Model Checking Lecture #14: Fairness [Baier & Katoen, Chapter - PowerPoint PPT Presentation

Fairness and Safety Properties Overview The Relevance of Fairness 1 Fairness Assumptions 2 Fairness and Safety Properties 3 LTL Model Checking Under Fairness 4 CTL Fairness Assumptions 5 CTL Model Checking Under Fairness 6 Summary 7 Joost-Pieter Katoen Lecture#14 18/62

Fairness and Safety Properties Realisable Fairness Definition: realisable fairness Fairness assumption fair is realisable for transition system TS if for any reachable state s : FairPaths fair ( s ) ≠ ∅ . A fairness assumption is realisable for TS if every initial finite path fragment of TS can be completed to a fair run. Joost-Pieter Katoen Lecture#14 19/62

Fairness and Safety Properties The Fairness Suffix Property For any (infinite) fair path π , it holds 1. all suffixes of π are fair too. 2. any finite path extended by π is fair. Proof. Rather straightforward. Joost-Pieter Katoen Lecture#14 20/62

Fairness and Safety Properties Realisable Fairness and Safety Safety properties are preserved under realisable fairness For transition system TS and safety property E safe (both over AP ) and fair a realisable fairness assumption for TS : TS ⊧ E safe if and only if TS ⊧ fair E safe . Proof. Joost-Pieter Katoen Lecture#14 21/62

Fairness and Safety Properties Realisable Fairness and Safety Safety properties are preserved under realisable fairness For transition system TS and safety property E safe (both over AP ) and fair a realisable fairness assumption for TS : TS ⊧ E safe if and only if TS ⊧ fair E safe . Proof. Non-realisable fairness may harm safety properties. Shown by example. Joost-Pieter Katoen Lecture#14 21/62

LTL Model Checking Under Fairness Overview The Relevance of Fairness 1 Fairness Assumptions 2 Fairness and Safety Properties 3 LTL Model Checking Under Fairness 4 CTL Fairness Assumptions 5 CTL Model Checking Under Fairness 6 Summary 7 Joost-Pieter Katoen Lecture#14 22/62

LTL Model Checking Under Fairness The Fair LTL Model-Checking Problem Given: 1. a finite transition system TS 2. an LTL formula ϕ , and 3. an LTL fairness assumption fair Question: does TS ⊧ fair ϕ ? Joost-Pieter Katoen Lecture#14 23/62

LTL Model Checking Under Fairness Fair LTL Model Checking For transition system TS , LTL formula ϕ and LTL fairness assumption fair : TS ⊧ ( fair → ϕ ) if and only if TS ⊧ fair ϕ ��������������������������������������������������������������� ����������������������������������������������������������������������������������������������������������� fair LTL model checking LTL model checking Joost-Pieter Katoen Lecture#14 24/62

LTL Model Checking Under Fairness Fair LTL Model Checking For transition system TS , LTL formula ϕ and LTL fairness assumption fair : TS ⊧ ( fair → ϕ ) if and only if TS ⊧ fair ϕ ��������������������������������������������������������������� ����������������������������������������������������������������������������������������������������������� fair LTL model checking LTL model checking The fair LTL model-checking problem for ϕ under fairness assumption fair can be reduced to the LTL model-checking problem for fair → ϕ . Joost-Pieter Katoen Lecture#14 24/62

LTL Model Checking Under Fairness Fair LTL Model Checking For transition system TS , LTL formula ϕ and LTL fairness assumption fair : TS ⊧ ( fair → ϕ ) if and only if TS ⊧ fair ϕ ��������������������������������������������������������������� ����������������������������������������������������������������������������������������������������������� fair LTL model checking LTL model checking The fair LTL model-checking problem for ϕ under fairness assumption fair can be reduced to the LTL model-checking problem for fair → ϕ . This approach is not applicable to CTL (as we will discuss) Joost-Pieter Katoen Lecture#14 24/62

LTL Model Checking Under Fairness Which Fairness Notion? ▶ Fairness constraints aim to rule out “unreasonable” runs Joost-Pieter Katoen Lecture#14 25/62

LTL Model Checking Under Fairness Which Fairness Notion? ▶ Fairness constraints aim to rule out “unreasonable” runs ▶ Too strong? reasonable runs ruled out. Verification result: ⇒ ▶ “false”: error found ▶ “true”: don’t know as some relevant execution may refute it Joost-Pieter Katoen Lecture#14 25/62

LTL Model Checking Under Fairness Which Fairness Notion? ▶ Fairness constraints aim to rule out “unreasonable” runs ▶ Too strong? reasonable runs ruled out. Verification result: ⇒ ▶ “false”: error found ▶ “true”: don’t know as some relevant execution may refute it ▶ Too weak? ⇒ too many runs considered. Verification result: ▶ “true”: formula holds ▶ “false”: don’t know, as refutation maybe due to an unreasonable run Joost-Pieter Katoen Lecture#14 25/62

LTL Model Checking Under Fairness Which Fairness Notion? ▶ Fairness constraints aim to rule out “unreasonable” runs ▶ Too strong? reasonable runs ruled out. Verification result: ⇒ ▶ “false”: error found ▶ “true”: don’t know as some relevant execution may refute it ▶ Too weak? ⇒ too many runs considered. Verification result: ▶ “true”: formula holds ▶ “false”: don’t know, as refutation maybe due to an unreasonable run Rules of thumb: ▶ strong (or unconditional) fairness is useful for solving contentions ▶ weak fairness is useful to resolve unfair scheduling of threads Joost-Pieter Katoen Lecture#14 25/62

CTL Fairness Assumptions Overview The Relevance of Fairness 1 Fairness Assumptions 2 Fairness and Safety Properties 3 LTL Model Checking Under Fairness 4 CTL Fairness Assumptions 5 CTL Model Checking Under Fairness 6 Summary 7 Joost-Pieter Katoen Lecture#14 26/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if ▶ An analogous approach for CTL is not possible Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if ▶ An analogous approach for CTL is not possible ▶ Formulas form ∀ ( fair → ϕ ) and ∃ ( fair ∧ ϕ ) needed Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if ▶ An analogous approach for CTL is not possible ▶ Formulas form ∀ ( fair → ϕ ) and ∃ ( fair ∧ ϕ ) needed ▶ But: boolean combinations of path formulae are not allowed in CTL Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if ▶ An analogous approach for CTL is not possible ▶ Formulas form ∀ ( fair → ϕ ) and ∃ ( fair ∧ ϕ ) needed ▶ But: boolean combinations of path formulae are not allowed in CTL ▶ and: strong fairness constraint □ ◇ b → □ ◇ c , i.e., ◇ □ ¬ b ∨ ◇ □ c cannot be expressed in CTL as persistence properties are not in CTL Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions Fairness Constraints in CTL ▶ For LTL it holds: TS ⊧ fair ϕ TS ⊧ ( fair → ϕ ) if and only if ▶ An analogous approach for CTL is not possible ▶ Formulas form ∀ ( fair → ϕ ) and ∃ ( fair ∧ ϕ ) needed ▶ But: boolean combinations of path formulae are not allowed in CTL ▶ and: strong fairness constraint □ ◇ b → □ ◇ c , i.e., ◇ □ ¬ b ∨ ◇ □ c cannot be expressed in CTL as persistence properties are not in CTL ▶ Solution: change the semantics of CTL by ignoring unfair paths Joost-Pieter Katoen Lecture#14 27/62

CTL Fairness Assumptions CTL Fairness Constraints Definition: CTL fairness constraints A strong CTL fairness constraint is a formula of the form: ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTL state-formulas over AP . Joost-Pieter Katoen Lecture#14 28/62

CTL Fairness Assumptions CTL Fairness Constraints Definition: CTL fairness constraints A strong CTL fairness constraint is a formula of the form: ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTL state-formulas over AP . Weak and unconditional CTL fairness constraints are defined similarly, e.g.: ⋀ ⋀ □ ◇ Ψ i ( ◇ □ Φ i → □ ◇ Ψ i ) . and ufair = wfair = 0 < i ≤ k 0 < i ≤ k Joost-Pieter Katoen Lecture#14 28/62

CTL Fairness Assumptions CTL Fairness Constraints Definition: CTL fairness constraints A strong CTL fairness constraint is a formula of the form: ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTL state-formulas over AP . Weak and unconditional CTL fairness constraints are defined similarly, e.g.: ⋀ ⋀ □ ◇ Ψ i ( ◇ □ Φ i → □ ◇ Ψ i ) . and ufair = wfair = 0 < i ≤ k 0 < i ≤ k Definition: CTL fairness assumption A CTL fairness assumption is a conjunction of ufair , sfair and wfair . Joost-Pieter Katoen Lecture#14 28/62

CTL Fairness Assumptions CTL Fairness Constraints Definition: CTL fairness constraints A strong CTL fairness constraint is a formula of the form: ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTL state-formulas over AP . Weak and unconditional CTL fairness constraints are defined similarly, e.g.: ⋀ ⋀ □ ◇ Ψ i ( ◇ □ Φ i → □ ◇ Ψ i ) . and ufair = wfair = 0 < i ≤ k 0 < i ≤ k Definition: CTL fairness assumption A CTL fairness assumption is a conjunction of ufair , sfair and wfair . A CTL fairness constraint is an LTL formula over CTL state formulas. Φ i and Ψ i are interpreted by the standard (unfair) CTL semantics Joost-Pieter Katoen Lecture#14 28/62

CTL Fairness Assumptions Semantics of Fair CTL For CTL fairness assumption fair , relation ⊧ fair is defined by: iff a ∈ L ( s ) s ⊧ fair a ¬ ( s ⊧ fair Φ ) s ⊧ fair ¬ Φ iff iff ( s ⊧ fair Φ ) ∨ ( s ⊧ fair Ψ ) s ⊧ fair Φ ∨ Ψ s ⊧ fair ∃ ϕ iff π ⊧ fair ϕ for some fair path π that starts in s iff π ⊧ fair ϕ for all fair paths π that start in s s ⊧ fair ∀ ϕ iff π [ 1 ] ⊧ fair Φ π ⊧ fair ◯ Φ iff ( ∃ j ≥ 0 . π [ j ] ⊧ fair Ψ and ( ∀ 0 ≤ i < j . π [ i ] ⊧ fair Φ )) π ⊧ fair Φ U Ψ π is a fair path iff π ⊧ LTL fair for CTL fairness assumption fair Joost-Pieter Katoen Lecture#14 29/62

CTL Fairness Assumptions Transition System Semantics ▶ For CTL-state-formula Φ, and fairness assumption fair , the satisfaction set Sat fair ( Φ ) is defined by: Sat fair ( Φ ) = { s ∈ S ∣ s ⊧ fair Φ } ▶ TS satisfies CTL-formula Φ iff Φ holds in all its initial states: TS ⊧ fair Φ if and only if ∀ s 0 ∈ I . s 0 ⊧ fair Φ ▶ This is equivalent to I ⊆ Sat fair ( Φ ) Joost-Pieter Katoen Lecture#14 30/62

CTL Fairness Assumptions Example: An Arbiter for Mutual Exclusion ⊧ ( ∀ □ ∀◇ crit 1 ) ∧ ( ∀ □ ∀◇ crit 2 ) TS 1 ∥ Arbiter ∥ TS 2 / But: TS 1 ∥ Arbiter ∥ TS 2 ⊧ fair ∀ □ ∀◇ crit 1 ∧ ∀ □ ∀◇ crit 2 with fair = □ ◇ head ∧ □ ◇ tail Joost-Pieter Katoen Lecture#14 31/62

CTL Fairness Assumptions Example Joost-Pieter Katoen Lecture#14 32/62

CTL Fairness Assumptions Example Joost-Pieter Katoen Lecture#14 33/62

CTL Model Checking Under Fairness Overview The Relevance of Fairness 1 Fairness Assumptions 2 Fairness and Safety Properties 3 LTL Model Checking Under Fairness 4 CTL Fairness Assumptions 5 CTL Model Checking Under Fairness 6 Summary 7 Joost-Pieter Katoen Lecture#14 34/62

CTL Model Checking Under Fairness The Fair CTL Model-Checking Problem Given: 1. a finite transition system TS 2. an CTL state-formula 1 Φ, and 3. a CTL fairness assumption fair Question: does TS ⊧ fair Φ? 1 Assumed to be in existential normal form. Joost-Pieter Katoen Lecture#14 35/62

CTL Model Checking Under Fairness The Fair CTL Model-Checking Problem Given: 1. a finite transition system TS 2. an CTL state-formula 1 Φ, and 3. a CTL fairness assumption fair Question: does TS ⊧ fair Φ? use recursive descent à la CTL to determine Sat fair ( Φ ) using as much as possible standard CTL model-checking algorithms 1 Assumed to be in existential normal form. Joost-Pieter Katoen Lecture#14 35/62

CTL Model Checking Under Fairness Treating Strong CTL Fairness Constraints ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) ▶ Let strong CTL fairness constraint: sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTLstate-formulas over AP Joost-Pieter Katoen Lecture#14 36/62

CTL Model Checking Under Fairness Treating Strong CTL Fairness Constraints ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) ▶ Let strong CTL fairness constraint: sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTLstate-formulas over AP ▶ Replace the CTL state-formulas in sfair by fresh atomic propositions: ⋀ ( □ ◇ a i → □ ◇ b i ) sfair ∶ = 0 < i ≤ k ▶ where a i ∈ L ( s ) if and only if s ∈ Sat ( Φ i ) (not Sat fair ( Φ i ) ) ▶ . . . b i ∈ L ( s ) if and only if s ∈ Sat ( Ψ i ) (not Sat fair ( Ψ i ) ) Joost-Pieter Katoen Lecture#14 36/62

CTL Model Checking Under Fairness Treating Strong CTL Fairness Constraints ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) ▶ Let strong CTL fairness constraint: sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTLstate-formulas over AP ▶ Replace the CTL state-formulas in sfair by fresh atomic propositions: ⋀ ( □ ◇ a i → □ ◇ b i ) sfair ∶ = 0 < i ≤ k ▶ where a i ∈ L ( s ) if and only if s ∈ Sat ( Φ i ) (not Sat fair ( Φ i ) ) ▶ . . . b i ∈ L ( s ) if and only if s ∈ Sat ( Ψ i ) (not Sat fair ( Ψ i ) ) ▶ For unconditional and weak fairness this goes similarly Joost-Pieter Katoen Lecture#14 36/62

CTL Model Checking Under Fairness Treating Strong CTL Fairness Constraints ⋀ ( □ ◇ Φ i → □ ◇ Ψ i ) ▶ Let strong CTL fairness constraint: sfair = 0 < i ≤ k where Φ i and Ψ i (for 0 < i ≤ k ) are CTLstate-formulas over AP ▶ Replace the CTL state-formulas in sfair by fresh atomic propositions: ⋀ ( □ ◇ a i → □ ◇ b i ) sfair ∶ = 0 < i ≤ k ▶ where a i ∈ L ( s ) if and only if s ∈ Sat ( Φ i ) (not Sat fair ( Φ i ) ) ▶ . . . b i ∈ L ( s ) if and only if s ∈ Sat ( Ψ i ) (not Sat fair ( Ψ i ) ) ▶ For unconditional and weak fairness this goes similarly ▶ Note: π ⊧ fair iff π [ j .. ] ⊧ fair for some j ≥ 0 iff π [ j .. ] ⊧ fair for all j ≥ 0 Joost-Pieter Katoen Lecture#14 36/62

CTL Model Checking Under Fairness Some Useful Results For CTL fairness assumption fair and a , a ′ ∈ AP it holds: 1. s ⊧ fair ∃◯ a iff ∃ s ′ ∈ Post ( s ) with s ′ ⊧ a and FairPaths fair ( s ′ ) / = ∅ 2. s ⊧ fair ∃ ( a U a ′ ) if and only if there exists a finite path fragment s 0 s 1 s 2 . . . s n − 1 s n ∈ Paths ∗ ( s ) with n ≥ 0 such that s i ⊧ a for 0 ≤ i < n , s n ⊧ a ′ , and FairPaths fair ( s n ) / = ∅ . Proof. On the black board. Joost-Pieter Katoen Lecture#14 37/62

CTL Model Checking Under Fairness Example Joost-Pieter Katoen Lecture#14 38/62

CTL Model Checking Under Fairness Fair Path Existence s ⊧ fair ∃ □ true . FairPaths fair ( s ) / if and only if = ∅ Joost-Pieter Katoen Lecture#14 39/62

CTL Model Checking Under Fairness Fair Path Existence s ⊧ fair ∃ □ true . FairPaths fair ( s ) / if and only if = ∅ Example Joost-Pieter Katoen Lecture#14 39/62

CTL Model Checking Under Fairness Basic Model-Checking Algorithm for Fair CTL ▶ Determine Sat fair ( ∃ □ true ) = { s ∈ S ∣ FairPaths fair ( s ) / = ∅ } Joost-Pieter Katoen Lecture#14 40/62

CTL Model Checking Under Fairness Basic Model-Checking Algorithm for Fair CTL ▶ Determine Sat fair ( ∃ □ true ) = { s ∈ S ∣ FairPaths fair ( s ) / = ∅ } ▶ Introduce an atomic proposition a fair and adjust labeling where: s ∈ Sat fair ( ∃ □ true ) ▶ a fair ∈ L ( s ) if and only if Joost-Pieter Katoen Lecture#14 40/62

CTL Model Checking Under Fairness Basic Model-Checking Algorithm for Fair CTL ▶ Determine Sat fair ( ∃ □ true ) = { s ∈ S ∣ FairPaths fair ( s ) / = ∅ } ▶ Introduce an atomic proposition a fair and adjust labeling where: s ∈ Sat fair ( ∃ □ true ) ▶ a fair ∈ L ( s ) if and only if ▶ Compute the sets Sat fair ( Ψ ) for all sub-formulas Ψ of Φ (in ENF) by: Sat fair ( a ) { s ∈ S ∣ a ∈ L ( s ) } = Sat fair ( ¬ a ) S \ Sat fair ( a ) = Sat fair ( a ∧ a ′ ) Sat fair ( a ) ∩ Sat fair ( a ′ ) = Sat fair ( ∃◯ a ) Sat ( ∃◯ ( a ∧ a fair )) = Sat ( ∃ ( a U ( a ′ ∧ a fair ))) Sat fair ( ∃ ( a U a ′ )) = Sat fair ( ∃ □ a ) = . . . . . . Joost-Pieter Katoen Lecture#14 40/62

CTL Model Checking Under Fairness Basic Model-Checking Algorithm for Fair CTL ▶ Determine Sat fair ( ∃ □ true ) = { s ∈ S ∣ FairPaths fair ( s ) / = ∅ } ▶ Introduce an atomic proposition a fair and adjust labeling where: s ∈ Sat fair ( ∃ □ true ) ▶ a fair ∈ L ( s ) if and only if ▶ Compute the sets Sat fair ( Ψ ) for all sub-formulas Ψ of Φ (in ENF) by: Sat fair ( a ) { s ∈ S ∣ a ∈ L ( s ) } = Sat fair ( ¬ a ) S \ Sat fair ( a ) = Sat fair ( a ∧ a ′ ) Sat fair ( a ) ∩ Sat fair ( a ′ ) = Sat fair ( ∃◯ a ) Sat ( ∃◯ ( a ∧ a fair )) = Sat ( ∃ ( a U ( a ′ ∧ a fair ))) Sat fair ( ∃ ( a U a ′ )) = Sat fair ( ∃ □ a ) = . . . . . . ▶ Thus: model checking CTL under fairness constraints is ▶ CTL model checking + algorithm for computing Sat fair ( ∃ □ a ) Joost-Pieter Katoen Lecture#14 40/62

CTL Model Checking Under Fairness Model Checking CTL with Fairness Model checking CTL with fairness can be done by combining ▶ the model-checking algorithm for CTL (without fairness), and ▶ an algorithm for computing Sat fair ( ∃ □ a ) for a ∈ AP . Joost-Pieter Katoen Lecture#14 41/62

CTL Model Checking Under Fairness Model Checking CTL with Fairness Model checking CTL with fairness can be done by combining ▶ the model-checking algorithm for CTL (without fairness), and ▶ an algorithm for computing Sat fair ( ∃ □ a ) for a ∈ AP . As ∃ □ true is a special case of ∃ □ a , an algorithm for Sat fair ( ∃ □ a ) can be used for Sat fair ( ∃ □ true ) Joost-Pieter Katoen Lecture#14 41/62

CTL Model Checking Under Fairness Basic Fair CTL Algorithm Joost-Pieter Katoen Lecture#14 42/62

CTL Model Checking Under Fairness Characterising Sat fair ( ∃□ a ) sfair = ⋀ s ⊧ sfair ∃ □ a ( □ ◇ a i → □ ◇ b i ) where 0 < i ≤ k iff there exists a finite path fragment s 0 . . . s n and a cycle s ′ 0 . . . s ′ r with: s n = s ′ 0 = s ′ 1. s 0 = s and r 2. s i ⊧ a , for any 0 ≤ i ≤ n , and s ′ j ⊧ a , for any 0 ≤ j ≤ r , and 3. Sat ( a i ) ∩ { s ′ 1 , . . . , s ′ r } = ∅ or Sat ( b i ) ∩ { s ′ 1 , . . . , s ′ r } / = ∅ for 0 < i ≤ k Proof. Next slide. Joost-Pieter Katoen Lecture#14 43/62

CTL Model Checking Under Fairness Proof Joost-Pieter Katoen Lecture#14 44/62

CTL Model Checking Under Fairness Computing Sat fair ( ∃□ a ) ▶ Consider only state s if s ⊧ a , otherwise eliminate s ▶ consider TS [ a ] = ( S ′ , Act , → ′ , I ′ , AP , L ′ ) with S ′ = Sat ( a ) , ▶ → ′ = → ∩ ( S ′ × Act × S ′ ) , I ′ = I ∩ S ′ , and L ′ ( s ) = L ( s ) for s ∈ S ′ ⇒ each infinite path fragment in TS [ a ] satisfies □ a 2 This is not necessarily an SCC (a maximal strongly-connected set). Joost-Pieter Katoen Lecture#14 45/62

CTL Model Checking Under Fairness Computing Sat fair ( ∃□ a ) ▶ Consider only state s if s ⊧ a , otherwise eliminate s ▶ consider TS [ a ] = ( S ′ , Act , → ′ , I ′ , AP , L ′ ) with S ′ = Sat ( a ) , ▶ → ′ = → ∩ ( S ′ × Act × S ′ ) , I ′ = I ∩ S ′ , and L ′ ( s ) = L ( s ) for s ∈ S ′ ⇒ each infinite path fragment in TS [ a ] satisfies □ a ⋀ ▶ Let fair = ( □ ◇ a i → □ ◇ b i ) 0 < i ≤ k 2 This is not necessarily an SCC (a maximal strongly-connected set). Joost-Pieter Katoen Lecture#14 45/62

CTL Model Checking Under Fairness Computing Sat fair ( ∃□ a ) ▶ Consider only state s if s ⊧ a , otherwise eliminate s ▶ consider TS [ a ] = ( S ′ , Act , → ′ , I ′ , AP , L ′ ) with S ′ = Sat ( a ) , ▶ → ′ = → ∩ ( S ′ × Act × S ′ ) , I ′ = I ∩ S ′ , and L ′ ( s ) = L ( s ) for s ∈ S ′ ⇒ each infinite path fragment in TS [ a ] satisfies □ a ⋀ ▶ Let fair = ( □ ◇ a i → □ ◇ b i ) 0 < i ≤ k ▶ s ⊧ fair ∃ □ a iff s can reach a strongly connected node-set 2 D in TS [ a ] with: D ∩ Sat ( a i ) = ∅ D ∩ Sat ( b i ) / or = ∅ for 0 < i ≤ k (*) ▶ Sat fair ( ∃ □ a ) = { s ∈ S ∣ Reach TS [ a ] ( s ) ∩ T / = ∅ } ▶ T is the union of all SCCs C that contain D satisfying (*) 2 This is not necessarily an SCC (a maximal strongly-connected set). Joost-Pieter Katoen Lecture#14 45/62

CTL Model Checking Under Fairness Example Computing Sat fair ( ∃ □ a ) by analysing the digraph G a of TS [ a ] Joost-Pieter Katoen Lecture#14 46/62

CTL Model Checking Under Fairness Example Joost-Pieter Katoen Lecture#14 47/62

CTL Model Checking Under Fairness ∃□ a under Unconditional Fairness ⋀ □ ◇ b i Let ufair = 0 < i ≤ k Let T be the set union of all non-trivial SCCs C of TS [ a ] satisfying C ∩ Sat ( b i ) / = ∅ for all 0 < i ≤ k Joost-Pieter Katoen Lecture#14 48/62

CTL Model Checking Under Fairness ∃□ a under Unconditional Fairness ⋀ □ ◇ b i Let ufair = 0 < i ≤ k Let T be the set union of all non-trivial SCCs C of TS [ a ] satisfying C ∩ Sat ( b i ) / = ∅ for all 0 < i ≤ k It now follows: s ⊧ ufair ∃ □ a Reach TS [ a ] ( s ) ∩ T / if and only if = ∅ ⇒ T can be determined by a depth-first search procedure Joost-Pieter Katoen Lecture#14 48/62

CTL Model Checking Under Fairness Example Joost-Pieter Katoen Lecture#14 49/62

CTL Model Checking Under Fairness ∃□ a Under One Strong Fairness Constraint ▶ sfair = □ ◇ a 1 → □ ◇ b 1 , i.e., k = 1 Joost-Pieter Katoen Lecture#14 50/62

CTL Model Checking Under Fairness ∃□ a Under One Strong Fairness Constraint ▶ sfair = □ ◇ a 1 → □ ◇ b 1 , i.e., k = 1 ▶ s ⊧ sfair ∃ □ a iff C is a non-trivial SCC in TS [ a ] reachable from s with: 1. C ∩ Sat ( b 1 ) / = ∅ , or 2. D ∩ Sat ( a 1 ) = ∅ , for some non-trivial SCC D in C Joost-Pieter Katoen Lecture#14 50/62

CTL Model Checking Under Fairness ∃□ a Under One Strong Fairness Constraint ▶ sfair = □ ◇ a 1 → □ ◇ b 1 , i.e., k = 1 ▶ s ⊧ sfair ∃ □ a iff C is a non-trivial SCC in TS [ a ] reachable from s with: 1. C ∩ Sat ( b 1 ) / = ∅ , or 2. D ∩ Sat ( a 1 ) = ∅ , for some non-trivial SCC D in C ▶ D is a non-trivial SCC in the graph that is obtained from C [ ¬ a 1 ] Joost-Pieter Katoen Lecture#14 50/62

CTL Model Checking Under Fairness ∃□ a Under One Strong Fairness Constraint ▶ sfair = □ ◇ a 1 → □ ◇ b 1 , i.e., k = 1 ▶ s ⊧ sfair ∃ □ a iff C is a non-trivial SCC in TS [ a ] reachable from s with: 1. C ∩ Sat ( b 1 ) / = ∅ , or 2. D ∩ Sat ( a 1 ) = ∅ , for some non-trivial SCC D in C ▶ D is a non-trivial SCC in the graph that is obtained from C [ ¬ a 1 ] ▶ For T the union of non-trivial SCCs in satisfying (1) and (2): s ⊧ sfair ∃ □ a Reach TS [ a ] ( s ) ∩ T / if and only if = ∅ Joost-Pieter Katoen Lecture#14 50/62

CTL Model Checking Under Fairness ∃□ a Under One Strong Fairness Constraint ▶ sfair = □ ◇ a 1 → □ ◇ b 1 , i.e., k = 1 ▶ s ⊧ sfair ∃ □ a iff C is a non-trivial SCC in TS [ a ] reachable from s with: 1. C ∩ Sat ( b 1 ) / = ∅ , or 2. D ∩ Sat ( a 1 ) = ∅ , for some non-trivial SCC D in C ▶ D is a non-trivial SCC in the graph that is obtained from C [ ¬ a 1 ] ▶ For T the union of non-trivial SCCs in satisfying (1) and (2): s ⊧ sfair ∃ □ a Reach TS [ a ] ( s ) ∩ T / if and only if = ∅ For several strong fairness constraints ( k > 1), this is applied recursively T is determined by standard graph analysis (DFS) Joost-Pieter Katoen Lecture#14 50/62

CTL Model Checking Under Fairness Example: One Strong Fairness Constraint Joost-Pieter Katoen Lecture#14 51/62

CTL Model Checking Under Fairness Example: One Strong Fairness Constraint Joost-Pieter Katoen Lecture#14 52/62

CTL Model Checking Under Fairness Example: One Strong Fairness Constraint Joost-Pieter Katoen Lecture#14 53/62

CTL Model Checking Under Fairness Example: Two Strong Fairness Constraints Joost-Pieter Katoen Lecture#14 54/62

CTL Model Checking Under Fairness Example: Two Strong Fairness Constraints Joost-Pieter Katoen Lecture#14 55/62

CTL Model Checking Under Fairness Algorithm CheckFair is a recursive procedure over the k strong fairness constraints Basically an SCC analysis per fairness constraint. Time complexity: O (∣ TS ∣ ⋅ ∣ fair ∣) . Joost-Pieter Katoen Lecture#14 56/62

CTL Model Checking Under Fairness CheckFair Algorithm (for completeness) Joost-Pieter Katoen Lecture#14 57/62

CTL Model Checking Under Fairness Time complexity The CTL model-checking problem under fairness assumption fair can be solved in O (∣ Φ ∣ ⋅ ∣ TS ∣ ⋅ ∣ fair ∣) . Proof. Follows from the complexity O (∣ Φ ∣ ⋅ ∣ TS ∣) of CTL model checking Joost-Pieter Katoen Lecture#14 58/62

Summary Overview The Relevance of Fairness 1 Fairness Assumptions 2 Fairness and Safety Properties 3 LTL Model Checking Under Fairness 4 CTL Fairness Assumptions 5 CTL Model Checking Under Fairness 6 Summary 7 Joost-Pieter Katoen Lecture#14 59/62

Summary Model Checking Complexity CTL ∗ CTL LTL model PTIME PSPACE PSPACE checking ∣ TS ∣ ⋅ ∣ Φ ∣ ∣ TS ∣ ⋅ exp (∣ ϕ ∣) ∣ TS ∣ ⋅ exp (∣ Φ ∣) algorithmic complexity ∣ TS ∣ ⋅ ∣ Φ ∣ ⋅ ∣ fair ∣ ∣ TS ∣ ⋅ exp (∣ ϕ ∣ + ∣ fair ∣) ∣ TS ∣ ⋅ exp (∣ Φ ∣ + ∣ fair ∣) with fairness All theoretical complexity indications are complete. Joost-Pieter Katoen Lecture#14 60/62