LTL: Linear-time logic. LTL is another important temporal logic. In LTL the future is seen as a sequence of states, so the future is seen as a path.

Transcription

1 LTL: Linear-time logic LTL is another imortant temoral logic. In LTL the future is seen as a sequence of states, so the future is seen as a ath. We can consider a set of aths, however we don t have an existential ath quantifier (the E of CTL), when we interret an LTL formula over a set of aths the formula has to be true of all aths to be true, i.e we are always quantifying universally over all ossible aths in the set. 1

2 In LTL roositions are interreted not over trees (like CTL does) but over individual aths, As usual there are atomic roosition 1,..., n,... Other formulas are as follows: φ ::= true false φ 1 φ 2 φ 1 φ 2 φ φ φ Gφ Fφ Xφ [φuφ] [φwφ] [φrφ] So we are missing few CTL oerators (the temoral modalities) and adding two new: W, R whose meaning is Weak until and Release 2

3 Regarding the absence of ath quantifiers A and E. We said that this is because a formula is evaluated on a ath, or a set of aths A set of aths satisfy φ iff every ath in the set satisfy φ. That mean that imlicitly all formulas are universally ath quantified, i.e. [Uq] stands for A[Uq] etc... 3

4 We don t have ath quantifiers, so we know we can t write things like E ( U q) or E F or A G E F however there are things we can write in LTL that we couldn t write in CTL. Consider F Fq and comare it to his closest CTL relative: AF AFq 4

5 There are things we can write in CTL but not in LTL, things like on all aths is always true that exists a ath such that... There are things we can write in LTL but not in CTL, like If it is infinitely often the case that then at some oint q A G E G G F Fq... q 5

6 Remember that in CTL the semantics was defined as a relation K, s = φ where s is a state in the KTS LTL semantics will be defined as a relation K, π = φ where π is a ath in the KTS. we will note aths as follows: π = s 0 s 1... s n and π i = s i... s n i.e. π i is the subath of π starting at s i. 6

7 Let s see how to give a semantics to LTL. We consider the same structure we used for the semantics of CTL, i.e. a KTS K=(S,,I) Given a KTS K, we are going to define the relation K, π = φ meaning the ath π in K satisfies the formula φ. The definition is by induction on the structure of φ 8

8 K, π = true K, π = false K, π = iff I(s 0 ) K, π = φ iff K, π = φ K, π = φ 1 φ 2 iff K, π = φ 1 and K, π = φ 2 K, π = φ 1 φ 2 iff K, π = φ 1 or K, π = φ 2 K, π = φ 1 φ 2 iff K, π = φ 1 or K, π = φ 2 K, π = Gφ iff for all aths π i for all i 0 we have K, π i = φ K, π = Fφ iff for some ath π i for some i 0 we have K, π i = φ 9

9 K, π = Xφ iff K, π 1 = φ K, π = [φ 1 Uφ 2 ] iff exists i 0 such that K, π i = φ 2 and for all j < i, K, π j = φ 1 K, π = [φ 1 Wφ 2 ] iff exists i 0 such that K, π i = φ 2 and for all j < i, K, π j = φ 1 or for all i 0 K, π i = φ 1 K, π = [φ 1 Rφ 2 ] iff exists i 0 such that K, π i = φ 1 and for all j i, K, π j = φ 2 or for all i 0 K, π i = φ 2

10 Notes: [φ 1 Wφ 2 ] is the same as [φ 1 Uφ 2 ] Gφ 1 [φ 1 Rφ 2 ] is the same as [ φ 1 U φ 2 ] q Until q q Weak Until q q q Releases q 10

11 Few words about aths: Strictly seaking, given a KTS and a state, the aths starting at that state s are all sequences of states starting from s such that if s is in the ath and s s is a transition in the KTS then s is in the ath as well. So the aths (starting at s 0 ) in s0, q q s2 s1 are the sequences of the form (s 0 s 1 ) n s 0 s 2 where n 0 11

12 Most authors require aths in LTL to be infinite; as such our revious KTS would have no ath. However is easily seen that we can always transform finite aths into infinite ones by adding loos on the ending states. Here is what our revious KTS would become s0,q s2 q s1 Hence to kee things simle we don t require aths to be infinite. Also we may want sometimes to use finite refixes of aths: 12

13 In the KTS just seen and starting at s 0 we have s 0 s 2, s 0 s 1 s 0 s 1 s 0. (s 0 s 1 ) n s 0 (s 0 s 1 ) n s 0 s 2 (s 0 s 1 ) n s 0 s 1 You should read the aths ending with s 0 and s 1 as finite refixes of aths as you could always extend a ath ending with s 0 with an s 2 and one ending with s 1 with s 0 s 2 13

14 Here we use finite refixes to illustrate the meaning of LTL formulas: (s 0 s 1 ) n s 0 = Gq, (s 0 s 1 ) n s 0 = Fq, (s 0 s 1 ) n s 0 = GFq (s 0 s 1 ) n s 0 s 1 = G, s 0 s 2 = Gq but {(s 0 s 1 ) n s 0 s 1, s 0 s 2 } = G Gq but {(s 0 s 1 ) n s 0 s 1, s 0 s 2 } = G Gq (s 0 s 1 ) n s 0 = (Uq) what about (s 0 s 1 ) n s 0 s 1 = (qr)? 14

15 Few equivalences of LTL formulas: Gφ F φ Fφ G φ Xφ X φ (φuψ) φr ψ φuψ (φwψ) Fψ Fφ true Uφ Gφ false Rφ 15

16 What we can exress with LTL formulas? Over the years few classes of roerties of systems have emerged as suitable to be studied by these temoral logics: what kind of roerties make sense for all ossible systems modeled by KTS? Things like the ower is on, there is enough fuel etc... are not general roerties but the following are: 16

17 a Reachability : A articular state is reachable from the resent state b Safety: A (bad) roerty will never be satisfied c Liveness: A (good) roerty will always be satisfied by some state in the future c Deadlock freedom: never be reached a dead end state will 17

18 Safety is to rule out bad (catastrohic) behaviours of the system. For examle in a vending machine an examle of safety is: a state where a drink is given with no money inserted is never met Some more examles: A missile is never launched unless the launch button is ressed A traffic light is not green if its orthogonal light is green A train will not cross a train crossing with the gates in the u osition 18

19 Liveness is to ensure that the system does what is is meant to do. Examle of liveness: If enough money is in the machine a drink will be released if the launch button is ressed the missile will be launched If the light is orange then it will become red next If the train is aroaching the crossing the gates will go down

20 So a live and safe system is a system which does what is meant to do and doesn t do things it is not meant to do. That should ensure that the system is well-behaving, shouldn t it? Consider two traffic light in a junction satisfying the liveness and safety conditions described above. Would that be roerly working? 19

21 Solution: Have you ever been at a red traffic light waiting for the light to become green, and waiting... and waiting... You can have systems where comonents are waiting forever for some other comonent to finish. If A is waiting for B who is waiting for A you have a deadlock. If A is waiting for B, B is roerly working but it never gets back to A you have un-fairness 20

22 In KTS terms deadlock means that the system has reached a state s which has no successor (i.e. there is no outgoing transition out of s). Informally fairness means that a state that is available infinitely often will eventually be reached, for examle at a junction if it is ossible to turn left then at some oint some car will turn left. Roughly seaking most systems which are safe, live, deadlock free and fair are systems working roerly 21