Interval Temporal Logic
Total Page:16
File Type:pdf, Size:1020Kb
Interval Temporal Logic Antonio Cau, Ben Moszkowski and Hussein Zedan Software Technology Research Laboratory December 6, 2007 HTML version of the ITL home page ITL-course: A not so short introduction to ITL Abstract Interval Temporal Logic (ITL) is a flexible notation for both propositional and first-order reasoning about periods of time found in descriptions of hardware and software systems. Unlike most temporal logics, ITL can handle both sequential and parallel composition and offers powerful and extensible specification and proof techniques for reasoning about properties involving safety, liveness and projected time[15]. Timing constraints are expressible and furthermore most imperative pro- gramming constructs can be viewed as formulas in a slightly modified version of ITL [25]. Tempura provides an executable framework for developing and experimenting with suitable ITL specifications. In addition, ITL and its mature executable subset Tempura [9] have been extensively used to specify the properties of real-time systems where the primitive circuits can directly be represented by a set of simple tempo- ral formulae. In addition, various researchers have applied Tempura to hardware simulation and other areas where timing is important. 1 Syntax The key notion of ITL is an interval. An interval σ is considered to be a (in)finite sequence of states σ0; σ1 :::, where a state σi is a mapping from the set of variables Var to the set of values V al. The length jσj of an interval σ0 : : : σn is equal to n (one less than the number of states in the interval (this has always been a convention in ITL), i.e., a one state interval has length 0). The syntax of ITL is defined in Table1 where z is an integer value, a is a static variable (doesn't change within an interval), A is a state variable (can change within an interval), v a static or state variable, g is a function symbol, p is a predicate symbol. 1 Table 1: Syntax of ITL Expressions exp ::= z j a j A j g(exp1; : : : ; expn) j {a: f Formulae ∗ f ::= p(exp1; : : : ; expn) j :f j f1 ^ f2 j 8v f j skip j f1 ; f2 j f q 2 Semantics The informal semantics of the most interesting constructs are as follows: • {a: f choose a value of a such that f holds. If there is no such an a then {a: f takes an arbitrary value from a's range. • skip unit interval (length 1). • f1 ; f2 holds if the interval can be decomposed (\chopped") into a prefix and suffix interval, such that f1 holds over the prefix and f2 over the suffix, or if the interval is infinite and f1 holds for that interval. • f ∗ holds if the interval is decomposable into a finite number of intervals such that for each of them f holds, or the interval is infinite and can be decomposed into an infinite number of finite intervals for which f holds. The formal semantics is listed in Table2: Let χ be a choice function which maps any nonempty set to some element in the set. 0 0 We write σ ∼v σ if the intervals σ and σ are identical with the possible exception of their mappings for the variable v. 3 Derived Constructs Frequently used derived constructs are listed in table3{6. 4 Propositional proof system In table7 we list the propositional axioms and rules for ITL. 5 First order proof system Some axioms for the first order case are shown in Table8. Let v refer to both static and state variables. e We denote by fv that in formula f expression e is substituted for variable v. 2 Table 2: Semantics of ITL Eσ[[v]] = σ0(v) Eσ[[g(exp1; : : : ; expn)]] =g ^(Eσ[[exp1]];:::; Eσ[[expn]]) ( χ(u) if u 6= fg Eσ[[{a: f]] = χ(Vala) otherwise 0 0 where u = fσ (a) j σ ∼a σ ^ Mσ0 [[f]] = ttg Mσ[[p(exp1; : : : ; expn)]] = tt iffp ^(Eσ[[exp1]];:::; Eσ[[expn]]) Mσ[[:f]] = tt iff Mσ[[f]] = ff Mσ[[f1 ^ f2]] = tt iff Mσ[[f1]] = tt and Mσ[[f2]] = tt 0 0 Mσ[[8v f]] = tt iff for all σ s.t. σ ∼v σ ; Mσ0 [[f]] = tt Mσ[[skipq]] = tt iff jσj = 1 Mσ[[f1 ; f2]] = tt iff (exists a k; s.t. Mσ0...σk [[f1]] = tt and ((σ is infinite and Mσk:::[[f2]] = tt) or (σ is finite and k ≤ jσj and Mσk...σjσj [[f2]] = tt))) or (σ is infinite and Mσ[[f1]]) ∗ Mσ[[f ]] = tt iff if σ is infinite then (exist l0; : : : ; ln s.t. l0 = 0 and M [[f]] = tt and σln ::: for all 0 ≤ i < n, l < l and M [[f]] = tt) i i+1 σli ...σli+1 or (exist an infinite number of li s.t. l0 = 0 and for all 0 ≤ i; l < l and M [[f]] = tt) i i+1 σli ...σli+1 else (exist l0; : : : ; ln s.t. l0 = 0 and ln = jσj and for all 0 ≤ i < n; l < l and M [[f]] = tt) i i+1 σli ...σli+1 3 Table 3: Frequently used non-temporal derived constructs true =b 0 = 0 true value false =b :true false value f1 _ f2 =b :(:f1 ^ :f2) or f1 ⊃ f2 =b :f1 _ f2 implies f1 ≡ f2 =b (f1 ⊃ f2) ^ (f2 ⊃ f1) equivalent 9v f =b :8v :f exists q q Table 4: Frequently used temporal derived constructs f =b skip ; f next more =b true non-empty interval empty =b :more empty interval inf =b true ; false infinite interval isinf (f) =b inf ^ f is infinite finite =b :inf finite interval isfin (f) =b finite ^ f is finite fmore =b more ^ finite non-empty finite interval 3f =b finite ; f sometimes 2f =b :3:f always w f =b : :f weak next 3i f =b f ; true some initial subinterval 2i f =b :(3i :f) all initial subintervals 3a f =b finite ; f ; true some subinterval 2a f =b :(3a :f) all subintervals Table 5: Frequently used concrete derived constructs if f0 then f1 else f2 =b (f0 ^ f1) _ (:f0 ^ f2) if then else if f0 then f1 =b if f0 then f1 else empty if then fin f =b 2(empty ⊃ f) final state sfin f =b :(fin (:f)) strong final state halt f =b 2(empty ≡ f) terminate interval when shalt f =b :(halt (:f)) strong terminate interval when keep f =b 2a (skip ⊃ f) all unit subintervals keepnow f =b 3i (skip ^ f) initial unit subinterval ! ∗ f =b isinf (isfin (f) ) infinite chopstar ∗ fstar (f) =b isfin (isfin (f) ) _ isfin (isfin (f)∗); isinf (f) finite chopstar ∗ while f0 do f1 =b (f0 ^ f1) ^ fin :f0 while loop repeat f0 until f1 =b f0 ;(while :f1 do f0) repeat loop 4 Table 6: Frequently used derived constructs related to expressions exp =b {a: (exp = a) next value fin exp =b {a: fin (exp = a) end value A := exp =b A = exp assignment exp1 ≈ exp2 =b 2(exp1 = exp2) equal in interval exp1 exp2 =b finite ^ (fin exp1) = exp2 temporal assignment exp1 gets exp2 =b keep (exp1 exp2) gets stable exp =b exp gets exp stability padded exp =b (stable (exp); skip) _ empty padded expression exp1 <∼ exp2 =b (exp1 exp2) ^ padded exp1 padded temporal assignment goodindex exp =b keep (exp exp _ exp exp + 1) goodindex intlen (exp) =b 9I (I = 0) ^ (I gets I + 1) ^ (I exp) interval length q Table 7: Propositional Axioms and Rules for ITL. ChopAssoc ` (f0; f1); f2 ≡ f0;(f1; f2) OrChopImp ` (f0 _ f1); f2 ⊃ (f0; f2) _ (f1; f2) ChopOrImp ` f0;(f1 _ f2) ⊃ (f0; f1) _ (f0; f2) EmptyChop ` empty; f1 ≡ f1 ChopEmpty ` f1; empty ≡ f1 BiBoxChopImpChop ` 2i (f0 ⊃ f1) ^ 2(f2 ⊃ f3) ⊃ (f0; f2) ⊃ (f1; f3) StateImpBi ` p ⊃ 2i p NextImpNotNextNot ` f0 ⊃ : :f0 KeepnowImpNotKeepnowNot ` keepnow (f0) ⊃ : keepnow (:f0) BoxInduct ` f0 ^ 2(f0 ⊃ w f0) ⊃ 2f0 InfChop ` (f0 ^ inf); f1 ≡ (f0 ^ inf) ∗ ∗ ChopStarEqv ` f0 ≡ (empty _ ((f0 ^ more); f0 )) ∗ ChopstarInduct ` (inf ^ f0 ^ 2(f0 ⊃ (f1 ^ fmore); f0)) ⊃ f1 MP ` f0 ⊃ f1; ` f0 ) ` f1 BoxGen ` f0 ) ` 2f0 BiGen ` f0 ) ` 2i f0 5 Table 8: Some First Order Axioms and Rules for ITL. e ForallSub ` 8v f ⊃ fv , where theq expression e has the same data and temporal type as the variable v and is free for v in f. ForallImplies ` 8v (f1 ⊃ f2) ⊃ (f1 ⊃ 8v f2); where vqdoesn't occur freely in f1.q B SubstAxiom ` 2(A = B) ⊃ f ≡ fA : StaticWeakNext ` w ⊃ w w, where w only contains static variables. ExistsChopRight ` 9v (f1; f2) ⊃ (9v f1); f2, where vqdoesn't occur freelyq in f2. ExistsChopLeft ` 9v (f1; f2) ⊃ f1;(9v f2), where vqdoesn't occur freelyq in f1. ExistsImpDesc ` (9v f) ^ ({v: f) = v ⊃ f, where v isq a static variable. ForallGen ` f ) ` 8v f, for any variable v. q 6 6 Tools 6.1 (Ana)Tempura Tempura, the C-Tempura interpreter version 2.7 developed originally by Roger Hale and now maintained by Antonio Cau and Ben Moszkowski, is an interpreter for executable Interval Temporal Logic formulae. The first Tempura interpreter was programmed in Prolog by Ben Moszkowski, and was operational around December 2, 1983. Subsequently he rewrote the interpreter in Lisp (mid Mar, 1984), and in late 1984 modified the program to handle a two-level memory and multi-pass scanning. The C-Tempura interpreter was written in early 1985 by Roger Hale at Cambridge University. AnaTempura, which is built upon C-Tempura, is a tool for the runtime verification of systems using Interval Temporal Logic (ITL) and its executable subset Tempura. The runtime verification technique uses assertion points to check whether a system satisfies timing, safety or security properties expressed in ITL.