1. CIS 540 Principles of Embedded Computation Spring 2016 http://www.seas.upenn.edu/~cis540/ Instructor: Rajeev Alur alur@cis.upenn.edu

2. LTL Recap  Syntax: Formulas built from  Base formulas: Boolean-valued expressions over typed variables  Logical connectives: AND, OR, NOT, IMPLIES …  Temporal Operators: Always, Eventually, Next, Until  LTL formula is evaluated w.r.t. a trace  (infinite seq of valuations)  Semantics defined by rules for the satisfaction relation  A system satisfies LTL spec  if every infinite execution satisfies   Derived operators  Repeatedly (Always Eventually); Persistently (Eventually Always)  Sample requirement: Every req is eventually granted Always [ req=1  Eventually ( grant=1) ] CIS 540 Spring 2016; Lecture March 16

3. Temporal Implications and Equivalences  Understanding subtle differences among different variants of LTL formulas can be tricky  Formula  is stronger than the formula  : whenever a trace satisfies , it is guaranteed to satisfy   Every trace satisfies the implication     Formula  is equivalent to the formula  : a trace satisfies  if and only if it satisfies   Two formulas express exactly the same requirement  Knowing some standard equivalences can be useful for simplifying formulas CIS 540 Spring 2016; Lecture March 16

4. Temporal Implications and Equivalences  Always  is stronger than   Repeatedly  is equivalent to ~ Persistently ~   Persistently  is stronger than Repeatedly   Always  is equivalent to [  & Next Always  ]  What’s the relationship between  Always Eventually   Next Always Eventually   Eventually Always Eventually  CIS 540 Spring 2016; Lecture March 16

5. Logical Connectives and Temporal Operators  Are these equivalent? Eventually (  |  ) and Eventually  | Eventually  [Proof in one direction]. Suppose a trace  satisfies Eventually (  |  )  There exists a position j such that ( , j) |=  |   Either ( , j) |=  or ( , j) |=   Suppose ( , j) |=  (the other case is similar)  Then  satisfies Eventually   Hence also satisfies Eventually  | Eventually  [Proof of converse]. Suppose trace  satisfies Eventually  | Eventually   Suppose it satisfies Eventually  (the other case is similar)  There exists a position j such that ( , j) |=   Then, it also is the case that ( , j) |=  |   It follows that  satisfies Eventually (  |  ) CIS 540 Spring 2016; Lecture March 16

6. Logical Connectives and Temporal Operators  Are these equivalent? Eventually (  &  ) and Eventually  & Eventually  [Proof in one direction]. The first is stronger than the second  Suppose a trace  satisfies Eventually (  &  )  There exists a position j such that ( , j) |=  &   It follows that both ( , j) |=  and ( , j) |=   Since ( , j) |=  it also satisfies Eventually   Similarly it also satisfies Eventually   It follows that the trace satisfies Eventually  & Eventually  [Disprove the converse]. But the two are not equivalent!  Consider trace 0,1,0,1,0,1,… over a boolean variable x  It satisfies Eventually(x=0) & Eventually(x=1)  But does not satisfy Eventually (x=0 & x=1) CIS 540 Spring 2016; Lecture March 16

7. Logical Connectives and Temporal Operators  Distributivity rules for logical connectives and temporal operators  Are these equivalent?  Always (  &  ) and Always  & Always   Always (  |  ) and Always  | Always    Repeatedly (  &  ) and Repeatedly  & Repeatedly    Repeatedly (  |  ) and Repeatedly  | Repeatedly  CIS 540 Spring 2016; Lecture March 16

8. Model Checking System Model LTL Requirement yes no/bug Model Checker  Performed using enumerative or symbolic search through the state- space of the program  Success story for transitioning academic research to industrial practice  2007 Turing Award to Ed Clarke, Alan Emerson, and Joseph Sifakis  Used to debug multicore protocols, pipelined processors, device driver code, distributed algorithms in Intel, Microsoft, IBM … CIS 540 Spring 2016; Lecture March 16

9. Buchi Automata  A safety monitor classifies finite executions into good and bad  Verification of safety requirements is done by analyzing reachable states of the system composed with the monitor  Bug: An execution that drives the monitor into an error state  How can a monitor (also called an automaton) classify “infinite” executions into good and bad?  Theoretical model of Buchi automata proposed by Richard Buchi (1960)  Model checking application (1990s) using Buchi automata  Automatically translate LTL formula  to a Buchi monitor M  Consider the composition of system C and monitor M  Reachable cycles in this composite correspond to counter-examples (if no such cycle is found, system satisfies spec)  Implemented in many model checkers including SPIN CIS 540 Spring 2016; Lecture March 16

10. Buchi Automaton: Example 1 a ~e e  Inputs: boolean variable e  Of two states a and b, a is initial and b is accepting  Given a trace  over e (i.e. infinite sequence of 0/1 values to e), there is a corresponding execution of M  The trace  is accepted if accepting state appears repeatedly  Language of M = Set of traces in which e is satisfied repeatedly  M accepts  iff  |= Repeatedly e ~e e b CIS 540 Spring 2016; Lecture March 16

11. Buchi Automaton: Example 2 a  Automaton is nondeterministic: as long as it is in state a, at each step it can either stay in state a, or switch to state b  On a given input trace, many possible executions  An execution is accepting if it visits accepting state repeatedly  M accepts an input trace if there exists some accepting execution on that input  M accepts  iff  |= Persistently e e b CIS 540 Spring 2016; Lecture March 16

12. Buchi Automaton: Example 3  Design a Buchi automaton such that M accepts  iff  |= Always [ e  Eventually f ]  Inputs: Boolean conditions e and f  In an accepting execution, every e must be followed by f b ~ e | f e & ~f f a ~ f CIS 540 Spring 2016; Lecture March 16

13. Buchi Automaton: Example 4 a e c b f Which traces does this accept? Express it in LTL M accepts  iff  |= Repeatedly e & Repeatedly f CIS 540 Spring 2016; Lecture March 16

14. Buchi Automaton M Definition  V: set of Boolean input variables  Finite set Q of states  Set Init of initial states  Set F of accepting states  Set of edges/transitions, where each edge is of the form q –Guard  q’ where Guard is a Boolean-valued condition over input vars V  Given an input trace  = v 1, v 2, v 3, … over V, an accepting run/execution of M over  is an infinite sequence of states q 0, q 1, q 2, … such that 1.State q 0 is initial 2.For each i, there exists an edge q i -Guard  q i+1 such that input v i satisfies Guard 3.There are infinitely many positions i such that state q i is in F  The automaton M accepts the input trace  if there exists an accepting run of M over  CIS 540 Spring 2016; Lecture March 16

15. Buchi Automata: More Examples e Eventually e ~ e e Eventually e CIS 540 Spring 2016; Lecture March 16

16. Buchi Automata Examples a e c b f Eventually [e & Next Eventually f] Eventually e | Eventually f a e c f b CIS 540 Spring 2016; Lecture March 16