WSU CEG 7370: Distributed Computing Principles

Temporal Logic

Prabhaker Mateti

Symbols

¬ negation/not;
! negation/not;
for-all;
there-exists-a;
eventually;
always ;
implies;
::= is-defined-as,
is-the-same-as

Classical v Temporal Logic

  1. Classical mathematical logic deals with timeless statements.

    "This basket has 5 red balls and 10 blue balls."

    ∀n : ∃m : g(n + m)

    asserts that g(i) is true for infinitely many values of i.
  2. Classical logic cannot express:

    "This basket will have 10 red balls."

  3. Interesting statements about processes depend on time.

    A and B are mutually exclusive for ever.

  4. Temporal logic can describe time-dependent properties without introducing time explicitly.

    Process 2 will be in the critical section.

  5. Without temporal logic, we would be forced to explicitly involve time as a variable:

    for-all t: not (A(t) and B(t))

Temporal Logic Overview

TL Example Assertions

  1. keywords: Always, Eventually, Sometime, Next, Until
  2. Always x != 0
  3. Sometime x == 0
  4. {x == y} Until {y == 0}
  5. {x == 0} implies {Next {Always {x != 0}}}
    // x is zero only once
  6. Sometime {! this.isInterrupted()}
    // this thread is not interrupted forever
    // this thread is never interrupted
  7. Always {x.isWaitingOn(y) implies {! y.isWaitingOn(x)}}
  8. forall agent in AgentPool
         forall document in TopSecretDocumentPool
           {! agent.canView(document)}
               Until {agent.hasClearanceFor(document)}

Modal Operators

The semantics of temporal logic is based on behaviors. A behavior is an infinite sequence of states.

always P (□P)

P is always True. □ Square. Unary prefix. Also called, Henceforth.

An assertion that something may never happen is called a safety property.

eventually P (◊P)

It is not the case that P is always False. P is eventually True. Same as, "sometime". ◊ Diamond box.

As you can see, (eventually P) is the same as (not always not P); ◊P ≡ !□!P

An assertion that something eventually does happen is called a liveness property.

P until Q

Q holds now or in the future, and P has to hold until that time. From that time on, P does not have to hold any more. Binary infix.

P leads-to Q (P ~→ Q)

P leads-to Q ::= (always (P implies eventually Q))

Using wiggly-arrow ~→ for leads-to

P ~→ Q ::= □(P ⇒ ◊Q)

Binary infix.

This is transitive.

Infinitely Often (□◊P)

The formula □◊P (always eventually P) is true for a behavior iff ◊P is true at all times n during that behavior, and ◊P is true at time n iff P is true at some time m greater than or equal to n.

Eventually Always (◊□P)

The formula ◊□P asserts that eventually P is always True.

Eventually Always implies Infinitely Often

◊□P ⇒ □◊P, for any P

Temporal Properties

□ F ⇒ F Always F implies F.
¬ □F ⇔ ◊¬F      F is not always true iff it is eventually false.
□(F & G ) ⇔ □F & □G      F and G are both always true iff F is always true and G is always true. Another way of saying this is that □ distributes over & .
□ F or □ G ⇒ □(F or G) □ distributes over or?
[Note the implies]
□(F or G) ⇏ (□ F or □ G) Reverse of above does not hold.
◊(F or G ) ⇔ ◊F or ◊G Eventually distributes over OR.
□ ◊(F or G) ⇔ (□◊F) or (□◊G) Always-Eventually distributes over OR.
◊□ (F & G) ⇔ (◊□ F) & (◊□ G) Eventually-Always distributes over AND.
from P ⇒ P', P' ⇒□Q', Q' ⇒Q
infer P ⇒ □Q
Consequence Rule
from P ⇒□R, R ⇒□Q infer P ⇒□Q Catenation Rule
from F infer □F Generalization Rule
from F ⇒ G infer □F ⇒ □G Implies Generalization Rule

Weak/Strong Fairness

int x := 0, y := 0;
do < await true --> x := x + 1>
[] < await true --> y := y + 1>
od
  Do any of the following hold?
always x = 0
eventually x > 5
eventually always y = 3

Weak Fairness

An operation must be executed if it remains possible to do so for a long enough time.

"Long enough" means until the operation is executed, so weak fairness asserts that eventually the operation must either be executed or become impossible to execute. It may mean perhaps only briefly.

Strong Fairness

An operation must be executed if it is infinitely often possible to do so.

Either the operation is eventually executed, or its execution is not infinitely often possible. Not infinitely often possible is the same as eventually always impossible (¬□◊ . . . ≡ ◊□¬ . . .), so we get

strong fairness: (◊ executed) or (◊□ impossible)

We formalize action A is "executed" and A is "impossible" later.

Naive Formulation

weak fairness: (eventually executed) or (eventually impossible)

strong fairness: (eventually executed) or (eventually always impossible)

In symbols,

weak fairness  : (◊ executed) or (◊ impossible)

strong fairness: (◊ executed) or (◊ □ impossible)

We formalize action A is "executed" and A is "impossible" later.

Intermediate Formulation

The two naive temporal formulas assert fairness at "time zero", but we want fairness to hold at all times. The correct formulas are:

weak fairness : □((◊ executed) or (◊ impossible))
strong fairness: □((◊ executed) or (◊□ impossible))

Temporal logic reasoning, using the semantic definitions of □ and ◊, shows that these conditions are equivalent to

weak fairness : (□◊ executed) or (□◊ impossible)
strong fairness: (□◊ executed) or (◊□ impossible)

Final Formulation

  1. Enabled A ::= the predicate that is true for a state iff it is possible to take an A step starting in that state.
  2. If A is an atomic operation of a program, then Enabled A is true for those states in which it is possible to perform the operation.
  3. Formalizing action A is "executed" and A is "impossible", we get
  4. WFf(A) ::= (□◊ A f ) or (□◊¬Enabled A f )
    SFf(A) ::= (□◊ A f ) or (◊□¬Enabled A f )
  5. Since ◊□P ⇒ □◊P for any P, SFf(A) ⇒ WFf(A).

Exercises

  1. Prove that (eventually P) is the same as (not always not P).
  2. In the context of the program shown above, do any of the following hold? always x = 0, eventually x > 5, eventually always y = 3. Assume weak fairness.
  3. Assume strong fairness. Answer Q2.
  4. Under what conditions does this terminate?

    bool b := true;
    process LP:: do b → skip od
    process ST:: b := false

  5. Claim: Strong: Terminates. Weak: May not terminate. Prove it.
    bool continue := true, try := false;
    process LP::
    do continue →
       try := true;
       try := false
    od
    process ST:: < await try → continue := false >

References

  1. Gregory R. Andrews, Concurrent Programming: Principles and Practice, Benjamin/Cummings, 1991. Chapter 2: Required Reading.
  2. http://www.tlaplus.net/ TLA "is a logic ... that consist[s] mainly of ordinary (non-temporal) mathematics with just a tiny bit of temporal logic." This site hosts a number of free software tools and articles on a subset of temporal logic developed by Lamport. Recommended Visit.
  3. Leslie Lamport, Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers, Pearson Education, Inc, 2002. (A free PDF of this book, for personal use, is available at http://research.microsoft.com/en-us/um/ people/ lamport/ tla/ tla.html) http://research.microsoft.com/en-us/ um/people/ lamport/ tla/ hyperbook.html Suggested Reading.

Copyright © 2014 pmateti@wright.edu