Extending nuXmv with Timed Transition Systems and Timed Temporal Properties
Abstract
nuXmv is a wellknown symbolic model checker, which implements various stateoftheart algorithms for the analysis of finite and infinitestate transition systems and temporal logics. In this paper, we present a new version that supports timed systems and logics over continuous superdense semantics. The system specification was extended with clocks to constrain the timed evolution. The support for temporal properties has been expanded to include \(\textsc {MTL}_{0,\infty }\) formulas with parametric intervals. The analysis is performed via a reduction to verification problems in the discretetime case. The internal representation of traces has been extended to go beyond the lassoshaped form, to take into account the possible divergence of clocks. We evaluated the new features by comparing nuXmv with other verification tools for timed automata and \(\textsc {MTL}_{0,\infty }\), considering different benchmarks from the literature. The results show that nuXmv is competitive with and in many cases performs better than stateoftheart tools, especially on validity problems for \(\textsc {MTL}_{0,\infty }\).
1 Introduction
nuXmv [1] is a symbolic model checker for the analysis of synchronous finite and infinitestate transition systems. For the finitestate case, nuXmv features strong verification engines based on stateoftheart SATbased algorithms. For the infinitestate case, nuXmv features SMTbased verification techniques, implemented through a tight integration with the MathSAT5 solver [2]. nuXmv has taken part to recent editions of the hardware model checking competition, where it has shown to be very competitive with the stateoftheart. nuXmv also compares well with other model checkers for infinitestate systems. Moreover, it has been successfully used in several application domains both in research and industrial settings. It is currently the core verification engine for many other tools (also industrial ones) for requirements analysis, contract based design, model checking of hybrid systems, safety assessment, and software model checking.
2 Software Architecture
To support the specification and model checking of invariant, \(\textsc {LTL}\) and \(\textsc {MTL}_{0,\infty }\) properties for timed transitions systems, and for the validity checking of properties over dense time semantics, nuXmv has been extended w.r.t. [1] as discussed here after.

We extended the parser to allow the user to choose the time semantics to use for the read model. Depending on the time model some parse constructs and checks are enabled and/or disabled. For instance, variables of type clock and \(\textsc {MTL}_{0,\infty }\) properties are only allowed if the dense time semantics has been specified. By default the system uses the discrete time semantics of the original nuXmv. Notice also that, depending on the specified semantics, the commands available to the user change to allow only the analyses supported for the chosen semantics.

We extended the parser to support the specification of symbolic timed automata (definition of clock variables, specification of urgent transitions and state invariants, etc.). Moreover, we extended the parser to allow for the specification of \(\textsc {MTL}_{0,\infty }\) properties, and we extended the \(\textsc {LTL}\) bounded operators not only to contain constants, but also complex expressions over clock variables. See Fig. 2 for a simple example showing some of the new language constructs.

We extended the symbol table to support the specification of clock variables, and we extended the type checker to properly handle the new defined variables, expression types and language constructs.

We added new modules for the encoding of the symbolic timed automata into equivalent transition systems to verify with the existing algorithms of nuXmv.

We extended the traces for nuXmv to support timed traces (lassoshaped traces where some clock variables may diverge).

We modified the encoding for the loops in the bounded model checking algorithms to take into account that traces may contain diverging variables to allow for the verification and validation of \(\textsc {LTL}\) and \(\textsc {MTL}_{0,\infty }\) properties.
For portability, nuXmv has been developed mainly in standard C with some new parts in standard C++. It compiles and executes on Linux, MS Windows, and MacOS.
3 Language Extensions
Timed Transition Systems. Discretetime transition systems are described in nuXmv by a set V of variables, an initial condition I(V), a transition condition \(T(V,V')\) and an invariant condition Z(V). Variables are introduced with the keyword VAR and can have type Boolean, scalar, integer, real or array. The initial and the invariant conditions are introduced with the keyword INIT and INVAR and are expressions over the variables in V. The transition condition is introduced with TRANS and is an expression over variables in V and \(V'\), where for each variable v in V, \(V'\) contains the “next” version denoted in the language by \(\texttt {\small next}(v)\). Expressions may use standard symbols in the theory associated to the variable types and userdefined rigid functions that are declared with the keyword \(\texttt {\small FUN}\).
The input language of nuXmv has been extended to allow the specification of timed transition systems (TTS), which are enabled by the annotation @TIME_DOMAIN continuous at the beginning of a model description.
Besides the standard types, in the timed case, state variables can be declared of type clock. All variables of type different from clock are discrete variables.
The language provides a builtin clock variable, accessible through the reserved keyword time. It represents the amount of time elapsed from the initial state until now. time is initialized to 0 and its value does not change in discrete transitions. While all other clock variables can be used in any expression in the model definition, time can be used only in comparison with constants.
Initial, transition, and invariant conditions are specified in nuXmv with the keywords INIT, TRANS, and INVAR, as in the discrete case. In particular, TRANS allows to specify “arbitrary” clock resets. Like all other nuXmv state variables, if a clock is not constrained during a discrete transition, its next value is chosen nondeterministically.
Clock variables can be used in INVAR only in the form \(\varphi \rightarrow \phi \), where \(\varphi \) is a formula built using only the discrete variables and \(\phi \) is convex over the clock variables. This closely maps the concept of location invariant described for timed automata: all locations satisfying \(\varphi \) have invariant \(\phi \).
An additional constraint, not allowed in the discretetime case, is introduced with the keyword URGENT followed by a predicate over the discrete variables, which allows to specify a set of locations in which time cannot elapse.
Comparison with Timed Automata. Timed automata can be represented by TTSs by simply introducing a variable representing the locations of the automaton. Note that, in TTS, it is possible to express any kind of constraint over clock variables in discrete transitions, while in timed automata it is only possible to reset them to 0 in transitions or compare them to constants in guards. Moreover, the discrete variables of a timed automaton always have finite domain, while in TTSs, also the discrete variables might have an infinite domain. This additional expressiveness allows to describe more complex behaviors (e.g. it is straightforward to encode stopwatches and comparison between clocks) losing the decidability of the model checking problem.
Specifications. nuXmv ’s support for \(\textsc {LTL}\) has been extended to allow for the use of \(\textsc {MTL}_{0,\infty }\) operators [12] and other operators such as eventfreezing functions [13] and dense version of \(\textsc {LTL}\) X and Y operators. \(\textsc {MTL}_{0,\infty }\) bounded operators extend the \(\textsc {LTL}\) ones of nuXmv to allow for bounds either of the form [c,\(\infty \)), where c is a constant greater or equal to 0, e.g. F[0,+oo) \(\varphi \), or generic expressions over parametric/frozen variables: e.g. F [0, 3+v] \(\varphi \) where v is a frozen variable.
In timed setting, next and previous operators come in two possible versions. The standard \(\textsc {LTL}\) operators X and Y require to hold, respectively after and before, a discrete transition. Dually, X~ and Y~ have been introduced to allow to predicate about the evolution over time of the system. They are always FALSE in discrete steps and hold in time elapses if the argument holds in the open interval immediately after/before (resp.) the current step. The disjunction Open image in new window allows to check if the argument \(\varphi \) holds after the current state without distinction between time or discrete evolution.
The eventfreezing operators at next and at last, written @F~ and @O~, are binary operators allowed in \(\textsc {LTL}\) specifications. The lefthand side is a term, while the righthand side is a temporal formula. They return the value of the term respectively at the next and at the last point in time in which the formula is true. If the formula will [has] never happen [happened] the operator evaluates to a default value.
time_until and time_since are two additional unary operators that can be used in \(\textsc {LTL}\) specifications of timed models. Their argument must be a Boolean predicate over current and next variables. \(\texttt {\small time\_until}(\varphi )\) evaluates to the amount of time elapse required to reach the next state in which \(\varphi \) holds, while \(\texttt {\small time\_since}(\varphi )\) evaluates to the amount of time elapsed from the last state in which \(\varphi \) held. As for the @F~ and @O~ operators if no such state exists they are assigned to a default value.
4 Extending Traces
Timed Traces. The semantics of nuXmv has been extended to take into account the timing aspects in case of superdense time. While in the discrete time case, the execution trace is given by a sequence of states connected by discrete transitions (i.e., satisfying the transition condition), in the superdense time case the execution trace is such that every pair of consecutive states is a discrete or a timed transition. As in the discrete case, discrete transitions are pair of states satisfying the transition condition. As in timed automata, in a timed transition time elapses for a certain amount (referred to as delta_time), clocks increase of the same amount, while discrete variables do not change.
LassoShaped Traces with Diverging Variables. Traditionally, the only infinite paths supported by nuXmv have been those in lasso shape, i.e. those traces which can be represented by a finite prefix \(s_0,s_1,\dots , s_l\) (called the stem) followed by a finite suffix \(s_{l+1}, \ldots , s_{k} \equiv s_l\) (called the loop), which can be repeated infinitely many times. While this representation is sufficient for finitestate systems (because in a finitestate setting if a system does not satisfy an \(\textsc {LTL}\) property, then a lassoshaped counterexample trace is guaranteed to exist), this is an important limitation in an infinitestate context, in which lassoshaped counterexamples are not guaranteed to exist. (As a simple example, consider a system \(M := \langle \{x\}, (x = 0), (x' = x+1)\rangle \) in which \(x \in {\mathbb {Z}}\). Then \(M\not \models \mathbf{G}\mathbf{F}(x = 0)\), but clearly M has no lassoshaped trace). In fact, this is especially relevant for timed transition systems, which, by the presence of the alwaysdiverging variable \(time\), admit no lassoshaped trace.
In order to overcome this limitation, we introduce new kinds of infinite traces, which we call lassoshape traces with diverging variables (to allow also for representing traces with variables whose value might be diverging). We modified the bounded model checking algorithms to leverage on this new representation to then extend the capabilities to find witnesses for a given property. This representation significantly extends the capabilities of nuXmv to find witnesses for violated \(\textsc {LTL}\) and \(\textsc {MTL}\) properties on timed transition systems (see experimental evaluation).
Definition 1
Intuitively, the idea of lassoshaped traces with diverging variables is to provide a finite representation for infinite traces that is more general then simple lassoshaped ones, and which allows to capture more interesting behaviors of timed transition systems.
Example 1
Consider the system \(M := \langle \{y, b\}, \lnot b \wedge y = 0, (b' = \lnot b) \wedge (b \rightarrow y' = y+1) \wedge (\lnot b \rightarrow y' = y)\rangle \). Then one lassoshaped trace for M is given by: \(\pi := s_0, s_1, s_2\), where \(s_0 := \{ b \mapsto \bot , y \mapsto 0 \}\), \(s_1 := \{ b \mapsto \top , y \mapsto 0 \}\), and \(s_2 := \{ b \mapsto \bot , y \mapsto 1 \}\); the trace is lassoshaped with diverging variables considering \(Y := \{ y \}\); the loopback at index 0, and \(f_y(b, y) := b ~?~ y+1 ~:~ y\).
Extended BMC for Traces with Divergent Clocks. The definition above requires the existence of the functions \(f_y\) for computing the updates of diverging variables. In case y is a clock variable, we can define a region \(\llbracket \phi _y\rrbracket \) in which y can diverge (i.e., \(f_y=y+\delta \), where \(\delta \) is the delta time variable).
5 Related Work
There are many tools that allow for the specification and verification of infinite state symbolic synchronous transition systems. Given the focus of this paper, here we restrict our attention to tools supporting timed systems and/or \(\textsc {MTL}\) properties.
Uppaal [15], the reference tool for timed systems verification, supports only bounded variable types and therefore finite asynchronous TTS. Properties are limited to a subset of the branchingtime logic TCTL [16, 17]. LTSmin [18] and Divine [19] are two model checkers that support the Uppaal specification language and properties specified in \(\textsc {LTL}\). RTDFinder [20] handles only safety properties for realtime componentbased systems specified in RTBIP. The verification is based on a compositional computation of an invariant overapproximating the set of reachable states of the system and leverages on counterexamplebased invariant refinement algorithm. The ZOT Bounded Model/Satisfiability Checker [21] supports different logic languages through a multilayered approach based on \(\textsc {LTL}\) with past operators. Similarly to nuXmv, ZOT supports densetime \(\textsc {MTL}\). It leverages only on SMTbased Bounded Model Checking, and is therefore unable to prove that properties hold. Atmoc [22] implements an extension of IC3 [7] and Kinduction [23] to deal with symbolic timed transition systems. It supports both invariant and \(\textsc {MTL}_{0,\infty }\) properties, although for the latter it only supports bounded model checking. CTAV [24] reduces the model checking problem for an \(\textsc {MTL}_{0,\infty }\) property \(\varphi \) to a symbolic language emptiness check of a timed Büchi automata for \(\varphi \).
6 Experimental Evaluation
We compared nuXmv with Atmoc [22], CTAV [24], ZOT [21], Divine [19], LTSmin [18], and Uppaal [25].
7 Conclusions
We presented the new version of nuXmv, a stateofthe art symbolic model checker for finite and infinitestate transition systems, that we extended to allow for the specification of synchronous timed transition systems and of \(\textsc {MTL}_{0,\infty }\) properties. To support the new features, we extended the nuXmv language, we allowed for the specification \(\textsc {MTL}_{0,\infty }\) formulas with parametric intervals, we adapted the model checking algorithms to find for lassoshaped traces (over discrete semantics) where clocks may diverge. We evaluated the new features comparing nuXmv with other verification tools for timed automata, considering different benchmarks. The results show that nuXmv is competitive with and in many cases performs better than stateoftheart tools, especially on validity problems for \(\textsc {MTL}_{0,\infty }\).
References
 1.Cavada, R., et al.: The nuXmv symbolic model checker. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 334–342. Springer, Cham (2014). https://doi.org/10.1007/9783319088679_22CrossRefGoogle Scholar
 2.Cimatti, A., Griggio, A., Schaafsma, B.J., Sebastiani, R.: The MathSAT5 SMT Solver. In: Piterman, N., Smolka, S.A. (eds.) TACAS 2013. LNCS, vol. 7795, pp. 93–107. Springer, Heidelberg (2013). https://doi.org/10.1007/9783642367427_7CrossRefzbMATHGoogle Scholar
 3.Koymans, R.: Specifying realtime properties with metric temporal logic. RealTime Syst. 2(4), 255–299 (1990)CrossRefGoogle Scholar
 4.Ouaknine, J., Worrell, J.: On the decidability of metric temporal logic. In: Proceedings of the 20th Annual IEEE Symposium on Logic in Computer Science. LICS 2005, pp. 188–197. IEEE (2005)Google Scholar
 5.Somenzi, F.: CUDD: Colorado University Decision Diagram package – release 2.4.1Google Scholar
 6.Eén, N., Sörensson, N.: An extensible SATsolver. In: Giunchiglia, E., Tacchella, A. (eds.) SAT 2003. LNCS, vol. 2919, pp. 502–518. Springer, Heidelberg (2004). https://doi.org/10.1007/9783540246053_37CrossRefGoogle Scholar
 7.Bradley, A.R.: SATbased model checking without unrolling. In: Jhala, R., Schmidt, D. (eds.) VMCAI 2011. LNCS, vol. 6538, pp. 70–87. Springer, Heidelberg (2011). https://doi.org/10.1007/9783642182754_7CrossRefGoogle Scholar
 8.Hassan, Z., Bradley, A.R., Somenzi, F.: Better generalization in IC3. In: FMCAD, pp. 157–164. IEEE (2013)Google Scholar
 9.Vizel, Y., Grumberg, O., Shoham, S.: Lazy abstraction and satbased reachability in hardware model checking. In: Cabodi, G., Singh, S. (eds.) FMCAD, pp. 173–181. IEEE (2012)Google Scholar
 10.Claessen, K., Sörensson, N.: A liveness checking algorithm that counts. In: Cabodi, G., Singh, S. (eds.) FMCAD, pp. 52–59. IEEE (2012)Google Scholar
 11.Schuppan, V., Biere, A.: Liveness checking as safety checking for infinite state spaces. Electr. Notes Theor. Comput. Sci. 149(1), 79–96 (2006)MathSciNetCrossRefGoogle Scholar
 12.Alur, R., Feder, T., Henzinger, T.A.: The benefits of relaxing punctuality. J. ACM 43(1), 116–146 (1996)MathSciNetCrossRefGoogle Scholar
 13.Tonetta, S.: Lineartime Temporal Logic with Event Freezing Functions. In: GandALF, pp. 195–209 (2017)Google Scholar
 14.Biere, A., Cimatti, A., Clarke, E.M., Strichman, O., Zhu, Y.: Bounded model checking. Adv. Comput. 58, 117–148 (2003)CrossRefGoogle Scholar
 15.Behrmann, G., David, A., Larsen, K.G.: A tutorial on Uppaal. In: Bernardo, M., Corradini, F. (eds.) SFMRT 2004. LNCS, vol. 3185, pp. 200–236. Springer, Heidelberg (2004). https://doi.org/10.1007/9783540300809_7CrossRefGoogle Scholar
 16.Bouyer, P.: Modelchecking timed temporal logics. In: Areces, C., Demri, S. (eds.) Proceedings of the 4th Workshop on Methods for Modalities (M4M–5). Electronic Notes in Theoretical Computer Science, vol. 1, pp. 323–341. Elsevier Science Publishers, Cachan, March 2009Google Scholar
 17.Bouyer, P., Laroussinie, F., Markey, N., Ouaknine, J., Worrell, J.: Timed temporal logics. In: Aceto, L., Bacci, G., Bacci, G., Ingólfsdóttir, A., Legay, A., Mardare, R. (eds.) Models, Algorithms, Logics and Tools. LNCS, vol. 10460, pp. 211–230. Springer, Cham (2017). https://doi.org/10.1007/9783319631219_11CrossRefGoogle Scholar
 18.Kant, G., Laarman, A., Meijer, J., van de Pol, J., Blom, S., van Dijk, T.: LTSmin: highperformance languageindependent model checking. In: Baier, C., Tinelli, C. (eds.) TACAS 2015. LNCS, vol. 9035, pp. 692–707. Springer, Heidelberg (2015). https://doi.org/10.1007/9783662466810_61CrossRefGoogle Scholar
 19.Baranová, Z., et al.: Model checking of C and C++ with DIVINE 4. In: D’Souza, D., Narayan Kumar, K. (eds.) ATVA 2017. LNCS, vol. 10482, pp. 201–207. Springer, Cham (2017). https://doi.org/10.1007/9783319681672_14CrossRefGoogle Scholar
 20.BenRayana, S., Bozga, M., Bensalem, S., Combaz, J.: RTDfinder: a tool for compositional verification of realtime componentbased systems. In: Chechik, M., Raskin, J.F. (eds.) TACAS 2016. LNCS, vol. 9636, pp. 394–406. Springer, Heidelberg (2016). https://doi.org/10.1007/9783662496749_23CrossRefGoogle Scholar
 21.Pradella, M.: A user’s guide to zot. CoRR abs/0912.5014 (2009)Google Scholar
 22.Kindermann, R., Junttila, T.A., Niemelä, I.: Smtbased induction methods for timed systems. CoRR abs/1204.5639 (2012)Google Scholar
 23.Sheeran, M., Singh, S., Stålmarck, G.: Checking safety properties using induction and a SATsolver. In: Hunt, W.A., Johnson, S.D. (eds.) FMCAD 2000. LNCS, vol. 1954, pp. 127–144. Springer, Heidelberg (2000). https://doi.org/10.1007/354040922X_8CrossRefGoogle Scholar
 24.Li, G.: Checking timed büchi automata emptiness using LUabstractions. In: Ouaknine, J., Vaandrager, F.W. (eds.) FORMATS 2009. LNCS, vol. 5813, pp. 228–242. Springer, Heidelberg (2009). https://doi.org/10.1007/9783642043680_18CrossRefGoogle Scholar
 25.Larsen, K.G., Lorber, F., Nielsen, B.: 20 years of UPPAAL enabled industrial modelbased validation and beyond. In: Margaria, T., Steffen, B. (eds.) ISoLA 2018. LNCS, vol. 11247, pp. 212–229. Springer, Cham (2018). https://doi.org/10.1007/9783030034276_18CrossRefGoogle Scholar
 26.Cimatti, A., Griggio, A., Magnago, E., Roveri, M., Tonetta, S.: Extending nuXmv with timed transition systems and timed temporal properties (extended version) (2019). Extended version with data to reproduce experiments https://nuxmv.fbk.eu/papers/cav2019
Copyright information
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.