Verification of critical systems
Kripke structure and temporal logics
Summary
I Kripke structure
I Temporal logics
I Logics for verification
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Basic modal logic: Syntax
I It is composed by propositional logic; and
I Two extras connectives:
I ⇤, necessarily
I ⌃, possibility
::=?| > | p | ¬ | ( ^ ) | ( _ ) | ( $ ) | ⇤ | ⌃ ,
where p is a atomic formula
I Examples of parse trees:
I (p ^ ⌃(p ! ⇤¬r ))
I ⇤((⌃q ^ ¬r ) ! ⇤p))
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Kripke structure: Semantic
I Basic modal logics are specified by:
I set W , whose elements are called worlds
I relation R on W called accessibility relation (R ✓ W ⇥ W )
I function L : W ! P(Atoms) called labeling function
I Semantic is given by M = (W , R, L),
I w 2 W is a possible world;
I wRw 0 means that w 0 is a world related to the world w ;
I Satisfaction relation: x ✏
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Satisfaction relation
I By induction on , x ✏
x
is given as follow:
>;
x 1 ?;
x
x
x
p i↵ p 2 L(x);
¬
x
x
x
x
⇤
x
⌃
i↵ x 1 ;
^
i↵ x
and x
;
_
i↵ x
, or x
;
!
i↵ x
, whenever we have x
$
i↵ x
, i↵ x
;
;
i↵ , for each y 2 W with R(x, y ), we have y
i↵ there is a y 2 W such that R(x, y ) and y
;
;
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Kripke model
I An example of Kripke structure
x2
p, q
x1
q
M = (W , R, L)
x3
p
x1 q, since q 2 L(x1 ); and
x1 ⌃q, where there is a world related to x1 , x2 which satisfies q,
therefore R(x1 , x2 ) and x2 q
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
LTL and Büchi Automata
I Büchi automata can encode LTL properties
I Example:
>
a
b
aU b
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Kripke ⇥ Automaton
I Transform Kripke structure into an Automaton
I Example of Kripke structure:
{p, q}
s0
{q}
s2
s1
{p}
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Kripke ⇥ Automaton (cont.)
I Automaton representation:
{p, q}
{p, q}
s0
{p}
sI
s2
{p, q}
{p}
s1
{q}
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Examples of Formulas
I Reachability: ⇤¬(c1 ^ c2 )
It always holds that c1 and c2 do not appear together
I Liveness: (¬x)U y
x does not occur before the first occurrence of y , and y does
eventually occur.
Verification of critical systems
Kripke structure and temporal logics
Kripke Structure
Formulas and schemes
I Example of scheme: p ! ⇤⌃p
I Examples of valid formulas:
¬⇤ $ ⌃¬
⇤( ^ ) $ ⇤ ^ ⇤
⌃( _ ) $ ⌃ _ ⌃
I Some sort pf modal logics:
K (weakest): there exist only propositional logics (scheme K)
(⇤( ! ) ! (⇤ ! ⇤ ));
KT45, or S5: axiom T (reflexive), 4 (transitive) e 5 (euclidean);
KT4, or S4: relation R is reflexive and transitive over the Kripke
model.
Verification of critical systems
Kripke structure and temporal logics
Temporal logics
Linear and Branching time logic
I LTL (Linear temporal logic):
I its computation evolves in a sequence with a unique future
I it does not use existential and universal quantifiers
I it has discrete time in which processes share the global clock
::= p | (¬ ) | ( ^ ) | ( U ) | (G ) | (F ) | (X )
I CTL (Computation tree logic):
I its computation evolves in a tree with several futures
I it uses existential and universal quantifiers
I it has discrete time in which processes share the global clock
::=> |?| p | (¬ ) | ( ^ ) | ( _ ) | ( ! ) |
AX
| EX
| A[ U ] | E [ U ] | AG | EG | AF
| EF
Verification of critical systems
Kripke structure and temporal logics
Temporal logics
CTL*
I LTL and CTL have the same expressiveness
I Mixing LTL and CTL has more expressiveness power:
there exists state formula ) evolves in states
::=p | > | ¬ |
^
| A[↵] | E [↵]
there exists path formula ) evolves along path
↵ ::= | ¬↵ | ↵ ^ ↵ | ↵U↵ | G ↵ | X ↵ | F ↵
? where p is a atomic formula and ↵ is a path formula.
Verification of critical systems
Kripke structure and temporal logics
Temporal logics
TCTL
I It specifies explicit time
I Timed computation tree logic:
I it is an extension of CTL
I syntax rules for TCTL formula
::= ⌘ | ¬ 1 |
1_
2 | x. 1 | 9 1 U 2 | 9⇤ 1
I it has dense time in which several clocks can be set, reset and
tested in a independent way
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Building formulas using CTL syntax
I Examples of well-formed CTL formulas:
I AG (q ! EGr )
I A[rUq]
I EFE [rUq]
I AGEGp ! AFr
I Examples of not well-formed CTL formulas:
I FGr (since F and G must occur immediately after an E or an
A)
I AEFr
I F [rUq]
I A¬G ¬p
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Semantic
I Meaning of CTL formulas in M = (S, !, L) where:
I S is a set of states;
I ! is transition relation such that s, s 0 2 S, s ! s 0 ; and
I L is a labelling function such that L : S ! P(Atoms)
I M, s ✏ means:
? given any s 2 S, CTL formula
holds in state s of M
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Satisfaction relation
I ✏ is a satisfaction relation where:
M, s ✏> for all s 2 S;
M, s 2 ? for all s 2 S;
M, s ✏p i↵ p 2 L(s);
M, s ✏¬ i↵ M, s 2 ;
M, s ✏ ^
i↵ M, s ✏
and M, s ✏ ;
M, s ✏ !
i↵ M, s 2
or M, s ✏ ;
M, s ✏ _
M, s ✏AX
i↵ M, s ✏
or M, s ✏ ;
i↵ for all s1 such that s ! s1 we have M, s1 ✏
AX says: in every next state;
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Satisfaction relation (cont.)
I ✏ is a satisfaction relation where:
M, s ✏EX
i↵ for some s1 such that s ! s1 we have M, s1 ✏
M, s ✏AG
holds i↵ for all paths s1 ! s2 ! s3 ! . . . , where s1
M, s ✏EG
holds i↵ there is a path s1 ! s2 ! s3 ! . . . , where s1
M, s ✏AF
holds i↵ for all paths s1 ! s2 ! s3 ! . . . , where s1
M, s ✏EF
holds i↵ there is a path s1 ! s2 ! s3 ! . . . , where s1
EX says: in some next state;
equals s, and for all si along the path, we have M, si ✏
equals s, and for all si along the path, we have M, si ✏
equals s, there is some si such that M, si ✏
equals s, and for some si along the path, we have M, si ✏
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Satisfaction relation (cont.)
I ✏ is a satisfaction relation where:
M, s ✏A[ 1 U 2 ] holds i↵ there is a path s1 ! s2 ! s3 ! . . . , where s1
equals s, and that path satisfies
1 U 2 , i.e. there is some si
along the path, such that M, si ✏
2 , and, for each j < i
, we have M, sj ✏
1
M, s ✏A[ 1 U 2 ] holds i↵ there is a path s1 ! s2 ! s3 ! . . . , where s1
equals s, and that path satisfies
1 U 2 as specified in last
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Equivalence
I Some important equivalences in CTL formulas:
I ¬AF ⌘ EG ¬
I ¬EF ⌘ AG ¬
I ¬AX ⌘ EX ¬
I AF ⌘ A[>U ]
I EF ⌘ E [>U ]
I A[pUq] ⌘ ¬(E [¬qU (¬p ^ ¬q)] _ EG ¬q)
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Equivalence (cont.)
I Noteworthy equivalences (fixed point computation):
I AG ⌘ ^ AXAG
I EG ⌘ ^ EXEG
I AF ⌘ _ AXAF
I EF ⌘ _ EXEF
I A[ U ] ⌘ _ ( ^ AXA[ U ])
I E [ U ] ⌘ _ ( ^ EXE [ U ])
Verification of critical systems
Kripke structure and temporal logics
CTL Formulas and Verification
Kripke model for CTL formula
I An example of CTL formulas within Kripke model
AXp
S2
Ap
S1
EGq
M = (S, !, L)
I Checked formulas in this model:
M, s1 ✏p;
M, s2 ✏AXp;
M, s3 ✏EGq.
S3
0
