sawine@7
|
1 |
\documentclass[a4paper, pagesize, DIV=calc, smallheadings]{article}
|
sawine@2
|
2 |
\usepackage{graphicx}
|
sawine@2
|
3 |
%\usepackage[latin1]{inputenc}
|
sawine@14
|
4 |
\usepackage{amsmath, amsthm, amssymb, amsfonts, verbatim}
|
sawine@2
|
5 |
\usepackage{typearea}
|
sawine@2
|
6 |
\usepackage{algorithm}
|
sawine@2
|
7 |
\usepackage{algorithmic}
|
sawine@15
|
8 |
\usepackage{multicol}
|
sawine@11
|
9 |
%\usepackage{fullpage}
|
sawine@19
|
10 |
%\usepackage{a4wide}
|
sawine@19
|
11 |
\usepackage[left=3.9cm, right=3.9cm]{geometry}
|
sawine@5
|
12 |
%\usepackage[T1]{fontenc}
|
sawine@5
|
13 |
%\usepackage{arev}
|
sawine@7
|
14 |
%\pagestyle{headings}
|
sawine@19
|
15 |
|
sawine@2
|
16 |
\renewcommand{\familydefault}{\sfdefault}
|
sawine@17
|
17 |
\newcommand{\M}{\mathcal{M}}
|
sawine@17
|
18 |
\newcommand{\N}{\mathbb{N}_0}
|
sawine@19
|
19 |
\newcommand{\F}{\mathcal{F}}
|
sawine@19
|
20 |
\newcommand{\Prop}{\mathcal{P}}
|
sawine@19
|
21 |
|
sawine@7
|
22 |
\title{\uppercase{\textbf{\Large{A}\large{lgorithmic} \Large{V}\large{erification of} \Large{R}\large{eactive} \Large{S}\large{ystems}}\\
|
sawine@7
|
23 |
\tiny{Draft}
|
sawine@7
|
24 |
}}
|
sawine@7
|
25 |
\author{
|
sawine@19
|
26 |
\uppercase{{\small{E}\scriptsize{UGEN} \small{S}\scriptsize{AWIN}}\thanks{\lowercase{\scriptsize{\texttt{sawine@informatik.uni-freiburg.de}}}}\\
|
sawine@19
|
27 |
{\em \small{U}\scriptsize{NIVERSITY OF} \small{F}\scriptsize{REIBURG}}\thanks{\tiny{Computer Science Department, Research Group for Foundations of Artificial Intelligence}}\\
|
sawine@7
|
28 |
%{\em \small{C}\scriptsize{omputer} \small{S}\scriptsize{cience} \small{D}\scriptsize{epartment}}\\
|
sawine@7
|
29 |
{\em \small{G}\scriptsize{ERMANY}}}\\
|
sawine@7
|
30 |
%\texttt{\footnotesize{sawine@informatik.uni-freiburg.de}}
|
sawine@7
|
31 |
}
|
sawine@5
|
32 |
\date{\textsc{\hfill}}
|
sawine@7
|
33 |
|
sawine@15
|
34 |
\theoremstyle{definition} %plain, definition, remark, proposition, proof, corrolary
|
sawine@7
|
35 |
\newtheorem*{def:finite words}{Finite words}
|
sawine@7
|
36 |
\newtheorem*{def:infinite words}{Infinite words}
|
sawine@8
|
37 |
\newtheorem*{def:regular languages}{Regular languages}
|
sawine@8
|
38 |
\newtheorem*{def:regular languages closure}{Regular closure}
|
sawine@7
|
39 |
\newtheorem*{def:omega regular languages}{$\omega$-regular languages}
|
sawine@8
|
40 |
\newtheorem*{def:omega regular languages closure}{$\omega$-regular closure}
|
sawine@11
|
41 |
\newtheorem*{def:buechi automata}{Automata}
|
sawine@11
|
42 |
\newtheorem*{def:automata runs}{Runs}
|
sawine@11
|
43 |
\newtheorem*{def:automata acceptance}{Acceptance}
|
sawine@21
|
44 |
\newtheorem*{def:general automata}{Generalised automata}
|
sawine@21
|
45 |
\newtheorem*{def:general acceptance}{Acceptance}
|
sawine@14
|
46 |
\newtheorem*{def:vocabulary}{Vocabulary}
|
sawine@19
|
47 |
\newtheorem*{def:frames}{Frames}
|
sawine@18
|
48 |
\newtheorem*{def:models}{Models}
|
sawine@18
|
49 |
\newtheorem*{def:satisfiability}{Satisfiability}
|
sawine@14
|
50 |
|
sawine@15
|
51 |
\theoremstyle{proposition}
|
sawine@21
|
52 |
\newtheorem{prop:vocabulary sat}{Proposition}[section]
|
sawine@21
|
53 |
\newtheorem{prop:general equiv}{Proposition}[section]
|
sawine@15
|
54 |
|
sawine@0
|
55 |
\begin{document}
|
sawine@0
|
56 |
\maketitle
|
sawine@4
|
57 |
\thispagestyle{empty}
|
sawine@2
|
58 |
%\itshape
|
sawine@2
|
59 |
%\renewcommand\abstractname{Abstract}
|
sawine@0
|
60 |
\begin{abstract}
|
sawine@0
|
61 |
Over the past two decades, temporal logic has become a very basic tool for spec-
|
sawine@0
|
62 |
ifying properties of reactive systems. For finite-state systems, it is possible to use
|
sawine@0
|
63 |
techniques based on B\"uchi automata to verify if a system meets its specifications.
|
sawine@0
|
64 |
This is done by synthesizing an automaton which generates all possible models of
|
sawine@0
|
65 |
the given specification and then verifying if the given system refines this most gen-
|
sawine@0
|
66 |
eral automaton. In these notes, we present a self-contained introduction to the basic
|
sawine@0
|
67 |
techniques used for this automated verification. We also describe some recent space-
|
sawine@0
|
68 |
efficient techniques which work on-the-fly.
|
sawine@0
|
69 |
\end{abstract}
|
sawine@2
|
70 |
%\normalfont
|
sawine@4
|
71 |
\newpage
|
sawine@2
|
72 |
\section{Introduction}
|
sawine@2
|
73 |
Program verification is a fundamental area of study in computer science. The broad goal
|
sawine@5
|
74 |
is to verify whether a program is ``correct''--i.e., whether the implementation of a program
|
sawine@2
|
75 |
meets its specification. This is, in general, too ambitious a goal and several assumptions
|
sawine@2
|
76 |
have to be made in order to render the problem tractable. In these lectures, we will focus
|
sawine@2
|
77 |
on the verification of finite-state reactive programs. For specifying properties of programs,
|
sawine@2
|
78 |
we use linear time temporal logic.
|
sawine@2
|
79 |
|
sawine@2
|
80 |
What is a reactive program? The general pattern along which a conventional program
|
sawine@2
|
81 |
executes is the following: it accepts an input, performs some computation, and yields an
|
sawine@2
|
82 |
output. Thus, such a program can be viewed as an abstract function from an input domain
|
sawine@2
|
83 |
to an output domain whose behaviour consists of a transformation from initial states to
|
sawine@2
|
84 |
final states.
|
sawine@2
|
85 |
|
sawine@2
|
86 |
In contrast, a reactive program is not expected to terminate. As the name suggests, such
|
sawine@2
|
87 |
systems “react” to their environment on a continuous basis, responding appropriately to
|
sawine@2
|
88 |
each input. Examples of such systems include operating systems, schedulers, discrete-event
|
sawine@2
|
89 |
controllers etc. (Often, reactive systems are complex distributed programs, so concurrency
|
sawine@2
|
90 |
also has to be taken into account. We will not stress on this aspect in these lectures—we
|
sawine@2
|
91 |
take the view that a run of a distributed system can be represented as a sequence, by
|
sawine@2
|
92 |
arbitrarily interleaving concurrent actions.)
|
sawine@2
|
93 |
|
sawine@2
|
94 |
To specify the behaviour of a reactive system, we need a mechanism for talking about
|
sawine@2
|
95 |
the way the system evolves along potentially infinite computations. Temporal logic
|
sawine@2
|
96 |
has become a well-established formalism for this purpose. Many varieties of temporal logic
|
sawine@2
|
97 |
have been defined in the past twenty years—we focus on propositional linear time temporal
|
sawine@2
|
98 |
logic (LTL).
|
sawine@2
|
99 |
|
sawine@2
|
100 |
There is an intimate connection between models of LTL formulas and languages of
|
sawine@2
|
101 |
infinite words—the models of an LTL formula constitute an ω-regular language over an
|
sawine@2
|
102 |
appropriate alphabet. As a result, the satisfiability problem for LTL reduces to checking
|
sawine@2
|
103 |
for emptiness of ω-regular languages. This connection was first explicitly pointed out in.
|
sawine@2
|
104 |
|
sawine@8
|
105 |
\section{$\omega$-regular languages}
|
sawine@7
|
106 |
\begin{def:finite words}
|
sawine@11
|
107 |
Let $\Sigma$ be a non-empty set of symbols, called the alphabet. $\Sigma^*$ is the set of all \emph{finite} words over $\Sigma$. A \emph{finite} word $w \in \Sigma^*$ is a \emph{finite} sequence $v_0,...,v_{n-1}$ of symbols from alphabet $\Sigma$ with length $n = |w|$. $\varepsilon$ denotes the empty word with length $|\varepsilon| = 0$.
|
sawine@7
|
108 |
\end{def:finite words}
|
sawine@7
|
109 |
|
sawine@8
|
110 |
\begin{def:regular languages}
|
sawine@8
|
111 |
The class of regular languages is defined recursively over an alphabet $\Sigma$:
|
sawine@15
|
112 |
\begin{multicols}{2}
|
sawine@8
|
113 |
\begin{itemize}
|
sawine@8
|
114 |
\item $\emptyset$ is regular
|
sawine@8
|
115 |
\item $\{\varepsilon\}$ is regular
|
sawine@8
|
116 |
\item $\forall_{a \in \Sigma}:\{a\}$ is regular
|
sawine@8
|
117 |
\end{itemize}
|
sawine@15
|
118 |
\end{multicols}
|
sawine@8
|
119 |
\end{def:regular languages}
|
sawine@8
|
120 |
|
sawine@8
|
121 |
\begin{def:regular languages closure}
|
sawine@10
|
122 |
Let $L_{R_1}, L_{R_2} \in \Sigma^*$ be regular. The class of regular languages is closed under following operations:
|
sawine@15
|
123 |
\begin{multicols}{2}
|
sawine@8
|
124 |
\begin{itemize}
|
sawine@8
|
125 |
\item $L_{R_1}^*$
|
sawine@8
|
126 |
\item $L_{R_1} \circ L_{R_2}$
|
sawine@8
|
127 |
\item $L_{R_1} \cup L_{R_2}$
|
sawine@10
|
128 |
\item $L_{R_1} \cap L_{R_2}$
|
sawine@10
|
129 |
\item $\overline{L}_{R_1}$ and therefore $L_{R_1} - L_{R_2}$
|
sawine@8
|
130 |
\end{itemize}
|
sawine@15
|
131 |
\end{multicols}
|
sawine@8
|
132 |
\end{def:regular languages closure}
|
sawine@8
|
133 |
|
sawine@9
|
134 |
\begin{def:infinite words}
|
sawine@17
|
135 |
$\Sigma^\omega$ is the set of all \emph{infinite} words over $\Sigma$. An \emph{infinite} word $w \in \Sigma^\omega$ is an \emph{infinite} sequence $v_0,...,v_\infty$ with length $\infty$. To address the elements of the infinite sequence $w$, we view the word as a function $w : \N \to \Sigma$ with $w(i) = v_i$; thus $w(i)$ denotes the symbol at sequence position $i$ of word $w$; another notation used for $w(i)$ is $w_i$.
|
sawine@9
|
136 |
\end{def:infinite words}
|
sawine@9
|
137 |
|
sawine@7
|
138 |
\begin{def:omega regular languages}
|
sawine@8
|
139 |
Set $L$ is an $\omega$-language over alphabet $\Sigma$ iff $L \subseteq \Sigma^\omega$. Let $L_R \subseteq \Sigma^*$ be a non-empty regular finite language and $\varepsilon \notin L_R$. A set $L$ is $\omega$-regular iff $L$ is an $\omega$-language and $L = L_R^\omega$.
|
sawine@7
|
140 |
\end{def:omega regular languages}
|
sawine@7
|
141 |
|
sawine@8
|
142 |
\begin{def:omega regular languages closure}
|
sawine@8
|
143 |
Let $L_{\omega_1}, L_{\omega_2} \subseteq \Sigma^\omega$ be $\omega$-regular languages. The class of $\omega$-regular languages is closed under following operations:
|
sawine@8
|
144 |
\begin{itemize}
|
sawine@8
|
145 |
\item $L_R \circ L_{\omega_1}$, but \emph{not} $L_{\omega_1} \circ L_R$
|
sawine@8
|
146 |
\item $L_{\omega_1} \cup L_{\omega_2}$, but only \emph{finitely} many times
|
sawine@8
|
147 |
\end{itemize}
|
sawine@8
|
148 |
\end{def:omega regular languages closure}
|
sawine@7
|
149 |
|
sawine@8
|
150 |
\section{B\"uchi automata}
|
sawine@11
|
151 |
\begin{def:buechi automata}
|
sawine@15
|
152 |
A non-deterministic B\"uchi automaton is a tuple $A = (\Sigma, S, S_0, \Delta, F)$, where $\Sigma$ is a finite non-empty \emph{alphabet}, $S$ is a finite non-empty set of \emph{states}, $S_0 \subseteq S$ is the set of \emph{initial states}, $F \subseteq S$ is the set of \emph{accepting states} and $\Delta: S \times \Sigma \times S$ is a \emph{transition relation}. When suitable we will use the arrow notation for the transitions, where $s \xrightarrow{a} s'$ iff $(s, a, s') \in \Delta$.
|
sawine@11
|
153 |
|
sawine@21
|
154 |
A \emph{deterministic B\"uchi automaton} is a specialisation where the \emph{transition relation} $\Delta$ is a \emph{transition function} $\delta: S \times \Sigma \to S$ and the set $S_0$ of \emph{initial states} contains only a single state $s_0$.
|
sawine@11
|
155 |
|
sawine@19
|
156 |
Within this text \emph{automaton} will refer to the non-deterministic B\"uchi automaton, unless otherwise noted.
|
sawine@11
|
157 |
\end{def:buechi automata}
|
sawine@11
|
158 |
|
sawine@11
|
159 |
\begin{def:automata runs}
|
sawine@17
|
160 |
Let $A = (\Sigma, S, S_0, \Delta, F)$ be an automaton, a run $\rho$ of $A$ on an infinite word $w = a_0,a_1,...$ over alphabet $\Sigma$ is a sequence $\rho = s_0,s_1,...$, where $s_0 \in S_0$ and $(s_i, a_i, s_{i+1}) \in \Delta$, for all $i \geq 0$. Again we may view the run sequence as a function $\rho : \N \to S$, where $\rho(i) = s_i$ denotes the state at the $i^{th}$ sequence position.
|
sawine@11
|
161 |
\end{def:automata runs}
|
sawine@11
|
162 |
|
sawine@11
|
163 |
\begin{def:automata acceptance}
|
sawine@17
|
164 |
Let $A = (\Sigma, S, S_0, \Delta, F)$ be an automaton and let $\rho$ be a run of $A$, we define $inf(\rho) = \{s \in S \mid \exists^\omega{n \in \N}: \rho(n) = s\}$, where $\exists^\omega$ denotes the existential quantifier for infinitely many occurances, i.e., $s$ occurs infinitely often in $\rho$.
|
sawine@11
|
165 |
|
sawine@21
|
166 |
The run $\rho$ is \emph{accepting} iff $inf(\rho) \cap F \neq \emptyset$, i.e., there exists an \emph{accepting state} which occurs infinitely often in the run $\rho$. The automaton $A$ \emph{accepts} an input word $w$, iff there exists a run $\rho$ of $A$ on $w$, such that $\rho$ is \emph{accepting}.
|
sawine@21
|
167 |
|
sawine@21
|
168 |
The language $L_\omega(A)$ recognised by automaton $A$ is the set of all infinite words accepted by $A$. A language $L$ is \emph{B\"uchi-recognisable} iff there is an automaton $A$ with $L = L_\omega(A)$.
|
sawine@11
|
169 |
\end{def:automata acceptance}
|
sawine@11
|
170 |
|
sawine@21
|
171 |
\subsection{Generalised B\"uchi automata}
|
sawine@21
|
172 |
\begin{def:general automata}
|
sawine@21
|
173 |
A \emph{generalised B\"uchi automaton} $A$ is a tuple $(\Sigma, S, S_0, \Delta, \{F_i\}_{i < k})$ for $i, k \in \N$, where the \emph{acceppting states} $F_i$ are composed within a finite set with $F_i \subseteq S$.
|
sawine@21
|
174 |
\end{def:general automata}
|
sawine@21
|
175 |
|
sawine@21
|
176 |
\begin{def:general acceptance}
|
sawine@21
|
177 |
The acceptance condition is adjusted accordingly. A run $\rho$ of $A$ is \emph{accepting} iff $\forall{i < k}: inf(\rho) \cap F_i \neq \emptyset$.
|
sawine@21
|
178 |
\end{def:general acceptance}
|
sawine@21
|
179 |
|
sawine@21
|
180 |
\begin{prop:general equiv}
|
sawine@21
|
181 |
Let $A = (\Sigma, S, S_0, \Delta, \{F_i\}_{i < k})$ be a \emph{generalised automaton} and let $A_i = (\Sigma, S, S_0, \Delta, F_i)$ be \emph{non-deterministic automata}, then following equivalance condition holds:
|
sawine@21
|
182 |
\[L(A) = \bigcap_{i < k} L(A_i)\]
|
sawine@21
|
183 |
\end{prop:general equiv}
|
sawine@21
|
184 |
\noindent Intuitively follows the equivalance of the language recognition abilities of general and non-deterministic B\"uchi automata.
|
sawine@21
|
185 |
|
sawine@8
|
186 |
\section{Linear temporal logic}
|
sawine@19
|
187 |
\subsection{Syntax}
|
sawine@19
|
188 |
Let $\Prop$ be the countable set of \emph{atomic propositions}. The \emph{alphabet} of the language $L_{LTL}(\Prop)$ is $\Prop \cup \{\neg, \lor, X, U\}$. We define the $L_{LTL}(\Prop)$-\emph{formulae} $\varphi$ using following productions:
|
sawine@19
|
189 |
\[\varphi ::= p \in \Prop \,|\, \neg \varphi \,|\, \varphi \lor \varphi \,|\, X \varphi \,|\, \varphi U \varphi\]
|
sawine@13
|
190 |
|
sawine@18
|
191 |
\subsection{Interpretation}
|
sawine@13
|
192 |
The intuition should go as follows: $\neg$ and $\lor$ correspond to the Boolean \emph{negation} and \emph{disjunction}, the unary temporal operator $X$ reads as \emph{next} and the binary temporal operator $U$ reads as \emph{until}.
|
sawine@13
|
193 |
|
sawine@13
|
194 |
LTL is interpreted over \emph{computation paths}, where a computation corrensponds to a model over a \emph{Kripke-frame} constructed by the order of natural numbers.
|
sawine@13
|
195 |
|
sawine@18
|
196 |
\subsection{Semantics}
|
sawine@19
|
197 |
\begin{def:frames}
|
sawine@20
|
198 |
A LTL-\emph{frame} is a tuple $\F = (S, R)$, where $S = \{s_i \mid i \in \N\}$ is the set of states and $R = \{(s_i, s_{i+1}) \mid i \in \N\}$ the set of accessibility relations. Hence $S$ is an isomorphism of $\N$ and $R$ an isomorphism of the strict linear order $(\N, <)$, which corresponds to the linear progression of discrete time.
|
sawine@19
|
199 |
\end{def:frames}
|
sawine@19
|
200 |
|
sawine@18
|
201 |
\begin{def:models}
|
sawine@19
|
202 |
A LTL-\emph{model} is a tuple $\M = (\F, V)$, where $\F$ is a \emph{frame} and $V: S \to 2^\Prop$ a \emph{valuation function}. Intuitively we say $p \in \Prop$ is \emph{true} at time instant $i$ iff $p \in V(i)$.
|
sawine@19
|
203 |
%A \emph{model} is a function $\M: \N \to 2^\Prop$ over \emph{frame} $\F$. The frame constitutes a linear order over $\N$, which corresponds to the linear progression of time from the \emph{present/past} into the \emph{future}. Therefore $\M(i)$ assigns a set of \emph{positive atomic propositions} to each state of time instant $i$. Intuitively we say $p \in \Prop$ is \emph{true} at time instant $i$ iff $p \in \M(i)$.
|
sawine@18
|
204 |
\end{def:models}
|
sawine@13
|
205 |
|
sawine@18
|
206 |
\begin{def:satisfiability}
|
sawine@19
|
207 |
A model $\M = (\F, V)$ \emph{satisfies} a formula $\varphi$ at time instant $i$ is denoted by $\M,i \models \varphi$. Satisfiability of a formula $\varphi$ is defined inductively over the structure of $\varphi$:
|
sawine@13
|
208 |
\begin{itemize}
|
sawine@19
|
209 |
\item $\M,i \models p$ for $p \in \Prop$ iff $p \in V(i)$
|
sawine@17
|
210 |
\item $\M,i \models \neg \varphi$ iff not $\M,i \models \varphi$
|
sawine@17
|
211 |
\item $\M,i \models \varphi \lor \psi$ iff $\M,i \models \varphi$ or $\M,i \models \psi$
|
sawine@17
|
212 |
\item $\M,i \models X \varphi$ iff $\M,i+1 \models \varphi$
|
sawine@17
|
213 |
\item $\M,i \models \varphi U \psi$ iff $\exists{k \geq i}: \M,k \models \psi$ and $\forall{i \leq j < k}: \M,j \models\varphi$
|
sawine@13
|
214 |
\end{itemize}
|
sawine@18
|
215 |
\end{def:satisfiability}
|
sawine@18
|
216 |
|
sawine@14
|
217 |
\begin{def:vocabulary}
|
sawine@19
|
218 |
Let $\varphi$ be a LTL-formula over atomic propositions $\Prop$, we define the \emph{vocabulary} $Voc(\varphi)$ of $\varphi$ inductively:
|
sawine@15
|
219 |
\begin{multicols}{2}
|
sawine@14
|
220 |
\begin{itemize}
|
sawine@19
|
221 |
\item $Voc(p) = \{p\}$ for $p \in \Prop$
|
sawine@14
|
222 |
\item $Voc(\neg \varphi) = Voc(\varphi)$
|
sawine@14
|
223 |
\item $Voc(\varphi \lor \psi) = Voc(\varphi) \cup Voc(\psi)$
|
sawine@14
|
224 |
\item $Voc(X \varphi) = Voc(\varphi)$
|
sawine@14
|
225 |
\item $Voc(\varphi U \psi) = Voc(\varphi) \cup Voc(\psi)$
|
sawine@14
|
226 |
\end{itemize}
|
sawine@15
|
227 |
\end{multicols}
|
sawine@17
|
228 |
%
|
sawine@21
|
229 |
\noindent Let $\M = (\F, V)$ be a model and $\varphi$ a LTL-formula, we define model $\M_{Voc(\varphi)} = (\F, V_{Voc(\varphi)})$ with:
|
sawine@21
|
230 |
\[\forall{i \in \N}: V_{Voc(\varphi)}(i) = V(i) \cap Voc(\varphi)\]
|
sawine@21
|
231 |
Henceforth, we will abbreviate $\M_{Voc(\varphi)}$ and $V_{Voc(\varphi)}$ with $\M_\varphi$ and $V_\varphi$ accordingly.
|
sawine@21
|
232 |
%\noindent Let $\M$ be a model and $\varphi$ a LTL-formula, we define model $\M_{Voc(\varphi)}$:
|
sawine@21
|
233 |
%\[\forall{i \in \N}: \M_{Voc(\varphi)} = \M(i) \cap Voc(\varphi)\]
|
sawine@17
|
234 |
\end{def:vocabulary}
|
sawine@17
|
235 |
%
|
sawine@17
|
236 |
\begin{prop:vocabulary sat}
|
sawine@17
|
237 |
Let $\M$ be a model and $\varphi$ a LTL-formula, then following holds:
|
sawine@21
|
238 |
\[\forall{i \in \N}: \M,i \models \varphi \iff \M_\varphi,i \models \varphi\]
|
sawine@17
|
239 |
\end{prop:vocabulary sat}
|
sawine@17
|
240 |
%
|
sawine@19
|
241 |
\subsection{Derived connectives}
|
sawine@17
|
242 |
For a more convenient description of system specifications we present some derived symbols to be used in LTL-formulae. At first we introduce the notion of \emph{truth} and \emph{falsity} using constants $\top$ and $\bot$. Then we expand our set of connectives with the Boolean \emph{and}, \emph{implication} and \emph{equivalence}. And at last we derive the commonly used modal operators \emph{eventually} and \emph{henceforth}.
|
sawine@15
|
243 |
|
sawine@19
|
244 |
Let $\varphi$ and $\psi$ be $L_{LTL}(\Prop)$-formulae:
|
sawine@15
|
245 |
\begin{multicols}{2}
|
sawine@15
|
246 |
\begin{itemize}
|
sawine@19
|
247 |
\item $\top \equiv p \lor \neg p$ for $p \in \Prop$
|
sawine@15
|
248 |
\item $\bot \equiv \neg \top$
|
sawine@15
|
249 |
\item $\varphi \land \psi \equiv \neg (\neg \varphi \lor \neg \psi)$
|
sawine@15
|
250 |
\item $\varphi \rightarrow \psi \equiv \neg \varphi \lor \psi$
|
sawine@15
|
251 |
\item $\varphi \leftrightarrow \psi \equiv (\varphi \rightarrow \psi) \land (\psi \rightarrow \varphi)$
|
sawine@15
|
252 |
\item $\Diamond \varphi \equiv \top U \varphi$
|
sawine@15
|
253 |
\item $\Box \varphi \equiv \neg \Diamond \neg \varphi$
|
sawine@15
|
254 |
\end{itemize}
|
sawine@15
|
255 |
\end{multicols}
|
sawine@16
|
256 |
From the derivations for operators $\Diamond$, \emph{read diamond}, and $\Box$, \emph{read box}, it follows:
|
sawine@17
|
257 |
\begin{multicols}{2}
|
sawine@16
|
258 |
\begin{itemize}
|
sawine@17
|
259 |
\item $\M,i \models \Diamond \varphi$ iff $\exists{k \geq i}: \M,k \models \varphi$
|
sawine@17
|
260 |
\item $\M,i \models \Box \varphi$ iff $\forall{k \geq i}: \M,k \models \varphi$
|
sawine@16
|
261 |
\end{itemize}
|
sawine@17
|
262 |
\end{multicols}
|
sawine@19
|
263 |
|
sawine@19
|
264 |
With the additional derived connectives we get the following $L_{LTL}(\Prop)$-formulae productions:
|
sawine@19
|
265 |
\[\varphi ::= p \in \Prop \,|\, \neg \varphi \,|\, \varphi \lor \varphi \,|\, \varphi \land \varphi \,|\, X \varphi \,|\, \varphi U \varphi \,|\, \varphi \rightarrow \varphi \,|\, \varphi \leftrightarrow \varphi \,|\, \Diamond \varphi \,|\, \Box \varphi\]
|
sawine@19
|
266 |
|
sawine@21
|
267 |
\section{Automata construction}
|
sawine@21
|
268 |
Before applying the automata-theoretic verification methods, we need to construct an automaton for a given specification formula $\varphi$. For that, we treat the model $\M = (\F, V)$ for an LTL-formula $\varphi$ as an infinite word over the finite alphabet $2^{Voc(\varphi)}$. We define the infinite word representing the model $\M_\varphi = (\F, V_\varphi)$ by the image of its validation function $V_\varphi^\rightarrow(\N)$.
|
sawine@21
|
269 |
\[Mod(\varphi) = \{V_\varphi^\rightarrow(\N) \mid \M_\varphi = (\F, V_\varphi) \land \M_\varphi,0 \models \varphi\}\]
|
sawine@21
|
270 |
$Mod(\varphi)$ is the set of all infinite words, which represent models for $\varphi$.
|
sawine@21
|
271 |
|
sawine@21
|
272 |
|
sawine@8
|
273 |
\section{Model checking}
|
sawine@15
|
274 |
|
sawine@19
|
275 |
|
sawine@19
|
276 |
\section{On-the-fly methods}
|
sawine@19
|
277 |
|
sawine@0
|
278 |
\begin{thebibliography}{99}
|
sawine@5
|
279 |
\bibitem{ref:ltl&büchi}
|
sawine@6
|
280 |
\uppercase{M{\footnotesize adhavan} M{\footnotesize ukund}.}
|
sawine@5
|
281 |
{\em Linear-Time Temporal Logic and B\"uchi Automata}.
|
sawine@2
|
282 |
Winter School on Logic and Computer Science, Indian Statistical Institute, Calcutta, 1997.
|
sawine@0
|
283 |
|
sawine@2
|
284 |
\bibitem{ref:handbook}
|
sawine@6
|
285 |
\uppercase{P{\footnotesize atrick} B{\footnotesize lackburn},
|
sawine@6
|
286 |
F{\footnotesize rank} W{\footnotesize olter and} J{\footnotesize ohan van} B{\footnotesize enthem}.}
|
sawine@2
|
287 |
{\em Handbook of Modal Logic (Studies in Logic and Practical Reasoning)}.
|
sawine@3
|
288 |
3rd Edition, Elsevier, Amsterdam, 2007.
|
sawine@7
|
289 |
|
sawine@19
|
290 |
\bibitem{ref:alternating verification}
|
sawine@19
|
291 |
\uppercase{M{\footnotesize oshe} Y. V{\footnotesize ardi}.}
|
sawine@19
|
292 |
{\em Alternating Automata and Program Verification}.
|
sawine@19
|
293 |
Computer Science Today, Volume 1000 of Lecture Notes in Computer Science, Springer-Verlag, Berlin, 1995.
|
sawine@19
|
294 |
|
sawine@7
|
295 |
\bibitem{ref:infpaths}
|
sawine@7
|
296 |
\uppercase{P{\footnotesize ierre} W{\footnotesize olper},
|
sawine@7
|
297 |
M{\footnotesize oshe} Y. V{\footnotesize ardi and}
|
sawine@7
|
298 |
A. P{\footnotesize rasad} S{\footnotesize istla}.}
|
sawine@7
|
299 |
{\em Reasoning about Infinite Computation Paths}.
|
sawine@7
|
300 |
In Proceedings of the 24th IEEE FOCS, 1983.
|
sawine@7
|
301 |
|
sawine@0
|
302 |
\end{thebibliography}
|
sawine@0
|
303 |
\end{document}
|