Lecture 2: Linear vs. Branching time. Temporal Logics: CTL, CTL*. CTL model checking algorithm. Counter-example generation.

Transcription

1 CS 267: Automated Verification Lecture 2: Linear vs. Branching time. Temoral Logics: CTL, CTL*. CTL model checking algorithm. Counter-examle generation. Instructor: Tevfik Bultan

2 Linear Time vs. Branching Time In linear time logics we look at the execution aths individually In branching time logics we view the comutation as a tree comutation tree: unroll the transition relation Transition System Execution Paths Comutation Tree s1 s2 s4 s4 s1 s4 s1. s2. s4. s1. s4. s2 s1.

3 Comutation Tree Logic (CTL) In CTL we quantify over the aths in the comutation tree We use the same four temoral oerators: X, G, F, U However we attach ath quantifiers to these temoral oerators: A : for all aths E : there exists a ath We end u with eight temoral oerators: AX, EX, AG, EG, AF, EF, AU, EU

4 CTL Semantics Given a state s and CTL roerties and q s = iff L(s, ) = True, where AP s = iff not s = s = q iff s = and s = q s = q iff s = or s = q s 0 = EX iff there exists a ath s 0, s 1, s 2,... such that s 1 = s 0 = AX iff for all aths s 0, s 1, s 2,..., s 1 =

5 CTL Semantics s 0 = EG iff there exists a ath s 0, s 1, s 2,... such that for all i 0, s i = s 0 = AG iff for all aths s 0, s 1, s 2,..., for all i 0, s i = s 0 = EF iff there exists a ath s 0, s 1, s 2, such that there exists an i 0 such that s i = s 0 = AF iff for all aths s 0, s 1, s 2,..., there exists an i 0, such that, s i = s 0 = EU q iff there exists a ath s 0, s 1, s 2,..., such that, there exists an i 0 such that s i = q and for all 0 j < i, s j = s 0 = AU q iff for all aths s 0, s 1, s 2,..., there exists an i 0 such that s i =q and for all 0 j< i, s j =

6 CTL Proerties Transition System s1 s2 s4 Comutation Tree s4 s1 = s4 = s1 = s2 = = EX = EX = AX = AX = EG = EG = AF = EF = AF s4. s1. s4.. s2 s1.

7 CTL Equivalences CTL basis: EX, EU, EG AX = EX AG = EF AF = EG AU q = ( ( q EU ( q)) EG q) EF = True EU Another CTL basis: EX, EU, AU

8 CTL Model Checking Given a transition system T= (S, I, R) and a CTL roerty T = iff for all initial state s I, s = Model checking roblem: Given a transition system T and a CTL roerty, determine if T is a model for (i.e., if T =) For examle: T =? AG ( (c1=c c2=c)) T =? AG(c1=w AF(c1=c)) AG(c2=w AF(c2=c)) Question: Are CTL and LTL equivalent?

9 CTL vs. LTL CTL and LTL are not equivalent There are roerties that can be exressed in LTL but cannot be exressed in CTL For examle: FG There are roerties that can be exressed in CTL but cannot be exressed in LTL For examle: AG(EF ) Hence, exressive ower of CTL and LTL are not comarable

10 CTL* CTL* is a temoral logic which is strictly more owerful than CTL and LTL CTL* also uses the temoral oerators X, F, G, U and the ath quantifiers A and E, but temoral oerators can also be used without ath quantifiers

11 CTL* CTL and CTL* corresondence Since and CTL roerty is also a CTL* roerty, CTL* is clearly as exressive as CTL Any LTL f roerty corresonds to the CTL* roerty A f i.e., LTL roerties have an imlicit for all aths quantifier in front of them Note that, according to our definition, an LTL roerty f holds for a transition system T, if and only if, for all execution aths of T, f holds So, LTL roerty f holds for the transition system T if and only if the CTL* roerty A f holds for all initial states of T

12 CTL* CTL* is more exressive than CTL and LTL Following CTL* roerty cannot be exressed in CTL or LTL A(FG ) AG(EF )

13 Model Checking Algorithm for Finite State Systems [Clarke and Emerson 81], [Queille and Sifakis 82] CTL Model checking roblem: Given a transition system T = (S, I, R), and a CTL formula f, does the transition system satisfy the roerty? CTL model checking roblem can be solved in O( f ( S + R )) Note that the comlexity is linear in the size of the formula and the transition system Recall that the size of the transition system is exonential in the number of variables and concurrent comonents (this is called the state sace exlosion roblem)

14 CTL Model Checking Algorithm Translate the formula to a formula which uses the basis EX, EG, EU q Start from the innermost subformulas Label the states in the transition system with the subformulas that hold in that state Initially states are labeled with atomic roerties Each (temoral or boolean) oerator has to be rocessed once Processing of each oerator takes O( S + R )

15 CTL Model Checking Algorithm Boolean oerators are easy : Each state which is not labeled with should be labeled with q : Each state which is labeled with both and q should be labeled with q q : Each state which is labeled with or q should be labeled with q

16 CTL Model Checking Algorithm: EX EX is easy to do in O( S + R ) All the nodes which have a next state labeled with should be labeled with EX s1 s2 s4, EX, EX s1 s2 s4 EX

17 CTL Model Checking Algorithm: EU q EU q: Find the states which are the source of a ath where U q holds Find the nodes that reach a node that is labeled with q by a ath where each node is labeled with Label such nodes with EU q It is a reachability roblem which can be solved in O( S + R ) First label the nodes which satisfy q with EU q For each node labeled with EU q, label all its revious states that are labeled with with EU q

18 CTL Model Checking Algorithm: EU q s1 s2 s4 q, EU q, EU q s1 s2 s4 q, EU q

19 CTL Model Checking Algorithm: EG EG : Find infinite aths where each node on the ath is labeled with, and label nodes in such aths with EG First remove all the states which do not satisfy from the transition grah Comute the strongly connected comonents of the remaining grah, and then find the nodes which can reach the strongly connected comonents (both of which can be done in O( S + R ) Label the nodes in the strongly connected comonents and the nodes that can reach the strongly connected comonents with EG

20 CTL Model Checking Algorithm: EG s1 s2 s4 A strongly connected comonent s2 s4, EG, EG s1 s2 s4, EG

21 Verification vs. Falsification Verification: Show: initial states truth set of Falsification: Find: a state initial states truth set of Generate a counter-examle starting from that state Model checking algorithms can be modified to generate a counter-examle aths if the roerty is not satisfied without increasing the comlexity The ability to find counter-examles is one of the biggest strengths of the model checkers

22 Counter-Examle Generation Remember: Given a transition system T= (S, I, R) and a CTL roerty T = iff for all initial state s I, s = Verification vs. Falsification Verification: Show: initial states truth set of Falsification: Find: a state initial states truth set of Generate a counter-examle starting from that state The ability to find counter-examles is one of the biggest strengths of the model checkers

23 General Idea We can define two temoral logics using subsets of CTL oerators ACTL: CTL formulas which only use the temoral oerators AX, AG, AF and AU and all the negations aear only in atomic roerties (there are no negations outside of temoral oerators) ECTL: CTL formulas which only use the temoral oerators EX, EG, EF and EU and all the negations aear only in atomic roerties Given an ACTL roerty its negation is an ECTL roerty

24 An Examle If we wish to check the roerty AG() We can use the equivalence: AG() EF( ) If we can find an initial state which satisfies EF( ), then we know that the transition system T, does not satisfy the roerty AG()

25 Another Examle If we wish to check the roerty AF() We can use the equivalence: AF() EG( ) If we can find an initial state which satisfies EG( ), then we know that the transition system T, does not satisfy the roerty AF()

26 Counter-Examle Generation for ACTL Given an ACTL roerty, we negate it and comute the set of states which satisfy it is negation is an ECTL roerty If we can find an initial state which satisfies then we generate a counter-examle ath for starting from that initial state by following the states that are marked with Such a ath is called a witness for the ECTL roerty

27 Counter-examle generation for ACTL In general the counter-examle for an ACTL roerty (equivalently a witness to an ECTL roerty) is not a single ath For examle, the counter examle for the roerty AF(AG) would be a witness for the roerty EG(EF ) It is not ossible to characterize the witness for EG(EF ) as a single ath However it is ossible to generate tree-like transition grahs containing counter-examle behaviors as a counterexamle: Edmund M. Clarke, Somesh Jha, Yuan Lu, Helmut Veith: Tree-Like Counterexamles in Model Checking. LICS 2002: 19-29

28 Counter-examle generation for LTL Recall that, an LTL roerty f holds for a transition system T, if and only if, for all execution aths of T, f holds Then, to generate a counter-examle for an LTL roerty f, we need to show that there exists an execution ath for which f holds. Given an LTL roerty f, a counter-examle is an execution ath for which f holds

29 What About LTL and CTL* Model Checking? The comlexity of the model checking roblem for LTL and CTL* are: ( S + R ) 2 O( f ) Tyically the size of the formula is much smaller than the size of the transition system So the exonential comlexity in the size of the formula is not very significant in ractice