Lecture 4. Formal specifications: LTL, CTL ELEC-E8110 Automation - PowerPoint PPT Presentation

Lecture 4. Formal specifications: LTL, CTL ELEC-E8110 Automation Systems Synthesis and Analysis Igor Buzhinsky igor.buzhinskii@aalto.fi 2018 Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 1 / 37

State (reachability) graph of a system Nodes: all reachable states of the system If the system is modular, then the state of the system consists of the state of all its modules Directed edges: one-step evolutions of the state Multiple outgoing edges are possible from each state, i.e. nondeterminism is common Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 2 / 37

State graph: example NCES module (actually, a Petri net) Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 3 / 37

State graph: example NCES module (actually, a Petri net) State graph, state = p 1 p 2 p 3 Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 3 / 37

Kripke structures Formalization of a state graph Let AP be the a finite set of so-called atomic propositions Then M = ( S , I , T , L ) is a Kripke structure , where: S is a finite set of states I ⊂ S is a set of initial states T ⊂ S × S is a transition relation L : S → 2 AP is a labeling function No deadlock assumption: ∀ s ∈ S ∃ s ′ ∈ S : ( s , s ′ ) ∈ T Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 4 / 37

State graph interpreted as a Kripke structure Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : nodes of this graph I ⊂ S = Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : nodes of this graph I ⊂ S = { 101 } Note: in UPPAAL and NCES models there is always one initial state! T ⊂ S × S : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : nodes of this graph I ⊂ S = { 101 } Note: in UPPAAL and NCES models there is always one initial state! T ⊂ S × S : edges of the graph, e.g. (002 , 011), (011 , 002), ... L : S → 2 AP : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : nodes of this graph I ⊂ S = { 101 } Note: in UPPAAL and NCES models there is always one initial state! T ⊂ S × S : edges of the graph, e.g. (002 , 011), (011 , 002), ... L : S → 2 AP : token assignments (markings) in each state, e.g. L (020) = { “ p 0 = 0” , “ p 1 = 2” , “ p 3 = 0” } Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

State graph interpreted as a Kripke structure AP = { “ p i = j ” | i = 1 .. 3 , j = 0 .. 2 } S : nodes of this graph I ⊂ S = { 101 } Note: in UPPAAL and NCES models there is always one initial state! T ⊂ S × S : edges of the graph, e.g. (002 , 011), (011 , 002), ... L : S → 2 AP : token assignments (markings) in each state, e.g. L (020) = { “ p 0 = 0” , “ p 1 = 2” , “ p 3 = 0” } Specifications can be interpreted as predicates over Kripke structures Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 5 / 37

Kripke structures / state graphs for UPPAAL models? Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

Kripke structures / state graphs for UPPAAL models? AP: whether a state machine is in a certain state, whether a variable has a certain value S : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

Kripke structures / state graphs for UPPAAL models? AP: whether a state machine is in a certain state, whether a variable has a certain value S : ( s 1 , ..., s k , v 1 , ..., v m ) ∈ S if it is a reachable combination of states and variable values I ⊂ S : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

Kripke structures / state graphs for UPPAAL models? AP: whether a state machine is in a certain state, whether a variable has a certain value S : ( s 1 , ..., s k , v 1 , ..., v m ) ∈ S if it is a reachable combination of states and variable values I ⊂ S : single initial state ( s 01 , ..., s 0 k , v 01 , ..., v 0 m ) composed of initial individual states and variable values T ⊂ S × S : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

Kripke structures / state graphs for UPPAAL models? AP: whether a state machine is in a certain state, whether a variable has a certain value S : ( s 1 , ..., s k , v 1 , ..., v m ) ∈ S if it is a reachable combination of states and variable values I ⊂ S : single initial state ( s 01 , ..., s 0 k , v 01 , ..., v 0 m ) composed of initial individual states and variable values T ⊂ S × S : valid state transitions L : S → 2 AP : Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

Kripke structures / state graphs for UPPAAL models? AP: whether a state machine is in a certain state, whether a variable has a certain value S : ( s 1 , ..., s k , v 1 , ..., v m ) ∈ S if it is a reachable combination of states and variable values I ⊂ S : single initial state ( s 01 , ..., s 0 k , v 01 , ..., v 0 m ) composed of initial individual states and variable values T ⊂ S × S : valid state transitions L : S → 2 AP : individual states and variable values Note: we ignore timed capabilities of UPPAAL by now Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 6 / 37

System behaviors are paths in Kripke structures Infinite paths are common in formal verification. This is the reason why deadlocks are undesirable Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 7 / 37

System behaviors are paths in Kripke structures Infinite paths are common in formal What happens in terms of the verification. This is the reason why original system? deadlocks are undesirable Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 7 / 37

Single behavior view Assume that now we have only two atomic propositions: p and q All possible behaviors are infinite sequences over 2 { p , q } Example: { p , q } , { p } , {} , cycle( { q } , { p , q } ) Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 8 / 37

Single behavior view Assume that now we have only two atomic propositions: p and q All possible behaviors are infinite sequences over 2 { p , q } Example: { p , q } , { p } , {} , cycle( { q } , { p , q } ) Boolean logic is able to characterize single elements of such sequences Can we somehow introduce predicates over infinite sequences of atomic propositions? For example, to formulate a specification: each p is followed by ¬ p on the next step (which is false for the example) Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 8 / 37

Linear temporal logic (LTL) Formal language which extends the usual propositional Boolean logic Variables: atomic propositions, e.g. p and q Usual Boolean operators are allowed, e.g. p → q (i.e. ¬ p ∨ q ) is an LTL formula, but it refers to the first element of an infinite sequence Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 9 / 37

Linear temporal logic (LTL) Formal language which extends the usual propositional Boolean logic Variables: atomic propositions, e.g. p and q Usual Boolean operators are allowed, e.g. p → q (i.e. ¬ p ∨ q ) is an LTL formula, but it refers to the first element of an infinite sequence Temporal operators Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 9 / 37

Linear temporal logic (LTL) Formal language which extends the usual propositional Boolean logic Variables: atomic propositions, e.g. p and q Usual Boolean operators are allowed, e.g. p → q (i.e. ¬ p ∨ q ) is an LTL formula, but it refers to the first element of an infinite sequence Temporal operators G : g lobally (always), e.g. G ( p → q ) means “in each element of the sequence, p → q holds” Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 9 / 37

Linear temporal logic (LTL) Formal language which extends the usual propositional Boolean logic Variables: atomic propositions, e.g. p and q Usual Boolean operators are allowed, e.g. p → q (i.e. ¬ p ∨ q ) is an LTL formula, but it refers to the first element of an infinite sequence Temporal operators G : g lobally (always), e.g. G ( p → q ) means “in each element of the sequence, p → q holds” F : in the f uture, e.g. F ( p → q ) means “for some element of the sequence, p → q holds” Igor Buzhinsky Lecture 4. Formal specifications: LTL, CTL 2018 9 / 37