Temporal Formulas Research Articles

Semantics, distributed implementation, and formal analysis of KLAIM models in Maude

Emerging distributed systems such as cloud-based services are characterized by computations over different explicit localities, moving code and data, and a high degree of concurrency. KLAIM is a well-established language that can naturally describe such systems. The KLAIM language is process algebra flavored, allows Linda-based asynchronous communication through distributed tuple spaces, and supports explicit localities as well as code and data mobility. In this work we take some first steps in the quest for a correct-by-construction design process for secure and reliable distributed systems. Such a design process is necessary as more and more safety- and security-critical tasks that need to satisfy mission-critical formal requirements are executed in a distributed setting. We use a rewriting-based approach to formally specify and analyze KLAIM specifications of distributed systems. In particular we: (i) specify the reduction semantics of KLAIM in Maude, (ii) extend the Maude-based specification by making messages first-class citizens, and (iii) describe a second extension that allows true distributed execution of Maude-based KLAIM specifications. We prove that under appropriate weak fairness assumptions all these specifications are stuttering bisimilar and that large classes of logic temporal formulas, namely all CTL⁎∖X formulas, are preserved. By means of an example we show that our approach allows specifying aspects of a distributed system in a Maude-based KLAIM dialect, verifying these specifications using Maude's LTL model checking capabilities, and then executing the verified specifications in a distributed environment. This marks a first step in the quest for a correct-by-construction design process for secure and reliable distributed systems.

Interconnections between classes of sequentially compositional temporal formulas

Interval Temporal Logic (ITL) is an established formalism for reasoning about time periods. We elucidate here the relationship between various kinds of compositional propositional ITL formulas. Several are closed under conjunction and the standard temporal operator known as “box” and “always”.

Büchi Store: an open repository of $$\omega $$ -automata

We introduce Buchi Store, an open repository of Buchi automata and other types of $$\omega $$ -automata for model-checking practice, research, and education. The repository contains Buchi automata and their complements for common specification patterns and numerous temporal formulae. These automata are made as small as possible by various construction techniques in view of the fact that smaller automata are easier to understand and often help in speeding up the model-checking process. The repository is open, allowing the user to add automata that define new languages or are smaller than existing equivalent ones. Such a collection of Buchi automata is also useful as a benchmark for evaluating translation or complementation algorithms and as examples for studying Buchi automata and temporal logic. These apply analogously for other types of $$\omega $$ -automata, including deterministic Buchi and deterministic parity automata, which are also collected in the repository. In particular, the use of smaller deterministic parity automata as an intermediary helps reduce the complexity of automatic synthesis of reactive systems from temporal specifications.

Temporal formulas in Serbian oral epic songs

This paper seeks to present time as one of the most important parameters in epic songs, shown in the example of temporal formulas. Time also represents the principle of organizing section sequences in the song (linear, successive and chronological, or discontinuous and retrospective). The paper further examines the temporal formulas in a broad and a narrow sense, with regard to whether the temporal markers refer to the narrative shifts in the development of the story, or to some archaic meanings related to expressions which mark the determinants of real time (year and its parts, days of the week, time of the day, etc.).

Abstraction and Idealization in the Formal Verification of Software Systems

Questions concerning the epistemological status of computer science are, in this paper, answered from the point of view of the formal verification framework. State space reduction techniques adopted to simplify computational models in model checking are analysed in terms of Aristotelian abstractions and Galilean idealizations characterizing the inquiry of empirical systems. Methodological considerations drawn here are employed to argue in favour of the scientific understanding of computer science as a discipline. Specifically, reduced models gained by Data Abstraction are acknowledged as Aristotelian abstractions that include only data which are sufficient to examine the interested executions. The present study highlights how the need to maximize incompatible properties is at the basis of both Abstraction Refinement, the process of generating a cascade of computational models to achieve a balance between simplicity and informativeness, and the Multiple Model Idealization approach in biology. Finally, fairness constraints, imposed to computational models to allow fair behaviours only, are defined as ceteris paribus conditions under which temporal formulas, formalizing software requirements, acquire the status of law-like statements about the software systems executions.

Agent deliberation in an executable temporal framework

Autonomous agents are not so difficult to construct. Constructing autonomous agents that will work as required is much harder. A clear way in which we can design and analyse autonomous systems so that we can be more confident that their behaviour is as required is to use formal methods. These can, in principle, allow us to exactly specify the behaviour of the agent, and verify that any implementation has the properties required. In addition to using a more formal approach, it is clear that problems of conceptualisation and analysis can be aided by the use of an appropriate abstraction. In this article we tackle one particular aspect of formal methods for agent-based systems, namely the formal representation and implementation of deliberation within agents. The key aspect here is simplicity. Agents are specified using a relatively simple temporal logic and are executed by directly interpreting such temporal formulae. Deliberation is captured by modifying the way in which execution handles its temporal goals. Thus, in this article we provide motivations, theoretical underpinnings, implementation details, correctness arguments, and comparisons with related work.

Reactive Safety

The distinction between safety and liveness properties is a fundamental classification with immediate implications on the feasibility and complexity of various monitoring, model checking, and synthesis problems. In this paper, we revisit the notion of safety for reactive systems, i.e., for systems whose behavior is characterized by the interplay of uncontrolled environment inputs and controlled system outputs. We show that reactive safety is a strictly larger class of properties than standard safety. We provide algorithms for checking if a property, given as a temporal formula or as a word or tree automaton, is a reactive safety property and for translating such properties into safety automata. Based on this construction, the standard verification and synthesis algorithms for safety properties immediately extend to the larger class of reactive safety.

Constructing Situations and Time

Situations serving as partial worlds as well as events in natural language semantics are constructed from a type-theoretic interpretation of first-order formulae and (after a type reduction) temporal formulae. Limitations of the Russell-Wiener-Kamp derivation of time from events are discussed and overcome to give a more widely applicable account of temporal granularity. Finite situations are formulated as strings of observations, conceptualized to persist inertially (in the absence of forces).

Multi-Valued Modal Fixed Point Logics for Model Checking

In this paper, I will show how multi-valued logics are used for model checking. Model checking is an automatic technique to analyze correctness of hardware and software systems. A model checker is based on a temporal logic or a modal fixed point logic. That is to say, a system to be checked is formalized as a Kripke model, a property to be satisfied by the system is formalized as a temporal formula or a modal formula, and the model checker checks that the Kripke model satisfies the formula. Although most existing model checkers are based on 2-valued logics, recently new attempts have been made to extend the underlying logics of model checkers to multi-valued logics. I will summarize these new results.

The Temporal Aliasing Formulas for the Tandem Mission of Jason-1 and TOPEX/Poseidon

Abstract The temporal aliasing formulas are derived for the Tandem Mission of Jason-1 and the Ocean Topography Experiment (TOPEX)/Poseidon. Previously, aliasing formulas were derived for a single satellite or a constellation of coordinated satellites, wherein the coordination is such that the collective samplings appear as if they were carried out by a single satellite. In this vein, Jason-1 and TOPEX/Poseidon are coordinated spatially but not temporally. The problem is treated as a general problem about the temporal phasing between any two satellites that are coordinated spatially so that the Tandem Mission is just one special case, whereas the temporally coordinated case is another special case. The present results do agree with the formulas for a constellation of coordinated satellites when the temporal phasing yields temporal coordination, as they should. The benefit of temporal coordination shows itself as having a higher spatial resolution for temporally aliased features. The physical implication is twofold. First, a high-frequency and low-wavenumber feature (e.g., the barotropic Rossby waves) has a better chance of being aliased as a low-frequency and higher-wavenumber feature in a perfectly coordinated mission than it has in the Tandem Mission. Second, in a perfectly coordinated mission, a high-frequency and high-wavenumber feature could be aliased as a low-frequency and high-wavenumber feature rather than as a low-frequency and low-wavenumber feature in the Tandem Mission. Despite the extreme mathematical complexity, the physical case is rather intuitive. Namely, the two satellites need temporal coordination to work as one in fending off temporal aliasing. Without it, the two satellites behave as two independent satellites, thus each reverting to their original (i.e., lower) spatial resolution capability in dealing with temporal aliasing.

A Sound and Complete Deductive System for CTL* Verification

The paper presents a compositional approach to the verification of CTL* properties over reactive systems. Both symbolic model-checking (SMC) and deductive verification are considered. Both methods are based on two decomposition principles. A general state formula is decomposed into basic state formulas which are CTL* formulas with no embedded path quantifiers. To deal with arbitrary basic state formulas, we introduce another reduction principle which replaces each basic path formula, i.e., path formulas whose principal operator is temporal and which contain no embedded temporal operators or path quantifiers, by a newly introduced boolean variable which is added to the system. Thus, both the algorithmic and the deductive methods are based on two statification transformations which successively replace temporal formulas by assertions which contain no path quantifiers or temporal operators. Performing these decompositions repeatedly, we remain with basic assertional formulas, i.e., formulas of the form Ef p and Af p for some assertion p. In the model-checking method we present a single symbolic algorithm to verify both universal and existential basic assertional properties. In the deductive method we present a small set of proof rules and show that this set is sound and relatively complete for verifying universal and existential basic assertional properties over reactive systems. Together with two proof rules for the decompositions, we obtain a sound and relatively complete proof system for arbitrary CTL* properties. Interestingly, the deductive approach for CTL* presented here, offers a viable new approach to the deductive verification of arbitrary LTL formulas. The paper corrects a previous preliminary version of a deductive system for CTL*, in which some of the rules were unsound. The correction is based on the introduction of a new type of temporal testers which are guaranteed to be non blocking. That is, when composed with a deadlock-free system, which is a key operation in the verification process, the resulting composed system is guaranteed to remain deadlock free.

Tool support for learning Büchi automata and linear temporal logic

Abstract We introduce a graphical interactive tool, named GOAL, that can assist the user in understanding Büchi automata, linear temporal logic, and their relation. Büchi automata and linear temporal logic are closely related and have long served as fundamental building blocks of linear-time model checking. Understanding their relation is instrumental in discovering algorithmic solutions to model checking problems or simply in using those solutions, e.g., specifying a temporal property directly by an automaton rather than a temporal formula so that the property can be verified by an algorithm that operates on automata. One main function of the GOAL tool is translation of a temporal formula into an equivalent Büchi automaton that can be further manipulated visually. The user may edit the resulting automaton, attempting to optimize it, or simply run the automaton on some inputs to get a basic understanding of how it operates. GOAL includes a large number of translation algorithms, most of which support past temporal operators. With the option of viewing the intermediate steps of a translation, the user can quickly grasp how a translation algorithm works. The tool also provides various standard operations and tests on Büchi automata, in particular the equivalence test which is essential for checking if a hand-drawn automaton is correct in the sense that it is equivalent to some intended temporal formula or reference automaton. Several use cases are elaborated to show how these GOAL functions may be combined to facilitate the learning and teaching of Büchi automata and linear temporal logic.

Timed automata for metric interval temporal logic formulae in prototype verification system

Based on analysis of the syntax structure and semantics model of the metric interval temporal logic (MITL) formulas, it is shown how to transform a formula written in the real-time temporal logic MITL formula into a fair timed automaton (TA) that recognizes its satisfying models with prototype verification system (PVS) in this paper. Both the tabular construction’s principles and the PVS implementation details are given for the different type of MITL formula according to the corresponding semantics interpretations. After this transformation procedure, specifications expressed with MITL formula can be verified formally in the timed automata framework developed previously.

Estimating rate- and state-friction parameters using a two-node stochastic model for aftershocks

The well-known Omori, and modified Omori (Omori-Utsu), empirical formulae describe the decay in the rate of occurrence of aftershocks. Dieterich's rate- and state-dependent constitutive law for aftershock production produces a similar temporal formula with physically interpretable parameters, such as the shear stressing rates, the normal stress, and a fault constitutive parameter. This naturally leads to an interest in estimating these parameters from earthquake catalogs, which requires a simpler stochastic model. An alternative to the Epidemic Type Aftershock Sequence (ETAS) model is the two-node seismic transfer and release model, where one node represents the mainshock process, and a secondary node represents the aftershock zone. The aftershock decay rate in the two-node model equals that derived from Dieterich's rate- and state-dependent constitutive law, and the inclusion of aseismic slip in the aftershock zone allows for values of p > 1 in the best matching modified Omori law. The two-node model can be easily fitted to aftershock data, and has an application to aftershock stacking for estimating p-values. The equivalence between the rate- and state- and two-node aftershock rates forms a bridge between a formula derived from physical considerations and a phenomenological stochastic model. We show how this can be exploited, by identifying physical units for the parameters in the latter, to estimate the fault constitutive parameters, and the stressing rates, in Dieterich's formula through a best-fit inversion on real aftershock sequences. The procedure is illustrated using data from four Japanese earthquakes.

A Petri-Net-Based Correctness Analysis of Internet Stock Trading Systems

This paper shows how temporal Petri nets (TPNs) can be used to specify and analyze an Internet stock trading system. The dynamical behavior of the system and causality between events can be explicitly described by temporal formulas. The functional correctness of the modeled system is formally verified by using the inferential rules in temporal logic. Important properties of the system are analyzed based on its TPN model such as liveness, eventuality, and fairness properties. This paper demonstrates that TPNs can provide significant advantages in the design and analysis of business processes.

Assisting Groupware Development with Model Checking - Case Studies from Cooperative Work in the WWW

Efficient collaboration entails significant benefits for modern enterprises. Recent advances in Internet technology allow physically dispersed groups to bypass the obstacles raised by geographical distances, so the development of Internet based groupware may extend collaboration to a global scale. As groupware applications grow larger and more diverse, however, it becomes difficult to anticipate their correctness. In this paper, we address this difficulty within the context of group awareness, which we regard both as a communication issue and a user-interface one. The main contribution of our research is the use of symbolic model checking for verifying group awareness in collaborative work across the WWW. This involves the specification of two related protocols with temporal logic and the development of a methodology for encoding temporal formulae into the language of a symbolic model checker, which eliminates the need to draw state-transition diagrams. Taking then advantage of the model checker's ability to produce counterexamples, we discover drawbacks in these protocols and propose thereon a number of improvements, which aim to transform the WWW into a reliable collaborative environment.

Real-Time Model-Checking: Parameters everywhere

In this paper, we study the model-checking and parameter synthesis problems of the logic TCTL over discrete-timed automata where parameters are allowed both in the model (timed automaton) and in the property (temporal formula). Our results are as follows. On the negative side, we show that the model-checking problem of TCTL extended with parameters is undecidable over discrete-timed automata with only one parametric clock. The undecidability result needs equality in the logic. On the positive side, we show that the model-checking and the parameter synthesis problems become decidable for a fragment of the logic where equality is not allowed. Our method is based on automata theoretic principles and an extension of our method to express durations of runs in timed automata using Presburger arithmetic.

An Efficient Specification for System Verification

In design of complex and large scale systems, system verification has played an important role. In this article, we focus on specification process of model checking in system verifications. Modeled systems are in general specified by temporal formulas of computation tree logic, and users must know well about temporal specification because the specification might be complex. We propose a method by which specifications with temporal formulas are obtained inductively. We will show verification results using the proposed temporal formula specification method, and show that amount of memory, OBDD nodes, and execution time are reduced.

LogLogics: A logic for history-dependent business processes

Choices in business processes are often based on the process history saved as a log-file listing events and their time stamps. In this paper we introduce LogLogics, a finite-path variant of the Timed Propositional Temporal Logic with Past, which can be in particular used for specifying guards in business process models. The novelty is due to the presence of boundary points corresponding to the starting and current observation points, which gives rise to a three-valued logic allowing us to distinguish between temporal formulas that hold for any log extended with some possible past and future (true), those that do not hold for any extended log (false) and those that hold for some but not all extended logs (unknown). We reduce the check of the truth value of a LogLogics formula to a check on a finite abstraction and present an evaluation algorithm. We also define LogLogics patterns for commonly occurring properties.

Emlan: A Language for model checking of embedded systems software

Abstract Embedded System Modelling Language (EMLAN) is high-level, C-like language for modelling and model checking of embedded systems. The language addresses a number of topics concerning embedded systems such as: partitioning of the system, concurrency, interrupts, synchronization mechanisms, time, data transformations hardware interactions. Model checking of the EMLAN specification is based on translations into DT-CSM (Discrete Time Concurrent State Machines), generation of a reachability graph and checking requirements expressed as CTL temporal formulas. The paper presents the EMLAN language, methods of translation into DT-CSM and an example of specification and symbolic verification of the traffic light controller.