Temporal logic query checking: a tool for model exploration

: The question of whether branching-time temporal logic or linear-time temporal logic is best for reasoning about concurrent programs is one of the most controversial issues in logics of programs. Concurrent programs are usually modelled by labelled state-transition graphs in which some state is designated as the initial state. For historical reasons such graphs are called Kripke structures. In linear temporal logic operators are provided for describing events along a single time path (i.e., along a single path in a Kripke structure). In a branching-time logic the temporal operators quantify over the futures that are possible from a given state (i.e., over the possible paths that lead from a state). It is well known that the two types of temporal logic have different expressive powers. Linear temporal logic, for example, can express certain fairness properties that cannot be expressed in branching-time temporal logic. On the other hand, certain practical decision problems like model checking are easier for branching-time temporal logic than for linear temporal logic. This paper provides further insight on which type of logic is best. It is shown that if two finite Kripke structures can be distinguished by some formula that contains both branching-time and linear-time operators, then the structures can be distinguished by a formula that contains only branching time operators. Specifically, we show that if two finite Kripke structures can be distinguished by some formula of the logic CTL (i.e., if there is some CTL formula that is true in one but not in the other), then they can be distinguished by some formula of the logic CTL.

Temporal logic queries on Datalog and negated Datalog programs are studied, and their relationship to Datalog queries on these programs is explored. It is shown that, in general, temporal logic queries have more expressive power than Datalog queries on Datalog and negated Datalog programs. It is also shown that anexistential domain-independent fragment of temporal logic queries has the same expressive power as Datalog queries on negated Datalog programs with inflationary semantics. This means that for finite structures this class of queries has the power of the fixpoint logic.

Many temporal and modal logic languages can be regarded as subsets of first order logic, i.e. the semantics of a temporal logic formula is given as a first order condition on points of the underlying models (Kripke structures). Often the set of possible models is restricted to models which are trees. A temporal logic language is (first order) expressively complete, if for every first order condition for a node of a tree there exists an equivalent temporal formula which expresses the same condition. In this paper expressive completeness of the temporal logic language with the set of operators U (until), S (since), and X k (k-next) is proved, and the result is extended to various other tree-like structures.

This paper shows the relation between linear temporal logic and theory of languages of concurrent processes. To this purpose, we give an algebraic correspondence between temporal logic systems and some non deterministic sequential machines. This correspondence lies on an effective method which composes machines as temporal operators. So we can synthetise processes from temporal logic formulas and solve logic problems by algorithms applied to machines.KeywordsTemporal LogicLinear Temporal LogicTemporal Logic FormulaNous AllonsBranch Time Temporal LogicThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper considers the problem of power systems load voltage control in order to satisfy formula expresses in temporal logics. Temporal logic can be used for expressing the coordination and sequencing of multiple agent controllers. In order to implement temporal logic control of power system, the paper first construct discrete abstraction of load voltage control system through its continuous state space decomposition, and then defines some specification propositions for OLTC regulation, load shedding relay and capacitor bank switching, and finally generates the temporal logic formula for power system load voltage control. This temporal logic formula is a supervisor of multiple agent coordination control. Some cases taking temporal logic formulas as specifications were simulated, and the results display that the temporal logic control for power system control synthesis is extremely significant

Subject of Research. The paper presents the study of vulnerability exploitation techniques in the implementation of dynamic memory allocation algorithms (glibc library allocator): Poisoned Null-byte, Overlapped Chunks, Fastbin Attack,Unsafe Unlink, House of Einherjar, House of Force, House of Spirit, House of Lore, Unsorted Bin Attack. Examples of vulnerability exploitation code and classification of the presented techniques are given in accordance with the Common Weakness Enumeration list. The modern methods and means of vulnerabilities detection are studied; their advantages and disadvantages are shown using the Heap Hopper framework as an example. Modern methods of appropriate software verification are considered. Method. The proposed software verification method combines the approaches of static analysis and symbolic execution using an accurate model of algorithms for dynamic memory allocation. In the compilation process of program being tested, the Kripke structure is created. Dynamic memory vulnerabilities are described by temporal logic formulas. The resulting structure and formulas are passed at the input of the model checking algorithm. Concrete-symbolic execution of the assembled binary file is performed. Vulnerability conditions expressed in the form of propositional logic formulas are checked for symbolic execution paths. Main Results. The practical use of the proposed approach to detection of dynamic memory vulnerabilities in software applications is shown. Symbolic execution is implemented in the form of a low-level debugger, which reduces the operating time of algorithms due to the execution of the application being tested on a real processor. Practical Relevance. The paper presents an integrated approach for solving the problem of automatic vulnerabilities detecting at different stages of the software development life cycle. This approach is applicable for verification of the similar implementations of dynamic memory allocators, such as ptmalloc, dlmalloc, tcmalloc, jemalloc and musl.

We address the problem of learning temporal properties from the branching-time behavior of systems. Existing research in this field has mostly focused on learning linear temporal properties specified using popular logics, such as Linear Temporal Logic (LTL) and Signal Temporal Logic (STL). Branching-time logics such as Computation Tree Logic (CTL) and Alternating-time Temporal Logic (ATL), despite being extensively used in specifying and verifying distributed and multi-agent systems, have not received adequate attention. Thus, in this paper, we investigate the problem of learning CTL and ATL formulas from examples of system behavior. As input to the learning problems, we rely on the typical representations of branching behavior as Kripke structures and concurrent game structures, respectively. Given a sample of structures, we learn concise formulas by encoding the learning problem into a satisfiability problem, most notably by symbolically encoding both the search for prospective formulas and their fixed-point based model checking algorithms. We also study the decision problem of checking the existence of prospective ATL formulas for a given sample. We implement our algorithms in a Python prototype and have evaluated them to extract several common CTL and ATL formulas used in practical applications.

In this paper, a motion planning system based on predictive control and temporal logic specifications is established for the welding dual-arm robot with gantry. Firstly, based on the spatial structure of the dual-arm robot with gantry, a novel mathematical model is presented between the joint variables and the terminal attitude and the quaternion replaces the Euler Angle to describe the posture for avoiding gimbal lock. Then a constraint model predictive controller is constructed for the multi-variable, nonlinear and coupling model of the robot and the constraints of the environment. Meanwhile, the temporal logic formula is used for describing the complex welding tasks and reducing the workload of repeated programming. Next the expectation values and constraints are converted by the temporal logic formula will be sent to the predictive controller one by one. Finally, the simulation result shows that the system can effectively solve the problem of motion planning for the welding dual-arm robot with gantry.

We study the runtime verification of hyperproperties, expressed in the temporal logic HyperLTL, as a means to inspect a system with respect to security polices. Runtime monitors for hyperproperties analyze trace logs that are organized by common prefixes in the form of a tree-shaped Kripke structure, or are organized both by common prefixes and by common suffixes in the form of an acyclic Kripke structure. Unlike runtime verification techniques for trace properties, where the monitor tracks the state of the specification but usually does not need to store traces, a monitor for hyperproperties repeatedly model checks the growing Kripke structure. This calls for a rigorous complexity analysis of the model checking problem over tree-shaped and acyclic Kripke structures. We show that for trees, the complexity in the size of the Kripke structure is L-complete independently of the number of quantifier alternations in the HyperLTL formula. For acyclic Kripke structures, the complexity is PSPACE-complete (in the level of the polynomial hierarchy that corresponds to the number of quantifier alternations). The combined complexity in the size of the Kripke structure and the length of the HyperLTL formula is PSPACE-complete for both trees and acyclic Kripke structures, and is as low as NC for the relevant case of trees and alternation-free HyperLTL formulas. Thus, the size and shape of both the Kripke structure and the formula have significant impact on the complexity of the model checking problem.

The properties of dynamic interactions in mobile-interactive systems are still difficult to analyze because of the complexity of systems. Thus, we have proposed a new Petri net called the variable petri net (VPN) recently, which specializes in describing dynamic interactions in systems. To make better use of VPN, this article focuses on the model checking method of VPN. It introduces the algorithm to transform a VPN to a Kripke structure that can describe both the system running states and the system connection states in VPN, and the method to transform a property to a temporal logic formula based on VPN and its Kripke structure. The Kripke structure can be optimized by considering the specific property about the system connection states and then be used to perform the targeted verification to the property by using a model checker. A practical example is given to demonstrate the proposed methods.

In bounded model checking (BMC) a system is modeled with a finite automaton and various desired properties with temporal logic formulae. Property verification is achieved by translation into boolean logic and the application of SAT-solvers. bounded satisfiability checking (BSC) adopts a similar approach, but both the system and the properties are modeled with temporal logic formulae, without an underlying operational model. Hence, BSC supports a higher-level, descriptive approach to system specification and analysis. We compare the performance of BMC and BSC over a set of case studies, using the Zot tool to translate automata and temporal logic formulae into boolean logic. We also propose a method to check whether an operational model is a correct implementation (refinement) of a temporal logic model, and assess its effectiveness on the same set of case studies. Our experimental results show the feasibility of BSC and refinement checking, with modest performance loss w.r.t. BMC.

We present a tableau-based algorithm for obtaining an automaton from a temporal logic formula. The algorithm is geared towards being used in model checking in an “on-the-fly” fashion, that is the automaton can be constructed simultaneously with, and guided by, the generation of the model. In particular, it is possible to detect that a property does not hold by only constructing part of the model and of the automaton. The algorithm can also be used to check the validity of a temporal logic assertion. Although the general problem is PSPACE-complete, experiments show that our algorithm performs quite well on the temporal formulas typically encountered in verification. While basing linear-time temporal logic model-checking upon a transformation to automata is not new, the details of how to do this efficiently, and in “on-the-fly” fashion have never been given.

We demonstrate the first Recurrent Neural Network architecture for learning\nSignal Temporal Logic formulas, and present the first systematic comparison of\nformula inference methods. Legacy systems embed much expert knowledge which is\nnot explicitly formalized. There is great interest in learning formal\nspecifications that characterize the ideal behavior of such systems -- that is,\nformulas in temporal logic that are satisfied by the system's output signals.\nSuch specifications can be used to better understand the system's behavior and\nimprove design of its next iteration. Previous inference methods either assumed\ncertain formula templates, or did a heuristic enumeration of all possible\ntemplates. This work proposes a neural network architecture that infers the\nformula structure via gradient descent, eliminating the need for imposing any\nspecific templates. It combines learning of formula structure and parameters in\none optimization. Through systematic comparison, we demonstrate that this\nmethod achieves similar or better mis-classification rates (MCR) than\nenumerative and lattice methods. We also observe that different formulas can\nachieve similar MCR, empirically demonstrating the under-determinism of the\nproblem of temporal logic inference.\n

This paper presents a correct and complete algorithm that translates propositional linear time temporal logic (PTL) formulae to event-based automata for finitary control synthesis. It proposes the translation algorithm as a specification interface to well-established automata-theoretic control synthesis methods for discrete-event systems (DES’s). This allows control requirements to be more easily described and understood in an expressive and readable language that temporal logic is widely recognized as. Adding such a translation interface effectively combines specifiability and readability in temporal logic with prescriptiveness and computability in automata. The former temporal logic features support specification while the latter automata features support the prescription of DES dynamics and algorithmic computations. A practical implementation of the interface has been developed, providing an enabling technology for writing more readable control specifications in PTL that it translates for finitary control synthesis in automata. A simple example illustrates the use of the proposed temporal logic interface. Practical implications of the complexity of the translation algorithm are discussed.

In our earlier work, we introduced a state-based approach for the diagnosis of repeatedly occurring failures in discrete event systems (DESs). Since temporal logic provides a simpler way of specifying system properties, in this paper a temporal logic based approach for diagnosing the occurrence of a repeated number of failures is developed. Linear-time temporal logic (LTL) formulae are used to represent the specifications of DESs. Notions of pre-diagnosability for failures and diagnosability for repeated failures are introduced in the setting of temporal logic. A polynomial algorithm for the test of pre-diagnosability for failures is provided. The diagnosis problem for repeated failures in the temporal logic setting is reduced to one in a state-based setting, and so the prior results of state-based repeated failure diagnosis can be applied.