1. Formal Methods in software development
a.y.2016/2017
Prof. Anna Labella
5/13/2019

2. Linear time and Branching time
Linear: only one possible future in a moment
Look at individual computations
Branching: may split to different courses depending on possible futures
Look at the tree of computations s0 s2 s3 s1 s0 s1 s3 s2
... s0 s2 s3 s1
...
5/13/2019

3. LTS: Automata without terminal states
Semantics: transition systems
Abstract models: states and transitions
LTS: Automata without terminal states
Kripke structures
®  S  S
5/13/2019

4. Infinite computation tree for initial state s1
Computation Trees: labelled TS a b ac s1 s3 s1 s2 a b ac
State transition structure
(Kripke Model)
Infinite computation tree for initial state s1
5/13/2019

5. Operators and Quantifiers
State operators
G f : f holds globally
F f : f holds eventually
X f : f holds at the next state
f U y : f holds until y holds
f W y : f holds until y possibly holds
Path quantifiers
E: along at least one path (there exists …)
A: along all paths (for all …)
5/13/2019

6. CTL characterisation
Temporal operators must be immediately preceded by a path quantifier
5/13/2019

7. Typical CTL Formulas E F ( start  ¬ ready ) A G ( req  A F ack )
eventually a state is reached where start holds and ready does not hold
A G ( req  A F ack )
any time request occurs, it will be eventually acknowledged
A G ( E F restart )
from any state it is possible to get to the restart state
5/13/2019

8. CTL semantics E X (f) A X (f) E G (f) A G (f)
true in state s if f is true in some successor of s (there exists a next state of s for which f holds)
A X (f)
true in state s if f is true for all successors of s (for all next states of s f is true)
E G (f)
true in s if f holds in every state along some path emanating from s (there exists a path ….)
A G (f)
true in s if f holds in every state along all paths emanating from s (for all paths ….globally )
5/13/2019

9. E F, A F are special cases of E [f Uy], A [f Uy]
E F (y)
there exists a path which eventually contains a state in which y is true
A F (y)
for all paths, eventually there is state in which y holds
E F (f U y)
there exists a path where (f U y) is true
A F (f U y)
for all paths (f U y) is true
E F, A F are special cases of E [f Uy], A [f Uy]
E F (y) = E [ true U y ], A F (y) = A [ true U y ]
5/13/2019

10. CTL Operators - examples
so |= E F y y so so y
so |= A F y y
so |= E G y y so
so |= A G y so y y
5/13/2019

11. Minimal set of CTL Formulas
Full set of operators
Boolean: ¬, , , , 
temporal: E, A, X, F, G, U, W
Minimal set sufficient to express any CTL formula
Boolean: ¬, 
temporal: E, X, U
Examples:
f  y = ¬(¬f  ¬y), F f = true U f , A (f ) = ¬E(¬f )
5/13/2019

12. CTL* – Computation Tree Logic
Path quantifiers - describe branching structure of the tree
A (for all computation paths)
E (for some computation path = there exists a path)
Temporal operators - describe properties of a path through the tree
X (next time, next state)
F (eventually, finally)
G (always, globally)
U (until)
W (weak until)
5/13/2019

13. CTL* Formulas
Temporal logic formulas are evaluated w.r.to a state in the model
State formulas
apply to a specific state
Path formulas
apply to all states along a specific path
5/13/2019

14. CTL* Syntax An atomic proposition p is a state formula
A state formula is also a path formula
If f, y are state formulae, so are ¬f, fy, fy,
If a is a path formula, E a is a state formula
If a, b are path formulae, so are ¬a, ab , ab
If a, b are path formulae, so are X a, aUb
5/13/2019

15. Summing up (CTL*)
5/13/2019

16. CTL* Semantics
If formula f holds at state s (path ), we write: s |= f ( |= a)
s |= p, p  A iff p  L(s) [label of s]
s |= ¬ f, iff s |≠ f
s |= f y, iff s |= f and s |= y
s |= E f, iff   from state s, s.t.  |= f
 |= ¬ a, iff  |≠ a
 |= a b, iff  |= a and  |= b
 |= X a, iff 1 |= a (a reachable in next state)
5/13/2019

17. CTL – Computational Tree Logic
CTL* - a powerful branching-time temporal logic
CTL – a branching-time fragment of CTL*
In CTL every temporal operator (G,F,X,U,W) must be immediately preceded by a path quantifier (A,E)
We need both state formulae and path formulae to recursively define the logic
5/13/2019

18. More expressivity in CTL than in LTL?
Quantifying on paths
In LTL formulas are always quantified through A
5/13/2019

19. LTL: blocks of operators must be thought as preceded by A always
Linear time operators.
The following are a complete set
¬f , fy , Xf, f U y
Others can be derived
f  y  ¬(¬f  ¬y)
f y  ¬f y
F f  (true U f)
G f (f U false)
5/13/2019

20. Expressivity of LTL and CTL
Safety G ( c1 c2)
Liveness G (ti Fci)
Safety AG ( c1 c2)
Liveness AG (ti AFci)
5/13/2019

21. LTL and CTL
LTL (Linear Temporal Logic) - Reasoning about infinite sequence of states π: s0, s1, s2, …
CTL (Computation Tree Logic) – Reasoning on a computation tree.
Temporal operators are immediately preceded by a path quantifier (e.g. A F p )
CTL vs. LTL – different expressive power
EFp is not expressible in LTL
FGp is not expressible in CTL
5/13/2019

22. Comparing logics
5/13/2019

23. Comparing logics
5/13/2019

24. Exercises
5/13/2019

25. Exercises
5/13/2019

26. Exercises
5/13/2019