Branching-time Temporal Logic CTL Research Articles

Strategic reasoning with a bounded number of resources: The quest for tractability

The resource-bounded alternating-time temporal logic RB±ATL combines strategic reasoning with reasoning about resources. Its model-checking problem is known to be 2exptime-complete (the same as its proper extension RB±ATL⁎) and fragments have been identified to lower the complexity.In this work, we consider the variant RB±ATL+ that allows for Boolean combinations of path formulae starting with single temporal operators, but restricted to a single resource, providing an interesting trade-off between temporal expressivity and resource analysis. We show that the model-checking problem for RB±ATL+ restricted to a single agent and a single resource is Δ2P-complete, hence the same as for the standard branching-time temporal logic CTL+. In this case reasoning about resources comes at no extra computational cost. When a fixed finite set of linear-time temporal operators is considered, the model-checking problem drops to ptime, which includes the special case of RB±ATL restricted to a single agent and a single resource. Furthermore, we show that, with an arbitrary number of agents and a fixed number of resources, the model-checking problem for RB±ATL+ can be solved in exptime using a sophisticated Turing reduction to the parity game problem for alternating vector addition systems with states (AVASS).

Equivalence between model-checking flat counter systems and Presburger arithmetic

We show that model-checking flat counter systems with the branching-time temporal logic CTL* extended with arithmetical constraints on counter values has the same worst-case complexity as the satisfiability problem for Presburger arithmetic. The lower bound already holds with strong restrictions: the logical language uses only the temporal operator EF and no arithmetical constraints, and the guards on the transitions are made of linear constraints. This work complements our understanding of model-checking flat counter systems with linear-time temporal logics, such as LTL, for which the problem is already known to be (only) NP-complete with guards restricted to the linear fragment.

Rewrite rules for CTL*

A number of procedures for checking the satisfiability of formulas in the important branching time temporal logic CTL* have recently been proposed.In this paper we develop techniques to support such reasoning based on rewrite rules. We consider how to automatically generate and quickly validate such rewrites. The techniques are based on use of so-called non-local and bundled variants of computation tree logics.We show that such rules can quickly simplify CTL* formulas. These simplified formulas are shorter and easier to reason with using existing decision procedures for CTL*, as demonstrated by significant speed-ups across a wide range of benchmark formulas.In this paper we provide both an Associative Commutative sound, confluent and terminating term rewrite system as well as a simple greedy rewrite system. We test them on a useful set of benchmarks. There are practical applications for theorem-proving and model-checking.

Cycle Detection in Computation Tree Logic

Temporal logic is a very powerful formalism deeply investigated and used in formal system design and verification. Its application usually reduces to solving specific decision problems such as model checking and satisfiability. In these kind of problems, the solution often requires detecting some specific properties over cycles. For instance, this happens when using classic techniques based on automata, game-theory, SCC decomposition, and the like. Surprisingly, no temporal logics have been considered so far with the explicit ability of talking about cycles. In this paper we introduce Cycle-CTL*, an extension of the classical branching-time temporal logic CTL* along with cycle quantifications in order to predicate over cycles. This logic turns out to be very expressive. Indeed, we prove that it strictly extends CTL* and is orthogonal to mu-calculus. We also give an evidence of its usefulness by providing few examples involving non-regular properties. We investigate the model checking problem for Cycle-CTL* and show that it is PSPACE-Complete as for CTL*. We also study the satisfiability problem for the existential-cycle fragment of the logic and show that it is solvable in 2ExpTime. This result makes use of an automata-theoretic approach along with novel ad-hoc definitions of bisimulation and tree-like unwinding.

Branching-Time Model Checking Gap-Order Constraint Systems

We consider the model checking problem for Gap-order Constraint Systems (GCS) w.r.t. the branching-time temporal logic CTL, and in particular its fragments EG and EF. GCS are nondeterministic infinitely branching processes described by evolutions of integer-valued variables, subject to Presburger c onstraints of the form x − y ≥ k, where x and y are variables or constants and k ∈ ℕ is a non-negative constant. We show that EG model checking is undecidable for GCS, while EF is decidable. In particular, this implies the decidability of strong and weak bisimulation equivalence between GCS and finite-state systems.

A resolution calculus for the branching-time temporal logic CTL

The branching-time temporal logic CTL is useful for specifying systems that change over time and involve quantification over possible futures. Here we present a resolution calculus for CTL that involves the translation of formulae to a normal form and the application of a number of resolution rules. We use indices in the normal form to represent particular paths and the application of the resolution rules is restricted dependent on an ordering and selection function to reduce the search space. We show that the translation preserves satisfiability, the calculus is sound, complete, and terminating, and consider the complexity of the calculus.

Pushdown model checking for malware detection

The number of malware is growing extraordinarily fast. Therefore, it is important to have efficient malware detectors. Malware writers try to obfuscate their code by different techniques. Many well-known obfuscation techniques rely on operations on the stack such as inserting dead code by adding useless push and pop instructions, or hiding calls to the operating system, etc. Thus, it is important for malware detectors to be able to deal with the program's stack. In this study, we propose a new model-checking approach for malware detection that takes into account the behavior of the stack. Our approach consists in: (1) Modeling the program using a pushdown system (PDS). (2) Introducing a new logic, called stack computation tree predicate logic (SCTPL), to represent the malicious behavior. SCTPL can be seen as an extension of the branching-time temporal logic CTL with variables, quantifiers, and predicates over the stack. (3) Reducing the malware detection problem to the model-checking problem of PDSs against SCTPL formulas. We show how our new logic can be used to precisely express malicious behaviors that could not be specified by existing specification formalisms. We then consider the model-checking problem of PDSs against SCTPL specifications. We reduce this problem to emptiness checking in Symbolic Alternating Buchi Pushdown Systems, and we provide an algorithm to solve this problem. We implemented our techniques in a tool and applied it to detect several viruses. Our results are encouraging.

Branching-time logics with path relativisation

We define extensions of the full branching-time temporal logic CTL⁎ in which the path quantifiers are relativised by formal languages of infinite words, and consider its natural fragments obtained by extending the logics CTL and CTL+ in the same way. This yields a small and two-dimensional hierarchy of temporal logics parametrised by the class of languages used for the path restriction on one hand, and the use of temporal operators on the other. We motivate the study of such logics through two application scenarios: in abstraction and refinement they offer more precise means for the exclusion of spurious traces; and they may be useful in software synthesis where decidable logics without the finite model property are required. We study the relative expressive power of these logics as well as the complexities of their satisfiability and model-checking problems.

Graded computation tree logic

In modal logics, graded (world) modalities have been deeply investigated as a useful framework for generalizing standard existential and universal modalities in such a way that they can express statements about a given number of immediately accessible worlds. These modalities have been recently investigated with respect to the μCalculus, which have provided succinctness, without affecting the satisfiability of the extended logic, that is, it remains solvable in ExpTime. A natural question that arises is how logics that allow reasoning about paths could be affected by considering graded path modalities . In this article, we investigate this question in the case of the branching-time temporal logic CTL (GCTL, for short). We prove that, although GCTL is more expressive than CTL, the satisfiability problem for GCTL remains solvable in ExpTime, even in the case that the graded numbers are coded in binary. This result is obtained by exploiting an automata-theoretic approach, which involves a model of alternating automata with satellites. The satisfiability result turns out to be even more interesting as we show that GCTL is at least exponentially more succinct than graded μCalculus.

Algebraic Neighbourhood Logic

We present an algebraic embedding of Neighbourhood Logic ( NL) into the framework of semirings which yields various simplifications. For example, some of the NL axioms can be dropped, since they are theorems in our framework, and Galois connections produce properties for free. A further simplification is achieved, since the semiring methods used are easy and fairly standard. Moreover, this embedding allows us to reuse knowledge from Neighbourhood Logic in other areas of Computer Science. Since in its original axiomatisation the logic cannot handle intervals of infinite length and therefore not fully model and specify reactive and hybrid systems, using lazy semirings we introduce an extension of NL to intervals of finite and infinite length. Furthermore, we discuss connections between the (extended) logic and other application areas, like Allen’s thirteen relations between intervals, the branching time temporal logic CTL ∗ and hybrid systems.

Model checking MASL specification of distributed real-time systems

We present model checking algorithms for MASL specification of distributed real-time systems. The proposed algorithms use symbolic model checking approach by analogy with model checking algorithms for branching-time temporal logic CTL and alternating-time temporal logic ATL. For the fixed environment case, the algorithm is polynomial-time in the specification length and sizes of the sets of system states and actions. For the dynamic environment case, the algorithm is polynomial-time in the model size, but it is exponential-time in the structure of environment specification.

Verifying data refinements using a model checker

Abstract In this paper, we consider how refinements between state-based specifications (e.g., written in Z) can be checked by use of a model checker. Specifically, we are interested in the verification of downward and upward simulations which are the standard approach to verifying refinements in state-based notations. We show how downward and upward simulations can be checked using existing temporal logic model checkers. In particular, we show how the branching time temporal logic CTL can be used to encode the standard simulation conditions. We do this for both a blocking, or guarded, interpretation of operations (often used when specifying reactive systems) as well as the more common non-blocking interpretation of operations used in many state-based specification languages (for modelling sequential systems). The approach is general enough to use with any state-based specification language, and we illustrate how refinements between Z specifications can be checked using the SAL CTL model checker using a small example.

Model Checking Downward Simulations

This paper shows how downward simulation can be checked using existing temporal logic model checkers. In particular, we show how the branching time temporal logic CTL can be used to encode the standard downward simulation conditions. We do this for both a blocking, or guarded, interpretation of operations (often used when specifying reactive systems) as well as the more common non-blocking interpretation of operations used in many state-based specification languages (for modelling sequential systems). The approach is general enough to use with any state-based specification language, and any CTL model checker in which the language can be encoded.

Clausal resolution in a logic of rational agency

A resolution based proof system for a Temporal Logic of Possible Belief is presented. This logic is the combination of the branching-time temporal logic CTL (representing change over time) with the modal logic KD45 (representing belief ). Such combinations of temporal or dynamic logics and modal logics are useful for specifying complex properties of multi-agent systems. Proof methods are important for developing verification techniques for these complex multi-modal logics. Soundness, completeness and termination of the proof method are shown and simple examples illustrating its use are given.

Refining and Compressing Abstract Model Checking

For verifying systems involving a wide number or even an infinite number of states, standard model checking needs approximating techniques to be tractable. Abstract interpretation offers an appropriate framework to approximate models of reactive systems in order to obtain simpler models, where properties of interest can be effectively checked. In this work we study the impact of domain refinements in abstract interpretation based model checking. We consider the universal fragment of the branching time temporal logic CTL∗ and we characterize the structure of temporal formulae that are verified in new abstract models obtained by refining an abstract domain by means of reduced product and disjunctive completion, or by simplifying the domain by their inverse operations of complementation and least disjunctive bases.

Branching-Time Temporal Logic and Tree Automata

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal logic formula that specifies this behavior. The close connection between linear-time temporal logics and the theory of automata on infinite words has been an active area of research. In particular, automata-theoretic techniques have proven to be an effective approach to linear-time model checking. On the other hand, for branching-time temporal logics, current automata-theoretic techniques involve an exponential blow-up, making them essentially useless for model-checking. In this paper we present an automata-theoretic framework for branching-time model checking. We introducesimultaneous treesand associate with every structure a simultaneous tree that enables an automaton to visit different nodes on the same path of the structure simultaneously. With every formulaψwe associate an automaton that accepts exactly these simultaneous trees that originate from structures that satisfyψ. This enables to use the automaton for model checking which is reduced to the membership problem. We demonstrate our framework with the branching-time temporal logic CTL and show that it yields a linear automata-based model-checking algorithm, matching the known bound. This is the first time that a model-checking algorithm for a branching-time temporal logic has been placed in the automata-theoretic framework.

Complexity Results for Model Checking

The complexity of model checking branching and linear time<br />temporal logics over Kripke structures has been addressed in e.g. [SC85,<br />CES86]. In terms of the size of the Kripke model and the length of the<br />formula, they show that the model checking problem is solvable in <br />polynomial time for CTL and NP-complete for L(F). The model checking<br />problem can be generalised by allowing more succinct descriptions of<br />systems than Kripke structures. We investigate the complexity of the<br />model checking problem when the instances of the problem consist of<br />a formula and a description of a system whose state space is at most<br />exponentially larger than the description. Based on Turing machines,<br />we define compact systems as a general formalisation of such system<br />descriptions. Examples of such compact systems are K-bounded Petri<br />nets and synchronised automata, and in these cases the well-known <br />algorithms presented in [SC85, CES86] would require exponential space in<br />term of the sizes of the system descriptions and the formulas; we present<br />polynomial space upper bounds for the model checking problem over<br />compact systems and the logics CTL and L(X,U,S). As an example of<br />an application of our general results we show that the model checking<br />problems of both the branching time temporal logic CTL and the linear<br />time temporal logics L(F) and L(X,U, S) over K-bounded Petri nets are<br />PSPACE-complete.