CS6133 Software Specification and Verification

1. CS6133Software Specification and Verification Lecture 3 Temporal Logic

2. Temporal Logic: Overview • Temporal Logic was designed for expressing the temporal ordering of events and states within a logical framework • State is an assignment of values to the model’s variables. Intuitively, the system state is a snapshot of the system’s execution, in which every variable has some value • Event is a trigger (e.g., signal) that can cause a system to change its state and won’t persist CS6133

3. Trace • In temporal logic, the notion of exact time is abstracted away • In temporal logic, we keep track of changes to variable values and the order in which they occur • A trace σ is an infinite sequence of states that represents a particular execution of the system starts from an initial state s0, which is determined by the initials values of all the variables σ = s0, s1, s2, …… CS6133

4. Linear Temporal Logic Formula • In linear temporal logic (LTL), a formula f is evaluated with respect to a trace σ and a particular state sj in that trace CS6133

5. LTL Characteristics • Time is totally ordered CS6133

6. LTL Characteristics • Time is bounded in the past and unbounded in the future CS6133

7. LTL Characteristics • Time is discrete CS6133

8. Future Temporal Operators • Future temporal operators are shorthand notations that quantify over states CS6133

9. Henceforth CS6133

10. Eventually CS6133

11. Next State CS6133

12. Until CS6133

13. Unless CS6133

14. Examples CS6133

15. LTL Properties • Safety property can be expressed by a temporal formula of the form • Response property can be expressed by a temporal formula of the form • Precedence (a happens before b happens) CS6133

16. LTL Properties • Precedence Chain (a before b before c) CS6133

17. LTL Properties • P between Q and R or CS6133

18. Example: A Telephone System Given the predicates CS6133

19. Examples Using Future Operators I • Formalize the following sentences in LTL • A user always needs to pick up the phone before dialing • After picking up the phone, the user eventually either goes back on hook or dials • Whenever a user dialed a number and heard the ring tone, a connection will only result after the other user picks up the phone • Immediately after the callee hangs up on a connection, the caller will hear an idle tone, then, the caller will hear a dial tone CS6133

20. Examples Using Future Operators II • Formalize the properties of the elevatorin LTL • The elevator will eventually terminate, with its doors closed. • The elevator shall not keep its doors open indefinitely. • Pressing the button at floor 2 guarantees that the elevator will arrive at floor 2 and open its doors. • Pressing the button at any floor guarantees that the elevator will arrive at that floor and open its doors. • The elevator will not arrive at a floor and open its doors unless it is called. CS6133

21. Past Temporal Operators • Past temporal operators are shorthand notations that quantify over states • Past temporal operators are a symmetric counterpart to each of the future temporal operators • Has-always-been • Once • Previous • Since • Back-to CS6133

22. Has-always-been f  T if f is true in the current and all past system states F otherwise f iff i. 0  i  j  f f S0 Sj CS6133

23. Once f  T if f is true in the current or some past system state F otherwise fiff i. 0 i  j  f f OR S0 Sj f Sj S0 CS6133

24. Previous f  T if f is true in the previous system state F otherwise f iff  i. i  j -1  f f S0 Sj-1 Sj CS6133

25. Since f g  T if once g was true and f has been true since the last g to the present F otherwise f g iff k. 0  k  j  g  i. k  i  j  f g f Sk+1 Sk Sj S0 CS6133

26. Back-to f g  T if f has-always- been true or f since g F otherwise f g iff f g  f f OR S0 Sj f g Sk+1 Sk Sj S0 CS6133

27. Examples Using Past Operators • Formalize the following sentences in LTL • When a caller hears the dial tone, the caller must have picked up the phone • When the callee hears the ring, a caller must dial the callee’s number and hasn’t hanged up • Whenever a user dialed a number and heard the ring tone, a connection is established if the other user picks up the phone CS6133

28. Linear vs. Branching Views • Two ways to think about the computations of reactive system • Linear time: LTL • Branching time: computation tree logic (CTL) • A CTL formula is true/false relative to a state where as an LTL formula is true/false relative to a path CS6133

29. CTL • There are future temporal operators of LTL • There are also path quantifiers todescribe the branching structure of a computation tree: • A and E • A means for all computation paths • E means for some computation paths CS6133

30. CTL Syntax • If p is an atomic proposition, and f1 and f2 are CTL formulae, then the set of CTL formulae consists of • 1. p • 2. ￢f1, f1 ∧ f2, f1 ∨ f2, f1 ⇒ f2 • 3. AX f1, EX f1 • 4. AG f1, EG f1 • 5. AF f1, EF f1 • 6. A [f1Uf2], E [f1Uf2] • Note that the path quantifiers and temporal operators are always paired together CS6133

31. CTL Semantics • AX f • if on all paths starting at state s, f holds in the next state • EX f • if there exists a path starting at state s on which f holds at the next state. CS6133

32. CTL Semantics • EF f • if f is reachable (i.e., if there exists a path starting at state s, on which f holds in some future state). • AF f • if f is inevitable (i.e., if on all paths that start at state s, f holds in some future state). CS6133

33. CTL Semantics EG f if there exists a path starting at state s, on which f holds globally. AG f if f is invariant (i.e., if on all paths that start at state s, f holds globally). CS6133

34. CTL Semantics E[g U f] if there exists a path starting at state s, on which g holds until f eventually holds. A[g U f] if on all paths that start at state s, g holds until f eventually holds. CS6133

35. Example of CTL Formulas “It is possible to get to a state where started holds, but ready does not hold.” “For any state, if a request occurs, then it will eventually be acknowledged.” “It is always the case that a certain process is enabled infinitely often on every computation path.” CS6133

36. LTL vs. CTL In LTL, we could write: FG p There is no equivalent of this formula in CTL. In CTL, we could write: AG EF p There is no equivalent of this formula in LTL. CS6133