Track 2: (Logic, Semantics, Specification and Verification) Title: Truncating Regular Expressions. Authors: 1. Cindy Eisner (contact author)

Transcription

1 Track : (Logic, Semantics, Specification and Verification Title: Truncating Regular Expressions Authors: 1. Cindy Eisner (contact author IBM Haifa Research Laboratory Haifa University Campus Mount Carmel, Haifa 31905, ISRAEL phone: fax: eisner@il.ibm.com. Dana Fisman IBM Haifa Research Laboratory and Weizmann Institute of Science Rehovot, ISRAEL 3. John Havlicek Motorola, Inc. Austin, TX, USA 4. Johan Mårtensson Safelogic Göteborg, SWEDEN Keywords: temporal logic, finite path, truncated path, abort operator, regular expression, extended regular expression, logical contradiction, structural contradiction March 31, 004 Abstract. In previous work [6] we have shown that in order for temporal logic to be useful in incomplete verification methods such as simulation or bounded model checking, it is necessary to define semantics over truncated paths. A truncated path is a path which is finite, but not necessarily maximal. In this paper we examine the problem of expanding the previous work on LTL to a temporal logic augmented with regular expressions. Such extensions, adopted in emerging standards, are motivated by the desire to increase the expressive power as well as allow easy formulation of properties. Using the notion of structural contradictions and basic theorems on the semantics of [6], we argue that the trivial solution is not a good one, and we present an alternative more in keeping with the spirit of [6].

2 1 1 Introduction The truncated semantics of [6] gives semantics to formulas of LTL [1] on truncated paths. A truncated path is a path that is finite, but not necessarily maximal. For instance, a path examined by a simulation tool, or by bounded model checking, is a truncated path. A path can also be truncated by a hardware reset because a reset can be thought of as cutting a path into two disjoint parts a finite, truncated part up until the reset and a possibly infinite, maximal part after the reset. In this paper, we expand the idea of truncation to temporal logics containing regular expressions. Methods of reasoning about finite maximal paths are insufficient for reasoning about truncated paths. When considering a truncated path, the user might want to reason about properties of the truncation as well as properties of the model. For instance, the user might want to specify that a simulation test goes on long enough to discharge all outstanding obligations, or, on the other hand, that an obligation need not be met if it is the fault of the test (that is, if the test is too short. The former approach is useful for a test designed (either manually or by other means to continue until correct output can be confirmed. The latter approach is useful for a test which has no opinion on the correct length of a test - for instance, a monitor running concurrently with the main test to check for bus protocol errors. In such a situation, we need to define the semantics over a truncated path. In other words, at the end of the truncated path, the truth value must be decided. If the path was truncated after the evaluation of the formula completed, the truth value is already determined. The problem is to decide the truth value if the path was truncated before the evaluation of the formula completed, i.e., where there is doubt regarding what would have been the truth value if the path had not been truncated. We term a decision to return true when there is doubt the weak view and a decision to return false when there is doubt the strong view. For instance, consider the formula X on a finite path of length 1 such that holds in the first state. Given the evidence we have, it is impossible to say whether or not the formula holds neutrally on the untruncated path. Thus the formula holds weakly and does not hold strongly. The formula X holds weakly on a finite path of length 1 such that holds in the first state. In fact, on such a path the formula X holds weakly for any, including false. Thus, the weak view of the truncated semantics takes the lazy approach, in that it is not required to know whether or not is satisfiable if we have not yet reached a point where matters. Many previous works have examined the issue of augmenting temporal logic with regular expressions, with the motivation of increasing the expressive power as well as allowing easy formulation of properties. In this paper, we study the problem of expanding the truncated semantics to regular expressions. In the process, interesting questions arise regarding the relationship between logical contradictions, such as false, and structural contradictions, such as (where denotes intersection, is a regular expression whose language contains words consisting of a single letter satisfying, and is a regular expression whose language contains words consisting of two such letters. For example, the formula X false is weakly satisfiable, and we might expect the same of the formula X because, intuitively, both false and are contradictions. To view the issue from another direction, consider the logic LTL "$# [6] obtained by expanding LTL with the trunc W operator,

3 " which truncates a path and takes us to the weak view. In the truncated semantics, the formula trunc W true holds for any LTL " # formula on any non-empty path, and we might expect the same of an extension of the truncated semantics to a logic including regular expressions. In the sequel, we examine these and other issues related to truncating regular expressions and arrive at an extension of the truncated semantics that preserves most of the properties from [6]. Preliminaries.1 Notation ( * * 4 ; < P $ Throughout,,,, and denote non-negative integers. We will denote a letter from some alphabet by (possibly with subscripts and an empty, finite, or infinite word over by,, or (possibly with subscripts. The concatenation of and is denoted by. If is infinite, then. The empty word is denoted by, so that. If, we say that is a prefix of, denoted, that is a suffix of, and that is an extension of, denoted. We use to mean and. We denote the length of word as. The empty word has length 0, a finite word "# %$ has length &', and an infinite word has length. 1 For, we use +* to denote the &,'.- letter of (since counting of letters starts at zero, and we denote by *0/1/ the suffix of starting at. When + 3, we denote by *0/1/4 the finite sequence of letters starting from and ending in. That is, +*0/1/4 0 5*6 5*87 9 :4. We use to denote an infinite-length word, each letter of which is. We use the term boolean expression to mean any application of the standard boolean operators to atomic propositions. We use B to denote the set of boolean expressions over a finite set of atomic propositions, and to denote a member of B. We assume a relation >@?BADC B relating letters in?ea with boolean expressions in B. If GFH JI we say that the letter satisfies the boolean expression, denoted. We assume that the boolean relation behaves in the usual manner. In particular, we assume that for every letter 3IK?BA, atomic proposition IL< and boolean expressions MFHBNFH $I B: (i iff IO ; (ii true and false; (iii QR iff PJ ; and (iv BTSU iff. and %$.. The three-view approach to the truncated semantics In [6] we presented the logic LTL " #, defined as follows. Definition 1 (LTL"$# formulas. Every boolean expression is an LTL " # formula. If and V are LTL"$# formulas and is a boolean expression, then the following are LTL " # formulas : W Q W XSYV W X W[Z U V]\ W trunc W 1 We use ^ to denote the cardinality of the non-negative integers. It is understood that ^`_a^ybc^ and ^d_efboe:_3^by^. Since we have finite paths, we need both weak and strong next-time operators. We use X for the strong version. The weak version, X, is given as syntactic sugar.

4 Additional operators are defined as syntactic sugaring of the above operators: W UV Q Q OScQ V W V Q UV W X Q X Q W F Z true U T\ W G Q F Q W[Z W V]\ W trunc S Q Q trunc W 3 Z U V \ G The truncated semantics of LTL "$# was defined in [6]. Later, we will give an alternative formalization of the same semantics. In order to distinguish between the two, we will call the formalization given in [6] the three-view approach to the truncated semantics. The three-view approach defines the semantics of an LTL "$# formula with respect to finite or infinite words over? A and a context indicating the view, which can be either weak, neutral or strong. According to our motivation presented above, the formula holds on a truncated path in the weak view if up to the point where the path ends, nothing has yet gone wrong with. It holds on a truncated path in the neutral view according to the standard LTL semantics for finite paths. In the strong view, holds on a truncated path if everything that needs to happen to convince us that holds on the original untruncated path has already occurred. Intuitively then, each view is recursively defined, with negation switching between the weak and strong views. The truncation operators trunc W and trunc S truncate a path and move to the weak and strong views, respectively. We use to denote that is satisfied under the model 0 `F, where is if the view is weak, null if it is neutral, and & if it is strong. Under the neutral view only non-empty words are evaluated; under the weak/strong views, empty words are evaluated as well. The definition makes use of an overflow and underflow for the ` indices of a word. That is, 49/1/ if 3, and +*0/1/ if 3 ( possibly negative. For example, in the definition below of the semantics of Z U V]\ under the weak and strong views, when we say, is not required to be less than 3. Let and V denote LTL " # formulas. In the three-view approach, the truncated semantics is defined as follows. 3 Q V Z holds weakly: For such that 3, 1. or. P 3. USOV and 4. X /1/ 5. UV]\" such that $# /1/ V, and for every, 4H/1/ % 6. trunc W & or 3 s.t. $# and /1/ #(' holds neutrally: For such that 3, 1. U&. OQ P 3. XSYV and YV 4. X ' and /1/ 5. Z UV \* 3 such that # /1/ DV, and for every 6. trunc W & or 3 s.t. # and /1/ #(', J49/1/ 3 Recall that + always denotes a boolean expression and, -/ e always denote non-negative integers.

5 * holds strongly: For such that, Q V Z V # 1. 3 and. P 3. USOV and 4. X /1/ 5. UV]\" such that $# /1/, and for every, 4H/1/ 6. trunc W & or 3 s.t. and /1/ #(' % In [6], we analyzed the characteristics of the truncated semantics. We showed that the strong view is indeed stronger than the neutral, and the neutral stronger than the weak (the Strength relation theorem. We also showed that if a truncated path satisfies in the weak view, then any prefix of satisfies in the weak view, and that if a truncated path satisfies in the strong view, then any extension of satisfies in the strong view (the Prefix/extension theorem. Finally, we defined the definitive prefix of a word with respect to ( 0 [F as the shortest prefix of which suffices to conclude that holds or does not hold on, and showed that any proper prefix of 0 [F satisfies weakly both and Q, while 0 [F and all of its extensions satisfy strongly exactly one of or Q (the Definitive prefix theorem. We would like to extend the truncated semantics to regular expressions in such a way that these characteristics are preserved..3 Expanding LTL with regular expressions The use of regular expressions in temporal logic is usually based on a relatively straightforward expansion of traditional regular expressions [10] to regular expressions whose syntactic atoms are boolean expressions (see, for instance, [3]. For the purposes of this paper, we will use the extension below. We use,,, and for concatenation, union, intersection, and Kleene closure, respectively. Formally, the syntax of extended regular expressions, or EREs, is given below. Definition (EREs. Every boolean expression is an ERE. If, E, and M$ are EREs, then the following are EREs: W B M$ W B.$ W B M$ W <? A While the syntactic alphabet is the infinite one of boolean expressions over, the semantics is defined over the finite alphabet. We define a relation of tight satisfaction between finite words and EREs. We use to denote that the finite word tightly satisfies the ERE. Let, E, and M$ denote EREs. The semantics of tight satisfaction is as follows: 1. 3 ' and. B.$ and 5$ such that f $ and E and 5$.$ 3. B.$ B or.$ 4. $ and $ 5. either or there exist dnf $GFMF such that f9 $ and for all ] such that ',

6 Despite the surface similarities to traditional regular expressions, there are subtleties. For instance, in the traditional semantics of regular expressions, a letter can be either or, but not both, and so the intersection of the language of with the language of is empty. We have that this intersection is the language of Sd, which need not be empty because a letter of our alphabet can satisfy both and provided they are consistent. It remains to define the semantics of when considered as a formula of temporal logic. Intuitively, is a formula which says that we see a word tightly satisfying. Formally, there exist and such that and 5 3 Expanding LTL with regular expressions In Section, we presented truncated semantics for LTL as well as the semantics of an extended regular expression when viewed as a formula. We now turn to the main issue examined in this paper, which is the problem of combining them. Definition 3 (RTL "$# formulas. Every ERE is an RTL"$# formula. If and V are RTL " # formulas and is a boolean expression, then the following are RTL"$# formulas: W Q W XSYV W X W[Z U V]\ W trunc W Note that the base case of Definition 3 is an ERE. Recalling from Definition that the base case of an ERE is a boolean expression, we have that a boolean expression is an RTL " # formula. Additional operators are defined as syntactic sugaring of the above operators as in Section.. In the remainder of this section, we first present a trivial combination of the truncated semantics with regular expressions based upon an alternative formalization of the truncated semantics, which we term the F approach to the truncated semantics. We then point out some problems with the trivial solution, and finally we present a solution that is more in keeping with the spirit of [6]. 3.1 The approach to the truncated semantics The idea behind the F approach is that we add special letters and such that satisfies all Boolean expressions, including false, and satisfies no Boolean expression, including true. Letting negation switch a to a and vice versa, we get that ; satisfies all LTL "$# formulas, and ; satisfies no LTL " # formula. We then define the semantics of trunc W so that it pads the word with ; and the semantics of trunc S so that it pads the word with f;. Intuitively, this will enforce the requirement that the weak view return true and the strong view false when there is doubt as to the validity of the formula on the original, untruncated path. Formally, the F approach to the truncated semantics defines the semantics of LTL " # with respect to non-empty finite and infinite words over? A F. We use to denote that is satisfied on non-empty word in the F approach. We use to denote the complement of, the word obtained by replacing every with a and vice versa. We augment the boolean relation of Section.1 as follows to

7 6 include the two special letters and : for every, and P5. Note that in particular, false and P true. We make use of the underflow for the indices of ], so that */1/ if 3 ( possibly negative. Let and V denote LTL "$# formulas. In the F approach, the truncated semantics is defined as follows. 1.. Q P 3. XSUV and V 4. X 3 ' and /1/ 5. Z UV]\ 3 s.t. $# /1/ V, and, 4H/1/ 6. trunc W or 3 s.t. # and /1/ # ' ; For any word over, if ; we say that weakly satisfies, denoted. If ; we say that strongly satisfies, denoted. For infinite, ; ; (by the definition of concatenation in Section.1, so iff iff. The following theorem states the equivalence of the two approaches to the truncated semantics. Theorem 4 (Equivalence of three-view and F approaches. Let be a word over?ga, be a non-empty word over?ea, and be a formula of LTL "$#. Then W % W Ö W 3. Trivial extension of the truncated semantics to RTL Using the F approach, the problem of combining the truncated semantics with the semantics for extended regular expressions has an immediate solution, which we term the trivial extension. The trivial extension extends the F approach to the truncated semantics by adding the semantics for EREs as defined in Section.3, but interpreted over the new alphabet?ea F. there exist and such that and There is nothing left to be done because the semantics of tight satisfaction is defined on top of the boolean relation, which is extended by the F approach to cover the two new letters, and. 3.3 Problems with the trivial extension While the trivial extension follows immediately from the F approach, it is not intuitively satisfying. The F approach represents a weak truncation by removing the suffix of the word starting at the truncation point and replacing it with ;. The idea is that ; should satisfy all obligations from that point on, including inconsistent ones. Since for any boolean expression, boolean inconsistencies are satisfied. However, is a letter with length 1, so inconsistencies in length requirements on the operands of in an ERE are not satisfied. We call an ERE with such length inconsistencies a structural contradiction. An ERE that has no length inconsistency but that has some boolean inconsistency we call a logical contradiction. Formally,

8 Definition 5 (Structural and logical contradictions. An ERE is a structural contradiction if it is not tightly satisfied by any finite word over? A F. An ERE is a logical contradiction if it is not a structural contradiction and it is not tightly satisfied by any finite word over?ea. For instance, and Q are both structural contradictions, while false and QR are both logical contradictions. As an example of the difference in the way the trivial extension treats these two kinds of contradiction, let false,, and consider formulas V F and V F. In the trivial extension, V is weakly satisfiable, but V is not. In [6] we showed that the difference between the semantics of the PSL abort operator as originally proposed [5] and the truncated semantics can be understood through formulas like X false and F false, which are satisfiable in the truncated semantics but not in that of [5]. Formulas V and V demonstrate that the trivial extension behaves like the truncated semantics for a logical contradiction, but like the semantics of [5] for a structural contradiction. The difference in the behavior of the trivial extension on formulas V and V can be seen from another direction. The following claim expresses an intuitive property of the truncation operators in the truncated semantics. Claim 6 For any non-empty word such that trunc W true and P trunc S true. true and any LTL " # formula, In the trivial extension, Claim 6 holds for V, but not for V. Furthermore, the following important property of the truncated semantics is not maintained by the trivial extension. Theorem 7 (Strength relation theorem [6]. Let alphabet? A, and let be an LTL"$# formula. Then W W be a non-empty word over the To see that Theorem 7 does not hold on the trivial extension, let as before, and let X Q. We have that ; P. Therefore, ; Q, and thus + Q. Let 3 '. Then, but P The weak/strong word semantics The problem with the trivial extension is illustrated by the fact that it does not treat the structural contradiction in the same way as the logical contradiction false. We would like a solution in which they are treated the same. We term our solution the weak/strong word semantics, because it is defined over weak and strong words, in addition to the neutral words of? A. The idea behind the weak/strong word semantics is to fold the three views of the three-view approach into one in a way similar to the F approach, while avoiding the problems discussed above. In order to deal with structural contradictions, we need to have the suffix after truncation indifferent to length requirements. We achieve this by using ' and 7 to mark truncation and move to the weak/strong view respectively. In general, any word over?ea can be suffixed by ' or 7 to indicate that it should be

9 8 evaluated under the weak or strong view, and negation switches between the views, as previously. In addition, in order to preserve the Definitive prefix theorem of [6], we need to preserve the property that holds on iff X holds on %. Thus we want X to hold on words of length 1 when holds on the empty word, and X X to hold on words of length in such a case, and so on. To achieve this, we first extend the syntax of RTL " # slightly, as follows: Definition 8 (KRTL " # formulas. Every ERE is a KRTL "$# formula. If and V are KRTL"$# formulas, is a boolean expression, and is a nonnegative integer, then the following are KRTL " # formulas: W Q W XSYV W X# Ẁ Z U V]\ W trunc W We define X# as syntactic sugar for Q X# Q and X as syntactic sugar for X. Additional operators are defined as syntactic sugaring as in Section.. Below, we define weak and strong words. We will use ', 7, the weak and strong versions of the empty word, to mark a truncation. The words ', 7 have a plural nature. As markers, they should not disturb the length of a word, which is determined by its letters from? A. Thus we want ' " H7J. On the other hand, ', H7 mark a truncation to the weak or strong view that cannot be undone. Therefore, 3', 7 should behave like infinite words with respect to concatenation on the right: ' ' and 7 7 for any word. Since truncation must occur at a finite time, ' or 7 following an infinite word should have no effect. Thus, we want ' 7 for any infinite word. Finally, we want the empty word to remain the unique identity element with respect to concatenation. We formalize this as follows. Let denote the set of finite and infinite words over? A. The elements of are called neutral words. Let N ' I EF N 7 I. Whenever the notation ' or 7 is used, it is understood that I. The elements of are called weak words, and the elements of are called strong words. Note in particular that (' I and 7 I. Let, and define concatenation in as follows. For all FÜI, is equal to the concatenation of and in, and if is finite then 0 ' 0 ' and #7. For all F I, if is infinite or if I then,. With this definition concatenation in is associative and is the unique identity element. Since ' FH 7 I, ', ' and 7T, 7. Also, if is infinite, then ' 7. Define the length of an element of according to '] 7 for 4 Clearly, then, ' " '. Thus, has all the desired algebraic properties set forth above. Complementation in is defined by, ' 7, and 7 '. Word indexing in is defined as follows. Let I. Indexing for works as defined in Sections.1 and., including the use of overflow and underflow for the indices of. If R, define 0 ' If R, define 0 ' 4H/1/ # 4H/1/ # H/1/ #. For all, define 0 ' 64H/1/ 0 4H/1/ ', H/1/ 0 4H/1/ #7. Note that if, then 0 ' 4H/1/ ', 4H/1/, /1/ 7. Thus, the overflow preserves the strength 4 Note that %b _ does not hold in general for -. This equality does hold if or is infinite.

10 * 4 4 I " # V " # of a word. Finally, if I and f 3 ( possibly negative, then *0/1/. Thus, the underflow is always. The weak/strong word semantics is defined over words. We use to denote that the KRTL formula is satisfied on in the weak/strong word semantics, and for finite, we use to denote that ERE is satisfied tightly on in the weak/strong word semantics. Let, B, and.$ denote EREs, and let and denote KRTL formulas. Tight satisfaction is defined by: 1. & either ( ' or (,I and 3 ' and. B.$ and 5$ such that 9 $ and f B and $.$ 3. B.$ B or.$ 4. B.$ B and.$ 5. $ either or there exist df $GF.F such that f9 $ 9 and for all ] such that ', Formula satisfaction is defined as follows. 1. there exist and such that and. Q P 3. XSUV and V 4. X# (,I and or ( and # /1/ 5. Z UV]\ s.t. X# V, and, X4 6. trunc W or 3 s.t. # and /1/ # ' ' Since a boolean expression is an ERE, the case of a boolean formula is covered by the first case above. The formula is strong in the sense that it requires to occur (that is, it does not hold on the empty word. We therefore use the syntactic sugar s ( strong to signify a formula whose semantics is identical to that of, and w ( weak, for the dual of s, as follows: s and w Q s QR. Note that while s does not hold on an empty word, w does. Let I. If is finite, then 7 7 and ' '. When is infinite, 7 ', and thus syntactically 7 7 and ' '. Semantically, though, 7 is equivalent to 7 and ' is equivalent to ' even for infinite, as stated in the following claim. Claim 9 Let be a KRTL " # formula and let I. Then T7 iff H7 and 'K iff '. For the remainder of this paper, we adopt the notation of the three-view approach for the weak/strong word semantics as follows: For I, we denote ' by and 7 by Discussion The neutral view of the truncated semantics was defined with respect to non-empty words. However, KRTL " # includes formulas of the form, which intuitively hold on an empty word. Therefore, we have chosen to define the weak/strong word semantics with respect to both empty and non-empty neutral words. Doing so introduces a

11 10 problem for boolean expressions, which we first examined in [7]. Whatever choice we make for the semantics of on an empty word, we end up with ambiguity when evaluating the formula QR. Is Q a boolean negation or a formula negation? If boolean, then QR is a boolean expression, therefore it holds on the empty word iff holds. If formula, then we must preserve the property QR P. Rather than introduce distinct operators for boolean vs. formula negation, we adopt the convention that negation applied to boolean expressions is boolean negation. Formula negation of a boolean can be achieved by promoting to a formula using s, then negating. The introduction of empty words has also influenced the semantics of X. When ', we use the condition 3 ' instead of,' as in the truncated semantics. The reason is that we want to preserve the property that if, then for any fi, % X. Since + for any, we want that N+ X for any and any. Note that for any formula that does not hold on the empty word, we still have that X implies that 3 ' for I. Finally, the introduction of formulas which hold on the empty word means that we now have formulas whose definitive prefix is. Definition 10 (Definitive prefix [6] for. Let be a word and a KRTL " # formula. The definitive prefix of with respect to, denoted 0 `F, is the shortest finite neutral prefix of if such exists and such that otherwise. The following Claim confirms our intuition that nothing needs to be read in order to decide if holds on a given word. Claim 11 For any,i and any ERE, 0 `F $ 0 [F Q $. 3.6 Properties of the weak/strong word semantics We first note that the weak/strong word semantics treats the logical contradiction false the same as the structural contradiction. That is, false, hence false. In fact, these conditions are all equivalent to ('. The weak/strong word semantics uses ' rather than ; in the definition of a weak truncation. While ; is sensitive to structural contradictions, ' is not. Claim 1 Every ERE is tightly satisfied by '. Note, however, that not all logical and structural contradictions are equivalent in the weak/strong word semantics, in the same way that the formulas `S Q and X S X Q are not equivalent in the truncated semantics. Contradictions can differ in the number of timesteps and the conditions imposed before reaching an inconsistency. For example, let be a neutral word of length 1. Then P SdQ, P0 Q, and P. However, X S X Q, true true Q, and true true. As another example, is clearly equivalent to (both are equivalent to false, but is not equivalent to H. If Q, then the former holds weakly on a neutral word of length 1 such that, while the latter does not.

12 The weak/strong word semantics preserves most of the properties of the truncated semantics from [6], some of which fail in the trivial extension. For example, Claim 13 For any finite neutral word and any KRTL " # formula, F. The Strength relation theorem also holds, despite failing in the trivial extension. Theorem 14 (Strength relation theorem for. Let be a neutral word, and let be a KRTL " # formula. Then W W The Prefix/extension theorem of [6] also holds. Theorem 15 (Prefix/extension theorem for. Let, and be neutral words, and let be a KRTL " # formula. Then W Ẍ F W Ẍ, F The prefix/extension theorem looks at prefixes and extensions of a word. The following theorem looks at extensions of an ERE. Theorem 16 (Syntactic extension theorem. Let I be a word, and let,.$ be EREs. Then B.$ B The Definitive prefix theorem of [6] is maintained by the weak/strong word semantics. Theorem 17 (Definitive prefix theorem for. Let ŸI be a word, and let be a KRTL " # formula. If 0 F f then for all I 0 F and Q 0 F or Q Otherwise, for every finite I s.t.,, Q, P, and P Q Claim 6 does not hold for the weak/strong word semantics on KRTL "$# : the result fails for formulas such that F,. By Claim 11, and Q $ are examples. Such formulas are completely determined on the empty word, and they are excluded from the following analog of Claim 6. Claim 18 Let be a KRTL"$# formula such that NF. Then for any nonempty I, trunc W true and P trunc S true. 3.7 Relation between the truncated semantics and the weak/strong word semantics We now examine the relation between the truncated semantics and the weak/strong word semantics. The truncated semantics is understood to be defined 0 for the boolean formula operators s and w according to s and w Q s QR. We say that an LTL " # formula is homogeneous if its negation normal form satisfies the following conditions: (i the temporal operators (excluding the truncation operators are either all strong or all weak, and (ii the maximal boolean sub-formulas (excluding the right operand of a truncation operator are either all strong or all weak and match the strength of the temporal operators, if any. The following theorem states the equivalence between the truncated semantics and the weak/strong word semantics. 11

13 P P P 1 Theorem 19. Let be a (possibly empty neutral word, and be a non-empty neutral word. Let be a formula of LTL " #. Then 1.. ( is infinite or is homogeneous ( Ẍ 3. The neutral equivalence can fail for non-homogeneous LTL " # formulas on finite words. The reason is that, compared to the truncated semantics, the weak/strong word semantics cedes some of the strength of a temporal operator to its operand. Consider for instance a neutral word of length 1. The weak/strong word semantics gives X s because, despite the weakness of the X operator, the strength of its operand demands that there be a second letter. It also gives X w because, despite the strength of the X operator, the weakness of its operand allows the formula to hold when there is no second letter. By contrast, in the truncated semantics X s and P X w. Another example is G s. In the weak/strong word semantics, G iff is not a finite strong word and for all, # /1/. Let be a finite neutral word. Then taking, we have that G implies. Since 5 s, it follows that G s. The problem is that at the point where we fall off the end of a neutral word, the strength of affects the truth value of G, in contrast to the weakness of the G operator. We have seen cases where the neutral view of the weak/strong word semantics disagrees with the neutral view of the truncated semantics. Since the neutral view of the truncated semantics is identical to the traditional LTL semantics over finite words [11], the weak/strong word semantics disagrees with the traditional LTL semantics over finite neutral words. This result is less than desirable, since we would like a logic that allows us to reuse known results from LTL. 4 Related Work There is a long history of studying the relation between regular languages and temporal logic [8]. The idea of combining regular languages and temporal logic was first discussed by Wolper [13], who was concerned with the issue of increasing the expressive power of temporal logic. He accomplished this by augmenting LTL with grammar operators, one for each right-linear grammar. Our particular combination of LTL with regular languages represented as regular expressions is derived from [4]. The work described in this paper is the result of discussions in the semantic subcommittee of the Accellera SystemVerilog Assertions Committee (SVA and in the alignment sub-committee of the Accellera Formal Verification Technical Committee (FVTC. The trivial extension of Section 3. is that taken in the formal semantics of SVA Version 3.1 [1], and of PSL Version 1.1 []. The problem of truncating regular expressions translates directly to the problem of weak satisfaction of PSL strong SEREs. There is an interesting relation between weak satisfaction of a PSL strong SERE and the neutral semantics of a PSL weak SERE. Briefly, they are the same for finite words, but different for infinite words, in the same way that weak satisfaction of Z U M\ differs from neutral satisfaction of Z W M\. For a thorough examination of the issue, see [9].

14 13 5 Conclusion We have examined the problem of expanding the truncated semantics of [6] to a logic containing regular expressions, and we have shown that a trivial extension is not intuitively satisfying and breaks basic theorems of the truncated semantics. We have presented a solution that we term the weak/strong word semantics, which treats logical and structural contradictions in a uniform manner. We have shown that our solution preserves the basic theorems of the truncated semantics, but that in some cases it disagrees with the traditional LTL semantics over finite neutral words. Future work is to find a logic that solves the problems addressed by the weak/strong word semantics without breaking the traditional semantics of LTL over finite neutral words. This might be done, for instance, by distinguishing between the semantics of weak regular expressions [9] and strong regular expressions (as in this paper on the empty word. Acknowledgements The first author thanks Avigail Orni for many interesting discussions. References 1. Accellera property sepcification language reference manual. lrm- 1.1.pdf. 3. I. Beer, S. Ben-David, C. Eisner, D. Fisman, A. Gringauze, and Y. Rodeh. The temporal logic Sugar. In G. Berry, H. Comon, and A. Finkel, editors, Proc. International Conference on Computer Aided Verification (CAV, LNCS 10, pages Springer-Verlag, I. Beer, S. Ben-David, and A. Landver. On-the-fly model checking of RCTL formulas. In Proc. International Conference on Computer Aided Verification (CAV, LNCS 147, pages Springer-Verlag, C. Eisner and D. Fisman. Sugar.0 proposal presented to the Accellera Formal Verification Technical Committee, March 00. At Accellera.ps. 6. C. Eisner, D. Fisman, J. Havlicek, Y. Lustig, A. McIsaac, and D. Van Campenhout. Reasoning with temporal logic on truncated paths. In Proc. International Conference on Computer Aided Verification (CAV, LNCS 75, pages 7 39, July C. Eisner, D. Fisman, J. Havlicek, A. McIsaac, and D. Van Campenhout. The definition of a temporal clock operator. In Proc. ICALP 003, LNCS 719, pages Springer-Verlag, June E. Emerson. Temporal and model logic. In Handbook of Theoretical Computer Science, Volume B, chapter 16, pages Elsevier Science Publishers and The MIT Press, D. Fisman, C. Eisner, and J. Havlicek. Weak regular expressions. to appear. 10. J. Hopcroft and J. Ullman. Introduction to Automata Theory, Languages, and Computation. Addison- Wesley, Z. Manna and A. Pnueli. Temporal Verification of Reactive Systems: Safety, pages Springer-Verlag, New York, A. Pnueli. A temporal logic of concurrent programs. Theoretical Computer Science, 13:45 60, P. Wolper. Temporal logic can be more expressive. Information and Control, 56(1/:7 99, 1983.

15 14 A Proofs Throughout the appendix, denotes the set of finite words over? A. A.1 Proof of Theorem 4 Proposition 0 Let a. b. +; be any word over? A, and let be a formula of LTL "$#. Then ; Proof (of Proposition 0. By induction over the structure of. 1.. (a % 3 or 0 ; or 0 ; 0 ; ; (b 3% and 0 ; +;. Q. (a Q P [induction] ; P [ ] +; J P ; Q (b Q % P [induction] ; P [ ] ; J P +; Q 3. S. (a ds % and % [induction] ; and ; ds ; ; (b ds and [induction] ; and ds ; % 4. X. (a % X /1/ [induction] /1/ ;

16 0 ; /1/ [ ; ( ] ; X (b X /1/ [induction] /1/ +; 0 ; /1/ [ ; ( ] ; X 5. Z U \. (a % Z U \ there exists such that # /1/ % and for all F 49/1/ % [induction] there exists such that # /1/ ; and for all F 4H/1/ ; there exists such that 0 ; # /1/ and for all F 0 ; 64H/1/ ; Z U \ (b Z U \ there exists such that # /1/ and for all F J49/1/ [induction] there exists such that # /1/ ; and for all F 4H/1/ ; there exists such that 0 ; # /1/ and for all F 0 ; 64H/1/ ; Z U \ 6. trunc W. (a trunc W either or there exists 3 such that # and /1/ # ' [induction] A: either ; or there exists 3 such that # and /1/ # ' ; [ ; (JFH implies 0 ; # # and 0 ; /1/ # ' /1/ # ' ] B: either ; or there exists ;R such that 0 ; # and 0 ; /1/ # ' ; ; trunc W. It remains to show that B A. Suppose there exists ; such that 0 ; # and 0 ; /1/ # ' ;. If, then 0 ; # # and 0 ( /1/ # ', so we are done. Otherwise, is finite and, so ; 0 ; /1/ # ' ;, and again we are done. (b trunc W either or there exists 3 such that # and /1/ # ' [induction] A: either ; or there exists 3 such that # and /1/ # ' ; [ ; (JFH implies 0 ; # # and 0 ; /1/ # ' /1/ # ' ] B: either ; or there exists ;R such that 0 ; # and 0 ; /1/ # ' ; ; trunc W. It remains to show that B A. Suppose there exists [; such that 0 ; # and 0 ; /1/ #(' ;. If is finite and 3, then 0 +; #, a contradiction. Therefore,. Then 0 f; # # and 0 ; /1/ # ' /1/ # ', so we are done. 15 /1/ #('

17 16 Corollary 1 Let be a non-empty (possibly infinite word over? A, and let be a formula of LTL "$#. Then. Proof (of Corollary 1. By inspection of the definitions, since is over? A and we have the equivalence (a from Proposition 0 to use in the case of the semantics of trunc W. This completes the proof of Theorem 4. A. Proof of Claim 6 1. trunc W true or there exists such that # true and /1/ # ' [let ; true is assumed] Lemma 4 of [6] guarantees that +.. trunc S true [Observation 8 of [6]] and for all, if # true then [let ; true is assumed] Lemma 4 of [6] guarantees that + P. /1/ # ' A.3 Proof of Claim 9 If is a word in, let 0 denote the underlying neutral word. In other words, 0 if is neutral, and 0 if 7 or '. Lemma Let I be infinite, and let be a formula of KRTL "$#. Then iff 0. Proof (of Lemma. By induction over the structure of. 1.. there exist FÖI such that and [ only if is finite; if is finite and is not neutral, then is finite ] there exist I and ÖI such that and there exist I and ÖI such that 0 0 and [ let 0 ; only if is finite; if is finite and is not neutral, then is finite ] there exist F I such that 0 and 0 5. Q. Q P [induction] J P

18 17 [ 0 0 ] 0 5 P 0 5 Q 3. S. fs and [induction] 0 5 and fs 4. X#. X# ( I and 3 or ( 3% and $# /1/ [ ] # /1/ [induction, using # /1/ ( ] 0 # /1/ J 0 # /1/ [ ] ( 0 I and 0 or ( and 0 # /1/ 0 5 X# 5. trunc W. trunc W or there exists 3 such that # and 0 /1/ # ' ' [ induction; 0 ; for 3, # 0 # and /1/ # ' 0 ] 0 5 or there exists 0 such that 0 # and 0 /1/ # ' 'K 0 5 trunc W 7 7 ' Proof (of Claim 9. If is finite, then and '. If is infinite, then the result follows from Lemma. A.4 Proof of Claim 11 so for all I,, in particular 'K and + and 7 and it follows that 7 P Q $ and 5 P Q $ and 'K P Q $. So ' + H7 and H7 Q $ Q $ ' Q $. Hence for any and any, 0 [F $ 0 [F Q $. A.5 Proof of Claim 1 By induction over the structure of. 1.. ' is obvious by definition.. B M$. ' ' ' and, by induction, ' B and '.$. 3. B M$. By induction, ' B. 4. B M$. By induction, ' B and ' M$. 5.. By induction, '. Let '.

19 4 * 4 18 ' A.6 Proof of Claim 13 F [definition] 'K Z true U \ there is s.t. ' X# and, ' X4 true Note that 'K X 7 and that (hence 3 &' 0 ' 4H/1/ Therefore by letting N& ', it follows that 'K F. true A.7 Proof of Theorem 14 Lemma 3 For I and an ERE, T7 P. Proof (of Lemma 3. By induction over the structure of P is obvious by definition.. B.$. If 7 9 $, then either f 7 or $ is strong. By induction, 7 P B and if 5$ is strong then +$ P.$. 3. B M$. By induction, 7 P B and 7 P.$. 4. B M$. By induction, 7 P B is not equal to. If there exist and FNF I such that 7 9, then there must be at least one non-neutral. The first such must be strong, so, by induction, it does not tightly satisfy. Proof (of Theorem 14. By induction over the the structure of. Base case: I ' 1. Assume, so there are F such that and. Either or there is such that ( 0 #7. But 7, because for all and r P (Lemma 3 Thus there is such that. Thus trivially (because by the assumption.. Assume for. Thus there are F such that and, but then ' since ' 1. Q Inductive step: (a 7 Q 7 P ' P [induction] P Q [ I, so ] Q (b Q

20 19 P [ I, so ] P [induction] 7 P 7 Q ' Q. DS (trivial 3. X# (a 7 X# [ 7 I ] and 0 7 # /1/ 3% and 0 # /1/ 7 [induction] 3 and # /1/ X# (b X# [ I ] and $# /1/ [induction] 3 and 0 # /1/ ' and 0 ' # /1/ ' X# 4. Z U E\ (a 7 Z U E\ there is s.t. 7 X# and F 7 X4 [by induction and the case for X# ] there is s.t. X# and, X4 Z U E\ (b Z U E\ there is s.t. X# and, X4 [by induction and the case for X# ] there is s.t. ' X# and, ' X4 ' Z U E\ 5. trunc W (a 7 trunc W either 7 or there is f7: s.t. 0 7 # and 0 7 /1/ #(' ' [induction and for all 3, 0 d7 # # ] either or there is 3 s.t. # and /1/ # ' ' trunc W (b trunc W either or there is 3 s.t. # and /1/ # ' ' [induction and for all 3, 0 ' # $# ] either ' or there is ' s.t. 0 ' # and 0 ' /1/ # ' ' ' trunc W A.8 Proof of Theorem 15 Lemma 4 and '

21 # # ' # " ' # # # ' " 0 Proof (of Lemma 4. By induction over the the structure of. ' ' Base case Assume and. Thus either or ( I and 3 and If ' then and ' ', so '. If I and 3 ' and then also and ' ', so '. Inductive step 1. $ : Assume $ and K. Thus there exist F $ I s.t. $ and B and B$.$. Either or not. If then by induction, ' and $ $, hence ' $. If there exist F $ I s.t. 9 $ so $ G$ and thus by induction, B and $ '.$. Hence 9 $ ' B M$ and thus ' B.$. B.$ : Trivial. 3. B.$ : Trivial. 4. : Assume and. so there exist df $GFH such that $ 9 and for all k ',. Let be the least index (' such that [ 9 such that 9 and so ' and by induction so '. ' # ' #.. Then there is. But for ', Lemma 5, " /1/ " /1/ Proof (of Lemma 5. Assume,. If I or,i then, so " /1/ " /1/ trivially. So we assume that I. Either or not. If then " /1/ so " /1/ " /1/. If since there is such that + thus 0 5 " /1/ " /1/ so " /1/ " /1/ (because for " /1/ " /1/. So " /1/ " /1/ (because for,i, " /1/ " /1/. Proof (of Theorem 15. By induction over the the structure of. Base case: 7 7 I $ $ 7 7 ' ' ' ' ' ' $ $ ' ' ' 1. Assume and LI s.t.. So there are NF B$ such that G$ and. [ (by Lemma 3. Hence I so there are F such that and.. Assume and KI s.t., so there are F B$ such that B$ and. Either or not. If then by Lemma 4,. But, so. If 3, then there are F such that 9 and, so. 1. Q Inductive step (a Assume 7 Q and I s.t.,

22 ' P [induction] ' P 7 Q (b Assume 'K Q and I s.t. 7 P [induction] 7 P ' Q. DS (a Assume 7 S and I s.t. 7 and 7 [induction] 7 and 7 7 S (b Assume 'K S and I s.t. ' and ' [induction] 'K and 'K ' S 3. X# (a Assume 7 X# and I s.t. [ 7 I ] and 0 7 # /1/ [by definition] and 0 $# /1/ 7 [induction and Lemma 5] and 0 # /1/ #7 [by definition] and 0 7 # /1/ 7 X# (b Assume ' X# and I s.t., so ' and 0 ' #. If ' and 0 ' # /1/ [by definition] 0 # /1/ ' [by induction and Lemma 5] 0 # /1/ ' [by definition] 0 ' # /1/ [by assumption] and 0 ' # /1/ ' X# 4. Z U E\ (a Assume 7 Z U E\ and I s.t.. or ' then 'K X# so assume that ']%@ there is s.t. 7 X# and, 7 X 4 [induction and the case for X# ] there is s.t. 7 X# and 7 X 4 7 Z U E\ (b Assume ' Z U E\ and I s.t.. there is s.t. 'K X# and, ' X# [induction and the case for X# ] there is s.t. ' X# and Z 7 'K 'K X# U E\ 5. trunc W (a Assume trunc W and I s.t., either 7 or there is f7: s.t. 0 7 # and 0 7 /1/ #(' ' [by induction and for 3 and, # 0 7 # 0 7 # ] either 7 or there is s.t. 0 7 # and 0 7 /1/ # ' 'K 1,,

23 P P P 7 trunc W (b Assume ' trunc W and I s.t. either ' or there is ' s.t. 0 ' # and 0 ' /1/ #(' ' [induction] either 'K or there is ' s.t. 0 ' # and 0 ' /1/ #(' If 'K we are finished. If 'K P and ' we are finished. If ' then 0 ' /1/ # ' ', so by induction ' and thus 'K trunc W ' A.9 Proof of Theorem 16 E.$ there are F such that and B.$ there are F such that and there exist NF $LI s.t. 9 $ and and $ $ [let and $, then 0 9 $ 0 $% there are F such that and B B by associativity] A.10 Proof of Theorem Assume 0 F. (a Assume 0 F. Then not ( 'K 7 by definiton. Note that ( 'K and 7 and ' P (and 7 P P (by Theorem 14. So not ( ' and 7 and not ( 'K P and 7 (because 0 F. Thus either ( 'K and 7 P or ( ' P and 7. So, by the semantics of negation, either ( 'K and 'K Q or ( 7 Q and 7. So ( 'K and ' Q (by Theorem 14. (b Assume 0 F and I. Either 0 F 5 or 0 F. If 0 F 5 then 7 because 0 F 7 by Theorems 15 and 14. If 0 F P then 'K P because 0 F ' P by Theorems 15 and 14, so 7 Q. 0 F. Then for all finite, not ( ' 7 by definition. Thus ( 'K and 'K Q (by the same argument as in 1(a above, and so ( T7 P and 7 Q (by definition.. Assume A.11 Proof of Claim 18 I,, and NF. Thus, by Theorem 17, ('K and 7 P. 1. trunc W true either or there exists s.t. # true and 0 /1/ # ' 'K

24 P P either or ( true and 'K either or TRUE TRUE. trunc S true Q Q trunc W true Q trunc W true [by (1 and 3 ] TRUE 3 A.1 Proof of Theorem 19 The following proposition proves the first and third parts of Theorem 19. Proposition 6 Let be a word over? A and let be a formula of LTL " #. Then a. b. Proof (of Proposition 6. By induction over the structure of. 1. (a ' there exist FÜI such that ' and [ ' and imply that either ' or I ] either ' or there is a finite neutral prefix of ' such that [ ' I ; ' ] either ' ' or there is a finite neutral prefix of such that R ' and I ' 7 ' 7 P P Q either 3 or 3% and (b there exist FÜI such that d7 and [ and imply that either or I ] either or there is a finite neutral prefix of [7 such that [ ; ] either ' or there is a finite neutral prefix of such that ' and [ 7 ] 3 and. Q (a Q ' Q P [induction] %

25 4 (b Q 7 Q ' P P [induction] P Q 3. S (a % ds and [induction] and ' and 'K ' fs fs (b ds and [induction] and 7 and 7 7 fs fs 4. X (a X X ' X [ 'KI and ' 3 ] either ' or %' and 0 ' /1/ [ 0 ' /1/ 0 /1/ ' ] either 3 ' or 3 ' and 0 /1/ ' either 3 ' or 3%' and /1/ [induction] either ' or ' and /1/ [if 3 ', then /1/ + by Lemma 4 of [6]] /1/ X (b X X 7 X [ 7 I ; 7 ] ' and 0 7 /1/ [ 0 7 /1/ 0 /1/ 7 ] 3 ' and 0 /1/ 7 3% ' and /1/ [induction] 3 ' and /1/ [if /1/, then by Lemma 4 of [6], /1/T, so 3 ' ] /1/ X 5. Z U \ (a Z U \ ' Z U \ there exists such that 'K X# and for all, ' X4 [ ' I ; ' ; 0 ' *0/1/ 0 5*0/1/ ' ] there exists such that either 9 3 or 9 and 0 $# /1/ ' and such that for all, either 9 3 or 9 3%K and 0 49/1/ 'K

26 # ' # # # Z \ Z \ 7 Z \ # # # # # # Z \ ' # ' # ' ' # # # # ' ' # # ' # # ' 7 # ' # ' # # # # ' ' # # ' # # ' there exists such that if then 0 /1/ 'K, if 3 K then 0 :4H/1/ and such that for all there exists such that if 3 then /1/ and such that for all, if 3 K then 4H/1/ [induction] there exists such that if then /1/ and such that for all, if 3 K then 4H/1/ [if 3, then $# /1/ + by Lemma 4 [6]; similarly if 3, then 4H/1/ ] there exists such that /1/ % and for all, :4H/1/ U (b U U there exists such that f7 X and for all, 7 X [ I ; ; 0 *0/1/ 0 *0/1/ ] there exists such that 3%@ and 0 /1/ #7 and such that for all, 3 and 0 J4H/1/ #7 there exists such that 3 and /1/ and such that for all, 3%K and 4H/1/ [induction] there exists such that 3% and /1/ and such that for all, 3% and 4H/1/ [if $# /1/, then by Lemma 4 [6], /1/, so 3%@ ; if 3%@, then 3% ] there exists such that /1/ and for all, :4H/1/ U 6. trunc W (a trunc W ' trunc W [ ': ; for, 0 /1/ /1/ and 0 ] either ' or there exists 3 such that and 0 /1/ either or there exists 3 such that and /1/ [induction] either or there exists such that and /1/ trunc W (b trunc W trunc W [ 75 ; for, 0 7 /1/ /1/ and 0 7 ] either 7 or there exists 3 such that and 0 /1/ either or there exists 3 such that and /1/ [induction] either or there exists such that and /1/ trunc W 5 In order to prove the second part of Theorem 19, we need to work with the derived operators of KRTL "$#. We begin with a number of lemmas that give the weak/strong word semantics for the derived operators explicitly and show that duality relations hold as expected in the weak/strong word semantics.

27 P 6 Definition 7 (weak/strong word equivalence. KRTL " # formulas and are said to be weak/strong word equivalent, written, iff for all words,i, iff. If F are KRTL " # formulas and if B is a subformula of, let Z E E\ denote the KRTL"$# formula that results from substituting for in. Since the weak/strong word semantics is inductively defined, it is straightforward to check that if G, then Z G E\. [For the purposes of this proof, it is understood that the boolean right-hand operand of a truncation operator is not a subformula.] Lemma 8 Let,I, and let be a boolean expression. s iff either ' or ( and. Proof (of Lemma 8. s iff there exist FÜI such that and iff there exist F LI such that and either ' or I and ' and iff [ ' implies ' ] either ' or ( 3% and Lemma 9 Let I, and let be a boolean expression. w iff both 7 and (if 3% then. Proof (of Lemma 9. w iff Q s QR iff s QR iff [Lemma 8] Q (either ' or ( and iff both ' and (if % then iff [if, then ] both 7 and (if % then iff both 7 and (if % then QR P QR P QR Lemma 30 Let I. 1. s true iff ' or 3%.. w true iff s false iff '. 4. w false iff or '. Proof (of Lemma 30. These all follow easily from Lemma 8 and Lemma 9 using the fact that if %, then true and P false. Lemma 31 Let I, and let F be KRTL " # formulas. iff or.