Advanced Logic Linear Temporal Logic Computation Tree Logic - PowerPoint PPT Presentation

LTL: Models M , s | = φ if φ is satisfied on every path starting at s . M | = φ if φ is satisfied on every path starting from the initial state. release s 1 s 2 s 3 pull breaks extended extended, malfunction Which of the states satisfies the following? M , s 1 , s 3 | = X extended M , s 3 | = F G extended M , s 2 , s 3 | = X X extended M , s 1 , s 2 , s 3 �| = ¬ F G extended M , s 1 , s 2 , s 3 | = F extended ? | = G ( ¬ extended → X extended) M , s 3 | = G extended ? | = G (extended → X ¬ extended) M , s 1 , s 2 , s 3 | = G F extended

LTL: Models M , s | = φ if φ is satisfied on every path starting at s . M | = φ if φ is satisfied on every path starting from the initial state. release s 1 s 2 s 3 pull breaks extended extended, malfunction Which of the states satisfies the following? M , s 1 , s 3 | = X extended M , s 3 | = F G extended M , s 2 , s 3 | = X X extended M , s 1 , s 2 , s 3 �| = ¬ F G extended M , s 1 , s 2 , s 3 | = F extended M | = G ( ¬ extended → X extended) M , s 3 | = G extended M , s 1 , s 2 , s 3 �| = G (extended → X ¬ extended) M , s 1 , s 2 , s 3 | = G F extended Note that: M �| = F G extended and M �| = ¬ F G extended !

LTL: Equivalence of Formulas LTL formulas φ and ψ are semantically equivalent, denoted by φ ≡ ψ , if they are true for the same paths

LTL: Equivalence of Formulas LTL formulas φ and ψ are semantically equivalent, denoted by φ ≡ ψ , if they are true for the same paths Which of the following are semantically equivalent? X ( φ ∨ ψ ) ≡ X φ ∨ X ψ F F φ ≡ F φ X ( φ ∧ ψ ) ≡ X φ ∧ X ψ G G φ ≡ G φ F ( φ ∧ ψ ) ≡ F φ ∧ F ψ F G φ ≡ G F φ F ( φ ∨ ψ ) ≡ F φ ∨ F ψ ¬ F φ ≡ G ¬ φ G ( φ ∧ ψ ) ≡ G φ ∧ F ψ ¬ G φ ≡ F ¬ φ G ( φ ∨ ψ ) ≡ G φ ∨ F ψ F φ ≡ φ ∨ X (F φ ) ρ U ( φ ∨ ψ ) ≡ ( ρ U φ ) ∨ ( ρ U ψ ) G φ ≡ φ ∧ X (G φ ) ρ U ( φ ∧ ψ ) ≡ ( ρ U φ ) ∧ ( ρ U ψ ) φ U ψ ≡ φ U ( φ U ψ )

Mutual Exclusion ◮ multiple processes ◮ a shared resource that can only be used by one process at a time shared resource process Q process P

Mutual Exclusion ◮ multiple processes ◮ a shared resource that can only be used by one process at a time shared resource process Q process P Q P non critical non critical . . . . . . C Q critical section C P critical section . . . . . . non critical non critical To solve conflicts: processes agree on a negotiation protocol. ◮ mutual exclusion: never more than one process in the critical section

Mutual Exclusion ◮ multiple processes ◮ a shared resource that can only be used by one process at a time shared resource process Q process P Q P non critical non critical . . . . . . C Q critical section C P critical section . . . . . . non critical non critical To solve conflicts: processes agree on a negotiation protocol. ◮ mutual exclusion: never more than one process in the critical section G ¬ ( C Q ∧ C P )

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p1, C Q ,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p1, C Q ,0 p1,q4,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p2,q2,1 p1, C Q ,0 p1,q4,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p2,q2,1 p1, C Q ,0 p2, C Q ,0 p1,q4,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p2,q2,1 p1, C Q ,0 p2, C Q ,0 C P , C Q ,0 p1,q4,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p2,q2,1 C P ,q2,0 p1, C Q ,0 p2, C Q ,0 C P , C Q ,0 p1,q4,0

Mutual Exclusion: Attempt 1 ◮ boolean variable free = 1 Q P loop forever loop forever p1: wait for free = 1 q1: wait for free = 1 p2: free = 0 q2: free = 0 C P : critical section C Q : critical section p4: free = 1 q4: free = 1 For such a program we compute the state space: p1,q1,1 p2,q1,1 C P ,q1,0 p4,q1,0 p1,q2,1 p2,q2,1 C P ,q2,0 p4,q2,0 p1, C Q ,0 p2, C Q ,0 C P , C Q ,0 p4, C Q ,0 p1,q4,0 p2,q4,0 C P ,q4,0 p4,q4,0

Model Checking Formalize the system design 1 Formalize the validation requirements 2 Validate: system meets requirements 3 Req 1 Req 2 System � Reqs System design . . . Promela or Embedded C Req n SPIN engine LTL Verification process

Mutual Exclusion: Peterson ◮ boolean variables x = 0, y = 0, t = 0 Q P loop forever loop forever p1: x = 1 q1: y = 1 p2: turn = 1 q2: turn = 0 p3: wait for y = 0 or t = 0 q3: wait for x = 0 or t = 1 C P : critical section C Q : critical section p4: x = 0 q4: y = 0

LTL: Applications Safety properties ◮ “nothing bad ever happens” G ¬ (reactor temperature > 1000) ◮ invariant: “ a is always false” Liveness properties ◮ “something good will eventually happen” G (ordered → F delivered) ◮ termination: “the system will eventually terminate” ◮ response: “if action a occurs then b eventually will occur” Deadlock freeness ◮ deadlock state: “a state where no actions are possible” ◮ no deadlocks: there is always some next state G ( ¬ terminated → X ⊤ )

Industrial Case Studies I Figure: After Flood Disaster (1953), Maeslant Barrier (Maeslantkering)

Industrial Case Studies: Flood Control Verification of the interface between BOS and BESW: ◮ Beslis- en Ondersteunend Systeem (BOS) ◮ BEsturingsSysteem Waterweg (BESW) ◮ BOS takes the decision to move the barrier ◮ BESW performs this task Even deadlocks were found in BESW!

Industrial Case Studies II Figure: NASA Mission Critical Software: Cassini, Mars Rovers, Deep Impact

Industrial Case Studies III

State Space Explosion

State Space Explosion ◮ Assume A 1 , A 2 , . . . are a processes each having 10 states

State Space Explosion ◮ Assume A 1 , A 2 , . . . are a processes each having 10 states ◮ Then A 1 and A 2 together have 100 states.

State Space Explosion ◮ Assume A 1 , A 2 , . . . are a processes each having 10 states ◮ Then A 1 and A 2 together have 100 states. ◮ Then A 1 , . . . , A n together have 10 n states.

State Space Explosion ◮ Assume A 1 , A 2 , . . . are a processes each having 10 states ◮ Then A 1 and A 2 together have 100 states. ◮ Then A 1 , . . . , A n together have 10 n states. This is the state space explosion problem.

Computation Tree Logic (CTL) Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1

Computation Tree Logic (CTL) Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2 iff there is a path s = s 1 → s 2 → . . . , such that for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2 iff there is a path s = s 1 → s 2 → . . . , such that for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ M , s | = EG φ ( φ holds globally on some path starting from s ) 3

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2 iff there is a path s = s 1 → s 2 → . . . , such that for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ M , s | = EG φ ( φ holds globally on some path starting from s ) 3 iff there is a path s = s 1 → s 2 → . . . such that for all i ≥ 1, M , s i | = φ

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2 iff there is a path s = s 1 → s 2 → . . . , such that for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ M , s | = EG φ ( φ holds globally on some path starting from s ) 3 iff there is a path s = s 1 → s 2 → . . . such that for all i ≥ 1, M , s i | = φ M , s | = EX φ ( φ holds in some next state) 4

Computation Tree Logic (CTL) exists globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ where p ∈ Ω exists until exists next The formula φ holds model M at state s , M , s | = φ , is defined by: as usual: M , s | = ⊤ , M , s | = p , M , s | = ¬ φ , M , s | = φ 1 ∧ φ 2 1 M , s | = φ EU ψ ( φ until ψ holds on some path starting from s ) 2 iff there is a path s = s 1 → s 2 → . . . , such that for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ M , s | = EG φ ( φ holds globally on some path starting from s ) 3 iff there is a path s = s 1 → s 2 → . . . such that for all i ≥ 1, M , s i | = φ M , s | = EX φ ( φ holds in some next state) 4 iff ( M , s 2 ) | = φ for some s 2 such that s → s 2

CTL: Extensions Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω

CTL: Extensions Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ AG φ = ¬ EF ¬ φ

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ AG φ = ¬ EF ¬ φ M , s | = AX φ ( φ holds in all next states) 2

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ AG φ = ¬ EF ¬ φ M , s | = AX φ ( φ holds in all next states) 2 iff ( M , s 2 ) | = φ for all s 2 such that s → s 2

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ AG φ = ¬ EF ¬ φ M , s | = AX φ ( φ holds in all next states) 2 iff ( M , s 2 ) | = φ for all s 2 such that s → s 2 AX φ = ¬ EX ¬ φ

CTL: Extensions always globally Computation Tree Logic (CTL) is defined by: φ ::= p | ⊤ | ¬ φ | φ ∧ φ | φ EU φ | EG φ | EX φ | φ AU φ | AG φ | AX φ where p ∈ Ω always until always next M , s | = AG φ ( φ holds globally on all paths starting from s ) 1 iff for all paths s = s 1 → s 2 → . . . we have: for all i ≥ 1, M , s i | = φ AG φ = ¬ EF ¬ φ M , s | = AX φ ( φ holds in all next states) 2 iff ( M , s 2 ) | = φ for all s 2 such that s → s 2 AX φ = ¬ EX ¬ φ M , s | = φ AU ψ ( φ until ψ holds on all paths starting from s ) 3 iff for all paths s = s 1 → s 2 → . . . we have: for some i ≥ 1, M , s i | = ψ and for all j < i , M , s j | = φ

CTL: Examples s 1 r Which of the states satisfies the following? s 2 s 3 ? | = AG (EF p ) q p ? | = AG (( q ∨ r ) AU p ) ? | = AG (EF ( q ∧ r )) s 4 q , r s 5 p

Advanced Logic Linear Temporal Logic Computation Tree Logic - PowerPoint PPT Presentation

Advanced Logic Linear Temporal Logic Computation Tree Logic Daniel Gebler VU University Amsterdam March 11, 2013 Overview Linear temporal logic (LTL): describes properties of paths (individual executions) no modalities to

Formal Verifjcation Lecture 5: Computation Tree Logic (CTL) Jacques Fleuriot 1 jdf@inf.ac.uk

Introduction to Temporal Logic Sanjit A. Seshia EECS, UC Berkeley Plan for Todays Lecture

Tree-shaped one-pass tableau systems for Linear Temporal Logic satisfiability checking Nicola

Temporal Logic of Actions Advanced Topics in Distributed Computing Dominik Grewe Saarland

Formal Verifjcation Lecture 2: Linear Temporal Logic Jacques Fleuriot jdf@inf.ed.ac.uk Recap

Hoare Logic and Model Checking Model Checking Lecture 10: Computation Tree Logic (CTL) Dominic

Overview overview7.5 Introduction Modelling parallel systems Linear Time Properties Regular

Overview overview7.4 Introduction Modelling parallel systems Linear Time Properties Regular

Programming in Linear Temporal Logic Correspondence Categorical Semantics for Restricted LTL

Linear Temporal Logic, Critical Sections and Promela Modelling Dr. Liam OConnor University of

Linear Temporal Logic, Critical Sections and Promela Modelling Dr. Liam OConnor University of

Hoare Logic and Model Checking Model Checking Lecture 11: Model checking for Computation Tree

Temporal and Modal Logic Based on paper: E.A. Emerson. Temporal and Modal Logic J. van Leeuwen,

Overview Word Systems Regular expressiveness Linear temporal logic B uchi-automata

Informatics 1 connections between Computation and Logic computation and logic. We Sets of

INF5140 Specification and Verification of Parallel Systems Spring 2018 Institutt for

L ECTURE IV: C OMPUTATION T REE L OGIC (CTL) Alessandro Artale Faculty of Computer Science

Nanoclusters Nanoparticle vs. Nanocluster 2-3 nm Nanoclusters Nanoparticles No surface plasmon

Developments in Particle Therapy using Nuclear Science and Technology Helsinki, NUSPRASEN

OWCM: One-Way Counter Mode Danilo Gligoroski and Hristina Mihajloska and Hkon Jacobsen

CTL vs. LTL Robert Bellarmine Krug Department of Computer Sciences University of Texas at Austin

Computation Tree Logic B. Srivathsan Chennai Mathematical Institute Model Checking and Systems

Model Checking and Predicate Abstrac5on CSE 501 Spring

Temporal Logic and Model Checking Model mathematical structure extracted from hardware or