Non-deterministic temporal logics for general flow systems?

Transcription

1 Non-deterministic temporal logics for general flow systems? J.M. Davoren 1, V. Coulthard 1;2, N. Markey 3, and T. Moor 4 1 Department of Electrical & Electronic Engineering The University of Melbourne, VIC 3010 AUSTRALIA davoren@unimelb.edu.au 2 Computer Sciences Laboratory, RSISE The Australian National University, Canberra ACT 0200 AUSTRALIA vaughan@discus.anu.edu.au 3 Département d Informatique Université Libre de Bruxelles, 1050 BELGIUM markey@lsv.ens-cachan.fr 4 Lehrstuhl für Regelungstechnik Friedrich-Alexander-Universität, Erlangen D GERMANY thomas.moor@rt.eei.uni-erlangen.de Abstract. This paper demonstrates how the constructs of non-deterministic or branching temporal logic can be used to formalize reasoning about a class of general flow systems which include and extend the broad class of evolutionary systems identified by Aubin. We introduce a logic we call Full General Flow Logic, GFL?, which has essentially the same syntax as the well-known Full Computation Tree Logic, CTL?, but generalizes the semantics to general flow models over arbitrary time lines, where a time line is defined to be a linearly ordered set satisfying minimal translation-invariance properties. In particular, the semantics is uniform for discrete-time transition systems, continuous-time differential inclusions or evolutionary systems, and hybrid-time systems such as hybrid automata and impulse differential inclusions. We propose an axiomatic proof system for the logic, establish its soundness w.r.t. the general flow semantics, and discuss prospects for proving completeness and/or decidability of validity for subclasses of general flow models. 1 Introduction Recent work in set-valued dynamical systems, notably by Aubin and co-workers [5, 7, 6], investigates a class of models known as evolutionary systems. These systems are described by a set-valued map S which maps each state x 2 X to the set S(x) of all possible future evolutions from initial state x, where an evolution is a function fl :[0; 1)! X describing a possible state trajectory as a function of time t 2 [0; 1). These systems are non-deterministic in the sense of being not necessarily deterministic: from a fixed initial state, there may be exactly one possible future evolution of the system, there may be more than one such evolution, or there may be none at all. The class of evolutionary systems is simply defined by the condition that the family of sets of evolutions, paramaterized by initial state, must be closed under the operations of taking a suffix of an evolution, and of taking the fusion of the prefix of one evolution with the suffix of another at a state they have in common. It includes as examples the extended solution maps over real time of differential equations with control and/or disturbance inputs, of differential inclusions, of mutational equations on metric spaces, of impulse differential inclusions, and of several other system classes [5, 9]. In the discrete time case, these same closure properties come up in the study of sets computation sequences or branches of computation trees, and are familiar in automata theory and the semantics of temporal? Research support from Australian Research Council, Grants No. DP and No. LX , and from CNRS France, Embassy of France in Australia, & Aust. Academy of Science, Grant ID DEMRIX236.

2 logics [2, 21, 19]. The same closure properties appear again in Willems Behavioural Systems theory [22], under the names time invariance and axiom of state, and as in Aubin s work, the basic objects are functions mapping the entire time line into a value or state space, with the time domain the real numbers or the integers. Working with evolutions defined on the entire time line gives something of a god s eye view of the system, looking forward from now to eternity (and perhaps also backward to negative eternity!) In contrast, the approach we take here is that a path describes a bounded-time segment of a possible evolution of or signal within a system. We take a path in a value space X to be a function fl that starts somewhere, with some value fl(0) = x 2 X, at (relative) initial time 0, and then progresses with an ordering given by a linear ordering L to end somewhere, at a final time point b fl > 0 in L, with a value fl(b fl )=x 0 2 X. For the suffix and fusion-closure properties, the minimal structure we need on a linear order are translation or shift maps, so we take a (future) time line to be a linear order with least element 0 that has such translation structure. The general dynamical systems model we develop here is essentially Aubin s model of an evolutionary system, generalized to arbitrary time lines L, but then also deconstructed, so that the basic objects are bounded length paths. Trajectories of hybrid systems can be naturally represented as functions whose domains are certain subsets of the hybrid time line L = N R + ffi which is linearly ordered lexicographically. The time domain of a hybrid trajectory is not a single interval within L, but rather the union of an ordered sequence of disjoint intervals, with gaps between the time position at the end of the i-th segment, and at the start of the (i +1)-st segment. We develop the theory allowing paths with gappy time domains in this sense, and in virtue of the deconstruction to bounded length paths, we can describe cleanly how the paths of a hybrid time system are composed out of the paths of its continuous time and discrete time components. A further source of motivation comes the work of Aubin and co-workers in Viability Theory [4, 9, 5]. A central concept is of an evolution being viable in K until capturing target C, which means that the path starts at a state in K,andeither remains in K for all time, or it reaches C in finite time, and remains within K until it does so. From the perspective of formal methods in computer science, this notion is crying out to be formalized in a temporal logic with an until operator. In this paper, we head that cry. We introduce a logic we call Full General Flow Logic, GFL?, which has essentially the same syntax as the well-known Full Computation Tree Logic, CTL?, developed for discrete time transition system models, but here we generalize the semantics to general flow models over arbitrary time lines. Having done the deconstruction to bounded length paths, we then have to go through a completion process in order to gain access to the maximally extended paths of a system, so that in quantifying over all the paths of a system that remain in one set until they reach a target set, we can take back the god s eye view, and not be distracted by short paths that would reach the target set if only they were extended further. We propose an axiomatic proof system for the logic, establish its soundness w.r.t. the general flow semantics, and discuss prospects for proving completeness and/or decidability of validity for subclasses of general flow models. The paper is organized as follows. Section 2 covers preliminary material on set-valued maps, while Section 3 develops some basic theory of linear orders and paths in a value space with bounded time domains. We introduce general flow systems in Section 4, and give instances of such systems in discrete, continuous and hybrid time. In Section 5, we give an infinitary completion construction to access maximally extended paths, and identify the relationship between the class of systems developed here, and Aubin s evolutionary systems and Willems behavioural systems. The syntax and semantics of GFL? is presented in Section 6, and we briefly illustrate the expressive power and utility of the formalism. An axiomatization is presented in Section 7, and soundness is proved with respect to arbitrary general flow models, and in Section 8, we discuss the road to completeness results for various classes of general flow models, and the possibilities for decidability of some of these classes.

3 2 Preliminaries: relations and set-valued maps On notation, when we write Y ρ X for sets X; Y, we will mean Y is a proper subset of X, andso := [0; 1) and N Y X iff Y ρ X or Y = X. We write 2 X for the set of all subsets of X,andR + ffi for the non-negative reals, and natural numbers, respectively. We will write r : X ; Y to mean r : X! 2 Y is a set-valued map, with set-values r(x) Y for every x 2 X (possibly r(x) =?), for X; Y arbitrary sets. We use the same notation to mean r X Y is a relation; that is, we don t distinguish between a set-valued map and its graph. Let [ X ; Y ] := 2 X Y denote the set of all maps r : X ; Y from X to Y.Theset[ X ; Y ] is partially ordered by the subset relation, so r r 0 iff r(x) r 0 (x) for all x 2 X, and this partial order has a least element?, the empty map. Every map r : X ; Y has a relational converse r 1 : Y ; X given by: x 2 r 1 (y) iff y 2 r(x). Thedomain of a set-valued map is dom(r) := fx 2 X j r(x) 6=?g,andtherange is ran(r) :=dom(r 1 ) Y.Amapr : X ; Y is total on X if dom(r) =X. For maps r 1 : X ; Y and r 2 : Y ; Z, we write their sequential composition in left-to-right word order, as r 1 ffi r 2 : X ; Z, definedby (r 1 ffi r 2 )(x) :=fz 2 Z j (9y 2 Y ) y 2 r 1 (x) ^ z 2 r 2 (y) g. Thus the composition r 1 ffir 2 6=? iff ran(r 1 ) dom(r 2 ) 6=?,anddom(r 1 ffir 2 )=dom(r 1 ) iff ran(r 1 ) dom(r 2 ). Among the class of all set-valued maps, we distinguish several sub-classes of deterministic or single-valued maps. We will write (as is standard) r : X! Y to mean r is a function that is total on domain X, with range contained in Y, and values written r(x) = y (rather than r(x) = fyg). Let [ X! Y ] denote the set of all functions from X to Y. We also distinguish partial functions, and write r : X 99KY to mean that on its domain dom(r) X, r is single-valued; let [ X 99KY ] denote the set of all such maps. For partial functions, we will also use the single-valued notation r(x) = y when x 2 dom(r), and write r(x) = UNDEF when x =2 dom(r). So as sets of maps, [ X! Y ] [ X 99KY ] [ X ; Y ], and the inclusions are proper whenever X and Y have more than one element. 3 Time lines and paths Let (L; <; 0) be a linear order with least element 0 and no largest element, and let 6 be the reflexive closure of <. We use usual notation for bounded intervals in L: for elements a; b 2 L, theset [a; b] :=fl 2 L j a 6 l 6 bg is a closed bounded interval in L, and(a; b) :=fl 2 L j a<l<bg is an open interval in L; similarly for half-open/half-closed bounded intervals [a; b) and (a; b]. For right unbounded intervals, we write [a; 1) :=fl 2 L j a 6 lg and (a; 1) :=fl 2 L j a<lg. Given two linear orders (L; <) and (L 0 ;< 0 ), a function g : L! L 0 is called: g(k); ffl strictly order-preserving if (8l; k 2 L), l<k implies g(l) < 0 ffl an order embedding if it is strictly order-preserving (hence injective), and the partial function g 1 : L 0 99KL is also strictly ordering-preserving on dom(g 1 )=ran(g); ffl an order isomorphism if it is a surjective order embedding (and hence bijective). Definition 1. Let (L; <; 0) be a linear order with least element 0 and no largest element. We call L a (future) time line if L is shift invariant, in the sense that if for each a 2 L, there exists an order isomorphism ff a :[a; 1)! L, with inverse ff +a := (ff a ) 1 : L! [a; 1), and ff 0 = id L.We call the functions ff a left a-shift maps, and the inverses ff +a right a-shift maps. The examples of linear orders of obvious interest are the discrete time line N, andthedense continuum time line R + ffi, both with their usual orderings with respect to which they are the nonnegative half of linearly ordered abelian groups under addition, Z and R respectively. The group operation trivially gives shift invariance: ff a (l) =l a for l 2 [a; 1), andff +a (l) =l + a.

4 Trajectories of hybrid systems will be represented as functions whose domains are certain subsets of the hybrid time space N R + ffi which is linearly ordered lexicographically 1 :i.e.(i; t) < lex (j; s) iff i<jor i = j and t<s. The least element is 0 := (0; 0) and although this ordering does not admit any natural addition operation to make it a linearly ordered semi-group, it can be shown to be shift invariant by selectively using the addition operations in the two coordinates separately. For each a =(k; r) 2 L,defineff a :[a; 1)! L and ff +a : L! [a; 1) by ρ ff a (i; t) = (0;t r) if i = k (i k; t) if i>k ff +a (i; t) = ρ (k; t + r) if i =0 (i + k; t) if i>0 for l = (i; t) 2 [a; 1) and l = (i; t) 2 L, respectively. It is readily verified that both maps are order-preserving, and that ff a (ff +a (l)) = l for all l 2 L, andff +a (ff a (l) =l for all l 2 [a; 1). Observe that we can define a binary operation on L = N R + ffi, simply by taking a Φ b := ff +b (a), and the operation Φ is associative and has 0 as the left and right identity (but it is not commutative). However, we do not have a linearly ordered semi-group because Φ does not strictly preserve the linear order: we can have a< lex b but l Φ a = l Φ b. Takea =(k; r), b =(k; r 0 ) with r<r 0,and l =(i; t) with i>0,soff +a (l) =(i + k; t) =ff +b (l). For any linear order (L; <), define a partial function succ L : L 99KL,fora; b 2 L, by: succ L (a) = b, [ a<b ^ (8l 2 L) l 6 a _ b 6 l ] (2) Then succ L (a) =UNDEF iff for all b 2 L, ifa<bthen there exists l 2 L such that a<l<b. A linear order L will called everywhere discrete if succ L is a total function (dom(succ L )=L), and L will be called everywhere dense if succ L is defined nowhere (dom(succ L )=?). Thus in their usual orderings, N is everywhere discrete and R is everywhere dense. The full hybrid time line N R + ffi ordered lexicographically is also everywhere dense. In what follows, we will be interested in subsets T ρ L considered as suborderings of L, where relativized to T, the partial function succ T may be defined at some time points in T and not at others, so T is a hybrid of discrete and dense. For the hybrid line L = N R + ffi, finite hybrid trajectories can be represented as functions taking values in a space Q R n, with Q a finite set, and having time domains of the form: [ [ T = [(i; 0); (i; i)] = fig [0; i] (3) i<n where h 0; 1;:::; N 1 i is a finite sequence (of length N) ofinterval durations i 2 R + ffi for i<n. Along a hybrid trajectory, for i < N 1, we interpret the time position (i +1; 0) as the immediate discrete successor of position (i; i) and formally have succ T (i; i) =(i +1; 0), but relative to the underlying ordering of the whole line L, there is a distinct time gap between these two time positions, in the form of the open and continuum length interval ((i; i); (i; 1)).Itis the hybrid case that motivates our more general view of time domains for paths, so that paths in our broader sense consist of an ordered sequence of paths in the narrower sense, each with an interval time domain, where those intervals are ordered and disjoint. Definition 2. Let (L; <; 0) be a time line. Define a bounded time domain in L to be a proper subset T ρ L with least element 0 and a largest element b T such that T is a finite disjoint union of closed intervals in L, oftheformt S = n<n [a n;b n ],wheren 2 N and a 0 =0and a n 6 b n <a n+1 6 b n+1 for 0 6 n < N 1, and b N 1 = b T.LetBT(L) ρ 2 L denote the set of all bounded time domains in L. Also define BI(L) :=ft 2 BT(L) j (9b 2 L) dom(fl) =[0;b] g to be the subset of all bounded initial closed intervals in L. Over any set X 6=? (an arbitrary value space or signal space), definethe set ofl-paths in X, and the set of interval L-paths in X: Path(L; X) := f fl : L 99KX j dom(fl) 2 BT(L) g (4) IPath(L; X) := f fl : L 99KX j dom(fl) 2 BI(L) g 1 The lexicographic ordering is standard in the construction of products of linear orders [20], and on N R + ffi has order type (order-isomorphism class).! (read as!-many copies of. ), where!, and. are, respectively, the order types of N, R, and any left-closed real interval [a; 1) for a 2 R. i<n (1)

5 For fl 2 Path(L; X), define b fl := b dom(fl) to be the largest element in dom(fl), so that fl(0) 2 X is the start-value of fl and fl(b fl ) 2 X is the end-value of fl. First observe that the requirement of a disjoint union in a bounded time domain is not restrictive, because if [a n ;b n ] [a n+1 ;b n+1 ] 6=?, say with b n 2 [a n+1 ;b n+1 ], then we could replace the n- th interval with the merged interval [a n ;b n+1 ], and proceed likewise through the finite sequence to eliminate all overlaps. Proposition 1. 2 If L is a time line, then the set BT(L) of bounded time domains is closed under the following operations: for T;T 0 2 BT(L) and t 2 L, ffl intersection: T T 0 2 BT(L); in particular, [0;t] T 2 BT(L) if t 2 T ; ffl union: T [ T 0 2 BT(L); ffl left t-shift: ff t ([t; b T ] T ) 2 BT(L) if t 2 T ; ffl union with right t-shift: T [ ff +t (T ) 2 BT(L) if t > b T. The subset BI(L) of bounded initial closed intervals is closed under the first three operations, and is also closed under union with right shift restricted to t = b T. We consider various familiar operations on interval paths, extended to our general case of paths with time gaps in their domain. Definition 3. Let L be any time line, and X any value space. We define the following operations on Path(L; X);forfl;fl 0 2 Path(L; X) and t 2 dom(fl), define: ffl prefix ending at t: flj t 2 Path(L; X), where flj t := fl μ [0;t] dom(fl) ; ffl suffix starting at t: tjfl 2 Path(L; X), where: ( t jfl)(l) := fl(ff +t (l)) for all l 2 dom( t jfl) :=ff t ([t; b fl ] dom(fl)) (5) ffl fusion: fl Λ fl 0 2 Path(L; X), provided that fl 0 (0) = fl(b fl ), where: ρ (fl Λ fl 0 fl(l) if l 2 dom(fl) )(l) := fl 0 (ff bfl (l)) if l 2 ff +bfl (dom(fl 0 )) so dom(fl Λ fl 0 )=dom(fl) [ ff +bfl (dom(fl 0 )). (6) For each value x 2 X, define the trivial path x :[0; 0]! X by x (0) = x.let : X! Path(L; X) be the function defined by (x) := x, which gives an embedding (injective map) of the value space X into Path(L; X). For any subset of paths P Path(L; X), wesayp is suffix-closed (prefix-closed) if for all fl 2P and all t 2 dom(fl), the path t jfl 2P(respectively, flj t 2P). We say P is fusion-closed if for all fl;fl 0 2Pand all t 2 dom(fl), iffl(t) =fl 0 (0) then flj t Λ fl 0 2P. The well-defined-ness of these operations on paths is a straightforward consequence of Proposition 1; likewise, the restricted subset IPath(L; X) of (usual) interval paths is also closed under these operations. Observe that in Path(L; X), the trivial path x functions as a point-wise identity with respect to fusion: x Λ fl = fl iff fl starts at value x = fl(0), andfl Λ x = fl iff fl ends at value x = fl(b fl ). And on its domain, the partial operation Λ :(Path(L; X) Path(L; X)) 99KPath(L; X) is associative. Definition 4. Let (L; <; 0) be a time line and X a value space. Define a partial order on Path(L; X) from the underlying linear order on L (re-using notation) by: fl<fl 0 iff fl ρ fl 0 and t<t 0 for all t 2 dom(fl) and t 0 2 dom(fl 0 ) dom(fl) If fl<fl 0, we say the path fl 0 is a (proper) extension of fl. 2 The proofs of most results will be found in the optional (over-length) Appendix.

6 In addition to subset inclusion of paths (considered as subsets of L X), the path extension ordering fl<fl 0 requires that all the new time points in dom(fl 0 ) dom(fl) come after all points in dom(fl), and so lie in the interval (b fl ;b fl 0]. In general, the path extension ordering < is a proper subordering of the subset relation, but when restricted to the set IPath(L; X) of interval paths, it collapses to the subset relation. This is because if dom(fl) =[0;b fl ] and dom(fl 0 )=[0;b fl 0] are both interval time domains, then fl ρ fl 0 will imply that b fl <b fl 0, so the additional ordering requirement will be satisfied automatically. The following proposition characterizes the path extension partial order in terms of the fusion operation. Proposition 2. Let L be any time line, and X any value space. Then for all fl;fl 0 2 Path(L; X),the following are equivalent: (i) fl < fl 0 ; (ii) fl is a proper prefix of fl 0 ; i.e. fl = fl 0 j b fl and dom(fl) < dom(fl 0 ); (iii) fl 0 = fl Λ fl 00 for some fl 00 2 Path(L; X) with fl 00 6= x and fl 00 (0) = fl(b fl ) We now return to the hybrid time line L = N R + ffi for a more detailed discussion of some of its paths. Define DS := IPath(N; R + ffi ) to be the set of all (finite) duration sequences; i.e. 2 DS is a finite sequence of values i := (i) 2 R + ffi for i < N for N = length( ) 2 N. For duration sequences 2 DS,defineHT( ) to be the hybrid time domain determined by ; define HT ρ BT(L) to be the set of all hybrid time domains; and over any value space X 6=?, define HPath(X) ρ Path(N R + ffi ;X) to be the set of all hybrid paths over X, as follows: S HT( ) := i<length( ) [(i; 0); (i; i)] HT := f HT( ) 2 BT(L) j 2 DS g HPath(X) := f fl 2 Path(N R + ffi ;X) j dom(fl) 2 HT g (7) For hybrid paths fl 2 HPath(X), definetheduration sequence of fl by ds(fl) = iff dom(fl) = HT( ) for 2 DS, and define the discrete length of fl by dl(fl) := length(ds(fl)) 2 N. Also define the total duration of fl by td(fl) := P i<dl(fl) i. Every hybrid path fl can be viewed as a finite discrete sequence, of length dl(fl), of real time interval paths fl i 2 IPath(R + ffi ;X). Making this precise, let ds(fl) = and for each i<dl(fl), definethei-thpathsegmentfl i :[0; i]! X by fl i (t) := fl(i; t) for all t 2 [0; i]. We have thus established a natural bijection between the path sets HPath(X) and IPath(N ; IPath(R + ffi ;X)) The following proposition characterizes the partial order relation of extension on hybrid paths induced by the lexicographic ordering on N R + ffi. Proposition 3. For all fl;fl 0 2 HPath(X), fl 6 lex fl 0 iff dl(fl) 6 dl(fl 0 ) and (8i <N := dl(fl) 1) fl i = fl 0 i and fl N 6 fl 0 N With hybrid paths, we have to deal with the product structure on the time line. We also encounter product structure on the value space. Let ß X : (X Y )! X and ß Y : (X Y )! Y be the standard coordinate projection functions on a product of sets X Y. These can be lifted to give projection functions on paths ß X : Path(L; X Y )! Path(L; X) and to projections on functions ß X : [ L! (X Y )]! [ L! X ], by defining (ß X )(t) := ß X ( (t)) for t 2 dom( ) and 2 Path(L; X Y ) or : L! (X Y ); and symmetrically for ß Y in the other coordinate. 4 General flow systems The general dynamical system model we develop here is essentially Aubin s model of an evolutionary system, generalized to arbitrary time lines L, but also deconstructed, so that the basic objects are bounded length paths, having dom(fl) [0;b fl ].

7 Definition 5. Let (L; <; 0) be a time line, and let X 6=? be an arbitrary value space. A general flow system over X with time line L is a map Φ : X ; Path(L; X) satisfying, for all x 2 dom(φ), for all fl 2 Φ(x), and for all t 2 dom(fl): (GF0) initialization: (GF1) suffix-closure: fl(0) = x tjfl 2 Φ(fl(t)) (GF2) fusion-closure: flj t Λ fl 0 2 Φ(x) for all fl 0 2 Φ(fl(t)) ffl Φ has interval paths if ran(φ) IPath(L; X); ffl Φ has hybrid paths if ran(φ) HPath(X) and L = N R + ffi ; ffl Φ is reflexive if x 2 Φ(x) for all x 2 dom(φ); ffl Φ is blocked at x if Φ(x) =f x g, and is non-blocking if it is not blocked at any x 2 X; ffl Φ is prefix-closed if flj t 2 Φ(x) for all x 2 dom(φ), fl 2 Φ(x) and t 2 dom(fl); ffl Φ is deterministic if for all x 2 dom(φ), the path set Φ(x) is linearly ordered by <. In terms of Behavioural Systems theory [22], the suffix-closure condition (GF1) correspondsto the time invariance property, while the fusion-closure condition (GF2) corresponds to the so-called axiom of state principle, that the state should contain sufficient information about the past so as to determine the future behaviour, because the various possible extensions of a trajectory at time t are exactly those which would have been possible if we had observed only the state at time t, and not the past of the trajectory prior to that point. Before proceeding to examples of general flow systems, we identify some basic facts, including characterizing the non-blocking property in terms of extendibility of paths. Proposition 4. Let (L; <; 0) be a time line, let X 6=? be a value space, and let Φ : X ; Path(L; X) be a general flow system over X with respect to L. Then: (1:) The set dom(φ) X is closed under reachability by Φ-paths: if x 2 dom(φ) and fl 2 Φ(x), and t 2 dom(fl),thenfl(t) 2 dom(φ). (2:) Φ is reflexive iff Φ is prefix-closed. (3:) Φ is non-blocking iff for all x 2 dom(φ) and fl 2 Φ(x), there exists fl 0 2 Φ(x) : fl<fl 0. Example 1. Let L be any time line, X 6=? any space, and let P Path(L; X) be any suffixclosed and fusion-closed set of paths. Then define a general flow system Φ P : X ; Path(L; X) by Φ P (x) := ffl 2 P j fl(0) = xg. Sodom(Φ P ) = fx 2 X j (9fl 2 P) fl(0) = xg, and ran(φ P )=P, andφ P is non-blocking iff P is unbounded w.r.t. the path extension ordering, in the sense that for every fl 2P, there exists fl 0 2Psuch that fl<fl 0. Example 2. If g : L 1! L 2 is an order embedding, and Φ : X ; Path(L 1 ;X) is a general flow system, then the map Φ g : X ; Path(L 2 ;X) is also a general flow system, where: Φ g (x) := f 2 Path(L 2 ;X) j (9fl 2 Φ(x))[ dom( ) =g(dom(fl)) ^ (8t 2 dom( )) (t) =fl(g ΛΨ (8) 1 (t)) for x 2 dom(φ g )=dom(φ). IfΦ is non-blocking, or is deterministic at x, thensoisφ g. Example 3. A(basic)state transition system is a structure (X; R) where X 6=? is the state space, and R : X ; X is any set-valued map (the one-step transition relation). The map R determines a general flow system with interval paths over the discrete time line L = N: Φ R (x) := ffl 2 IPath(N;X) j fl(0) = x ^ (8i <b fl 1) fl(i +1)2 R(fl(i)) g (9) From the definition, we have dom(φ R )=X because x 2 Φ R (x) for all x 2 X. It is easily verified that Φ R are suffix-closed, fusion, and prefixes, and that Φ R (x) = f x g iff x =2 dom(r). Hence the system Φ R is non-blocking iff the map R is total on X (dom(r) =X), and the system Φ R is deterministic iff R : X 99KX is a partial function.

8 Example 4. A differential inclusion is a structure (X; F ) where X R n is a finite dimensional vector space with the Euclidean norm, and F : X ; R n is a set-valued map. Define AC(X) := ffl 2 IPath(R + ffi ;X) j fl absolutely continuous on [0;b fl ] g. Solutions to the differential inclusion _x(t) 2 F (x(t)) starting at a state x are defined by: Sol F (x) := f fl 2 AC(X) j fl(0) = x ^ d dt fl (l) 2 F (fl(l)) almost all l 2 [0;b fl ] g (10) for x 2 dom(sol F ) := cl(dom(f )), the topological closure of dom(f ). It is immediate that Sol F is reflexive and is suffix-closed and fusion, hence is a general flow system with interval paths over L = R + ffi. For the non-blocking property, to ensure the existence of non-trivial solutions from each x 2 cl(dom(f )), one needs to impose some regularity assumptions on the map F [9,4,8]. For example, it suffices to require F : X ; R n to be total on X and Lipschitz, which means there exists a real constant >0 such that for all x; x 0 2 dom(f ),andforally 2 F (x), there exists y 0 2 F (x 0 ) such that ky y 0 k 6 kx x 0 k. An alternative condition sufficient for Sol F to be non-blocking is that F satisfies the Marchaud conditions [4, 9]: (a) F is total on X; (b) the graph of F is closed in X R n ; (c)theimageset F (x) is convex and compact in R n for every x 2 dom(f ); and (d) the growth of F is linear, in that there exists a real constant c>0 such that supfkyk j y 2 F (x)g 6 c(kxk +1)for all x 2 dom(f ). IfF : X! R n is actually a function and the differential equation _x(t) = F (x(t)) has a unique maximal solution : [0;c x )! X starting from each x 2 X, with c x 2 R + ffi [ f1g,thensol F (x) =f j t j t 2 [0;c x ) g is linearly ordered, hence Sol F is deterministic at every x 2 X. Example 5. A hybrid automaton [18, 3, 17, 2, 1] is a structure H =(Q; E; X; F; D; R ) ffl Q is a finite set of control modes; ffl E : Q ; Q is the discrete transition relation; ffl X R n is the continuous state space; ffl F : Q! [ X ; R n ] maps each q 2 Q to a set-valued vector field F (q) :X ; R n with differential inclusion solution map Solq := Sol F (q) : X ; IPath(R + ffi ;X); ffl D : Q ; X maps each q 2 Q to a set D q := D(q) X, the domain of mode q; ffl R : E! [ X ; X ] maps each (q; q 0 ) 2 E to a reset relation R q;q 0 := R(q; q 0 ):X ; X. DefineamapTraj H :(Q X) ; HPath(Q X) by: Traj H (q; x) := f fl 2 HPath(Q X) j (0) fl(0; 0) = (q; x) ^ (8i <dl(fl)) for i := ds(fl)(i) ^ q i := ß Q fl i (0) (1) ß X fl i 2 Solq i (ß X fl i (0)) ^ (2) ran(fl i ) fq i g Dq i ^ (3) if i<dl(fl) 1 then (q i ;q i+1 ) 2 E ^ ß X fl i+1 (0) 2 Rq i ;q i+1 ßX fl i ( i) ΛΛΨ Paths in Traj H are called (finite) trajectories of H. Direct from the definition, we can see that dom(traj H )=D = f(q; x) 2 Q X j x 2 D q g. We will saya hybridautomatonh is well-constituted ifall ofthefollowingconditionshold: (A) Q 6=?, and E : Q ; Q is total; (B) X R n is a non-empty finite dimensional vector space with the Euclidean norm; where: (C) D : Q ; X is total, so D q 6=? for each q 2 Q; (D) for each q 2 Q, domain D q ρ dom(solq) and Solq is not blocked at any point x 2 D q ;and (E) for each transition pair (q; q 0 ) 2 E, the reset relation R q;q 0 : X ; X satisfies the constraints dom(r q;q 0 ) 6=? and dom(r q;q 0 ) D q and ran(r q;q 0 ) D q 0. Any assumptions will do on the set-valued vector fields F (q) :X ; R n, provided they give nontrivial solution paths in Solq on the mode domains D q. (11)

9 Proposition 5. Let H =(Q; E; X; F; D; R ) be a hybrid automaton. Then the trajectory map Traj H :(Q X) ; HPath(Q X) is a general flow system over Q X with time line N R + ffi. If H is well-constituted then Traj H is also prefix-closed. The conditions on H being well-constituted rule out all trivial ways that Traj H may become blocked: Solq is not blocked at any x 2 Dq dom(solq); sincee is total, every q 2 Q has a discrete successor; and for each discrete transition (q; q 0 ) 2 E, thetransition guard set dom(r q;q 0 ) is non-empty and contained in D q, and under the reset relation, the image set ran(r q;q 0 ) lies in D q 0. So in attending to the possibility of blocking, we need to focus only on states x 2 D q that are not in any transition guard set, so no discrete transition is possible from (q; x), and states x 2 D q from which every non-trivial q-solution leaves D q immediately after now, so there are no hybrid trajectories from (q; x) with non-trivial continuous evolution in mode q. Proposition 6. If a hybrid automaton H =(Q; E; X; F; D; R ) is well-constituted, then 3 : Traj H is non-blocking on D iff Out q Grd q for all q 2 Q where Out q := Φ x 2 D q j (8fl 2 Solq(x))(8t 2 dom(fl); t>0)(9s <t) fl(s) =2 D q Ψ Grd q := S q 0 2E(q) dom(r q;q 0 ) Observe that, in virtue of the continuity of paths fl 2 Solq(x), thesetout q is contained in the topological boundary of D q : Out q bd(d q ) := cl(d q ) int(d q ). An immediate corollary of Proposition 6 is that if H is well-constituted then Traj H will be non-blocking on D if for all q 2 Q, either (bd(d q ) D q ) Grd q,orelsed q is open. Example 6. An impulse differential inclusion [9] is a structure H =(X; F; R; J ) ffl X is a finite dimensional vector space; ffl F : X ; X, with differential inclusion solution map Sol F : X ; IPath(R+ ffi ;X); ffl R : X ; X is a reset relation, with guard set dom(r) X; ffl J X is the forced transition set. DefineamapRun H : X ; HPath(X) by: where: Run H (x) := f fl 2 HPath(X) j (0) fl(0; 0) = x ^ (8i <dl(fl)); for i := ds(fl)(i); (1) fl i 2 Sol F (fl i (0)) ^ (2) (8t 2 [0; i)) fl i (t) =2 J ^ Ψ (3) if i<dl(fl) 1 then fl i+1 (0) 2 R(fl i ( i)) (12) As in [9], paths in Run H (x) are called finite runs of H. Direct from the definition, dom(run H )= cl(dom(f ) J) [ R 9 (X J), wherer 9 (W ) := fx 2 X j (9x 0 2 R(x)) x 0 2 Wg, and R 9 (W ) dom(r), foranyw X. The following are regularity conditions on a system H: (A) F is Marchaud (and hence total); (B) the set R 9 (I) is closed, where I := X J; (C) J is either closed or open in X;(D) J dom(r); (E) if J is open (hence I closed) then Sol F is viable in I capturing target G := dom(r), which means that for all x 2 I, there exists a function : R + ffi! X such that (0) = x, and j t 2 Sol F (x) for all t, andeither (s) 2 I for all s 2 R + ffi, or there exists t 2 R + ffi such that (t) 2 G and (s) 2 I for all s 2 [0;t].From Corollary 2 of [9], if H satisfies conditions (A), (B) and (C), then H will satisfy conditions (D) and (E) iff for all x 2 dom(run H )=I [ R 9 (I), every bounded run 2 Run H (x) has an extension that has either infinite total duration or infinite discrete length. In particular, if H satisfies all five conditions then Run H is non-blocking. 3 The sets Outq and the condition Outq Grd q are identified in [18], in a setting where the continuous dynamics are deterministic (F : X! R n is globally Lipschitz continous) and the unique maximal solution from each x 2 X has time domain [0; 1). We turn to infinitary extensions in the next section.

10 5 Infinitary extensions of general flow systems From Proposition 4, we know that if a general flow Φ is non-blocking, then for each x 2 dom(φ) and fl 2 Φ(x), there exists an infinite sequence of paths ffl n g with fl 0 = fl and fl n 2 Φ(x) and fl n < fl n+1 for all n. Motivated by this fact, we view maximal extensions or completions of paths as infinitary objects, arising as limits of infinite ordered sequences of finitary bounded paths. In this paper, we take limits over ordered sequences of order type (ordinal)!, the order type of N, but we want to leave open the possibility, for later work, of dealing with sequences of transfinite length, with ordinals greater than!. 4 We need access to maximal length paths in order to formalize the until construct in temporal logic, but we also want to go to infinity in order to be able to directly compare our class of dynamical systems with those developed in terms of functions over the whole time line L = N or L = R + ffi ; in particular, Aubin s model of an evolutionary system [7, 5], and also Willem s behavioural systems model [22]. Definition 6. For any path set P Path(L; X), define the!-extension of P by: Ext! (P) := f : L 99KX j (9 fl :!! Path(L; X))(8k <!)[ fl k := fl(k) ^ fl k 2P ^ fl k <fl k+1 ^ S = k<! fl ΛΨ k Paths 2 Ext! (P) will be called!-paths of P. Define EPath! (L; X) := Ext! ( Path(L; X)) to be the set of all!-paths of Path(L; X), and likewise for the restricted case of interval paths, define EIPath! (L; X) :=Ext! ( IPath(L; X)). Thus the!-extension Ext! (P) contains all the partial functions : L 99KX that can arise as the union or limit of an!-length strictly extending sequence of paths in the set P. The path extension ordering < on bounded paths induced by the linear order on L can be lifted to!-paths. For paths ; 0 2 Path(L; X) [ EPath! (L; X), we extend Definition 4 to define < 0 if ρ 0 and t<t 0 for all t 2 dom( ) and t 0 2 dom( 0 ) dom( ). Note that if < 0 then dom( ) must be a bounded subset of L. For a general flow system, we want to pick out the subset of!-paths 2 Ext! (Φ(x)) that are maximal in the sense that there are no real paths of the system in Φ(x) extending. Definition 7. Given a general flow system Φ : X ; Path(L; X), define the maximized!-extension of Φ to be the set-valued map E! Φ : X ; EPath! (L; X) given by: (E! Φ)(x) := f 2 Ext! (Φ(x)) j (8fl 2 Φ(x)) Ξ fl g AsystemΦ will be called!-extendible if for every x 2 dom(φ) and every fl 2 Φ(x), there exists 2 (E! Φ)(x) such that fl<. In general, dom(e! Φ) dom(φ), anddom(e! Φ) = dom(φ) iff Φ is!-extendible. In reasoning about the behaviour of an!-extendible system Φ, we can safely replace quantification over all possible paths in Φ(x), with quantification over all maximal!-paths in (E! Φ)(x), and this is a crucial step in developing semantics for temporal logic formulas over general flow models. Proposition 7. For any general flow Φ : X ; Path(L; X), (1:) Φ is!-extendible iff Φ is non-blocking. (2:) If Φ non-blocking, then Φ is deterministic iff E! Φ is a partial function. 4 One reason for doing so is in formalizing a continuation of a Zeno hybrid trajectory: after reaching a Zeno state at discrete stage!, one could progress onwards with continuous evolution and discrete transitions through stages! +1,! +2, :::,towardstage! +!, etc. taking unions at limit ordinals. One would use a hybrid time line L = ν R + ffi where ν>!isacountable limit ordinal, and sequences of order type up to ν.

11 Proof. We prove (1:); part(2:) is straight-forward. From the definition here and Proposition 4, part (3.), it is immediate that if Φ is!-extendible then Φ is non-blocking. For the converse, suppose Φ is non-blocking, and fix x 2 dom(φ) and fl 2 Φ(x). By repeated application of Proposition 4, part (3.), we can form an!-sequence of paths ffl k g with fl 0 := fl and fl k 2 Φ(x) and fl k <fl k+1 ;let := S k<! fl k,sofl <. Then by Definition 6, 2 Ext! (Φ(x)). If 2 (E! Φ)(x), then we are done. Otherwise, =2 (E! Φ), so by Definition 7, there must be a bounded path fl 1 2 Φ(x) such that 0 := <fl 1. Repeating the same argument, there must be an!-path 1 2 Ext! (Φ(x)) such that fl 1 < 1. In this way, we form two sequences, one of actual paths fl n 2 Φ(x), with fl 0 := fl, and the other of!-paths n 2 Ext! (Φ(x)), such that fl n < n <fl n+1 < n+1.ifatastagen, we get an!-path n 2 (E! Φ)(x), then we are done. Otherwise, we have a strictly extending!-sequence ffl n g of paths in Φ(x), so take the limit ο S := k<! fln, and we have ο 2 Ext! (Φ(x)). Again,ifο 2 (E! Φ)(x), then we are done. Otherwise, there must be a bounded path fl 0 2 Φ(x) such that ::: Now suppose, for a contradiction, that this process never ever terminates. Let P Φ(x)[(Ext! (Φ(x)) (E! Φ)(x) be the set of all paths fl 0 2 Φ(x) and all!-paths ο 0 2 Ext! (Φ(x)) (E! Φ)(x) that are produced by iterating this process forever. The resulting set P is then linearly ordered by the path extension relation <, and for every proper subset MρP, there is bounded path fl 0 2P Φ(x) that properly extends every path or!-path in M. Then by Zorn s Lemma, P must have a maximal element, fl 2P.Iffl 2P Φ(x), then we get a contradiction, because we can always do the non-blocking construction to get a ο 0 2 Ext! (Φ(x)) with fl<ο 0.Butiffl 2 (Ext! (Φ(x)) (E! Φ)(x)), thenby definition, there must be a bounded path fl 0 2 Φ(x) with fl<fl 0, so we get a contradiction in both cases. Thus the process must terminate, to produce an!-path 2 (E! Φ)(x)) such that fl<. Ξ We are now in a position to formalize the relationship between Aubin s model of an evolutionary system [7, 5, 6], and the general flow systems defined here. Aubin s systems are over time lines L = R + ffi or L = N, and consist of a map Ψ : X ; [ L! X ], with extended whole line paths : L! X, such that (0) = x for all 2 Ψ (x), andψ is closed under the suffix and fusion operations (the natural extensions to unbounded paths of the operations in Definition 3), in the same sense as which general flow systems with bounded paths are closed under these operations, as required by clauses (GF1) and (GF2) of Definition 5. Proposition 8. Let the time line be either L = N or L = R + ffi, and X 6=?. Ψ : X ; [ L! X ] is an evolutionary system in the sense of Aubin iff there exists an interval path, non-blocking general flow system Φ : X ; IPath(L; X) such that Ψ = E! Φ. Thus evolutionary systems are a subclass of non-blocking general flow systems. For those familiar with Willem s Behavioural Systems model [22], consider the time lines L = N or L = R + ffi,soa behaviour in Willems sense is a set of functions B [ L! X ]. It can be established that B is a time-invariant and complete state behaviour iff there exists an interval path, non-blocking general flow system Φ : X ; IPath(L; X) such that B = ran(e! Φ) 5. Example 7. [5] Define the stationary system : X ; Path(L; X) by (x) :=ffl 2 IPath(L; X) j (8t 2 dom(fl)) fl(t) = xg. Then is deterministic on dom( ) = X, with E! (x) = f# x g where # x : L! X is the constant map # x (t) := x for all t 2 L. Moreover, the total function E! : X! EPath! (L; X) gives an embedding of X into EPath! (L; X). When L = N, thenall!-paths 2 EPath! (N;X) have infinite time domain, so we will always have (E! Φ)(x) =Ext! (Φ(x)) for any non-blocking general flow Φ. When L = R + ffi, and first for interval paths, we know that every!-path 2 EPath! (R + ffi ;X) must have dom( ) =[0;c) for some c 2 R + ffi [f1g. For a non-blocking flow Φ, suppose 2 Ext! (Φ(x)) is any!-path. Then c = 1 automatically gives 2 (E! Φ)(x). Ifc < 1, then we will have a maximally extended!-path 2 (E! Φ)(x) exactly when j t 2 Φ(x) for all t 2 [0;c) but the limit 5 This result will be proved in a separate paper.

12 as t! c of (t) does not exist, or does exist but is not in dom(φ); i.e. has finite escape time. The analysis for the!-extensions of general bounded paths is similar. For the differential inclusion systems in Example 4, the Marchaud conditions on F in [4, 9] constitute a property stronger than non-blocking: they imply that dom( ) =[0; 1) for all 2 (E! Sol F )(x), sothereareno!-paths with finite escape time. When L = N R + ffi is the hybrid time line, we can characterize the maximal!-paths of a nonblocking system as follows. Proposition 9. For any X 6=? and non-blocking general flow Φ : X ; HPath(X), every!-path 2 (E! Φ)(x) is of one of two forms: (i) = fl Λ fl where fl 2 Φ(x) and fl : f0g [0;c)! X with c 2 R + ffi [ f1g and fl S = n<! fl n and each fl n 2 Φ(fl(0; 0)) has dl(fl n )=1, hence has finite discrete length dl( ) = dl(fl) 2 N, and total duration td( ) = td(fl) +c, which may be finite or infinite, depending on c; or (ii) S = n<! P fl n where dl(fl n ) < dl(fl n+1 ), hence has infinite discrete length, and total duration td( ) = n<! td(fl n), which may be finite or infinite; Note that the non-blocking/!-extendibility property here allows for two cases among extensions of hybrid paths that are typically considered pathological : Zeno extended hybrid paths 2 (E! Φ)(x) that have infinite discrete length but finite total duration td( ) < 1; and livelocked extended hybrid paths 2 (E! Φ)(x) that have finite discrete length dl( ) =k +1and finite total duration. For the livelocked case, we use that term because is maximal with the last path segment having dom( k )=[0;c);thisΦ path would die at k-local time t = c (hybrid time (k; c))ifitever got there, but it never does, as for every extension of k to the domain [0;c], the resulting hybrid path is not a path in Φ(x). For a non-blocking hybrid automaton H, the general flow Traj H will exhibit livelock on an extended trajectory 2 (E! Traj H )(x) with dl( ) =k +1 iff the last path segment k :[0;c)! (Q X) is such that, for q k := ß Q k (0) and x k := ß X k (0), there exists a solution path fl 2 Solq k (x k ) such that dom(fl) = [0;b fl ], with b fl > c and fl μ [0;c) = ß X k,that eventually leaves the mode domain D q, but never passes through Grd q on the way: fl(c) =2 D q and fl(t) 2 D q Grd q for all t 2 [0;c). 6 Full General Flow Logic GFL? : syntax and semantics We now turn to the syntax and semantics of a logic we call Full General Flow Logic, GFL?,which generalizes to general flow models the semantics of Full Computation Tree Logic, CTL?, introduced by Emerson and Halpern in 1983 [13, 12] for formalizing reasoning about executions of concurrent programs in discrete time. As in CTL?, we distinguish between so-called state formulae (to be semantically evaluated at states) and path formulae (evaluated along!-paths). The syntax here is a labelled variant of that of CTL?, allowing for semantic models consisting of a finite family of non-blocking general flow systems, indexed by a finite label set. Definition 8. A signature is a pair ± = (Sys; Prp), wheresys is a finite set of system labels, and Prp is a countable set of atomic propositions (or state predicates). The temporal logic language L(±) consists of the set of all formulae ' inductively generated by the grammar: ' ::= p j : ' j ' 1 _ ' 2 j ' 1 U a ' 2 j 8 a ' for atomic propositions p 2 Prp, and system labels a 2 Sys. We further distinguish two subsets of the language L(±): thestate formulae, L sta (±), and path formulae, L pth (±), defined by simultaneous induction as follows: ffl Prp L sta (±) ; ffl if '; ' 1 ;' 2 all in L sta (±) then : ' in L sta (±) and ' 1 _ ' 2 in L sta (±) ; ffl if ' in L pth (±) then 8 a ' in L sta (±), for each system label a 2 Sys ; ffl L sta (±) L pth (±) ;

13 ffl if '; ' 1 ;' 2 all in L pth (±) then : ' in L pth (±) and ' 1 _ ' 2 in L pth (±) ; ffl if ' 1 ;' 2 all in L pth (±) then ' 1 U a ' 2 in L pth (±), for each system label a 2 Sys. It follows that L pth (±) =L(±) and L sta (±) ρl(±). The other propositional (Boolean) connectives and logical constants true, >, andfalse,?, are defined in a standard way, and the path quantifiers 8 a have classical negation duals 9 a, as follows: ' 1 ^ ' 2 ' 1 $ ' 2 def def = : (: ' 1 _ :' 2 ) ' 1! ' 2 = : ' 1 _ ' 2 def = (' 1! ' 2 ) ^ (' 2! ' 1 ) 9 a ' = def :8 a : ' > = def p _:p for any p 2 Prp? = def :> (13) The temporal operators, U a,fora 2 Sys, refer to the!-path space of a non-blocking general flow system Φ a. The formula ' U a ψ, read ' until ψ, fora-type paths, will hold along any!-path of type a if at some time in the future (along ) the formula ψ holds, and at all intermediate times (along ) between now and then, ' holds. The universal quantifier 8 a applied to a path formula produces a state formula, and 8 a (' U a ψ) holds at a state x if every!-path 2 (E! Φ a )(x) satisfies the path formula ' U a ψ. Dually, 9 a (' U a ψ) holds at a state x if there exists an!-path 2 (E! Φ a )(x) which satisfies the path formula ' U a ψ.theuntil construct on paths can be formulated in several distinct ways; we shall take as primitive the strictest version of until, and then define weaker variants in terms of it. In particular, an important difference between the logic here, and the usual presentation of CTL? developed for discrete time paths, is that instead of taking the next-time discrete successor operator as a syntactic and semantic primitive, we use a known method to define next-time in terms of the strictest until [10, 12, 16]. Our semantics covers arbitrary time lines, so in general the immediate successor map is only a partial function on the domain of a path, and in the case of interval paths in a dense time line, may be everywhere undefined. Definition 9. A general flow logic model (logic model, for short) of signature ± = (Sys; Prp) is a structure M =(X; L; S; P), where: ffl X 6=? is the state space, of arbitrary cardinality; ffl L is a function mapping each symbol a 2 Sys to a time line L a := L(a); ffl S is a function mapping each symbol a 2 Sys to an non-blocking general flow system Φ a := S(a) :X ; Path(L a ;X) over the space X, with time line L a ; ffl P : X ; Prp maps x 2 X to a set P(x) Prp of propositions ( satisfied at x inm). The!-path space of a logic modelm is defined by: EPath(M) := [ a2sys EPath! (L a ;X) Let GF(±) denote the class of all general flow logic models of signature ±, and for the case of a single time line L, let GF(L; ±) denote the subclass of all logic models M such that L(a) =L for all a 2 Sys. For the further special case where jsysj = 1 and Prp is countably infinite, let TR(N) denote the subclass of all discrete time logic models M with one general flow Φ R : X ; IPath(N;X) from a total transition relation R : X ; X (also called R-generable models [15, 13, 19]). For the case of deterministic systems, let DF(L) denote the subclass of all logic models where the time line L is the non-negative half of a linearly ordered abelian group, and the one general flow Φ : X ; IPath(L; X) is deterministic, total, interval path, and non-blocking [11]. Definition 10. For ' 2L sta (±) and x 2 X, the relation ' is satisfied at state x in model M, written M;x j= '; and for ' 2L pth (±) and 2 EPath(M), the relation ψ is satisfied along path in model M, written M; j= ψ, are defined by simultaneous induction on the structure of

14 state formulae and path formulae, with p 2 Prp and a 2 Sys: M;x j= p iff p 2 P(x) M;x j= : ' iff M;x 2 ' M;x j= ' 1 _ ' 2 iff M;x j= ' 1 or M;x j= ' 2 M;x j= 8 a ψ iff 8 2 (E! Φ a )(x) : M; j= ψ M; j= ' iff M; (0) j= ' for ' 2L sta (±) M; j= : ψ iff M; 2 ψ M; j= ψ 1 _ ψ 2 iff M; j= ψ 1 or M; j= ψ 2 M; j= ψ1 U a ψ 2 iff 2 EPath! (L a ;X) and 9 t 2 dom( ) with t>0 : M; t j j= ψ 2 and 8s 2 (0;t) dom( ) : M; s j j= ψ 1 For state formulae ' 2 L sta (±), thestate denotation set J ' K M X, and for path formulae ψ 2L pth (±), thepath denotation set J ψ K M EPath(M), are defined by: J ' K M := f x 2 X j M;x j= ' g J ψ K M := f 2 EPath(M) j M; j= ψ g Definition 11. For a logic model M 2 GF(±), for a class of logic models C GF(±), and for ' 2L sta (±) (respectively, ' 2L pth (±)), we say: ffl ' is satisfiable in M, if M;x j= ' for some state x 2 X (respectively, M; j= ' for some 2 EPath(M)); ffl ' is true in M, written M j= ',if M;x j= ' for every state x 2 X, so J ' M K = X (respectively, M; j= ' for every 2 EPath(M), so J ' M K = EPath(M) ); ffl ' is C-valid, written j= C ',if M j= ' for every M 2 C. Define Valid(C) :=fψ 2L(±) j j= C define CTL? := Valid( TR(N)) and GFL? := Valid( GF(±)). ψ g to be the set of all C-valid formulas, and The while...always path operator is a negation dual of until: ' A a ψ def = :(' U a (: ψ)),which can be read as if a type-a path, then while ', always ψ. The operator has the semantics: M; j= ' A a ψ iff if 2 EPath! (L a ;X) then 8 t 2 dom( ) with t>0 : [ if (8s 2 (0;t) dom( )) M; s j j= ' then M; t j j= ψ ] Other one-place operators are definable from the two-place U a and A a,plus> and?, as follows: 3 a ' = def >U a ' type-a paths along which ' will eventually be true in the future Λ a ' = def >A a ' type-a paths along which ' will always be true in the future, plus non-type-a paths fi a ' = def?u a ' type-a paths along which time 0 has a discrete successor, and ' true at that next time a ' = def :' A a? type a-paths along which ' is true immediately after now, plus non-type-a paths. In particular, the semantics for the next-time operator, fi a, come out as: M; j= fi a ' iff for T := dom( ) and 0 2 dom(succ T ) and k := succ T (0) and M; k j j= ' Different versions of until come by varying the constraints on end-values of the bounded paths that satisfy ' until they satisfy ψ : ' U fflffl a ψ def = ' ^ ' U a (' ^ ψ) ' U fflffi a ψ def = ' ^ ' U a ψ (14) Before turning to the axiomatization in Section 7, we briefly illustrate the expressivity of the logic in two areas. Viability Theory: In the recent work of Aubin and co-workers in Viability Theory [4, 9, 5], the key concept is of paths being viable in K until capturing target C. Define: ' V a ψ def = ( >U a > ^ ' ^ Λ a ' ^ Λ a 3 a > ) _ ' U fflffl a ψ (15)