% TOOD: Some more intuition
\newpage
\subsection{Linear Temporal Logic}
\subsubsection{Transition System of a Promela Model}
For the transition systems, compared to earlier, we use a fixed initial configuration because we only model one program or system,
as opposed to all programs of a programming language, as previously.
In addition, we omit terminal configurations from the definition, which simplifies the theory, and termination can be modelled by a transition into a special state,
the \bi{sink state}, which only allows further transitions back to itself.


\paragraph{Converting a Promela model into a transition system}

The configurations are the states of the model, such as global variables and channels, as well as per active process the local variables, channels, and location counters.

The initial configuration is the initial state of the model.

The transition relation is defined by the operational semantics of the statements. They are kept informal in this course.

A Promela model has a finite number of states, since there are a finite number of allowed active processes (255), as well as finite numbers of variables and channels,
finite ranges of variables and finite buffers of channels.


\shade{gray}{Computations}

$S^\omega$ is the set of infinite sequences of elements of set $S$ and $s_{[i]}$ denotes the $i$-th element of the sequence $s \in S^\omega$

$\gamma \in \Gamma^\omega$ is a \bi{computation} of a transition system if:
\begin{itemize}
    \item $\gamma_{[0]} = \sigma_I$
    \item $\gamma_{[i]} \rightarrow \gamma_{[i + 1]}$ (for all $i \geq 0$)
\end{itemize}
Note that we use $\sigma$ to range over the states $\Gamma$ of a transition system. Here $\gamma_{[i]}$ denotes the $i$-th element in $\gamma = \sigma_0 \sigma_1 \ldots$

We use $\cC(TS)$ to denote the set of all computations of a transition system $TS$



\subsubsection{Linear Time Properties}
LT-Properties can be used to specify the permitted computations of a transition system.
A linear time property $P$ over $\Gamma$ is a subset of $\Gamma^\omega$, where $P$ specifies a particular set of infinite sequences of configurations.

A transition system $TS$ \bi{satisfies} the LT-Property $P$ (over $\Gamma$), denoted $TS \models P$, if and only if $\cC(TS) \subseteq P$.
Intuitively, this means that all computations of $TS$ belong to the set $P$.

LT-Properties \bi{precisely} express properties of computations.
Non-termination is handled using infinite sequences and non-determinism is handled by considering each computation separately.

To make notation cleaner and quicker, we define \bi{atomic propositions} (AP) for a transition system $TS$, which is a proposition that does not contain any logical connectives.
For example, $AP = \{ open, closed \}$ (for files).

We then provide a \bi{labeling function} $L : \Gamma \rightarrow \cP(AP)$ that maps configurations to sets of atomic propositions from AP.
$L(\sigma)$ is called an \bi{abstract state}. AP and $L$ are both considered to be \hl{part of the transition system}.


\paragraph{Traces}
A trace is an abstraction of a computation, which only observes the propositions of each state, not the concrete state itself.
It is an infinite sequence of abstract states $\cP(AP)^\omega$.

$t \in \cP(AP)^\omega$ is a trace of a transition system $TS$ if $t = L(\gamma_{[0]} L(\gamma_{[1]}) \ldots$ and $\gamma$ is a computation of $TS$.
The set of all traces of $TS$ is $\cT(TS)$.
The LT-Properties are typically specified over infinite sequences of abstract states, rather than over sequences of configurations.


\paragraph{Safety Properties}
\inlinedefinition An LT-property $P$ is a safety property if for all infinite sequences $t \in \cP(AP)^{\omega}$:
if $t \notin P$ then there is a finite prefix $\hat{t}$ of $t$ such that for every $t'$ with prefix $\hat{t}$, $t \notin P$.

\inlineintuition More informally, it \textit{does not allow anything bad to happen}. Or, more exhaustively, if a sequence $t$ is not allowed by the LT-property,
then there exists a finite prefix $\hat{t}$, which contains everything that makes the sequence violate the LT-property.
Thus, whatever sequence we append to it, it will always remain in violation of the property $P$.


\paragraph{Liveness Properties}
\inlinedefinition An LT-property $P$ is a liveness property if every finite sequence $\hat{t} \in \cP(AP)^*$ is a prefix of an infinite sequence $t \in P$

\inlineintuition More informally, it states that \textit{something good will happen eventually}.
Or, more exhaustively, if every finite sequence of atomic propositions can be extended to a sequence that is allowed by the LT-property.


\paragraph{On proves and examples}
Some remarks for common exam multiple-choice questions
\begin{itemize}
    \item Safety Property and Liveness Property: Only \texttt{true} is such an example
    \item Neither: There are no examples, since every LT-property is a conjunct of a safety and liveness property and every LT-property can be rewritten as such a conjunct.
\end{itemize}

Typically, the exam includes questions on whether or not a given LT-property $\varphi$ is a liveness property, safety property or a conjunct of both.
To determine that, use the following flow chart:
\begin{center}
    \begin{tikzpicture}[node distance = 0.5cm and 0.5cm, >={Classical TikZ Rightarrow[width=7pt]}]
        \node (start) {Is $\varphi$ safety property?};
        \node (safety) [below left=of start] {Safety Property};
        \node (isliveness) [below right=of start] {Is $\varphi$ a liveness property?};
        \node (liveness) [below left=of isliveness] {Liveness Property};
        \node (conjunct) [below right=of isliveness] {Conjunct};

        \draw[arrows = ->, distance = 1.5pt] (start) -- node [above left] {\scriptsize Yes} (safety);
        \draw[arrows = ->, distance = 1.5pt] (start) -- node [above right] {\scriptsize No} (isliveness);
        \draw[arrows = ->, distance = 1.5pt] (isliveness) -- node [below right] {\scriptsize Yes} (liveness);
        \draw[arrows = ->, distance = 1.5pt] (isliveness) -- node [below left] {\scriptsize No} (conjunct);
    \end{tikzpicture}
\end{center}
