The specification of properties is a fundamental step in the formal verification process. System requirements must be captured by formal properties, typically using logic formulas. However, this is often a complex activity and may become a blocking factor for an industrial adoption of the formal techniques. The informal requirements are quite ambiguous but also the complexity of the target logic may be the source of errors in the specification. Finding a property specification language that balances simplicity, expressiveness, and analysis tool support remains an open problem in many real-world contexts.
One of the most popular logics used in computer science to specify properties for formal verification is Linear-time Temporal Logic (LTL) . The model of time is typically discrete and models are discrete, linear sequences of states. We consider First-Order LTL  with future as well as past operators . Thus, the system state is described by individual variables and first-order functions/predicates can describe their relationship. In the spirit of Satisfiability Modulo Theories (SMT) , the formulas are interpreted modulo a background first-order theory as in  (here, we restrict to a quantifier-free fragment with all signature’s symbols rigid). Efficient SMT-based model checking techniques can be used to verify temporal properties on systems described with first-order formulas (see, e.g, [13, 17]).
In the case of real-time systems, LTL is interpreted over a dense model of time or super-dense (dense time with possible sequences of instantaneous events, as needed for example for asynchronous real-time systems). When considering real models of time, it becomes natural to have constraints on the time elapsing between different events. Therefore, LTL has been extended either with clocks/freezing operators as in TPTL  or with metric operators as in [23, 2, 31]. Again, these extensions can be combined with first-order logic (e.g., to represent message passing  or for monitoring specification in ).
When a system or component is seen as a black box, the properties must be specified in terms of the observable variables or messages exchanged with the system environment. This is for example the case of properties of monitors (which trigger alarms based on some condition on the observed variables/messages) or contract-based specifications (which formalize the assumptions/guarantees of components independently of the implementation). In these cases, the properties must capture the relationship between the observable variables at different points of time, without referring to internal variables that store the corresponding values. It is therefore necessary to have suitable mechanisms to refer to the value of variables at different points of time. Instead of enriching the specification language with registers as in register automata  to explicitly store the value of variables in an operational-style specification, we adopt a more declarative style with functions that directly return the value of variables at the next or last state in which a formula will be/was true.
More specifically, we extend the quantifier-free fragment of First-Order Linear-Time Temporal Logic with Past operators adding “at next” and “at last” functional symbols, which are used to represent the value of a term at the next state in the future or at the last state in the past in which a formula holds. For example, the formula says that is true iff in the last two points in which was true the variable had the same value. We consider different models of time, including discrete, dense, and super-dense time. In the dense time setting, the definition has to take into account that a minimum time point may not exist because a formula may be true on open intervals. The “at next” and “at last” functions can be seen as a generalization of Event-Clock Temporal Logic (ECTL) operators [30, 21, 31] (which, on turn, are the logical counterpart of event clocks ) and can encode some Metric Temporal Logic (MTL) operators  also with counting [22, 27]. They are useful to formalize properties of component-based models because they allow us to express constraints on the data exchanged with messages at different instants of time. We provide a simple encoding of the formulas with these extra functional symbols into equisatisfiable formulas without them. We implemented a prototype tool support based on SMT-based model checking.
The natural alternative to the logic we proposed would be to use registers and freezing quantifiers as in  and TPTL. Despite freezing quantifiers provide a higher expressiveness (also with respect to MTL ), they are not so common in industrial applications (at least compared to LTL and MTL), either because they are less intuitive to use or they lack tool support.
The main contributions of the paper are the following. First, we identify an extension of LTL that can express interesting properties relating variables at different points of time. Second, we define the new operators in a very rich setting that includes first-order constraints, past operators, dense and super-dense semantics; this gives also a uniform treatment of LTL satisfiability modulo theories in the case of real time models. Third, we provide a prototype tool support that effectively proves interesting properties, while many logics in the real-time setting lack of tool support.
The rest of the paper is organized as follows: Section 2 introduces the considered time models, LTL satisfiability modulo theories, and its extension with metric operators; Section 3 defines the extension with the new event freezing functions; Section 4 describes the satisfiability procedure; Section 5 presents some preliminary experimental results; finally, Section 6 concludes the paper and draws directions for future work.
2.1 Time models
is the set of non-negative real numbers. A time interval is a convex subset of . The left endpoint of an interval is denoted by , while the right endpoint by . Two intervals and are almost adjacent iff (so they may overlap in at most one point). A singular interval is an interval in the form for some . A time interval sequence is a sequence of time intervals such that, for all , and are almost adjacent and .
We consider different models of time [4, 5]. A time model is a structure with a domain , a total order over , a minimum element , and a function that represents the real time of a time point in . The function is used instead of a distance (e.g., as in ) to treat the weakly-monotonic case in a more uniform way. A time point is an element of . In particular, we consider the following models:
discrete time models where , 0 and are the standard zero and order over natural numbers, and is a non-decreasing divergent sequence (this is also called the pointwise semantics; we use these models also for discrete-time LTL ignoring these real-time timestamps);
dense (strictly-monotonic) time model where , 0 and are the standard zero and order over the real numbers, and is the identity function;
super-dense (weakly-monotonic) time models where 1) such that the sequence of sets where, for all , the set , is a time interval sequence (thus subsequent intervals can overlap in at most one point), 2) iff or and , 3) , and 4) .
2.2 First-Order Linear-time Temporal Logic
We consider First-Order Linear-time Temporal Logic with Past Operators, which we refer to for simplicity as LTL.
Given a first-order signature and a set of variables, we define the syntax of -formulas as follows:
where is a predicate symbol of , is a term, is a functional symbol of , is a constant symbol of , and is a variable in .
-formulas are interpreted by a first-order structure interpreting the symbols in and assignments to variables that vary along time. More specifically, a state is given by a first-order structure and an assignment of variables of into the domain of . Given a state and a symbol of or variable we use to denote the interpretation of in and to denote the value assigned by to . Given , let be the set of states with first-order structure . A trace is given by a first-order structure , a time model , and a mapping from the domain of into . Given a trace and , we denote by the state .
We assume to be given a first-order theory . Given a first-order structure , an assignment to variables of , and a first-order formula over , we use the standard notion of . In the rest of the paper, we omit the first-order signature and theory for simplicity.
In our definition of trace, the first-order structure is shared by all time points, meaning that the interpretation of the symbols in the signature is rigid, does not vary with time. However, note that the interpretation of symbols may not be “fixed” by the background theory. These“uninterpreted” symbols are also called parameters. For example, the signature can include the symbols of the theory of reals (including the constants and ) and an additional constant symbol , whose value is not determined by the theory but does not vary with time (thus, is a parameter).
Given a trace , a time point of , and a formula , we define recursively on the structure of .
Note that we are using the strict version of the “until” and “since” operators, where both arguments are required to hold in points strictly greater or less than the current time.
Finally, iff . We say that is satisfiable iff there exists such that . We say that is valid iff, for all , .
We use the following standard abbreviations:
As usual in many works on real-time temporal logics (e.g., [2, 29]), we assume the “finite variability” of traces, i.e., that the evaluation of predicates by a trace changes from true to false or vice versa only finitely often in any finite interval of time. This can be lifted to temporal formulas in the sense that temporal operators preserve the finite variability property (as proved for example in ). Formally, we say that a trace is fine for in a time interval iff for all , iff . A trace has the finite variability property iff for every formula there exists a sequence of points of such that is fine for in every interval , for . In the following, we assume that traces have the finite variability property.
2.3 Next Operator and Function
Since is the strict version of the “until” operator, we can write the standard as abbreviation:
is well defined in the different time models, also in the case of dense or super-dense time. In the case of weakly-monotonic time, can be true only on a discrete step (i.e., in if is also in ). In the case of strictly-monotonic time, is always false.
With the strict until, we can also define a continuous counterpart of the operator:
Note that is true in all and only in discrete steps. Thus, is always false in the case of discrete time, while in the case of dense time it is true in the time points with a right neighborhood satisfying . In the super-dense time case, is false in the discrete steps, while in other time points it is true if a right neighborhood satisfies . Note that this is a variant of the more standard formula, which has been studied for example in . However, it was considered only in the dense time case. Here, we added , because it will be more convenient in the super-dense time case.
Similarly, we define the “yesterday” operators and . We also define the weaker version of “yesterday” that is true in the initial state: and .
In the discrete-time setting, we often use also the functional counterpart of , here denoted by . Given a term , the interpretation of in a trace at the time point is equal to the value of assigned by at the time point . “next” does not typically have a counterpart in the dense time case. Let LTL-next be the extension of LTL with the function (with discrete time).
2.4 Metric Temporal Operators
In this section, we define some extensions of LTL that use metric operators to constrain the time interval between two or more points. We give a general version in the first-order setting that include also weakly-monotonic time and parametric intervals.
Metric Temporal Logic (MTL) formulas are built with the following grammar:
where the terms are defined as before and are terms that do not contain variables. Thus, the bounds of intervals used in MTL (as well in the other logics defined below) are rigid and may contain parameters. We assume here that the background first-order theory contains the theory of reals and that the terms have real type.
The abbreviations and their non-strict versions are defined in the usual way. Moreover, for all logics defined in this section, we abbreviate the intervals , , , , , by respectively , , , , . Thus, for example, is an abbreviation of .
Let . We give the semantics just for the metric operators:
where is the set obtained from by substituting the terms at the endpoints with their interpretation (thus it may be also an empty set).
MTL is the subset of MTL where the intervals in metric operators are in the form , , , , , .
Event-Clock Temporal Logic (ECTL) is instead defined with the following grammar:
where and are defined as above.
We just give the semantics for the new symbols:
Finally, we define the Temporal Logic with Counting (TLC) with the following grammar:
where and are defined as above.
We just give the semantics for the new symbols:
3 LTL with Event Freezing Functions
3.1 Until next occurrence
Before introducing the new operators, we observe some subtleties of the dense-time semantics. In the discrete-time setting, and are equivalent. In other words, if is true in the future, there exists a first point in which it is true, while is false in all preceding points. This is not the case in the dense-time setting, since for example the third trace of Figure 1 satisfies but not : for every time in which holds, there exists a left open interval in which holds as well.
We can instead use another variant of the until operator defined as:
Thus, with we are requiring that holds in a point or in every point of a right interval. In this case, we are guaranteed that there exists a minimum point that satisfies such condition. In fact, since we are assuming finite variability, is equivalent to . In the next sections, we will use this condition to characterize the next point in the future that satisfies . In particular, when we say “the next point in the future in which holds”, we actually mean holds in that point or in a right left-open interval (see also Figure 1). Similarly, for the past case.
Note that this is related to the issue of in the dense time setting raised first by Bouajjani and Lakhnech in  and later by Raskin and Schobbens in , namely that is satisfied only if the time interval in which holds is left-closed. In , this is solved by considering . However, this does not solve our issue of characterizing the first point in which holds. In , the issue was solved at the semantic level by defining the on timed state sequence that are fine for the subformulas and quantifying over the time intervals of the sequence instead of over the points of the time domain. We instead chose a more classical approach to define the semantics which seems to clarify better what we mean for “the next point in which holds”. This is more similar to the semantics defined in  for event clocks in Event-Clock Timed Automata and for the corresponding quantifiers in the equally expressive monadic logic. However, in , a nonstandard real number is used in case holds in a left-open interval.
3.2 Event Freezing Functions
We extend the logic with two binary operators, “at next” and “at last” , which take in input a term and a formula and represent the value of at the next point in the future, respectively at the last point in the past, in which holds. If such point does not exist we consider a default value represented by a constant or . As in SMT, we also use an if-then-else operator, extended to the temporal case.
The set of LTL with Event Freezing Functions (LTL-EF) formulas is therefore defined as follows:
A formula is interpreted on a trace , where is a first-order structure over the signature extended with the constant symbols for every event freezing term in . The semantics of LTL is thus extended as follows:
if there exists such that, for all , , and ; if there exists such that, for all , , and ; otherwise,
if there exists such that, for all , , and ; if there exists such that, for all , , and ; otherwise,
if , else
The “if-then-else” operator can be used to define the non-strict version:
We define the following abbreviations:
3.3 Extension with Explicit Time
In this section, we extend the language with an explicit notion of time that can be constrained using the event freezing functions defined above. In particular, we introduce an explicit symbol , which represents the time elapsed from the initial state. We allow to be compared with constant terms.
The new set of LTL-EF formulas with explicit time (XLTL-EF) is defined as follows:
The semantics of LTL-EF is extended as follows:
Note that we assume that the signature contains the real arithmetic operators and that the underlying theory contains the theory of reals.
3.4 Coverage of Metric Operators
These operators can be seen as a generalization of the ECTL operators as below:
We can encode similarly MTL operators. As proved in , in case of non-singular intervals with real constant bounds, MTL operators can be expressed in ECTL (and thus in XLTL-EF).
We can also express TLC properties as follows:
3.5 Sensor Example
Consider a sensor with input and output and a Boolean flag that represents whether or not the value reported by the sensor is correct. Let us specify that the output is always equal to the last correct input value with . We assume that a failure is permanent: . Consider also a Boolean variable that represents the event of reading the variable . Let us say that the reading happens periodically with period : . Finally, let us say that an alarm is true if and only if the last two read values are the same: .
We would like to prove that, given the above scenario, every point in which the sensor is not correct is followed within by an alarm:
In the following, we show that this kind of problems can be indeed solved automatically with SMT-based techniques.
4 Satisfiability Procedure
4.1 Overview of the Procedure
The satisfiability problem for (first-order) LTL with discrete time, and thus also for (X)LTL-EF which is an extension thereof, is in general undecidable (see for example ). However, we can reduce it to SMT-based model checking, which although undecidable has effective and mature tool support (also in the case of LTL-next). We thus propose to reduce the satisfiability for (X)LTL-EF to the one for LTL-next. The approach consists of the following steps: 1) the formula is translated into an equisatisfiable one with discrete-time model, 2) the event freezing functions are removed generating an equisatisfiable LTL-next formula. Since LTL-EF is a subset of XLTL-EF, in the following we consider just XLTL-EF formulas.
Given an XLTL-EF formula with dense or super-dense time, we create an equisatisfiable one with discrete time. We will use the non-strict version of the temporal operators as these are those typically supported by tools for LTL. The discretization approach is similar to the one described in . The idea is to split the time evolution is a sequence of singular or open intervals in such a way that the trace is fine for the input formula on such intervals. To this purpose we introduce three variables that encode a sequence of time intervals used to sample the value of variables: is a Boolean variable that encodes if the interval is singular or open; is a real variable that encodes the time elapsed between two samplings; is a real variable that accumulates arbitrary sums of . A constraint ensures that the value of these additional variables represent a valid time interval sequence (e.g., after an open interval there must be a singular interval and is infinitely often greater than and reset). Another constraint ensures that the variable is equal to the accumulation of and that the evaluation of predicates in the formula is uniform in open intervals.
Given these extra variables, we can define the translation. Given a formula over , we rewrite into over defined as:
where , , and are defined as follows.
is defined recursively on the structure of and rewrites the temporal operators splitting between the case in which the current interval is singular () or open ().
Let us consider first ; intuitively, to hold in a time point , if belongs to an open interval (fine for ), then must hold in ; similarly, if because holds in and is part of an open interval, also must hold in . Thus, is translated as follows: either the current interval is open (), holds in a future singular interval and holds now and until that interval; or the current interval is open, holds in a future open interval and holds now and until that interval included; or the current interval is singular, holds in a future singular interval and holds (strictly) until that interval; or the current interval is singular, holds in a future open interval and holds (strictly) until that interval included. Similarly for the past case. Overall:
Let us consider now . We first define , which is used as intermediate step to define . The discretization of is translated into the value of at the first state in the future such that holds in that state or the following state corresponds to an open interval in which holds:
If the current interval is open and holds in all points of the interval, then . Similarly, if the current interval is singular and is followed by an open interval in which holds, then . If the current interval is open and does not hold in the interval, then again . Finally, if the interval is singular and is not followed by an open interval in which holds, is equal to the value of in the next interval. The overall translation is the following:
where we use for simplicity with the following semantics: and . In practice, this is rewritten in terms of and an extra monitor variable in the usual way.
The following completes the definition with the trivial cases:
encodes the structure of the time model (to enforce for example that after an open interval there must be a singular one and that in a discrete step time does not elapse):
Finally, encodes the value of and forces the uniformity of predicates over in open intervals:
where denotes the set of subformulas of .
Note in particular that we require to split the time intervals in such a way that for every constant occurring in a time constraint, is a time interval in the sequence. Note that can be in general a term built with the signature symbols that are interpreted rigidly.
Written as above the discretization clearly produces a formula whose size is exponential in the input. However, since we are interested in equisatisfiability we can always use extra variables (one for subformula) to obtain a linear-size formula.
We now prove that the translation is correct, i.e., that the new formula is equisatisfiable.
and are equisatisfiable.
Proof. Given a trace satisfying we can build a trace with a discrete time model satisfying as follows. Let be a sequence of time intervals such that 1) is fine for all subformulas of in each interval , 2) each interval in the sequence is singular or open, and 3) in case of super-dense time, for all , there exists an integer such that for all . We build an assignment to , and based on such sequence. The values of , , and are determined by the sequence of intervals in order to satisfy .
Let us define the value assigned by to as follows:
iff is singular;
if is singular
Thus, . Notice in particular, that if then , if is singular and is not then is equal to half of the length of and if is not singular then is equal to half of the length of .
Let and for all . Notice that for all , . We complete the time model of by defining for all .
Let in case has a dense time and in case of super dense time. Let us complete the definition of by saying that for all , .
We now prove that, for all , for all subformulas of , iff and for all terms in , .
By definition of , is the value of at the next point such that . Since is fine for , must belong to a singular interval with (so ). By inductive hypothesis, iff and iff . Thus, iff . Moreover, still by inductive hypothesis, for all , iff and . Thus, .
It is routine to prove the other cases and we can conclude that