The First-Order Logic of Hyperproperties Joint work with Bernd - - PowerPoint PPT Presentation

The First-Order Logic of Hyperproperties

Joint work with Bernd Finkbeiner (Saarland University)

Martin Zimmermann

Saarland University

March, 3rd 2017

RWTH Aachen University, Aachen, Germany

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 1/19

Hyperproperties

S Isecret Osecret Ipublic Opublic

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties

S Isecret Osecret Ipublic Opublic The system S is input-deterministic: for all traces t, t′ of S t =I t′ implies t =O t′

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties

S Isecret Osecret Ipublic Opublic The system S is input-deterministic: for all traces t, t′ of S t =I t′ implies t =O t′ Noninterference: for all traces t, t′ of S t =Ipublic t′ implies t =Opublic t′

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties

Both properties are not trace properties, but hyperproperties, i.e., sets of sets of traces. A system S satisfies a hyperproperty H, if Traces(S) ∈ H. Many information flow properties can be expressed as hyperproperties.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 3/19

Hyperproperties

Both properties are not trace properties, but hyperproperties, i.e., sets of sets of traces. A system S satisfies a hyperproperty H, if Traces(S) ∈ H. Many information flow properties can be expressed as hyperproperties. Specification languages for hyperproperties [Clarkson et al. ’14] HyperLTL: Extend LTL by trace quantifiers. HyperCTL∗: Extend CTL∗ by trace quantifiers.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 3/19

HyperLTL

HyperLTL = LTL + ψ ::= a | ¬ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions)

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

HyperLTL

HyperLTL = LTL + trace quantification ϕ ::= ∃π. ϕ | ∀π. ϕ | ψ ψ ::= aπ | ¬ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions) and π ∈ V (trace variables).

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

HyperLTL

HyperLTL = LTL + trace quantification ϕ ::= ∃π. ϕ | ∀π. ϕ | ψ ψ ::= aπ | ¬ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions) and π ∈ V (trace variables). Shortcuts as usual: F ψ = true U ψ G ψ = ¬F ¬ψ

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

{} | = ∀π. ∀π′. G (onπ ↔ onπ′)

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

{} | = ∀π. ∀π′. G (onπ ↔ onπ′) {π → t} | = ∀π′. G (onπ ↔ onπ′) for all t ∈ T

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

{} | = ∀π. ∀π′. G (onπ ↔ onπ′) {π → t} | = ∀π′. G (onπ ↔ onπ′) for all t ∈ T {π → t, π′ → t′} | = G (onπ ↔ onπ′) for all t′ ∈ T

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

{} | = ∀π. ∀π′. G (onπ ↔ onπ′) {π → t} | = ∀π′. G (onπ ↔ onπ′) for all t ∈ T {π → t, π′ → t′} | = G (onπ ↔ onπ′) for all t′ ∈ T {π → t[n, ∞), π′ → t′[n, ∞)} | = onπ ↔ onπ′ for all n ∈ N

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics

ϕ = ∀π. ∀π′. G (onπ ↔ onπ′) T ⊆ (2AP)ω is a model of ϕ iff

{} | = ∀π. ∀π′. G (onπ ↔ onπ′) {π → t} | = ∀π′. G (onπ ↔ onπ′) for all t ∈ T {π → t, π′ → t′} | = G (onπ ↔ onπ′) for all t′ ∈ T {π → t[n, ∞), π′ → t′[n, ∞)} | = onπ ↔ onπ′ for all n ∈ N

• n ∈ t(n) ⇔ on ∈ t′(n)

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

LTL vs. HyperLTL

LTL has many desirable properties.

• 1. Every satisfiable LTL formula is satisfied by an ultimately

periodic trace, i.e., by a finite and finitely-represented model.

• 2. LTL and FO[<] are expressively equivalent.
• 3. LTL satisfiability and model-checking are PSpace-complete.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 6/19

LTL vs. HyperLTL

LTL has many desirable properties.

• 1. Every satisfiable LTL formula is satisfied by an ultimately

periodic trace, i.e., by a finite and finitely-represented model.

• 2. LTL and FO[<] are expressively equivalent.
• 3. LTL satisfiability and model-checking are PSpace-complete.

Only partial results for HyperLTL.

• 3a. HyperLTL satisfiability [F. & Hahn ’16]:

alternation-free: PSpace-complete ∃∗∀∗: ExpSpace-complete ∀∗∃∗: undecidable

• 3b. HyperLTL model-checking is decidable [F. et al. ’15].

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 6/19

The Models of HyperLTL

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 7/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ)

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ {a} ∅ ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . . The unique model of ϕ is {∅n {a} ∅ω | n ∈ N}.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models?

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ {a} ∅ ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . . The unique model of ϕ is {∅n {a} ∅ω | n ∈ N}.

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any finite set of traces.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

t

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

f0(t) f1(t, t) · · · fk(t, . . . , t) t

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

t

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

· · · · · · t

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models?

Theorem

Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀π0. ∃π′

• 0. · · · ∀πk. ∃π′
• k. ψ with quantifier-free ψ.

Fix a Skolem function fj for every existentially quantified π′

j.

· · · · · · t The limit is a model of ϕ and countable.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.

{a} {b} {a} {b} {a} {b} ∅ω

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.
• 2. .. for every trace of the form

x{b}{a}y in T, also the trace x{a}{b}y. {a} {b} {a} {b} {a} {b} ∅ω

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.
• 2. .. for every trace of the form

x{b}{a}y in T, also the trace x{a}{b}y. {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.
• 2. .. for every trace of the form

x{b}{a}y in T, also the trace x{a}{b}y. {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.
• 2. .. for every trace of the form

x{b}{a}y in T, also the trace x{a}{b}y. {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Regular Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any ω-regular set of traces. Proof Express that a model T contains..

• 1. .. ({a}{b})n∅ω for every n.
• 2. .. for every trace of the form

x{b}{a}y in T, also the trace x{a}{b}y. {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω {a} {b} {a} {b} {a} {b} ∅ω Then, T ∩ {a}∗{b}∗∅ω = {{a}n{b}n∅ω | n ∈ N} is not ω-regular.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 10/19

What about Ultimately Periodic Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any set of traces that contains an ultimately periodic trace.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 11/19

What about Ultimately Periodic Models?

Theorem

There is a satisfiable HyperLTL sentence that is not satisfied by any set of traces that contains an ultimately periodic trace. One can even encode the prime numbers in HyperLTL!

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 11/19

First-order Logic for Hyperproperties

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 12/19

First-order Logic vs. LTL

FO[<]: first-order order logic over signature {<} ∪ {Pa | a ∈ AP}

• ver structures with universe N.

Theorem (Kamp ’68, Gabbay et al. ’80)

LTL and FO[<] are expressively equivalent.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 13/19

First-order Logic vs. LTL

FO[<]: first-order order logic over signature {<} ∪ {Pa | a ∈ AP}

• ver structures with universe N.

Theorem (Kamp ’68, Gabbay et al. ’80)

LTL and FO[<] are expressively equivalent. Example ∀x(Pq(x) ∧ ¬Pp(x)) → ∃y(x < y ∧ Pp(y)) and G (q → F p) are equivalent.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 13/19

First-order Logic for Hyperproperties

· · · <

N

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 14/19

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

T

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 14/19

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

T

E

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 14/19

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

T

E FO[<, E]: first-order logic with equality over the signature {<, E} ∪ {Pa | a ∈ AP} over structures with universe T × N. Example ∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′))

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 14/19

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

T

E FO[<, E]: first-order logic with equality over the signature {<, E} ∪ {Pa | a ∈ AP} over structures with universe T × N.

Proposition

For every HyperLTL sentence there is an equivalent FO[<, E] sentence.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 14/19

A Setback

Let ϕ be the following property of sets T ⊆ (2{p})ω: There is an n such that p / ∈ t(n) for every t ∈ T.

Theorem (Bozzelli et al. ’15)

ϕ is not expressible in HyperLTL.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 15/19

A Setback

Let ϕ be the following property of sets T ⊆ (2{p})ω: There is an n such that p / ∈ t(n) for every t ∈ T.

Theorem (Bozzelli et al. ’15)

ϕ is not expressible in HyperLTL. But, ϕ is easily expressible in FO[<, E]: ∃x ∀y E(x, y) → ¬p

Corollary

FO[<, E] strictly subsumes HyperLTL.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 15/19

HyperFO

∃Mx and ∀Mx: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 16/19

HyperFO

∃Mx and ∀Mx: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x. HyperFO: sentences of the form ϕ = QM

1 x1. · · · QM k xk. QG 1 y1 ≥ xg1. · · · QG ℓ yℓ ≥ xgℓ. ψ

Q ∈ {∃, ∀}, {x1, . . . , xk} and {y1, . . . , yℓ} are disjoint, every guard xgj is in{x1, . . . , xk}, and ψ is quantifier-free over signature {<, E} ∪ {Pa | a ∈ AP} with free variables in {y1, . . . , yℓ}.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 16/19

Equivalence

Theorem

HyperLTL and HyperFO are equally expressive.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 17/19

Equivalence

Theorem

HyperLTL and HyperFO are equally expressive. Proof From HyperLTL to HyperFO: structural induction. From HyperFO to HyperLTL: reduction to Kamp’s theorem.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 17/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′))

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Mx1 ∀Mx2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2))

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Mx1 ∀Mx2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) {on} {on} ∅ {on} · · · {on} ∅ ∅ {on} · · · x1 → x2 →

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) {on} {on} ∅ {on} · · · {on} ∅ ∅ {on} · · · x1 → x2 →

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) ∀Mx1 ∀Mx2 ∀y1 ∀y2 (y1 = y2) → (P(on,1)(y1) ↔ P(on,2)(y2)) {(on, 1), {(on, 1)} ∅ {(on, 1), · · · (on, 2)} (on, 2)}

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) ∀Mx1 ∀Mx2 ∀y1 ∀y2 (y1 = y2) → (P(on,1)(y1) ↔ P(on,2)(y2)) ∀Mx1 ∀Mx2 G ((on, 1) ↔ (on, 2)) {(on, 1), {(on, 1)} ∅ {(on, 1), · · · (on, 2)} (on, 2)}

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) ∀Mx1 ∀Mx2 ∀y1 ∀y2 (y1 = y2) → (P(on,1)(y1) ↔ P(on,2)(y2)) ∀Mx1 ∀Mx2 G ((on, 1) ↔ (on, 2)) ∀Mx1 ∀Mx2 {(on, 1), {(on, 1)} ∅ {(on, 1), · · · (on, 2)} (on, 2)}

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

From HyperFo to HyperLTL

∀x∀x′ E(x, x′) → (Pon(x) ↔ Pon(x′)) ∀Gy1 ≥ x1 ∀Gy2 ≥ x2E(y1, y2) → (Pon(y1) ↔ Pon(y2)) ∀Mx1 ∀Mx2 ∀y1 ∀y2 (y1 = y2) → (P(on,1)(y1) ↔ P(on,2)(y2)) ∀Mx1 ∀Mx2 G ((on, 1) ↔ (on, 2)) ∀Mx1 ∀Mx2 ∀π1 ∀π2 G (onπ1 ↔ onπ2) {on} {on} ∅ {on} · · · {on} ∅ ∅ {on} · · · π1 → π2 →

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 18/19

Conclusion

Our Results The models of HyperLTL are rather not well-behaved, i.e., in general (countably) infinite, non-regular, and non-periodic. FO[<, E] is strictly more expressive than HyperLTL. HyperFO is expressively equivalent to HyperLTL.

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 19/19

Conclusion

Our Results The models of HyperLTL are rather not well-behaved, i.e., in general (countably) infinite, non-regular, and non-periodic. FO[<, E] is strictly more expressive than HyperLTL. HyperFO is expressively equivalent to HyperLTL. Open Problems Is there a class of languages L such that every satisfiable HyperLTL sentence has a model from L? Is there a temporal logic that is expressively equivalent to FO[<, E]? What about HyperCTL∗?

Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 19/19