Download Decision Problems for Metric Temporal Logic

Decision Problems for Metric Temporal Logic
Joël Ouaknine
Department of Computer Science
Oxford University
Quantitative Model Checking Winter School, February 2012
Metric Temporal Logic (MTL)
• MTL = LTL + timing constraints on operators:
– ♦[3,5] a
– !(a → ♦=1 b)
ϕ ::= TRUE | ϕ1 ∧ ϕ2 | ¬ϕ | a | ϕ1 UI ϕ2
where a is atomic and I ⊆ R is an interval with integer (or
unbounded) endpoints.
Modal operators !I and ♦I are derived from UI in the usual way.
Metric Temporal Logic (MTL)
• MTL = LTL + timing constraints on operators:
– ♦[3,5] a
– !(a → ♦=1 b)
• ϕ ::= TRUE | ϕ1 ∧ ϕ2 | ¬ϕ | a | ϕ1 UI ϕ2
where a is atomic and I ⊆ R is an interval with integer (or
unbounded) endpoints.
Modal operators !I and ♦I are derived from UI in the usual way.
Metric Temporal Logic (MTL)
• MTL = LTL + timing constraints on operators:
– ♦[3,5] a
– !(a → ♦=1 b)
• ϕ ::= TRUE | ϕ1 ∧ ϕ2 | ¬ϕ | a | ϕ1 UI ϕ2
where a is atomic and I ⊆ R is an interval with integer (or
unbounded) endpoints.
• Modal operators !I and ♦I are derived from UI in the usual way.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
1
t0
c
a
2
c
a
3
The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
1
t0
c
a
2
c
a
3
The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
1
t0
c
a
2
c
a
3
The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
• The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
• The continuous semantics is based on flows (or signals):
p
0
q
q
r
1
s
p
r
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
• The continuous semantics is based on flows (or signals):
p
0
q
t1
q
r
t2 t3
1
s
t4
p
r
t5
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
• The continuous semantics is based on flows (or signals):
p
0
q
t1
q
r
t2 t3
1
s
t4
p
r
t5
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
The Semantics of MTL
MTL has two main semantics: point-based and continuous:
• The point-based semantics is based on timed words
(finite or infinite sequences of timed events):
a
b
b
0
t1
t2
t0
1
2
a
c
c
a
t3
t4
t5
t6
3
• The continuous semantics is based on flows (or signals):
p
0
q
t1
q
r
t2 t3
1
s
t4
p
r
t5
2
3
We require that infinite timed words be non-Zeno: time should diverge
(timestamps get unboundedly large).
We also require that flows have finite variability: only finitely many
discontinuities in any finite amount of time.
Point-based vs. Continuous Semantics
• The point-based semantics is used to express specifications for
timed automata with labels on transitions.
It offers a series of ‘snapshot observations’ of the system under
consideration, every time an event (discrete change) occurs.
The continuous semantics is used to express specifications for
timed automata with labels on states.
It follows the evolution of the system at every instant in time.
Point-based vs. Continuous Semantics
• The point-based semantics is used to express specifications for
timed automata with labels on transitions.
It offers a series of ‘snapshot observations’ of the system under
consideration, every time an event (discrete change) occurs.
• The continuous semantics is used to express specifications for
timed automata with labels on states.
It follows the evolution of the system at every instant in time.
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
For example, let ϕ be:
!(request −→ ♦[0,1] grant)
Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
– Let w be:
!(request −→ ♦[0,1] grant)
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
– Let w be:
!(request −→ ♦[0,1] grant)
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
– Let w be:
!(request −→ ♦[0,1] grant)
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
– Let w be:
!(request −→ ♦[0,1] grant)
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
– Let w be:
!(request −→ ♦[0,1] grant)
1
0
Does w " ϕ ?
1
2
3
Point-based Semantics for MTL
• The relationship w " ϕ is defined inductively as in LTL.
– For example, let ϕ be:
!(request −→ ♦[0,1] grant)
– Let w be:
1
0
Indeed, w " ϕ.
1
2
3
Decision Problems for MTL
• Model checking: Given ϕ and a timed automaton A, does w " ϕ for
all words/flows w ∈ L(A) ?
• Satisfiability: Given ϕ, does there exist a word/flow w such that
w"ϕ?
Undecidability
Unfortunately, a transcription error led to the widespread belief
[AH92, AH93, H98, HR04, . . . ] that:
“Theorem.” Model checking and satisfiability are undecidable for
(weak fragments of) MTL.
In fact,
Theorem. [Alur and Henzinger, LICS 90]. MTL + past temporal
operators is undecidable (over both finite and infinite words/flows).
The original theorem and proof were correct, however an oversight
led to the claim, in the Conclusion, that “Any dense-time logic that
can express !(a −→ ♦=1 b) is undecidable.”
This led to the folklore slogan that
“Punctuality =⇒ undecidability.”
Undecidability
Unfortunately, a transcription error led to the widespread belief
[AH92, AH93, H98, HR04, . . . ] that:
“Theorem.” Model checking and satisfiability are undecidable for
(weak fragments of) MTL.
In fact,
Theorem. [Alur and Henzinger, LICS 90]. MTL + past temporal
operators is undecidable (over both finite and infinite words/flows).
The original theorem and proof were correct, however an oversight
led to the claim, in the Conclusion, that “Any dense-time logic that
can express !(a −→ ♦=1 b) is undecidable.”
This led to the folklore slogan that
“Punctuality =⇒ undecidability.”
Undecidability
Unfortunately, a transcription error led to the widespread belief
[AH92, AH93, H98, HR04, . . . ] that:
“Theorem.” Model checking and satisfiability are undecidable for
(weak fragments of) MTL.
In fact,
Theorem. [Alur and Henzinger, LICS 90]. MTL + past temporal
operators is undecidable (over both finite and infinite words/flows).
• The original theorem and proof were correct, however an oversight
led to the claim, in the Conclusion, that “Any dense-time logic that
can express !(a −→ ♦=1 b) is undecidable.”
• This led to the folklore slogan that
“Punctuality =⇒ undecidability.”
“The Benefits of Relaxing Punctuality”
• The perceived undecidability of MTL led researchers to investigate
‘punctually relaxed’ versions of MTL.
• Alur, Feder, and Henzinger defined the logic
Metric Interval Temporal Logic (MITL) [JACM 96].
MITL restricts MTL by forbidding punctual (singleton) intervals
I as time constraints.
They showed that model checking and satisfiability are
EXPSPACE-Complete.
The proof was very intricate (11 pages). Later on, Hirshfeld and
Rabinovich, as well as Maler, Nickovic, and Pnueli, published
considerably improved proofs.
Other attempted restrictions include, e.g., interpreting MTL over
integer time (also EXPSPACE-Complete). . .
“The Benefits of Relaxing Punctuality”
• The perceived undecidability of MTL led researchers to investigate
‘punctually relaxed’ versions of MTL.
• Alur, Feder, and Henzinger defined the logic
Metric Interval Temporal Logic (MITL) [JACM 96].
– MITL restricts MTL by forbidding punctual (singleton) intervals
I as time constraints.
They showed that model checking and satisfiability are
EXPSPACE-Complete.
The proof was very intricate (11 pages). Later on, Hirshfeld and
Rabinovich, as well as Maler, Nickovic, and Pnueli, published
considerably improved proofs.
Other attempted restrictions include, e.g., interpreting MTL over
integer time (also EXPSPACE-Complete). . .
“The Benefits of Relaxing Punctuality”
• The perceived undecidability of MTL led researchers to investigate
‘punctually relaxed’ versions of MTL.
• Alur, Feder, and Henzinger defined the logic
Metric Interval Temporal Logic (MITL) [JACM 96].
– MITL restricts MTL by forbidding punctual (singleton) intervals
I as time constraints.
– They showed that model checking and satisfiability are
EXPSPACE-Complete.
– The proof was very intricate (11 pages). Later on, Hirshfeld and
Rabinovich, as well as Maler, Nickovic, and Pnueli, published
considerably improved proofs.
Other attempted restrictions include, e.g., interpreting MTL over
integer time (also EXPSPACE-Complete). . .
“The Benefits of Relaxing Punctuality”
• The perceived undecidability of MTL led researchers to investigate
‘punctually relaxed’ versions of MTL.
• Alur, Feder, and Henzinger defined the logic
Metric Interval Temporal Logic (MITL) [JACM 96].
– MITL restricts MTL by forbidding punctual (singleton) intervals
I as time constraints.
– They showed that model checking and satisfiability are
EXPSPACE-Complete.
– The proof was very intricate (11 pages). Later on, Hirshfeld and
Rabinovich, as well as Maler, Nickovic, and Pnueli, published
considerably improved proofs.
• Other attempted restrictions include, e.g., interpreting MTL over
integer time (also EXPSPACE-Complete). . .
Safety and Liveness
A property of a real-time system is a set of timed words.
• Safety property: every violation has a finite bad (irredeemable)
prefix.
– ‘You do not shoot your supervisor’: !¬shoot.
• Liveness property: there are no bad prefixes (it’s never too late).
– ‘You eventually submit your thesis’: ♦submit.
Safety and Liveness
Q. Classify the following property: safety, liveness, or a mixture?
– ‘You submit your thesis within 3 years’: ♦[0,3] submit.
A. This is a safety property because of the non-Zenoness assumption
on timed words. Any non-Zeno word violating the property has a
finite bad prefix.
Realistic specifications define safety properties relative to the
divergence of time. Contrast with ‘You submit your thesis’!
Safety and Liveness
Q. Classify the following property: safety, liveness, or a mixture?
– ‘You submit your thesis within 3 years’: ♦[0,3] submit.
A. This is a safety property because of the non-Zenoness assumption
on timed words. Any non-Zeno word violating the property has a
finite bad prefix.
Realistic specifications define safety properties relative to the
divergence of time. Contrast with ‘You submit your thesis’!
Safety and Liveness
Q. Classify the following property: safety, liveness, or a mixture?
– ‘You submit your thesis within 3 years’: ♦[0,3] submit.
A. This is a safety property because of the non-Zenoness assumption
on timed words. Any non-Zeno word violating the property has a
finite bad prefix.
Realistic specifications define safety properties relative to the
divergence of time. Contrast with ‘You submit your thesis’!
Safety Fragments of MTL
There are various ways to impose syntactic restrictions on MTL to obtain
safety fragments of it:
• BMTL requires that all time constraints I be bounded.
– BMTL is in some sense ‘dual’ to MITL.
IMTL extends BMTL in allowing unbounded !I , but only under an
even number of negations.
IMTL = BMTL + Invariance.
Safety MTL requires that all future eventualities (♦I , UI ) be
time-bounded.
We have BMTL ⊆ IMTL ⊆ Safety MTL.
Safety Fragments of MTL
There are various ways to impose syntactic restrictions on MTL to obtain
safety fragments of it:
• BMTL requires that all time constraints I be bounded.
– BMTL is in some sense ‘dual’ to MITL.
• IMTL extends BMTL in allowing unbounded !I , but only under an
even number of negations.
– IMTL = BMTL + Invariance.
Safety MTL requires that all future eventualities (♦I , UI ) be
time-bounded.
We have BMTL ⊆ IMTL ⊆ Safety MTL.
Safety Fragments of MTL
There are various ways to impose syntactic restrictions on MTL to obtain
safety fragments of it:
• BMTL requires that all time constraints I be bounded.
– BMTL is in some sense ‘dual’ to MITL.
• IMTL extends BMTL in allowing unbounded !I , but only under an
even number of negations.
– IMTL = BMTL + Invariance.
• Safety MTL requires that all future eventualities (♦I , UI ) be
time-bounded.
We have BMTL ⊆ IMTL ⊆ Safety MTL.
Safety Fragments of MTL
There are various ways to impose syntactic restrictions on MTL to obtain
safety fragments of it:
• BMTL requires that all time constraints I be bounded.
– BMTL is in some sense ‘dual’ to MITL.
• IMTL extends BMTL in allowing unbounded !I , but only under an
even number of negations.
– IMTL = BMTL + Invariance.
• Safety MTL requires that all future eventualities (♦I , UI ) be
time-bounded.
We have BMTL ⊆ IMTL ⊆ Safety MTL.
Safety Fragments of MTL
Note that:
• All these fragments define safety properties relative to the
assumption of non-Zenoness.
• All these fragments allow punctuality.
• Only BMTL is closed under negation.
Flat and Coflat Fragments of MTL
• Flat MTL is defined as follows in negation-normal form:
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
– Flat MTL = BMTL + MITL-Persistence.
Coflat MTL is the dual logic (negation of Flat MTL):
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
MITL, BMTL, IMTL ⊆ Coflat MTL.
Note: Neither Flat MTL nor Coflat MTL are safety fragments.
Flat and Coflat Fragments of MTL
• Flat MTL is defined as follows in negation-normal form:
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
– Flat MTL = BMTL + MITL-Persistence.
• Coflat MTL is the dual logic (negation of Flat MTL):
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
– MITL, BMTL, IMTL ⊆ Coflat MTL.
Note: Neither Flat MTL nor Coflat MTL are safety fragments.
Flat and Coflat Fragments of MTL
• Flat MTL is defined as follows in negation-normal form:
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
– Flat MTL = BMTL + MITL-Persistence.
• Coflat MTL is the dual logic (negation of Flat MTL):
ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | ϕ UI ϕ | ϕ U!I ϕ
where I unbounded ⇒ ϕ ∈ MITL.
– MITL, BMTL, IMTL ⊆ Coflat MTL.
Note: Neither Flat MTL nor Coflat MTL are safety fragments.
Fragments of MTL
BMTL
IMTL
Safety MTL
MTL
LTL
MITL
Coflat MTL
Examples
!(request −→ ♦=1 grant)
is in IMTL, Safety MTL, and Coflat MTL.
It is not in BMTL or Flat MTL. (Nor in MITL.)
is not a safety formula.
!(request −→ ♦grant)
Since it is in LTL, it is in both Flat MTL and Coflat MTL. (And MITL.)
Examples
!(request −→ ♦=1 grant)
is in IMTL, Safety MTL, and Coflat MTL.
It is not in BMTL or Flat MTL. (Nor in MITL.)
is not a safety formula.
!(request −→ ♦grant)
Since it is in LTL, it is in both Flat MTL and Coflat MTL. (And MITL.)
Examples
!(request −→ ♦=1 grant)
is in IMTL, Safety MTL, and Coflat MTL.
It is not in BMTL or Flat MTL. (Nor in MITL.)
is not a safety formula.
!(request −→ ♦grant)
Since it is in LTL, it is in both Flat MTL and Coflat MTL. (And MITL.)
Examples
!(request −→ ♦=1 grant)
is in IMTL, Safety MTL, and Coflat MTL.
It is not in BMTL or Flat MTL. (Nor in MITL.)
is not a safety formula.
!(request −→ ♦grant)
Since it is in LTL, it is in both Flat MTL and Coflat MTL. (And MITL.)
Channel Machines
a b c
a!
a?
a?
c!
b?
c?
b!
Thm. The halting problem for channel machines is undecidable.
Channel Machines
a b c
a!
a?
a?
c!
b?
c?
b!
Thm. The halting problem for channel machines is undecidable.
Channel Machines
a b c a
a!
a?
a?
c!
b?
c?
b!
Thm. The halting problem for channel machines is undecidable.
Channel Machines
b c a
a!
a?
a?
c!
b?
c?
b!
Thm. The halting problem for channel machines is undecidable.
Channel Machines
b c a c
a!
a?
a?
c!
b?
c?
b!
Thm. The halting problem for channel machines is undecidable.
Channel Machines
b c a c
q1
a!
a?
a?
q0
c!
q3
q2
b?
c?
b!
q4
Thm. The halting problem for channel machines is undecidable.
Channel Machines
b c a c
q1
a!
a?
a?
q0
c!
q3
q2
b?
c?
b!
q4
Trace: q0 a! q1 a? q2 c! q3 · · ·
Channel Cycles
abcde
Channel Cycles
abcde
Channel Cycles
abcdef
Channel Cycles
abcdef g
Channel Cycles
bcdef g
Channel Cycles
cdef g
Channel Cycles
cdef gh
Channel Cycles
cdef ghi
Channel Cycles
cdef ghij
Channel Cycles
def ghij
Channel Cycles
def ghijk
Channel Cycles
def ghijkl
Channel Cycles
def ghijklm
Channel Cycles
def ghijklmn
Channel Cycles
ef ghijklmn
Channel Cycles
f ghijklmn
Channel Cycles
f ghijklmn
An EXPSPACE Algorithm
Theorem. The cycle-bounded reachability problem for single-channel
machines is decidable in EXPSPACE.
• Channel may contain doubly exponentially many messages in terms
of the number of cycles.
• Proof idea: can guess and verify a computation table using
exponential space.
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q
b! r
r a? q c! p
d! q b? r
r b! p c? r a! r d? q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Computation Table
a!
b!
a?
c!
d!
b?
b!
c?
a!
d?
p −→ q −→ r −→ q −→ p −→ q −→ r −→ p −→ r −→ r −→ q
p a! q q q q q q q b! r
r a? q c! p p p d! q b? r
r b! p c? r a! r d? q q q
Reducing BMTL to Cycle-Bounded Channel Machines
• BMTL has a small-model property:
Satisfiable BMTL formulas have models with prefixes of duration at
most exponential (in the size of the formula).
Runs of the corresponding alternating automaton can be computed
with an (exponential) cycle-bounded Channel Automaton that in
addition has global Renaming and Occurrence Testing as primitive
operations (CAROTs).
The halting problem for CAROTS is also in EXPSPACE.
Corollary: BMTL Satisfiability is in EXPSPACE.
Reducing BMTL to Cycle-Bounded Channel Machines
• BMTL has a small-model property:
Satisfiable BMTL formulas have models with prefixes of duration at
most exponential (in the size of the formula).
• Runs of the corresponding alternating automaton can be computed
with an (exponential) cycle-bounded Channel Automaton that in
addition has global Renaming and Occurrence Testing as primitive
operations (CAROTs).
The halting problem for CAROTS is also in EXPSPACE.
Corollary: BMTL Satisfiability is in EXPSPACE.
Reducing BMTL to Cycle-Bounded Channel Machines
• BMTL has a small-model property:
Satisfiable BMTL formulas have models with prefixes of duration at
most exponential (in the size of the formula).
• Runs of the corresponding alternating automaton can be computed
with an (exponential) cycle-bounded Channel Automaton that in
addition has global Renaming and Occurrence Testing as primitive
operations (CAROTs).
• The halting problem for CAROTS is also in EXPSPACE.
Corollary: BMTL Satisfiability is in EXPSPACE.
Reducing BMTL to Cycle-Bounded Channel Machines
• BMTL has a small-model property:
Satisfiable BMTL formulas have models with prefixes of duration at
most exponential (in the size of the formula).
• Runs of the corresponding alternating automaton can be computed
with an (exponential) cycle-bounded Channel Automaton that in
addition has global Renaming and Occurrence Testing as primitive
operations (CAROTs).
• The halting problem for CAROTS is also in EXPSPACE.
Corollary: BMTL Satisfiability is in EXPSPACE.
Coflat MTL Model Checking
• Let A be a timed automaton and ϕ a Coflat MTL formula.
• We can construct a timed alternating automaton BA,¬ϕ that captures
the joint runs of A and ¬ϕ.
• Using flatness and a ranking argument, one can show that any run of
BA,¬ϕ can be partitioned into ‘active’ and ‘MITL’ segments:
active
MITL
active
MITL active
MITL
active
MITL . . .
• Moreover, the number of active segments is exponentially bounded,
and their total duration is also exponentially bounded.
• The runs of BA,¬ϕ can be simulated by a CAROT C.
• A " ϕ iff C has no accepting computations.
• Corollary: Coflat MTL model checking is EXPSPACE-Complete.
Complexity of MTL Fragments over the Point-Based Semantics
Model Checking
Satisfiability
LTL
PSPACE-Complete
PSPACE-Complete
MITL
EXPSPACE-Complete
EXPSPACE-Complete
BMTL
EXPSPACE-Complete
EXPSPACE-Complete
IMTL
EXPSPACE-Complete
Non-Elem.-Hard
Safety MTL
Non-Prim. Rec.
Non-Elem.-Hard
Coflat MTL
EXPSPACE-Complete
Undecidable
MTL (finite)
Non-Prim. Rec.
Non-Prim. Rec.
MTL
Undecidable
Undecidable
Complexity of MTL Fragments over the Continuous Semantics
Model Checking
Satisfiability
LTL
PSPACE-Complete
PSPACE-Complete
MITL
EXPSPACE-Complete
EXPSPACE-Complete
BMTL
EXPSPACE-Complete
EXPSPACE-Complete
IMTL
EXPSPACE-Complete
Undecidable
Safety MTL
Undecidable
Undecidable
Coflat MTL
EXPSPACE-Complete
Undecidable
MTL (finite)
Undecidable
Undecidable
MTL
Undecidable
Undecidable
Summary and Future Directions
• A fairly broad picture of the complexity of Metric Temporal Logic
and its various fragments.
• Techniques employed reveal surprising connections between various
fragments of MTL and various types of faulty Turing machines.
• Such techniques apply more generally to infinite-state systems
operating on unbounded structured data (with restrictions).
Timing Is Everything!