121 MotivationContext veri cationoftimedsystemstowardslineartimetimedtemporallogics 221 MotivationContext veri cationoftimedsystemstowardslineartimetimedtemporallogics 1 lineartimetimedtempora ID: 406200
Download Pdf The PPT/PDF document "TheCostofPunctualityPatriciaBouyer,Nicol..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
TheCostofPunctualityPatriciaBouyer,NicolasMarkey,JoelOuaknine,JamesWorrellLSV{CNRS&ENSdeCachan{FranceOxfordUniversityComputingLaboratory{UK 1/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 2/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 1. linear-timetimedtemporallogics:interestingforspecifyingpropertiesofsystems,butwecannotverifythem! [AH93] 2/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 1. linear-timetimedtemporallogics:interestingforspecifyingpropertiesofsystems,butwecannotverifythem! [AH93] 2.MITL ,apalliativetothesenegativeresults [AFH96] ( MITL :disallowspunctualconstraints) 2/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 1. linear-timetimedtemporallogics:interestingforspecifyingpropertiesofsystems,butwecannotverifythem! [AH93] 2.MITL ,apalliativetothesenegativeresults [AFH96] ( MITL :disallowspunctualconstraints) !punctualityisundecidable! 2/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 1. linear-timetimedtemporallogics:interestingforspecifyingpropertiesofsystems,butwecannotverifythem! [AH93] 2.MITL ,apalliativetothesenegativeresults [AFH96] ( MITL :disallowspunctualconstraints) !punctualityisundecidable! 3.Safety-MTL :adecidablelogicwhichpartlyallowspunctuality [OW0f5,6g] However,itis non-primitiverecursive ! 2/21 MotivationContext: veri cationoftimedsystemstowardslinear-timetimedtemporallogics 1. linear-timetimedtemporallogics:interestingforspecifyingpropertiesofsystems,butwecannotverifythem! [AH93] 2.MITL ,apalliativetothesenegativeresults [AFH96] ( MITL :disallowspunctualconstraints) !punctualityisundecidable! 3.Safety-MTL :adecidablelogicwhichpartlyallowspunctuality [OW0f5,6g] However,itis non-primitiverecursive ! 4. weproposeatractablethoughpowerfullinear-timetimedtemporallogicwhichallowspunctuality... 2/21 MetricTemporalLogicMTL :MetricTemporalLogic [Koymans1990] MTL 3'::=aj:aj'_'j'^'j'UI j'eUI'whereIisanintervalwithintegralbounds 3/21 MetricTemporalLogicMTL :MetricTemporalLogic [Koymans1990] MTL 3'::=aj:aj'_'j'^'j'UI j'eUI'whereIisanintervalwithintegralboundsWeinterpret MTL formulasovertimedwords(thisistheso-calledpoint-basedsemantics): 3/21 MetricTemporalLogicMTL :MetricTemporalLogic [Koymans1990] MTL 3'::=aj:aj'_'j'^'j'UI j'eUI'whereIisanintervalwithintegralboundsWeinterpret MTL formulasovertimedwords(thisistheso-calledpoint-basedsemantics): Weuseclassicalshorthands,likeF,G,X,etc... 3/21 MetricTemporalLogicMTL :MetricTemporalLogic [Koymans1990] MTL 3'::=aj:aj'_'j'^'j'UI j'eUI'whereIisanintervalwithintegralboundsWeinterpret MTL formulasovertimedwords(thisistheso-calledpoint-basedsemantics): Weuseclassicalshorthands,likeF,G,X,etc... I G2 !F=1 3/21 MetricTemporalLogicMTL :MetricTemporalLogic [Koymans1990] MTL 3'::=aj:aj'_'j'^'j'UI j'eUI'whereIisanintervalwithintegralboundsWeinterpret MTL formulasovertimedwords(thisistheso-calledpoint-basedsemantics): Weuseclassicalshorthands,likeF,G,X,etc... I G2 !F=1 I ( U�3 )U[0;1](F�1 ) 3/21 InterestingFragmentsofMTLMTL 3'::=aj:aj'_'j'^'j'U I 'j'eU I ' MTL InterestingFragmentsofMTLLTL 3'::=aj:aj'_'j'^'j'U'j'eU' MTLLTL [Pnueli77] InterestingFragmentsofMTLMITL 3'::=aj:aj'_'j'^'j'U I 'j'eU I 'with I non-singular,i.e.,withno\punctuality" MTLLTLMITL [AFH96] InterestingFragmentsofMTLBounded-MTL 3'::=aj:aj'_'j'^'j'U I 'j'eU I 'with I bounded MTLLTLMITL Bounded-MTL InterestingFragmentsofMTLSafety-MTL 3'::=aj:aj'_'j'^'j'U J 'j'eU I 'with J bounded MTLLTLMITL Bounded-MTLSafety-MTL Bounded-MTL +Invariance Safety-MTL [OW05] InterestingFragmentsofMTLFlat-MTL 3'::=aj:aj'_'j'^'j U I 'j'eU I with I unbounded) 2 LTLMTLLTLMITL Bounded-MTLSafety-MTL InterestingFragmentsofMTLcoFlat-MTL 3'::=aj:aj'_'j'^'j'U I j eU I 'with I unbounded) 2 LTLMTLLTLMITL Bounded-MTLSafety-MTL coFlat-MTL Bounded-MTL +Invariance coFlat-MTL 4/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . 5/21 SomeExamplesofFormulasI Grequest!F[0;1](acquire^F=1release)isin coFlat-MTL ,butneitherin Bounded-MTL ,norin MITL . I 'n= ^ Double ^G[0;2n) Double where Double = !F=1( ^X1 )^ !F=1( ^X1 )isin Bounded-MTL . !enforcesinpolynomialspaceadoublyexponentialvariability 5/21 SomeExamplesofFormulas(cont'd)I Half =F=1tt_X61F=1tt!mayeliminateoneovertwoactions 6/21 SomeExamplesofFormulas(cont'd)I Half =F=1tt_X61F=1tt!mayeliminateoneovertwoactions I theformula ^ Double ^G[0;2n) Double ^G[2n;2n+1) Half ^F=2n+1( ^X=1tt)henceenforcesexactdoublingandhal ng... 6/21 ComplexityResults Overin nitetimedwords: ModelChecking Satis ability LTL PSPACE-C. [folklore] PSPACE-C. [folklore] MITL EXPSPACE-C. [AFH96] EXPSPACE-C. [AFH96] Bounded-MTL Safety-MTL Decidable [OW06] coFlat-MTL MTL Undec. [AH93,OW06] Undec. [AH93,OW06] 7/21 ComplexityResults Overin nitetimedwords: ModelChecking Satis ability LTL PSPACE-C. [folklore] PSPACE-C. [folklore] MITL EXPSPACE-C. [AFH96] EXPSPACE-C. [AFH96] Bounded-MTL Safety-MTL Non-Prim.-Rec. [forthc.] Non-Elem. [forthc.] coFlat-MTL Undec. [OW06] MTL Undec. [AH93,OW06] Undec. [AH93,OW06] 7/21 ComplexityResults Overin nitetimedwords: ModelChecking Satis ability LTL PSPACE-C. [folklore] PSPACE-C. [folklore] MITL EXPSPACE-C. [AFH96] EXPSPACE-C. [AFH96] Bounded-MTL EXPSPACE-C. EXPSPACE-C. Safety-MTL Non-Prim.-Rec. [forthc.] Non-Elem. [forthc.] coFlat-MTL EXPSPACE-C. Undec. [OW06] MTL Undec. [AH93,OW06] Undec. [AH93,OW06] 7/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 AnExample AssumeonewantstoverifyformulaG2 !F=1 =1 Oine,westackalltimeunitsanduseaslidingwindow: 8/21 ChannelAutomata server c2?msg c2?req c1!ackclient c2!msg c2!stop c1?ack c1?hup channelc1 ack ack hup channelc2 msg stop NB:channelsareFIFO... 9/21 ExtendedChannelAutomata Weextendchannelautomatawith: I renaming(alettercanbereplacednon-deterministicallybyanotherone); I occurrencetesting(checkwhethersomeletterappearsonthechannel).! CAROT 10/21 ExtendedChannelAutomata Weextendchannelautomatawith: I renaming(alettercanbereplacednon-deterministicallybyanotherone); I occurrencetesting(checkwhethersomeletterappearsonthechannel).! CAROT s t u v a! ; b! R d? d! a? ; b? c? where R non-deterministicallyrename b toeither b or c . 10/21 ExtendedChannelAutomata Weextendchannelautomatawith: I renaming(alettercanbereplacednon-deterministicallybyanotherone); I occurrencetesting(checkwhethersomeletterappearsonthechannel).! CAROT s t u v a! ; b! R d? d! a? ; b? c? where R non-deterministicallyrename b toeither b or c . Wewillbeinterestedinthereachabilityproblemfor CAROT swhenweboundthenumberofcyclesofthemachine 10/21 s t u v a! ; b! R d? d! a? ; b? c? where R : b 7! b _ c 11/21 s t u v a! ; b! R d? d! a? ; b? c? where R : b 7! b _ c Computationtable,startingwith d onthechannel: s b! s b! s R t d? u d! v b? v c? s a! s b! s R t d? u d! v a? v c? s b! s R t d? u d! v c? s R u d? u d! v 11/21 s b! s b! s R t d? u d! v b? v c? s a! s b! s R t d? u d! v a? v c? s b! s R t d? u d! v c? s R u d? u d! v 12/21 s b! s b! s R t d? u d! v b? v c? s a! s b! s R t d? u d! v a? v c? s b! s R t d? u d! v c? s R u d? u d! v Computationtablewithslidingwindow: s b! s b! s R t d? uuu d! vvvvvvv v b? v c? s a! s b! s R t d? u d! vvvvv vvv vv a? v c? s b! s R t d? u d! vvv vvv vvvvv v c? s R uuu d? u d! v 12/21 s b! s b! s R t d? u d! v b? v c? s a! s b! s R t d? u d! v a? v c? s b! s R t d? u d! v c? s R u d? u d! v Computationtablewithslidingwindow: s b! s b! s R t d? uuu d! vvvvvvv v b? v c? s a! s b! s R t d? u d! vvvvv vvv vv a? v c? s b! s R t d? u d! vvv vvv vvvvv v c? s R uuu d? u d! v Weneedtostoreawindowandsomeextrainformationfortherenamingfunctionsandtheoccurrencetesting. 12/21 Theorem Thecycle-boundedreachabilityproblemforCAROTsissolvableinpoly-nomialspaceinthesizeofthechannelautomatonandpolynomialspaceinthevalueofthecyclebound.(Canguessandverifyacomputationtableusingpolynomialspace.) 13/21 ApplicationtoTimedTemporalLogicsI Transforman MTL formula'intoanequivalentone-clockalternatingtimedautomatonA' [OW05] G2 !F=1 14/21 ApplicationtoTimedTemporalLogicsI Transforman MTL formula'intoanequivalentone-clockalternatingtimedautomatonA' [OW05] G2 !F=1 r s x:=0 x2; t x=1; 14/21 r s x:=0 x2; t x=1; 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t r;0 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t r;0s;0 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t s;0r;1 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t s;0r;1s;0 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t r;1s;0s;1 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t r;1s;0t 15/21 r s x:=0 x2; t x=1; I SeeabehaviourofthisautomatonasthecontentofaFIFOchannel r;0r;0:6r;0:7s;0r;1:5s;0s;0:8r;1:7s;0:2t r;1s;0t FromMTLtoCAROTs Everyformula'canbetransformedintoaCAROTthat\accepts"themodelsof'. 15/21 ADigressiononTimedAutomata r0r1r0r1xy 16/21 ADigressiononTimedAutomata r0r1r0r1xyx;y2r0,fygfxg (y;r0)(x;r0) 16/21 ADigressiononTimedAutomata r0r1r0r1xyx2r1,y2r0,fxgfyg (x;r1)(y;r0) 16/21 ADigressiononTimedAutomata r0r1r0r1xyx;y2r1,fygfxg (y;r1)(x;r1) 16/21 ADigressiononTimedAutomata r0r1r0r1xy Theregiongraphcanbesimulatedbyachannelmachine(withasingleboundedchannel). 16/21 BacktocoFlat-MTL Wewanttoboundthenumberofcyclesneededbythe CAROT toachievemodel-checkingof coFlat-MTL ,ormoresimplythesatis abilityof Flat-MTL . Flat-MTL 3'::=aj:aj'_'j'^'j U I 'j'eU I with I unbounded) 2 LTL 17/21 BacktocoFlat-MTL Wewanttoboundthenumberofcyclesneededbythe CAROT toachievemodel-checkingof coFlat-MTL ,ormoresimplythesatis abilityof Flat-MTL . Flat-MTL 3'::=aj:aj'_'j'^'j U I 'j'eU I with I unbounded) 2 LTL Asliceoftheautomaton:f( aUb ;1:6);( (pUq)U(F=1a) ; 2:5 );( G�3(p_q) ; 4:1 );( (F1q)U64a ; 3:9 )g 17/21 BacktocoFlat-MTL Wewanttoboundthenumberofcyclesneededbythe CAROT toachievemodel-checkingof coFlat-MTL ,ormoresimplythesatis abilityof Flat-MTL . Flat-MTL 3'::=aj:aj'_'j'^'j U I 'j'eU I with I unbounded) 2 LTL Asliceoftheautomaton:f( aUb ;1:6);( (pUq)U(F=1a) ; 2:5 );( G�3(p_q) ; 4:1 );( (F1q)U64a ; 3:9 )gItsencodingis:f( (pUq)U(F=1a) ; � );( G�3(p_q) ; ? );( (F1q)U64a ; � )gifwesupposethemaximalconstantis4. 17/21 BacktocoFlat-MTL Wewanttoboundthenumberofcyclesneededbythe CAROT toachievemodel-checkingof coFlat-MTL ,ormoresimplythesatis abilityof Flat-MTL . Flat-MTL 3'::=aj:aj'_'j'^'j U I 'j'eU I with I unbounded) 2 LTL Asliceoftheautomaton:f( aUb ;1:6);( (pUq)U(F=1a) ; 2:5 );( G�3(p_q) ; 4:1 );( (F1q)U64a ; 3:9 )gItsencodingis:f( (pUq)U(F=1a) ; � );( G�3(p_q) ; ? );( (F1q)U64a ; � )gifwesupposethemaximalconstantis4. � active ? inactive 17/21 ARankingFunction Weassumealinearorderonpairs( ;?�)with non- LTL modalsubformulaof',and?�2f � ; ? gsuchthat:( ; ? )( ; � )( 0;?�0)( ;?&#x-5.1;䝀)if 0subformulaof 18/21 ARankingFunction Weassumealinearorderonpairs( ;?�)with non- LTL modalsubformulaof',and?�2f � ; ? gsuchthat:( ; ? )( ; � )( 0;?�0)( ;?&#x-5.1;䝀)if 0subformulaof rank (\r)=u: where highestactivesubformula,anduallinactivesubformulas(orderedwith)whicharelargerthan 18/21 ARankingFunction Weassumealinearorderonpairs( ;?�)with non- LTL modalsubformulaof',and?�2f � ; ? gsuchthat:( ; ? )( ; � )( 0;?�0)( ;?&#x-5.1;䝀)if 0subformulaof rank (\r)=u: where highestactivesubformula,anduallinactivesubformulas(orderedwith)whicharelargerthan +weordertherankswiththelexicographicorder 18/21 ARankingFunction Weassumealinearorderonpairs( ;?�)with non- LTL modalsubformulaof',and?�2f � ; ? gsuchthat:( ; ? )( ; � )( 0;?�0)( ;?&#x-5.1;䝀)if 0subformulaof rank (\r)=u: where highestactivesubformula,anduallinactivesubformulas(orderedwith)whicharelargerthan +weordertherankswiththelexicographicorder Properties I if\r!\r0,then rank (\r0)6 rank (\r) I if\risactive(resp.inactive)and\r0isinactive(resp.active),andif\r!\r0,then rank (\r0) rank (\r) I if%:\r!\r0,andduration(%)�M,then rank (\r0) rank (\r) 18/21 ARankingFunction Weassumealinearorderonpairs( ;?�)with non- LTL modalsubformulaof',and?�2f � ; ? gsuchthat:( ; ? )( ; � )( 0;?�0)( ;?&#x-5.1;䝀)if 0subformulaof rank (\r)=u: where highestactivesubformula,anduallinactivesubformulas(orderedwith)whicharelargerthan +weordertherankswiththelexicographicorder Properties I if\r!\r0,then rank (\r0)6 rank (\r) I if\risactive(resp.inactive)and\r0isinactive(resp.active),andif\r!\r0,then rank (\r0) rank (\r) I if%:\r!\r0,andduration(%)�M,then rank (\r0) rank (\r)Hence,%=%0%1:::%2n+1with%2i(resp.%2i+1)active(resp.inactive)andPni=0duration(%2i)6(M+1)j'j2j'j 18/21 ModelCheckingcoFlatMTL ApplyingthepreviousdecompositionofrunsandthecomplexityofanalyzingCAROTs,wegetthefollowingresult: Theorem Themodelcheckingof coFlat-MTL isinEXPSPACE. pure LTL pure LTL pure LTL pure LTL active active active active 19/21 Hardness Theorem Thesatis abilityproblemfor Bounded-MTL isEXPSPACE-Hard. 20/21 Hardness Theorem Thesatis abilityproblemfor Bounded-MTL isEXPSPACE-Hard.EncodethehaltingproblemofanEXPSPACETuringmachine: I generateadoublyexponentialnumberofeventsinonetimeunit I onthenexttimeunit,non-deterministicallyguessacomputationoftheEXPSPACETuringmachine I checkitiscorrect(requires2ntimeunits,oneforeachcellofthemachine) I half,andcheckthatonlyoneeventremains 20/21 Conclusion Inthiswork,wehaveexhibitedasubclassof MTL which: I containspunctualconstraints, I containsinvariance, I istractableintheory. 21/21 Conclusion Inthiswork,wehaveexhibitedasubclassof MTL which: I containspunctualconstraints, I containsinvariance, I istractableintheory.Whatneedstobedone: I checktractabilityinpractice, I extendtocontinuoussemantics. 21/21