Model checking discounted temporal properties

Abstract

Temporal logic is two-valued: formulas are interpreted as either true or false. When applied to the analysis of stochastic systems, or systems with imprecise formal models, temporal logic is therefore fragile: even small changes in the model can lead to opposite truth values for a specification. We present a generalization of the branching-time logic CTL which achieves robustness with respect to model perturbations by giving a quantitative interpretation to predicates and logical operators, and by discounting the importance of events according to how late they occur. In every state, the value of a formula is a real number in the interval [0,1], where 1 corresponds to truth and 0 to falsehood. The boolean operators and and or are replaced by min and max, the path quantifiers ∃ and ∀ determine sup and inf over all paths from a given state, and the temporal operators ✸ and specify sup and inf over a given path; a new operator averages all values along a path. Furthermore, all path operators are discounted by a parameter that can be chosen to give more weight to states that are closer to the beginning of the path.We interpret the resulting logic DCTL over transition systems, Markov chains, and Markov decision processes. We present two semantics for DCTL: a path semantics, inspired by the standard interpretation of state and path formulas in CTL, and a fixpoint semantics, inspired by the -calculus evaluation ଁ Updated and extended text of paper to appear in Theoretical Computer Science, Elsevier. 140 L. de Alfaro et al. / Theoretical Computer Science 345 (2005) 139 -170 of CTL formulas. We show that, while these semantics coincide for CTL, they differ for DCTL, and we provide model-checking algorithms for both semantics.

Comparison of modeling formalisms for Safety Analyses: SAML and AltaRica

“…It can perform quantitative analysis like "How likely is it in the worsecase that a certain (dangerous) state is reached". It can analyze any kind of pCTL [6] formula. Rather than calculating sets of failure combinations, the pDCCA calculates the overall hazard probability.…”

Probabilistic contracts: a compositional reasoning methodology for the design of systems with stochastic and/or non-deterministic aspects

“…The theory generalizes to other classes of infinite word automata closed under negation and union and other logical formalisms such as CTL [17] or PSL [27]. -Availability with level m and discount factor d. In [23], de Alfaro et al proposed DCTL, a quantitative version of the CTL logic [17]. DCTL has the same syntax as CTL, but its semantics differs: in DCTL, formulas and atomic propositions take values between 0 and 1 rather than in {0, 1}.…”

“…maximum) valuation of ϕ 1 over all the runs. In addition to its quantitative aspect, DCTL also allows to discount on the value of the formula as well as to compute its average ( d operator, where d is the discount: see the semantics with d = 1 and d < 1 page 6 of [23]) on a possibly infinite run. We assume that B A and B G are complete finite-word automata and show how to reduce A-satisfaction to the evaluation of a DCTL property.…”

“…We can thus use the labeling technique with propositions that was proposed for the non-probabilistic case (assuming that the states of the automaton have also been split (see the split for transition system)). For a given scheduler (which transforms the MDP into a Markov chain), we can compute the expected value for the formula d p. Remark 4 Memoryless schedulers are sufficient for P-R-Satisfaction, but history-dependent schedulers are needed for the case of P-A-Satisfaction (see page 13 of [23]). …”

“…Assuming that assumptions and guarantees are represented with Büchi automata (which allows to specify assumptions and guarantees with logics such as LTL [43] or PSL [27]), we observe that checking if a (stochastic) system satisfies a reliability property can be done with classical techniques implemented in tools such as SPIN [49] or LIQUOR [14]. In the paper, we show that satisfaction of availability properties can be checked with an extension of the work presented in [23]. Finally, we also show that operations between and on contracts can easily be performed on the automata-based representations.…”