Discounting in LTL. 1 Introduction. Shaull Almagor 1, Udi Boker 2, and Orna Kupferman 1

Transcription

1 Discouning in LTL Shaull Almagor 1, Udi Boker 2, and Orna Kupferman 1 1 The Hebrew Universiy, Jerusalem, Israel. 2 The Inerdisciplinary Cener, Herzliya, Israel. Absrac. In recen years, here is growing need and ineres in formalizing and reasoning abou he qualiy of sofware and hardware sysems. As opposed o radiional verificaion, where one handles he quesion of wheher a sysem saisfies, or no, a given specificaion, reasoning abou qualiy addresses he quesion of how well he sysem saisfies he specificaion. One direcion in his effor is o refine he evenually operaors of emporal logic o discouning operaors: he saisfacion value of a specificaion is a value in [0, 1], where he longer i akes o fulfill evenualiy requiremens, he smaller he saisfacion value is. In his paper we inroduce an augmenaion by discouning of Linear Temporal Logic (LTL), and sudy i, as well as is combinaion wih proposiional qualiy operaors. We show ha one can augmen LTL wih an arbirary se of discouning funcions, while preserving he decidabiliy of he model-checking problem. Furher augmening he logic wih unary proposiional qualiy operaors preserves decidabiliy, whereas adding an average-operaor makes he model-checking problem undecidable. We also discuss he complexiy of he problem, as well as various exensions. 1 Inroducion One of he main obsacles o he developmen of complex hardware and sofware sysems lies in ensuring heir correcness. A successful paradigm addressing his obsacle is emporal-logic model checking given a mahemaical model of he sysem and a emporal-logic formula ha specifies a desired behavior of i, decide wheher he model saisfies he formula [5]. Correcness is Boolean: a sysem can eiher saisfy is specificaion or no saisfy i. The richness of oday s sysems, however, jusifies specificaion formalisms ha are muli-valued. The muli-valued seing arises direcly in sysems wih quaniaive aspecs (muli-valued / probabilisic / fuzzy) [9 11, 16, 23], bu is applied also wih respec o Boolean sysems, where i origins from he semanics of he specificaion formalism iself [1, 7]. When considering he qualiy of a sysem, saisfying a specificaion should no longer be a yes/no maer. Differen ways of saisfying a specificaion should induce differen levels of qualiy, which should be refleced in he oupu of he verificaion procedure. Consider for example he specificaion G(reques F(response gran response deny)) ( every reques is evenually responded, wih eiher a gran or a denial ). There should be a difference beween a compuaion ha saisfies i wih responses generaed soon afer requess and one ha saisfies i wih long wais. Moreover, here may be a difference beween gran and deny responses, or cases in which no reques is issued. The issue of generaing high-qualiy hardware and sofware sysems aracs a lo of aenion

2 [13, 26]. Qualiy, however, is radiionally viewed as an ar, or as an amorphic ideal. In [1], we inroduced an approach for formalizing qualiy. Using i, a user can specify qualiy formally, according o he imporance he gives o componens such as securiy, mainainabiliy, runime, and more, and hen can formally reason abou he qualiy of sofware. As he example above demonsraes, we can disinguish beween wo aspecs of he qualiy of saisfacion. The firs, o which we refer as emporal qualiy concerns he waiing ime o saisfacion of evenualiies. The second, o which we refer as proposiional qualiy concerns prioriizing relaed componens of he specificaion. Proposiional qualiy was sudied in [1]. In his paper we sudy emporal qualiy as well as he combinaions of boh aspecs. One may ry o reduce emporal qualiy o proposiional qualiy by a repeaed use of he X ( nex ) operaor or by a use of bounded (promp) evenualiies [2, 3]. Boh approaches, however, pariions he fuure ino finiely many zones and are limied: correcness of LTL is Boolean, and hus has inheren dichoomy beween saisfacion and dissaisfacion. On he oher hand, he disincion beween near and far is no dichoomous. This suggess ha in order o formalize emporal qualiy, one mus exend LTL o an unbounded seing. Realizing his, researchers have suggesed o augmen emporal logics wih fuure discouning [8]. In he discouned seing, he saisfacion value of specificaions is a numerical value, and i depends, according o some discouning funcion, on he ime waied for evenualiies o ge saisfied. In his paper we add discouning o Linear Temporal Logic (LTL), and sudy i, as well as is combinaion wih proposiional qualiy operaors. We inroduce LTL disc [D] an augmenaion by discouning of LTL. The logic LTL disc [D] is acually a family of logics, each parameerized by a se D of discouning funcions sricly decreasing funcions from N o [0, 1] ha end o 0 (e.g., linear decaying, exponenial decaying, ec.). LTL disc [D] includes a discouning- unil (U η ) operaor, parameerized by a funcion η D. We solve he model-checking hreshold problem for LTL disc [D]: given a Kripke srucure K, an LTL disc [D] formula ϕ and a hreshold [0, 1], he algorihm decides wheher he saisfacion value of ϕ in K is a leas. In he Boolean seing, he auomaa-heoreic approach has proven o be very useful in reasoning abou LTL specificaions. The approach is based on ranslaing LTL formulas o nondeerminisic Büchi auomaa on infinie words [28]. Applying his approach o he discouned seing, which gives rise o infiniely many saisfacion values, poses a big algorihmic challenge: model-checking algorihms, and in paricular hose ha follow he auomaa-heoreic approach, are based on an exhausive search, which canno be simply applied when he domain becomes infinie. A naural relevan exension o he auomaa-heoreic approach is o ranslae formulas o weighed auomaa [22]. Unforunaely, hese exensively-sudied models are complicaed and many problems become undecidable for hem [15]. We show ha for hreshold problems, we can ranslae LTL disc [D] formulas ino (Boolean) nondeerminisic Büchi auomaa, wih he propery ha he auomaon acceps a lasso compuaion iff he formula aains a value above he hreshold on ha compuaion. Our algorihm relies on he fac ha he language of an auomaon is non-empy iff here is a lasso winess for he non-empiness. We cope wih he infiniely many possible saisfacion values by using he discouning behavior

3 of he evenualiies and he given hreshold in order o pariion he sae space ino a finie number of classes. The complexiy of our algorihm depends on he discouning funcions used in he formula. We show ha for sandard discouning funcions, such as exponenial decaying, he problem is PSPACE-complee no more complex han sandard LTL. The fac our algorihm uses Boolean auomaa also enables us o sugges a soluion for hreshold saisfiabiliy, and o give a parial soluion o hreshold synhesis. In addiion, i allows o adap he heurisics and ools ha exis for Boolean auomaa. Before we coninue o describe our conribuion, le us review exising work on discouning. The noion of discouning has been sudied in several fields, such as economy, game-heory, and Markov decision processes [25]. In he area of formal verificaion, i was suggesed in [8] o augmen he µ-calculus wih discouning operaors. The discouning suggesed here is exponenial; ha is, wih each ieraion, he saisfacion value of he formula decreases by a muliplicaive facor in (0, 1]. Algorihmically, [8] shows how o evaluae discouned µ-calculus formulas wih arbirary precision. Formulas of LTL can be ranslaed o he µ-calculus, hus [8] can be used in order o approximaely model-check discouned-ltl formulas. However, he ranslaion from LTL o he µ- calculus involves an exponenial blowup [6] (and is complicaed), making his approach inefficien. Moreover, our approach allows for arbirary discouning funcions, and he algorihm reurns an exac soluion o he hreshold model-checking problem, which is more difficul han he approximaion problem. Closer o our work is [7], where CTL is augmened wih discouning and weighedaverage operaors. The moivaion in [7] is o inroduce a logic whose semanics is no oo sensiive o small perurbaions in he model. Accordingly, formulas are evaluaed on weighed-sysems or on Markov-chains. Adding discouning and weighed-average operaors o CTL preserves is appealing complexiy, and he model-checking problem for he augmened logic can be solved in polynomial ime. As is he case in he Boolean semanics, he expressive power of discouned CTL is limied. The fac he same combinaion, of discouning and weighed-average operaors, leads o undecidabiliy in he conex of LTL winesses he echnical challenges of he LTL disc [D] seing. Perhaps closes o our approach is [19], where a version of discouned-ltl was inroduced. Semanically, here are wo main differences beween he logics. The firs is ha [19] uses discouned sum, while we inerpre discouning wihou accumulaion, and he second is ha he discouning here replaces he sandard emporal operaors, so all evenualiies are discouned. As discouning funcions end o 0, his sricly resrics he expressive power of he logic, and one canno specify radiional evenualiies in i. On he posiive side, i enables a clean algebraic characerizaion of he semanics, and indeed he conribuion in [19] is a comprehensive sudy of he mahemaical properies of he logic. Ye, [19] does no sudy algorihmic quesions abou o he logic. We, on he oher hand, focus on he algorihmic properies of he logic, and specifically on he model-checking problem. Le us now reurn o our conribuion. Afer inroducing LTL disc [D] and sudying is model-checking problem, we augmen LTL disc [D] wih proposiional qualiy operaors. Beyond he operaors min, max, and, which are already presen, wo basic proposiional qualiy operaors are he muliplicaion of an LTL disc [D] formula by a consan in [0, 1], and he averaging beween he saisfacion values of wo LTL disc [D] formulas

4 [1]. We show ha while he firs exension does no increase he expressive power of LTL disc [D] or is complexiy, he laer causes he model-checking problem o become undecidable. In fac, model checking becomes undecidable even if we allow averaging in combinaion wih a single discouning funcion. Recall ha his is in conras wih he exension of discouned CTL wih an average operaor, where he complexiy of he model-checking problem says polynomial [7]. We consider addiional exensions of LTL disc [D]. Firs, we sudy a varian of he discouning-evenually operaors in which we allow he discouning o end o arbirary values in [0, 1] (raher han o 0). This capures he inuiion ha we are no always pessimisic abou he fuure, bu can be, for example, ambivalen abou i, by ending o 1 2. We show ha all our resuls hold under his exension. Second, we add o LTLdisc [D] pas operaors and heir discouning versions (specifically, we allow a discouning- since operaor, and is dual). In he radiional semanics, pas operaors enable clean specificaions of many ineresing properies, make he logic exponenially more succinc, and can sill be handled wihin he same complexiy bounds [17, 18]. We show ha he same holds for he discouned seing. Finally, we show how LTL disc [D] and algorihms for i can be used also for reasoning abou weighed sysems. Due o lack of space, mos proofs are omied, and can be found in he full version, in he auhors home pages. 2 The Logic LTL disc [D] The linear emporal logic LTL disc [D] generalizes LTL by adding discouning emporal operaors. The logic is acually a family of logics, each parameerized by a se D of discouning funcions. Le N = {0, 1,...}. A funcion η : N [0, 1] is a discouning funcion if lim i η(i) = 0, and η is sricly monoonic-decreasing. Examples for naural discouning funcions are η(i) = λ i, for some λ (0, 1), and η(i) = 1 i+1. Given a se of discouning funcions D, we define he logic LTL disc [D] as follows. The synax of LTL disc [D] adds o LTL he operaor ϕu η ψ (discouning-unil), for every funcion η D. Thus, he synax is given by he following grammar, where p ranges over he se AP of aomic proposiions and η D. ϕ := True p ϕ ϕ ϕ Xϕ ϕuϕ ϕu η ϕ. The semanics of LTL disc [D] is defined wih respec o a compuaion π = π 0, π 1,... (2 AP ) ω. Given a compuaion π and an LTL disc [D] formula ϕ, he ruh value of ϕ in π is a value in [0, 1], denoed [π, ϕ]. The value is defined by inducion on he srucure of ϕ as follows, where π i = π i, π i+1,.... [π, True] { = 1. [π, ϕ ψ ] = max {[π, ϕ], [π, ψ ]}. 1 if p π 0, [π, p] = [π, ϕ] = 1 [π, ϕ]. 0 if p / π 0. [π, Xϕ] = [π 1, ϕ]. [π, ϕuψ ] = sup{min{[π i, ψ ], min i 0 0 j<i {[πj, ϕ]}}}. [π, ϕu η ψ ] = sup{min{η(i)[π i, ψ ], min i 0 0 j<i {η(j)[πj, ϕ]}}}.

5 The inuiion is ha evens ha happen in he fuure have a lower influence, and he rae by which his influence decreases depends on he funcion η. 1 For example, he saisfacion value of a formula ϕu η ψ in a compuaion π depends on he bes (supremum) value ha ψ can ge along he enire compuaion, while considering he discouned saisfacion of ψ a a posiion i, as a resul of muliplying i by η(i), and he same for he value of ϕ in he prefix leading o he i-h posiion. We add he sandard abbreviaions Fϕ TrueUϕ, and Gϕ = F ϕ, as well as heir quaniaive counerpars: F η ϕ TrueU η ϕ, and G η ϕ = F η ϕ. We denoe by ϕ he number of subformulas of ϕ. A compuaion of he form π = u v ω, for u, v (2 AP ), wih v ɛ, is called a lasso compuaion. We observe ha since a specific lasso compuaion has only finiely many disinc suffixes, he inf and sup in he semanics of LTL disc [D] can be replaced wih min and max, respecively, when applied o lasso compuaions. The semanics is exended o Kripke srucures by aking he pah ha admis he lowes saisfacion value. Formally, for a Kripke srucure K and an LTL disc [D] formula ϕ we have ha [K, ϕ] = inf {[π, ϕ] : π is a compuaion of K}. Example 1. Consider a lossy-disk: every momen in ime here is a chance ha some bi would flip is value. Fixing flips is done by a global error-correcing procedure. This procedure manipulaes he enire conen of he disk, such ha iniially i causes more errors in he disk, bu he longer i runs, he more bis i fixes. Le ini and erminae be aomic proposiions indicaing when he error-correcing procedure is iniiaed and erminaed, respecively. The qualiy of he disk (ha is, a measure of he amoun of correc bis) can be specified by he formula ϕ = GF η (ini F µ erminae) for some appropriae discouning funcions η and µ. Inuiively, ϕ ges a higher saisfacion value he shorer he waiing ime is beween iniiaions of he error-correcing procedure, and he longer he procedure runs (ha is, no erminaed) in beween hese iniiaions. Noe ha he wors case naure of LTL disc [D] fis here. For insance, running he procedure for a very shor ime, even once, will cause many errors. 3 LTL disc [D] Model Checking In he Boolean seing, he model-checking problem asks, given an LTL formula ϕ and a Kripke srucure K, wheher [K, ϕ] = True. In he quaniaive seing, he modelchecking problem is o compue [K, ϕ], where ϕ is now an LTL disc [D] formula. A simpler version of his problem is he hreshold model-checking problem: given ϕ, K, and a hreshold v [0, 1], decide wheher [K, ϕ] v. In his secion we show how we can solve he laer. Our soluion uses he auomaa-heoreic approach, and consiss of he following seps. We sar by ranslaing ϕ and v o an alernaing weak auomaon A ϕ,v such ha L(A ϕ,v ) iff here exiss a compuaion π such ha [π, ϕ] > v. The challenge here is ha ϕ has infiniely many saisfacion values, naively implying an infiniesae auomaon. We show ha using he hreshold and he discouning behavior of 1 Observe ha in our semanics he saisfacion value of fuure evens ends o 0. One may hink of scenarios where fuure evens are discouned owards anoher value in [0, 1] (e.g. discouning owards 1 as ambivalence regarding he fuure). We address his in Secion 5. 2

6 he evenualiies, we can resric aenion o a finie resoluion of saisfacion values, enabling he consrucion of a finie auomaon. Complexiy-wise, he size of A ϕ,v depends on he funcions in D. In Secion 3.3, we analyze he complexiy for he case of exponenial-discouning funcions. The second sep is o consruc a nondeerminisic Büchi auomaon B ha is equivalen o A ϕ,v. In general, alernaion removal migh involve an exponenial blowup in he sae space [21]. We show, by a careful analysis of A ϕ,v, ha we can remove is alernaion while only having a polynomial sae blowup. We complee he model-checking procedure by composing he nondeerminisic Büchi auomaon B wih he Kripke srucure K, as done in he radiional, auomaabased, model-checking procedure. The complexiy of model-checking an LTL disc [D] formula depends on he discouning funcions in D. Inuiively, he faser he discouning ends o 0, he less saes here will be. For exponenial-discouning, we show ha he complexiy is NLOGSPACE in he sysem (he Kripke srucure) and PSPACE in he specificaion (he LTL disc [D] formula and he hreshold), saying in he same complexiy classes of sandard LTL model-checking. We conclude he secion by showing how o use he generaed nondeerminisic Büchi auomaon for addressing hreshold saisfiabiliy and synhesis. 3.1 Alernaing Weak Auomaa For a given se X, le B + (X) be he se of posiive Boolean formulas over X (i.e., Boolean formulas buil from elemens in X using and ), where we also allow he formulas True and False. For Y X, we say ha Y saisfies a formula θ B + (X) iff he ruh assignmen ha assigns rue o he members of Y and assigns false o he members of X \ Y saisfies θ. An alernaing Büchi auomaon on infinie words is a uple A = Σ, Q, q in, δ, α, where Σ is he inpu alphabe, Q is a finie se of saes, q in Q is an iniial sae, δ : Q Σ B + (Q) is a ransiion funcion, and α Q is a se of acceping saes. We define runs of A by means of (possibly) infinie DAGs (direced acyclic graphs). A run of A on a word w = σ 0 σ 1 Σ ω is a (possibly) infinie DAG G = V, E saisfying he following (noe ha here may be several runs of A on w). V Q N is as follows. Le Q l Q denoe all saes in level l. Thus, Q l = {q : q, l V }. Then, Q 0 = {q in }, and Q l+1 saisfies q Q l δ(q, σ l ). For every l N, Q l is minimal wih respec o conainmen. E l 0 (Q l {l}) (Q l+1 {l + 1}) is such ha for every sae q Q l, he se {q Q l+1 : E(< q, l >, < q, l + 1 >)} saisfies δ(q, σ l ). Thus, he roo of he DAG conains he iniial sae of he auomaon, and he saes associaed wih nodes in level l + 1 saisfy he ransiions from saes corresponding o nodes in level l. The run G acceps he word w if all is infinie pahs saisfy he accepance condiion α. Thus, in he case of Büchi auomaa, all he infinie pahs have infiniely many nodes q, l such ha q α (i is no hard o prove ha every infinie pah in G is par of an infinie pah saring in level 0). A word w is acceped by A if

7 here is a run ha acceps i. The language of A, denoed L(A), is he se of infinie words ha A acceps. When he formulas in he ransiion funcion of A conain only disjuncions, hen A is nondeerminisic, and is runs are DAGs of widh 1, where a each level here is a single node. The alernaing auomaon A is weak, denoed AWA, if is sae space Q can be pariioned ino ses Q 1,..., Q k, such ha he following hold: Firs, for every 1 i k eiher Q i α, in which case we say ha Q i is an acceping se, or Q i α =, in which case we say ha Q i is rejecing. Second, here is a parial-order over he ses, and for every 1 i, j k, if q Q i, s Q j, and s δ(q, σ) for some σ Σ, hen Q j Q i. Thus, ransiions can lead only o saes ha are smaller in he parial order. Consequenly, each run of an AWA evenually ges rapped in a se Q i and is acceping iff his se is acceping. 3.2 From LTL disc [D] o AWA Our model-checking algorihm is based on ranslaing an LTL disc [D] formula ϕ o an AWA. Inuiively, he saes of he AWA correspond o asserions of he form ψ > or ψ < for every subformula ψ of ϕ, and for cerain hresholds [0, 1]. A lasso compuaion is hen acceped from sae ψ > iff [π, ψ ] >. The assumpion abou he compuaion being a lasso is needed only for he only if direcion, and i does no influence he proof s generaliy since he language of an auomaon is non-empy iff here is a lasso winess for is non-empiness. By seing he iniial sae o ϕ > v, we are done. Defining he appropriae ransiion funcion for he AWA follows he semanics of LTL disc [D] in he expeced manner. A naive consrucion, however, yields an infiniesae auomaon (even if we only expand he sae space on-he-fly, as discouning formulas can ake infiniely many saisfacion values). As can be seen in he proof of Theorem 1, he problemaic ransiions are hose ha involve he discouning operaors. The key observaion is ha, given a hreshold v and a compuaion π, when evaluaing a discouned operaor on π, one can resric aenion o wo cases: eiher he saisfacion value of he formula goes below v, in which case his happens afer a bounded prefix, or he saisfacion value always remains above v, in which case we can replace he discouned operaor wih a Boolean one. This observaion allows us o expand only a finie number of saes on-he-fly. Before describing he consrucion of he AWA, we need he following lemma, which reduces an exreme saisfacion of an LTL disc [D] formula, meaning saisfacion wih a value of eiher 0 or 1, o a Boolean saisfacion of an LTL formula. The proof proceeds by inducion on he srucure of he formulas. Lemma 1. Given an LTL disc [D] formula ϕ, here exis LTL formulas ϕ + and ϕ <1 such ha ϕ + and ϕ <1 are boh O( ϕ ) and he following hold for every compuaion π. 1. If [π, ϕ] > 0 hen π = ϕ +, and if [π, ϕ] < 1 hen π = ϕ <1. 2. If π is a lasso, hen if π = ϕ + hen [π, ϕ] > 0 and if π = ϕ <1 hen [π, ϕ] < 1. Henceforh, given an LTL disc [D] formula ϕ, we refer o ϕ + as in Lemma 1.

8 Consider an LTL disc [D] formula ϕ. By Lemma 1, if here exiss a compuaion π such ha [π, ϕ] > 0, hen ϕ + is saisfiable. Conversely, since ϕ + is a Boolean LTL formula, hen by [27] we know ha ϕ + is saisfiable iff here exiss a lasso compuaion π ha saisfies i, in which case [π, ϕ] > 0. We conclude wih he following. Corollary 1. Consider an LTL disc [D] formula ϕ. There exiss a compuaion π such ha [π, ϕ] > 0 iff here exiss a lasso compuaion π such ha [π, ϕ] > 0, in which case π = ϕ + as well. Remark 1. The curious reader may wonder why we do no prove ha [π, ϕ] > 0 iff π = ϕ + for every compuaion π. As i urns ou, a ranslaion ha is valid also for compuaions wih no period is no always possible. For example, as is he case wih he promp-evenualiy operaor of [14], he formula ϕ = G(F η p) is such ha he se of compuaions π wih [π, ϕ] > 0 is no ω-regular, hus one canno hope o define an LTL formula ϕ +. We sar wih some definiions. For a funcion f : N [0, 1] and for k N, we define f +k : N [0, 1] as follows. For every i N we have ha f +k (i) = f(i + k). Le ϕ be an LTL disc [D] formula over AP. We define he exended closure of ϕ, denoed xcl(ϕ), o be he se of all he formulas ψ of he following classes: 1. ψ is a subformula of ϕ. 2. ψ is a subformula of θ + or θ +, where θ is a subformula of ϕ. 3. ψ is of he form θ 1 U η +kθ 2 for k N, where θ 1 U η θ 2 is a subformula of ϕ. Observe ha xcl(ϕ) may be infinie, and ha i has boh LTL disc [D] formulas (from Classes 1 and 3) and LTL formulas (from Class 2). Theorem 1. Given an LTL disc [D] formula ϕ and a hreshold v [0, 1], here exiss an AWA A ϕ,v such ha for every compuaion π he following hold. 1. If [π, ϕ] > v, hen A ϕ,v acceps π. 2. If A ϕ,v acceps π and π is a lasso compuaion, hen [π, ϕ] > v. Proof. We consruc A ϕ,v = Q, 2 AP, Q 0, δ, α as follows. The sae space Q consiss of wo ypes of saes. Type-1 saes are asserions of he form (ψ > ) or (ψ < ), where ψ xcl(ϕ) is of Class 1 or 3 and [0, 1]. Type-2 saes correspond o LTL formulas of Class 2. Le S be he se of Type-1 and Type-2 saes for all ψ xcl(ϕ) and hresholds [0, 1]. Then, Q is he subse of S consruced on-he-fly according o he ransiion funcion defined below. We laer show ha Q is indeed finie. The ransiion funcion δ : Q 2 AP B + (Q) is defined as follows. For Type-2 saes, he ransiions are as in he sandard ranslaion from LTL o AWA [27] (see he full version for deails). For he oher saes, we define he ransiions as follows. Le σ 2 AP. [ True if < 1, δ((true > ), σ) = δ((false > ), σ) = False. False if = 1. [ True if > 0, δ((true < ), σ) = False. δ((false < ), σ) = False if = 0.

9 [ [ True if p σ and < 1, False if p σ or = 0, δ((p > ), σ) = δ((p < ), σ) = False oherwise. True oherwise. δ((ψ 1 ψ 2 > ), σ) = δ((ψ 1 > ), σ) δ((ψ 2 > ), σ). δ((ψ 1 ψ 2 < ), σ) = δ((ψ 1 < ), σ) δ((ψ 2 < ), σ). δ(( ψ 1 > ), σ) = δ((ψ 1 < 1 ), σ) δ(( ψ 1 < ), σ) = δ((ψ 1 > 1 ), σ). δ((xψ 1 > ), σ) = (ψ 1 > ). δ((xψ 1 < ), σ) = (ψ 1 < ). δ((ψ 2 > ), σ) [δ((ψ 1 > ), σ) (ψ 1 Uψ 2 > )] if 0 < < 1, δ((ψ 1 Uψ 2 > ), σ) = False if 1, δ(((ψ 1 Uψ 2 ) + ), σ) if = 0. δ((ψ 2 < ), σ) [δ((ψ 1 < ), σ) (ψ 1 Uψ 2 < )] if 0 < 1, δ((ψ 1 Uψ 2 < ), σ) = True if > 1, False if = 0. δ((ψ 1 U η ψ 2 > ), σ) = δ((ψ 2 > η(0) ), σ) [δ((ψ 1 > η(0) ), σ) (ψ 1U η +1ψ 2 > )] if 0 < η(0) < 1, False if η(0) 1, δ(((ψ 1 U η ψ 2 ) + ), σ) if η(0) = 0 (i.e., = 0). δ((ψ 1 U η ψ 2 < ), σ) = δ((ψ 2 < η(0) ), σ) [δ((ψ 1 < η(0) ), σ) (ψ 1U η +1ψ 2 < )] if 0 < η(0) 1, True if False if η(0) η(0) > 1, = 0 (i.e., = 0). We provide some inuiion for he more complex pars of he ransiion funcion: consider, for example, he ransiion δ((ψ 1 U η ψ 2 > ), σ). Since η is decreasing, he highes possible saisfacion value for ψ 1 U η ψ 2 is η(0). Thus, if η(0) (equivalenly, η(0) 1), hen i canno hold ha ψ 1U η ψ 2 >, so he ransiion is o False. If = 0, hen we only need o ensure ha he saisfacion value of ψ 1 U η ψ 2 is no 0. To do so, we require ha (ψ 1 U η ψ 2 ) + is saisfied. By Corollary 1, his is equivalen o he saisfiabiliy of he former. So he ransiion is idenical o ha of he sae (ψ 1 U η ψ 2 ) +. Finally, if 0 < < η(0), hen (slighly abusing noaion) he asserion ψ 1 U η ψ 2 > is rue if eiher η(0)ψ 2 > is rue, or boh η(0)ψ 1 > and ψ 1 U η+1 ψ 2 > are rue. The iniial sae of A ϕ,v is (ϕ > v). The acceping saes are hese of he form (ψ 1 Uψ 2 < ), as well as acceping saes ha arise in he sandard ranslaion of Boolean LTL o AWA (in Type-2 saes). Noe ha each pah in he run of A ϕ,v evenually ges rapped in a single sae. Thus, A ϕ,v is indeed an AWA. The inuiion behind he accepance condiion is as follows. Geing rapped in a sae of he form (ψ 1 Uψ 2 < ) is allowed, as he evenualiy is saisfied wih value 0. On he oher hand, geing suck in oher saes (of Type-1) is no allowed, as hey involve evenualiies ha are no saisfied in he hreshold promised for hem. This concludes he definiion of A ϕ,v. Finally, observe ha while he consrucion as described above is infinie (indeed, uncounable), only finiely many saes are reachable from he iniial sae (ϕ > v), and we can compue hese saes in advance. Inuiively, i follows from he fac ha once he proporion beween and η(i) goes above 1, for Type-1 saes associaed wih hreshold and sub formulas wih a discouning funcion η, we do no have o generae new saes. A deailed proof of A s finieness and correcness is given in he full version.

10 Since A ϕ,v is a Boolean auomaon, hen L(A) iff i acceps a lasso compuaion. Combining his observaion wih Theorem 1, we conclude wih he following. Corollary 2. For an LTL disc [D] formula ϕ and a hreshold v [0, 1], i holds ha L(A ϕ,v ) iff here exiss a compuaion π such ha [π, ϕ] > v. 3.3 Exponenial Discouning The size of he AWA generaed as per Theorem 1 depends on he discouning funcions. In his secion, we analyze is size for he class of exponenial discouning funcions, showing ha i is singly exponenial in he specificaion formula and in he hreshold. This class is perhaps he mos common class of discouning funcions, as i describes wha happens in many naural processes (e.g., emperaure change, capacior charge, effecive ineres rae, ec.) [8, 25]. For λ (0, 1) we define he exponenial-discouning funcion exp λ : N [0, 1] by exp λ (i) = λ i. For he purpose of his secion, we resric o λ (0, 1) Q. Le E = {exp λ : λ (0, 1) Q}, and consider he logic LTL disc [E]. For an LTL disc [E] formula ϕ we define he se F (ϕ) o be {λ 1,..., λ k : he operaor U expλ appears in ϕ}. Le ϕ be he lengh of he descripion of ϕ. Tha is, in addiion o ϕ, we include in ϕ he lengh, in bis, of describing F (ϕ). Theorem 2. Given an LTL disc [E] formula ϕ and a hreshold v [0, 1] Q, here exiss an AWA A ϕ,v such ha for every compuaion π he following hold. 1. If [π, ϕ] > v, hen A ϕ,v acceps π. 2. If A ϕ,v acceps π and π is a lasso compuaion, hen [π, ϕ] > v. Furhermore, he number of saes of A ϕ,v is singly exponenial in ϕ and in he descripion of v. The proof follows from he following observaion. Le λ (0, 1) and v (0, 1). When discouning by exp λ, he number of saes in he AWA consruced as per Theorem 1 is proporional o he maximal number i such ha λ i > v, which is a mos log λ v = log v log λ, which is polynomial in he descripion lengh of v and λ. A similar (ye more complicaed) consideraion is applied for he seing of muliple discouning funcions and negaions. 3.4 From A ϕ,v o an NBA Every AWA can be ranslaed o an equivalen nondeerminisic Büchi auomaon (NBA, for shor), ye he sae blowup migh be exponenial BKR10,MH84. By carefully analyzing he AWA A ϕ,v generaed in Theorem 1, we show ha i can be ranslaed o an NBA wih only a polynomial blowup. The idea behind our complexiy analysis is as follows. Translaing an AWA o an NBA involves alernaion removal, which proceeds by keeping rack of enire levels in a run-dag. Thus, a run of he NBA corresponds o a sequence of subses of Q. The key o he reduced sae space is ha he number of such subses is only Q O( ϕ ) and no 2 Q. To see why, consider a subse S of he saes of A. We say ha S is minimal if i does no include wo saes of he form ϕ < 1 and ϕ < 2, for 1 < 2, nor wo saes

11 of he form ϕu η +iψ < and ϕu η +j ψ <, for i < j, and similarly for >. Inuiively, ses ha are no minimal hold redundan asserions, and can be ignored. Accordingly, we resric he sae space of he NBA o have only minimal ses. Lemma 2. For an LTL disc [D] formula ϕ and v [0, 1], he AWA A ϕ,v consruced in Theorem 1 wih sae space Q can be ranslaed o an NBA wih Q O( ϕ ) saes. 3.5 Decision Procedures for LTL disc [D] Model checking and saisfiabiliy. Consider a Kripke srucure K, an LTL disc [D] formula ϕ, and a hreshold v. By checking he empiness of he inersecion of K wih A ϕ,1 v, we can solve he hreshold model-checking problem. Indeed, L(A ϕ,1 v ) L(K) iff here exiss a lasso compuaion π ha is induced by K such ha [π, ϕ] < v, which happens iff i is no rue ha [K, ϕ] v. The complexiy of he model-checking procedure depends on he discouning funcions in D. For he se of exponenial-discouning funcions E, we provide he following concree complexiies, showing ha i says in he same complexiy classes of sandard LTL model-checking. Theorem 3. For a Kripke srucure K, an LTL disc [E] formula ϕ, and a hreshold v [0, 1] Q, he problem of deciding wheher [K, ϕ] > v is in NLOGSPACE in he number of saes of K, and in PSPACE in ϕ and in he descripion of v. Proof. By Theorem 2 and Lemma 2, he size of an NBA B corresponding o ϕ and v is singly exponenial in ϕ and in he descripion of v. Hence, we can check he empiness of he inersecion of K and B via sandard on he fly procedures, geing he saed complexiies. Noe ha he complexiy in Theorem 3 is only NLOGSPACE in he sysem, since our soluion does no analyze he Kripke srucure, bu only akes is produc wih he specificaion s auomaon. This is in conras o he approach of model checking emporal logic wih (non-discouning) accumulaive values, where, when decidable, involves a doubly-exponenial dependency on he size of he sysem [4]. Finally, observe ha he NBA obained in Lemma 2 can be used o solve he hresholdsaisfiabiliy problem: given an LTL disc [D] formula ϕ and a hreshold v [0, 1], we can decide wheher here is a compuaion π such ha [π, ϕ] v, for {<, >}, and reurn such a compuaion when he answer is posiive. This is done by simply deciding wheher here exiss a word ha is acceped by he NBA. Threshold synhesis Consider an LTL disc [D] formula ϕ, and assume a pariion of he aomic proposiions in ϕ o inpu and oupu signals, we can use he NBA A ϕ,v in order o address he synhesis problem, as saed in he following heorem (see he full version for he proof). Theorem 4. Consider an LTL disc [D] formula ϕ. If here exiss a ransducer T all of whose compuaions π saisfy [π, ϕ] > v, hen we can generae a ransducer T all of whose compuaions τ saisfy [τ, ϕ] v.

12 4 Adding Proposiional Qualiy Operaors As model checking is decidable for LTL disc [D], one may wish o push he limi and exend he expressive power of he logic. In paricular, of grea ineres is he combining of discouning wih proposiional qualiy operaors [1]. 4.1 Adding he Average Operaor A well-moivaed exension is he inroducion of he average operaor, wih he [π,ϕ ]+ [π,ψ ] semanics [π, ϕ ψ ] = 2. The work in [1] proves ha exending LTL by his operaor, as well as wih oher proposiional quaniaive operaors, enables clean specificaion of qualiy and resuls in a logic for which he model-checking problem can be solved in PSPACE. We show ha adding he operaor o LTL disc [D] gives a logic, denoed LTL disc [D], for which he validiy and model-checking problems are undecidable. The validiy problem asks, given an LTL disc [D] formula ϕ over he aomic proposiions AP and a hreshold v [0, 1], wheher [π, ϕ] > v for every π (2 AP ) ω. In he undecidabiliy proof, we show a reducion from he 0-haling problem for wocouner machines. A wo-couner machine M is a sequence (l 1,..., l n ) of commands involving wo couners x and y. We refer o {1,..., n} as he locaions of he machine. There are five possible forms of commands: INC(c), DEC(c), GOTO l i, IF c=0 GOTO l i ELSE GOTO l j, HALT, where c {x, y} is a couner and 1 i, j n are locaions. Since we can always check wheher c = 0 before a DEC(c) command, we assume ha he machine never reaches DEC(c) wih c = 0. Tha is, he couners never have negaive values. Given a couner machine M, deciding wheher M hals is known o be undecidable [20]. Given M, deciding wheher M hals wih boh couners having value 0, ermed he 0-haling problem, is also undecidable: given a couner machine M, we can replace every HALT command wih a code ha clears he couners before haling. Theorem 5. The validiy problem for LTL disc [D] is undecidable (for every nonempy se of discouning funcions D). The proof goes along he following lines: We consruc from M an LTL disc [D] formula ϕ such ha M 0-hals iff here exiss a compuaion π such ha [π, ϕ] = 1 2. The idea behind he consrucion is as follows. The compuaion ha ϕ is verified wih corresponds o a descripion of a run of M, where every riple l i, α, β is encoded as he sring ix α y β #. The formula ϕ will require he following properies of he compuaion π (recall ha he seing is quaniaive, no Boolean): 1. The firs configuraion in π is he iniial configuraion of M, namely l 1, 0, 0, or 1# in our encoding. 2. The las configuraion in π is HALT, 0, 0, or k in our encoding, where k is a line whose command is HALT. 3. π represens a legal run of M, up o he consisency of he couners beween ransiions.

13 4. The couners are updaed correcly beween configuraions. Properies 1-3 can easily be capured by an LTL formula. Propery 4 uilizes he expressive power of LTL disc [D], as we now explain. The inuiion behind Propery 4 is he following. We compare he value of a couner before and afer a command, such ha he formula akes a value smaller han 1 2 if a violaion is encounered, and 1 2 oherwise. Since he value of couners can change by a mos 1, he essence of his formula is he abiliy o es equaliy of couners. We sar wih a simpler case, o demonsrae he poin. Le η D be a discouning funcion. Consider he formula CounA := au η a and he compuaion a i b j # ω. I holds ha [a i b j, CounA] = η(i). Similarly, i holds ha [a i b j # ω, au(bu η b)] = η(j). Denoe he laer by CounB. Le CompareAB := (CounA CounB) ( CounA CounB). We now have { ha } [a i b j # ω, CompareAB ] = min η(i)+1 η(j) 2, η(j)+1 η(i) 2 = 1 2 η(i) η(j) 2, and observe ha he laer is 1 2 iff i = j (and is less han 1 2 oherwise). This is because η is sricly decreasing, and in paricular an injecion. Thus, we can compare couners. To apply his echnique o he encoding of a compuaion, we use formulas ha parse he inpu and find successive occurrences of a couner. Since, by considering a Kripke srucure ha generaes all compuaions, i is easy o reduce he validiy problem o he model-checking problem, we can conclude wih he following. Theorem 6. The model-checking problem for LTL disc [D] is undecidable. 4.2 Adding Unary Muliplicaion Operaors As we have seen in Secion 4.1, adding he operaor o LTL disc [D] makes model checking undecidable. One may sill wan o find proposiional qualiy operaors ha we can add o he logic preserving is decidabiliy. In his secion we describe one such operaor. We exend LTL disc [D] wih he operaor λ, for λ (0, 1), wih he semanics [π, λ ϕ] = λ [π, ϕ]. This operaor allows he specifier o manually change he saisfacion value of cerain subformulas. This can be used o express imporance, reliabiliy, ec. of subformulas. For example, in G(reques (response 2 Xresponse), we limi 3 he saisfacion value of compuaions in which a response is given wih a delay o 2 3. Noe ha he operaor λ is similar o a one-ime applicaion of U exp +1, hus λ ϕ is λ equivalen o FalseU exp +1ψ. In pracice, i is beer o handle λ formulas direcly, by λ adding he following { ransiions o he consrucion in he proof { of Theorem 1. δ(ϕ > δ( λ ϕ >, σ) = λ, σ) if λ < 1, δ(ϕ < False if λ 1,δ( λϕ <, σ) = λ, σ) if λ 1, True if λ > 1. 5 Exensions LTL disc [D] wih Pas Operaors A useful augmenaion of LTL is he addiion of pas operaors [18]. These operaors enable he specificaion of clearer and more succinc

14 formulas while preserving he PSPACE complexiy of model checking. In he full version, we add discouning-pas operaors o LTL disc [D] and show how o perform model checking on he obained logic. The soluion goes via 2-way weak alernaing auomaa and preserves he complexiy of LTL disc [D]. Weighed Sysems In LTL disc [D], he verified sysem need no be weighed in order o ge a quaniaive saisfacion i sems from aking ino accoun he delays in saisfying he requiremens. Neverheless, LTL disc [D] also naurally fis weighed sysems, where he aomic proposiions have values in [0, 1]. In he full version we exend he semanics of LTL disc [D] o weighed Kripke srucures, whose compuaions assign weighs in [0, 1] o every aomic proposiion. We solve he corresponding model-checking problem by properly exending he consrucion of he auomaon A ϕ,v. Changing he Tendency of Discouning One may observe ha in our discouning scheme, he value of fuure formulas is discouned oward 0. This, in a way, reflecs an inuiion ha we are pessimisic abou he fuure. While in some cases his fis he needs of he specifier, i may well be he case ha we are ambivalen o he fuure. To capure his noion, one may wan he discouning o end o 1 2. Oher values are also possible. For example, i may be ha we are opimisic abou he fuure, say when a sysem improves is performance while running and we know ha componens are likely o funcion beer in he fuure. We may hen wan he discouning o end, say, o 3 4. To capure his noion, we define he operaor O η,z, parameerized by η D and z [0, 1], wih he semanics. [π, ϕo η,z ψ ] = sup i 0 {min{η(i)[π i, ψ ] + (1 η(i))z, min 0 j<i η(j)[π j, ϕ] + (1 η(j))z}}. The discouning funcion η deermines he rae of convergence, and z deermines he limi of he discouning. In he full version, we show how o augmen he consrucion of A ϕ,v wih he operaor O in order o solve he model-checking problem. 6 Discussion An abiliy o specify and o reason abou qualiy would ake formal mehods a significan sep forward. Qualiy has many aspecs, some of which are proposiional, such as prioriizing one saisfacion scheme on op of anoher, and some are emporal, for example having higher qualiy for implemenaions wih shorer delays. In his work we provided a soluion for specifying and reasoning abou emporal qualiy, augmening he commonly used linear emporal logic (LTL). A saisfacion scheme, such as ours, ha is based on elapsed imes inroduces a big challenge, as i implies infiniely many saisfacion values. Noneheless, we showed he decidabiliy of he model-checking problem, and for he naural exponenial-decaying saisfacions, he complexiy remains as he one for sandard LTL, suggesing he ineresing poenial of he new scheme. As for combining proposiional and emporal qualiy operaors, we showed ha he problem is, in general, undecidable, while cerain combinaions, such as adding prioriies, preserve he decidabiliy and he complexiy. Acknowledgemen. We hank Eleni Mandrali for poining o an error in an earlier version of he paper.

15 References 1. S. Almagor, U. Boker, and O. Kupferman. Formalizing and reasoning abou qualiy. In 40h ICALP, S. Almagor, Y. Hirshfeld, and O. Kupferman. Prompness in ω-regular auomaa. In 8h ATVA, LNCS 6252, pages 22 36, M. Bojańczyk and T. Colcombe. Bounds in ω-regulariy. In 21s LICS, pages , U. Boker, K. Chaerjee, T.A. Henzinger, and O. Kupferman. Temporal Specificaions wih Accumulaive Values. In 26h LICS, pages 43 52, E. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, M. Dam. CTL and ECTL as fragmens of he modal µ-calculus. TCS, 126:77 96, L. de Alfaro, M. Faella, T. Henzinger, R. Majumdar, and M. Soelinga. Model checking discouned emporal properies. TCS, 345(1): , L. de Alfaro, T. Henzinger, and R. Majumdar. Discouning he fuure in sysems heory. In 30h ICALP, LNCS 2719, pages , M. Drose and G. Rahonis. Weighed auomaa and weighed logics wih discouning. TCS, 410(37): , M. Drose and H. Vogler. Weighed auomaa and muli-valued logics over arbirary bounded laices. TCS, 418:14 36, M. Faella, A. Legay, and M. Soelinga. Model checking quaniaive linear ime logic. Elecr. Noes Theor. Compu. Sci., 220(3):61 77, P. Gasin and D. Oddoux. Fas LTL o Büchi auomaa ranslaion. In 13h CAV, LNCS 2102, pages Springer, S.H. Kan. Merics and Models in Sofware Qualiy Engineering. Addison-Wesley Longman Publishing Co., O. Kupferman, N. Pierman, and M.Y. Vardi. From Liveness o Prompness. In 19h CAV, LNCS 4590, pages Springer, D. Krob. The equaliy problem for raional series wih mulipliciies in he ropical semiring is undecidable. Inernaional Journal of Algebra and Compuaion, 4(3): , M. Kwiakowska. Quaniaive verificaion: models echniques and ools. In ESEC/SIGSOFT FSE, pages , F. Laroussinie and P. Schnoebelen. A hierarchy of emporal logics wih pas. In 11h STACS, pages 47 58, O. Lichensein, A. Pnueli, and L. Zuck. The glory of he pas. In Logics of Programs, LNCS 193, pages Springer, E. Mandrali. Weighed LTL wih discouning. In CIAA, LNCS 7381, pages , M. Minsky. Compuaion: Finie and Infinie Machines. Prenice Hall, 1 ediion, S. Miyano and T. Hayashi. Alernaing finie auomaa on ω-words. TCS, 32: , M. Mohri. Finie-sae ransducers in language and speech processing. Compuaional Linguisics, 23(2): , S. Moon, K. Lee, and D. Lee. Fuzzy branching emporal logic. IEEE Transacions on Sysems, Man, and Cyberneics, Par B, 34(2): , A. Pnueli and R. Rosner. On he synhesis of a reacive module. In Proc. 16h POPL, pages , L. Shapley. Sochasic games. In Proc. of he Naional Academy of Science, vol. 39, D. Spinellis. Code Qualiy: The Open Source Perspecive. Addison-Wesley Professional, M.Y. Vardi. An auomaa-heoreic approach o linear emporal logic. In Logics for Concurrency: Srucure versus Auomaa, LNCS 1043, pages , M. Vardi and P. Wolper. An auomaa-heoreic approach o auomaic program verificaion. In 1s LICS, pages , 1986.