Outline Temporal Logic Ralf Huuck Why not standard logic? What is temporal logic? LTL CTL* CTL Fairness Model Checking Problem model, program? M φ satisfies, Implements, refines property, specification How to formalize the different components? for this lecture we assume is M given as a Kripke structure, what about and φ? Kripke Structure Given a set of atomic propositions AP. Kripke structure M=(S,,, μ) is defined by S set of states initial state S S transition relation (total) μ:s 2 AP labeling function Any infinite run is accepting, i.e., like Buchi automaton where every state is a final state. Product as for NFA. 1
Example How to define properties formally? Kripke structure automata ω regular expression logics Logic can provide succinct notation, close to natural language. Propositional Logic Propositional Logic Syntax φ ::= p φ φ 1 φ 2 Other connectivities (,,, ) can be derived (see next slide) Semantics Given a state s in a Kipke structure M we define M,s φ inductively by: M,s p p μ(s) M,s φ not M,s φ M,s φ 1 φ 2 M,s φ 1 or M,s φ 2 (,,, true,false ) Propositional logic is good at describing static situations. 2
Example Example M, a b M, a M, a How to describe: eventually b will happen? a will happen always again? Propositional logic is good for describing static situations. Propositional logic is unsuitable for describing dynamic behavior. Dynamic Behavior Mutual Exclusion Important for reactive systems security protocols hardware operating systems embedded systems process1 ncs cs ncs process2 ncs cs ncs always only one process in cs eventually process1 in cs always eventually process2 in cs cs = critical section ncs = none critical section 3
Temporal Logics LTL originate from philosophy how to express statements including time? what is an appropriate model? real-time vs discrete time linear time vs branching time (deterministic vs non-deterministic) (P)LTL LTL Syntax Propositional Linear time Temporal Logic discrete time linear (deterministic) progression on on on on on on on on PLTL formula are inductively defined by: φ ::= p φ φ 1 φ 2 Xφ Fφ Gφ φ 1 Uφ 2 p denotes atomic proposition X denotes next-state operator F denotes eventually/finally G denotes always/globally U denotes until 4
LTL semantics Paths in Kripke Structures LTL formula φ interpreted over infinite paths of states π= we define LTL wrt Kripke structure M M,π²φ denotes φ holds in a path π of Kripke structure M. M²φ iff all paths of M satisfy φ, i.e., for all π in M we have M,π²φ remember transition relation is total Semantics of LTL Operators Example let π k denote suffix s k s k+1 s k+2... where k 0 M,π² p iff ² p, i.e., p μ( ) M,π² φ iff not M,π²φ M,π²φ 1 φ 2 iff M,π²φ 1 or M,π²φ 2 M,π² Xφ iff M,π 1 ²φ, i.e., s k s k+1 s k+2... satisfies φ M,π² Fφ iff k 0 s.t. M,π k ²φ M,π² Gφ iff k 0 M,π k ²φ M,π² φ 1 Uφ 2 iff 0 s.t. M,π k ² φ 2 and 0 j<k we have M,π j ² φ 1 path π satisfies: M,π² a M,π² b M,π² Xb M,π² Fa M,π² FG(a b) M,π² F(bUa) M,π² FG(aUb) what else? 5
Exercise M²φ Which temporal operators can be expressed through one or more of the others? M²φ iff M,π²φ for all paths π Which cannot? Which properties satisfy this Kripke structure? CTL* CTL* Computational Tree Logic (star) discrete time branching (non-deterministic) progression describes properties of computation trees more powerful than LTL 6
Computation Trees Unwinding Kripke Structure Kripke structure computation tree on on on on on on on on on on on Operators in CTL* CTL* Formulae temporal operators same as LTL, describe properties of paths path quantifiers A: for all paths ( )... E: there exists a path ( )... more formally... propositional logic as underlying static logic two different types of formulae state formula: properties of a state path formulas: property of a path all LTL formulae are path formulae state formulae static propositional formulae 7
State Formulae Path Quantifiers in State Formulae φ s ::= p φ s φ s1 φ s2 Aφ π Eφ π φ s denotes state formula φ π path formula p atomic proposition Aφ π and Eφ π are state formulas set of all state formulae = set of all legal CTL* formulae Aand Eare path quantifiers denote universal and existential quantification over paths starting in a certain state Aφ π holds in a state s iff for all paths starting in s, φ π holds Eφ π holds in a state s iff there exisits a path starting in s, s.t. φ π holds Path Formulae Semantics of CTL* φ π ::= φ s φ π φ π1 φ π2 Xφ π Fφ π Gφ π φ π1 Uφ π2 every LTL formula is path formula all state formulae are also path formulae define semantics w.r.t. Kripke structure M M,s²φ denotes state formula φ holds in a state s of M M,π²φ denotes path formula φ holds for path π in M ² defined inductively, as before nesting: A(GF(A a b)) (example tree?) 8
Semantics of CTL* State Formulae Semantics of CTL* Path Formulae M,s² piffp μ(s) M,s² φ iff not M,s²φ M,s²φ 1 φ 2 iff M,s²φ 1 and M,s²φ 2 M,s² Aφ iff for all paths π starting in s, M,π²φ M,s² Eφ iff there exists a paths π starting in s, such that M,π²φ M,π²φ s iff ² φ s M,π² φ iff not M,π²φ M,π²φ 1 φ 2 iff M,π²φ 1 or M,π²φ 2 M,π² Xφ iff M,π 1 ²φ, i.e., s k s k+1 s k+2... satisfies φ M,π² Fφ iff k 0 s.t. M,π k ²φ M,π² Gφ iff k 0 M,π k ²φ M,π² φ 1 Uφ 2 iff k 0 s.t. M,π k ² φ 2 and 0 j<k we have M,π j ² φ 1 basically, same as before LTL vs. CTL* Examples φ LTL implies Aφ CTL* root state s o satisfies: M, ² Aa computation tree EFφ CTL* but not expressible in LTL (other examples?) M, ² A( b) M, ² AXb LTL strictly less expressive than CTL* M, ² EFa M, ² EFAa what else? 9
M²φ M²φ (φ CTL*) iff M, ²φ for initial state CTL a fragment of CTL* Which properties satisfies this Kripke structure? CTL CTL Syntax CTL is restricted version of CTL* temporal operators as in CTL* path quantifier as in CTL* However, no unrestricted nesting and Boolean combinations of path formulae (next slide) φ::= p φ φ 1 φ 2 AXφ EXφ AFφ EFφ AGφ EGφ A(φ 1 Uφ 2 ) E(φ 1 U φ2) no arbitrary nesting path qualifiers and temporal operators alternate no Boolean combinations of path formulae Not allowed: a Fq, E(A(F(a b)),..., what else? 10
Example LTL vs. CTL vs. CTL* Which CTL properties hold for this Kripke structure? LTL sublogic of CTL* (EF φ CTL*, not expressible in LTL) CTL sublogic of CTL* (FGφ CTL*, not expressible in CTL) LTL and CTL not comparable FGφ LTL, not expressible in CTL EFφ CTL, not expressible in LTL LTL vs. CTL vs. CTL* Safety and Liveness CTL* safety: never something bad will happen AG (in1 in2) LTL CTL liveness: eventually something good will happen EF safe rule of thumb: liveness properties iff counter example requires an infinite trace/infinite deep tree 11
Fairness Weak/Strong Fairness Often liveness properties cannot be proven without certain assumptions, i.e., fairness. weak fairness if an event is continuously enabled, it will occur infinitely often in LTL: GF ( enabled occurs) strong fairness if a event is infinitely often enabled it will occur infinitely often in LTL: GF enabled GF occurs {c} {c} M²Fb? M²Fc? Weak/Strong Fairness {c} weak fairness if an event is continuously enabled, it will occur infinitely often in LTL: GF ( enabled occurs) strong fairness if a event is infinitely often enabled it will occur infinitely often in LTL: GF enabled GF occurs {c} Fairness and Model Checking Weak/strong fairness can be expressed in LTL, however, not in CTL in LTL model checking fairness can be added directly as an assumption in CTL model checking fairness has to be build into the model checking algorithm under weak fairness: M²Fb under strong fairness: M²Fc 12
This Lecture Summary temporal logic to specify behavior over time LTL: linear structure (for all paths) CTL(*): branching structure (selective paths) LTL, CTL sublogics of CTL* CTL, LTL not comparable different classes of properties (safety/liveness, fairness) Next Lecture CTL model checking how does it work 13