Computation tree logic

Computation tree logic is a branching-time logic, meaning that its model of time is a tree-like structure in which the future is not determined; there are different paths in the future, any one of which might be an actual path that is realized. It is used in formal verification of software or hardware artifacts, typically by software applications known as model checkers, which determine if a given artifact possesses safety or liveness properties. For example, CTL can specify that when some initial condition is satisfied, then all possible executions of a program avoid some undesirable condition. In this example, the safety property could be verified by a model checker that explores all possible transitions out of program states satisfying the initial condition and ensures that all such executions satisfy the property. Computation tree logic belongs to a class of temporal logics that includes linear temporal logic . Although there are properties expressible only in CTL and properties expressible only in LTL, all properties expressible in either logic can also be expressed in CTL*.

History

CTL was first proposed by Edmund M. Clarke and E. Allen Emerson in 1981, who used it to synthesize so-called synchronisation skeletons, i.e abstractions of concurrent programs.
Since the introduction of CTL, there has been debate about the relative merits of CTL and LTL. Because CTL is more computationally efficient to model check, it has become more common in industrial use, and many of the most successful model-checking tools use CTL as a specification language.

Syntax of CTL

The language of well-formed formulas for CTL is generated by the following grammar:
where ranges over a set of atomic formulas. It is not necessary to use all connectives - for example,
comprises a complete set of connectives, and the others can be defined using them.

means 'along All paths' '
means 'along at least one path' '

For example, the following is a well-formed CTL formula:
The following is not a well-formed CTL formula:
The problem with this string is that can occur only when paired with an or an.
CTL uses atomic propositions as its building blocks to make statements about the states of a system. These propositions are then combined into formulas using logical operators and temporal operators.

Operators

Logical operators

The logical operators are the usual ones: ¬, ∨, ∧, ⇒ and ⇔. Along with these operators CTL formulas can also make use of the Boolean constants true and false.

Temporal operators

The temporal operators are the following:

Quantifiers over paths
*A Φ - All: Φ has to hold on all paths starting from the current state.
*E Φ - Exists: there exists at least one path starting from the current state where Φ holds.
Path-specific quantifiers
*X φ - Next: φ has to hold at the next state.
*G φ - Globally: φ has to hold on the entire subsequent path.
*F φ - Finally: φ eventually has to hold.
*φ U ψ - Until: φ has to hold at least until at some position ψ holds. This implies that ψ will be verified in the future.
*φ W ψ - Weak until: φ has to hold until ψ holds. The difference with U is that there is no guarantee that ψ will ever be verified. The W operator is sometimes called "unless".

In CTL*, the temporal operators can be freely mixed. In CTL, operators must always be grouped in pairs: one path operator followed by a state operator. See the examples below. CTL* is strictly more expressive than CTL.

Minimal set of operators

In CTL there are minimal sets of operators. All CTL formulas can be transformed to use only those operators. This is useful in model checking. One minimal set of operators is:.
Some of the transformations used for temporal operators are:

EFφ E'
AXφ ¬EX
AGφ ¬EF ¬ E
AFφ A' ¬EG
A ¬U¬] ∨ '''EG'''

Semantics of CTL

Definition

CTL formulae are interpreted over transition systems. A transition system is a triple, where is a set of states, is a transition relation, assumed to be serial, i.e. every state has at least one successor, and is a labelling function, assigning propositional letters to states. Let be such a transition model, with, and, where is the set of well-formed formulas over the language of.
Then the relation of semantic entailment is defined recursively on :

Characterisation of CTL

Rules 10-15 above refer to computation paths in models and are what ultimately characterise the "Computation Tree";
they are assertions about the nature of the infinitely deep computation tree rooted at the given state.

Semantic equivalences

The formulae and are said to be semantically equivalent if any state in any model that satisfies one also satisfies the other.
This is denoted
It can be seen that and are duals, being universal and existential computation path quantifiers respectively:
Furthermore, so are and.
Hence an instance of De Morgan's laws can be formulated in CTL:
It can be shown using such identities that a subset of the CTL temporal connectives is adequate if it contains, at least one of and at least one of and the Boolean connectives.
The important equivalences below are called the expansion laws; they allow unfolding the verification of a CTL connective towards its successors in time.

Examples

Let "P" mean "I like chocolate" and Q mean "It's warm outside."

AG.P
EF.P
AF.'EG.P
EG.AF.P

The two following examples show the difference between CTL and CTL*, as they allow for the until operator to not be qualified with any path operator :

EFU')

Relations with other logics

Computation tree logic is a subset of CTL* as well as of the modal μ calculus. CTL is also a fragment of Alur, Henzinger and Kupferman's alternating-time temporal logic.
Computation tree logic and linear temporal logic are both a subset of CTL*. CTL and LTL are not equivalent and they have a common subset, which is a proper subset of both CTL and LTL.

FG.P exists in LTL but not in CTL.
AG∧)) and AG.EF.P exist in CTL but not in LTL.

Extensions

CTL has been extended with second-order quantification and to quantified computational tree logic. There are two semantics:

the tree semantics. We label nodes of the computation tree. QCTL* = QCTL = MSO over trees. Model checking and satisfiability are tower complete.
the structure semantics. We label states. QCTL* = QCTL = MSO over graphs. Model checking is PSPACE-complete but satisfiability is undecidable.

A reduction from the model-checking problem of QCTL with the structure semantics, to TQBF has been proposed, in order to take advantage of the QBF solvers.