Focus games for satisfiability and completeness of temporal logic

Focus Games for Satisfiability and Completeness of Temporal LogicMartin Lange Colin StirlingLFCS,Division of Informatics,University of Edinburgh,JCMB,King’s Buildings,Edinburgh,EH93JZmartin,cps@AbstractWe introduce a simple game theoretic approach to satisfi-ability checking of temporal logic,for LTL and CTL,whichhas the same complexity as using automata.The mecha-nisms involved are both explicit and transparent,and un-derpin a novel approach to developing complete axiom sys-tems for temporal logic.The axiom systems are naturallyfactored into what happens locally and what happens in thelimit.The completeness proofs utilise the game theoretic construction for satisfiability:if afinite set of formulas isconsistent then there is a winning strategy(and thereforeconstruction of an explicit model is avoided).1IntroductionThe automata theoretic approach to satisfiability check-ing for temporal logic is very popular and successful[6,17]. However there is a cost with the involvement of automatamechanisms and in particular the book keeping implicit inthe product construction,when a local automaton is paired with an eventuality automaton.While this is not an imped-iment for checking satisfiability it appears to be for otherformal tasks such as showing that an axiomatisation of a temporal logic is complete.When proving completeness,one needs to establish that afinite consistent set of formulas is satisfiable.It is not known,in general,how to plug intosuch a proof automata theoretic constructions(such as prod-uct and determinisation)for satisfiability.Instead standard completeness proofs either appeal to“canonical”structuresbuilt from maximal consistent sets[15,8]or tableaux whichexplicitly build models from consistent sets,as illustrated by the delicate proofs of completeness for CTL[14]and modal-calculus[18],and even the proofs of completeness for LTL[7,13](future linear time logic)and CTL[5](com-putation tree logic).In this paper we introduce a simple game theoretic ap-proach to satisfiability checking of temporal logic,for LTL and CTL,which has the same complexity as using au-tomata.The mechanism involved,the use of a“focus”, is both explicit and transparent,and underpins a novel ap-proach to developing complete axiom systems for temporal logic.The axiom systems are naturally factored into what happens locally and what happens in the limit.The com-pleteness proofs use the game theoretic construction for sat-isfiability:if afinite set of formulas is consistent then there is a winning strategy(and therefore construction of an ex-plicit model is avoided).Although the origin of these games is model checking CTL[12],it remains to be seen if the game technique extends to satisfiability checking of CTL and modal-calculus.Moreover,it remains to be seen if the technique is practically viable for testing satisfiability of LTL and CTL.2LTLWe present LTL[7]in positive form,where only atomic formulas are negated.Let be a family of atomic propo-sitions closed under negation,where,and contain-ing the constants(true)and(false).Formulas of LTL are built from using boolean connectives and,the unary temporal operator(next)and the binary temporal connectives(until)and its dual(release).We assume a usual-model for formulas,consisting of an infinite sequence of states which are maximal consistent sets of atomic formulas.A state therefore obeys the con-dition that for any,iff,and and.The semantics inductively defines when an-sequence of states satisfies a formula,written. In the case of,iff is in the initial state of .The clauses for the boolean connectives are as usual.If and then is the th suffix of.The remaining clauses are as follows.We assume that(eventually)abbreviates and its dual(always)abbreviates.The meanings of and are determined by theirfixed point definitions, is the least solution to whereasis the largest solution of.A formula is satisfiable if there is a model such that.In the naive tableau approach to deciding satisfiability,one constructs an“or”decision tree.The root is afinite set of initial formulas,and the decision question is whether their conjunction is satisfiable.Child nodes are produced by local rules on formulas.A node has child.A nodehas two children and.Formulas and are replaced by theirfixed point unfolding,and.After repeated appli-cations of these rules,a node without children has the form,where each.If the set is unsatisfiable then the node is an unsuccessful leaf.If is satisfiable andthen the node is a successful leaf.Otherwise a new childis produced,which amounts to moving to a new state.Nodes with until or release formulas may continually produce children,and therefore one also needs another cri-terion for when a node counts as a leaf.An obvious candi-date is when a node is a repetition,contains the same for-mulas as an earlier node(and in between there is at least one application of the new state rule).Whether or not such a leaf is successful will depend on whether formulas are the result of thefixed point unfolding of a release or an until formula.A repeat of should be successful whereas a repeat of is unsuccessful.Consider the following example decision tree,where set braces are dropped(and and are dispensed with and so the unfolding of is and the unfolding of is).NextNext labels a transition to a new state.Both leaves in this tree are repetitions of the root.However the left leaf should count as successful because the formula at the initial node is“fulfilled”in the left branch,giving the model where.In contrast is not fulfilled in the right branch and is thereby“regenerated”,and therefore the right leaf should count as unsuccesful.The problem of whichfixed points are regenerated dis-appears in the automata theoretic approach to satisfiability [17].Roughly speaking,the decision tree is then only partof the story.It is captured by the“local”automaton and onealso needs to factor in the“eventuality”automaton which automatically deals with regeneration offixed points,andtherefore the problem does not arise.However the cost is the use of the product construction between the two au-tomata.While this is not an impediment for checking satis-fiability it appears to be for other formal tasks such as show-ing that an axiomatisation of a temporal logic is complete.We now show that a simple game theoretic approach tosatisfiability checking,where the mechanisms are both ex-plicit and transparent,has the virtue that it also leads to verysimple proofs of completeness for both LTL and CTL.3Games for LTLIn the naive tableau approach to satisfiability there are“or”choices but there are no“and”choices.Recasting as a game,“or”choices are-choices for the player and“and”choices are-choices for the player.The role of playeris that of verifier,“I want to show that the initial set of for-mulas is satisfiable”whereas the role of is that of refuter,“I want to show that the initial set of formulas is unsatisfi-able”.In a position player chooses the disjunct ,and play continues from the position.The idea is that()has a winning strategy iff the initial set of formu-las is satisfiable(unsatisfiable).We need to force player to make choices.A new com-ponent,the“focus”,is introduced into a set of formulas forthis purpose.One of the formulas in a position is in focus. We write to represent the position when is in focus.Player chooses which formula is in focus.If it is an“and”formula then chooses which subformula to keep in focus.During a play may also change mind,and move the focus to a different formula.Given a starting formula(the conjunction of the ini-tial formulas)we will define its focus game.The set of subformulas of,Sub,is defined as expected but with the requirement that the unfolding of an untilis a subformula of and the un-folding of a release is a subformula of .A position in a play of is an element where and.A play of the game is a sequence of positionswhere is the initial position,and the change in po-sition to is determined by one of the moves of Fig-ure1.They are divided into three groups.First are rules for who chooses disjuncts in and out of focus.Second are the moves for player who chooses which conjunct remains in focus and who also can change focus with the rule change. Finally,there are the remaining moves which do not involvePlayerPlayerOther movesFigure1.Game movesany choices,and so neither player is responsible for them.These include thefixed point unfolding of until and release in and out of focus,the removal of out of focus and the next state rule,next,where the focus remains with the sub-formula of the next formula in focus.It is therefore incum-bent on to make sure that an formula is in focus when next is applied.The next ingredient in the definition of the game is the winning conditions for a player,when a play counts as a win.Definition1Player wins the play if1.is and(is or)or2.is and for some the positionis and between player has not applied the rule change.Therefore wins if there is a simple contradiction or a re-peat position with the same until formula in focus and no application of change between the repeats.Definition2Player wins the play if1.is and is satisfiable or2.is and for some the position isor3.is and for some the position isand between player has applied the rule change.So wins if player is unable to focus on a formula so that next can be applied when the atomic formulas are satisfiable.The other two conditions cover repeat positions. First is the case if the repeat position has the same release formula in focus,and second is the case of a repeat when the same formula is in focus and change has been applied between the repeat positions.The following upper bound on the length of a play is obvious.Fact1Every play of hasfinite length less than.A player wins the game if the player is able to win every play of the game,that is has a winning strategy1.The following is a simple consequence of Fact1and the fact that the winning conditions are mutually exclusive.Fact2Every game has a unique winner.Next we come to the game characterisation of satisfiabil-ity,which we split into two halves.Proposition1If wins the game then is satisfi-able.Proof:Assume wins the game.Consider the play where uses the following optimal strategy.Letbe a priority list of all until subfor-mulas of,in decreasing order of size.We say that is present in a position if either oror.Player starts with the focus on.If the formula in focus is a release formula and contains an until subformula then chooses when the release formula is unfolded.If the formula is a conjunction then chooses a conjunct with an until subformula.If the focus remains on a release for-mula or ends up on a member of then changes focus, if this is possible,to the until formula which is present in the position and which is earliest in the priority list.If the focus is on an until formula then keeps the focus on it until it is“fulfilled”,that is until player chooses when it is unfolded.This until formula is then moved to the end of the priority list.Player then changes focus to the ear-liest until formula in the priority list which is present in the position,if this is possible.This argument is then repeated. By assumption player wins against this strategy,and the play hasfinite length.It is now straightforward to extract an eventually cyclic model from the play,where every until formula present in some position will be fulfilled.Next we prove the converse of Proposition1.One proof is to show how a winning strategy for can be extractedfrom a model of.However we provide an alternative proof which is the key to obtaining a complete axiom sys-tem.We utilise an observation fromfixed point logics about leastfixed points.Given Park’sfixed point induction prin-ciple below and that afixed point is equivalent to its un-folding,Lemma1below holds(as observed by a num-ber of researchers,for instance[10,15,19]).Standard sub-stitution is assumed,is the replacement of all free occurrences of in with.Moreover we write to mean is valid(true everywhere in all models).Lemma1If is not free in and is satisfiable then the formula is satisfiable. Proof:Suppose is satisfiable,but.Therefore.Hence byand so bywhich contradicts that is satis-fiable.Lemma1sanctions the following property of until un-folding.Lemma2If is satisfiable thenis satisfiable.Proof:Assume is satisfiable.So there is a model such that and,and therefore and for,for some. Also assume is not satisfiable,and so the following validity holds.Because therefore. So and because it follows that.And so,and therefore.And so and.If then by the valid formula above,and soand because it follows that,and so.The argument is now repeated for subsequent,,which contradicts that .Proposition2If is satisfiable then player wins the game.Proof:Assume that is satisfiable.We show that player wins the game.The idea is that al-ways chooses a move which preserves satisfiability(and has to choose moves which preserve satisfiability).Ifis satisfiable then is satisfiable for at least one,and so player chooses such an.If the position is where the until for-mula is in focus then player adorns the interpretation of it when it is unfolded,where and are to be understood asand.This adornment,which is justified by Lemma2,is repeated as long as the until formula is in fo-cus.Whenever changes mind,an adorned until subfor-mula loses its adornment and is returned to its intended interpretation.Now it is easy to see that can never win.Condition1of the win-ning condition for can not be reached because preserves satisfiability.And condition2,the repeat position,cannot occur because.Proposition3The complexity of deciding the winner of is in PSPACE.Proof:Consider the tree of all plays in where the position of the focus is completely determined by the strat-egy described in the proof of Proposition1,above.Player wins iff there exists a path in this tree such that wins the play of this path.An algorithm P can nondetermin-istically choose this path.The required space is polynomial in the size of the input.P only has to store a counter and two configurations:the actual one which gets overwritten every time a new game rule is applied,and the one which is repeated in case wins the play with her winning condition 2or3.The latter can be chosen nondeterministically,too, and gets deleted every time the rule change is applied.The counter is needed to terminate the algorithm if it did notfind a repeat after configurations.Notice that the size of the counter also is polynomial in the length of the input.Hence by Savitch’s Theorem the problem can be solved in PSPACE.4A complete axiomatisation for LTLThe game theoretic characterisation of satisfiability of-fers a simple basis for extracting a complete axiom sys-tem for LTL.Given an axiom system a formula is-consistent if.The axiom system is complete provided that for any if is-consistent then has a model.In this framework this becomes(*)if is-consistent then wins the game. The axiom system for LTL is presented in Figure2.The axioms and rules were developed with the proof of in mind.Axioms1-6and the rules MP and XGen provide“lo-cal”justifications for the rules of the focus game for LTL, and axiom7and the rule Rel capture’s winning strategy. Theorem1The axiom system is sound and complete for LTL.Axioms1.any tautology instance2.3.4.5.6.7.RulesMP if and thenXGen if thenRel ifthenFigure2.The axiom systemProof:Soundness of is straightforward.Each axiom is valid and each rule preserves validity.The interesting case is the rule Rel,whose soundness was proved in lemma2 of the previous section.For completeness of we es-tablish,if is-consistent then wins the game.The proof is similar to Proposition2of the pre-vious section.Given afinite-consistent set of LTL for-mulas we show that any player move or other move in Figure1preserves-consistency,and that player can pre-serve-consistency when she moves.If is -consistent then is-consistent for some by ax-iom1,and the rule MP.Axioms2and3are needed for the fixed point unfolding moves.Axioms4-6and rule XGen are required for the next move.If is not-consistent then and sousing XGen and axioms,and one half of.Finally rule Rel is used to capture’s winning strategy.If the position isand is-consistent then by rule Rel,the other half of axiom4and axiom7is-consistent.In[7]soundness and completeness of the following ax-iom system for LTL is proved using maximal consis-tent sets of formulas2.The game rules used are the unfolding of,the adorned unfolding of,the disjunctive choice and the next rule. Player wins with winning condition2.Therefore the ax-ioms and rules needed to prove A5are1and MP(for), 2and3(for the unfoldings),4–6,XGen(for next),7(to reason about the negation of A5),and Rel to describe the winning condition.5CTLIn this section we define focus games for CTL.Again we present CTL in positive form.Formulas of CTL are built from,the boolean connectives and,the two unary temporal operators and the four binary temporal op-erators,where.is the“some paths”quantifier and is the“for all paths”quantifier.A Kripke model for CTL formulas consists of a set of states,a binary transition relation which is total(for all there is a such that)and a valuation which assigns to each state a maximal consistent set of atomic formulas in.The semantics defines when a state satisfies a formula,,and it appeals to full paths from a state which is an-sequence of states such that for each.In the case of ,iff belongs to the valuation of.The clauses for the boolean connectives are as usual.The remaining clauses are as follows.The semantics of until and release formulas are determined by theirfixed point definitions.is the least solu-tion to and is the largest solution to.We now define the focus game for a CTL for-mula.As with the LTL game,a position in a play of is an element where and,and a play is a sequence of posi-tions where is the initial position.The change in position to is determined by one of the moves of Figure3.Again they are divided into three groups. First are rules for who chooses disjuncts in and out of focus.Second are the moves for player who chooses which conjunct remains in focus and who also can change focus with the rule change.Player also chooses the next state when an formula is in focus,by choosing a sin-gle,if there is one:we include here the case where and does not have any choice.Finally,there are the remaining moves which do not involve any choices,and so neither player is responsible for them.These include the fixed point unfolding of until and release in and out of fo-cus,the removal of out of focus and the next state rule Player Playerwhen an formula is in focus.The winning conditions for a player are almost identical to the LTL game.Definition1Player wins the play if1.is and(is or)or2.is and for some the positionis and between player has not applied the rule change.Definition2Player wins the play if1.is and is satisfiable or2.is and for some the positionis or3.is and for some the position isand between player has applied the rule change.Facts1and2of Section3also hold for CTL games.A main result is again the game characterisation of satisfiabil-ity.Proposition1wins the game iff is satisfiable.Proof:Assume wins the game.The proof is similar to that of Proposition1of Section3,ex-cept that all“next”state choices are examined,and so we have a tree of plays instead of a single play.Letbe an initial priority list of all until subformulas of in order of decreasing size.Each play in the tree of plays has its own associated current prior-ity list.Player starts with the focus on.Once the focus is on an until formula,,player keeps the fo-cus on it until it is fulfilled(player chooses)or there is branching.At an application of next a play splits into all choices,each with its own priority list.If the focus is on a formula then it will be on in all these plays and they each have the same priority list.If the position isand is the current priority list then the focus remains on in the play with this subformula with list.Otherwise for each there is the play where changes focus for the posi-tion.If is then this formula is moved to the end of the priority list and chooses as focus the earliest until formula in present in the position,if this is possible.This argu-ment is repeated.By assumption player wins thefinite tree of plays.It is now straightforward to read off a Kripke model from this tree of plays where is true at the initial state.For the converse assume that is satisfiable.We show that has a winning strategy for the game.We usethe fact that for each if is satisfi-able then is sat-isfiable.So the interpretation of can be adorned whenever it is unfolded in focus as with Proposition2of Section3.One important difference with LTL is the complexity of checking the winner of a game,because of branch-ing choices for.Proposition2The complexity of deciding the winner of is in EXPTIME.Proof:The proof is very similar to that of Proposition3of Section3.However,the tree of all plays is now an and-or tree because of player’s choices using rule next.There-fore the polynomial space algorithm deciding the winner of is alternating instead of nondeterministic.By[3] the problem is therefore in EXPTIME.6A complete axiomatisation for CTLThe game theoretic characterisation of CTL satisfiabil-ity also allows one to extract a sound and complete axiom system for CTL,the system in Figure4.Theorem1The axiom system is sound and complete for CTL.Proof:Soundness of is straightforward.The most in-teresting cases are soundness of ARel and ERel rules,and in the case of ERel the rule captures“limit closure”.For completeness of,the proof is similar to Theorem1of Section4.If is-consistent then player wins the game.Given afinite-consistent set of formu-las,any move by player or other move in Figure1pre-serves-consistency.The important cases are the next state rules.Assume is not-consistent,and so.So by AXGen and axioms, and(and using instead of one deals with the case when).Finally the ARel and ERel rules are used to capture’s winning strategy.In[5]soundness and completeness of the following ax-iom system for CTL is proved using tableaux.Ax1.any tautology instanceAx2.Ax3.Ax4.Ax5.Ax6.Axioms1.any tautology instance2.3.4.5.6.7.8.9.10.11.RulesMP if and thenAXGen if thenERel ifthenARel ifthenFigure4.The axiom system Ax7.Ax8.R1.if thenR2.if thenR3.ifthenR4.if and thenThe same arguments for comparing the two LTL axioma-tisations also hold for the two axiomatisations of CTL.Ax1,Ax5–Ax7,and R4are already present in.Ax2and Ax3 are covered by the abbreviation of.Ax4can be proved bya combination of6–9,1and MP.1,AXGen,7,MP and6establish Ax8.Rule R1is simulated using AXGen,9,MP, 7and the hypothesis of having a shorter proof of in .R2is simulated in the following way.Suppose there is a -proof of.Then,by4,1,and MP there is also a proof offor ing ERel yields a proof of. Simulating R3is similar.7ConclusionWe have introduced a game theoretic approach to satis-fiability checking of LTL and CTL.It remains to be seen if focus games extend to richer logics such as CTL and modal-calculus.In[12]it was shown that focus games can also be used to solve the model checking problem for CTL.The game trees arising there are very similar to the tableau structures used in[2,1].However,in order to tackle the problem of deciding whetherfixed point constructs are regenerated or reproduced these authors pursue a different strategy.Take the unfolding of for example.While the focus highlights the case that player always chooses the term in which occurs again,a path in the tableaux of[2]is successful if never occurs after.The dif-ference seems to be a point of view only.In the focus games it is checked whether afixed point construct is regenerated, therefore it is never fulfilled.In the tableau approach it is checked whether it is never fulfilled,therefore it is regener-ated.In[1]the authors define Tableau B¨u chi Automata which are essentially the same as the tableaux of[2].As with the focus games,this enables the authors to handle the regener-ation problem offixed points implicitly.Instead of explic-itly requiring tableaux to be processed with a depth-first-search,the solution to the regeneration problem is encoded in an acceptance condition,which is in that case a gener-alised B¨u chi condition.However,this small difference is the key to the strengthening lemma(Lemma1of Section3)which underpins the proofs of completeness of the axioma-tisations.A more recent automata theoretic approach to satisfi-ability and model checking employs alternating automata [16,11].Although these appear to be very game theoretic, they rely upon automata over trees which capture the“and”branching,both in the case of the boolean“and”and in the case for CTL of branching through next states.In both cases of LTL and CTL formulas are states of the automata, and transitions are determined by maximal consistent sets of atomic propositions.The acceptance conditions decide acceptablefixed point regeneration.It is not clear if this ap-proach can underpin sound and complete axiomatisations. References[1]Bhat,G.,and Cleaveland,R.(1996).Efficient modelchecking via the equational-calculus.Proc.11thAnnual IEEE Symp.on Logic in Computer Science,LICS’96,304-312.[2]Bhat,G.,Cleaveland,R.,and Grumberg,O.(1995).Efficient on-the-fly model checking for CTL.Proc.10th Annual IEEE Symp.on Logic in Computer Sci-ence,LICS’95,388-397.[3]Chandra,A.,Kozen,D.and Stockmeyer,L.(1981).Alternation.Journal of ACM,28,114-133.[4]Clark,E.,Emerson,E.,and Sistla,P.(1986).Auto-matic verification offinite state concurrent systemsusing temporal logic.ACM Trans.on ProgrammingLanguages and Systems,8,244-263.[5]Emerson,E.,and Halpern,J.(1985).Decision pro-cedures and expressiveness in the temporal logic ofbranching time.Journal of Comput.System Sci.,30,1-24.[6]Emerson,E.,and Jutla,C.(1988).The complex-ity of tree automata and logics of programs.Procs.29th IEEE Symp.on Foundations of Comput.Sci-ence,328-337.[7]Gabbay,D.,Pnueli,A.,Shelah,S.,and Stavi,J.(1980).The temporal analysis of fairness.Procs.7th ACM Symp.on Principles of Programming Lan-guages,163-173.[8]Goldblatt,R.(1992).Logics of Time and Computa-tion,CSLI Lecture Notes No.7.[9]Hodges,W.(1993).Model Theory,Cambridge Uni-versity Press.[10]Kozen, D.(1983).Results on propositional mu-calculus.Theoretical Computer Science,27,333-354.[11]Kupferman,O.,Vardi,M.,and Wolper,P.(2000).An automata-theoretic approach to branching-time model checking.Journal of ACM,47,312-360. [12]Lange,M.,and Stirling,C.(2000).Model checkinggames for CTL.Proc.Int.Conf.on Temporal Logic, ICTL’2000.[13]Lichtenstein,O.,and Pnueli, A.(2000).Proposi-tional temporal logics:decidability and complete-ness.Logic Journal of the IGPL,8,55-85.[14]Reynolds,M.(2000).An axiomatisation of full com-putation tree logic.To appear Journal of Symbolic Logic.[15]Stirling,C.(1992).Modal and temporal logics.InHandbook of Logic in Computer Science,V ol2,Ox-ford University Press,477-563.[16]Vardi,M.(1996).An automata-theoretic approach tolinear temporal logic.Lecture Notes in Computer Sci-ence,1043,238-266.[17]Vardi,M.,and Wolper P.(1994).Reasoning aboutinfinite rmation and Computation, 115,1-37.[18]Walukiewicz,I.(2000).Completeness of Kozen’s ax-iomatisation of the propositional r-mation and Computation,157,142-182.[19]Winskel,G.(1991).A note on model checking themodal nu-calculus,Theoretical Computer Science, 83,157-167.。