Temporal Logic

Lecture, October 2019 Temporal logic What I will present today

Semantics of CTL

More examples of CTL algorithm (mutual exclusion)

A better algorithm for computing [[EGψ]]

A similar algorithm with fairness

Connection with fixpoint results on posets

Deciding = ψ in LTL | This corresponds to Chapters 2.6 and 2.7 in the book

1 Temporal logic Semantics of CTL

s = AXψ if s0 = ψ for all s0 N(s) | | ∈ s = EXψ if s0 = ψ for some s0 N(s) | | ∈

2 Temporal logic Semantics of CTL

s = EGψ if there exists a path σ starting from s such that σ(k) = ψ for all k | | s = EF ψ if there exists a path σ starting from s with σ(k) = ψ for some k | | s = AF ψ if for all path σ starting from s there exists k such that σ(k) = ψ | | s = AGψ if for all path σ starting from s we have σ(k) = ψ for all k | |

3 Temporal logic Fixpoint characterisation of CTL

s = EGψ means that there exists a path σ starting from s and such that σ(k) |= ψ for all k | Alternatively using EGψ = ψ EX(EGψ) we have seen that [[EGψ]] is the greatest set Z such that ∧

Z = [[ψ]] p∃(Z) ∩ where p∃(Y ) = s S N(s) Y = { ∈ | ∩ 6 ∅}

4 Temporal logic Fixpoint characterisation of CTL

We compute [[EGψ]] by the approximation algorithm

Z0 = [[ψ]] Zn+1 = Zn p∃(Zn) ∩

5 Temporal logic Fixpoint characterisation of CTL

s = AF ψ means that for all path σ starting from s we have σ(k) = ψ for some |k |

Alternatively using AF ψ = ψ AX(AF ψ) we have seen that [[AF ψ]] is the least set Z such that ∨

Z = [[ψ]] p∀(Z) ∪ where p∀(Y ) = s S N(s) Y { ∈ | ⊆ }

6 Temporal logic Fixpoint characterisation of CTL

We compute [[AF ψ]] by the approximation/labelling algorithm

Z0 = [[ψ]] Zn+1 = Zn p∀(Zn) ∪

7 Temporal logic Alternative algorithm for EGψ

Here is another clever algorithm for computing EGψ

It uses the notion of strongly connected component

By duality we get an alternative algorithm for computing AF ψ

8 Directed Graphs

In a directed graph G=(V,E), two nodes u and v are strongly connected if and only if there is a path from u to v and a path from v to u.

The strongly connected is an . Its equivalence classes are the strongly connected components.

Directed Graphs

In a directed graph G=(V,E), two nodes u and v are strongly connected if and only if there is a path from u to v and a path from v to u.

The strongly connected relation is an equivalence relation. Its equivalence classes are the strongly connected components.

Every node is in precisely one strongly connected component, since the equivalence classes partition the set of nodes. Component Graph

Take a directed graph G=(V,E) and let ≡ be the strongly connected scc relation. Then we can define a graph G = (V/≡, E≡), where the nodes are the strongly connected components of G and there is an edge from component C to component D iff there is an edge in G from a vertex in C to a vertex in D. Temporal logic Strongly Connected Components

R is a relation on a set S, so R S S ⊆ × We can consider the reflexive transitive closure R∗ of R

R∗(a, b) means that a = b or that there exists a path going from a to b

S,R∗ is a

We may not have R∗(a, b) R∗(b, a) a = b ∧ →

12 Temporal logic Strongly Connected Components

The relation a b defined by ≡ R∗(a, b) R∗(b, a) ∧ is a reflexive, symetric and

This is an equivalence relation

A strongly connected component (SCC) of the graph S,R is an equivalence class for the relation a b ≡

13 Temporal logic Condensation graph

If we have two different equivalence classes X and Y we define a new relation R(X,Y ) to mean R(a, b) for all a X and b Y ∈ ∈ This is equivalent to R(a, b) for some a X and b Y ∈ ∈ This new relation R is a strict poset relation

The associated graph is a directed acyclic graph

This is the condensation graph of the initial graph

14 Temporal logic Strongly Connected Components

Linear time algorithms to compute the strongly connected components

-Kosaraju

-Tarjan

-Dijkstra

A SCC is non trivial if it contains at least one arrow

Note that it may have only one point

15 Temporal logic Alternative algorithm

We compute the SCCs of the graph restricted to [[ψ]]

The “good” states are the one connected to a non trivial SCC

Non trivial means that there is at least one arrow in this component

Example of this algorithm for mutual exclusion

16 Temporal logic Alternative algorithm with fairness

One interesting feature of this algorithm is that we can refine it by asking some fairness constraints

A fairness contraint C = ψ1, . . . , ψn is given by formulae

s = EGCψ means that there exists a path σ starting from s such that | σ(k) = ψ for all k and σ is fair for C means that σ(k) = ψi for infinitely many k, for| each i = 1, . . . , n |

17 Temporal logic Alternative algorithm with fairness

The only modification in the previous algorithm is to look for a non trivial SCC B such that

B [[ψ1]] = ,...,B [[ψn]] = ∩ 6 ∅ ∩ 6 ∅ i.e. B meets each [[ψi]] for i = 1, . . . , n

18 Temporal logic Fixpoint characterisation of CTL

s = EGψ means that there exists a path σ starting from s and such that σ(k) |= ψ for all k | Alternatively using EGψ = ψ EX(EGψ) we have seen that [[EGψ]] is the greatest set Z such that ∧

Z = [[ψ]] p∃(Z) ∩ where p∃(Y ) = s S N(s) Y = { ∈ | ∩ 6 ∅}

19 Temporal logic Fixpoint characterisation of CTL

Note that F : Z [[ψ]] p∃(Z) is a monotone function 7→ ∧ We have seen the following result

Theorem: if F : P ow(S) P ow(S) is a monotone function then it has a greatest fixed point, which→ is computed by the approximation algorithm Y0 = S,Yn+1 = F (Yn) until we have Yn+1 = Yn

20 Temporal logic Fixpoint characterisation of CTL

So the algorithm for computing the greated fixpoint is

(1) Y0 = S,Yn+1 = [[ψ]] p∃(Yn) ∩ On the other hand, the approximation/labelling algorithm we have used is given by

(2) Z0 = [[ψ]],Zn+1 = Zn p∃(Zn) ∩ This is not the same!!

How to connect the two algorithms?

21 Temporal logic Discussion

The algorithm (2) is more efficient than (1)

(1) follows from a general method of computing fixpoint

The method we show to prove the correctness of (2) is to prove that (1) and (2) are equivalent without trying to prove directly the correctness of (2) but we rely on the correctness of (1)

This is a usual pattern: to prove the correctness of an algorithm w.r.t. a specification it is sometimes easier to prove that this algorithm is equivalent to a less efficient but clearly correct other algorithm

22 Temporal logic Fixpoint

We have

(1) Y0 = S,Yn+1 = [[ψ]] p∃(Yn) ∩ (2) Z0 = [[ψ]],Zn+1 = Zn p∃(Zn) ∩ Theorem: We have Yn+1 = Zn for all n

23 Temporal logic Fixpoint

To simplify the notation we write A = [[ψ]] and p = p∃

(1) Y0 = S,Yn+1 = A p(Yn) ∩ (2) Z0 = A, Zn+1 = Zn p(Zn) ∩ Lemma: We have A p(Zn) Zn for all n ∩ ⊆ We prove this by induction on n

24 Temporal logic Fixpoint

(1) Y0 = S,Yn+1 = A p(Yn) ∩ (2) Z0 = A, Zn+1 = Zn p(Zn) ∩ Lemma: We have A p(Zn) Zn for all n ∩ ⊆ Theorem: We have Zn = Yn+1 for all n

So the labelling algorithm is justified by the fixpoint algorithm!

25 Temporal logic Deciding a LTL formula

Theorem: The problem = ψ is decidable | This is a non trivial result

I sketch a possible proof since it uses a very interesting method

The Tableau Method

26 Temporal logic Tableau method

We can consider the following syntax

ψ, ϕ ::= p p ψ ψ ψ ψ Xψ F ψ Gψ | ¬ | ∨ | ∧ | | | since using de Morgan laws, we can always assume that negation appears only in front of atomic formulae

Also ψ0 ψ1 can be replaced by ψ0 ψ1 → ¬ ∨ We give an algorithm to decide if a finite set of formulae Γ can be satisfied

27 Temporal logic Tableau method

For instance (G(p Xp) p Gp) can be written ¬ → ∧ → G(p Xp) p (Gp) → ∧ ∧ ¬ and then

G( p Xp) p F ( p) ¬ ∨ ∧ ∧ ¬

28 Temporal logic Good sets

A literal is a formula of the form p or p ¬ A finite set ∆ is good if it contains only literals or formulae of the form Xψ

It should not contain both p and p ¬ We write X−1∆ the set of ψ such that Xψ ∆ ∈ We write ∆, ∆0,... for good sets

Note that the empty set is a good set

29 Temporal logic Tableau method

The first step is to compute a list K(Γ) of good sets ∆1,..., ∆n such that

σ = Γ if and only if σ = ∆i for some i | |

30 Temporal logic Tableau method

In propositional logic this is like computing a disjunctive normal form

K((p q) (r s)) has for elements ∨ ∧ ∨ p, r and p, s and q, r and q, s

K((p q) ( p s)) has for elements ∨ ∧ ¬ ∨ p, s and q, p and q, s ¬ In LTL we use Gψ ψ XGψ and F ψ ψ XF ψ ≡ ∧ ≡ ∨

31 Synthesis of Boolean programs

Specication of a Boolean program: If the boss is in, I need to work unless the telephone rings. If the boss is not in, I go drink tea.

b =boss is in, r =telephone rings, w =I work, w 0 =I drink tea

φ(b, r, w) = br 0 w b0 w 0 → → = w 0 br 0 0 + wb = w 0 b0 + r + wb Goal: given any b and r, compute  w such that φ(b,r, w) = 1. One solution is just φ(b, r, w = 1):

w = φ(b, r, 1) = 0 b0 + r + 1b = b I work if and only if the boss is in 

(Other solutions exist, e.g. w = br 0) Sergei Winitzki (Versal Group Inc.) Temporal Logic and FRP April 25, 2014 7 / 23 LTL: temporal specication

Whenever the boss comes by my oce, I will start working. Once I start working, I will keep working until the telephone rings.

G ((b Fw)(w wUr)) = G b0 + Fw w 0 + wUr → → Whenever the button is pressed, the dialog will appear.  The dialog will disappear after 1 minute of user inactivity.

G (b Fd)(d Ft) d dUtd 0 → → → The timer t is an external event and is not specied here Dicult to say x stays true until further notice

Sergei Winitzki (Versal Group Inc.) Temporal Logic and FRP April 25, 2014 11 / 23 Temporal logic Tableau method

K(F p) has two elements p and XF p

K(Gp) has one element p, XGp

K(Γ) where Γ = F p, F ( p) has three elements p, XF ( p) and p, XF p and XF p, XF ( p) ¬ ¬ ¬ ¬ K(Gp, G( p)) is empty ¬

34 Temporal logic Tableau method

K(Γ) where Γ = F (p q),G( p),G( q) has only one element ∨ ¬ ¬ XF (p q),XG( p),XG( q), p, q ∨ ¬ ¬ ¬ ¬ K(Γ) where Γ = F p, F q, G( p q) has for elements ¬ ∨ ¬ p, q, XF q, XG( p q) ¬ ¬ ∨ ¬ p, q, XF p, XG( p q) ¬ ¬ ∨ ¬ p, XF p, XF q, XG( p q) ¬ ¬ ∨ ¬ q, XF p, XF q, XG( p q) ¬ ¬ ∨ ¬

35 Temporal logic Tableau method

We define a finite transition system starting from Γ

The first elements are all elements in K(Γ)

If ∆ is in, we add all elements in K(X−1∆) where X−1∆ = ψ Xψ ∆ { | ∈ } We have ∆ ∆0 if ∆0 K(X−1∆) → ∈ L(∆) is the set of atoms p such that p ∆ ∈

36 Temporal logic Tableau method

We define “∆ validates ψ” by induction on ψ

ψ = p it means p in ∆

ψ = p it means p in ∆ ¬ ¬ ψ = ψ0 ψ1 it means ∆ validates ψ0 and ψ1 ∧ ψ = ψ0 ψ1 it means ∆ validates ψ0 or ψ1 ∨ ψ = F ϕ it means XF ϕ in ∆ or ∆ validates ϕ

ψ = Gϕ it means XGϕ in ∆ and ∆ validates ϕ

37 Temporal logic Tableau method

A path ∆0 ∆1 ... in this transition system is good if whenever F ψ ∆i → → ∈ there exists j i such that ψ ∆j > ∈ Theorem: If σ is a good path then σ = Γ | Theorem: Γ is satisfiable if and only if there exists a good path

Theorem: There exists a good path if and only if there exists a non trivial SCC having the property that XF ψ ∆ for ∆ in this SCC implies ∆0 validates ψ for some ∆0 in the same SCC ∈

38 Temporal logic Tableau method

In this way we can check for instance G(p Xp) p Gp → ∧ → We start from Γ = G( p Xp), p, F ( p) we compute K(Γ) which has only one element ∆ = p, Xp,¬ XF∨( p),XG(¬p Xp) ¬ ¬ ∨ We have ∆ ∆ → This does not define a good path

XF ( p) ∆ but ∆ does not validate p ¬ ∈ ¬ So Γ is not satisfiable and = G(p Xp) p Gp | → ∧ →

39 Temporal logic Tableau method

Similarly we can check F (p q) (F p F q) ∨ → ∨ We find automatically a counter-example to (F p F q) F (p q) ∧ → ∧

40