3 COMP 1 5 9 3 Algorithmic Verification Temporal Logics Dr. - - PowerPoint PPT Presentation

▶
3 comp 1 5 9 3 algorithmic verification
SMART_READER_LITE
LIVE PREVIEW

3 COMP 1 5 9 3 Algorithmic Verification Temporal Logics Dr. - - PowerPoint PPT Presentation

Feb 25, 2024 41 likes •873 views

<latexit

slide-1
SLIDE 1

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

COMP 3 9 1 5 3 Algorithmic Verification

<latexit sha1_base64="P4jUJHo6g1yopyZBD74hiv3LdI=">AIZHicjVRb9NIFD6kXEKW6l4QEhoCBalIa4JYJqVcTSF14QRaIFqanQ2D5xRpnYZjxpG6L8Cn7d/oH9EfvEmWPnRgy7juw5/ubMd75zif1Uq8w2m39fqKxcvHT5SvVq7Y9r12/cvLV6+yhLBibAwyDRifnsywy1ivHQKqvxc2pQ9n2Nn/zevtv/dIomU0n80Q5TPOnLKFYdFUhL0JfVyve2j5GKR1b1vqUqsAOD41o7TkI8zqy0WO8orfd8PcAH2826ULGySuoTsfHV2xSjtsVz63fyNeuM9t+/OxiPx38uMxgMmUD6ySkKo6KuFUln76tHVHqnhGqnOdUJRotU/mok7OfqXZLqHbLqSKDGJeJ0ruOqSw/r5xpiJqkMNWMhOW0Skha5STBUMZzeTmKVl0GAaZWxRGX6fzXdQqNPMubgmGEXIgydGeGuqoXqDeH7paiM4bWHNqa8Z5vFikJacWGV9/yGtNWkMq/dJQYZbt9FYgjNMJZO0Yhwvz9+XWerPR5EsG15hrENxHSrlTa0IYQEAhAHxBisGRrkJDR7xg8aEJK2AmMCDNkKd5HGEONzg7IC8lDEtqjZ0RvxwUa07vjzPh0QFE03YZOCnhc+IRkdxjNVxdfzPn+KsaIuZ3GIa1+wdkn1EKX0P86N/H8v+dcTpYUvuRcFOlMGXFZBgsZdWjV9G5Jv3sOyRPJCumUISsgTBOaIy6GoTWvq8u8y3W7Idk/S4Xd6oH3zj+xGeCaVp9ZjIUzeU9YE15rhLqdCal96yI7mrv8op4x50yhJ3Rvu0zBhzqOMyGsLXrH3K9gj1OmVFNdV8gnj+l28Xo8BYJ3cIFdMCKpFm7f5767majRvfyLaT+cVjPjPFz9keJ70IAW2f1p5IwrH5Bnh+5FBX3OVdHq5n6Zz2lxWZ7R0/VYsJ3MacgonoB97lfM/RAcyXkgc7jpzKvfWMoI4ZS7O2SdlnuC8Iw8M54ZzTmNWK/intf5H6JoR9NOxJ0dwgPKuUkdmuXsVM9nmnKlU45mp3WY/OeQJ6oLQtyd6SB7vtaLyvO6WZ7dfM4Rzum5B4/o7dFvlEw8c0SyJUlZyioM+yZFrfMTuSJTeM5mpgbuW+f9/GVbNo62G97zxvMP2+uv3xRfvSrcg4ewQfPyAl7DWziAQwgq/6Ilc2Vp1f+qV6rlXv5K6VC8WZNVi4qvd/AB3w9Tw=</latexit>

Temporal Logics

  • Dr. Liam O’Connor

CSE, UNSW (for now) Term 1 2020

1

slide-2
SLIDE 2

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Reachability

Define Reach(A, q) ⊆ Q as the set of states reachable in A from q. Define Reach(A) ≡ Reach(A, q0).

2

slide-3
SLIDE 3

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Reachability

Define Reach(A, q) ⊆ Q as the set of states reachable in A from q. Define Reach(A) ≡ Reach(A, q0). Exercise Describe the algorithm for computing Reach(A).

3

slide-4
SLIDE 4

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Reachability

Define Reach(A, q) ⊆ Q as the set of states reachable in A from q. Define Reach(A) ≡ Reach(A, q0). Exercise Describe the algorithm for computing Reach(A). Deadlock or a stuck state is a state q ∈ Q which has no outgoing transitions i.e ∀a. δ(q, a) = ∅.

4

slide-5
SLIDE 5

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Deadlock Example

Assuming unicast synchronisation: p0 p1 p2 p3 lock(L1)! lock(L2)! unlock(L2)! unlock(L1)! q0 q1 q2 q3 lock(L2)! lock(L1)! unlock(L1)! unlock(L2)! free1 locked1 lock(L1)? unlock(L1)? free2 locked2 lock(L2)? unlock(L2)? Exercise: What is an algorithm to detect deadlock?

slide-6
SLIDE 6

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Deadlock Example

Assuming unicast synchronisation: p0 p1 p2 p3 lock(L1)! lock(L2)! unlock(L2)! unlock(L1)! q0 q1 q2 q3 lock(L2)! lock(L1)! unlock(L1)! unlock(L2)! free1 locked1 lock(L1)? unlock(L1)? free2 locked2 lock(L2)? unlock(L2)? locked1 locked2 q1 p1

6

slide-7
SLIDE 7

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Deadlock Example

Assuming unicast synchronisation: p0 p1 p2 p3 lock(L1)! lock(L2)! unlock(L2)! unlock(L1)! q0 q1 q2 q3 lock(L2)! lock(L1)! unlock(L1)! unlock(L2)! free1 locked1 lock(L1)? unlock(L1)? free2 locked2 lock(L2)? unlock(L2)? locked1 locked2 q1 p1 Exercise: What is an algorithm to detect deadlock?

7

slide-8
SLIDE 8

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Safety Properties

A safety property is an assertion that bad things do not happen. In

  • ther words, given some set of states Bad ⊆ Q, we want to check

that: Bad ∩ Reach(A) = ∅

8

slide-9
SLIDE 9

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Safety Properties

A safety property is an assertion that bad things do not happen. In

  • ther words, given some set of states Bad ⊆ Q, we want to check

that: Bad ∩ Reach(A) = ∅ Exercise Give an algorithm to check a safety property.

9

slide-10
SLIDE 10

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Observations

Is use after free a safety property? void foo() { int x, a; int *p = malloc(sizeof(int)); for (x = 10; x > 0; x--) { a = *p; if (x <= 1) { free(p); } } }

slide-11
SLIDE 11

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Observations

Is use after free a safety property? void foo() { int x, a; int *p = malloc(sizeof(int)); for (x = 10; x > 0; x--) { a = *p; if (x <= 1) { free(p); } } } ℓ0 ℓ1 ℓ2 ℓ7 ℓ3 ℓ4 ℓ5 ℓ6 malloc use free

slide-12
SLIDE 12

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Observations

Is use after free a safety property? void foo() { int x, a; int *p = malloc(sizeof(int)); for (x = 10; x > 0; x--) { a = *p; if (x <= 1) { free(p); } } } ℓ0 ℓ1 ℓ2 ℓ7 ℓ3 ℓ4 ℓ5 ℓ6 malloc use free OK Free Bad

free use

∗

12

slide-13
SLIDE 13

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Kripke Structures

Definition A labelled automaton is a FA (Q, q0, Σ, δ, F, L) with an additional labelling function L : Q → 2P, where P is our atomic propositions. A Kripke structure is a type of labelled automaton where |Σ| = 1, F = Q. Equivalently, we don’t have a notion of actions or final states, and δ : Q → 2Q. We also require that for any q, δ(q) = ∅. q0 q1 q3 q2 start stop terminate suspend resume

slide-14
SLIDE 14

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Kripke Structures

Definition A labelled automaton is a FA (Q, q0, Σ, δ, F, L) with an additional labelling function L : Q → 2P, where P is our atomic propositions. A Kripke structure is a type of labelled automaton where |Σ| = 1, F = Q. Equivalently, we don’t have a notion of actions or final states, and δ : Q → 2Q. We also require that for any q, δ(q) = ∅. q0 q1 q3 q2 start stop terminate suspend resume start stop terminate suspend resume

slide-15
SLIDE 15

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Kripke Structures

Definition A labelled automaton is a FA (Q, q0, Σ, δ, F, L) with an additional labelling function L : Q → 2P, where P is our atomic propositions. A Kripke structure is a type of labelled automaton where |Σ| = 1, F = Q. Equivalently, we don’t have a notion of actions or final states, and δ : Q → 2Q. We also require that for any q, δ(q) = ∅. q0 q1 q3 q2 start stop terminate suspend resume start stop terminate suspend resume { stopped } { started, running } { terminated } { suspended, started }

slide-16
SLIDE 16

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Kripke Structures

Definition A labelled automaton is a FA (Q, q0, Σ, δ, F, L) with an additional labelling function L : Q → 2P, where P is our atomic propositions. A Kripke structure is a type of labelled automaton where |Σ| = 1, F = Q. Equivalently, we don’t have a notion of actions or final states, and δ : Q → 2Q. We also require that for any q, δ(q) = ∅. q0 q1 q3 q2 start stop terminate suspend resume start stop terminate suspend resume { stopped } { started, running } { terminated } { suspended, started }

16

slide-17
SLIDE 17

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Traces

Definition A trace, also called a behaviour, is the sequence of labels corresponding to a run. For Kripke structures it is necessarily infinite in length. Define Traces(A) to be all possible infinite traces from q0 in A. Definition A linear time property is a set of traces, i.e. a subset of (2P)ω. We say a Kripke structure A satisfies a property P iff: Traces(A) ⊆ P

17

slide-18
SLIDE 18

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL

Linear temporal logic (LTL) is a logic designed to describe linear time properties. Linear temporal logic syntax We have normal propositional operators: p ∈ P is an LTL formula. If ϕ, ψ are LTL formulae, then ϕ ∧ ψ is an LTL formula. If ϕ is an LTL formula, ¬ϕ is an LTL formula.

18

slide-19
SLIDE 19

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL

Linear temporal logic (LTL) is a logic designed to describe linear time properties. Linear temporal logic syntax We have normal propositional operators: p ∈ P is an LTL formula. If ϕ, ψ are LTL formulae, then ϕ ∧ ψ is an LTL formula. If ϕ is an LTL formula, ¬ϕ is an LTL formula. We also have modal or temporal operators: If ϕ is an LTL formula, then X ϕ is an LTL formula. If ϕ, ψ are LTL formulae, then ϕ UNTIL ψ is an LTL formula.

19

slide-20
SLIDE 20

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•}

20

slide-21
SLIDE 21

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,•

21

slide-22
SLIDE 22

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• X¬• X• X• X• X¬• ??

22

slide-23
SLIDE 23

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

23

slide-24
SLIDE 24

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

24

slide-25
SLIDE 25

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

25

slide-26
SLIDE 26

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

26

slide-27
SLIDE 27

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

27

slide-28
SLIDE 28

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

28

slide-29
SLIDE 29

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics in Pictures

σ ∅ {•} {•} {•} {•} {•} ¬•, ¬• ¬•,•

  • , ¬•
  • , ¬•
  • , ¬•

¬•,• ¬(φ U ψ) φ U ψ φ U ψ φ U ψ φ U ψ φ U ψ

29

slide-30
SLIDE 30

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics

Let σ = σ0σ1σ2σ3σ4σ5 . . . be a trace. Then define notation: σ|0 = σ σ|1 = σ1σ2σ3σ4σ5 . . . σ|n+1 = (σ|1)|n

30

slide-31
SLIDE 31

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics

Let σ = σ0σ1σ2σ3σ4σ5 . . . be a trace. Then define notation: σ|0 = σ σ|1 = σ1σ2σ3σ4σ5 . . . σ|n+1 = (σ|1)|n Semantics The models of LTL are traces. For atomic propositions, we just look at the first state: σ | = p ⇔ p ∈ σ0

31

slide-32
SLIDE 32

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics

Let σ = σ0σ1σ2σ3σ4σ5 . . . be a trace. Then define notation: σ|0 = σ σ|1 = σ1σ2σ3σ4σ5 . . . σ|n+1 = (σ|1)|n Semantics The models of LTL are traces. For atomic propositions, we just look at the first state: σ | = p ⇔ p ∈ σ0 σ | = ϕ ∧ ψ ⇔ σ | = ϕ and σ | = ψ σ | = ¬ϕ ⇔ σ | = ϕ

32

slide-33
SLIDE 33

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics

Let σ = σ0σ1σ2σ3σ4σ5 . . . be a trace. Then define notation: σ|0 = σ σ|1 = σ1σ2σ3σ4σ5 . . . σ|n+1 = (σ|1)|n Semantics The models of LTL are traces. For atomic propositions, we just look at the first state: σ | = p ⇔ p ∈ σ0 σ | = ϕ ∧ ψ ⇔ σ | = ϕ and σ | = ψ σ | = ¬ϕ ⇔ σ | = ϕ σ | = X ϕ ⇔ σ|1 | = ϕ

33

slide-34
SLIDE 34

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

LTL Semantics

Let σ = σ0σ1σ2σ3σ4σ5 . . . be a trace. Then define notation: σ|0 = σ σ|1 = σ1σ2σ3σ4σ5 . . . σ|n+1 = (σ|1)|n Semantics The models of LTL are traces. For atomic propositions, we just look at the first state: σ | = p ⇔ p ∈ σ0 σ | = ϕ ∧ ψ ⇔ σ | = ϕ and σ | = ψ σ | = ¬ϕ ⇔ σ | = ϕ σ | = X ϕ ⇔ σ|1 | = ϕ σ | = ϕ UNTIL ψ ⇔ There exists an i such that σ|i | = ψ and for all j < i, σ|j | = ϕ We say A | = ϕ iff ∀σ ∈ Traces(A). σ | = ϕ.

34

slide-35
SLIDE 35

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

The operator F ϕ (“finally” or “eventually”) says that ϕ will be true at some point. The operator G ϕ (“globally” or “always”) says that ϕ is always true. Exercise Give the semantics of F and G. Define F and G in terms of other operators.

35

slide-36
SLIDE 36

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •?

slide-37
SLIDE 37

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •?

slide-38
SLIDE 38

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •?

slide-39
SLIDE 39

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •? ρ | = F •?

slide-40
SLIDE 40

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •? ρ | = F •? ρ|3 | = F (• ∧ ¬•)?

slide-41
SLIDE 41

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •? ρ | = F •? ρ|3 | = F (• ∧ ¬•)? ρ | = FG (• ∧•)?

slide-42
SLIDE 42

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •? ρ | = F •? ρ|3 | = F (• ∧ ¬•)? ρ | = FG (• ∧•)? ρ | = G (• UNTIL •)?

slide-43
SLIDE 43

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

More Exercises

Let ρ be this trace:

  • · · ·

ρ | = •? ρ | = •? ρ | = X •? ρ | = F •? ρ|3 | = F (• ∧ ¬•)? ρ | = FG (• ∧•)? ρ | = G (• UNTIL •)? More Derived Operators Define “Infinitely Often” in LTL. Define “Almost Globally” in LTL (always true from some point

  • nwards).

43

slide-44
SLIDE 44

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Possible Futures

q0 q1 q3 q2 start stop terminate suspend resume start stop terminate suspend resume { stopped } { started, running } { terminated } { suspended, started } We can see that it is always possible for a run to move to the terminated state. How do we express this in LTL?

44

slide-45
SLIDE 45

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Possible Futures

q0 q1 q3 q2 start stop terminate suspend resume start stop terminate suspend resume { stopped } { started, running } { terminated } { suspended, started } We can see that it is always possible for a run to move to the terminated state. How do we express this in LTL? We can’t! — it is a branching time property.

45

slide-46
SLIDE 46

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Branching Time

Definition The computation tree of a Kripke structure A, written Tree(A), is an infinite tree of Kripke structure states, where q0 is the root and a state q′ is a child of q if q′ ∈ δ(q).

46

slide-47
SLIDE 47

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Branching Time

Definition The computation tree of a Kripke structure A, written Tree(A), is an infinite tree of Kripke structure states, where q0 is the root and a state q′ is a child of q if q′ ∈ δ(q). A path t1t2t3 . . . is a (infinite) sequence of computation trees such that tn+1 is the child of tn. Define Paths(t) to be the set of all paths starting at t.

47

slide-48
SLIDE 48

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Branching Time

Definition The computation tree of a Kripke structure A, written Tree(A), is an infinite tree of Kripke structure states, where q0 is the root and a state q′ is a child of q if q′ ∈ δ(q). A path t1t2t3 . . . is a (infinite) sequence of computation trees such that tn+1 is the child of tn. Define Paths(t) to be the set of all paths starting at t. Exercise Draw the CT for the process example.

48

slide-49
SLIDE 49

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Syntax

Definition We define two types of formulae, state formulae and path formulae, named based on their models. A state formula (SF) is defined as follows: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF.

49

slide-50
SLIDE 50

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Syntax

Definition We define two types of formulae, state formulae and path formulae, named based on their models. A state formula (SF) is defined as follows: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF. Given a PF ϕ, Eϕ and Aϕ are SFs.

50

slide-51
SLIDE 51

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Syntax

Definition We define two types of formulae, state formulae and path formulae, named based on their models. A state formula (SF) is defined as follows: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF. Given a PF ϕ, Eϕ and Aϕ are SFs. A path formula (PF) is defined much like LTL: If P is a SF, then P is a PF.

51

slide-52
SLIDE 52

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Syntax

Definition We define two types of formulae, state formulae and path formulae, named based on their models. A state formula (SF) is defined as follows: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF. Given a PF ϕ, Eϕ and Aϕ are SFs. A path formula (PF) is defined much like LTL: If P is a SF, then P is a PF. Given PFs ϕ and ψ, ¬ϕ is a PF and ϕ ∧ ψ is a PF.

52

slide-53
SLIDE 53

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Syntax

Definition We define two types of formulae, state formulae and path formulae, named based on their models. A state formula (SF) is defined as follows: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF. Given a PF ϕ, Eϕ and Aϕ are SFs. A path formula (PF) is defined much like LTL: If P is a SF, then P is a PF. Given PFs ϕ and ψ, ¬ϕ is a PF and ϕ ∧ ψ is a PF. Given a PF ϕ then Xϕ is a PF. Given PFs ϕ and ψ, ϕ UNTIL ψ is a PF. Initially, we start with state formulae (SFs).

53

slide-54
SLIDE 54

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot)

54

slide-55
SLIDE 55

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P

55

slide-56
SLIDE 56

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ

56

slide-57
SLIDE 57

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ t | = A ϕ ⇔ ∀ρ ∈ Paths(t). ρ | = ϕ

57

slide-58
SLIDE 58

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ t | = A ϕ ⇔ ∀ρ ∈ Paths(t). ρ | = ϕ Path Semantics ρ | = P ⇔ ρ0 | = P

58

slide-59
SLIDE 59

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ t | = A ϕ ⇔ ∀ρ ∈ Paths(t). ρ | = ϕ Path Semantics ρ | = P ⇔ ρ0 | = P ρ | = ϕ ∧ ψ ⇔ ρ | = ϕ and ρ | = ψ ρ | = ¬ϕ ⇔ ρ | = ϕ

59

slide-60
SLIDE 60

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ t | = A ϕ ⇔ ∀ρ ∈ Paths(t). ρ | = ϕ Path Semantics ρ | = P ⇔ ρ0 | = P ρ | = ϕ ∧ ψ ⇔ ρ | = ϕ and ρ | = ψ ρ | = ¬ϕ ⇔ ρ | = ϕ ρ | = X ϕ ⇔ ρ|1 | = ϕ

60

slide-61
SLIDE 61

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Semantics

State Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = E ϕ ⇔ ∃ρ ∈ Paths(t). ρ | = ϕ t | = A ϕ ⇔ ∀ρ ∈ Paths(t). ρ | = ϕ Path Semantics ρ | = P ⇔ ρ0 | = P ρ | = ϕ ∧ ψ ⇔ ρ | = ϕ and ρ | = ψ ρ | = ¬ϕ ⇔ ρ | = ϕ ρ | = X ϕ ⇔ ρ|1 | = ϕ ρ | = ϕ UNTIL ψ ⇔ There exists an i such that ρ|i | = ψ and for all j < i, ρ|j | = ϕ

61

slide-62
SLIDE 62

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Examples

We say a Kripke structure A satisfies a CTL* property P, that is, A | = P iff Tree(A) | = P Given this automaton A: q0 q1 q2 A | = E G F •?

slide-63
SLIDE 63

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Examples

We say a Kripke structure A satisfies a CTL* property P, that is, A | = P iff Tree(A) | = P Given this automaton A: q0 q1 q2 A | = E G F •? A | = A G F •?

slide-64
SLIDE 64

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Examples

We say a Kripke structure A satisfies a CTL* property P, that is, A | = P iff Tree(A) | = P Given this automaton A: q0 q1 q2 A | = E G F •? A | = A G F •? A | = A F •?

slide-65
SLIDE 65

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

CTL* Examples

We say a Kripke structure A satisfies a CTL* property P, that is, A | = P iff Tree(A) | = P Given this automaton A: q0 q1 q2 A | = E G F •? A | = A G F •? A | = A F •? A | = A E F •?

65

slide-66
SLIDE 66

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simplifying

CTL* is very expressive but very complicated. It’s also extremely hard to model check, which we’ll get to later. CTL* to CTL Keep state formulae the same: All p ∈ P are SFs. Given SFs P and Q, ¬P is a SF and P ∧ Q is a SF. Given a PF ϕ, Eϕ and Aϕ are SFs. But we force path formulae to go straight back to state formulae immediately with a temporal operator: Given a SF P then XP is a PF. Given SFs P and Q, P UNTIL Q is a PF.

66

slide-67
SLIDE 67

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Examples

Which of the following CTL* formulae are CTL formulae? a UNTIL (b UNTIL c) A (a UNTIL c) X X a X A a A (a UNTIL (b UNTIL c)) A E (a UNTIL b) E X a X E a

67

slide-68
SLIDE 68

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Non-mutual CTL Syntax

Simpler CTL Syntax A CTL formula is defined as follows: All p ∈ P are formulae. Given formulae P and Q, ¬P is a formula and P ∧ Q is a formula. Given a formula P, EX P and AX P are formulae. Given formulae P and Q, E(P UNTIL Q) and A(P UNTIL Q) are formulae.

68

slide-69
SLIDE 69

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot)

69

slide-70
SLIDE 70

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P

70

slide-71
SLIDE 71

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = EX P ⇔ ∃ρ ∈ Paths(t). ρ1 | = P

71

slide-72
SLIDE 72

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = EX P ⇔ ∃ρ ∈ Paths(t). ρ1 | = P t | = AX P ⇔ ∀ρ ∈ Paths(t). ρ1 | = P

72

slide-73
SLIDE 73

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = EX P ⇔ ∃ρ ∈ Paths(t). ρ1 | = P t | = AX P ⇔ ∀ρ ∈ Paths(t). ρ1 | = P t | = A(P UNTIL Q) ⇔ ∀ρ ∈ Paths(t), there ∃ an i such that: ρi | = Q and ∀j < i. ρj | = P

73

slide-74
SLIDE 74

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Simpler CTL Semantics

Semantics are as with CTL*, but can be defined more directly: Semantics t | = p ⇔ p ∈ L(troot) t | = P ∧ Q ⇔ t | = P and t | = Q t | = ¬P ⇔ t | = P t | = EX P ⇔ ∃ρ ∈ Paths(t). ρ1 | = P t | = AX P ⇔ ∀ρ ∈ Paths(t). ρ1 | = P t | = A(P UNTIL Q) ⇔ ∀ρ ∈ Paths(t), there ∃ an i such that: ρi | = Q and ∀j < i. ρj | = P t | = E(P UNTIL Q) ⇔ ∃ρ ∈ Paths(t) and an i such that: ρi | = Q and ∀j < i. ρj | = P

74

slide-75
SLIDE 75

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define EF•:

75

slide-76
SLIDE 76

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define EF•: E(True UNTIL •)

76

slide-77
SLIDE 77

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define EG•:

77

slide-78
SLIDE 78

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define EG•: ¬A(True UNTIL ¬•)

78

slide-79
SLIDE 79

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define AF•:

79

slide-80
SLIDE 80

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define AF•: A(True UNTIL •)

80

slide-81
SLIDE 81

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define AG•:

81

slide-82
SLIDE 82

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Derived Operators

Define AG•: ¬EF ¬•

82

slide-83
SLIDE 83

Reachability and Safety Trace Semantics and LTL Tree Semantics and CTL* CTL

Bibliography

Huth/Ryan: Logic in Computer Science, Section 3.2 and 3.4 Bayer/Katoen: Principles of Model Checking Sections 5.1 and 6.2

83