2
Outlinen We introduce linear temporal logic (LTL), a
logical formalism that is suited for specifying LT properties.
n Then we go through a model-checkingalgorithm for LTL based on Bϋchi automata.
3
Linear Temporal Logicn Correctness of reactive systems
depends on the execution of the system and on fairness issues.n Temporal logic is a suitable formalism for
treating these aspects.n Temporal logic extends propositional or
predicate logic by modalities to specify infinite behavior of a reactive system.
Linear Temporal Logic (Con.)n The elementary modalities of temporal
logics include the operators:n à “eventually” (eventually in the future)n □ “always” (now and forever in the future).
n The nature of time in temporal logics can be either linear or branching:
4
Linear Temporal Logic (Con.)n In the linear view, at each moment in time
there is a single successor moment.n LTL (Linear Temporal Logic) is based on linear-
time perspective.n In the branching view, it has a branching,
tree-like structure, where time may split into alternative course.
n CTL (Computational Tree Logic) is based on a branching-time view.
5
Linear Temporal Logic (Con.)n A temporal logic allows for the
specification of the relative order of events. But it does not support any means to refer to the precise timing of events.n “The car stops once the driver pushes the
brake”.n “The message is received after it has been
sent”.6
Linear Temporal Logic (Con.)n LTL may be used to express the timing
for the class of synchronous systems in which all components proceed in a lock-stop fashions. n In this setting, a transition corresponds to
the advance of a single time-unit.n The time domain is discrete: the present
moment refers to current state and the next moment corresponds to the next state.
7
Linear Temporal Logic: syntaxn LTL formulae over the set AP of atomic
proposition are formed according to the following grammar:n j ::= true | a | j1Ùj2 | ¬j | �j | j1Uj2
where aÎAP.n �, “next” : �j holds at the current moment if j holds in the next state.
n U, “until”: j1Uj2 holds at the current moment, if there is some future for which j holds and jholds at all moments until future moment.
8
Linear Temporal Logic: syntax (Con.)n The precedence order on operators is
as follows.n The unary operators bind stronger than the
binary ones.n � and ¬ bind equally strong.n The temporal operator U takes precedence
over Ù,Ú, and ®.
9
Linear Temporal Logic: syntax (Con.)n Using the Boolean connectives Ù and ¬,
the full power of propositional logic is obtained.
n The until operator allows to derive the temporal modalities à and □ as follows:n àj= true U j and □j= ¬à¬j
n àj ensures that j will be true eventually the in future.
n □j is satisfied iff it id not the case that eventually ¬j holds. 10
Linear Temporal Logic: syntax (Con.)n The intuitive meaning of temporal
modalities are illustrated below:
11
Linear Temporal Logic: syntax (Con.)n By combining □ and à, new temporal
modalities are obtained:n □àa describes the property stating that at
any moment j there is a moment i³j at which a-state is visited. Thus a-state is visited infinitely often.
n à□a expresses that from moment j, only a-state are visited. Thus a-state is visited eventually forever.
12
Linear Temporal Logic: syntax (Con.)n Example 5.2: properties for mutual
exclusion problem:n Safety property stating that P1 and P2
never simultaneously have access to their critical section: □(¬crit1Ú¬crit2).
n Liveness property stating each process Pi is infinitely often in its critical section: (□àcrit1)Ù (□àcrit2).
n Read examples 5.3 and 5.4.13
Linear Temporal Logic: syntax (Con.)n Let |j| denote the length of LTL
formula j in terms of the number of operators in j.
n This can be easily defined by inductionon the structure of:n aÎAP has length 0;n �aÚb has length 2 and (�a)U(aÙ¬b) has
length 4.14
Linear Temporal Logic: semanticsn LTL formula stands for properties of
paths.n The semantics of LTL formula is defined
by a LT property. Then it is extended to an interpretation over paths and statesof a LTS.
15
Linear Temporal Logic: semantics (Con.)n Definition: Let j be an LTL formula
over AP. The LT property induced by jis
Words(j)={sÎ(2AP)w| s|=j}where |= Í(2AP)w´LTL is the smallest
relation with the properties:
16
Linear Temporal Logic: semantics (Con.)
n For the derived operators and the expected result is :
n Derive semantics of à□ and □à!17
Linear Temporal Logic: semantics (Con.)
n Definition 5.7: Let TS=(S,Act,®,I,AP,L ) be a transition system without terminal state, and let j be a LTL formula over AP.n For infinite path fragments p of TS, the
satisfaction relation is defined by p |= j iff trace(p) |=j
18
Linear Temporal Logic: semantics (Con.)
n For state sÎS, the satisfaction relation |= is defined by:
s|=j iff ("pÎPaths(s).p|=j)n TS satisfies j, denoted TS |=j , if
Traces(TS)ÍWords(j).
19
Linear Temporal Logic: semantics (Con.)n From this definition, it immediately
follows that:
n Thus, TS |=j iff s0 |= j for all initial states s0 of TS.
20
Linear Temporal Logic: semantics (Con.)n Example 5.8: Consider the LTS below
with the set of propositions AP={a,b}
n TS |=□an TS | ¹ �(aÙb)n TS |= □(¬b ®□(aÙ¬b))n TS |¹ b U (aÙ¬b)
21
Linear Temporal Logic: semantics (Con.)n Semantics of Negation:
n For paths, it holds p|=j iff p|¹¬j. Since Words(¬j)=(2AP)w\Words(j).
n However statements TS|¹j and TS|=¬jare not equivalent. Instead TS|=¬ jimplies TS|¹j. Note that :
22
Linear Temporal Logic: semantics (Con.)n Thus it is possible that a LTS satisfies
neither j nor ¬j:n Consider the TS below with AP={a}:
n TS|¹ àa, since the initial path s0(s2)w|¹àa.n TS|¹ ¬àa, since the initial path s0(s1)w|=a,
and thus s0(s1)w|¹ ¬à a.23
Linear Temporal Logic: specifying propertiesn Example 5.11: A modulo 4 counter
can be represented by a sequential circuit C, which outputs 1 every fourth cycle, otherwise 0.n Let the evaluation of r1r2 denote i=2.r1+r2n C is constructed such that the output bit y
is set exactly for i=0 (hence r1=0,r2=0). Son dr1=r1År2, dr2=¬r1, ly=¬r1Ù¬r2.
24
Linear Temporal Logic: specifying properties (Con.)
n The circuit C and its transition system TSC is shown below:
25
Linear Temporal Logic: specifying properties (Con.)
n Let AP={r1,r2,y}. The following statement holds:
n TSC |= □(y « ¬r1Ù¬r2)n TSC |= □(r1 ® (�y Ú��y))n TSC |= □(y ®(�¬y Ù��¬y)).
n The property that at least during every four cycles the output 1 id obtained holds for TSC:
n TSC |= □(y Ú�yÚ��yÚ���y).
26
Linear Temporal Logic: specifying properties (Con.)
n The fact that these outputs are produced in a periodic manner where every fourth cycle yields the output 1 is expressed as:
n TSC |= □(y®(�¬y Ú ��¬y Ú���¬y)).
n Read example 5.12
27
Linear Temporal Logic: specifying properties (Con.)
n Example 5.13: Leader election protocol:n Goal: a process with a higher identifier is
elected.n Processes are initially inactive, and may
become active and then participate in the election (fairness: each process becomes active at some time).
n If an inactive process with higher id becomes active, a new leader election takes place.
28
Linear Temporal Logic: specifying properties (Con.)n We use LTS to specify some properties.
Let AP={leaderi,activei|1£i,j£N}.n There is always one leader:
n □(\/1£i£N leaderi Ù /\ 1£j£N,j¹i ¬leaderj)n Since initially no leader exists we modify it to: □à(\/1£i£N leaderi Ù /\ 1£j£N,j¹i ¬leaderj)
n But this allows there to be more than one leader at a time temporarily, so: (□ /\1£i£N(leaderi ® /\ 1£j£N,j¹i ¬leaderj)) Ù(□à(\/1£i£N leaderi )
29
Linear Temporal Logic: specifying properties (Con.)
n In the presence of an active process with a higher identity, the leader will resign at some time:
□(/\ 1£i,j£N,i<j ((leaderi Ù¬leaderj Ùactivej)®à¬leaderi))
n A new leader will be an improvement over the previous one:□¬ (/\ 1£i,j£N,i ³j (leaderi Ù¬�leaderi Ù �àleaderj))
n Read Example 5.14.30
Linear Temporal Logic: specifying properties (Con.)n For synchronous systems LTL can be
used as a formalism to specify real-time properties:n �j states that “at the next time instant j
holds”.n �Kj =�.. � : j holds after k time
instants.n à£k j= \/0£i£k�
ij : j will hold at most k time instants.
31
Linear Temporal Logic: specifying properties (Con.)
n □£k j= ¬\/0£i£k�i¬j : j holds now and will
hold during the next k time instants.n But for asynchronous systems the next-
step operator should be used with care.
32
Linear Temporal Logic: equivalence of LTL formulaen Two formulae are intuitively equivalent
whenever they have the same truth-value under all interpretations.
n Definition: LTL formulae j1,j2 are equivalent, denoted j1ºj2, if Words(j1)=Words(j2).
33
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n As LTL subsumes propositional logic, equivalences of propositional logic also hold for LTL.
n For temporal modalities we have:
34
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n The duality rule ¬�jº�¬j shows that next-step operator is dual to itself:
n In the absorption law à□àjº□àj : infinitely often j is equal to from a certain point of time on, j is true infinitely often.
36
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n The distributive laws for and disjunction, or and conjunction are dual to each other:
n à(jÚy) ºàj Ú ày and □(jÙy) º□j Ù □yn Recall that $(jÚy) º $j Ú $y and "(jÙy) º "j Ù"y
n But à(aÙb) àa Ù àb and □(aÚb) □a Ú □b (the same holds for $ and "):
37
º º
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n The expansion laws describe the temporal modalities U,à and □ by means of a recursive equivalence:
n These equivalences assert something about the current, and about the director successor state.
n j U yºy Ú (jÙ �(jUy)): so j U y is a solutionof the equivalence kºy Ú (jÙ �k).
n àyºy Ú �ày is a special case of the expansion law for until:
38
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n Lemma 5.18 (Until is least solution of the expansion law): For LTL formulae jand y, Words(jUy) is the least LT property PÍ(2AP)w such that:n Words(y) È{A0,A1,A2…ÎWords(j)|A1
A2…ÎP}ÍP (I)n Moreover, Words(jUy) agrees with the
set: Words(y) È{A0,A1,A2…ÎWords(j)|A1A2…ÎWords(jUy)}.
39
Linear Temporal Logic: equivalence of LTL formulae (Con.)
n The formulation “least LT property satisfying condition (I)” means that the following conditions hold:n (1) P= Words(jUy) satisfies (I).n Words(jUy)ÍP for all LT properties P
satisfying condition (I).
40
Linear Temporal Logic: weak, release and positive normal form
n Any LTL formula can be transformedinto a canonical form, called positive normal form (PNF), in which:n Negations only occur adjacent to atomic
propositions.n Recall that PNF formulae in propositional
logic are constructed from true, false, the literals a and ¬a, and the operators Ù and Ú.
41
Linear Temporal Logic: weak, release and positive normal form (Con.)
n To transform any LTL formula into PNF, for each operator a dual operator is needed in the syntax:n True and false, Ù and Ú.n The next-step operator is a dual of itself.n Consider the until operator:¬(jUy)º((jÙ¬y) U (¬jÙ¬y)) Ú □(jÙ¬y)
42
Linear Temporal Logic: weak, release and positive normal form (Con.)
n The operator W, called weak until or unless, as the dual of U: jWyº(jUy) Ú□j.
n Until and W are dual in the following sense:
n Note that W has the same expresivness to U.n W and U satisfy the same expansion law.
43
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Lemma 5.19 (weak-until is the greatest solution of the expansion law) For LTL formulae j and y, Words(jWy) is the greatest LT property PÍ(2AP)w such that:n Words(y) È{A0,A1,A2…ÎWords(j)|A1 A2…ÎP}ÊP
(I)n Moreover, Words(jWy) agrees with the set:
Words(y) È{A0,A1,A2…ÎWords(j)|A1A2…ÎWords(jWy)}.
44
Linear Temporal Logic: weak, release and positive normal form (Con.)
n The formulation “greatest LT property satisfying condition (I)” means that the following conditions hold:n (1) P Ê Words(jWy) satisfies (I).n Words(jWy) Ê P for all LT properties P
satisfying condition (I).
45
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Definition: For aÎAP, the set of LTL formulae in weak-until positive normal form (weak-until PNF) is given by:n j::= true | false | a | ¬a | j1Ùy2 | j1Úy2 | �j | j1Uy2 | j1Wy2
n Since □j º j W false and àj º true U j, □and à can be also considered as permitted operator of W-PNF.
46
Linear Temporal Logic: weak, release and positive normal form (Con.)
n We can convert each LTL formula to its W-PNF by using the following rewriterules:
47
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Example 5.21: convert LTL formula ¬□((aUb)Ú �c) to weak-until PNF:n ¬□((aUb)Ú �c) º à¬((aUb)Ú �c) º à (¬(aUb)Ù ¬�c) º à ( (aÙ ¬ b) W (¬a Ù¬b) Ù ¬�c)
48
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Theorem 5.22: For each LTL formula there exists an equivalent LTL formula in weak-until PNF.
n The main draw-back of rewrite rules is that the length of the resulting formula may be exponential in the length of the original nonPNF LTL formula:n The rewrite rule for U and W , duplicates
the operands. 49
Linear Temporal Logic: weak, release and positive normal form (Con.)
n We can avoid this exponential blow-up by using another temporal modality as the dual of until, called release and defined by : n jRy = ¬(¬j U¬y)n jRy holds for a word if y always holds, a
requirement that is released as soon as jbecomes valid.
50
Linear Temporal Logic: weak, release and positive normal form (Con.)
n The always operator is obtained from the release operator : □jºfalse R j.
n The weak-until and the until operator are obtained by:n jWyº (¬j Ú y) R (j Ú y) and vice versa jRyº (¬j Ù y) W (j Ù y)
n jUyº ¬(¬j R ¬y)
51
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Definition: For aÎAP, the set of LTL formulae in release positive normal form (release PNF) is given by:n j::= true | false | a | ¬a | j1Ùy2 | j1Úy2 | �j | j1Uy2 | j1Ry2
n Thus the rewrite rules are:
52
Linear Temporal Logic: weak, release and positive normal form (Con.)
n Theorem 5.24: For any LTL formula jthere exists an equivalent LTL formula j’ in release PNF with |j’|=O(|j|).
53
Linear Temporal Logic: Fairness in LTL
n Definition: Let F and Y be propositional logic formula over AP.1. An unconditional LTL fairness constraint is
an LTL formula of the form ufair=□àY.2. A strong LTL fairness condition is an LTL
formula of the form ufair=□àF®□àY.3. A weak LTL fairness constraint is an LTL
formula of the form wfair= à□F®□àY.an LTL fairness assumption is a conjunction
of LTL fairness constraints. 54
Linear Temporal Logic: Fairness in LTL (Con.)n For instance, a strong LTL fairness
assumption denote a conjunction of strong LTL fairness constraints:
sfair = /\0<i£k(□àFi®□àYi)for propositional logic formulae Fi and Yi over AP.
n Generally LTL fairness assumptions are: fair = ufairÙsfair Ù wfair
55
Linear Temporal Logic: Fairness in LTL (Con.)n Let FairPaths(s) denote the set of all
fair paths starting in s and FairTraces(s) the set of all traces induced by fair paths starting in s:n FairPaths(s) ={pÎPaths(s) | p|=fair}n FairTraces(s) = {Trace(p)|pÎFairPaths(s)}
n Above definitions can be lifted to TSs yielding FairPaths(TS) and FairTraces(TS). 56
Linear Temporal Logic: Fairness in LTL (Con.)n Definition: For state s in TS (over AP)
without terminal state, LTL formula jand LTL fairness assumptions fair letn s |=fair j iff "pÎFairPaths(s). p|= j andn TS|=fair j iff s0ÎI.s0|=fair j.
n TS satisfies j under the LTL fairness assumption fair if j holds for all fair paths that originate from some initial state. 57
Linear Temporal Logic: Fairness in LTL (Con.)n Example 5.27: Consider the mutual
exclusion with randomized arbiter:
58
Linear Temporal Logic: Fairness in LTL (Con.)
n Arbiter tosses a coin, modeled by non-deterministic choice between heads and tails, to choose a process to enters its critical section.
n “process Pi is in its critical section infinitely often”:n TS1 || Arbiter || TS2 |¹ □à crit1 (why?)n TS1 || Arbiter || TS2 |=fair □àcrit1 Ù □àcrit2
where fair= □àheads Ù □àtails.59
Linear Temporal Logic: Fairness in LTL (Con.)n In chapter 3, fairness was introduced
using set of actions:n An execution is unconditionally A-fair for a
set of actions A, whenever each action aÎA occurs infinitely often.
n However LTL-fairness is defined on atomic propositions, i.e., from a state-based perspective.
60
Linear Temporal Logic: Fairness in LTL (Con.)n Action-based fairness assumptions can
always be translated into analogous LTL fairness assumption.
n The intuition is n Make a copy of each non-initial state s
such that it is recorded which action was executed to enter s.
n The copied state <s,a> indicates that state s has been reached by performing a as last action. 61
Linear Temporal Logic: Fairness in LTL (Con.)n Formally for TS=(S,Act,®,I,AP,L) let
TS’=(S’,Act’,®’,I’,AP’,L’) where n Act=ActÈ{begin},n I’=I´{begin},n S’=I’ È (S´Act),n TS’ is defined by :
62
Linear Temporal Logic: Fairness in LTL (Con.)n L’ is defined:
n L’(<s,a>)=L(s)È{taken(a)}È{enabled(b)|bÎAct(s)} n L’(<s0,begin>)=L(s0)È{enabled(b)|bÎAct(s0)}.
n It can be established thatn TracesAP(TS)=TracesAP(TS’).
n Thus strong fairness for AÍAct can be described by LTL fairness assumption:n sfairA=□àenabled(A)® □àtaken(A)
n enabled(A)=\/aÎAenabled(a), taken(A)=\/aÎAtaken(a)63
Linear Temporal Logic: Fairness in LTL (Con.)n The set of fair traces of action-based
fairness assumption F for TS and its corresponding LTL fairness fair for TS’ coincides:n {TraceAP(p)| pÎPaths(TS), p is F-fair}=
{TraceAP(p’)| p’ÎPaths(TS’), p’|= fair}n Thus FairTracesF(TS)=FairTracesfair(TS’):
n TS |=F P iff TS’ |=fair P.
64
Linear Temporal Logic: Fairness in LTL (Con.)n Conversely, a (state-based) LTL fairness
assumptions cannot always be represented as action-based fairness assumption.n Because strong or weak LTL fairness
assumptions need not be realizable while action-based can be realized by a scheduler.
n State-based LTL fairness assumptions are more general then action-based. 65
Linear Temporal Logic: Fairness in LTL (Con.)
n Theorem 5:30: For transition system TS without terminal state, LTL formula j, and LTL fairness assumption fair:n TS|=fair j iff TS|=(fair®j)
n Read Examples 5.28-30.
66
Automata-Based LTL Model Checkingn Given a finite transition system TS and
an LTL formula j (a requirement on TS), an LTL model-checking algorithm checks TS |= j:n If j is refuted, an error trace needs to be
returned.
67
Automata-Based LTL Model Checking (Con.)n In following, we assume that TS is finite
and has no terminal state.n The model-checking algorithm that we
are going to introduce is based on automata-based approach:n Each LTL formula j is represented by a
nondeterministic büchi automaton (NBA).n The basic idea is to disprove TS |= j by
looking for a path p in TS with p|= ¬j .68
Automata-Based LTL Model Checking (Con.)
n If such a path is found, a prefix of p is returned as error trace.
n If no such path is encountered, it is concluded that TS|=j.
n This Algorithm relies on following observation:
69
Automata-Based LTL Model Checking (Con.)
n Hence, for NBA A with Lw(A)=Words(¬j) we have :n TS |= j if and only if Traces(TS)ÇLw(A)=Æ.
n Thus, to check j holds for TS, we first construct an NBA for the negation of the input formula j and then look for their intersection TSÄA¬j.
70
Automata-Based LTL Model Checking (Con.)
n Now it remains to show that how a given LTL property can be presented by an NBAand such an NBA can be constructedalgorithmically.n Recall that the LTL semantics yields a
language Words(j)Í(2AP)w. Thus the alphabet of NBA for LTL formulae is Σ=2AP.
n We show that Words(j) is ω-regular, and hence, can be represented by a NBA.
72
Automata-Based LTL Model Checking (Con.)n Example 5.32: The edges of a NBA
can be represented symbolically by propositional logics over symbols aÎAP, true and Boolean connectors. n Thus they can be interpreted over sets of
propositions AÎS=2AP.n If AP={a,b} then q aÚb q’ is a short
notation for the three transitions:n q {a} q’, q {b} q’, and q {a,b} q’ .
73
Automata-Based LTL Model Checking (Con.)
n The language of all words s=A0A1…Î2AP
satisfying the LTL formula □àgreen is accepted by the NBA below:
n A is in the accept state q1 if and only if the last consumed symbol (the last set Ai of the input word A0A1A2...∈(2AP)ω) contains the propositional symbol green.
74
Automata-Based LTL Model Checking (Con.)n The liveness property: “whenever event
a occurs, event b will eventually occur”. An associated NBA over the alphabet 2{a,b} is shown below:
75
Automata-Based LTL Model Checking (Con.)n To construct an NBA A satisfying
Lw(A)=Words(j) for the LTL formula j, first a generalized NBA is constructed for j, which subsequently is transformed into an equivalent NBA.
76
Automata-Based LTL Model Checking (Con.)n Assume j only contains the operators Ù, ¬, � and U, i.e., the derived operators Ú, →, à, □, W and so on are assumed to be expressed in terms of the basic operators.n Since j=true is trivial, it may be assumed
that j¹true.
78
Automata-Based LTL Model Checking (Con.)n The basic idea to construct a GNBA over
the alphabet 2AP for a given LTL formula j (over AP), i.e., Lw(gj)=Words(j) is:n Let s=A0 A1 A2 …ÎWords(j).n The sets AiÍAP are expanded by
subformulae y (and their negation) of jsuch that an infinite word s=B0 B1 B2 … with the following property arises:
n yÎBi if and only if Ai Ai+1 Ai+2 …|=y79si
Automata-Based LTL Model Checking (Con.)n The GNBA gj is constructed such that Bi
constitute its states. n Moreover, the construction ensures that s=B0
B1 B2 … is a run for s= A0 A1 A2 … in Gj.n The accepting conditions for gj are chosen
such that the run s is accepting if and only if s|=j.
n We encode the meaning of the logical operators into the states, transitions and acceptance sets of Gj. 80
Automata-Based LTL Model Checking (Con.)n Let j= aU(¬aÙb) and s={a}{a,b}{b}…:
n Bi is a subset of the set of formulae {a,b,¬a,¬aÙb,j}È{¬b,¬(¬aÙb),¬j).
n The set A0={a} is extended with formulae ¬b, ¬(¬aÙb) and j, since all these formula hold in s0=s and all other subformulae in the above set are refuted by s.
n The set A1={a,b} is extended with the formulae ¬(¬aÙb) and j, as they hold in s1={a,b}{b}…. 81
Automata-Based LTL Model Checking (Con.)
n The A2={b} is extended with ¬a, ¬aÙb and j as they hold in s2={b}….
n These yield s= {a,¬b,¬(¬aÙb),j} {a,b,¬(¬aÙb),j} {¬a,b,¬aÙb,j}…
82
Automata-Based LTL Model Checking (Con.)n Definition: The closure of LTL formula j is the set closure(j) consisting of all subformulae y of j and their negation¬y (where y and ¬¬y are identical).n For instance, for j= aU(¬aÙb) , the
closure(j)={a,b,¬a,¬b, ¬aÙb,¬(¬aÙb),j, ¬j}.
n |closure(j)|ÎO(|j|)
83
Automata-Based LTL Model Checking (Con.)n B is consistent with respect to
propositional logic, i.e., for all ϕ1∧ϕ2,ψ∈closure(ϕ):n ϕ1∧ϕ2 ∈ B ⇒ ϕ1∈ B and ϕ2∈ Bn ψ∈B ⇒ ¬ψÏBn True ∈ closure(ϕ) ⇒ true ∈ B.
84
Automata-Based LTL Model Checking (Con.)
n B is locally consistent with respect to the until operator, i.e., for all ϕ1Uϕ2∈ closure(ϕ):n Φ2∈ B ⇒ ϕ1Uϕ2∈ Bn ϕ1Uϕ2∈ B and ϕ2 Ï B ⇒ ϕ1∈ B.
n B is maximal, i.e., for all ψ ∈ closure(ϕ):n ψÏB ⇒ ¬ψ∈B.
85
Automata-Based LTL Model Checking (Con.)n Definition: B⊆closure(j) is
elementary if it is consistent with respect to propositional logic, maximal, and locally consistent with respect to the until operator.
86
Automata-Based LTL Model Checking (Con.)n Example 5.35: let j=aU(¬aÙb):
n B0={a,b,j} is consistent with respect to propositional logic and locally consistent with respect to the until operator. But it is not maximal. Why?
n B1={a,b,¬aÙb,j} is not consistent with respect to propositional logic. Why?
n B2={a,b, ¬(¬aÙb), j} is an elementary set.
87
Automata-Based LTL Model Checking (Con.)n Let ϕ be an LTL formula over AP. Let
Gϕ=(Q,2AP,δ,Q0,F ) be its corresponding GNBA, where n Q is the set of all elementary sets of
formulae B⊆closure(ϕ),n Q0={B∈Q|ϕ∈B},n F ={Fϕ1Uϕ2|ϕ1Uϕ2∈closure(ϕ)} where
Fϕ1Uϕ2={B∈Q|ϕ1Uϕ2ÏB or ϕ2∈B}.
88
Automata-Based LTL Model Checking (Con.)
n The transition relation δ:Q×2AP→2Q is given by: n If A¹B∩AP, then δ(B,A)=∅. n If A=B∩AP, then δ(B,A) is the set of all
elementary sets of formulae B’ satisfying i. for every �ψ∈closure(ϕ): �ψ∈B⇔ψ∈B’, and ii. For every ϕ1Uϕ2∈closure(ϕ):
ϕ1Uϕ2∈B⇔(ϕ2∈B ∨ (ϕ1∈B ∧ϕ1Uϕ2∈B’)).
89
Automata-Based LTL Model Checking (Con.)n The conditions (i) and (ii) reflect the
semantics of the next step and the until operator, respectively. Rule (ii) is justified by the expansion rule:n ϕ1Uϕ2 º ϕ2∨ (ϕ1∧ �(ϕ1Uϕ2)).
90
Automata-Based LTL Model Checking (Con.)n To model the semantics of U, an
acceptance set Fψ is introduced for every subformula ψ=ϕ1Uϕ2 of ϕ.n Thus every run B0 B1 B2 ... for which
ψ∈B0, we have ϕ2∈Bj (for some j³0) and ϕ1∈Bi for all i<j.
n The requirement that a word σ satisfies ϕ1Uϕ2 only if ϕ2 will actually eventually become true is ensured by the accepting set Fϕ1Uϕ2. 91
Automata-Based LTL Model Checking (Con.)n Example 5.38: let j=�a. It
corresponding GNBA Gj is: n Q = {B1,B2,B3,B4} where B1={a,�a},
B2={a,¬�a}, B3={¬a,�a}, B4={¬a,¬�a},n Q0={B1,B3} since �aÎB1,B3,n 2{a}={Æ,{a}} and d is defined:
n B1Ç{a}={a}, so d(B1,{a})={B1,B2} since �aÎB1 and B1 and B2 are the only states that contain a.
n B1ÇÆ=Æ, so d(B1,Æ)=Æ. 92
Automata-Based LTL Model Checking (Con.)n Any state of the GNBA for an LTL
formula ϕ contains either ψ or its negation ¬ψ for every subformula ψ of ϕ.
n This is somewhat redundant. It suffices to represent state B∈closure(ϕ) by the propositional symbols a∈B∩AP, and the formulae �ψ or ϕ1Uϕ2∈B.
94
Automata-Based LTL Model Checking (Con.)n Having constructed a GNBA Gϕ for a
given LTL formula ϕ, an NBA for ϕ can be obtained by the transformation“GNBAàNBA” described Chapter 4.
95
Automata-Based LTL Model Checking (Con.)n Theorem: For any LTL formula ϕ (over
AP) there exists an NBA Aϕ with Words(ϕ)=Lω(Aϕ) which can be constructed in time and space 2O(|ϕ|).n It should be noted that the size of the
resulting GNBA grows up exponentiallywith respect to the size of formula.
96
Complexity of the LTL Model-checking problemn As explained before, the essential idea
behind the automata-based model-checking algorithm for LTL is based upon the following relations:
97
Complexity of the LTL Model-checking problem (Con.)
n The GNBA Gϕ has at most 2|ϕ| states with |ϕ| accepting states (the number of until-subformulas in ϕ).
n The NBA A¬ϕ can thus be constructed in exponential time: O(2|ϕ| ´|ϕ|)=O(2|ϕ|+log|ϕ|).
n Thus an upper bound for the time-and space-complexity of LTL model checking is O(|TS|´2|ϕ|).
98
Complexity of the LTL Model-checking problem (Con.)
n In general, the problem can be shown to be PSPACE-complete, the proof of which is rather involved.
n It is easy to show that the problem is coNP-hard.
99
Complexity of the LTL Model-checking problem (Con.)
n Consider an arbitrary directed graph G = (V, A) where V = {v1, …, vn}.
n We show that the problem of determining whether G has a directed Hamiltonian path is reducible to the problem of determining TS |¹ ϕ where TS and ϕ are to be defined later.
100
Complexity of the LTL Model-checking problem (Con.)
n ϕ is the formula (using the atomic propositions p1 , …, pn):
ϕ = ¬[àp1 Ù … Ù àpn Ù □(p1 → �□¬p1) Ù… Ù □(pn → �□¬pn)]
101
Complexity of the LTL Model-checking problem (Con.)
Let the transition system TS = (W, {τ}, ®, {w1}, AP, L) consist of:
§ W = V U {w1, w2} where ¬ (w1,w2 Î V).§ ® = {(u, τ, v) | (u, v) Î A} U {(w1,τ, vi) | vi ε V} U
{(vi, τ, w2) | vi ε V} U {(w2, τ, w2) } § AP = {p1, … pn}§ L is an assignment of propositions to states such that
• pi is true in vi for 1 ≤ i ≤ n• pj is false in vi for 1 ≤ i, j ≤ n, i ≠ j• pi is false in w1, w2 for 1 ≤ i ≤ n 102
Complexity of the LTL Model-checking problem (Con.)
n It is easy to show that TS |¹ ϕ if and only if there is a directed infinite path in TS starting at w1 that goes through all vi ε V exactly once and ends in the loop through w2.
103
LTL Model Checking with Fairnessn As a consequence of Theorem 5.30, the
model-checking problem for LTL with fairness assumptions can be reduced to the model-checking problem for plain LTL.n In order to check the formula ϕ under
fairness assumption fair, it suffices to verify the formula fair→ϕ with an LTL model-checking algorithm.
104
LTL Model Checking with Fairness (Con.)n The drawback of this approach is that
the length |fair| can have an exponential influence on the run-time of the algorithm.n The construction of an NBA for the
negated formula ¬(fair→ϕ) is exponential in |¬(fair→ϕ)|= |fair| + |ϕ|.
n To avoid this, a modified persistence check can be exploited to analyze TS⊗A¬ϕ (instead of TS⊗A¬(fair→ϕ)). 105