Branching-time Logic Research Articles

Generalized Formal Model-Verifier: A Formal Approach for Verifying Static Models

The field of software modeling has gained significant popularity in the last decades. By capturing the static aspects of the software requirements, model-driven engineering eases the development and maintenance of software. However, additional constraints, such as invariants on model elements, that the solution must conform to may be too complex to include in the structure of the model itself. External solutions are often used to describe static constraints on models, the most prevalent approach being the Object Constraint Language (OCL) and its formal variants. This paper proposes the Generalized Formal Model-Verifier (GFMV), which is a general approach for verifying static constraints on software models. GFMV employs different formal verification methods based on Kripke Structures. Kripke Structures are used to capture the static structure of the model, then the constraints are formalized using a first-order branching-time logic, the Computational Tree Logic (CTL). Finally, the NuSMV model checker is reused to verify whether the constraints formalized in CTL hold on the formal Kripke Structure. When compared to existing solutions, GFMV offers increased generality and formal proof that the constraints hold on the model. The expressive power and runtime-scalability of the approach are evaluated on a real-world example model and OCL invariants cited from literature.

Model checking timed recursive CTL

We introduce Timed Recursive CTL, a merger of two extensions of the well-known branching-time logic CTL: Timed CTL is interpreted over real-time systems like timed automata; Recursive CTL introduces a powerful recursion operator which takes the expressiveness of this logic CTL well beyond that of regular properties. The result is an expressive logic for real-time properties. We show that its model checking problem is decidable over timed automata, namely 2-EXPTIME-complete.

Robust computation tree logic

AbstractIt is widely accepted that every system should be robust in that “small” violations of environment assumptions should lead to “small” violations of system guarantees, but it is less clear how to make this intuition mathematically precise. While significant efforts have been devoted to providing notions of robustness for linear temporal logic, branching-time logics, such as computation tree logic (CTL) and CTL*, have received less attention in this regard. To address this shortcoming, we develop “robust” extensions of CTL and CTL*, which we name robust CTL (rCTL) and robust CTL* (rCTL*). Both extensions are syntactically similar to their parent logics but employ multi-valued semantics to distinguish between “large” and “small” violations of the specification. We show that the multi-valued semantics of rCTL make it more expressive than CTL, while rCTL* is as expressive as CTL*. Moreover, we show that the model checking problem, the satisfiability problem, and the synthesis problem for rCTL and rCTL* have the same asymptotic complexity as their non-robust counterparts, implying that robustness can be added to branching-time logics for free.

The tail-recursive fragment of timed recursive CTL

Timed Recursive CTL (TRCTL) was recently proposed as a merger of two extensions of the well-known branching-time logic CTL: Timed CTL on one hand is interpreted over real-time systems like timed automata, and Recursive CTL (RecCTL) on the other hand obtains high expressiveness through the introduction of a recursion operator. Model checking for the resulting logic is known to be 2-EXPTIME-complete.The aim of this paper is to investigate the possibility to obtain a fragment of lower complexity without losing too much expressive power. It is obtained by a syntactic property called “tail-recursiveness” that restricts the way that recursive formulas can be built. This restriction is known to decrease the complexity of model checking by half an exponential in the untimed setting. We show that this also works in the real-time world: model checking for the tail-recursive fragment of TRCTL is EXPSPACE-complete already in its data complexity, i.e. for a fixed formula. The upper bound is obtained via a model-checking procedure on region graphs combining standard untiming constructions with a tailored algorithm. The lower bound is established by a reduction from a suitable tiling problem.

Algorithms for recognizing formulas with none-stable truth values in branching time logic

We study the problem of none-stable truth values for modal formulas. Our aim is to investigate temporal-modal logics for description reliability of information. We investigate a logic with rather standard relational models for branching time logic. But we study an unusual task – intervals of none-stable truth values of formulas. None-stable truth values for formulas means that formulas for a long time change their truth values from true to false and vice versa. We found an algorithm which may recognize permanently none-stable formulas.

Branching Time Axiomatized With the Use of Change Operators

Abstract We present a temporal logic of branching time with four primitive operators: $\exists {\mathcal {C}}$ – it may change whether; $\forall {\mathcal {C}} $ – it must change whether; $\exists \Box $ – it may be endlessly unchangeable that; and $\forall \Box $ – it must be endlessly unchangeable that. Semantically, operator $\forall {\mathcal {C}}$ expresses a change in the logical value of the given formula in every state that may be an immediate successor of the one considered, while $\exists {\mathcal {C}}$ expresses a change in the logical value of the given formula in some state that is a possible immediate successor. $\forall {\mathcal {C}} $ and $\exists {\mathcal {C}}$ are not normal operators, they are not mutually definable and have unusual properties: $\forall {\mathcal {C}} A\leftrightarrow \forall {\mathcal {C}} \neg A$ and $\exists {\mathcal {C}} A \leftrightarrow \exists {\mathcal {C}} \neg A$ are axioms. Operators $\exists \Box $ and $\forall \Box $ express endless unchangeability in some and all paths, respectively. Our axiomatization contains two infinitary rules that allow one to obtain $\exists \Box A$ from infinitely many combinations of formulas with $A, \neg , \forall {\mathcal {C}}, \land $, and to get $\forall \Box A$ from infinitely many combinations of formulas with $A, \neg , \exists {\mathcal {C}}, \land $. We show that our formalism is complete by presenting a bridge between our logic and logic $\textsf {UB}$, which is a fragment of $\textsf {CTL}$ in which until operators does not occur.

Incremental Witness Generation for Branching-Time Logic CTL*

We propose a tester-based symbolic algorithm to incrementally generate tree-like witnesses (the dual concept of counterexamples) for branching-time logic CTL*. The CTL* witnesses are state transition directed graphs of tree-like structure in which all strongly connected components are cycles, and all branches are lasso paths with shortest prefixes. The states and transitions in these graphs may be respectively attached with satisfied state and path subformulas as annotations for intelligibility. The correctness of the lasso path generation algorithm is proved. We have developed an ordered binary decision diagrams based symbolic model checker MCTK2 for CTL* in which the proposed witness generation algorithm has been implemented. To make the generated witnesses graphs more succinct, several optimization strategies are applied to reduce the number of annotations and avoid constructing branching paths as much as possible. The interactive visualization interface of MCTK2 enables users to conveniently inspect counterexamples and expand branches of interest such that they can incrementally analyze larger and more complex counterexamples.

Formal Specification and Verification of Data Separation for Muen Separation Kernel

Introduction: Development of integrated mixed-criticality systems is becoming increasingly popular for application-specific systems, which needs separation mechanism for available onboard resources and the processors equipped with hardware virtualization. Hardware virtualization allow the partitions to physical resources, which include processor cores, memory, and I/O devices, among guest virtual machines (VMs). For building mixed criticality computing environment, traditional virtual machine systems are inappropriate because they use hypervisors to schedule separate VMs on physical processor cores. In this article, we discuss the design of an environment for mixed-criticality systems: The Muen an x86/64 separation kernel for high assurance. The Muen Separation Kernel is an Open Source microkernel which has no runtime errors at the source code level. The Muen separation kernel has been designed precisely to encounter the challenging requirements of high-assurance systems built on the Intel x86/64 platform. Muen is under active development, and none of the kernel properties of it has been verified yet. In this paper, we present a novel work of verifying one of the kernel properties formally. Method: The CTL used in NuSMV is a first-order modal along with data-depended processes and regular formulas. CTL is a branching-time logic, meaning that its model of time is a tree-like structure in which the future is not determined; there are different paths in the future, any one of which might be an actual path that is realized . This section shows the verification of all the requirements mentioned in section 3. In NuSMV tool the command used for verification of the formulas written in CTL is checkctlspec -p ”CTL-expression”. The nearest quantifier binds each occurrence of a variable in the scope of the bound variable, which has the same name and the same number of arguments. Result: Formal methods have been applied to various projects for specification and verification purpose. Some of them are the SCOMP , SeaView , LOCK,and Multinet Gateway projects. The TLS was written formally. Several mappings were done between the TLS and the SCOMP code: Informal English language to TLS, TLS to actual code , and TLS to pseudo-code. The authors present an ACL2 model for a generic separation kernel also known as GWV approach. Conclusion: We consider the formal verification of data separation property which is one of the crucial modules to achieve the separation functionality. The verification of the data separation manager is carried out on the design level using the NuSMV tool. Furthermore, we present the complete model of the data separation unit along with its code written in the NuSMV modelling language. Finally, we have converted the non-functional requirements into the formal logic, which then has verified the model formally.

Branching-time logics and fairness, revisited

AbstractEmerson and Halpern (1986, Journal of the Association for Computing Machinery33, 151–178) prove that the Computation Tree Logic (CTL) cannot express the existence of a path on which a proposition holds infinitely often (fairness for short).The scope is widened from CTL to a general branching-time logic. A path quantifier is followed by a language with temporal descriptions. In this extended setting, the said inexpressiveness is strengthened in two aspects. First, universal path quantifiers are unrestricted. In this way, they are relieved of any temporal quantifiers such as of those in $\mathtt{AU}$ and $\mathtt{AR}$ from CTL. Second, existential path quantifiers are allowed with any countable language. Instances are the temporal quantifiers in $\mathtt{EU}$ and $\mathtt{ER}$ from CTL. By contrast, the fairness statement is an existential path quantifier with an uncountable language. Both aspects indicate that this inexpressiveness is optimal with respect to the polarity of path quantifiers and to the cardinality of their languages.

Measuring inconsistency in some branching time logics

Branching time logics have been studied in computer science since the 1980s primarily to model the tree of computations for discrete transition systems. Inconsistency measures for propositional logic have been studied since the early 2000s by AI researchers. This paper introduces inconsistency measures for three branching time logics: ABTL, BBTL, and CBTL. In order to measure inconsistency properly in branching time logics, the semantics differs from the standard semantics using the construction of a canonical tree. ABTL extends propositional logic by three pairs of unary operators: next time, path, and eventually. BBTL adds a pair of binary Until operators that can be applied only to propositional logic formulas. CBTL adds the propositional connectives to BBTL formulas. Propositional logic inconsistency measures are extended to these logics and examples of the computation are given. These measures are shown to satisfy intuitively the concepts involved in the branching time logic operators unlike direct extensions of propositional logic inconsistency measures.

Model checking agent-based communities against uncertain group commitments and knowledge

In recent years, the use of Multi-Agent Systems (MASs) to solve complex problems has grown rapidly. Social communicative commitments have been widely employed in such systems as a means of communication allowing heterogeneous agents to cooperate. However, to prevent undesirable outcomes, communicative commitments and their interactions with agents’ knowledge need to be verified. This paper aims at verifying MASs where agents have knowledge and communicate through manipulating uncertain social commitments, especially when the scope of commitments moves beyond the common agent-to-agent scheme. We introduce a model checking method for verifying those systems and capitalize on the interaction between not only individual but also group communicative commitments and knowledge in the presence of uncertainty. System’s properties are expressed using the Probabilistic Computation Tree Logic of Knowledge and Commitment (PCTLkc+). In the proposed approach, model checking PCTLkc+ is reduced to model checking the probabilistic branching-time logic PCTL. This is achieved by transforming PCTLkc+ model to a Markov Decision Process (MDP), and reducing PCTLkc+ formulae into PCTL formulae compatible with PRISM, a reference model checking tool for probabilistic temporal systems. Thereafter, we provide the soundness and completeness proofs of the reduction technique, and compute its time complexity. The effectiveness of the proposed approach is evaluated by implementing it on top of PRISM using two concrete applications, namely Online Shopping System from the business domain, and Insurance Claim Processing from the industrial domain. The obtained results of the two case studies underscore the scientific value of our proposed framework and confirm that verifying commitment-based probabilistic epistemic MASs has become attainable by utilizing this approach. The presented work outperforms existing proposals because it considers the problem of modeling and verifying MASs where group social commitments are interacting with participating agents’ knowledge in the presence of uncertainty, which has not been addressed yet in the literature.

Multi-valued Verification of Strategic Ability

Some multi-agent scenarios call for the possibility of evaluating specifications in a richer domain of truth values. Examples include runtime monitoring of a temporal property over a growing prefix of an infinite path, inconsistency analysis in distributed databases, and verification methods that use incomplete anytime algorithms, such as bounded model checking. In this paper, we present multi-valued alternating-time temporal logic ( mv-ATL → ∗ ), an expressive logic to specify strategic abilities in multi-agent systems. It is well known that, for branchingtime logics, a general method for model-independent translation from multi-valued to two-valued model checking exists. We show that the method cannot be directly extended to mv-ATL → ∗ . We also propose two ways of overcoming the problem. Firstly, we identify constraints on formulas for which the model-independent translation can be suitably adapted. Secondly, we present a model-dependent reduction that can be applied to all formulas of mv-ATL → ∗ . We show that, in all cases, the complexity of verification increases only linearly when new truth values are added to the evaluation domain. We also consider several examples that show possible applications of mv-ATL → ∗ and motivate its use for model checking multi-agent systems.

Branching-time logic [formula omitted] and its tree-style one-pass tableau: Extending fairness expressibility of [formula omitted

Temporal logic has become essential for various areas in computer science, most notably for the specification and verification of hardware and software systems. For the specification purposes rich temporal languages are required that, in particular, can express fairness constraints. For linear-time logics which deal with fairness in the linear-time setting, one-pass and two-pass tableau methods have been developed. In the repository of the CTL-type branching-time setting, the well-known logics ECTL and ECTL+ were developed to explicitly deal with fairness. However, due to the syntactical restrictions, these logics can only express restricted versions of fairness. The logic CTL⋆, often considered as ‘the full branching-time logic’ overcomes these restrictions on expressing fairness. However, CTL⋆ is extremely challenging for the application of verification techniques, and the tableau technique, in particular. For example, there is no one-pass tableau construction for CTL⋆, while one-pass tableau has an additional benefit enabling the formulation of dual sequent calculi that are often treated as more ‘natural’ being more friendly for human understanding. These two considerations lead to the following problem - are there logics that have richer expressiveness than ECTL+, allowing the formulation of a new range of fairness constraints with ‘until’ operator, yet ‘simpler’ than CTL⋆, and for which a one-pass tableau can be developed? Here we give a positive answer to this question, introducing a sub-logic of CTL⋆ called ECTL#, its tree-style one-pass tableau, and an algorithm for obtaining a systematic tableau, for any given admissible branching-time formulae. We prove the termination, soundness and completeness of the method. As tree-shaped one-pass tableaux are well suited for the automation and are amenable for the implementation and for the formulation of sequent calculi. Our results also open a prospect of relevant developments of the automation and implementation of the tableau method for ECTL#, and of a dual sequent calculi.

On the expressive power of hybrid branching-time logics

Hybrid branching-time logics are a powerful extension of branching-time logics like CTL, CTL⁎ or even the modal μ-calculus through the addition of binders, jumps and variable tests. Their expressiveness is not restricted by bisimulation-invariance anymore. Hence, they do not retain the tree model property, and the finite model property is equally lost. Their satisfiability problems are typically undecidable, their model checking problems (on finite models) are decidable with complexities ranging from polynomial to non-elementary time.In this paper we study the expressive power of such hybrid branching-time logics. We extend the hierarchy of branching-time logics CTL, CTL+, CTL⁎ and the modal μ-calculus to their hybrid extensions. We show that most separation results can be transferred to the hybrid world, even though the required techniques become more involved. We also present collapse results for linear, tree-shaped and finite models.

Sublogics of a branching time logic of robustness

In this paper we study sublogics of RoCTL*, a recently proposed logic for specifying robustness. RoCTL* allows specifying robustness in terms of properties that are robust to a certain number of failures. RoCTL* is an extension of the branching time logic CTL* which in turn extends CTL by removing the requirement that temporal operators be paired with path quantifiers. In this paper we consider three sublogics of RoCTL*. We present a tableau for RoBCTL*, a bundled variant of RoCTL* that allows fairness constraints to be placed on allowable paths. We then examine two CTL-like restrictions of CTL*. Pair-RoCTL* requires a temporal operator to be paired with a path quantifier; we show that Pair-RoCTL* is as hard to reason about as the full CTL*. State-RoCTL* is restricted to State formulas, and we show that there is a linear truth preserving translation of State-RoCTL into CTL, allowing State-RoCTL to be reasoned about as efficiently as CTL.

Model checking and synthesis for branching multi-weighted logics

We investigate the open synthesis problem in a quantitative game theoretic setting where the system model is annotated with multiple nonnegative weights representing quantitative resources such as energy, discrete time or cost. We consider system specifications expressed in the branching time logic CTL extended with bounds on resources. As our first contribution, we show that the model checking problem for the full logic is undecidable with already three weights. By restricting the bounds to constant upper or lower-bounds on the individual weights, we demonstrate that the problem becomes decidable and that the model checking problem is PSPACE-complete. As a second contribution, we show that by imposing upper-bounds on the temporal operators and assuming that the cost converges over infinite runs, the synthesis problem is also decidable. Finally, we provide an on-the-fly algorithm for the synthesis problem on an unrestricted model for a reachability fragment of the logic and we prove EXPTIME-completeness of the synthesis problem.

Model checking for hybrid branching-time logics

We consider hybridisations of the full branching time logic CTL⁎ and its prominent fragments CTL, CTL+ and FCTL+ through the addition of nominals, binders and jumps. We formally define three types of hybridisations by restricting the interplay between hybrid operators and path formulas contrary to previous proposals in the literature which ignored potential problems with a formal semantics. We then investigate the model checking problem for these logics obtaining expression complexities from PSpace -completeness to non-elementary decidability and data complexities ranging from NLogSpace to PSpace. Lastly, we identify a family of fragments of these hybrid logics, called the bounded fragments, that (in some cases) have the same model checking complexity as their non-hybrid counterparts.

Quirky Quantifiers: Optimal Models and Complexity of Computation Tree Logic

The satisfiability problem of the branching time logic CTL is studied in terms of computational complexity. Tight upper and lower bounds are provided for each temporal operator fragment. In parallel, the minimal model size is studied with a suitable notion of minimality. Thirdly, flat CTL is investigated, i.e., formulas with very low temporal operator nesting depth. A sharp dichotomy is shown in terms of complexity and minimal models: Temporal depth one has low expressive power, while temporal depth two is equivalent to full CTL.

An Approach to Verification of a Family of Multiagent Systems for Conflict Resolution

In this paper, we describe a verification method for families of distributed systems generated by a context-sensitive network grammar of a special kind. The grammar includes special non-terminal symbols, so-called quasi-terminals, which uniquely correspond to grammar terminals. These quasi-terminals specify processes that are mergings of basic system processes; in contrast, simple nonterminals specify networks of parallel compositions of these processes. The verification method is based on the model-checking technique and abstraction. An abstract representative model for a family of systems depends on their specification grammar and the system properties to be verified. This model simulates the behavior of the systems in such a way that the properties holding for the representative model are satisfied for all these systems. The properties of the representative model can be verified by the model-checking method. The properties of the system generated are specified using the universal branching time logic ∀CTL with finite deterministic automata as atomic formulas. We demonstrate the application of the proposed method to verification of some properties of a multiagent system for conflict resolution, particularly for context-dependent disambiguation in ontology population. We also suggest that this approach should be used for verification of computations on subgrids that are subgraphs of computation grids. In particular, it can be used to compute the parity of the number of active processes in a subgrid.

Monitorability for the Hennessy–Milner logic with recursion

We study $$\mu $$ HML, a branching-time logic with least and greatest fixpoints, from a runtime verification perspective. The logic may be used to specify properties of programs whose behaviour may be expressed as a labelled transition system. We establish which subset of this logic can be monitored for at runtime by merely observing the runtime execution of a program. A monitor-synthesis algorithm is defined for this subset, where it is shown that the resulting synthesised monitors correctly perform the required analysis from the observed behaviour. We also prove completeness results wrt. this logical subset that show that, up to logical equivalence, no other properties apart from those identified can be monitored for and verified at runtime.