Computation tree logic

From Wikipedia, the free encyclopedia
Jump to: navigation, search

Computation tree logic (CTL) is a branching-time logic, meaning that its model of time is a tree-like structure in which the future is not determined; there are different paths in the future, any one of which might be an actual path that is realized. It is used in formal verification of software or hardware artifacts, typically by software applications known as model checkers which determine if a given artifact possesses safety or liveness properties. For example, CTL can specify that when some initial condition is satisfied (e.g., all program variables are positive or no cars on a highway straddle two lanes), then all possible executions of a program avoid some undesirable condition (e.g., dividing a number by zero or two cars colliding on a highway). In this example, the safety property could be verified by a model checker that explores all possible transitions out of program states satisfying the initial condition and ensures that all such executions satisfy the property. Computation tree logic is in a class of temporal logics that includes linear temporal logic (LTL). Although there are properties expressible in only one of CTL and LTL, all properties expressible in either logic can also be expressed in CTL*.

Syntax of CTL[edit]

The language of well formed formulas for CTL is generated by the following grammar:

\phi::=\bot |\top |p|(\neg\phi)|(\phi\and\phi)|(\phi\or\phi)|
(\phi\Rightarrow\phi)|(\phi\Leftrightarrow\phi)|\mbox{AX }\phi|\mbox{EX }\phi|\mbox{AF }\phi|\mbox{EF }\phi|\mbox{AG }\phi|\mbox{EG }\phi|
\mbox{A }[\phi \mbox{ U } \phi]|\mbox{E }[\phi \mbox{ U } \phi]

where p ranges over a set of atomic formulas. It is not necessary to use all connectives  – for example, \{\neg, \and, \mbox{AX}, \mbox{AU}, \mbox{EU}\} comprises a complete set of connectives, and the others can be defined using them.

  • \mbox{A} means 'along All paths' (Inevitably)
  • \mbox{E} means 'along at least (there Exists) one path' (possibly)

For example, the following is a well-formed CTL formula:

\mbox{EF }(\mbox{EG } p \Rightarrow \mbox{AF } r )

The following is not a well-formed CTL formula:

\mbox{EF }\big(r \mbox{ U } q\big)

The problem with this string is that U can occur only when paired with an A or an E. It uses atomic propositions as its building blocks to make statements about the states of a system. CTL then combines these propositions into formulas using logical operators and temporal logics.


Logical operators[edit]

The logical operators are the usual ones: \neg,\or,\and,\Rightarrow and \Leftrightarrow. Along with these operators CTL formulas can also make use of the boolean constants true and false.

Temporal operators[edit]

The temporal operators are the following:

  • Quantifiers over paths
    • A \phi – All: \phi has to hold on all paths starting from the current state.
    • E \phi – Exists: there exists at least one path starting from the current state where \phi holds.
  • Path-specific quantifiers
    • X \phi – Next: \phi has to hold at the next state (this operator is sometimes noted N instead of X).
    • G \phi – Globally: \phi has to hold on the entire subsequent path.
    • F \phi – Finally: \phi eventually has to hold (somewhere on the subsequent path).
    • \phi U \psi – Until: \phi has to hold at least until at some position \psi holds. This implies that \psi will be verified in the future.
    • \phi W \psi – Weak until: \phi has to hold until \psi holds. The difference with U is that there is no guarantee that \psi will ever be verified. The W operator is sometimes called "unless".

In CTL*, the temporal operators can be freely mixed. In CTL, the operator must always be grouped in two: one path operator followed by a state operator. See the examples below. CTL* is strictly more expressive than CTL.

Minimal set of operators[edit]

In CTL there is a minimal set of operators. All CTL formulas can be transformed to use only those operators. This is useful in model checking. One minimal set of operators is: {true, \or, \neg, EG, EU, EX}.

Some of the transformation used for temporal operator are:

  • EF\phi == E[trueU(\phi)] ( because F\phi == [trueU(\phi)] )
  • AX\phi == \negEX(\neg\phi)
  • AG\phi == \negEF(\neg\phi) == \neg E[trueU(\neg\phi)]
  • AF\phi == A[trueU\phi] == \negEG(\neg\phi)
  • A[\phiU\psi] == \neg( E[(\neg\psi)U\neg(\phi\or\psi)] \or EG(\neg\psi) )

Semantics of CTL[edit]


CTL formulae are interpreted over Transition Systems. A transition system is a triple \mathcal{M}=(S,\rightarrow,L), where S is a set of states, \rightarrow \subseteq S \times S is a transition relation, assumed to be serial, i.e. every state has at least one successor, and L is a labelling function, assigning propositional letters to states. Let \mathcal{M}=(S,\rightarrow,L) be such a transition model

with s \in S, \phi \in F where F is the set of wffs over the Language of \mathcal{M}.

Then the relation of semantic entailment (\mathcal{M}, s \models \phi) is defined by structural induction on \phi:

  1. \Big( (\mathcal{M}, s) \models \top \Big) \Leftrightarrow \Big( (\mathcal{M}, s) \not\models \bot \Big)
  2. \Big( (\mathcal{M}, s) \models p \Big) \Leftrightarrow \Big( p \in L(s) \Big)
  3. \Big( (\mathcal{M}, s) \models \neg\phi \Big) \Leftrightarrow \Big( (\mathcal{M}, s) \not\models \phi \Big)
  4. \Big( (\mathcal{M}, s) \models \phi_1 \land \phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \models \phi_1 \big) \land \big((\mathcal{M}, s) \models \phi_2 \big) \Big)
  5. \Big( (\mathcal{M}, s) \models \phi_1 \lor \phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \models \phi_1 \big) \lor \big((\mathcal{M}, s) \models \phi_2 \big) \Big)
  6. \Big( (\mathcal{M}, s) \models \phi_1 \Rightarrow \phi_2 \Big) \Leftrightarrow \Big( \big((\mathcal{M}, s) \not\models \phi_1 \big) \lor \big((\mathcal{M}, s) \models \phi_2 \big) \Big)
  7. \bigg( (\mathcal{M}, s) \models \phi_1 \Leftrightarrow \phi_2 \bigg) \Leftrightarrow \bigg( \Big( \big((\mathcal{M}, s) \models \phi_1 \big) \land \big((\mathcal{M}, s) \models \phi_2 \big) \Big) \lor \Big( \neg \big((\mathcal{M}, s) \models \phi_1 \big) \land \neg \big((\mathcal{M}, s) \models \phi_2 \big) \Big) \bigg)
  8. \Big( (\mathcal{M}, s) \models AX\phi \Big) \Leftrightarrow \Big( \forall \langle s \rightarrow s_1 \rangle \big( (\mathcal{M}, s_1) \models \phi \big) \Big)
  9. \Big( (\mathcal{M}, s) \models EX\phi \Big) \Leftrightarrow \Big( \exists \langle s \rightarrow s_1 \rangle \big( (\mathcal{M}, s_1) \models \phi \big) \Big)
  10. \Big( (\mathcal{M}, s) \models AG\phi \Big) \Leftrightarrow \Big( \forall \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \forall i \big( (\mathcal{M}, s_i) \models \phi \big) \Big)
  11. \Big( (\mathcal{M}, s) \models EG\phi \Big) \Leftrightarrow \Big( \exists \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \forall i \big( (\mathcal{M}, s_i) \models \phi \big) \Big)
  12. \Big( (\mathcal{M}, s) \models AF\phi \Big) \Leftrightarrow \Big( \forall \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \exists i \big( (\mathcal{M}, s_i) \models \phi \big) \Big)
  13. \Big( (\mathcal{M}, s) \models EF\phi \Big) \Leftrightarrow \Big( \exists \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \exists i \big( (\mathcal{M}, s_i) \models \phi \big) \Big)
  14. \bigg( (\mathcal{M}, s) \models A[\phi_1 U \phi_2] \bigg) \Leftrightarrow \bigg( \forall \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \exists i \Big( \big( (\mathcal{M}, s_i) \models \phi_2 \big) \land \big( \forall (j < i) (\mathcal{M}, s_j) \models \phi_1 \big) \Big) \bigg)
  15. \bigg( (\mathcal{M}, s) \models E[\phi_1 U \phi_2] \bigg) \Leftrightarrow \bigg( \exists \langle s_1 \rightarrow s_2 \rightarrow \ldots \rangle (s=s_1) \exists i \Big( \big( (\mathcal{M}, s_i) \models \phi_2 \big) \land \big( \forall (j < i) (\mathcal{M}, s_j) \models \phi_1 \big) \Big) \bigg)

Characterisation of CTL[edit]

Rules 10–15 above refer to computation paths in models and are what ultimately characterise the "Computation Tree"; they are assertions about the nature of the infinitely deep computation tree rooted at the given state s.

Semantic equivalences[edit]

The formulae \phi and \psi are said to be semantically equivalent if any state in any model which satisfies one also satisfies the other. This is denoted \phi \equiv \psi

It can be seen that A and E are duals, being universal and existential computation path quantifiers respectively: \neg A\phi \equiv E \neg \phi .

Furthermore so are G and F.

Hence an instance of De Morgan's Laws can be formulated in CTL:

\neg AF\phi \equiv EG\neg\phi
\neg EF\phi \equiv AG\neg\phi
\neg AX\phi \equiv EX\neg\phi

It can be shown using such identities that a subset of the CTL temporal connectives is adequate if it contains EU, at least one of \{AX,EX\} and at least one of \{EG,AF,AU\} and the boolean connectives.

The important equivalences below are called the expansion laws; they allow to unfold the verification of a CTL connective towards its successors in time.

AG\phi \equiv \phi \land AX AG \phi
EG\phi \equiv \phi \land EX EG \phi
AF\phi \equiv \phi \lor AX AF \phi
EF\phi \equiv \phi \lor EX EF \phi
A[\phi U \psi] \equiv \psi \lor (\phi \land AX A [\phi U \psi])
E[\phi U \psi] \equiv \psi \lor (\phi \land EX E [\phi U \psi])


Let "P" mean "I like chocolate" and Q mean "It's warm outside."

  • AG.P
"I will like chocolate from now on, no matter what happens."
  • EF.P
"It's possible I may like chocolate some day, at least for one day."
  • AF.EG.P
"It's always possible (AF) that I will suddenly start liking chocolate for the rest of time." (Note: not just the rest of my life, since my life is finite, while G is infinite).
  • EG.AF.P
"This is a critical time in my life. Depending on what happens next (E), it's possible that for the rest of time (G), there will always be some time in the future (AF) when I will like chocolate. However, if the wrong thing happens next, then all bets are off and there's no guarantee about whether I'll ever like chocolate."

The two following examples show the difference between CTL and CTL*, as they allow for the until operator to not be qualified with any path operator (A or E):

  • AG(PUQ)
"From now until it's warm outside, I will like chocolate every single day. Once it's warm outside, all bets are off as to whether I'll like chocolate anymore. Oh, and it's guaranteed to be warm outside eventually, even if only for a single day."
  • EF((EX.P)U(AG.Q))
"It's possible that: there will eventually come a time when it will be warm forever (AG.Q) and that before that time there will always be some way to get me to like chocolate the next day (EX.P)."

Relations with other logics[edit]

Computation tree logic (CTL) is a subset of CTL* as well as of the modal µ calculus. CTL is also a fragment of Alur, Henzinger and Kupferman's Alternating-time Temporal Logic (ATL).

Computation tree logic (CTL) and Linear temporal logic (LTL) are both a subset of CTL*. CTL and LTL are not equivalent and they have a common subset, which is a proper subset of both CTL and LTL.

  • GF.P exists in LTL but not in CTL.
  • AG(P\Rightarrow((EX.Q)\land(EX¬Q))) and AG.EF.P exist in CTL but not in LTL.

See also[edit]


  • Michael Huth and Mark Ryan (2004). "Logic in Computer Science (Second Edition)". Cambridge University Press: 207. ISBN 0-521-54310-X. 
  • Emerson, E. A. and Halpern, J. Y. (1985). "Decision procedures and expressiveness in the temporal logic of branching time". Journal of Computer and System Sciences 30 (1): 1–24. doi:10.1016/0022-0000(85)90001-7. 
  • Clarke, E. M., Emerson, E. A., and Sistla, A. P. (1986). "Automatic verification of finite-state concurrent systems using temporal logic specifications". ACM Transactions on Programming Languages and Systems 8 (2): 244–263. doi:10.1145/5397.5399. 
  • Emerson, E. A. (1990). "Temporal and modal logic". In Jan van Leeuwen. Handbook of Theoretical Computer Science, vol. B. MIT Press. pp. 955–1072. ISBN 0-262-22039-3. 

External links[edit]