CTL*

CTL* is a superset of computational tree logic (CTL) and linear temporal logic (LTL). It freely combines path quantifiers and temporal operators. Like CTL, CTL* is a branching time logic. The formal semantics of CTL* formulae are defined with respect to a given Kripke structure.

Contents

History

LTL has been proposed for the verification of computer programs first by Amir Pnueli in 1977. Four years later in 1981 E. M. Clarke and E. A. Emerson invented CTL and CTL model checking. CTL* was defined by E. A. Emerson and Joseph Y. Halpern in 1986.

Interestingly, CTL and LTL have been developed independently before CTL*. Both sublogics have become very important in the model checking community, while CTL* is not yet of practical importance. This is surprising because the computational complexity of model checking in CTL* is not worse than that of LTL: they both lie in PSPACE.

Syntax

The language of well-formed CTL* formulae is generated by the following unambiguous (wrt bracketing) context-free grammar:

\Phi::=\bot \mid \top \mid p \mid (\neg\Phi) \mid (\Phi\and\Phi) \mid (\Phi\or\Phi) \mid (\Phi\Rightarrow\Phi) \mid (\Phi\Leftrightarrow\Phi) \mid A\phi \mid E\phi
\phi::=\Phi \mid (\neg\phi) \mid (\phi\and\phi) \mid (\phi\or\phi) \mid (\phi\Rightarrow\phi) \mid (\phi\Leftrightarrow\phi) \mid X\phi \mid F\phi \mid G\phi \mid [\phi U \phi]

where p ranges over a set of atomic formulas. Valid CTL*-formulae are built using the nonterminal \Phi. These formulae are called state formulae, while those created by the symbol \phi are called path formulae. (The above grammar contains some redundancies; for example \Phi\or\Phi as well as implication and equivalence can be defined as just for Boolean algebras (or propositional logic) from negation and conjunction, and the temporal operators X and U are sufficient to define the other two.)

The operators basically are the same as in CTL. However, in CTL, every temporal operator (X, F, G, U) has to be directly preceded by a quantifier, while in CTL* this is not required. The universal path quantifier may defined in CTL* in the same way as for classical predicate calculus A\phi = \neg E \neg \phi, although this in not possible in the CTL fragment.

Examples of formulae

Remark: When taking LTL as subset of CTL*, any LTL formula is implicitly prefixed with the universal path quantifier \ A

Semantics

The semantics of CTL* are define with respect to some Kripke structure. As the names imply, state formulae are interpreted with respect to the states of this structure, while path formulae are interpreted over paths on it.

State formulae

If a state s of the Kripke structure satisfies a state formula \Phi it is denoted s\models\Phi. This relation is defined inductively as follows:

  1. \Big( (\mathcal{M}, s) \models \top \Big) \land \Big( (\mathcal{M}, s) \not\models \bot \Big)
  2. \Big( (\mathcal{M}, s) \models p \Big) \Leftrightarrow \Big( p \in L(s) \Big)
  3. \Big( (\mathcal{M}, s) \models \neg\Phi \Big) \Leftrightarrow \Big( (\mathcal{M}, s) \not\models \Phi \Big)
  4. \Big( (\mathcal{M}, s) \models \Phi_1 \land \Phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \models \Phi_1 \big) \land \big((\mathcal{M}, s) \models \Phi_2 \big) \Big)
  5. \Big( (\mathcal{M}, s) \models \Phi_1 \lor \Phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \models \Phi_1 \big) \lor \big((\mathcal{M}, s) \models \Phi_2 \big) \Big)
  6. \Big( (\mathcal{M}, s) \models \Phi_1 \Rightarrow \Phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \not\models \Phi_1 \big) \lor \big((\mathcal{M}, s) \models \Phi_2 \big) \Big)
  7. \bigg( (\mathcal{M}, s) \models \Phi_1 \Leftrightarrow \Phi_2 \bigg) \Leftrightarrow \bigg( \Big( \big((\mathcal{M}, s) \models \Phi_1 \big) \land \big((\mathcal{M}, s) \models \Phi_2 \big) \Big) \lor \Big( \neg \big((\mathcal{M}, s) \models \Phi_1 \big) \land \neg \big((\mathcal{M}, s) \models \Phi_2 \big) \Big) \bigg)
  8. \Big( (\mathcal{M}, s) \models A\phi \Big) \Leftrightarrow \Big(\pi\models\phi for all paths \ \pi starting in s\Big)
  9. \Big( (\mathcal{M}, s) \models E\phi \Big) \Leftrightarrow \Big(\pi\models\phi for some path \ \pi starting in s\Big)

Path formulae

The satisfaction relation \pi\models\phi for path formulae \ \phi and a path \pi = s_0 \to s_1 \to \cdots is also defined inductively. For this, let \ \pi[n] denote the sub-path s_n \to s_{n%2B1} \to \cdots:

  1. \Big( \pi \models \Phi \Big) \Leftrightarrow \Big((\mathcal{M}, s_0) \models \Phi\Big)
  2. \Big( \pi \models \neg\phi \Big) \Leftrightarrow \Big( \pi \not\models \phi \Big)
  3. \Big( \pi \models \phi_1 \land \phi_2 \Big) \Leftrightarrow \Big( \big(\pi \models \phi_1 \big) \land \big(\pi \models \phi_2 \big) \Big)
  4. \Big( \pi \models \phi_1 \lor \phi_2 \Big) \Leftrightarrow \Big( \big(\pi \models \phi_1 \big) \lor \big(\pi \models \phi_2 \big) \Big)
  5. \Big( \pi \models \phi_1 \Rightarrow \phi_2 \Big) \Leftrightarrow \Big( \big(\pi \not\models \phi_1 \big) \lor \big(\pi \models \phi_2 \big) \Big)
  6. \bigg( \pi \models \phi_1 \Leftrightarrow \phi_2 \bigg) \Leftrightarrow \bigg( \Big( \big(\pi \models \phi_1 \big) \land \big(\pi \models \phi_2 \big) \Big) \lor \Big( \neg \big(\pi \models \phi_1 \big) \land \neg \big(\pi \models \phi_2 \big) \Big) \bigg)
  7. \Big( \pi \models X\phi \Big) \Leftrightarrow \Big( \pi[1] \models \phi \Big)
  8. \Big( \pi \models F\phi \Big) \Leftrightarrow \Big( \exists n\geqslant 0: \pi[n] \models \phi \Big)
  9. \Big( \pi \models G\phi \Big) \Leftrightarrow \Big( \forall n\geqslant 0: \pi[n] \models \phi \Big)
  10. \Big( \pi \models [\phi_1U\phi_2] \Big) \Leftrightarrow \Big( \exists n\geqslant 0: \big(\pi[n] \models \phi_2 \land \forall 0\leqslant k < n:~ \pi[k] \models \phi_1 \big)\Big)

See also

References

External links