Interval Temporal Logic Antonio Cau and Ben Moszkowski 2021-04-09 HTML version of the ITL home page Abstract Interval Temporal Logic (ITL) is a flexible notation for both propositional and first-order reasoning about periods of time found in descriptions of hardware and software systems. Unlike most temporal logics, ITL can handle both sequential and parallel composition and offers powerful and extensible specification and proof techniques for reasoning about properties involving safety, liveness and pro- jected time [134]. Timing constraints are expressible and furthermore most imperative programming constructs can be viewed as formulas in a slightly modified version of ITL [125]. Tempura provides an executable framework for developing and experimenting with suitable ITL specifications. In addi- tion, ITL and its mature executable subset Tempura [157] have been extensively used to specify the properties of real-time systems where the primitive circuits can directly be represented by a set of simple temporal formulae. In addition, Tempura has been applied to hardware simulation and other areas where timing is important. 1 Contents 1 Finite Interval Temporal Logic3 1.1 Syntax............................................3 1.2 Semantics..........................................3 1.3 Derived Constructs......................................5 1.4 Propositional proof system..................................7 1.5 First order proof system...................................7 2 Finite and Infinite Interval Temporal Logic8 2.1 Syntax............................................8 2.2 Semantics..........................................8 2.3 Derived Constructs...................................... 11 2.4 Propositional proof system.................................. 13 2.5 First order proof system................................... 13 3 Tools 14 3.1 (Ana)Tempura........................................ 14 3.2 FLCheck: Fusion Logic decision Procedure......................... 21 3.3 ITL library for Isabelle/HOL................................. 23 3.3.1 Shallow embedding................................. 23 3.3.2 Deep embedding................................... 25 3.4 ITL Theorem Prover based on Prover9........................... 25 3.5 ITL Proof Checker based on PVS.............................. 26 3.6 Automatic Verification of Interval Temporal Logic..................... 26 4 ITL Related Publications 27 4.1 Articles............................................ 27 4.2 In Collections......................................... 31 4.3 Conference Papers...................................... 34 4.4 Books............................................ 42 4.5 Theses............................................ 42 4.6 Technical Reports...................................... 44 2 Table 1: Syntax of finite ITL Integer Expressions ie ::= z j A j ig(ie1; : : : ; ien) j A j fin A Boolean Expressions be ::= b j Q j bg(be1; : : : ; ben) j Q j fin Q Formulae ∗ f ::= true j h(e1; : : : ; en) j :f j f1 ^ f2 j 8V • f j skip j f1 ; f2 j f 1 Finite Interval Temporal Logic The key notion of ITL is an interval. An interval ff is considered to be a finite sequence of states ff0 : : : ffk . 1.1 Syntax The syntax of finite ITL is defined in Table1 where z denotes an integer value, A denotes a state integer variable, b denotes a Boolean value, Q denotes a state propositional variable, ig denotes a integer function symbol, bg denotes a Boolean function symbol, V denotes state (integer or Boolean) variable, ei denotes a Boolean or integer expression, h denotes a predicate symbol. 1.2 Semantics Each state ffi is the union of the mapping from the set of integer variables IntVar to the set of integer values Z and the mapping from propositional variables PropVar to set of Boolean values ftt; ffg. Each interval has at least one state. The length jffj of an interval ff0 : : : ffn is equal to n, one less than the number of states in the interval (this has always been a convention in ITL), i.e., a one state interval has length 0. Let ff = ff0ff1ff2 ::: be an interval then • ff0 : : : ffk (where 0 ≤ k ≤ jffj) denotes a prefix interval of ff • ffk : : : ffjffj (where 0 ≤ k ≤ jffj) denotes a suffix interval of ff • ffk : : : ffl (where 0 ≤ k ≤ l ≤ jffj) denotes a sub interval of ff The informal semantics of the most interesting constructs are as follows: • A: if the interval is non-empty then the value of A in the next state of that interval else an arbitrary value. • fin A: the value of A in the last state of the interval. • skip unit interval (length 1). • f1 ; f2 holds if the interval can be decomposed (“chopped”) into a prefix and suffix interval, such that f1 holds over the prefix interval and f2 over the suffix interval. 3 Table 2: Semantics of finite ITL E z (ff) = z EJAK (ff) = ff0(A) EJigK(ie1; : : : ; ien) (ff) = ig(E ie1 (ff);:::; E ien (ff)) EJ A (ff)K = ff1(AJ) K J Kif jffj > 0 J K choose-any-from(Z) otherwise E fin A (ff) = ffjffj(A) EJb (ff)K = b EJQK (ff) = ff0(Q) EJbgK(be1; : : : ; ben) (ff) = bg(E be1 (ff);:::; E ben (ff)) EJ Q (ff)K = ff1(QJ) K J K if jffj > 0 J K choose-any-from(Bool) otherwise E fin Q (ff) = ffjffj(Q) MJ true K(ff) = tt MJh(e1K; : : : ; en) (ff) = tt iff h(E e1 (ff);:::; E en (ff)) MJ:f (ff) = ttK iff not J(MK f (ff) = ttJ) K MJf1 ^K f2 (ff) = tt iff (M f1 (Jff)K = tt) and (M f2 (ff) = tt) MJskip (ffK) = tt iff jffjJ=K 1 J K 0 0 0 MJ8V •K f (ff) = tt iff (for all ff s.t. ff ∼V ff ; M f (ff ) = tt) MJf1 ; f2 (Kff) = tt iff J K J(existsKk; s.t. M f1 (ff0 : : : ffk ) = tt and M f2 (ffk : : : ffjffj) = tt) M f ∗ (ff) = ttJ K iff J K J(existK l0; : : : ; ln s.t. l0 = 0 and ln = jffj and for all 0 ≤ i < n; li < li+1 and M f (ffli : : : ffli+1 ) = tt) J K • f ∗ holds if the interval is decomposable into a finite number of intervals such that for each of them f holds. Let Σ+ denote the set of all finite intervals. Let Expressions denote the set of (integer or Boolean) expressions. Let Val denote the set of integer or Boolean values (Z [ Bool). Let E ::: () denote the meaning function from Expressions × Σ+ to Val. Let FormulaeJ K denote the set of ITL formulae. Let M ::: () denote the meaning function from Formulae × Σ+ to Bool (set of Boolean values, ftt; ffg). Let ff J= ffK0ff1 ::: denote an interval. 0 0 We write ff ∼V ff if the intervals ff and ff are identical with the possible exception of their mappings for the variable V . Let choose-any-from(Val) denote the choice function that selects an arbitrary value from Val. The formal semantics is listed in Table2: 4 1.3 Derived Constructs Frequently used derived constructs are listed in Table3–6. Table 3: Frequently used non-temporal derived constructs false , :true false value f1 _ f2 , :(:f1 ^ :f2) or f1 ⊃ f2 , :f1 _ f2 implies f1 ≡ f2 , (f1 ⊃ f2) ^ (f2 ⊃ f1) equivalent 9V • f , :8V • :f exists Table 4: Frequently used temporal derived constructs f , skip ; f next more , true non-empty interval empty , :more empty interval 3 f , true ; f sometimes 2 f , : 3 :f always w f , : :f weak next 3i f , f ; true some initial subinterval 2i f , :(3i :f ) all initial subintervals 3a f , true ; f ; true some subinterval 2a f , :(3a :f ) all subintervals 2s (f ) , empty _ (2i (f ); skip) all strict initial intervals 3s (f ) , :(2s (:f )) some strict initial interval £(f ) , f ^ 2s (:f ) first occurrence 5 Table 5: Frequently used concrete derived constructs if f0 then f1 else f2 , (f0 ^ f1) _ (:f0 ^ f2) if then else if f0 then f1 , if f0 then f1 else true if then fin f , 2(empty ⊃ f ) final state halt f , 2(empty ≡ f ) terminate interval when keep f , 2a (skip ⊃ f ) all unit subintervals keepnow f , 3i (skip ^ f ) initial unit subinterval ∗ while f0 do f1 , (f0 ^ f1) ^ fin :f0 while loop repeat f0 until f1 , f0 ;(while :f1 do f0) repeat loop f1 7! f0 , 2i (f1 ⊃ fin f0) always followed by f1 $ f0 , 2i (f1 ≡ fin f0) strong followed by Table 6: Frequently used derived constructs related to expressions Y := e , ( Y ) = e assignment Y ≈ e , 2(Y = e) equal in interval Y e , (fin Y ) = e temporal assignment Y gets e , keep (Y e) gets stable Y , Y gets Y stability padded Y , (stable (Y ); skip) _ empty padded expression Y <∼ e , (Y e) ^ padded Y padded temporal assignment intlen (e) , 9I • (I = 0) ^ (I gets I + 1) ^ (I e) interval length 6 1.4 Propositional proof system In Table7 we list the propositional axioms and rules for finite ITL. Table 7: Propositional Axioms and Rules for finite ITL. ChopAssoc ` (f0 ; f1); f2 ≡ f0 ;(f1 ; f2) OrChopImp ` (f0 _ f1); f2 ⊃ (f0 ; f2) _ (f1 ; f2) ChopOrImp ` f0 ;(f1 _ f2) ⊃ (f0 ; f1) _ (f0 ; f2) EmptyChop ` empty ; f ≡ f ChopEmpty ` f ; empty ≡ f BiBoxChopImpChop ` 2i (f0 ⊃ f1) ^ 2(f2 ⊃ f3) ⊃ (f0 ; f2) ⊃ (f1 ; f3) StateImpBi ` w ⊃ 2i w NextImpNotNextNot ` f ⊃ : :f BoxInduct ` f ^ 2(f ⊃ w f ) ⊃ 2 f ChopStarEqv ` f ∗ ≡ (empty _ ((f ^ more); f ∗)) MP ` f0 ⊃ f1; ` f0 ) ` f1 BoxGen ` f0 ) ` 2 f0 BiGen ` f0 ) ` 2i f0 1.5 First order proof system Some axioms for the first order case are shown in Table8. Let V denote a state variable. We denote by f [e = V ] that in formula f expression e is substituted for variable V . Table 8: Some First Order Axioms and Rules for finite ITL. ForallSub ` 8V • f ⊃ f [e = V ]; where the expression e has the same data and temporal type as the variable V and is free for V in f . ForallImplies ` 8V • (f1 ⊃ f2) ⊃ (f1 ⊃ 8V • f2); where V doesn’t occur freely in f1. SubstAxiom ` 2(V1 = V2) ⊃ f ≡ f [V2 = V1]: ExistsChopRight ` 9V • (f1 ; f2) ⊃ (9V • f1); f2; where V doesn’t occur freely in f2.