Overview. overview / 357

Transcription

1 Overview overview6.1 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL and LTL CTL model checking fairness, counterexamples/witnesses CTL + and CTL Equivalences and Abstraction 17 / 357

2 Linear vs branching time ctlss4.1-1 transition system T =(S, Act,, S 0, AP, L) state graph + labeling abstraction from actions linear-time view state sequences traces projection on AP branching-time view states & branches computation tree 4 / 357

3 Computation tree ctlss4.1-1c The computation tree of state s 0 in a transition system T =(S, Act,, S 0, AP, L) arisesby: unfolding T s0 =(S, Act,, s 0, AP, L) intoatree abstraction from the actions projection of the states s to their labels L(s) AP s 0 7 / 357

4 Example: computation tree ctlss4.1-1a mutual exclusion with semaphore and AP = {crit 1, crit 2 }: {crit 1 } {crit 2 } {crit 1 } {crit 2 } {crit 1 }{crit 2 }{crit 1 }{crit 2 } path nc 1, nc 2 wait 1, nc 2 crit 1, nc 2 crit 1, wait 2... trace {crit 1 } {crit 1 } / 357

5 Linear vs. branching time ctlss4.1-2 behavior temporal logic model checking impl. relation fairness linear time path based traces LTL path formulas PSPACE-complete O ( size(t ) exp( ϕ ) ) trace inclusion trace equivalence PSPACE-complete can be encoded branching time state based computation tree CTL state formulas PTIME O ( size(t ) Φ ) simulation bisimulation PTIME requires special treatment 16 / 357

6 Computation Tree Logic (CTL) ctlss4.1-4 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 19 / 357

7 Computation Tree Logic (CTL) ctlss4.1-4 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 eventually: Φ def = Φ Φ = (true U Φ) def = (true U Φ) always: Φ def = Φ =? note: Φ is no CTL formula 24 / 357

8 Computation Tree Logic (CTL) ctlss4.1-4 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 eventually: Φ def = Φ Φ = (true U Φ) def = (true U Φ) always: Φ def = Φ Φ = Φ def = Φ note: Φ is no CTL formula 26 / 357

9 Examples for CTL formulas ctlss4.1-3 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 Φ Φ mutual exclusion (safety) ( crit 1 crit 2 ) 29 / 357

10 Examples for CTL formulas ctlss4.1-3 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 Φ Φ mutual exclusion (safety) ( crit 1 crit 2 ) every request will be answered eventually ( request response ) 30 / 357

11 Examples for CTL formulas ctlss4.1-3 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 Φ Φ mutual exclusion (safety) ( crit 1 crit 2 ) every request will be answered eventually ( request response ) traffic lights ( yellow red ) 31 / 357

12 Examples for CTL formulas ctlss4.1-3 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 Φ Φ mutual exclusion (safety) ( crit 1 crit 2 ) every request will be answered eventually ( request response ) traffic lights ( yellow red ) reset possiblity start 32 / 357

13 Examples for CTL formulas ctlss4.1-3 CTL (state) formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ ϕ CTL path formulas: ϕ ::= Φ Φ1 U Φ 2 Φ Φ mutual exclusion (safety) ( crit 1 crit 2 ) every request will be answered eventually ( request response ) traffic lights ( yellow red ) reset possiblity start unconditional process fairness crit 1 crit 2 33 / 357

14 Alternative (standard) Syntax for CTL E ( ) there exists a path A ( ) for all paths X ( ) in the next state U until (strong) (W,V,R...) F (<>) finally (eventually) G ([]) generally (always) EFΦ: Φ holds potentially, AFΦ: Φ is inevitable EGΦ: potentially always Φ, AGΦ: invariantly Φ

15 [mutual exclusion] [ ]( crit1 crit2) AG( crit1 crit2) [every request will be answered eventually] []( request <> response ) AG( request AF response ) [traffic light] []( yellow red) AG( yellow AX red ) [reset possiblity] [] <> start AG EF start Alternative (standard) Syntax for CTL E ( ) there exists a path A ( ) for all paths X ( ) in the next state U until (strong) (W,V,R...) F (<>) finally (eventually) G ([]) generally (always) EFΦ: Φ holds potentially, AFΦ: Φ is inevitable EGΦ: potentially always Φ, AGΦ: invariantly Φ

16 Semantics of CTL ctlss define a satisfaction relation = = = for CTL formulas over AP and a given TS T =(S, Act,, S 0, AP, L) without terminal states interpretation of state formulas over the states interpretation of path formulas over the paths (infinite path fragments) 43 / 357

17 Recall: semantics of LTL ctlss4.1-ltl-semantics for infinite path fragment π = s 0 s 1 s 2...: π = true π = a iff s 0 = a,i.e., a L(s 0 ) π = ϕ 1 ϕ 2 iff π = ϕ 1 and π = ϕ 2 π = ϕ iff π = ϕ π = ϕ iff suffix(π, 1) = s 1 s 2 s 3... = ϕ π = ϕ 1 U ϕ 2 iff there exists j 0 such that suffix(π, j) = s j s j+1 s j+2... = ϕ 2 and suffix(π, k) = s k s k+1 s k+2... = ϕ 1 for 0 k < j 44 / 357

18 Satisfaction relation for path formulas ctlss4.1-11a Let π = s 0 s 1 s 2... be an infinite path fragment. π = Φ iff s 1 = Φ π = Φ 1 U Φ 2 iff there exists j 0 such that s j = = = Φ 2 s k = = = Φ 1 for 0 k < j semantics of derived operators: π = Φ iff there exists j 0with π = Φ iff for all j 0wehave: s j = Φ s j = Φ 50 / 357

19 Satisfaction relation for state formulas ctlss s = true s = a iff a L(s) s = Φ 1 Φ 2 iff s = Φ 1 and s = Φ 2 s = Φ iff s = Φ s = ϕ iff there is a path π Paths(s) s.t. π = ϕ s = ϕ iff for each path π Paths(s): π = ϕ satisfaction set for state formula Φ: Sat(Φ) def = { s S : s = Φ } 58 / 357

20 Interpretation of CTL formulas over a TS ctlss4.1-13a satisfaction of state formulas over a TS T : T = Φ iff S 0 Sat(Φ) iff s 0 = Φ for all initial states s 0 of T where S 0 is the set of initial states recall: Sat(Φ) = { s S : s = Φ } 61 / 357

21 Semantics of the next operator ctlss4.1-8 s = Φ iff there exists π = s s 1 s 2... Paths(s) s.t. π = Φ, i.e., s 1 = Φ s = Φ iff for all π = s s 1 s 2... Paths(s): π = Φ, i.e., s 1 = Φ Φ s s 1 Φ s Post(s) Sat(Φ) Post(s) Sat(Φ) 66 / 357

22 Semantics of until and eventually ctlss4.1-9 (Φ 1 U Φ 2 ) (Φ 1 U Φ 2 ) Φ Φ 70 / 357

23 Semantics of eventually and always ctlss Φ Φ Ψ Ψ 73 / 357

24 Specifying infinitely often in CTL ctlss4.1-inf-often.tex If s is a state in a TS and a AP then: iff s = CTL a for all paths π = s 0 s 1 s 2... Paths(s): i 0. s.t. s i = a iff s = LTL a 84 / 357

25 Example: CTL semantics ctlss T start try T = start? lost error delivered Φ 1 = start 85 / 357

26 Example: CTL semantics ctlss T start try T = start? lost error delivered Φ 1 = start Sat( start) = { error } 86 / 357

27 Example: CTL semantics ctlss T start try T = start? lost error delivered Φ 1 = start Sat( start) = { error } Sat( start) =? error 87 / 357

28 Example: CTL semantics T start try ctlss T = start lost error delivered Φ 1 = start error Sat( start) = { error } Sat( start) = Sat( error) = all states 88 / 357

29 Example: CTL semantics ctlss T start try T = start T = start? lost error delivered Φ 2 = start 89 / 357

30 Example: CTL semantics ctlss T start try T = start T = start? lost error delivered Φ 2 = start Sat( start) = {error} 90 / 357

31 Example: CTL semantics ctlss T start try T = start T = start? lost error delivered Φ 2 = start error Sat( start) = {error} Sat( start) = {error, try} 91 / 357

32 Example: CTL semantics ctlss T start try T = start T = start? lost error delivered Φ 2 = start (error try) Sat( start) = {error} Sat( start) = {error, try} Sat( start) =? 92 / 357

33 Example: CTL semantics ctlss T start try T = start T = start lost error delivered Φ 2 = start (error try) Sat( start) = {error} Sat( start) = {error, try} Sat( start) = {error, lost, start} 93 / 357

34 Example: CTL semantics ctlss t s u = {a} = {b} = T = (a U b)? 107 / 357

35 Example: CTL semantics ctlss t s u = {a} = {b} = T = (a U b) as sss... = (a U b) T = (( a)ub)? 110 / 357

36 Example: CTL semantics ctlss t s u = {a} = {b} = T = (a U b) T = (( a)u b) as sss... = (a U b) as t = a, u = a T = (a U ( a U b))? 112 / 357

37 Example: CTL semantics ctlss t s u = {a} = {b} = T = (a U b) as sss... = (a U b) T = (( a)u b) T = (a U ( a U b)) s u a ( a U b) as t = a, u = a... = a U ( a U b) 114 / 357

38 Correct or wrong? ctlss Let T be a transition system and Φ actlformula. Is the following statement correct? answer: no if T = Φ then T = Φ transition system T with 2 initial states: {a} T = a T = a 120 / 357

39 Equivalence of CTL formulas ctlss Φ 1 Φ 2 iff for all transition systems T : T = Φ 1 T = Φ 2 Examples: Φ Φ iff for all transition systems T : Sat(Φ 1 ) = Sat(Φ 2 ) (Φ Ψ) Φ Ψ... Φ Φ 136 / 357

40 Correct or wrong? ctlss (a b) a b wrong, e.g, (a b) a b wrong, e.g., but: (Φ 1 Φ 2 ) Φ 1 Φ 2 (Φ 1 Φ 2 ) Φ 1 Φ / 357

41 Expansion laws ctlss (Φ U Ψ) Ψ (Φ (Φ U Ψ)) (Φ U Ψ) Ψ (Φ (Φ U Ψ)) Ψ Ψ Ψ Ψ Ψ Ψ (Φ W Ψ) Ψ (Φ (Φ W Ψ)) (Φ W Ψ) Ψ (Φ (Φ W Ψ)) Φ Φ Φ Φ Φ Φ 184 / 357

42 Duality laws duality of and : Φ Φ Φ Φ ctlss self-duality of : Φ Φ Φ Φ duality of UandW, e.g.: (Φ U Ψ) ((Φ Ψ) W( Φ Ψ)) (( Ψ) W( Φ Ψ)) (( Ψ)U( Φ Ψ)) Ψ 191 / 357

43 Existential normalform for CTL ctlss For each CTL formula Ψ there is an equivalent CTL formula Φ built by operators of propositional logic the modalities, U and. Φ ::= true a Φ1 Φ 2 Φ Φ (Φ1 U Φ 2 ) Φ transformation Ψ Φ relies on: Ψ Ψ (Ψ 1 U Ψ 2 ) ( Ψ 2 U( Ψ 1 Ψ 2 )) Ψ / 357

44 Overview overview6.2 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL and LTL CTL model checking fairness, counterexamples/witnesses CTL + and CTL Equivalences and Abstraction 1 / 138

45 Equivalence of CTL and LTL formulas comparison4.2-1 Let Φ be a CTL formula and ϕ an LTL formula. Φ ϕ iff for all transition systems T and all states s in T : s = CTL Φ s = LTL ϕ e.g., CTL formula Φ LTL formula ϕ a a (a U b) a a a U b a, b AP 5 / 138

46 More examples CTL formula Φ LTL formula ϕ a a a a (a U b) a U b a a a a (a W b) a W b a a infinitely often a comparison4.2-1a but: a a 10 / 138

47 The CTL formula a comparison4.2-2 s = a iff on each path π from s there is a state t with t = a i.e., all states in the computation tree of t fulfill a a T : a a a T = a 16 / 138

48 a a transition system T comparison4.2-3 computation tree {a} {a} T = LTL a T = CTL a Sat( a) = { } / 138

49 From CTL to LTL, if possible comparison4.2-4 For each CTL formula Φ the following holds: either there is no equivalent LTL formula or Φ ϕ where ϕ is the LTL formula obtained from Φ by removing of all path quantifiers and Φ = a ϕ = a Φ without proof hence: there is no LTL formula equivalent to Φ 29 / 138

50 Expressiveness of LTL and CTL comparison4.2-5 The expressive powers of LTL and CTL are incomparable The CTL formulas (a a), a and a have no equivalent LTL formula The LTL formula a has no equivalent CTL formula LTL a strong fairness a CTL a (a a) a 51 / 138

51 LTL formula a comparison4.2-5b There is no CTL formula which is equivalent to the LTL formula a Proof (sketch): provide sequences (T n ) n 0, (T of transition systems such that for all n 0: n) n 0 (1) T n = a (2) T n = a (3) T n and T n satisfy the same CTL formulas length n 75 / 138

52 Overview overview6.3 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL and LTL CTL model checking fairness, counterexamples/witnesses CTL + and CTL Equivalences and Abstraction 1 / 454

53 CTL model checking ctlmc4.3-1 given: finite TS T =(S, Act,, S 0, AP, L) CTL formula Φ over AP question: does T = Φ hold? idea: compute Sat(Φ) = {s S : s = Φ} check whether S 0 Sat(Φ) 3 / 454

54 CTL model checking ctlmc4.3-1 given: finite TS T =(S, Act,, S 0, AP, L) CTL formula Φ over AP question: does T = Φ hold? inner subformulas first FOR ALL subformulas Ψ of Φ DO compute Sat(Ψ) replace Ψ by a new atomic proposition a Ψ FOR ALL s Sat(Ψ) DO add a Ψ to L(s) OD OD IF S 0 Sat(Φ) THEN output yes ELSE output no FI 7 / 454

55 Example: CTL model checking ctlmc4.3-2 Φ = a (b U c) syntax tree for Φ compute Sat(a), Sat(b), Sat(c) U a b c processed in bottom-up fashion 10 / 454

56 Example: CTL model checking ctlmc4.3-2 Φ = a (b U c) a 1 a 2 }{{}}{{} Φ 1 Φ 1 syntax tree for Φ a 1 U a 2 a b c processed in bottom-up fashion Φ 2 compute Sat(a), Sat(b), Sat(c) Sat(Φ 1 ) =...= = Sat(a 1 ) Sat( c) = S \ Sat(c) Sat(Φ 2 ) =...= = Sat(a 2 ) Φ 1 a 1 replace Φ 1 with a 1 replace Φ 2 with a 2 Sat(Φ) = Sat(a 1 ) Sat(a 2 ) 16 / 454

57 CTL model checking ctlmc4.3-3a given: finite TS T =(S, Act,, S 0, AP, L) CTL formula Φ over AP question: does T = Φ hold? method: regard in bottom-up manner all subformulas Ψ of Φ and compute their satisfaction sets Sat(Ψ) = {s S : s = Ψ} here: explanations for the case that Φ is in existential normal form analogous algorithms can be designed for standard CTL (and the derived operators) 18 / 454

58 Recall: Existential normal form for CTL ctlmc4.3-3 For each CTL formula there is an equivalent formula in -normal form, i.e., a CTL formula with the basis modalities, U,. CTL formulas in -normal form: Ψ ::= true a Ψ Ψ1 Ψ 2 Ψ (Ψ1 1 U Ψ 2 ) Ψ CTL formula CTL formula in -normal form Φ Φ (Φ 1 U Φ 2 ) ( Φ 2 U( Φ 1 Φ 2 )) Φ 2 21 / 454

59 Recursive computation of the satisfaction sets ctlmc4.3-4 Sat(true) Sat(a) Sat( Φ) Sat(Φ 1 Φ 2 ) = S = {s S : a L(s)} = S \ Sat(Φ) Sat(Φ 1 Φ 2 ) = Sat(Φ 1 ) Sat(Φ 2 ) Sat( Φ) = { s S : Post(s) Sat(Φ) } Sat( (Φ 1 U Φ 2 )) =... Sat( Φ) =... treatment of U and : via fixed point computation 28 / 454

60 Least fixed point characterization of U (Φ 1 U Φ 2 ) Φ 2 ( Φ 1 (Φ 1 U Φ 2 ) ) ctlmc4.3-5 Sat( (Φ 1 U Φ 2 )) = Sat(Φ 2 ) { s Sat(Φ1 1 ) : Post(s) Sat( (Φ 1 U Φ 2 )) } satisfies the following conditions: (1) Sat(Φ 2 ) Sat( (Φ 1 U Φ 2 )) (2) If s Sat(Φ 1 ) and Post(s) Sat( (Φ 1 U Φ 2 )) then s Sat( (Φ 1 U Φ 2 )) Sat( (Φ 1 UΦ 2 )) is the smallest set s.t. (1) and (2) hold 33 / 454

61 CTL model checking: until operator ctlmc (Φ 1 U Φ 2 ) Φ 2 (Φ 1 (Φ 1 U Φ 2 )) Sat( (Φ 1 U Φ 2 )) = least set T of states s.t. Sat(Φ 2 ) { s Sat(Φ 1 ) : Post(s) T } T Sat( (Φ 1 U Φ 2 )) 65 / 454

62 CTL model checking: always operator ctlmc expansion law: Φ Φ Φ Sat( Φ) = greatest set T of states with T { s Sat(Φ) : Post(s) T } T 0 := Sat(Φ), T n+1 := { s T n : Post(s) T n } Sat(Φ) 88 / 454

63 Recursive computation of Sat(...) ctlmc4.3-8 Sat(Φ 1 Φ 2 ) = Sat(Φ 1 ) Sat(Φ 2 ) Sat( Φ) = S \ Sat(Φ) Sat( Φ) = {s S : Post(s) Sat(Φ) = } Sat( (Φ 1 U Φ 2 )) = smallest set T of states s.t. Sat(Φ 2 ) T s Sat(Φ 1 ) and Post(s) T = s T Sat( Φ) = greatest set V of states s.t. V Sat(Φ) s V = Post(s) V 57 / 454

64 CTL model checking: treatment of U compute Sat( (Φ 1 U Φ 2 )) via an enumerative backward search ctlmc T := Sat(Φ 2 ) collects all states s = (Φ 1 U Φ 2 ) E := Sat(Φ 2 ) set of states still to be expanded WHILE E DO select a state s E and remove s from E FOR ALL s Pre(s ) DO IF s Sat(Φ 1 ) \ T THEN add s to T and E FI OD OD return T complexity: O(size(T )) 81 / 454

65 Computation of Sat( Φ) ctlmc T := Sat(Φ) organizes the candidates for s = Φ E := S \ T set of states to be expanded WHILE E DO pick a state s E and remove s from E FOR ALL s Pre(s ) DO IF s T and Post(s) T = THEN remove s from T and add s to E FI OD return T naïve implementation: quadratic time complexity 96 / 454

66 Computation of Sat( Φ) using counters ctlmc T := Sat(Φ); E := S \ T FOR ALL s Sat(Φ) DO c[s] := Post(s) OD loop invariant: c[s] = Post(s) (T E) for s T WHILE E DO pick a state s E and remove s from E FOR ALL s Pre(s ) DO complexity: IF s T THEN O(size(T )) c[s] := c[s] 1 IF c[s] =0THEN remove s from T and add s to E FI FI OD 106 / 454

67 Recursive computation of Sat(...) ctlmc4.3-8a Sat(Φ 1 Φ 2 ) = Sat(Φ 1 ) Sat(Φ 2 ) Sat( Φ) = S \ Sat(Φ) Sat( Φ) = {s S : Post(s) Sat(Φ) = } Sat( (Φ 1 U Φ 2 )) = T 0 = Sat(Φ 2 ) T n where T n n 0 T n+1 = { s Sat(Φ 1 ) : Post(s) T n } Sat( Φ) = V n where n 0 V 0 = Sat(Φ); V n+1 = { s V n : Post(s) V n } 118 / 454

68 Complexity of CTL/LTL model checking ctlmc CTL model checking: O ( size(t ) Φ ) LTL model checking: O ( size(t ) exp( ϕ ) ) model complexity, i.e., for fixed specification: CTL and LTL: O ( size(t ) ) If Φ ϕ then often we have: Φ = exp( ϕ ) 130 / 454

69 CTLvsLTL ctlmc4.3-23a If P NP then there is a sequence (ϕ n ) n 0 of LTL formulas such that: ϕ n = O ( poly(n) ) ϕ n has an equivalent CTL formula, but no equivalent CTL formula of polynomial length Proof. Let ϕ n = ϕ n. Then: ϕ n ( n = ϕ n +1=O( n 2) ϕ n has an equivalent CTL formula, e.g., Φ n Suppose there is a CTL formula of polynomial length that is equivalent to ϕ n. Then: Hamilton path problem P and P = NP 168 / 454

70 Overview overview6.4 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL and LTL CTL model checking CTL with fairness counterexamples/witnesses, CTL + and CTL Equivalences and Abstraction 1 / 168

71 Complexity of CTL and LTL model checking ctlfair4.4-1 LTL model checking problem: PSPACE-complete and solvable in time O(size(T ) exp( ϕ )) CTL model checking problem: solvable in polynomial time (even PTIME-complete) O(size(T ) Φ ) 4 / 168

72 Complexity of CTL and LTL model checking ctlfair4.4-1 LTL model checking problem: PSPACE-complete and solvable in time O(size(T ) exp( ϕ )) LTL with fairness: CTL model checking problem: O(size(T ) exp( ϕ ) fair ) solvable in polynomial time (even PTIME-complete) CTL with fairness: O(size(T ) Φ ) O(size(T ) Φ fair ) 6 / 168

73 Recall: LTL fairness assumptions ctlfair4.4-2 are conjunctions of LTL formulas of the form unconditional fairness φ strong fairness ψ φ weak fairness ψ φ where φ, ψ are propositional formulas Reduction of = fair to = = = T = fair ϕ iff π = ϕ for all fair paths π in T iff for all paths π in T : π = fair ϕ 12 / 168

74 CTLfairnessassumptions ctl4.4-4a conjunctions of formulas of the type unconditional fairness: Φ strong fairness: Ψ Φ weak fairness: Ψ Φ where Ψ, Φ are CTL state formulas note: CTL fairness assumptions are not CTL (state or path) formulas just a syntactic formalism to specify fairness assumptions 17 / 168

75 Satisfaction relation for CTL with fairness ctlfair4.4-3 s = fair true s = fair a iff a L(s) s = fair Φ iff s = fair Φ s = fair Φ 1 Φ 2 iff s = fair Φ 1 and s = fair Φ 2 s = fair ϕ iff there exists π Paths(s) with π = fair and π = fair ϕ s = fair ϕ iff for all π Paths(s): π = fair implies π = fair ϕ e.g., s 0 s 1 s 2... = Φ iff i 0s.t.s s i = Φ 23 / 168

76 Preprocessing of FairCTL model checking ctlfair4.4-12a given: question: finite transition system T CTL formula Φ in -normal form CTL fairness assumption fair, e.g., fair = Ψ i,1 Ψ i,2 1 i k does T = fair Φ hold? preprocessing: apply a standard CTL model checker to evaluate the CTL state subformulas of fair compute Sat(Ψ i,1 ) and Sat(Ψ i,2 ) replace Ψ i,1 and Ψ i,2 with fresh atomic propositions b i and c i, respectively 72 / 168

77 Idea of FairCTL model checking ctlfair4.4-12b given: question: finite transition system T CTL formula Φ in -normal form CTL fairness assumption fair does T = fair Φ hold? preprocessing Build the parse tree of Φ and process it in bottom-up-manner. Treatment of: true, a AP,, : asforstandard CTL, U: : via standard CTL model checking via analysis of SCCs 78 / 168

78 Summary: fairness in CTL ctlfair CTL fairness assumptions: formulas similar to LTL e.g., fair = ( Ψ i Φ i ) 1 i k CTL satisfaction relation with fairness: s = fair ϕ iff there exists π Paths(s) with π = fair and π = fair ϕ model checking for CTL with fairness:, U,, via CTL model checker analysis of SCCs for, U complexity: O(size(T ) Φ fair ) 286 / 168

79 Overview overview6.5 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL and LTL CTL model checking fairness, counterexamples/witnesses CTL + and CTL Equivalences and Abstraction 1 / 286

80 Combining LTL and CTL CTL ctlst4.6-1 CTL* LTL a a a... a CTL a 3 / 286

81 Syntax of CTL* ctlst4.6-4 state formulas: Φ ::= true a Φ1 Φ 2 Φ ϕ path formulas: ϕ ::= Φ ϕ1 ϕ 2 ϕ ϕ ϕ1 U ϕ 2 derived operators:,, etc. eventually, always as in LTL: ϕ = true U ϕ, ϕ = ϕ universal quantification: ϕ = ϕ 10 / 286

82 Semantics of CTL* ctlst4.6-2 Let T =(S, Act,, S 0, AP, L) be a transition system without terminal states. define by structural induction: a satisfaction relation = = = for states s S and CTL* state formulas a satisfaction relation = = = for infinite path fragments π in T and CTL* path formulas 12 / 286

83 Semantics of CTL* state formulas ctlst4.6-2a s = true s = a iff a L(s) s = Φ iff s = Φ s = Φ 1 Φ 2 iff s = Φ 1 and s = Φ 2 s = ϕ iff there exists a path π Paths(s) such that π = ϕ satisfaction relation = = = for CTL* path formulas 15 / 286

84 Semantics of CTL* path formulas ctlst4.6-2b let π = s 0 s 1 s 2... be an infinite path fragment in T π = Φ iff s 0 = Φ π = ϕ iff π = ϕ π = ϕ 1 ϕ 2 iff π = ϕ 1 satisfaction relation for CTL* state formulas π = ϕ 1 and π = ϕ 2 π = ϕ iff suffix(π, 1) = ϕ π = ϕ 1 U ϕ 2 iff there exists j 0 such that ϕ 2 suffix(π, j) = = = ϕ 2 suffix(π, i) = = = ϕ 1 for 0 i < j suffix(π, k) = s k s k+1 s k / 286

85 Examples of CTL*-formulas ctlst4.6-3 mutual exclusion: safety ( crit 1 crit 2 ) liveness crit 1 crit 2 progress property, e.g., (request response) persistence property, e.g., a CTL* formulas with existential quantification, e.g., Hamilton path problem (for fixed initial state) ( ( v (v v)) ) v V 26 / 286

86 Expressiveness of CTL, LTL and CTL* ctlst4.6-4a CTL is a sublogic of CTL* LTL is a sublogic of CTL* CTL* is more expressive than LTL and CTL a b CTL* LTL a a a a a... CTL b 34 / 286

87 Equivalence of CTL*-formulas ctlst ϕ ϕ ϕ ϕ e.g., a a e.g., a a (ϕ 1 ϕ 2 ) ϕ 1 ϕ 2 (ϕ 1 ϕ 2 ) ϕ 1 ϕ 2 but: (ϕ 1 ϕ 2 ) ϕ 1 ϕ 2 (ϕ 1 ϕ 2 ) ϕ 1 ϕ 2 ϕ ϕ ϕ ϕ but: ϕ ϕ ϕ ϕ 71 / 286

88 CTL* model checking ctlst given: finite TS T =(S, Act,, S 0, AP, L) CTL* formula Φ question: does T = Φ hold? main procedure as for CTL: FOR ALL subformulas Ψ of Φ DO compute Sat(Ψ) = {s S : s = Ψ} OD IF S 0 Sat(Φ) THEN return yes ELSE return no FI 75 / 286

89 Recursive computation of satisfaction sets ctlst4.6-24a Sat(true) = S Sat(a) = {s S : a L(s)} as for CTL Sat(Φ 1 Φ 2 ) = Sat(Φ 1 ) Sat(Φ 2 ) Sat( Φ) = S \ Sat(Φ) Sat( ϕ) = Sat LTL (ϕ) } using an LTL Sat( ϕ) = S \ Sat LTL ( ϕ) model checker 80 / 286

90 Complexity of CTL/LTL/CTL* model checking ctlst CTL PTIMEcomplete = = = O(size(T ) Φ ) LTL and CTL* PSPACE - complete O(size(T ) exp( ϕ )) = fair O(size(T ) Φ fair ) O(size(T ) exp( ϕ ) fair ) model complexity, i.e., for fixed formula: O( size(t ) ) 119 / 286

91 Relationships among logics modal μ-calculus ω-tree automata CTL* ω-word automata Büchi automata (never claims) LTL CTL LTL LTL without X same box means equally expressive single arrow means more expressive than no arrow means expressiveness is not comparable 2