Daniel Neider 12 PauloTabuada 1 - University of PennsylvaniaDaniel Neider and Paulo Tabuada: Robust...

Robust LTL

Daniel Neider 1,2 Paulo Tabuada 1

1University of California, Los Angeles

2University of Illinois at Urbana-Champaign

Annual ExCAPE Meeting, MIT, Cambridge, Massachusetts, USAJune 22nd, 2015

Specifications of Open Systems

ϕ ⇒ ψ

Environment assumption System guarantee

Daniel Neider and Paulo Tabuada: Robust LTL 1

ϕ ⇒ ψ

Fault Tolerance (Wikipedia)

“[...] If its operating quality decreases at all, the decrease isproportional to the severity of the failure, as compared to a naivelydesigned system in which even a small failure can cause totalbreakdown. [...]”

ϕ ⇒ ψ

GoalDevelop a semantics for LTL capturing “robustness”

I Here: only LTL( , )

Design Goals

I Robustness should be internal to the logicI We want to reuse the wealth of existing techniques for LTL

ϕ ⇒ ψ

GoalDevelop a semantics for LTL capturing “robustness”

I Here: only LTL( , )

Design Goals

I Robustness should be internal to the logicI We want to reuse the wealth of existing techniques for LTL

Different Shades of False

In which ways can p be violated?

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p

(1, 1, 1, 1)

p¬p p

(0, 1, 1, 1)

p¬p p

(0, 0, 1, 1)

p¬p p

(0, 0, 0, 1)

p¬p ¬p

(0, 0, 0, 0)

Weakening

p¬p p (1, 1, 1, 1)

p¬p p (0, 1, 1, 1)

p¬p p (0, 0, 1, 1)

p¬p p (0, 0, 0, 1)

p¬p ¬p (0, 0, 0, 0)

shades

offalse

falseDaniel Neider and Paulo Tabuada: Robust LTL 2

Weakening

p¬p p (1, 1, 1, 1)

p¬p p (0, 1, 1, 1)

p¬p p (0, 0, 1, 1)

p¬p p (0, 0, 0, 1)

p¬p ¬p (0, 0, 0, 0)

A Da Costa Algebra over B4

Elements of B4 are ordered:

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

Additionally, we introduce the following four operations:

I a ∧ b = min {a, b}I a ∨ b = max {a, b}

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

(1, 1, 1, 1) if a ≤ bb otherwise

a b a ∧ b min {a, b} a ∨ b max {a, b}

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

In fact, (B4, <,∧,∨, · ,→) is a so-called da Costa algebra

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

Additionally, we introduce the following four operations:I a ∧ b = min {a, b}I a ∨ b = max {a, b}

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

(0, 0, 0, 0) < (0, 0, 0, 1) < (0, 0, 1, 1) < (0, 1, 1, 1) < (1, 1, 1, 1)

I a ={

(0, 0, 0, 0) if a = (1, 1, 1, 1)(1, 1, 1, 1) otherwise

I a→ b ={

0 0 0 0 0 00 1 0 0 1 11 0 0 0 1 11 1 1 1 1 1

Negation

(1, 1, 1, 1) (0, 0, 0, 0)

(0, 1, 1, 1) (1, 1, 1, 1)

(0, 0, 1, 1) (1, 1, 1, 1)

(0, 0, 0, 1) (1, 1, 1, 1)

(0, 0, 0, 0) (1, 1, 1, 1)

In fact, (B4, <,∧,∨, · ,→) is a so-called da Costa algebraDaniel Neider and Paulo Tabuada: Robust LTL 3

Robust Semantics

We use new symbols , and call this “logic” rLTL

The semantics of rLTL( , ) is a functionV : ΦrLTL( , ) × (2P)ω → B4 inductively defined by

I V (p, σ) ={

(1, 1, 1, 1) if p ∈ σ(0)(0, 0, 0, 0) otherwise

I V (ϕ ∧ ψ, σ) = V (ϕ, σ) ∧ V (ψ, σ)I V (ϕ ∨ ψ, σ) = V (ϕ, σ) ∨ V (ψ, σ)I V (¬ϕ, σ) = V (ϕ, σ)I V (ϕ⇒ ψ, σ) = V (ϕ, σ)→ V (ψ, σ)

I V ( p, σ) = ( p, p, p, p)I V ( p, σ) = ( p, p, p, p)

Robust Semantics

I V (p, σ) ={

(1, 1, 1, 1) if p ∈ σ(0)(0, 0, 0, 0) otherwise

Robust Semantics

I V (p, σ) ={

(1, 1, 1, 1) if p ∈ σ(0)(0, 0, 0, 0) otherwise

I V ( p, σ) = ( p, p, p, p)

Robust Semantics

I V (p, σ) ={

(1, 1, 1, 1) if p ∈ σ(0)(0, 0, 0, 0) otherwise

Example

Consider p ⇒ q, and assume V ( p ⇒ q, σ) = (1, 1, 1, 1)

I If p holds, then p evaluates to (1, 1, 1, 1). Hence, q has toevaluate to (1, 1, 1, 1), which means that q holds

I If p holds (and p does not), then p evaluates to(0, 1, 1, 1). Hence, q has to evaluate to (0, 1, 1, 1) or higher,which implies that q holds

I Similarly, p implies q and p implies q

Recall: a→ b ={

Example

Consider p ⇒ q, and assume V ( p ⇒ q, σ) = (1, 1, 1, 1)I If p holds, then p evaluates to (1, 1, 1, 1). Hence, q has to

evaluate to (1, 1, 1, 1), which means that q holds

I If p holds (and p does not), then p evaluates to(0, 1, 1, 1). Hence, q has to evaluate to (0, 1, 1, 1) or higher,which implies that q holds

Recall: a→ b ={

Example

evaluate to (1, 1, 1, 1), which means that q holdsI If p holds (and p does not), then p evaluates to

(0, 1, 1, 1). Hence, q has to evaluate to (0, 1, 1, 1) or higher,which implies that q holds

Recall: a→ b ={

Example

evaluate to (1, 1, 1, 1), which means that q holdsI If p holds (and p does not), then p evaluates to

(0, 1, 1, 1). Hence, q has to evaluate to (0, 1, 1, 1) or higher,which implies that q holds

Recall: a→ b ={

Expressiveness

TheoremLTL( , ) and rLTL( , ) are equally expressive:

I Given an LTL( , ) formula ψ, one can construct an rLTL( , )formula ϕ such that for σ ∈ (2P)ω

V (ϕ, σ) = (1, 1, 1, 1) if and only if σ |= ψ

I Given an rLTL( , ) formula ϕ and b ∈ B4, one can construct anLTL( , ) formula ψ such that for σ ∈ (2P)ω

V (ϕ, σ) = b if and only if σ |= ψ

Note: |ψ| ∈ O(4|ϕ|)

Expressiveness

TheoremLTL( , ) and rLTL( , ) are equally expressive:

I Given an LTL( , ) formula ψ, one can construct an rLTL( , )formula ϕ such that for σ ∈ (2P)ω

V (ϕ, σ) = (1, 1, 1, 1) if and only if σ |= ψ

I Given an rLTL( , ) formula ϕ and b ∈ B4, one can construct anLTL( , ) formula ψ such that for σ ∈ (2P)ω

V (ϕ, σ) = b if and only if σ |= ψ

Note: |ψ| ∈ O(4|ϕ|)

Complexity ResultsTheoremGiven an rLTL( , ) formula ϕ over P, one can construct ageneralized Büchi Automaton A, containing dedicated states qb foreach b ∈ B4, such that for all σ ∈ (2P)ω

V (ϕ, σ) = b if and only if σ ∈ L(Aqb ).

A comprises O(5|ϕ|) states and at most 4 · |ϕ| acceptance sets.

Time complexity

rLTL( , ) LTL

Model checking 5|ϕ| 2|ϕ|

Synthesis 25|ϕ| 22|ϕ|

Complexity ResultsTheoremGiven an rLTL( , ) formula ϕ over P, one can construct ageneralized Büchi Automaton A, containing dedicated states qb foreach b ∈ B4, such that for all σ ∈ (2P)ω

V (ϕ, σ) = b if and only if σ ∈ L(Aqb ).

A comprises O(5|ϕ|) states and at most 4 · |ϕ| acceptance sets.

Time complexity

rLTL( , ) LTL

Model checking 5|ϕ| 2|ϕ|

Synthesis 25|ϕ| 22|ϕ|

Conclusion

Summary

I We introduced a semantics for LTL capturing robustnessI We demonstrated how to leverage the existing wealth of

techniques for LTL

What’s next?

I Full LTL (Next, Until, Release)I Address the “problem” of operators that work differently from

classical logics (e.g., “¬¬ϕ 6= ϕ”)I Do (complexity) results for restrictions of LTL carry over?

Daniel Neider 12 PauloTabuada 1 - University of PennsylvaniaDaniel Neider and Paulo Tabuada: Robust...

Documents

Transcript of Daniel Neider 12 PauloTabuada 1 - University of PennsylvaniaDaniel Neider and Paulo Tabuada: Robust...