Duration Calculus Introduction

Duration Calculus Introduction Michael R. Hansen mrh@imm.dtu.dk Informatics and Mathematical Modelling Technical University of Denmark 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.1/26

Overview Background Short introduction Decidability results Undecidability results 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.2/26

Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli,... Duration of states Duration Calculus Zhou Hoare Ravn 91 an Interval Temporal Logic Halpern Moszkowski Manna 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

Background Provable Correct Systems (ProCoS, ESPRIT BRA 3104) Bjørner Langmaack Hoare Olderog Project case study: Gas Burner Sørensen Ravn Rischel Intervals properties Timed Automata, Real-time Logic, Metric Temporal Logic, Explicit Clock Temporal,..., Alur, Dill, Jahanian, Mok, Koymans, Harel, Lichtenstein, Pnueli,... Duration of states Duration Calculus Zhou Hoare Ravn 91 an Interval Temporal Logic Halpern Moszkowski Manna Logical Calculi, Applications, Mechanical Support Duration Calculus: A formal approach to real-time systems Zhou Chaochen and Michael R. Hansen Springer 2004 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.3/26

Gas Burner example: Requirements State variables modelling Gas and Flame: G, F : Time {0, 1} State expression modelling that gas is Leaking L = G F Requirement Gas must at most be leaking 1/20 of the elapsed time (e b) 60 s 20 e L(t)dt (e b) b 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.4/26

Gas Burner example: Design decisions Leaks are detectable and stoppable within 1s: where c, d : b c < d e.(l[c, d] (d c) 1 s) P [c, d] = d P (t) = (d c) > 0 c which reads P holds throughout [c, d] 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.5/26

Gas Burner example: Design decisions Leaks are detectable and stoppable within 1s: where c, d : b c < d e.(l[c, d] (d c) 1 s) P [c, d] = d P (t) = (d c) > 0 c which reads P holds throughout [c, d] At least 30s between leaks: c, d, r, s : b c < r < s < d e. (L[c, r] L[r, s] L[s, d]) (s r) 30 s 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.5/26

Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop φ : Intv {tt,ff} 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop φ : Intv {tt,ff} Chop: φ ψ {}}{ b m e } {{ }} {{ } φ ψ for some m : b m e 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

Interval Logic [Halpern Moszkowski Manna 83] Terms: θ ::= x v θ 1 + θ n... Temporal Variable v : Intv R Formulas: φ ::= θ 1 = θ n φ φ ψ φ ψ ( x)φ... chop Chop: φ ψ {}}{ b m e } {{ }} {{ } φ ψ φ : Intv {tt,ff} for some m : b m e In DC: Intv = { [a, b] a, b R a b} 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.6/26

Duration Calculus [Zhou Hoare Ravn 91] State variables P : Time {0, 1} Finite Variablilty State expressions S ::= 0 1 P S S 1 S 2 S : Time {0, 1} pointwise defined 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.7/26

Duration Calculus [Zhou Hoare Ravn 91] State variables P : Time {0, 1} Finite Variablilty State expressions S ::= 0 1 P S S 1 S 2 S : Time {0, 1} pointwise defined Durations S : Intv R defined on [b, e] by e b S(t)dt Temporal variables with a structure 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.7/26

Example: Gas Burner Requirement l 60 20 L l Design decisions D 1 = ( L l 1) D 2 = (( L L L ) l 30) where l denotes the length of the interval, and φ = true φ true for some sub-interval: φ φ = φ for all sub-intervals: φ P = P = l l > 0 P holds throughout a non-point inter 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.8/26

Example: Gas Burner Requirement l 60 20 L l Design decisions D 1 = ( L l 1) D 2 = (( L L L ) l 30) where l denotes the length of the interval, and φ = true φ true for some sub-interval: φ φ = φ for all sub-intervals: φ P = P = l l > 0 P holds throughout a non-point inter succinct formulation no interval endpoints 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.8/26

Correctness informal interval reasoning We must establish: (D 1 D 2 ) l 60 20 L l 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l 30... {}}{ b e We must establish: (D 1 D 2 ) l 60 20 L l 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l 30... {}}{ b e Note that (D 1 D 2 ) (l 30 L 1): L 1 {}}{ L 1 L 1 {}}{... L 1 {}}{}}{ b e }{{} L n + 1 We must establish: (D 1 D 2 ) l 60 20 L l 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

Correctness informal interval reasoning l = 30 {}}{ l = 30 l = 30 {}}{{}}{ l 30... {}}{ b e Note that (D 1 D 2 ) (l 30 L 1): L 1 {}}{ L 1 L 1 {}}{... L 1 {}}{}}{ b e }{{} L n + 1 Since n 2 20 (n + 1) 30 n we have (D 1 D 2 ) l 60 20 L l 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.9/26

Decidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Skakkebæk Sestoft 94, Pandya 01, Fränzle 02, Gomez Bowman 03 Even small extensions give undecidable subsets RDC 1 (Cont. time) RDC 2 RDC 3 l = r, S φ, φ ψ, φ ψ S 1 = S 2 φ, φ ψ, φ ψ l = x, S φ, φ ψ, φ ψ, ( x)φ 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.10/26

Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N. We consider only discrete intervals [b, e] Intv where b, e N. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

Discrete-Time Duration Calculus For an interpretation I : SVar (Time {0, 1}) the discontinuity points of each P I must belong to N. We consider only discrete intervals [b, e] Intv where b, e N. The semantics of chop is { I, [b, e] = φ ψ iff I, [b, m] = φ and I, [m, e] = ψ, for some m [b, e] where m N } 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.11/26

Discrete- vs Continuous-Time DC The formula l = 1 1 ( 1 1 ) is valid for discrete time; but not for continuous time 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.12/26

Discrete- vs Continuous-Time DC The formula l = 1 1 ( 1 1 ) is valid for discrete time; but not for continuous time The formula S ( S S ) is valid for continuous time; but not for discrete time 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.12/26

Restricted Duration Calculus (RDC) 1. if S is a state expression, then S RDC, and 2. if φ, ψ RDC, then φ, φ ψ, φ ψ RDC. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.13/26

Restricted Duration Calculus (RDC) 1. if S is a state expression, then S RDC, and 2. if φ, ψ RDC, then φ, φ ψ, φ ψ RDC. Expressiveness of RDC for Discrete Time: l = 0 1 S = 0 S l = 0 l = 1 1 ( 1 1 ) S = 1 ( S = 0) ( S l = 1) ( S = 0) S = k + 1 ( S = k) ( S = 1) S k ( S = k) true S > k ( S k) ( S = k) S k ( S > k) S < k ( S k) ( S = k) 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.13/26

Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P 3 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P 3 Discrete time one letter corresponds to one time unit L( S ) = (DNF (S)) + L(ϕ ψ) = L(ϕ) L(ψ) L( ϕ) = Σ \ L(ϕ) L(ϕ ψ) = L(ϕ) L(ψ) 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

Decidability of RDC for Discrete Time Satisfiability is reduced to emptiness of regular languages Idea: a Σ describes a piece of an interpretation, e.g. P 1 P 2 P 3 Discrete time one letter corresponds to one time unit L( S ) = (DNF (S)) + L(ϕ ψ) = L(ϕ) L(ψ) L( ϕ) = Σ \ L(ϕ) L(ϕ ψ) = L(ϕ) L(ψ) L( φ ) is regular φ is satisfiable iff L( φ 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.14/26

Example Is the formula ( P P ) P valid for discrete time? 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}}. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}}. We have ( P P ) P is valid iff iff (( P P ) P ) is not satisfiable ( P P ) P is not satisfiable iff L 1 ( P P ) L 1 ( P ) = {} iff {{P } i i 2} (Σ \ {{P } i i 1}) = {} The last equality holds. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

Example Is the formula ( P P ) P valid for discrete time? Σ = {{P }, {}}. We have ( P P ) P is valid iff iff (( P P ) P ) is not satisfiable ( P P ) P is not satisfiable iff L 1 ( P P ) L 1 ( P ) = {} iff {{P } i i 2} (Σ \ {{P } i i 1}) = {} The last equality holds. Therefore, the formula is valid for discrete time. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.15/26

Undecidability [Zhou Hansen Sestoft 93] Restricted Duration Calculus : S φ, φ ψ, φ ψ Satisfiability is reduced to emptiness of regular languages Both for discrete and continuous time Appearrently small extensions give undecidable subsets RDC 1 (Cont. time) RDC 2 RDC 3 l = r, S φ, φ ψ, φ ψ S 1 = S 2 φ, φ ψ, φ ψ l = x, S φ, φ ψ, φ ψ, ( x)φ 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.16/26

Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) Halting problem is undecidable 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

Two-Counter Machines A two-counter machine has an initial label q 0, two counters c 1 and c 2 which can hold arbitrary natural numbers from N = {0, 1, 2,...}, and a finite set of labeled instructions m i. A configuration s has the form: (q, n 1, n 2 ), where q is the current label, and n 1 and n 2 are the values of c 1 and c 2, respectively. Instructions for c 1 (and similarly for c 2 ): Instruction s = s q : c + 1 q j (q, n 1, n 2 ) = (q j, n 1 + 1, n 2 ) q : c 1 q j, q k (q, 0, n 2 ) = (q j, 0, n 2 ) q : c 1 q j, q k (q, n 1 + 1, n 2 ) = (q k, n 1, n 2 ) Halting problem is undecidable Assume deterministic machine with one halting state q fin 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.17/26

Undecidability 1: Continuous time only 1. the formula l = r belongs to RDC 1 (r), 2. if S is a state expression, then S belongs to RDC 1 (r), and 3. if φ and ψ belong to RDC 1 (r), then so do φ, φ ψ, and φ ψ. Encoding of two-counter machine M: one state variable Q i for each label q i. Let Q = {Q 0,..., Q fin } two state variables C 1 and C 2 to represent the counter values two auxiliary state variables B and L, used as delimiters 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.18/26

Undecidability 1: Continuous time only 1. the formula l = r belongs to RDC 1 (r), 2. if S is a state expression, then S belongs to RDC 1 (r), and 3. if φ and ψ belong to RDC 1 (r), then so do φ, φ ψ, and φ ψ. Encoding of two-counter machine M: one state variable Q i for each label q i. Let Q = {Q 0,..., Q fin } two state variables C 1 and C 2 to represent the counter values two auxiliary state variables B and L, used as delimiters A configuration (q, n 1, n 2 ) is encoded on an interval of length 4r: Q Val }{{} 1 }{{}}{{} L Val 2 }{{} r r r r where Val j represents the value of counter c j. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.18/26

Undecidability 1 Abbreviations = 1 true = 1 l < r = ((l = r) true) l = 4r = (l = 2r) (l = 2r) S r = S (l = r) φ ψ = (φ ( ψ)) S r reads S has value one for a duration of r φ ψ reads if the interval starts with φ, it must end immediately with or with ψ φ leads to ψ 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.19/26

Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B. The computation of M is simulated by a formula F (M) For example, the following formula copies the C 1 sections to the same place in the next configuration. C 1 true Q i r (l < r) C 1 ( C 1 true) l = 4r exploits precision of length 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

Undecidability 1 Continued The interval describing Val i has the following form: B C i B B C i B with n i sections of C i separated by B. The computation of M is simulated by a formula F (M) For example, the following formula copies the C 1 sections to the same place in the next configuration. C 1 true Q i r (l < r) C 1 ( C 1 true) l = 4r M halts iff F (M) is satisfiable exploits precision of length satisfiability is undecidable for the subset under consideration 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.20/26

Remarks l = 1 is not expressible in RDC for continuous time. Relaxing punctuality, replacing l = r with l < r does not give decidability. Relaxing punctuality, replacing l = r with l > r? 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.21/26

Undecidability 2: Discrete and Cont. Time 1. if S 1 and S 2 are state expressions, then S 1 = S 2 belongs to RDC 2, and 2. if φ and ψ belong to RDC 2, then so do φ, φ ψ and ψ ψ. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.22/26

Undecidability 2: Discrete and Cont. Time 1. if S 1 and S 2 are state expressions, then S 1 = S 2 belongs to RDC 2, and 2. if φ and ψ belong to RDC 2, then so do φ, φ ψ and ψ ψ. Encoding 1. two state variables C + i and C i for each counter c i 2. state variables Q = {Q 0,..., Q fin } corresponding to the labels Idea the value of c i is represented by the value of C + i C i a computation s 0 s 1 s 2 is represented by a sequence QE 0 C 0 QE 1 C 1 QE 2 C 2 QE k is a state expression of Q C k is a state expression of {C + 1, C + 2, C 1, C 2 } 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.22/26

Undecidability 2: Abbreviations C = C + 1 C 1 C + 2 C 2 S = ( S = 1) ( 0 = 1) Incr 1 = C + 1 (C 1 C + 2 C 2 ) S > 0 = S = 1 true = 1 φ ψ = (φ ( ψ)) p φ = φ true reads: for some prefix interval: φ p φ = ( p ( φ)) reads: for all prefix intervals: φ. 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.23/26

Undecidability 2: Encoding Instructions The instruction q j : c + i q k is encoded as follows (true C ) ( Q j C ) Qj = C Q k ( Q k Incr i ) ( Q k Incr i Q true) remaining instructions follows similar pattern mutual exclusive sections and sections of equal size undecidability of RDC 2 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.24/26

Undecidability 3 1. if S is a state expression, then S belongs to RDC 3, 2. if x is a global variable, then l = x belongs to RDC 3, and 3. if φ and ψ belong to RDC 3, then so do φ, φ ψ, φ ψ and ( x)φ, where x is any global variable. A configuration of the machine is represented by a sequence of sections Q, L and C, all of the same length: Q C C L }{{} 1 C C L }{{} 2 n 1 n 2 The initial configuration, (q 0, 0, 0), is represented by Q 0 L 1 L 2 : x.( Q 0 (l = x)) ( L 1 (l = x)) ( L 2 (l = x)) true 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.25/26

Undecidability 3: Encoding Instructions An abbreviation: S x = ( S ) (l = x) An instruction q j : c + 1 q k transforms configurations as follows: Q j C C L }{{} 1 C C L }{{} 2 = Q k C C C L }{{} 1 C C L }{{} 2 n 1 n 2 n 1 +1 n 2 Encoding x, y, z. ( Q j x C y L 1 x C z L 2 x (l = 4x + y + z)) (l = 3x + y + z) Q k x C x C y L 1 x C z L 2 x undecidability of RDC 3 02240 Computability and Semantics, Spring 05, c Michael R. Hansen p.26/26