Model Checking Lecture 2
Slide 2Three imperative choices while picking framework properties: automata versus rationale stretching versus straight time wellbeing versus liveness The three choices are orthogonal, and they prompt considerably distinctive model-checking issues.
Slide 3If just widespread properties are of interest, why not exclude the way quantifiers?
Slide 4LTL (Linear Temporal Logic) - security & liveness - straight time [Pnueli 1977; Lichtenstein & Pnueli 1982]
Slide 5LTL Syntax ::= a | | | | U
Slide 6LTL Model interminable follow t = t 0 t 1 t 2 ... (succession of perceptions)
Slide 7Language of halt free state-move diagram K at state q : L(K,q) = set of unending hints of K beginning at q (K, q) |= iff for all t L(K,q), t |= (K, q) |= iff exists t L(K,q), t |=
Slide 8LTL Semantics t |= a iff a t 0 t |= iff t |= and t |= t |= iff not t |= t |= iff t 1 t 2 ... |= t |= U iff exists n 0 s.t. 1. for each of the 0 i < n, t i t i+1 ... |= 2. t n t n+1 ... |=
Slide 9Defined modalities X next U until = genuine U F eventually = G dependably W = ( U ) W sitting tight for (frail until)
Slide 10Summary of modalities STL U W CTL the majority of the above and W U LTL U W
Slide 11Important properties Invariance a wellbeing (pc1=in pc2=in) Sequencing a W b W c W d security (pc1=req (pc2 in) W (pc2=in) W (pc2 in) W (pc1=in)) Response (a b) liveness (pc1=req (pc1=in))
Slide 12Composed modalities a infinitely frequently a a almost dependably a
Slide 13Where did decency go ?
Slide 14Unlike in CTL, reasonableness can be communicated in LTL ! So there is no requirement for reasonableness in the model. Feeble (Buchi) reasonableness : (empowered taken ) = (empowered taken) Strong (Streett) decency : ( empowered ) ( taken )
Slide 15Starvation opportunity, amended (pc2=in ( pc2=out)) (pc1=req (pc1=in))
Slide 16CTL can\'t express decency a a b b q 1 q 0 q 2 an a b
Slide 17LTL can\'t express fanning Possibility (a b) So, LTL and CTL are exceptional. (There are fanning rationales that can express reasonableness, e.g., CTL * = CTL + LTL, however they lose the computational allure of CTL.)
Slide 18System property: 2x2x2 decisions - wellbeing (limited runs) versus liveness (limitless runs) - direct time (follows) versus spreading time (trees) - rationale (decisive) versus automata (operational)
Slide 19Specification Automata Syntax, given a set An of nuclear perceptions: S finite set of states S 0 S set of starting states S S transition connection : S PL(A) where the equations of PL are ::= a | | for a A
Slide 20Language L(M) of detail machine M = (S, S 0 , , ) : boundless follow t 0 , t 1 , ... L(M) iff there exists a limitless run s 0 s 1 ... of M with the end goal that for every one of the 0 i, t i |= (s i )
Slide 21Linear semantics of determination automata: dialect regulation (K, q) |= L M iff L(K,q) L(M) state-move diagram condition of K particular robot unending follows
Slide 22L blade (K,q) = set of limited hints of K beginning at q L balance (M) characterized as takes after: limited follow t 0 , ..., t n L balance (M) iff there exists a limited run s 0 s 1 ... s n of M with the end goal that for each of the 0 i n, t i |= (s i )
Slide 23(K, q) |= L M iff L(K,q) L(M) iff L balance (K,q) L balance (M) Proof requires three realities: K is without stop each state in K has a move from it M is limited expanding: number of moves from a state in M is limited Konig\'s lemma A limited fanning interminable tree has an unbounded way
Slide 24(K, q) |= L M iff L balance (K,q) L balance (M) To confirm (K, q) |= L M, check finitary follow regulation
Slide 25Invariance particular machine pc1 in pc2 in
Slide 26One-limited overwhelming determination robot pc1=req pc2 in pc1=req pc2=in pc1=out pc1=in pc1=req pc2 in
Slide 27Automata are more expressive than rationale, since worldly rationale can\'t tally : Let A = { a } a genuine This can\'t be communicated in LTL. (What about a (a a) ?)
Slide 28 a an a
Slide 29 a an a genuine
Slide 30 a an a (a a)
Slide 31 a an a truth be told, no LTL recipe with at most two events of can recognize the two follows. Evidence?
Slide 32Checking dialect control between limited automata is PSPACE-finished ! L(K,q) L(M) iff L(K,q) supplement( L(M) ) = includes determinization (subset development)
Slide 33practically speaking: 1. use screen automata 2. use reenactment as an adequate condition
Slide 34Monitor Automata Syntax: same as determination automata, except additionally set E S of mistake states Semantics: characterize L(M) s.t. runs must end in blunder states (K, q) |= C M iff L(K,q) L(M) =
Slide 35Invariance screen machine pc1 in pc2 in pc1 = in pc2 = in ERROR
Slide 36One-limited surpassing screen robot pc1=req pc2in pc1=req pc2=in pc1=out ERROR pc1=req pc2=in pc1=req pc2in pc1=in
Slide 37Specification automaton Monitor robot M complement(M) - portray right traces -depict mistake follows - check dialect control -check void (straight): (exponential) reachability of mistake expresses "All security confirmation is reachability checking."
Slide 38by and by: 1. use screen automata 2. use reenactment as adequate condition
Slide 39Branching semantics of particular automata: recreation conditions of (K, q) |= B M iff there exists a reproduction connection R Q S s.t. (q,s) R for some underlying state s of M conditions of M
Slide 40R Q S is a recreation connection iff (q,s) R infers [q] |= (s) for all q\' s.t. q q\' , exists s\' s.t. s s\' and (q\',s\') R. [Milner 1974]
Slide 41q |= L a genuine a b c c b
Slide 42q |= B a genuine a b c c b
Slide 43includes just follows (henceforth direct !) (K, q) |= L M M dialect contains (K,q) : exponential check (K, q) |= B M M recreates (K,q) : quadratic check X includes states (thus fanning !)
Slide 44by and by, reproduction is typically the "right" idea. (On the off chance that there is dialect control, however not reenactment, this is typically inadvertent, not by configuration.)
Slide 45Branching semantics of particular automata, elective definition: follow tree regulation (K, q) |= B M iff T(K,q) T(M) limited follow trees
Slide 46Omega Automata - security & liveness (unbounded runs !) - detail versus screen automata - direct (dialect regulation) versus spreading (reenactment) semantics We talk about just the direct detail case.
Slide 47Specification Omega Automata Syntax concerning limited automata, what\'s more an acknowledgment condition: Buchi: BA S
Slide 48Language L(M) of particular omega-robot M = (S, S 0 , , , BA ) : interminable follow t 0 , t 1 , ... L(M) iff there exists an interminable run s 0 s 1 ... of M to such an extent that 1. s 0 s 1 ... fulfills BA 2. for all i 0, t i |= (s i )
Slide 49Let Inf(s) = { p | p = s i for limitlessly numerous i }. The boundless run s fulfills the acknowledgment condition BA iff Buchi: Inf(s) BA
Slide 50Linear semantics of particular omega automata: omega-dialect control (K, q) |= L M iff L(K,q) L(M) interminable follows
Slide 51Response determination machine : (a b) expecting (a b) = false s 1 a b s 2 s 0 b a s 3 Buchi condition { s 0 , s 3 }
Slide 52Response screen robot : (a b) accepting (a b) = false genuine a b s 0 s 1 s 2 Buchi condition { s 2 }
Slide 53 an a a s 1 s 0 Buchi condition { s 0 }
Slide 54 an a a s 1 s 0 a s 2 Buchi condition { s 2 }
Slide 55Omega automata are entirely more expressive than LTL. Omega-automata: omega-consistent dialects LTL: sans counter omega-standard dialects
Slide 56a genuine (p) ( p p (p p) (p a)) (p) ( p(0) p(1) (t) (p(t) p(t+2)) (t) (p(t) a(t))) (a; genuine)