Checking interval properties of computations

Abstract

Model checking is a powerful method widely explored in formal verification. Given a model of a system, e.g., a Kripke structure, and a formula specifying its expected behaviour, one can verify whether the system meets the behaviour by checking the formula against the model. Classically, system behaviour is expressed by a formula of a temporal logic, such as LTL and the like. These logics are “point-wise” interpreted, as they describe how the system evolves state-by-state. However, there are relevant properties, such as those constraining the temporal relations between pairs of temporally extended events or involving temporal aggregations, which are inherently “interval-based”, and thus asking for an interval temporal logic. In this paper, we give a formalization of the model checking problem in an interval logic setting. First, we provide an interpretation of formulas of Halpern and Shoham’s interval temporal logic HS over finite Kripke structures, which allows one to check interval properties of computations. Then, we prove that the model checking problem for HS against finite Kripke structures is decidable by a suitable small model theorem, and we provide a lower bound to its computational complexity.

Appendix

Proof of Lemma 1.

Proof

The proof is by induction on $n\ge 0$. Let $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}'_{{\textit{BE}}_k}$ be the ${\textit{BE}}_k$-descriptors for $\rho$ and $\rho '$, respectively.

Base case ($n=0$). Since $\mathcal {K},\rho \models p\iff \mathcal {K},\rho '\models p$, for any $p\in \mathcal {AP}$, the roots of $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}_{{\textit{BE}}_k}'$ are labelled by the same set of proposition letters and the descriptors are corresponding up to depth 0.

Inductive step ($n \ge 1$). We preliminarily show that if $\mathcal {K}, \rho \models \varphi \iff \mathcal {K}, \rho ' \models \varphi$ for all HS formulas $\varphi$ with ${{\mathrm{Nest_{BE}}}}(\varphi ) \le k$ and ${{\mathrm{Nest}}}(\varphi )\le n$, then for any track $\overline{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho })={{\mathrm{lst}}}(\rho )$, there is a track $\overline{\rho }'\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho }')={{\mathrm{lst}}}(\rho ')$, such that, for all HS formulas $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k$, $\mathcal {K},\overline{\rho }\models \psi \iff \mathcal {K},\overline{\rho }'\models \psi$. The proof is by contradiction. Suppose that there exists a track $\overline{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho })={{\mathrm{lst}}}(\rho )$, such that, for all tracks $\overline{\rho }'\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho }')={{\mathrm{lst}}}(\rho ')$, there exists a formula $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k$, such that $\mathcal {K},\overline{\rho }\models \psi$ and $\mathcal {K},\overline{\rho }'\not \models \psi$. Let H be the set of those tracks $\hat{\rho }$ such that ${{\mathrm{fst}}}(\hat{\rho })={{\mathrm{lst}}}(\rho ')$. H can be partitioned into a finite number of classes, say $s \ge 1$, each one containing k-descriptor equivalent tracks of H (remind that k-descriptor equivalence is an equivalence relation of finite index). Now, let $\{\overline{\rho }'_1,\overline{\rho }'_2,\ldots , \overline{\rho }'_s\}$ be a set of track representatives, chosen one for each equivalence class induced by $\sim _k$ on H (for all $1\le \ i<j\le s$, $\overline{\rho }'_i$ and $\overline{\rho }'_j$ have distinct ${\textit{BE}}_k$-descriptors). By Theorem 1, tracks which are k-descriptor equivalent satisfy the same set of formulas $\psi '$, with ${{\mathrm{Nest_{BE}}}}(\psi ')\le k$. So there are formulas $\psi _1, \ldots ,\psi _s$ such that, for all $1 \le i \le s$, ${{\mathrm{Nest}}}(\psi _i)\le n-1$, ${{\mathrm{Nest_{BE}}}}(\psi _i)\le k$, $\mathcal {K},\overline{\rho }\models \psi _i$, and $\mathcal {K},\overline{\rho }'_i\not \models \psi _i$. It easily follows that $\mathcal {K},\overline{\rho }\models \psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s$ and, for all $1 \le i \le s$, $\mathcal {K},\overline{\rho }'_i\models \lnot \psi _1\vee \lnot \psi _2\vee \cdots \vee \lnot \psi _s$. Hence, $\mathcal {K},\rho \models {{\mathrm{\langle A\rangle }}}(\psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s)$ and $\mathcal {K},\rho '\models [A](\lnot \psi _1\vee \lnot \psi _2\vee \cdots \vee \lnot \psi _s)$, that is, $\mathcal {K},\rho '\not \models {{\mathrm{\langle A\rangle }}}(\psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s)$, which is a contradiction.

Thus, we have proved that for any track $\overline{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho })={{\mathrm{lst}}}(\rho )$, there exists a track $\overline{\rho }'\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho }')={{\mathrm{lst}}}(\rho ')$, such that, for all HS formulas $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k$, $\mathcal {K},\overline{\rho }\models \psi \iff \mathcal {K},\overline{\rho }'\models \psi$. By the inductive hypothesis, $\overline{\rho }$ and $\overline{\rho }'$ are associated with corresponding ${\textit{BE}}_k$-descriptors up to depth $n-1$. Symmetrically, we can show that for any track $\overline{\rho }'\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho }')={{\mathrm{lst}}}(\rho ')$, there exists $\overline{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho })={{\mathrm{lst}}}(\rho )$, such that $\overline{\rho }'$ and $\overline{\rho }$ are associated with corresponding ${\textit{BE}}_k$-descriptors up to depth $n-1$. In this way, we have proved the condition for modality A of Definition of 17. The conditions for modalities $\overline{A}$, $\overline{B}$, and $\overline{E}$ can be proved in a very similar way. In particular, as a consequence of the fact that $\mathcal {K}, \rho \models \varphi \iff \mathcal {K}, \rho ' \models \varphi$ for all HS formulas $\varphi$ with ${{\mathrm{Nest_{BE}}}}(\varphi ) \le k$ and ${{\mathrm{Nest}}}(\varphi )\le n$, with $n\ge 1$, it holds that $\mathcal {K},\rho \models {{\mathrm{\langle \overline{A}\rangle }}}\top \iff \mathcal {K},\rho '\models {{\mathrm{\langle \overline{A}\rangle }}}\top$. It follows that $\mathcal {D}_{{\textit{BE}}_k}$ has an $\overline{A}$-successor if and only if $\mathcal {D}'_{{\textit{BE}}_k}$ has one. The same holds for $\overline{E}$-successors.

Let us now consider the condition for modality B of Definition of 17.

First of all, we show that for any track $\overline{\rho }\in {{\mathrm{Pref}}}(\rho )$, there exists a track $\overline{\rho }'\in {{\mathrm{Pref}}}(\rho ')$ such that for all HS formulas $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k-1$, $\mathcal {K},\overline{\rho }\models \psi \iff \mathcal {K},\overline{\rho }'\models \psi$. The proof is again by contradiction. Suppose that there exists a track $\overline{\rho }\in {{\mathrm{Pref}}}(\rho )$ such that, for all tracks $\overline{\rho }'\in {{\mathrm{Pref}}}(\rho ')$, there exists a formula $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k-1$, such that $\mathcal {K},\overline{\rho }\models \psi$ and $\mathcal {K},\overline{\rho }'\not \models \psi$. Now, let us consider the tracks $\overline{\rho }'_1,\overline{\rho }'_2,\ldots , \overline{\rho }'_s$ (for some $s\in \mathbb {N}$) which are prefixes of $\rho '$ and are associated with distinct subtrees of depth $k-1$ of the ${\textit{BE}}_k$-descriptor for $\rho '$ (the number of these tracks is obviously finite). So there are formulas $\psi _1, \ldots ,\psi _s$ such that, for all $1 \le i \le s$, ${{\mathrm{Nest}}}(\psi _i)\le n-1$, ${{\mathrm{Nest_{BE}}}}(\psi _i)\le k-1$, $\mathcal {K},\overline{\rho }\models \psi _i$, and $\mathcal {K},\overline{\rho }'_i\not \models \psi _i$. Thus, $\mathcal {K},\overline{\rho }\models \psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s$ and for all i, $\mathcal {K},\overline{\rho }'_i\models \lnot \psi _1\vee \lnot \psi _2\vee \cdots \vee \lnot \psi _s$.

Hence $\mathcal {K},\rho \models {{\mathrm{\langle B\rangle }}}(\psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s)$ and $\mathcal {K},\rho '\models [B](\lnot \psi _1\vee \lnot \psi _2\vee \cdots \vee \lnot \psi _s)$, that is $\mathcal {K},\rho '\not \models {{\mathrm{\langle B\rangle }}}(\psi _1\wedge \psi _2\wedge \cdots \wedge \psi _s)$, which leads to a contradiction.

We have proved that for any track $\overline{\rho }\in {{\mathrm{Pref}}}(\rho )$, there exists a track $\overline{\rho }'\in {{\mathrm{Pref}}}(\rho ')$ such that, for all HS formulas $\psi$, with ${{\mathrm{Nest}}}(\psi )\le n-1$ and ${{\mathrm{Nest_{BE}}}}(\psi )\le k-1$, $\mathcal {K},\overline{\rho }\models \psi \iff \mathcal {K},\overline{\rho }'\models \psi$. By the inductive hypothesis, $\overline{\rho }$ and $\overline{\rho }'$ are associated with corresponding ${\textit{BE}}_{k-1}$-descriptors up to depth $n-1$. Symmetrically, we can show that for any track $\overline{\rho }'\in {{\mathrm{Pref}}}(\rho ')$, there exists a track $\overline{\rho }\in {{\mathrm{Pref}}}(\rho )$ such that $\overline{\rho }'$ and $\overline{\rho }$ are associated with corresponding ${\textit{BE}}_{k-1}$-descriptors up to depth $n-1$.

In this way, we have proved the condition for modality B of Definition of 17. The condition for modality E can be proved in a symmetrical way. $\square$

Proof of Lemma 2.

Proof

The proof is by induction on $n\ge 0$.

Base case ($n = 0$). Consider the descriptors $\mathcal {D}_{{\textit{BE}}_k}$, $\mathcal {D}_{{\textit{BE}}_k}'$, $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$, and $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$. Since the roots of $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}_{{\textit{BE}}_k}'$ are labelled by the same set of proposition letters, the roots of $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$ and $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$ are labelled by the same set of proposition letters as well.

Inductive step ($n>0$). Let $\rho ,\rho '\in {{\mathrm{Trk}}}_\mathcal {K}$ be two witnesses for $\mathcal {D}_{{\textit{BE}}_k}$ and for $\mathcal {D}_{{\textit{BE}}_k}'$, respectively (and thus for $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$ and and $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$, respectively). Consider a track $\tilde{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\tilde{\rho })={{\mathrm{lst}}}(\rho )$. The ${\textit{BE}}_k$-descriptor $\tilde{\mathcal {D}_{{\textit{BE}}_k}}$ for $\tilde{\rho }$ is an A-successor of $\mathcal {D}_{{\textit{BE}}_k}$, and $\tilde{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ is an A-successor of $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$. Since $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}_{{\textit{BE}}_k}'$ are corresponding up to depth n, there exists a track $\overline{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$, with ${{\mathrm{fst}}}(\overline{\rho })={{\mathrm{lst}}}(\rho ')$, described by $\overline{\mathcal {D}_{{\textit{BE}}_k}}$, such that $\tilde{\mathcal {D}_{{\textit{BE}}_k}}$ and $\overline{\mathcal {D}_{{\textit{BE}}_k}}$ are corresponding up to depth $n-1$. By the inductive hypothesis, $\tilde{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ and $\overline{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ are corresponding up to depth $n-1$ (and, obviously, $\overline{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ is an A-successor of $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$).

Let us consider now a track $\hat{\rho }$, with $({{\mathrm{lst}}}(\rho ),{{\mathrm{fst}}}(\hat{\rho }))\in \delta$ and $\rho \cdot \hat{\rho }\in {{\mathrm{Trk}}}_\mathcal {K}$. The ${\textit{BE}}_k$-descriptor $\hat{\mathcal {D}_{{\textit{BE}}_k}}$ of $\rho \cdot \hat{\rho }$ is a $\overline{B}$-successor of $\mathcal {D}_{{\textit{BE}}_k}$ and $\hat{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ is a $\overline{B}$-successor of $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$. Since $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}_{{\textit{BE}}_k}'$ are corresponding up to depth n, there exists a track $\check{\rho }$ such that $({{\mathrm{lst}}}(\rho '),{{\mathrm{fst}}}(\check{\rho }))\in \delta$, $\rho '\cdot \check{\rho }$ is described by $\check{\mathcal {D}_{{\textit{BE}}_k}}$, and $\hat{\mathcal {D}_{{\textit{BE}}_k}}$ and $\check{\mathcal {D}_{{\textit{BE}}_k}}$ are corresponding up to depth $n-1$. By the inductive hypothesis, $\hat{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ and $\check{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ are corresponding up to depth $n-1$ (and, obviously, $\check{\mathcal {D}_{{\textit{BE}}_k}}|_{k-1}$ is a $\overline{B}$-successor of $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$).

Finally (only for cases with $k\ge 2$), let us consider a subtree of depth $k-2$ linked to the root of $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$ via a B-edge. In this case, there exists (at least) a subtree of $\mathcal {D}_{{\textit{BE}}_k}$, say $\mathcal {S}_{k-1}$, such that $\mathcal {S}_{k-1}|_{k-2}$ is the considered subtree of $\mathcal {D}_{{\textit{BE}}_k}|_{k-1}$. Since $\mathcal {D}_{{\textit{BE}}_k}$ and $\mathcal {D}_{{\textit{BE}}_k}'$ are corresponding up to depth n, there exists a subtree $\mathcal {S}'_{k-1}$ of $\mathcal {D}_{{\textit{BE}}_k}'$, connected to the root of $\mathcal {D}_{{\textit{BE}}_k}'$ via a B-edge, corresponding to $\mathcal {S}_{k-1}$ up to depth $n-1$. By the inductive hypothesis $\mathcal {S}_{k-1}|_{k-2}$ and $\mathcal {S}'_{k-1}|_{k-2}$ are corresponding up to depth $n-1$ (the latter is a subtree of $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$ connected to the root of $\mathcal {D}_{{\textit{BE}}_k}'|_{k-1}$ via a B-edge).

The remaining cases can be dealt with analogously. $\square$