2 Real-Time Systems Real-time systems will be modeled by timed transition systems [7, 15]. A timed transition system S = hv; ; ; T ; L; Ui consists of

Transcription

1 Verication in Continuous Time by Discrete Reasoning? Luca de Alfaro and Zohar Manna Comper Science Department Stanford University Stanford, CA 94305, USA 1 Introduction There are two common choices for the semantics of real-time and hybrid systems. The rst is a discrete semantics, in which the temporal evolion of the system is represented as an enumerable sequence of snapshots, each describing the state of the system at a certain time. The second is a continuous semantics, in which the system evolion is represented by a sequence of intervals of time, together with a description of the system state during each interval. The weakness of the discrete semantics is that the sequence of snapshots does not correspond directly to the physical behavior of the system [6]. Moreover, the trh of temporal logic formulas depends not only on the behavior of the system, b also on the way in which the behavior has been sampled to produce the sequence of snapshots. In other words, the discrete semantics is not sample invariant [12]. What has made the discrete semantics popular, however, is the simplicity and power of the verication rules that can be formulated for temporal logic [7, 17]. The continuous semantics overcomes the weaknesses of the discrete one, b no comparable verication rules have been formulated for it. This paper shows how the advantages of both semantics can be combined by adapting the simple verication rules of the discrete semantics to the continuous one. Specically, we show that if a temporal logic formula has the property of nite variability (FV), its validity in the discrete semantics implies its validity in the continuous one. Thus, verication rules that have as conclusion a FV formula are sound also in the continuous semantics. Most formulas that arise in practice are FV, and we give criteria that help to characterize them. The ability to transfer results between the semantics, together with a deductive system for the continuous semantics, provides a powerful methodology for verifying temporal logic properties of real-time and hybrid systems in the continuous semantics. We rst present the case for real-time systems, and then we extend the results to hybrid systems.? This research was supported in part by the National Science Foundation under grant CCR , by the Defense Advanced Research Projects Agency under contract NAG2-892, and by the United States Air Force Oce of Scientic Research under contract F

2 2 Real-Time Systems Real-time systems will be modeled by timed transition systems [7, 15]. A timed transition system S = hv; ; ; T ; L; Ui consists of the following components. 1. A set V of variables called state variables, where each variable has its own type. 2. A set of states: each state s 2 is a type-consistent interpretation of all the variables in V. We denote by s(x) the value at state s of variable x, for every x 2 V. 3. A set of initial states. has an associated assertion f (V), such that = fs 2 j s j= f g. 4. A set T of transitions, where for all 2 T. Each 2 T has an associated assertion (V; V 0 ) such that = f(s; s 0 ) j (s; s 0 ) j= g, where (s; s 0 ) interprets x 2 V as s(x) and x 0 as s 0 (x). 5. Two sets L, U of minimum and maximum delays of transitions, s.t. 0 l u 1 for all 2 T. We denote by c the enabling condition of transition, dened by c = fs j 9s 0 : (s; s 0 ) 2 g. If s 2 c, we say that transition is enabled in state s. We will assume that transitions are self-disabling: (s; s 0 ) 2! s 0 62 c. The temporal behavior of a real-time system will be represented by discrete traces or by continuous traces, thus giving rise to the discrete and continuous semantics [6, 15, 17]. Denition 1 (discrete trace). A discrete trace d is an enumerable sequence of observations hs 0 ; t 0 i; hs 1 ; t 1 i; hs 2 ; t 2 i; : : :, with s n 2, t n 2 IR + for n 2 IN, such that t 0 = 0, lim n!1 t n = 1, and t n t n+1, (t n = t n+1 ) _ (s n = s n+1 ) for all n 2 IN. A moment of d is simply an integer n 2 IN. In the continuous semantics, the behavior of the system is represented by a mapping from intervals of non-negative real numbers (representing intervals of time) to states of the system. The intervals can overlap at most at the endpoints [6, 8, 2]. Denition 2 (continuous trace). A continuous trace c is a sequence of pairs c : hs 0 ; I 0 i, hs 1 ; I 1 i, hs 2 ; I 2 i, : : :, where I n is an interval of IR (open or closed at the endpoints) and s n 2 for all n 2 IN, such that S n2in I n = IR + and sup I n = inf I n+1 for all n 2 IN. For every n 2 IN, either s n = s n+1, or I n must be right-closed and I n+1 left-closed. A moment of a continuous trace c is a pair (n; t) such that t 2 I n. The moments are ordered in lexicographic order: (n; t) (n 0 ; t 0 ) i n < n 0 _ (n = n 0 ^ t t 0 ). Denition 3 (admission). A timed transition system S admits a trace, written S., if the following conditions are satised. 1. For all n 2 IN, either s n = s n+1 or (s n ; s n+1 ) 2 for a transition 2 T that has been continuously enabled at least for its minimum delay l. 2. Transitions are never continuously enabled for a time longer than their maximum delay.

3 3 Logic and Verication Temporal logic. It is possible to dene linear-time temporal logics for both the discrete and the continuous semantics. In both cases, we will use the same syntax, b the logics will have two dierent sets of models. We denote by TL D the logic dened for the discrete semantics, and by TL C the logic dened for the continuous semantics. Syntax. The logic we consider includes the fure temporal operators 2, 3, U, and the corresponding past operators 2{, 3{, S [7, 16]. However, the logic does not include the next and previous time operators e, e. The logic includes the age function? : for a formula, at any point in time, the term? () denotes for how long in the past has been continuously true [17]. The language also includes the special symbol T, whose value represents the global time. Thus, for any point in time, the equality T =? (true) holds. The logic allows quantication over rigid variables, whose value is constant in time [5]. We use Greek letters, like,, for the rigid variables and Latin letters, like x, y, for the state variables of the system. Semantics. The trh of temporal logic formulas is evaluated with respect to a model and an interpretation. The models of TL D are the discrete traces, the models of TL C are the continuous traces. The interpretation I assigns the value I() to each rigid variable. In both cases, the trh of a formula is evaluated at each moment of a trace. We write I; d j= D n (resp. I; c j= C (n;t) ) to denote that, under the interpretation I, is true at moment n of d (resp. (n; t) of c ). If the interpretation I is omitted, the above statement holds under all possible interpretations. In our notation, d j= D (resp. c j= C ) means that is true in every moment of d (resp. c ): this is called oating semantics, and diers from the anchored semantics of [16], where j= means that is true in the rst moment of. This leads to a simpler axiomatization of TL C. Validity of the formula in TL D (resp. TL C ) is denoted by j= D (resp. j= C ), and the provability relation is denoted by `D (resp. ). We say that a system S satises a formula of TL D (resp. TL C ) if all the traces of S satisfy, and we denote this by S j= D (resp. S j= C ). An Overview of Verication The logics TL D and TL C have dierent sets of valid formulas [18]. From the point of view of system specication, TL C is preferable, as the continuous semantics corresponds more closely to the physical behavior of the system. The following is an example of a formula expressing a TL C -valid property of time that is intuitively obvious, yet is not valid in TL D in fact, its negation is valid in TL D!

4 Example 1. The formula 1 : 8 8 3(T = ) ^ 3(T = )! 3 T = + 2 expressing the density of time is such that j= C 1, j= D : 1. The methods proposed in [7, 15, 17] to verify properties written in TL D rely on two concepts: verication conditions and verication rules. The proof of the soundness of the verication conditions and of the verication rules makes an essential use of the discreteness of the semantics. Therefore, this approach cannot be immediately transferred to TL C. In this paper, we propose a methodology for verifying system properties expressed in the continuous semantics based on two components. The rst component consists of the SFV-theorem, relating the discrete and continuous semantics. The SFV-theorem states that if a temporal formula has the property of syntactic nite variability, or SFV, then S j= D implies S j= C. This will allow us to use existing verication rules of TL D, and then transfer their conclusions to TL C. The second component is a deductive system for TL C that includes axioms abo time. This deductive system can be used to construct a proof of the system specication from the time axioms and from the conclusions of the verication rules. The reasoning in TL C can often be kept to a minimum, if desired. Related work. A related approach to proving S j= C has been proposed in [6] for similar semantics and logics. It suggests rephrasing the property into a form 0 which is suited for the discrete semantics. If the rephrasing is perfect, then S j= D 0 $ S j= C ; otherwise, it is sometimes possible to nd a stronger property 0 such that S j= D 0! S j= C. In [6] it is explained how to rephrase some formulas, and how to approximate others with stronger conditions. However, no methodology is given for verifying properties that have no useful rephrasing or strengthening, and the case of hybrid systems is not considered. 4 Relationship Between the Semantics and SFV-Theorem We say that a trace is a renement of another if it has been obtained by sampling the state of the system more frequently in time [12, 13, 2]. Denition 4 (partitioning function). A partitioning function is a sequence S 0, 1, 2, : : : of adjacent and disjoint intervals of IN covering IN. Formally, n2in n = IN, and max n = min n+1? 1 for all n 2 IN. Denition 5 (renement). A discrete trace 0 d : hs0 0; t 0 0i, hs 0 1; t 0 1i, hs 0 2; t 0 2i, : : : is a renement of d : hs 0 ; t 0 i, hs 1 ; t 1 i, hs 2 ; t 2 i, : : : by the partitioning function, written 0 d d, if t 0 min n = t n and s 0 j = s n for all n 2 IN and j 2 n.

5 A continuous trace c: 0 hr 0 0 ; I0 0 i, hr0 1 ; I0 1 i, hr0 2 ; I0 2 i, : : : is a renement of c: hr 0 ; I 0 i, hr 1 ; I 1 i, hr 2 ; I 2 i, : : : by the partitioning function, written 0 c c, if I n = S j2n I0 j and rj 0 = r n for all n 2 IN and j 2 n. We write 0 if there is some such that 0. If two traces have a common renement, they are said to be sample equivalent [12, 10]. Sample equivalent traces correspond to dierent samplings of the same physical behavior of the system. Denition 6 (sample equivalence). Two discrete (resp. continuous) traces, 0 are sample equivalent, written 0, if there is a discrete (resp. continuous) trace 00 such that 00, Theorem 7. If d 0 d, then S. d i S. 0 d. If c 0 c, then S. c i S. 0 c. We say that a temporal logic is sample invariant if 0 implies I; j= $ I; 0 j=. This means that the logic does not distinguish between sample equivalent traces, which is a desirable property. While it is known that TL D is not sample invariant, it can be proved that TL C is sample invariant. Theorem 8 (sample invariance of TL C ). If 0 c c and j 2 i, then I; 0 c j=c (j;t) $ I; c j= C (i;t) : for all t 2 I i \ I 0 j. If 0 c c, then 0 c j= $ c j=. Next, we dene a translation from continuous to discrete traces that preserves admission and renement. Denition 9 ( : c 7! d ). The translation function associates with c : hr 0 ; I 0 i, hr 1 ; I 1 i, hr 2 ; I 2 i, : : : the discrete trace d : hs 0 ; t 0 i, hs 1 ; t 1 i, hs 2 ; t 2 i, : : : such that, for all n 2 IN, s 2n = s 2n+1 = r n, and: 1. if I n is closed, then t 2n = inf I n, t 2n+1 = sup I n ; 2. if I n is left open, then t 2n = t 2n+1 = sup I n ; 3. if I n is right open, then t 2n = t 2n+1 = inf I n ; 4. if I n is open, then t 2n = t 2n+1 = (inf I n + sup I n )=2. Lemma 10. If S. c, then S. ( c ). If S. c and 0 c c, then S. ( 0 c) and ( 0 c) ( c ). We now dene nite variability, the main property that will be used in establishing the connection between the discrete and the continuous semantics. Denition 11 (nite variability). A formula has the property of nite variability (FV) if for every c and every I there exists a 0 c c such that I; 0 c j= C (i;t) $ I; 0 c j= C (i;t 0 ) for all subformulas of, and for all pairs (i; t), (i; t 0 ) of moments belonging to the same interval I 0 i of 0 c, for all i 0. The trace 0 c is called a ground trace for, c, I.

6 Example 2. The formula 2 : T < 4! 3 (cos 1=(T? 4) > 0) is not FV, as it is not possible to subdivide IR + into a nite number of intervals in which the subformula cos(1=(t? 4)) > 0 has constant value. Also the formula 1 of Example 1 is not FV. In fact, for each value of and it is possible to nd a 0 c such that the subformulas = T, = T and T = ( + )=2 have constant value in the intervals. However, it is not possible to nd a 0 c that has this property for all possible values of and. The interest of nite variability lies in the following theorems, that relate the satisfaction relation of the two semantics. Note that the converse of Theorem 13 is not valid. Theorem 12. If 0 c is a ground trace for, c, I, then for all n 2 IN and for all moments (n; t) of 0 c, I; ( 0 c) j= D 2n $ I; 0 c j= C (n;t) : Theorem 13. If S j= D and is FV, then S j= C. If j= D and is FV, then j= C. Proof. We prove only the rst statement, as the proof of the second is similar. We prove the counterpositive: assume S 6j= C. Then there are I, c and a moment (n; t) of c such that S. c, and I; c 6j= (n;t). As is FV, there is a trace 0 c c that is ground for, c, I. There is a k 2 n such that (k; t) is a moment of c, 0 and from Theorem 8 we have that I; 0 c 6j= (k;t). As 0 c is ground for I,, by Theorem 12 we have I; (c) 0 6j= 2k. Lemma 10 ensures that S. (c), 0 and we nally get S 6j= D, which concludes the proof. Syntactic nite variability. According to Denition 11, to show that a formula is FV it is necessary to give an argument for the existence of a ground trace for each trace and variable interpretation. As this might be complex, we propose instead a syntactic criterion, called syntactic nite variability (SFV), sucient to establish that a formula is FV. To be able to dene SFV, we rst dene well-behaved functions as functions that are analytical (in the calculus sense) along the real axis in some of their variables. If a function f(z) is analytical at the point b, there exists a region of positive radius centered on b in which f(z) can be expanded as a series f(z) = P 1 n=0 c nz n, where the coecients c n do not depend on z. This implies that around each zero of f(z) there is a region of positive radius in which f(z) has no other zero. This, in turn, leads to the well-known theorem of calculus stating that a function that is analytical along the real axis has at most a nite number of zeros in any nite interval of the real axis. Denition 14 (well-behaved function). We say that a function f(z 0 ; : : : ; z n ; v 1 ; : : : ; v k ) : IR n+k+1 7! IR is well-behaved if, for all 0 i n, when considered as a function of z i only, f is analytical along the real axis.

7 Denition 15 (syntactic nite variability). The set of SFV formulas is de- ned inductively as follows. 1. If P is a predicate symbol and u 1, : : :, u n are terms not containing T or?, then P (u 1 : : : u n ) is SFV. 2. If f(z 0 ; : : : ; z n ; v 1 ; : : : ; v k ) is a well-behaved function, then f(t;? ( 1 ); : : : ;? ( n ); c 1 ; : : : ; c k ) = 0 ; f(t;? ( 1 ); : : : ;? ( n ); c 1 ; : : : ; c k ) > 0 are SFV formulas, where c 1, : : :, c k are constants or rigid variables of the logic (thus dierent from T ), and 1, : : : n are formulas not containing T or?. Such SFV formulas are called T -atoms. 3. A formula constructed from SFV formulas using propositional connectives or temporal operators is a SFV formula. 4. If is a SFV formula, and does not occur in any T -atom of, then 8: is a SFV formula. If is SFV, the requirement that f(z 0 ; : : : ; z n ; v 1 ; : : : ; v k ) is well-behaved insures that all the inequalities in, and thus all subformulas of, change trh value at most nitely often within each interval of a continuous trace. We will say that a formula is SFV even if it is not in a form described by the above denition, b can be easily transformed and p in such a form. SFV is a sucient, b not necessary criterion for FV, b it is general enough to encompass many formulas used in the specication and verication of systems. Example 3. The formula 2 of Example 2 is not SFV, as the function cos(1=(x? 4)) is not analytical at x = 4, a point of the real axis. The formula T < 4! 3[T = 4] is SFV. The formula 1 of Example 1 is not SFV, as it quanties over and that appear in the T -atoms T =, T = and T = ( + )=2. Theorem 16 (SFV-theorem). If is SFV, it is also FV. Hence, the following inference rules are sound, with the proviso that is SFV: S `D S D D 0 ; ` ; S ` S (0;0) ; ` D 0 (0;0) : Using syntactic nite variability, we can also establish a connection with propositional temporal logic. Let PTL be the propositional temporal logic of discrete linear time, with temporal operators U, S, 2, 2{, 3, 3{, and based on the oating semantics. This logic is the same as the one presented in [14], except for the absence of the next and previous time operators e, e. Theorem 17 (from PTL to TL C ). Let be a formula of PTL, containing occurrences of the propositional letters p 1, : : :, p n. If j= PTL [p 1 ; : : : p n ], then

8 j= C [ 1 ; : : : ; n ] provided 1, : : :, n are FV. Similarly for initial validity. Therefore, the following inference rules `PTL [p 1 ; : : : p n ] [ 1 ; : : : ; n ] ; `PTL 0 [p 1 ; : : : p n ] (0;0) [ 1; : : : ; n ] with the proviso that 1, : : :, n are SFV, are sound. ; This result is of interest, as deductive systems for PTL are well-studied [14], and ecient decision algorithms for the problem of initial validity exist [9]. 5 Verication in the Continuous Semantic We propose the following methodology for verifying properties expressed in TL C. Suppose that the property to be veried is S j= C, or S j= C (0;0). First, we use the verication rules for the discrete semantics, like the ones proposed in [15, 7, 17], to establish temporal properties of the system that hold in TL D. Let S j= D 0 1, : : :, S j= D 0 k be the conclusions reached. Then, we can use a deductive system for TL D to reason abo S j= D 0 1, : : :, S j= D 0 k. Although TL D does not have a complete axiomatization [5, 1, 2], a deductive system for initial validity in TL D is given in [16]. Results can be transferred from initial validity to global validity using the rules D `D 0 2 `D ; S `0 2 S `D : Let S j= D 0 1, : : :, S j= D 0 m be the conclusions reached by reasoning in TL D. If the formulas 1, : : :, m are SFV, the SFV-theorem enables us to conclude S j= C (0;0) 1, : : :, S j= C (0;0) m. We can then use temporal reasoning in TL C, if necessary, to reach the desired conclusion S j= C or S j= C (0;0). TL C, like TL D, also lacks a complete axiomatization. An (incomplete) deductive system for TL C is presented below. Temporal reasoning in TL C is usually limited to the use of axioms abo the completeness and divergence of time. To prove S j= C, it is often possible to nd a formula 1 ^ : : : ^ n!, where 1 ; : : : ; n are TL C -valid formulas stating the progress of time. Then, if it is possible to prove S j= D 1 ^ : : : ^ n!, the only reasoning necessary in TL C is to use axioms abo time to obtain S j= C. 5.1 Deductive System for TL C Propositional and rst-order axioms. A list of axioms for propositional lineartime temporal logic with U, S has been presented in [3]. The axiomatization given there refers to an irreexive temporal logic, i.e. to a logic in which the fure and the past do not include the present; b it can be adapted to a reexive logic, such as TL C. A list of the adapted propositional axioms is given in [4], along with an entirely classical list of rst-order axioms.

9 T 0 Table 1. Time axiom schemas for TLC. (0;0) T = 0 T =! 2(T ) :!? () = 0 0? () T T! 3(T = ) T = ^ 2{ :[ U (T = )]!? () = 0 (T = + ) ^ S (T = ^? () = )!? () = + Table 2. Inference rules. The rules denoted by (y) have the proviso that must not occur free in. The rules denoted by (x) have the proviso that, 1, : : :, n are SFV. In all of them, if the premise(s) is (are) S-valid, the conclusion is S-valid.! ; (0;0)! ; (0;0) (0;0) 2 2{!! 8 (y) (0;0)! (0;0)! 8 (y) (0;0) 2 2 (0;0) `PTL [p1; : : : pn] [1; : : : ; n] (x) PTL `0 [p1; : : : pn] (0;0) [1; : : : ; n] (x) ` D (x) `D 0 (x) (0;0) Time axioms. The set of axioms listed in Table 1 is used to reason abo time. As usual, we list an axiom to mean. In the case where we claim only the initial validity of the axiom, as in the case of the second one, we write it explicitly. Inference rules. The inference rules we propose are listed in Table An Example of Verication Imprecise oscillator. Consider the system osc, consisting of an oscillator whose state is represented by the variable x. The oscillator can be in any of two states, x = 0 and x = 1, and it can stay in each of them for 3 to 5 seconds before switching to the other one. The oscillator starts in the state x = 0. The system can be described by: f : x = 0 T : f 0 ; 1 g 0 : x = 0 ^ x 0 = 1 l 0 : 3 u 0 : 5 1 : x = 1 ^ x 0 = 0 l 1 : 3 u 1 : 5 :

10 We want to verify that osc satises the following property: The oscillator is in the state x = 1 some time between 5 and 6 seconds after it is started. This property can be written as osc j= C (0;0) 3(x = 1 ^ 5 < T < 6) : (1) Note that the corresponding property in TL D, osc j= D 0 3(x = 1 ^ 5 < T < 6), does not hold. To prove (1), dene the abbreviations : x = 0 ^ [? (x = 0) = T ] ^ T 3 ; : T 5:5! [x = 1 ^? (x = 1) T? 3] : The following implications hold: ^ T = 5:5! x = 1, ^ T = 5:5! x = 1. The proof of (1) proceeds as follows: osc `D 0 W from wait-for rule for TL D (2) osc `D! 2 from invariance rule for TL D (3) osc `D 0 W 2 from (3) by temporal reasoning in TL D (4) osc `D 0 2(T = 5:5! x = 1) from (4) by temporal reasoning in TL D (5) osc (0;0) 2(T = 5:5! x = 1) from (5), as it is SFV (6) osc (0;0) 3(T = 5:5) from the time axioms of TL C (7) osc (0;0) 3(T = 5:5 ^ x = 1) from (6), (7) by temp. reas. in TL C (8) osc (0;0) 3(x = 1 ^ 5 < T < 6) from (8). (9) 6 Hybrid Systems The results obtained for real-time systems can be transferred to hybrid systems, by giving a new denition of SFV to account for the fact that the state of the system can change continuously in time. We will model hybrid systems by phase transition systems derived from those of [15, 17]. A phase transition system (PTS) S = hv; ; P; T ; L; U; i consists of the following components. 1. A set V of state variables. V is partitioned into two disjoint subsets: V d and V c. The variables in V d are called discrete variables, they can be of any type and they can change only in an instantaneous way. The variables in V c are called continuous variables, have the real numbers as domain, and can change both in an instantaneous and in a continuous way.

11 2. A set of states: each state is a type consistent interpretation of the variables. Again, we write s(x) to denote the interpretation of x 2 V at state s. We write sj Vd, sj Vc to denote the restrictions of the interpretation s to only discrete and only continuous variables, respectively. 3. A set of initial states. 4. A set P of phases. P is partitioned into disjoint subsets, one for each variable in V c. The subset corresponding to x 2 V c will be denoted by P x. 5. A set T of transitions, where for each 2. T is partitioned into two disjoint subsets T i and T d. The set T i is the set of immediate transitions, that must be execed no later than the time at which they become enabled. The set T d is the set of delayed transitions, whose enabling does not depend on the continuous variables. 6. Two sets L, U of minimum and maximum delays for the transitions in T d. Phases. For each x 2 V c, every phase } 2 P x consists of an enabling condition c } and a phase function f } : 7! IR. The phase } is used to represent a dierential equation governing x: the intended meaning is that if c } holds, then _x = f } (s) whenever no transition is taken. The enabling condition c } can depend on the discrete variables only: formally, for all s; s 0 2, sj Vd = s 0 j Vd! (s 2 c } $ s 0 2 c } ). We say that a phase } is linear if the function f } is a linear function of the continuous variables. It is not required that f } is linear in the discrete variables. Transitions. We dene the enabling condition c of a transition 2 T as the set of states that have a successor according to the transition, or c = fs j 9s 0 [(s; s 0 ) 2 ]g. Transitions must be self-disabling, that is, (s; s 0 ) 2! s 0 62 c. If an immediate transition becomes enabled at time t, it has to be taken or disabled by some other transition before time advances past t. There are no restrictions on the enabling conditions of immediate transitions: they can depend on both the continuous and the discrete part of the state. Each delayed transition 2 T d has an associated minimum delay l 2 L and maximum delay u 2 U, with 0 l u 1. After is enabled, it can wait for a time t d : l t d u before being taken. The enabling condition of delayed transitions can depend only on the discrete component of the state: for all s; s 0 2, sj Vd = s 0 j Vd! (s 2 c $ s 0 2 c ). Continuous semantics. The continuous semantics of hybrid systems is dened in terms of hybrid traces. They dier from the continuous traces used for realtime systems, as the value of the continuous variables can change in the intervals composing the trace. Denition 18 (hybrid trace). A hybrid trace h is a sequence of pairs h : hg 0 ; I 0 i, hg 1 ; I 1 i, hg 2 ; I 2 i, : : :, where I n is an interval of IR and g n : I n 7!, for all n 2 IN. The intervals can overlap at most at the endpoints, and they cover all IR + : S n2in I n = IR +, and sup I n = inf I n+1 for all n 2 IN.

12 Each function g n gives the state of the system g n (t) 2 corresponding to time t 2 I n. The value of variable x at time t of interval I n is thus g n (t)(x). The discrete variables must have constant value in an interval: for all n 2 IR, all t 1 ; t 2 2 I n, and all x 2 V d, g n (t 1 )(x) = g n (t 2 )(x). Moreover, for all x 2 V d, n 2 IN and t 2 I n, t 0 2 I n+1, we require that either g n (t)(x) = g n+1 (t 0 )(x), or that I n is right-closed and I n+1 is left-closed. Denition 19 (admission, hybrid traces). A PTS S admits a trace h : hg 0 ; I 0 i, hg 1 ; I 1 i, hg 2 ; I 2 i, : : :, written S. h, if the following conditions are satised: 1. All phases are respected: for each x 2 V c and n 2 IN, if inf I n < sup I n, there is a } 2 P x such that, for all t 2 I n : g n (t) 2 c } ; f } (g n (t)) = d g n(u)(x) du ; (10) u=t where it is assumed that for inf I n < t < sup I n the derivative dg n (u)(x)=du is dened in u = t, and for u = inf I n, u = sup I n, the left-hand and righthand derivatives, respectively, exist. 2. No immediate transition is skipped: for all n 2 IN, 2 T i, and inf I n t < sup I n, it is g n (t) 62 c. 3. All discrete state changes are due to a transition: for all n 2 IN, either g n (sup I n ) = g n+1 (inf I n+1 ) or there is 2 T such that? gn (sup I n ); g n+1 (inf I n+1 ) 2 : If such a is a delayed transition, we also require that it has been continuously enabled for at least l. 4. Delayed transitions are never continuously enabled for a time longer than their maximum delay. Discrete semantics. The discrete semantics of hybrid systems is dened in terms of discrete traces, which are dened as in Denition 1 except that the last clause is replaced by (t n = t n+1 ) _ (s n j Vd = s n+1 j Vd ) for all n 2 IN. The denition of admission of discrete traces is given in the next section. Temporal logic. The temporal logic corresponding to discrete semantics is denoted by TL D, as before. The logic corresponding to the hybrid semantics will be denoted by TL H, its satisfaction relation will be denoted with j= H, and its provability relation with `H. 7 From Discrete to Continuous Validity Renement of discrete traces was dened in Denition 5. Renement of hybrid traces is dened as follows.

13 Denition 20 (renement, hybrid traces). A hybrid trace h : hg 0 ; I 0 i, hg 1 ; I 1 i, hg 2 ; I 2 i, : : : is a renement of 0 h : hg0 0 ; I0 0 i, hg0 1 ; I0 1 i, hg0 2 ; I0 2i, : : : by the partitioning function, denoted 0 h h, if I i = S j2i I0 j, and for every i; j 2 IN such that j 2 i, it is 8t 2 Ij 0 gj (t) = g i (t). Sampling equivalence is then dened as before. We then dene a translation function from discrete traces to hybrid traces. A discrete trace does not encode all the information required to reconstruct a hybrid trace: it contains the information abo the state at the beginning and at the end of each closed interval, b it does not represent the evolion of the state in the interior of the interval. Therefore, to a single discrete trace will correspond all the hybrid traces that agree with the discrete one at the endpoints of the intervals. Denition 21 ( : d 7! h ). The translation function associates to d : hs 0 ; t 0 i, hs 1 ; t 1 i, hs 2 ; t 2 i, : : : a set of hybrid traces ( d ), such that, for every h : hg 0 ; I 0 i, hg 1 ; I 1 i, hg 2 ; I 2 i, : : : 2 ( d ), and for every n 2 IN, it is min I n = t n, max I n = t n+1, g n (min I n ) = s n, g n (max I n ) = s n+1. It is not possible to check directly whether a discrete trace respects the phases of a system, as in (10) for hybrid traces. Therefore, the denition of admission is indirect: a PTS S admits a discrete trace d if there is a hybrid trace corresponding to d admitted by S. This is the implicit meaning of the denition given in [17]. Denition 22 (admission, discrete traces). A PTS S admits trace d, written S. d, if there is a h 2 ( d ) such that S. h. a discrete In dening nite variability for hybrid systems, it is essential to dene it with respect to a given PTS, so that the behavior of the continuous variables is constrained by the phases of the PTS. It is then possible to prove the corresponding of Theorem 16. Denition 23 (hybrid nite variability). A formula is hybrid nite variability (HFV) with respect to a PTS S if for every h admitted by S and every I, there exists a 0 h h such that: I; 0 c j= C (i;t) $ I; 0 c j= C (i;t 0 ) for all subformulas of, and for all pairs (i; t), (i; t 0 ) of moments belonging to the same interval Ii 0 of 0 h, for all i 0. Theorem 24. If S j= D and is HFV with respect to S, then S j= H. If j= D and is HFV with respect to S, then S j= H. Similarly for initial validity. The property of hybrid syntactic nite variability (HSFV) provides a sucient criterion for HFV, and is also dened with respect to a PTS S. Denition 25 (simple age function). We say that an age function? () is simple with respect to a system S if its argument contains neither T, nor?, nor occurrences of continuous state variables of S.

14 Denition 26 (hybrid syntactic nite variability). A formula is hybrid syntactic nite variability (HSFV) with respect to a PTS S if the phases of S are linear, and if the formula is constructed in the following inductive way. 1. If P is a predicate symbol and u 1, : : :, u n are terms not containing T,?, nor continuous state variables, then P (u 1 ; : : : ; u n ) is HSFV. 2. If f(z 0 ; : : : ; z n ; v 1 ; : : : ; v k ) is a well-behaved function, then f(b 0 ; : : : ; b n ; c 1 ; : : : ; c k ) = 0 ; f(b 0 ; : : : ; b n ; c 1 ; : : : ; c k ) > 0 are HSFV formulas, provided b 0, : : :, b k are either constants, rigid variables, state variables (continuous or discrete), T or simple age functions, and c 1, : : :, c k are rigid variables or constants. We call these types of HSFV formulas HT -atoms. 3. A formula constructed from HSFV formulas using propositional connectives or temporal operators is a HSFV formula. 4. If is a HSFV formula, and does not occur in any HT -atom of, then 8: is a HSFV formula. The restriction requiring the linearity of the phases is important, and cannot be lifted witho being substited by some other kind of condition insuring that the solions of the dierential equations are well-behaved in the sense of Denition 14. Again, HSFV is a sucient condition for nite variability of a formula with respect to a PTS, providing thus the connection between the discrete and continuous semantics. Theorem 27 (from TL D to TL H ). If is HSFV with respect to a PTS S, then it is SFV with respect to S. Therefore, the inference rules S `D S `H D 0 ; S ` S `H (0;0) ; with the proviso that is HSFV with respect to S, are sound. A deductive system for TL H. Since the denition of syntactic nite variability is now relative to a PTS, we need to modify slightly the deductive system proposed for TL C. We take the same set of axioms, and all the inference rules listed in Table 2 apart from the last four, denoted by (x). Those four are replaced by the following rules: `PTL [p 1 ; : : : p n ] S `H [ 1 ; : : : ; n ] ; `PTL 0 [p 1 ; : : : p n ] S `H (0;0) [ 1; : : : ; n ] ; S `D S `H with the proviso that, 1, : : :, n are HSFV with respect to S. D 0 ; S ` S `H (0;0) ; Acknowledgments. We wish to thank Anuchit Anuchitanukul, Niklaj Bjorner, Arjun Kapur, Amir Pnueli and Henny Sipma for their valuable comments and suggestions.

15 References 1. R. Alur, T. Feder, and T.A. Henzinger. The benets of relaxing punctuality. In Proc. 10th ACM Symp. Princ. of Dist. Comp., pages 139{152, R. Alur and T.A. Henzinger. Logics and models of real time: a survey. In J.W. de Bakker, K. Huizing, W.-P. de Roever, and G. Rozenberg, editors, Real Time: Theory in Practice, Lecture Notes in Comper Science 600, pages 74{106. Springer-Verlag, J.P. Burgess. Axioms for tense logic I. \since" and \until". Notre Dame journal of Formal Logic, 23(4):367{374, October L. de Alfaro and Z. Manna. Continuous verication by discrete reasoning. Technical Report STAN-CS-TR , Stanford University, September J.W. Garson. Quantication in modal logic. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, volume 2, chapter 5. D. Reidel Publishing Company, T. Henzinger, Z. Manna, and A. Pnueli. What good are digital clocks? In W. Kuich, editor, Proc. 19th Int. Colloq. A. Lang. Prog., volume 623 of Lect. Notes in Comp. Sci., pages 545{558. Springer-Verlag, T. Henzinger, Z. Manna, and A. Pnueli. Temporal proof methodologies for timed transition systems. Inf. and Comp., 112(2):273{337, August T. Henzinger, X. Nicollin, J. Sifakis, and S. Yovine. Symbolic model checking for real-time systems. Information and Compation, (111):193{244, Y. Kesten, Z. Manna, H. McGuire, and A. Pnueli. A decision algorithm for full propositional temporal logic. In Comper Aided Verication, 5th International Workshop, Lect. Notes in Comp. Sci. Springer-Verlag, Y. Kesten, Z. Manna, and A. Pnueli. Temporal verication of simulation and re- nement. In Proc. of the REX Workshop "A Decade of Concurrency", volume 803 of Lect. Notes in Comp. Sci., pages 273{346. Springer-Verlag, L. Lamport. What good is temporal logic? In R.E.A. Mason, editor, Proc. IFIP 9th World Congress, pages 657{668. Elsevier Science Publishers (North-Holland), L. Lamport. The temporal logic of actions. Technical Report 79, DEC SRC, Palo Alto, CA, December L. Lamport. Verication and specication of concurrent programs. Technical report, DEC SRC, Palo Alto, CA, O. Lichtenstein, A. Pnueli, and L. Zuck. The glory of the past. In Proc. Conf. Logics of Programs, volume 193 of Lect. Notes in Comp. Sci., pages 196{218. Springer- Verlag, O. Maler, Z. Manna, and A. Pnueli. From timed to hybrid systems. In J.W. de Bakker, C. Huizing, W.P. de Roever, and G. Rozenberg, editors, Proc. of the REX Workshop "Real-Time: Theory in Practice", volume 600 of Lect. Notes in Comp. Sci., pages 447{484. Springer-Verlag, Z. Manna and A. Pnueli. The Temporal Logic of Reactive and Concurrent Systems: Specication. Springer-Verlag, New York, Z. Manna and A. Pnueli. Models for reactivity. Acta Informatica, 30:609{678, A. Pnueli. Development of hybrid systems. In Proceedings of the Third International Symposium on Formal Techniques in Real-time and Fault-tolerant Systems, volume 863 of Lect. Notes in Comp. Sci., Extended abstract.