Property Specification


Introduction

In order to analyse a probabilistic model which has been specified and constructed in PRISM, it is necessary to identify one or more properties of the model which can be evaluated by the tool. PRISM's property specification language subsumes several well-known probabilistic temporal logics, including PCTL, CSL, LTL and PCTL*. PCTL is used for specifying properties of DTMCs and MDPs; CSL is an extension of PCTL for CTMCs; LTL and PCTL* can be used to specify properties of DTMCs and MDPs (or untimed properties of CTMCs).

In fact, PRISM also supports numerous additional customisations and extensions of these two logics. Full details of the property specifications permitted in PRISM are provided in the following sections. The presentation given here is relatively informal. For the precise syntax and semantics of the various logics, see [HJ94],[BdA95] for PCTL, [ASSB96],[BKH99] for CSL and, for example, [Bai98] for LTL and PCTL*. You can also find various pointers to useful papers in the About and Documentation sections of the PRISM website.

Before discussing property specifications in more detail, it is perhaps instructive to first illustrate some typical examples of properties which PRISM can handle. The following are a selection of such properties. In each case, we give both the PRISM syntax and a natural language translation:

P>=1 [ F "terminate" ]

"the algorithm eventually terminates successfully with probability 1"

"init" => P<0.1 [ F<=100 num_errors > 5 ]

"from any initial state, the probability that more than 5 errors occur within the first 100 time units is less than 0.1"

"down" => P>0.75 [ !"fail" U[1,2] "up" ]

"when a shutdown occurs, the probability of system recovery being completed in between 1 and 2 hours without further failures occurring is greater than 0.75"

S<0.01 [ num_sensors < min_sensors ]

"in the long-run, the probability that an inadequate number of sensors are operational is less than 0.01"

Note that the above properties are all assertions, i.e. ones to which we would expect a "yes" or "no" answer. This is because all references to probabilities are associated with an upper or lower bound which can be checked to be either true or false. In PRISM, we can also directly specify properties which evaluate to a numerical value, e.g.:

P=? [ !proc2_terminate U proc1_terminate ]

"the probability that process 1 terminates before process 2 does"

Pmax=? [ F<=T messages_lost > 10 ]

"the maximum probability that more than 10 messages have been lost by time T"

S=? [ queue_size / max_size > 0.75 ]

"the long-run probability that the queue is more than 75% full"

Furthermore, PRISM makes it easy to combine such properties into more complex expressions, compute their values for a range of parameters and plot graphs of the results using experiments. This is often a very useful way of identifying interesting patterns or trends in the behaviour of a system. See the Case Studies section of the PRISM website for many examples of this kind of analysis.


Identifying A Set Of States

One of the most fundamental tasks when specifying properties of a model is to identify particular sets or classes of states of the model. For example, to verify a property such as "the algorithm eventually terminates successfully with probability 1", it is first necessary to identify the states of the model which correspond to situations where "the algorithm has terminated successfully". In terms of the way temporal logics are usually presented, these correspond to atomic propositions.

In PRISM, this is achieved simply by writing an expression in the PRISM language which evaluates to a Boolean value. This expression will typically contain references to variables (and constants) from the model to which it relates. The set of states corresponding to this expression is those for which it evaluates to true. We say that the expression is "satisfied" in these states.

For example, in the property given above:

"init" => P<0.1 [ F<=100 num_errors > 5 ]

the expression num_errors > 5 is used to identify states of the model where more than 5 errors have occurred.

It is also common to use labels to identify states in this way, like "terminate" in the example:

P>=1 [ F "terminate" ]

Properties can refer to labels either from the model to which the property relates, or included in the same properties file.


The P Operator

One of the most important operators in the PRISM property specification language is the P operator, which is used to reason about the probability of an event's occurrence. This operator was originally proposed in the logic PCTL but also features in the other logics supported by PRISM, such as CSL. The P operator is applicable to all three model types: DTMCs, MDPs and CTMCs.

Informally, the property:

P bound [ pathprop ]

is true in a state s of a DTMC, MDP or CTMC if "the probability that path property pathprop is satisfied by the paths from state s meets the bound bound". A typical example of a bound would be:

P>0.98 [ pathprop ]

which means: "the probability that pathprop is satisfied by the paths from state s is greater than 0.98". More precisely, bound can be any of >=p, >p, <=p or <p, where p is a PRISM language expression evaluating to a double in the range [0,1].

The types of path property supported by PRISM and their semantics are discussed below. PRISM also supports quantitative properties of the form P=? which are covered later in this section.

MDPs

For MDPs, some additional clarifications are necessary. Whereas for DTMCs and CTMCs, probability measures over paths are well defined (see e.g. [KSK66] and [BKH99], respectively), for MDPs a probability measure can only be feasibly defined once all nondeterminism has been removed. Hence, the actual meaning of the property P bound [ pathprop ] for an MDP is taken to be "the probability that pathprop is satisfied by the paths from state s meets the bound bound for all possible resolutions of nondeterminism". This means that, for an MDP, properties using the P operator actually reason about the minimum or maximum probability, over all possible resolutions of nondeterminism, that a certain type of behaviour is observed. This depends on the bound attached to the P operator: a lower bound (> or >=) relates to minimum probabilities and an upper bound (< or <=) to maximum probabilities.

Path properties

PRISM supports a wide range of path properties that can be used with the P operator. A path property is a formula that evaluates to either true or false for a single path in a model. Here, we review some of the simpler properties that feature a single temporal operator, as used for example in the logics PCTL and CSL. Later, we briefly describe how PRISM also supports more complex LTL-style path properties.

The basic different types of path property that can be used inside the P operator are:

  • X : "next"
  • U : "until"
  • F : "eventually" (sometimes called "future")
  • G : "always" (sometimes called "globally")
  • W : "weak until"
  • R : "release"

In the following sections, we describe each of these temporal operators. We then discuss the (optional) use of time bounds with these operators. Finally, we also discuss LTL-style path properties.

"Next" path properties

The property X prop is true for a path if prop is true in its second state, An example of this type of property, used inside a P operator, is:

P<0.01 [ X y=1 ]

which is true in a state if "the probability of the expression y=1 being true in the next state is less than 0.01".

"Until" path properties

The property prop1 U prop2 is true for a path if prop2 is true in some state of the path and prop1 is true in all preceding states. A simple example of this would be:

P>0.5 [ z<2 U z=2 ]

which is true in a state if "the probability that z is eventually equal to 2, and that z remains less than 2 up until that point, is greater than 0.5".

"Eventually" path properties

The property F prop is true for a path if prop eventually becomes true at some point along the path. The F operator is in fact a special case of the U operator (you will often see F prop written as true U prop). A simple example is:

P<0.1 [ F z>2 ]

which is true in a state if "the probability that z is eventually greater than 2is less than 0.1".

"Globally" path properties

Whereas the F operator is used for "reachability" properties, G represents "invariance". The property G prop is true of a path if prop remains true at all states along the path. Thus, for example:

P>=0.99 [ G z<10 ]

states that, with probability at least 0.99, z never exceeds 10.

"Weak until" and "release" path properties

Like F and G, the operators W and R are derivable from other temporal operators.

Weak until (a W b), which is equivalent to (a U b) | G a, requires that a remains true until b becomes true, but does not require that b ever does becomes true (i.e. a remains true forever). For example, a weak form of the until example used above is:

P>0.5 [ z<2 U z=2 ]

which states that, with probability greater than 0.5, either z is always less than 2, or it is less than 2 until the point where z is 2.

Release (a R b), which is equivalent to !(!a U !b), informally means that b is true until a becomes true, or b is true forever.

"Bounded" variants of path properties

All of the temporal operators given above, with the exception of X, have "bounded" variants, where an additional time bound is imposed on the property being satisfied. Since in DTMCs and MDPs, time progresses in discrete steps, whereas CTMCs model real (continuous) time, we treat these two cases separately for this operator.

For a DTMC or MDP, the time interval specification must be of the form "<=t" where t is a PRISM expression evaluating to a non-negative integer. A bounded until property prop1 U<=t prop2, for example, is satisfied along a path if prop2 becomes true within t steps and prop1 is true in all states before that point. A typical example of this would be:

P>=0.98 [ y<4 U<=7 y=4 ]

which is true in a state if "the probability of y first exceeding 3 within 7 time steps is greater than or equal to 0.98". Similarly:

P>=0.98 [ F<=7 y=4 ]

is true in a state if "the probability of y being equal to 4 within 7 time steps is greater than or equal to 0.98" and:

P>=0.98 [ G<=7 y=4 ]

is true if the probability of y staying equal to 4 for 7 time steps is at least 0.98.

The time bound can be an arbitrary (constant) expression, but note that you may need to bracket it, as in the following example:

P>=0.98 [ G<=(2*k+1) y=4 ]

In the context of a CTMC, the time interval specification time can take any of the three forms: >=t, <=t or [t1,t2], where t, t1 and t2 are PRISM expressions evaluating to a non-negative doubles, and t1 is no greater than t2. In each case, time defines an interval of real values in which the path property must be true.

For example:

P>=0.25 [ y<=1 U<=6.5 y>1 ]

means that the probability of y being greater than 1 within 6.5 time-units (and remaining less than or equal to 1 at all preceding time-points) is at least 0.25.

P<0.4 [ F>=5.5 y>1 ]

states that the probability of y exceeding 1 at some point after 5.5 time-units have elapsed is less than 0.4, and:

P>0 [ G[5.5,6.5] y>1 ]

says that the probability that y exceeds 1 for the whole time interval [5.5,6.5] is greater than zero".

Transient probabilities

We can also use the bounded F operator to refer to a single time instant, e.g.:

P<0.01 [ F[10,10] y=6 ]

refers to the probability of y being 6 at time instant 10.

LTL-style path properties

PRISM also supports probabilistic model checking of the temporal logic LTL (and, in fact, PCTL*). LTL provides a richer set of path properties for use with the P operator, by permitting temporal operators to be combined. Here are a few examples of properties expressible using this functionality:

P>0.99 [ F ( "request" & (X "ack") ) ]

"with probability greater than 0.99, a request is eventually received, followed immediately by an acknowledgement"

P>=1 [ G F "send" ]

"a message is sent infinitely often with probability 1"

P<0.01 [ F G ("error" & !"repair") ]

"the probability of an error occurring that is never repaired is less than 0.01" occurs?”


Quantitative Properties

It is very often useful to take a quantitative approach to probabilistic model checking, computing the actual probability that some behaviour of a model is observed, rather than just verifying whether or not the probability is above or below a given bound. Hence, PRISM allows the P operator to take the following form:

P=? [ pathprop ]

These properties return a numerical rather than a Boolean value. The S and R operators, discussed later, can also be used in this way.

Note that the probability bound on a P operator can only be replaced with =? if it is the outermost operator of the property in which it appears; otherwise the semantics are not well defined. Note also that, for MDPs, the situation is slightly more complex. Probabilities for an MDP can only be computed once the nondeterminism has been resolved. Hence, PRISM actually computes either the minimum or maximum probability of a path property being satisfied, quantifying over all possible resolutions (i.e. the best and worst cases). Therefore, for MDPs we have two possible types of property:

Pmin=? [ pathprop ]
Pmax=? [ pathprop ]

which return the minimum and maximum probabilities, respectively.

All of these operators return a single numerical value. In the simplest case, where the model being verified has a single initial state, the numerical value returned is the one corresponding to that state. Hence, for example:

P=? [ F x=5&y=5 ]

returns the probability of, from the initial state, reaching a state satisfying x=5&y=5. It is also possible, however, to obtain the probability for an arbitrary state, by specifying an atomic proposition, true only in that state, inside braces ({...}) before the closing ] bracket. This is known as a filter. For example, if the model contains two variables, X and y, then:

P=? [ F x=5&y=5 {x=1&y=2} ]

returns the probability of, from the state (1,2) (i.e. x=1 and y=2), reaching a state satisfying x=5&y=5. It is possible of course that the expression in the filter satisfies more than one state. If this the case, by default the first such state (lexicographically) is chosen. In this situation, PRISM will display a warning to notify you that the expression in the filter matched multiple states and will display what the first matching state is. The same approach is taken in the situation where no filter is given but the model contains multiple initial states. In this case, the numerical result obtained is for the first (lexicographically speaking) of the set of initial states. Note that if the expression in the filter is not satisfied by any states of the model, an error is reported.

It is also possible to possible to request either the minimum and maximum value from a set of values. For example:

P=? [ F x=5&y=5 {y=2}{min} ]
P=? [ F x=5&y=5 {y=2}{max} ]

return the minimum and maximum probability, respectively, of reaching a state satisfying x=5&y=5 from all the states satisfying y=2. In addition, PRISM will report the states of the model in which the minimum or maximum probability is attained. You can in fact also request that both the minimum and maximum value are computed simultaneously using, for example, {y=2}{min}{max}. In this case, both values will be reported, but the actual return value of the property will be the minimum value.

Finally, note that filters can also be used for classical (bounded) P properties. This has no bearing on the result of model checking a property; it simply causes the probabilities (where non-zero) for all states satisfying the expression in the filter to be printed during model checking (in the log, if using the GUI, or to the screen, if using the command-line). For example:

P>0.5 [ F x=5&y=5 {y=2} ]

will return a Boolean value, depending whether the property is true in all states of the model or not, but the probability (where non-zero) of path property F x=5&y=5 being satisfied will be displayed for all states where y=2.


The S Operator

The S operator is used to reason about the steady-state behaviour of a model, i.e. its behaviour in the long-run or equilibrium. Although this could in principle relate to all three model types, PRISM currently only provides support for DTMCs and CTMCs. The definition of steady-state (long-run) probabilities for finite DTMCS and CTMCs is well defined (see e.g. [Ste94]). Informally, the property:

S bound [ prop ]

is true in a state s of a DTMC or CTMC if "starting from s, the steady-state (long-run) probability of being in a state which satisfies the (Boolean-valued) PRISM property prop, meets the bound bound". A typical example of this type of property would be:

S<0.05 [ queue_size / max_size > 0.75 ]

which means: "the long-run probability of the queue being more than 75% full is less than 0.05".

Like the P operator, the S operator can be used in a quantitative form, e.g.:

S=? [ queue_size / max_size > 0.75 ]

including the use of filters.


Reward-based Properties

PRISM models can be augmented with information about rewards (or, equivalently, costs). The tool can analyse properties which relate to the expected values of these rewards. This is achieved using the R operator, which works in a similar fashion to the P and S operators, and can be used either in a Boolean-valued query, e.g.:

R bound [ rewardprop ]

where bound takes the form <r, <=r, >r or >=r for an expression r evaluating to a non-negative double, or a real-valued query, e.g.:

R query [ rewardprop ]

where query is =? for a DTMC or CTMC, and min=? or max=? for MDPs. In the latter case, filters can be used, as for the P and S operators.

Informally, "R bound [ rewardprop ]" is true in a state of a model if "the expected reward associated with rewardprop of the model when starting from that state'' meets the bound bound and "R query [ rewardprop ]" returns the actual expected reward value.

There are four different types of reward properties, namely:

  • "reachability reward": F prop
  • "cumulative reward" : C<=t
  • "instantaneous reward" : I=t
  • "steady-state reward" : S.

Below, we consider each of these cases in turn. The descriptions here are kept relatively informal. For precise definitions (in the case of DTMCs and CTMCs), see [KNP07a].

"Reachability reward" properties

"Reachability reward" properties associate a reward with each path of a model. More specifically, they refer to the reward accumulated along a path until a certain point is reached. The manner in which rewards are accumulated depends on the model type. For DTMCs and MDPs, the total reward for a path is the sum of the state rewards for each state along the path plus the sum of the transition rewards for each transition between these states. The situation for CTMCs is similar, except that the state reward assigned to each state of the model is interpreted as the rate at which rewards are accumulated in that state, i.e. if t time units are spent in a state with state reward r, the reward accumulated in that state is r x t. Hence, the total reward for a path in a CTMC is the sum of these products for each state along the path plus the sum of the transition rewards for each transition between these states.

The reward property "F prop" corresponds to the reward cumulated along a path until a state satisfying property prop is reached, where rewards are cumulated as described above. State rewards for the prop-satisfying state reached are not included in the cumulated value. In the case where the probability of reaching a state satisfying prop is less than 1, the reward is equal to infinity.

A common application of this type of property is the case when the rewards associated with the model correspond to time. One can then state, for example:

R<=9.5 [ F z=2 ]

which is true in a state s if "the expected time taken to reach, from s, a state where z equals 2 is less than or equal to 9.5".

"Cumulative reward" properties

"Cumulative reward" properties also associate a reward with each path of a model, but only up to a given time bound. The property C<=t corresponds to the reward cumulated along a path until t time units have elapsed. For DTMCs and MDPs, the bound t must evaluate to an integer; for CTMCs, it can evaluate to double. State and transition rewards along a path are cumulated exactly as described in the previous section.

A typical application of this type of property is the following. Consider a model of a disk-drive controller which includes a queue of incoming disk requests. If we assign a reward of 1 to each transition of the model corresponding to the situation where an incoming request is lost because the queue is full, then the property:

R=? [ C<=15.5 ]

would return, for a given state of the model, "the expected number of lost requests within 15.5 time units of operation".

"Instantaneous reward" properties

"Instantaneous reward" properties refer to the reward of a model at a particular instant in time. The reward property I=t associates with a path the reward in the state of that path when exactly t time units have elapsed. For DTMCs and MDPs, the bound t must evaluate to an integer; for CTMCs, it can evaluate to double.

Returning to our example from the previous section of a model for a disk-request queue in a disk-drive controller, consider the case where the rewards assigned to each state of the model give the current size of the queue in that state. Then, the following property:

R<4.4 [ I=100 ]

would be true in a state s of the model if "starting from s, the expected queue size exactly 100 time units later is less than 4.4". Note that, for this type of reward property, state rewards for CTMCs do not have to refer to rates; they can refer to any instantaneous measure of interest for a state.

"Steady-state reward" properties

Unlike the previous three types of property, "steady-state reward" properties relate not to paths, but rather to the reward in the long-run. A typical application of this type of property would be, in the case where the rewards associated with the model correspond to power consumption, the property:

R<=0.7 [ S ]

which is true in a state s if "starting from s, the long-run average power consumption is less than 0.7".

Which reward structure?

In the case where a PRISM model has multiple reward structures you may need to specify which reward structure your property refers to. This is done by placing the information in braces ({}) after the R operator. You can do so either using the name assigned to a reward structure (if any) or using the index (where 1 means the first rewards structure in the PRISM model file, 2 the second, etc.). Examples are:

R{"num_failures"}=? [ C<=10.0 ]
R{"time"}=? [ F step=final ]
R{2}=? [ F step=final ]

Note that when using an index to specify the reward structure, you can actually put any expression that evaluates to an integer. This allows you to, for example, write a property of the form R{c}=?[...] where c is an undefined integer constant. You can then vary the value of c in an experiment and compute values for several different reward structures at once.

If you don't specify a reward structure to the R operator, by default, the first one in the model file is used.

Availability

There are currently a few restrictions on the model checking engines that can be used for some reward properties. The following table summarises the currently availability, where S, M and H denote the "sparse", "MTBDD" and "hybrid" engines, respectively.

 FC<=tI=tS
DTMCsSMHSMHSMHSMH
CTMCsSMHSMHSMHSMH
MDPsSM----SM-n/a

Syntax And Semantics

The three principal operators of the PRISM property specification language, namely P, S and R, can be combined into any valid, well-typed PRISM expression. This mean that any of the following operators can be used:

  • - (unary minus)
  • *, / (multiplication, division)
  • +, - (addition, subtraction)
  • <, <=, >=, > (relational operators)
  • =, != (equality operators)
  • ! (negation)
  • & (conjunction)
  • | (disjunction)
  • => (implication)
  • ? (condition evaluation: condition ? a : b means "if condition is true then a else b")

Logical operators can be used, for example, to specify any property expressible in logics such as PCTL and CSL, e.g.:

"no_error" => P<0.1 [ F ("error1" | "error2") ]

Other operators can also be used to derive various arithmetic expressions such as:

P=? [ F[3600,7200] oper ]

"the probability that the system is not operational at any point during the second hour of operation"

R{"oper"}=? [ C<=t ] / t

"the expected fraction of time that the system is available (i.e. the expected interval availability) in the time interval [0, t]"

P=? [ F fail_A ] / P=? [ F any_fail ]

"the (conditional) probability that component A eventually fails, given that at least one component fails"

Semantics

We omit a formal presentation of the semantics of the PRISM property language. The semantics of the probabilistic temporal logics that the language incorporates can be found from a variety of sources. See for example the pointers given in the About and Documentation sections of the PRISM website.

It is worth, however, clarifying a few points specific to PRISM. A property is evaluated with respect to a particular state of a model. Depending on the type of the property, this value may either be a Boolean, an integer or a double. When analysing a property of a model, though, PRISM actually determines the value for all states of the model. Furthermore, the final value that PRISM returns as the result of model checking depends on the model type.

For Boolean properties, such as those conforming to the classical syntax of PCTL, CSL, etc., PRISM returns a value of true if the property is true for all states of the model. To check if a property is satisfied in some subset of states, for example just the initial states, properties can be prefixed with an implication, e.g.:

"init" => P>=1 [ F leader_elected=true ]

For numeric properties, typically a single value (for a single state) is required. The default behaviour of PRISM is to return the value for the initial state of the model. This issue was discussed in more depth in the the Quantitative Properties section.


Properties Files

Files containing properties to be analysed by PRISM can also contain constants, as is the case for model files. These are defined in identical fashion, for example:

const int k = 7;
const double T = 9.5;
const double p = 0.01;

P<p [ true U<=T x=k ]

As before, these constants can actually be left undefined and then later assigned either a single value or a range of values using experiments.

In fact, probability bounds for the P or S operators (like P above) and upper or lower bounds for the U operator (like T above) can be arbitrary expressions, provided they are constant. Furthermore, expressions in the properties file can also refer to constants previous defined in the model file.

Another feature of properties files is labels. These are a way of defining sets of states that will be referred to in properties (they correspond to atomic propositions in a temporal logic setting). As described earlier, labels can be defined in either model files or property files.

Labels are defined using the keyword label, followed by a name (identifier) in double quotes, and then an expression which evaluates to a Boolean. Definition and usage of formulas are illustrated in the following example:

label "safe" = temp<=100 | alarm=true;
label "fail" = temp>100 & alarm=false;

P>=0.99 [ "safe" U "fail" ]

Two special cases are the "init" and "deadlock" labels which are always defined. These are true in initial states of the model and states where deadlocks were found (and fixed by adding self-loops), respectively. The former is useful if you only wish to to check whether a property is true in the initial states, e.g.:

"init" => P>=0.99 [ "safe" U "fail" ]

A PRISM properties file can contain any number of properties. Like model files, they can also include any amount of white space (spaces, tabs, new lines, etc.) and C-style comments, which are both ignored. By convention, files are given the extension .pctl for properties of DTMCs and MDPs and extension .csl for properties of CTMCs.

PRISM Manual

Property Specification

[ View all ]