of a transi2on system is an ini2al maximal execu2on fragment Traces States are observed through their associated atomic proposi2ons The execu2on s0,act0,s1,act1,s2,act2,s3, can be represented as a trace, L(s0),L(s1),L (s2),l(s3), in a state view of a transi2on system A trace is thus a word over the power set of AP in a transi2on system 2 AP Introduction 3

4 Traces and paths Defini4on 3.8. Trace and Trace Fragment Let TS = (S, Act,, I,AP, L) be a transi6on system without terminal states. The trace of the infinite path fragment π = s0 s1... is defined as trace(π) = L(s0)L(s1).... The trace of the finite path fragment π = s0 s1... sn is defined as trace(π) = L(s0)L(s1)...L (sn). Trace operators trace(π) is the set of traces obtained from the paths in the set of paths, Π trace(π) = { trace(π) π Π} Traces(s) is the set of traces of s Traces(s) = traces(paths(s)) Traces(TS) is the set of all traces for all ini2al states of TS Traces(TS) = U s in I Traces(s) Introduction 4

5 LT property A linear temporal property over a set of atomic proposi2ons, AP is a subset of the set of all infinite words formed using only elements in AP (denoted (2 AP ) ω ) Defini4on Sa4sfac4on Rela4on for LT Proper4es Let P be an LT property over AP and TS = (S, Act,, I,AP, L) a transi6on system without terminal states. TS = (S, Act,, I,AP, L) sa6sfies P, denoted TS = P, iff Traces(TS) P. State s S sa6sfies P, nota6on s = P, whenever Traces(s) P. Two traffic lights: Traffic Light example AP = { red1, green1, red2, green2} LT1: The first traffic light is infinitely oden green A0 A1 A2... over 2 AP, such that green1 Ai holds for infinitely many i. LT2: The traffic lights are never both green simultaneously A0 A1 A2... such that either not(green1 Ai ) or not(green2 Ai), for all i 0. Introduction 5

6 Starva2on Freedom Example A process that wants to enter its cri2cal sec2on will eventually do so (AP = { wait1, crit1, wait2, crit2 }) Pfinwait = set of infinite words A0 A1 A2... such thatj.waiti Aj k j.criti Ak for each i {1, 2 } A process that waits oden enters its cri2cal sec2on oden P nostarve = set of infinite words A0 A1 A2... such that: (k 0. j k. wai6 Aj ) (k 0. j k. cri6 Aj) for each i {1, 2 } In abbreviated form we write: j. wai6 Aj j. cri6 Aj for each i {1, 2 }, where stands for there are infinitely many. Trace inclusion and equivalence Trace inclusion: TS is a correct implementa2on of TS if Traces(TS) is a subset of Traces(TS ). Equivalent statement: For any LT property P: TS = P implies TS = P. Transi2on systems TS and TS are trace- equivalent with respect to the set of proposi6ons AP if Traces AP (TS) = Traces AP (TS) Traces(TS) = Traces(TS ) iff TS and TS sa6sfy the same LT proper6es Introduction 6

7 Equivalent TS example For AP = {pay, soda, beer} the two TSs are trace equivalent There does not exist an LT property that dis2nguishes between the two vending machine models Safety proper2es A safety property is a behavior in which nothing bad happens e.g., Always at most one process is in its cri2cal sec2on (the bad thing two or more processes in cri2cal sec2on) An invariant is a special type of safety property. An invariant property is true in all states that are reachable from an ini2al state e.g., only one process can be in its cri2cal state in any state, i.e., Φ = not crit1 not crit2 is true in every state Introduction 7

8 Invariants An LT property Pinv over AP is an invariant if there is a proposi6onal logic formula Φ over AP such that P inv = {A0A1A2... (2 AP ) ω j 0. Aj = Φ} TS = P inv iff trace(π) P inv for all paths π in TS iff L(s) = Φ for all states s that belong to a path of TS iff L(s) = Φ for all states s Reach(TS) Checking invariants Naïve checking: adapt BFS of DFS algorithm of state graph of TS If a state is found in which the invariant does not hold then algorithm returns false, else it returns true See page 109 for algorithm 3 Algorithm can be adapted to provide a counterexample. See page 110 for algorithm 4 Introduction 8

9 Other safety proper2es A safety property that is not an invariant: money in a ATM is dispensed only ader a valid PIN is provided Note that this is not a state property It is a safety property since any finite prefix in which money is withdrawn without previous entry of a valid PIN is bad behavior Formal defini2on of a safety property An LT property P safe over AP is called a safety property if for all words σ (2 AP ) ω \P safe there exists a finite prefix σ^ of σ such that P safe {σ (2 AP ) ω σ^ is a finite prefix of σ} = σ^ is called a bad prefix for P safe A bad prefix is minimal if there is no smaller prefix that is bad BadPref(P safe ) denotes set of all bad prefixes for P safe Introduction 9

10 Traffic Light examples It is always the case that at least one light is on { σ = A 0 A 1... A j AP A j not = } Bad prefixes are finite words that contain A red light must be preceded immediately by a yellow light σ = A0 A1... with Ai { red, yellow } such that for all i 0 we have that red Ai implies i > 0 and yellow Ai 1 Minimal bad prefixes: { red } and { red } Sa2sfying safety proper2es TS = P safe if and only if Traces fin (TS) BadPref (P safe ) = Alterna6ve: P safe is a safety property iff closure (P safe ) = P safe i.e., P safe contains all the infinite traces whose finite prefixes are also prefixes of P safe closure(p) = {σ (2 AP ) ω pref(σ) pref(p)} where pref(σ) is the set of finite prefixes of the word σ Introduction 10

11 Trace inclusion and safety proper2es Let TS and TS be transi6on systems without terminal states and with the same set of proposi6ons AP. Then the following statements are equivalent: Tracesfin (TS) Tracesfin (TS ) For any safety property Psafe : TS = Psafe implies TS = Psafe Note that even if Traces(TS) is not a subset of Traces(TS), but the finite traces are (a weaker condi6on), then safety proper6es of TS also holds for TS Finite vs. infinite systems TS TS Traces(TS) is not a subset of Traces (TS) but Traces fin (TS) is a subset of Traces fin (TS ) Property: eventually b holds Introduction 11

12 Liveness proper2es A system that does nothing sa2sfies its safety proper2es; need to have proper2es that require system to make progress Liveness property: something good will eventually happen Liveness proper2es are condi2ons on infinite behaviors (Alpern, Schneider) Any finite prefix can be extended to sa2sfy a liveness property How does this differ from safety proper2es? What are some examples of liveness proper2es? Liveness defini2on A property P over AP is a liveness property when pref(p) = (2 AP ) * Each finite word can be extended to an infinite word that sa2sfies P Stated differently, P is a liveness property iff for all finite words w (2 AP ) there exists an infinite word σ (2 AP ) ω sa2sfying wσ P Introduction 12

13 Examples Each process will eventually enter its cri2cal sec2on (j 0. crit 1 A j ) (j 0. crit 2 A j ) Each process will enter its cri2cal sec2on infinitely oden (k 0. j k. crit 1 A j ) (k 0. j k. crit 2 A j ) Each wai2ng process will eventually enter its cri2cal sec2on j 0. (wait 1 A j (k > j. crit 1 A k )) j 0. (wait 2 A j (k > j. crit 2 A k )) Safety and liveness proper2es Are safety and liveness proper2es disjoint? Yes (if you exclude the set of all traces) Are all linear proper2es either a safety or liveness property? No Theorem Decomposi5on Theorem For any LT property P over AP there exists a safety property P safe and a liveness property P live (both over AP) such that P = P safe P live. Introduction 13

14 Example P = The vending machine provides soda infinitely oden ader ini2ally providing beer three 2mes in a row. What is the safety property? What is the liveness property? Fairness To prove a liveness property you some2mes have to remove behaviors in which a process hogs resources (i.e., behaviors in which a process prevents another process from accessing a resouce infinitely oden) Process fairness: Each process can execute enabled transi2ons infinitely oden Example: to prove starva2on freedom (i.e., a process can enter its cri2cal sec2on infinitely oden) we need to exclude the paths in which in which one process prevents the other process from entering its cri2cal sec2on infinitely oden Requires fair scheduling of processes Introduction 14

15 Simple semaphore A process does not have to wait infinitely long before entering its cri2cal sec2on while it is in its wait state Each of the processes executes its cri2cal sec2on infinitely oden Peterson s algorithm A process does not have to wait infinitely long before entering its cri2cal sec2on while it is in its wait state Each of the processes executes its cri2cal sec2on infinitely oden Introduction 15

16 Fairness constraints Fairness constraints are used to rule out unrealis2c behaviors from a transi2on system seman2cs of a concurrent system Refine model to resolve non- determinis2c behaviors Different types of fairness constraints Uncondi2onal fairness (impar2ality): e.g., a process can execute infinitely oden Strong fairness (compassion): e.g., a process that is enabled infinitely oden gets it turns to execute infinitely oden Weak fairness (jus2ce): e.g., a process that is con2nuously enabled ader a certain 2me, gets its turn to execute infinitely oden Expressing fairness constraints For transi2on system TS = (S, Act,, I,AP, L) without terminal states, A Act, and infinite execu2on fragment ρ = s 0 α 0 s 1 α 1 s of TS: ρ is uncondi6onally A- fair whenever j. α j A ρ is strongly A- fair whenever ( j. Act(s j ) A not= ) ( j. α j A) ρ is weakly A- fair whenever ( j. Act(s j ) A not= ) ( j. α j A) Introduction 16

17 Example A = {enter 2 }: Is the above uncoditionally A-fair, strongly A-fair, weakly A-fair for the infinite fragment shown in dashed lines? What about the trace shown in dotted lines? Fairness assump2on Introduction 17