CTL Model Checking. Prof. P.H. Schmitt. Formal Systems II. Institut für Theoretische Informatik Fakultät für Informatik Universität Karlsruhe (TH)

Transcription

1 CTL Model Checking Prof. P.H. Schmitt Institut für Theoretische Informatik Fakultät für Informatik Universität Karlsruhe (TH) Formal Systems II Prof. P.H. Schmitt CTLMC Summer / 26

2 Fixed Point Theory Prof. P.H. Schmitt CTLMC Summer / 26

3 Fixed Points Definition Definition Let f : P(G) P(G) be a set valued function and Z a subset of G. 1. Z is called a fixed point of f if f(z) = Z. 2. Z is called the least fixed point of f is Z is a fixed point and for all other fixed points U of f the relation Z U is true. 3. Z is called the greatest fixed point of f is Z is a fixed point and for all other fixed points U of f the relation U Z is true. Prof. P.H. Schmitt CTLMC Summer / 26

4 Finite Fixed Point Lemma Let G be an arbitrary set, Let P(G) denote the power set of a set G. A function f : P(G) P(G) is called monotone of for all X, Y G X Y f(x) f(y ) Let f : P(G) P(G) be a monotone function on a finite set G. 1. There is a least and a greatest fixed point of f. 2. n 1 f n ( ) is the least fixed point of f. 3. n 1 f n (G) is the greatest fixed point of f. Prof. P.H. Schmitt CTLMC Summer / 26

5 Proof of part (2) of the finite fixed point Lemma Monotonicity of f yields f( ) f 2 ( )... f n ( )... Since G is finite there must be an i such that f i ( ) = f i+1 ( ). Then Z = n 1 f n ( ) = f i ( ) is a fixed point of f: f(z) = f(f i ( )) = f i+1 ( ) = f i ( ) = Z Let U be another fixed point of f. From U be infer by monotonicity of f at first f( ) f(u) = U. By induction on n we conclude f n ( ) U for all n. Thus also Z = f i ( ) U. Prof. P.H. Schmitt CTLMC Summer / 26

6 Continuous Functions Definition A function f : P(G) P(G) is called 1. -continuous (upward continuous), if for every ascending sequence M 1 M 2... M n... f( M n ) = f(m n ) n 1 n continuous (downward continuous), if for every descending sequence M 1 M 2... M n... f( M n ) = f(m n ) n 1 n 1 Prof. P.H. Schmitt CTLMC Summer / 26

7 Fixed Points For Continuous Functions Let f : P(G) P(G) be an upward continuous functions and g : P(G) P(G) a downward continuous function. The for all M, N P(G) such that M f(m) and g(n) N the following is true. 1. n 1 f n (M) is the least fixed point of f containing M, 2. n 1 gn (M) is the greatest fixed point of g contained in M. Prof. P.H. Schmitt CTLMC Summer / 26

8 Proof of (1) By monotonicity we first obtain M f(m) f 2 (M)... f n (M)... Let P = n 1 f n (M). This immediately gives M P. Furthermore f(p ) = f( n 1 f n (M)) = n 1 f n+1 (M) by continuity = n 1 f n (M) since f(m) f 2 (M) = P Assume now that Q is another fixed point of f satisfying M Q. By Monotonicity and the fixed point property f(m) f(q) = Q and furthermore for every n 1 also f n (M) Q. Thus we obtain P = n 1 f n (M) Q Prof. P.H. Schmitt CTLMC Summer / 26

9 Knaster-Tarski-Fixed-Points Theorem Let f : P(G) P(G) be a monotone function. Then Note, G need not be finite. f has a least and a greatest fixed point. Prof. P.H. Schmitt CTLMC Summer / 26

10 Proof Fixed Point Let L = {S G f(s) S}, e.g., G L. Let U = L. Show f(u) = U! For all S L by the property of an intersection: U S. By monotonicity and definition of L f(u) f(s) S. Thus f(u) L = U and we have already established half of our claim. By monotonicity f(u) U implies f(f(u)) f(u) which yields f(u) L and futhermore U f(u). We thus have indeed U = f(u). Prof. P.H. Schmitt CTLMC Summer / 26

11 Proof Least Fixed Point Now assume W is another fixed point of f,i.e., f(w ) = W. This yields W L= {S G f(s) S} and U = L W. Thus U is the least fixed point of f. Following the same line of argument one can show that {S G S f(s)} is the greatest fixed point of f. Prof. P.H. Schmitt CTLMC Summer / 26

12 CTL Model Checking Algorithm Prof. P.H. Schmitt CTLMC Summer / 26

13 Two Auxiliary Concepts Let T = (S, R, v) be a transition system and F an CTL formula. The set τ(f ) = {s S s = F } is called the characteristic region of F in T. The universal and existential next step functions f AX, f EX : P(S) P(S) are defined by f AX (Z) = {s S for all t with srt we get t Z} f EX (Z) = {s S there exists a t with srt and t Z} Prof. P.H. Schmitt CTLMC Summer / 26

14 CTL Model Checking Algorithm Let T = (S, R, v) be a transition system and F an CTL formula. τ(f ) is computed by the following high-level recursive algorithm: 1 τ(p) = {s S v(s, p) = 1} 2 τ(f 1 F 2 ) = τ(f 1 ) τ)f 2 ) 3 τ(f 1 F 2 ) = τ(f 1 ) τ(f 2 ) 4 τ( F 1 ) = S \ τ(f 1 ) 5 τ(a(f 1 U F 2 )) = lfp[τ(f 2 ) (τ(f 1 ) f AX (Z))] 6 τ(e(f 1 U F 2 )) = lfp[τ(f 2 ) (τ(f 1 ) f EX (Z)] 7 τ(aff 1 ) = lfp[τ(f 1 ) f AX (Z)] 8 τ(eff 1 ) = lfp[τ(f 1 ) f EX (Z)] 9 τ(egf 1 ) = gfp[τ(f 1 ) f EX (Z)] 10 τ(agf 1 ) = gfp[τ(f 1 ) f AX (Z)] Prof. P.H. Schmitt CTLMC Summer / 26

15 Correctness Proof Case 10 AG F 1 By definition τ(ag F 1 ) = {s S s τ(f 1 ) and h τ(ag F 1 ) for all h with grh} Using Definition of the universal next step function: τ(ag F 1 ) = τ(f 1 ) f AX (τ(ag F 1 )) So, τ(ag F 1 ) is a fixed point of the function τ(f 1 ) f AX (Z). It remains to see that it is the greatest fixed point. Prof. P.H. Schmitt CTLMC Summer / 26

16 Correctness Proof Case 10 AG F 1 (continued) Let H be another fixed point, i.e., H = τ(f 1 ) f AX (H). We need to show H τ(ag F 1 )). Consider g 0 H with the aim of showing that for all n 0 and all g i satisfying g i 1 Rg i for all 1 i n we obtain g n τ(f 1 ). Observe H = τ(f 1 ) f AX (H) τ(f 1 ). Thus it suffices to show for all n 0 that g n H. For n = 0 that is true by assumptions. Assume g n 1 H. g n 1 H f AX (H) = {g for all h with grh we have h H}. Thus g n H. Prof. P.H. Schmitt CTLMC Summer / 26

17 Correctness Proof Case 6 E(F 1 U F 2) By definition τ(e(f 1 U F 2 )) = {g S s = F 2 or s = F 1 and there exists h with grh and h = F 2 } Using next step function: τ(e(f 1 U F 2 )) = τ(f 2 ) (τ(f 1 ) f EX (τ(e(f 1 U F 2 ))) Thus τ(e(f 1 U F 2 )) is a fixed point of the function τ(f 2 ) (τ(f 1 ) f EX (Z)). It remains to show that it is the least fixed point. Prof. P.H. Schmitt CTLMC Summer / 26

18 Correctness Proof Case 6 E(F 1 U F 2) (continued) Consider H S with H = τ(f 2 ) (τ(f 1 ) f EX (H)). We need τ(e(f 1 U F 2 )) H. Fix g 0 τ(e(f 1 U F 2 )), try to arrive at g 0 H. There is an n N and there are g i for 1 i n satisfying 1. g i Rg i+1 for all 0 i < n. 2. g n τ(f 2 ). 3. g i τ(f 1 ) for all 0 i < n. We set out to prove g n H by induction on n. n = 0 Since H = τ(f 2 ) (τ(f 1 ) f EX (H)) τ(f 2 ) and g 0 = g n τ(f 2 ). n 1 n By induction hypothesis we have g 1 H Since g 0 τ(f 1 ) and g 0 Rg 1 we obtain g 0 (τ(f 1 ) f EX (H)) H and thus also g 0 H. Prof. P.H. Schmitt CTLMC Summer / 26

19 CTL Model Checking Example Prof. P.H. Schmitt CTLMC Summer / 26

20 Transition System s 0 n 1n 2 s 1 t 1n 2 n 1t 2 s 5 s 3 s 8 n1c2 s6 s 2 c 1n 2 t 1t 2 t 1t 2 s 4 c 1t 2 s 7 t 1c 2 Prof. P.H. Schmitt CTLMC Summer / 26

21 The Task s0 n1n2 s1 t1n2 n1t2 s5 s2 c1n2 s4 c1t2 s3 t1t2 s8 t1t2 s7 t1c2 Check if the following the formula is true in state 1. n1c2 s N N T T C C F = T 1 AFC 1 T 1 AFC 1 Prof. P.H. Schmitt CTLMC Summer / 26

22 The Set-up Goal 1 = T 1 AFC 1 i.e. 1 = T 1 AFC 1 We will present the computations starting with the innermost subformulas first, i.e., in the order τ(t 1 ), τ(c 1 ), τ( T 1 ), τ(afc 1 ), and τ(f ). This will make it much easier to follow the algorithm, since when a recursice call is started, we know already its result. In the end we check 1 τ(f ). Prof. P.H. Schmitt CTLMC Summer / 26

23 The First Steps τ(t 1 ) = {1, 3, 7} (1) τ(c 1 ) = {2, 4} (2) From which we get easily τ( T 1 ) = {0, 2, 4, 5, 6} (3) Prof. P.H. Schmitt CTLMC Summer / 26

24 Fixed Point Computation The next step is to compute τ(afc 1 ) according to the algorithm this amounts to the computation of the least fixed point of f(z) = τ(c 1 ) f AX (Z) = f AX (Z) {2, 4}. We thus compute f( ), f 2 ( ),... f n ( ) till we reach a stationary value, i.e. f n ( ) = f n+1 ( ). f 1 ( ) = {2, 4} f 2 ( ) = {2, 3, 4} f 3 ( ) = {1, 2, 3, 4} f 4 ( ) = {1, 2, 3, 4, 7} f 5 ( ) = {1, 2, 3, 4, 7, 8} f 6 ( ) = {1, 2, 3, 4, 7, 8} Thus τ(afc 1 ) = {1, 2, 3, 4, 7, 8} (4) Prof. P.H. Schmitt CTLMC Summer / 26

25 End of the Computation τ(f ) = τ( T 1 ) τ(afc 1 ) = {0, 1, 2, 3, 4, 5, 6, 7, 8} = S (5) Since 1 τ(f ) we conclude s 1 = F (6) Prof. P.H. Schmitt CTLMC Summer / 26

26 THE END Prof. P.H. Schmitt CTLMC Summer / 26