## Temporal logics and model checking for fairly correct systems (2006)

Venue: | In Proc. 21st Ann. Symp. Logic in Computer Science (LICS’06 |

Citations: | 7 - 2 self |

### BibTeX

@INPROCEEDINGS{Varacca06temporallogics,

author = {Daniele Varacca},

title = {Temporal logics and model checking for fairly correct systems},

booktitle = {In Proc. 21st Ann. Symp. Logic in Computer Science (LICS’06},

year = {2006},

pages = {389--398},

publisher = {Press}

}

### OpenURL

### Abstract

We motivate and study a generic relaxation of correctness of reactive and concurrent systems with respect to a temporal specification. We define a system to be fairly correct if there exists a fairness assumption under which it satisfies its specification. Equivalently, a system is fairly correct if the set of runs satisfying the specification is large from a topological point of view, i.e., it is a co-meager set. We compare topological largeness with its more popular sibling, probabilistic largeness, where a specification is probabilistically large if the set of runs satisfying the specification has probability 1. We show that topological and probabilistic largeness of ω-regular specifications coincide for bounded Borel measures on finite-state systems. As a corollary, we show that, for specifications expressed in LTL or by Büchi automata, checking that a finite-state system is fairly correct has the same complexity as checking that it is correct. Finally we study variants of the logics CTL and CTL*, where the ‘for all runs ’ quantifier is replaced by a ‘for a large set of runs ’ quantifier. We show that the model checking complexity for these variants is the same as for the original logics. 1

### Citations

1246 | Automatic verification of finite-state concurrent systems using temporal logic specifications
- Clarke, Emerson, et al.
- 1986
(Show Context)
Citation Context ...re (H2) is removed 2 and (P1) is replaced by (P3) below. Finally, versions without past are defined by replacing (H1) by (H3) below. φ := X h | h U h (P3) h := p (H3) Satisfaction is defined as usual =-=[10, 16]-=-. In particular, we follow the Ockhamist interpretation of the past, where each state has a unique past. The semantics of history formulas is as follows: • M, x, i |= Y h iff (i > 0) and M, x, i − 1 |... |

506 |
Automata on infinite objects
- Thomas
- 1990
(Show Context)
Citation Context ... an LTL(+past) formula φ, we will also use φ to denote the set of paths that satisfy φ when no confusion arises. An ω-regular property is a property that is accepted by some Büchi automaton (see e.g. =-=[26]-=-). 2.3 Path games and the Pistore-Vardi logic The path quantifiers A (‘for all paths’) and E (‘there exists a path’) of CTL* are two extreme notions of satisfaction of a path formula in a system. We c... |

408 |
Defining Liveness
- Alpern, Schneider
- 1985
(Show Context)
Citation Context ...also say that a co-meager set is topologically large or T-large. 3.2 The safety-liveness classification We say that a property X ⊆ Σ ω is live in α ∈ Σ ∗ if α↑ ∩ X � ∅. Following Alpern and Schneider =-=[1]-=-, a safety property is a property X such that x � X implies that x has a finite prefix α where X is not live. X is live in a safety property S (also: (S, X) is machine-closed) if X is live in every α ... |

279 | A logic for reasoning about time and reliability
- Hansson, Jonsson
- 1994
(Show Context)
Citation Context ... an alternative to the known linear time algorithm for P-large CTL [2]. Other polynomial model checking algorithms could be derived by viewing P-large CTL as a restricted version of pCTL [6] and PCTL =-=[14]-=-. 7 Pistore-Vardi revisited As indicated in Sect. 2.3, besides AE, also the other path quantifiers of the Pistore-Vardi logic could be considered as relaxations of correctness. In this section, we obs... |

237 |
Automatic verification of probabilistic concurrent finite-state programs
- Vardi
- 1985
(Show Context)
Citation Context ...hecking largeness open. From Thm. 1, we can immediately conclude that checking largeness is PSPACE-complete for LTL or Büchi automata specifications. 6 5.1 Büchi automata and LTL specifications Vardi =-=[27]-=- has shown that checking P-largeness of an ωregular property given by a Büchi automaton is PSPACEcomplete in the size of the automaton. Hence we obtain: Theorem 2 The problem of checking T-largeness o... |

173 |
The complexity of probabilistic verification
- Courcoubetis, Yannakakis
- 1995
(Show Context)
Citation Context .... Hence we obtain: Theorem 2 The problem of checking T-largeness of a Büchi automata specification against a finite system is PSPACE-complete in the size of the automaton. Courcoubetis and Yannakakis =-=[11]-=- have shown that checking P-largeness of an LTL formula is PSPACEcomplete in the size of the formula. Therefore: Theorem 3 The problem of checking T-largeness of an LTL formula in a finite system is P... |

143 |
The glory of the past
- Lichtenstein, Pnueli, et al.
- 1985
(Show Context)
Citation Context ...to (M, s) if for each property X ∈ F that is T-large in (M, s), we have F ∩ M(s) ⊆ X. Note that if F is complete for a family F then it is also complete for every subfamily of F . Lichtenstein et al. =-=[21]-=- introduced α-fairness and showed that it is complete for showing P-largeness of ω-regular properties of finitestate systems. Zuck, Pnueli, and Kesten [29] point out that state fairness is complete fo... |

90 | It usually works: The temporal logic of stochastic systems
- Aziz, Singhal, et al.
- 1995
(Show Context)
Citation Context ...s. Hardness follows from the fact that checking largeness of LTL is PSPACE-hard. The logic P-large CTL* can be also seen as a restricted version of more expressive probabilistic logics, such as pCTL* =-=[6]-=-, which can express all probabilities between 0 and 1. The model checking of pCTL* is also in PSPACE. One can consider a logic that combines the universal/existential and largeness/non-smallness quant... |

87 | Model-checking for probabilistic real-time systems
- Alur, Courcoubetis, et al.
- 1991
(Show Context)
Citation Context ...xity. Note that, by Thm. 4, this algorithm can also be used for checking P-large CTL formulas on a finite Markov chain. This provides an alternative to the known linear time algorithm for P-large CTL =-=[2]-=-. Other polynomial model checking algorithms could be derived by viewing P-large CTL as a restricted version of pCTL [6] and PCTL [14]. 7 Pistore-Vardi revisited As indicated in Sect. 2.3, besides AE,... |

69 |
Modalities for Model Checking: Branching Time Strikes Back
- Emerson, Lei
- 1985
(Show Context)
Citation Context ...ss of an LTL+past formula can be translated into satisfaction of a CTL* formula. Checking whether a state reactivity formula is dense in a structure requires time quadratic in the size of the formula =-=[12]-=-. On the other hand, Alur and Henzinger [3] claim that checking whether a state reactivity is large requires linear time. We provide an alternative proof of their result. For a state reactivity formul... |

56 |
A hierarchy of temporal properties
- Manna, Pnueli
- 1990
(Show Context)
Citation Context ... therefore every property is the intersection of a safety and a liveness property [1]. 3.3 The safety-progress classification As an alternative to the safety-liveness classification, Manna and Pnueli =-=[22]-=- propose the safety-progress classification. Let X ⊆ Σ ω . • X is a safety property iff there exists a finitary property Q such that for each x ∈ X, all finite prefixes of x are in Q, • X is a guarant... |

47 | Measure and category. A survey of the analogies between topological and measure spaces. Second edition - Oxtoby - 1980 |

46 |
Appraising fairness in languages for distributed programming
- Apt, Francez, et al.
- 1988
(Show Context)
Citation Context ...rness is defined with respect to a given system (M, s) or, more general, with respect to a safety property S . (Note that M(s) is a safety property.) It has been pointed out by Apt, Francez, and Katz =-=[5]-=- and by Lamport [18] that a fairness property for S should be live (i.e., dense) in S . This requirement alone, however, does not rule out some properties that are intuitively not fairness properties,... |

43 | Hundreds of impossibility results for distributed computing
- Fich, Ruppert
- 2003
(Show Context)
Citation Context ...many problems, a system satisfying the ∗ Funded by EPSRC grant GR/T04724/01 1 Hagen Völzer Universität zu Lübeck, Germany actual specification is impossible, too difficult, or too expensive to obtain =-=[13]-=-. In such cases, we could be content with a system where the specification is almost satisfied, i.e., the set of runs satisfying the specification is ‘large’. One natural way to formalise ‘large set’ ... |

35 |
Reasoning with time and chance
- Lehmann, Shelah
- 1982
(Show Context)
Citation Context ... have the path quantifiers � and � , where � .φ means φ is satisfied with probability 1 and � .φ means φ is satisfied with probability > 0. This is essentially the logic studied by Lehmann and Shelah =-=[20]-=-. Call τ the bijection between T-large CTL* and P-large CTL* where AE is replaced by � and EA by � . Using structural induction and Thm. 1 it is easy to prove that: Theorem 4 For any T-large-CTL* form... |

33 | The complexity of temporal logic model checking
- Schnoebelen
- 2003
(Show Context)
Citation Context ...egy for one of the disjuncts. To check the largeness of a reactivity formula we check the satisfaction of the corresponding CTL+past formula. The model checking problem for CTL+past is PSPACEcomplete =-=[19, 25]-=-. Reactivity formulas encompass many interesting formulas, e.g. safety formulas such as G p or G(p → F −1 q), persistence formulas such as F G p and recurrence formulas such as G F p, also forms of re... |

27 | Characterization of Temporal Property Classes - Chang, Manna, et al. |

26 | Once and for all
- Kupferman, Pnueli
(Show Context)
Citation Context ... that (si, si+1) ∈ R for all i ≥ 0. The set of all paths of (M, s0) is denoted by M(s0). 2.2 Temporal-logical properties We consider various temporal logics here. The most expressive one is CTL*+past =-=[16]-=-, which is defined by the following syntax rules (S1)-(P1), where a ranges over atomic propositions, p over state formulas, h over history formulas, and φ over path formulas: p := a | ¬p | p ∧ p (S1) ... |

21 | Fairness and hyperfairness
- Lamport
(Show Context)
Citation Context ...th respect to a given system (M, s) or, more general, with respect to a safety property S . (Note that M(s) is a safety property.) It has been pointed out by Apt, Francez, and Katz [5] and by Lamport =-=[18]-=- that a fairness property for S should be live (i.e., dense) in S . This requirement alone, however, does not rule out some properties that are intuitively not fairness properties, and it implies that... |

19 | Local liveness for compositional modeling of fair reactive systems
- Alur, Henzinger
- 1995
(Show Context)
Citation Context ...n the future operators X, U, and their derivatives. In case all pi and qi are state formulas we call φ a state reactivity formula. A formula of the form (G F p ∨ F G q) is called a Streett constraint =-=[3]-=-. Consider the following translation of a reactivity formula into a CTL+past formula: • �F G h� = AG EF AG h • �G F h� = AG EF h • �G F h ∨ F G g� = AG(¬�F G ¬h� ∨ ¬�G F ¬g�) • �φ ∧ ψ� = �φ� ∧ �ψ� Pro... |

19 |
Augmenting branching temporal logics with existential quantification over atomic propositions
- Kupferman
- 1999
(Show Context)
Citation Context ...a. Their translation however is of non-elementary complexity and hence not suitable for complexity analysis. Pistore and Vardi [24] provide an efficient translation into the logic EGCTL* of Kupferman =-=[15]-=-, whose model checking complexity is double exponential time [15]. Kupferman and Vardi [17] show that model checking the Pistore-Vardi logic without AE and EA is EXPSPACE-complete leaving the complexi... |

11 |
Defining Fairness
- Völzer, Varacca, et al.
- 2005
(Show Context)
Citation Context ...dor [7] observe that for many fairness notions from the literature, the set of fair runs is topologically large, i.e., a co-meager set in the natural topology of runs of a given system. Völzer et al. =-=[28]-=- show that this is in fact true for most of the existing fairness notions and they also give more arguments why fairness should be defined as co-meagerness in the natural topology. An important conseq... |

7 | Reasoning about systems with transition fairness
- Aminof, Ball, et al.
- 2004
(Show Context)
Citation Context ... that a large set of runs satisfies X p if and only if all runs satisfy X p. Theorem 6 The model checking problem for T-large CTL can be solved in linear time. 3 A similar translation can be found in =-=[4]-=-, where it is used for model checking CTL under transition fairness. 8 The translation produces an exponential blow up, but the model checking algorithm can by-pass this, by a form of dynamic programm... |

5 | Specification in CTL + past for verification in CTL
- Laroussinie, Schnoebelen
(Show Context)
Citation Context ...egy for one of the disjuncts. To check the largeness of a reactivity formula we check the satisfaction of the corresponding CTL+past formula. The model checking problem for CTL+past is PSPACEcomplete =-=[19, 25]-=-. Reactivity formulas encompass many interesting formulas, e.g. safety formulas such as G p or G(p → F −1 q), persistence formulas such as F G p and recurrence formulas such as G F p, also forms of re... |

5 | The Planning Spectrum - One, Two, Three, Infinity
- Pistore, Vardi
- 2003
(Show Context)
Citation Context ... the standard case: PSPACE-complete for CTL* and linear for CTL. The path quantifier ‘for a large set of runs’ also occurs (under a different point of view) in a logic introduced by Pistore and Vardi =-=[24]-=-. We reinterpret their work from a topological point of view, which allows us to derive some basic properties of their logic. 2 Preliminary notions 2.1 Systems and temporal properties Let Σ be a count... |

5 | Automatic verification of probabilistic free choice
- Zuck, Pnueli, et al.
- 2002
(Show Context)
Citation Context ...r every subfamily of F . Lichtenstein et al. [21] introduced α-fairness and showed that it is complete for showing P-largeness of ω-regular properties of finitestate systems. Zuck, Pnueli, and Kesten =-=[29]-=- point out that state fairness is complete for showing P-largeness of properties that are expressible in LTL without the next- and until-operators. We show now that completeness w.r.t. ω-regular and L... |

4 | Once upon a time in a west - determinacy, definability, and complexity of path games
- Berwanger, Grädel, et al.
- 2003
(Show Context)
Citation Context ...fy any fairness assumption explicitly). We also show that fair correctness of a system with respect to an LTL+past specification is expressible in CTL+past, strengthening a result of Berwanger et al. =-=[8]-=-. Then, we consider variants of the logics CTL and CTL*, where the quantifier ‘for all runs’ is replaced by ‘for a large set of runs’. We show that also for these logics, the model checking complexity... |

3 | A temporal logic for proving properties of topologically general executions
- Ben-Eliyahu, Magidor
- 1996
(Show Context)
Citation Context ...tively, one can define a fairness assumption under which the specification is satisfied, with the intuition that ‘most’ runs are fair. This intuition has a formal counterpart: Ben-Eliyahu and Magidor =-=[7]-=- observe that for many fairness notions from the literature, the set of fair runs is topologically large, i.e., a co-meager set in the natural topology of runs of a given system. Völzer et al. [28] sh... |

1 |
Memoryful branching-time logic. This volume
- Kupferman, Vardi
(Show Context)
Citation Context ...plexity analysis. Pistore and Vardi [24] provide an efficient translation into the logic EGCTL* of Kupferman [15], whose model checking complexity is double exponential time [15]. Kupferman and Vardi =-=[17]-=- show that model checking the Pistore-Vardi logic without AE and EA is EXPSPACE-complete leaving the complexity of checking largeness open. From Thm. 1, we can immediately conclude that checking large... |