Computation Tree Logic (CTL)

Transcription

1 Computation Tree Logic (CTL) 1

2 CTL Syntax P - a set of atomic propositions, every p P is a CTL formula. f, g, CTL formulae, then so are f, f g, EXf, A[fUg], E[fUg] E, A path quantifiers, X, U, G, F temporal operators Interpreted over a tree of states: EXf - f holds in some immediate successor A[fUg] - every path has a prefix that satisfies [fug] 2

3 CTL Model (Kripke model) M = (S, s I, R, L) S is a finite set of states, s I S is the initial state R S S s.t. u S. v S. (u,v) R (total) L: S 2 AP Example: AP = {p,q,r} S1 {p} S0 {p,q} S2 {q} 3

4 Example: XR Control Program closed opened close!/go closing stop} {open!} {Tout,Tin} {close!,go} 4

5 Computation Tree The infinite computation tree spanned by a model M=(S,s I,R,L) root s 0 =s i s t is an arc in the tree iff (s,t) R. A path is: s 0,s 1,s 2, S s.t. i. (s i,s i+1 ) R S0 S0 S1 S1 S0 S2 S1 S2 S1 S2 S0 5

6 CTL Semantics w.r.t a given model (S,s I,R,L) and a state s S: s p iff p L(s) s f iff not s f s f g iff s f and s g s EXf iff s. (s,s ) R and s f s A[fUg] iff for every path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i f s E[fUg] iff for some path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i f f is satisfiable iff there exists a model (S,s I,R,L) such that s I f f is valid iff f is satisfiable by every model (S,s I,R,L) 6

7 Derived Operators AX(f) EX f AF(f) A[true U f] EF(f) E[true U f] AG(f) EF( f) EG(f) AF( f) f holds at all next states f holds in the future of every path f holds in the future of some path every state in every path satisfies f for some path every state satisfies f 7

8 8

9 A note on temporal wff Syntax: EXf, A[fUg], E[fUg] E, A path quantifiers X, U, G, F temporal operators Structure of a formula: (path)(temporal)[formula] E, A path quantifiers X, U, G, F temporal operators EF(Gu) is not a wff, only EF(EGu) or EF(AGu) A(fUg) cannot be derived from E(fUg) since E (fug) is not wff (since (fug) is not wff) 9

10 Properties Expressed in CTL Every req is followed by ack (not 1-1): AG(req AF ack) It is possible to get to a state where started holds but ready does not hold. EF(started ready) From any state it is possible to get to the restart state. AG EF restart Processes P,Q are not in their critical section simultaneously AG( (PC QC)) A process that asks to enter the critical section, eventually gets there AG(PE AF(PC)) Processes strictly alternate in access to the critical section AG(Pc A(PcU( Pc A( PcUQc)))) 10

11 Expressing Time in CTL Assertions: 50 seconds minimal delay between trains. AG(Tin AX Tin AXAX Tin AX..AX Tin ) It takes a train 6 seconds to arrive at the signal AG(Tin AX(AX(AX(AX(AX(AX(AtSignal))))))) however, we could write AG(Tin AX 6 (AtSignal) like we did in LTL 50 11

12 LTL vs. CTL Different models - A CTL tree defines a subset of models of LTL Expressivity Define LTL satisfied on Kripke model if satisfied by every path. For LTL both generate same paths A coin coin A coin B B C coffee tea coffee tea C D D E LTL cannot distinguish behaviors that generate same path, therefore cannot express possibility. CTL is sensitive to the branching structure Thus, it is always possible to get tea after inserting a coin is expressible in CTL: AG(coin EXtea) but not in LTL 12

13 LTL vs. CTL (II) p ~p p s 0 s 1 s 2 satisfies p but not AFAGp. -- no single F state Similarly, p q (p Op) not expressible in CTL 13

14 LTL vs. CTL (III) AGEFp - not expressible in LTL (a) S:{~p} S':{p} S:{~p} (b) Suppose A is equivalent to AGEFp - (a) satisfies AGEFp hence A - (b)-paths (a)-paths hence (b) satisfies A - However (b) does not satisfy AGEFp 14

15 CTL* Allows any LTL formula to be preceded by A or E. Exm. E(p Xq), A(Fq Gp) CTL* is more powerful then CTL and LTL but Model checking is PSPACE-complete in size of formula. 15

16 Model Checking Problem CTL Model Checking problem: Given a program model (S, s 0, R, L) and a CTL formula f, determine if s 0 f. Model-checking Satisfiability Semantic search: Given, M=(S,s 0,R,L), every formula is identified with the set of states that satisfy the formula (false, true S). So, given f, find the set S S of all states in S that satisfy f. Check if s 0 S. 16

17 Model Checking by Semantic Search Given (S, s 0, R,L), and f, find the set S S of all states in S that satisfy f. Simple for formulae: { s s p } = { s p L(s) } -- p atomic { s s f g } = { s s f } { s s g } { s s f } = S - { s s f } { s s EXf } = { s t S s.t. (s,t) R t f } The problem arises with A(qUr) and E(qUr). 17

18 Fix-points Fix-point: (x)=x Given a set S, a functional : 2 S 2 S is: - monotonic iff P Q [P] [Q] - -continuous iff P1 P2 [ Pi]= [Pi] - -continuous iff P1 P2 [ Pi]= [Pi] Theorem (Tarski) Monotonic have least and greatest fix-points: lfp( ) = {Z : [Z]=Z}, gfp( ) = {Z : [Z]=Z}, lfp( ) = i [ ], i=0,1, if is also -continuous gfp( ) = i [S], i=0,1, if is also -continuous 18

19 Fix-points of CTL Operators Lemma: EFf = f EX(Eff) (satisfied by same states) EFf is a fix-point of [Z] = f EX Z f EX Z is monotonic, -continuous and -continuous by Tarski: lfp(f EXZ) = (f EX false) I Lemma: EFf is a least fix-point of [Z] = f EX Z EFf = (f EX false) i 19

20 Fixpoints of CTL Operators (Clark-Emerson) [Z] g (f AXZ) g (f EXZ) f AXZ f EXZ lfp A[fUg] E[fUg] AFf EFf computation (g (f AX false)) i (g (f EX false)) i (f AX false) i (f EX false) i [Z] gfp computation f AXZ AGf (f AX true) i f EXZ EGf (f EX true) i where i S (S is finite) Recall AX(f) EX f 20

21 Example: EFp P the Kripke model P (false)= p EX false = p P 2 (false)= p EX p P 3 (false)= p EX(p EX p) 21

22 22 Example: EGy = (y EX true) i S6:{z} S7:{} S0:{x,y,z} S3:{x} S4:{y} S5:{x,z} S2:{y,z} S1:{x,y} [EG(y)] = [y] EX[S] = {s0,s1,s2,s4}=e0 [y] EX[E0]= {s0,s1,s2,s4} {s0,s2,s3,s4,s5,s6}= {s0,s2,s4}= E1 [y] EX[E1]= {s0,s1,s2,s4} {s0,s2,s3,s4,s6}= {s0,s2,s4}= E1

23 Example: EF(x=z y z) = ((x=z y z) EX false) i S6:{z} S7:{} S0:{x,y,z} S3:{x} S4:{y} S5:{x,z} S2:{y,z} S1:{x,y} [EF(x=z y z)] = [(x=z y z)] EX[ ] = {s4,s5}=e0 [E0] EX[E0]= {s4,s5} {s6}= {s4,s5,s6}= E1 (EX[E1]= {s6,s7})= {s4,s5,s6,s7}= E2 (EX[E2]= {s6,,s7,s5}) = {s4,s5,s6,s7} 23

24 Model Checking 24 Algorithm (sketch) 1. Construct A, the set of sub-formulae of f. 2. For i=1,, f, label every state s S with the sub-formulae of length i that are satisfied by s. 3. Check if s 0 is labeled by f. At stage i the algorithm employs the information gathered in earlier stages (in particular path formulae look at the information of the next states).

25 Model Checking Algorithm 25 Given M=(S, s 0, R, L), and a CTL formula f for j=0 to length(f) for each sub-formula g of f of length j case (-- structure of g) p: nothing (-- S is already labeled with propositions) q r: s S: if q L(s) and r L(s) then add q r to L(s) q: s S: if q L(s) then add q to L(s) EXq: s S: if t s.t. (s,t) R and q L(t) then add EXq to L(s) A(qUr): AU-check(q, r) E(qUr): EU-check(q, r) if f L(s 0 ) then output=true, else output=false.

26 Checking state satisfiability fro A(qUr), E(qUr) AU-check (q, r) for each s S, if r L(s) then add A(qUr) to L(s) for j=1 to S for each s S, if q L(s) and A(qUr) L(t) for all t s.t. (s,t) R then add A(qUr) to L(s) EU-check (q, r) for each s S, if r L(s) then add E(qUr) to L(s) for j=1 to S for each s S, if q L(s) and E(qUr) to L(t) for some t s.t. (s,t) R then add E(qUr) to L(s) Complexity: O( S 2 ) 26

27 Fairness Assumption Strong fairness: a transition that is enabled i.o. is taken i.o - LTL: ( ) - - private case, =True Weak fairness: a transition that is continuously enabled is taken i.o - LTL: ( ) Rule out traces that are unrealistic or provide for unfair service (starvation). (T_Red &P_Green) & (P_Red &T_Green) T_Red, P_Green T_Red, P_Red T_Green, P_Red Fairness assumptions are not in CTL

28 Fair Semantics for CTL Strong Fairness constraint: Sfair = i ( i i ) j ( j j ), i, i, j, j, CTL formulae. For a model M= (S, s I, R, L) and s S: FairPaths(s) = { Paths(s) Sfair } Fair semantics w.r.t. Sfair s F p iff s p s F f iff not s F f s F f g iff s F f and s F g s F Exf iff s. (s,s ) R and s f FairPaths(s), s F E[pUq] s F A[pUq] iff exists =(s 0, s 1, ) s.t s 0 =s, FairPaths(s), k 0. s k q i. 0 i k s i p iff for every =(s 0, s 1, ) s.t s 0 =s, FairPaths(s), k 0. s k q i. 0 i k s i p

29 Model Checking under Farness Constraints How to check: FairPaths(s)? Observation: FairPaths(s) iff j 0 j FairPaths( j ) Hence, redefine fair semantic: s F p iff s p s F f iff not s F f s F f g iff s F f and s F g s F Exf iff s. (s,s ) R and s f FairPaths(s ) s F A[fUg] iff for every path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i f FairPaths(s k ) s F E[fUg] iff for some path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i f FairPaths(s k )

30 Computation of FairPaths(s) Let: Sfair = ( ) where, are CTL formulae. Sfair iff k 0, n k, s.t. = s 0 s k-1 (s k s n ) and: k i n. s i or k j n. s j Computation of FairPaths(s) w.r.t. Sfair = ( ) For a model M= (S, s I, R, L): Let a, b, fair be new fresh variables Compute Sat( )={s S s } then s Sat( ). L(s):=L(s) {a} Compute Sat( )={s S s } then s Sat( ). L(s):=L(s) {b} Decompose M into a graph of maximal SCCs. For each SCC, if for all states s SCC, a L(s), or otherwise there exists a state s SCC s.t. b L(s ), mark the SCC as fair For each s S if there exists a path from s to a fair SCC then L(s) {fair}

31 Computation of FairPaths(s) Hence, redefine fair semantic: s F p iff s p s F f iff not s F f s F f g iff s F f and s F g s F Exf iff s. (s,s ) R and s (f fair) s F A[fUg] iff for every path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i (f fair) s F E[fUg] iff for some path (s 0, s 1, ) s.t s 0 =s, k 0. s k g i. 0 i k s i (f fair) Thus, fair model checking requires pre-processing of the model that extends the states labeling, then normal model checking algorithm

32 Complexity For a model with N states and M transitions and a CTL formula f and a CTL fairness constraint, still linear time: O( f (N +M)). In the general case, with k fairness constraints, the labeling must be carried out separately for each constraint and the final labeling is the conjunction of the separate labeling. The complexity is then O( f (N +M) k)

33 RTCTL 33 A(qU k r) - at all paths r holds within k t.u. and q holds at all states until then. E(qU k r) - at some path r holds within k t.u. and q holds at all states until then. Semantics (fixed rate progress approach): s 0 A(qU k r) iff for every path ( s 0, s 1, ) i. 0 i k s i r j. 0 j i s j q s 0 E(qU k r) iff exists path ( s 0, s 1, ) and i 0. 0 i k s i r j. 0 j i s j q

34 Model Checking Algorithm for RTCTL Given M=(S, s 0, R, L), and a CTL formula f for j=0 to length(f) for each sub-formula g of f of length j case (structure of g) p:.. q r:.. q:.. EXq:.. A(qUr):.. A(qU k r): AU-check(min(k, S ), q, r) E(qUr):.. E(qU k r): EU-check(min(k, S ), q, r) if f L(s 0 ) then output=true, else output=false. 34

35 A(qU k r): 35 AU-check (max_len, q, r) -- max_len= min(k, S ) for each s S, if r L(s) then add A(qU 0 r) to L(s) for len=1 to max_len for each s S, if q L(s) and for every t such that (s,t) R there is j len-1 s.t. A(qU j r) L(t) then add A(qU len r) to L(s) for each s S, if A(qU j r) L(s) for some j max_len then replace by A(qU max_len r) to L(s) Note j<max_len can occur when S >k

36 E(qU k r): 36 EU-check (max_len, q, r) -- max_len= min(k, S ) for each s S, if r L(s) then add E(qU 0 r) to L(s) for len=1 to max_len for each s S, if q L(s) and E(qU len-1 r) L(t) for some t such that (s,t) R then add E(qU len r) to L(s) for each s S, if E(qU j r) L(s) for some j max_len then replace by E(qU max_len r) to L(s)

37 RTCTL (II) 37 In order to express fixed delays, we need: A(qU k r) - at all paths r holds at k t.u. and q holds at all states until then. E(qU k r) - at some path r holds at k t.u. and q holds at all states until then. Semantics (fixed rate progress approach): s 0 A(qU k r) iff for every path ( s 0, s 1, ) s k r j. 0 j k s j q s 0 E(qU k r) iff exists path ( s 0, s 1, ) and s k r j. 0 j k s j q Model checking same idea as for k

38 Railroad Crossing in Real-Time CTL Assertions: 50 seconds minimal delay between trains. AG(Tin EF 50 Tin) It takes a train 6 seconds to arrive at the signal AG(Tin AF 6 AtSignal) Train exits XR within 15 to 25 seconds. AG(((Twait AX( Twait)) AX(AtSignal Twait)) AG 16 Tout AF 26 Tout ) Requirements: Train at the signal is allowed to continue within 10 seconds. AG(AtSignal AF 5 ( Twait)) The gate is open whenever the crossing is empty for more than 10 seconds. AG( E(Tcr0U =10 Open)) 38

39 Symbolic Model Checking Symbolic representation with Boolean formulae of: the model (program) CTL formula thus avoiding the state explosion problem. Model Checking reduces to Boolean formulae manipulation. The idea: Given a model (S,R,L) over P (set of atomic propositions), Represent every state s S by a Boolean formula over P that is satisfied exactly by L(s) Represents R in terms of the Boolean formulas corresponding to source and destination states. 39

40 Program Representation - Example I S S' p S p S p R ( p p ) (p p ) (p p ) ( p p) p (p p ) p (p p ) (p p) (p p ) (p p ) 40

41 Program Representation - Example II 41 S0 S1 v 0 v 0 S3 S2 v 1 v 0,v 1 v 1 S0 (v 0 v 1 ), S1 v 0 v 1, S2 v 0 v 1, S3 v 0 v 1 R (v 0 ' v 0 ) (v 1 (v 0 v 1 ))

42 CTL Symbolic Representation p P, f, f g, are Boolean formulae. We show Boolean representation for: EXf, A[fUg], E[fUg] EXf Let v 1,,v n P be the atomic propositions in f, then: (v 1,,v n ).f = (a1,,a n ) {0,1} n f(a 1,,a n ) Then, EXf is represented by the formula (v 1 ',,v n ').(R f (v 1 ',,v n ') ) EX p = p'. R f(p ) = p'. (p p') p' = p'. (p p') = (p false) (p true) = p S S' p 42

43 S0 S1 v 0 v 0 S3 S2 v 1 v 0,v 1 v 1 EX(v 0 v 1 ) = (v 0 ', v 1 '). R (v 0 ' v 1 ') = (v 0 ', v 1 '). ( v 0 v 1 v 0 ' v 1 ') = (v 1 ').( v 0 v 1 false v 1 ') ( v 0 v 1 true v 1 ') = (v 1 '). ( v 0 v 1 v 1 ') = ( v 0 v 1 false) ( v 0 v 1 true) = ( v 0 v 1 ) 43

44 CTL Operators Representation For other CTL operators use their fixed point representation in terms of EX. S S' p Example: computation of EFp - recall EFp = i (false) where (y)= p EXy 1 (false) = p EXfalse = p 2 (false) = (p) = p EXp = p p'.(p p') p' = true 3 (false) = (true) = p EXtrue = true 44

45 Computation of EF(v 0 v 1 ) S0 S1 v 0 v 0 S3 S2 v 1 v 0,v 1 v 1 1 (false) = (v 0 v 1 ) EXfalse = (v 0 v 1 ) 2 (false) = (v 0 v 1 ) = (v 0 v 1 ) EX(v 0 v 1 ) = (v 0 v 1 ) ( v 0 v 1 ) = v 1 3 (false) = (v 1 ) = (v 0 v 1 ) EXv 1 = (v 0 v 1 ) 3 (false) = (v 0 v 1 ) = (v 0 v 1 ) EX(v 0 v 1 ) = true 45

46 Symbolic Model Checking Algorithm eval(f) { Case (f) p : return p g: return eval(g) g h: return eval(g) eval(h) EXg: return v'.(r p') E(gUh): return evaleu(eval(g),eval(h),false)) EGg: return evaleg(eval(g),true) } evaleu(p,q,y) { y'=q (p evalex(y)) if y'=y then return y else return evaleu(p.q.y') } evaleg(p,y) { y'=(p evalex(y)) if y'=y then return y else return evaleg(p.y') 46

47 Binary Decision Diagrams (BDD) Graphical representation of Boolean formulae obtained from ordered decision trees. a b b c c c c d d d d d d d d Ordered Decision Tree of a b c d 47

48 BDD Derivation Apply in bottom-up manner: Combine isomorphic sub-trees into a single tree Eliminate nodes whose left and right children are isomorphic Linear time Size of resulting graph depends on variable ordering 48

49 49 Example - Step 1: node elimination a b b c c d 0 1 d 0 1 d 0 1 d 0 1 d 0 1 d 0 1 d 0 1 d 0 1 c c

50 Example - Step 1: isomorphic trees 50 a 0 1 b b 0,1 0 1 c c 0,1 0 1 d d d 0, ,

51 Example - Step 1: Final BDD 51 a 1 0 b 0 1 c d

52 Properties of BDDs Canonical representation of formulae, enables simple comparison. Logical operators:,,, EX are computed w.r.t. BDD quadratic time. 52