Systems and Timed Temporal Properties

. NU X MV is a well-known symbolic model checker, which implements various state-of-the-art algorithms for the analysis of ﬁnite-and inﬁnite-state transition systems and temporal logics. In this paper, we present a new version that supports timed systems and logics over continuous super-dense semantics. The system speciﬁcation was extended with clocks to constrain the timed evolution. The support for temporal properties has been expanded to include MTL 0 , ∞ formulas with parametric intervals. The analysis is performed via a reduction to veriﬁcation problems in the discrete-time case. The internal representation of traces has been extended to go beyond the lasso-shaped form, to take into account the possible divergence of clocks. We evaluated the new features by comparing NU X MV with other veriﬁcation tools for timed automata and MTL 0 , ∞ , considering different benchmarks from the literature. The results show that NU X MV is competitive with and in many cases performs better than state-of-the-art tools, especially on validity problems for MTL 0 , ∞ .


Introduction
NUXMV [1] is a symbolic model checker for the analysis of synchronous finite-and infinite-state transition systems. For the finite-state case, NUXMV features strong verification engines based on state-of-the-art SAT-based algorithms. For the infinite-state case, NUXMV features SMT-based verification techniques, implemented through a tight integration with the MATHSAT5 solver [2]. NUXMV has taken part to recent editions of the hardware model checking competition, where it has shown to be very competitive with the state-of-the-art. NUXMV also compares well with other model checkers for infinite-state systems. Moreover, it has been successfully used in several application domains both in research and industrial settings. It is currently the core verification engine for many other tools (also industrial ones) for requirements analysis, contract based design, model checking of hybrid systems, safety assessment, and software model checking.
In this paper, we put emphasis on the novel extensions to NUXMV to support timed synchronous transition systems, which extend symbolically-represented infinite-state transition systems with clocks. The main novelties of this new version are the following. The NUXMV input language was extended to enable the description of symbolic synchronous timed transition systems with super-dense time semantics (where signals can have a sequence of values at any real time t). The support for temporal properties has been expanded to include MTL 0,∞ formulas with parametric intervals [3,4]. Therefore, NUXMV now supports model checking of invariant, LTL and MTL 0,∞ properties over (symbolic) timed transition systems, as well as validity/satisfiability checking of LTL and MTL 0,∞ formulas. This is done via a correct and complete reduction to verification problems in the discrete-time case (thus allowing for the use of mature and efficient verification engines). In order to represent and find infinite traces where clocks may diverge, we extended the representation for lasso-shape traces (over discrete semantics) and we modified the bounded model checking algorithm to properly encode timed traces. We remark that, NUXMV is more expressive than timed automata, since the native management of time is added on top of an infinite state transition system. This makes it straightforward to encode stopwatches and comparison between clocks. We carried out an experimental evaluation comparing NUXMV with other state-of-theart verification tools for timed automata, considering different benchmarks taken from competitor tools distributions.

Software Architecture
The high level architecture of NUXMV is depicted in Fig. 1. For symbolic transition systems NUXMV behaves like the previous version of the system [1], thus allowing for full backward compatibility (apart from some new reserved keywords). It provides the user with all the basic model checking algorithms for finite domains both using BDDs (using CUDD [5]) and SAT (e.g. MINISAT [6]). It supports various SMT-based model checking algorithms (implemented through a tight integration with the MATHSAT5 solver [2]) for the analysis of finite and infinite state systems (e.g. IC3 [7][8][9], k-liveness [10], liveness to safety [11]). We refer the reader to [1] for a thorough discussion of these consolidated functionalities for the discrete-time setting. To support the specification and model checking of invariant, LTL and MTL 0,∞ properties for timed transitions systems, and for the validity checking of properties over dense time semantics, NUXMV has been extended w.r.t. [1] as discussed here after.
-We extended the parser to allow the user to choose the time semantics to use for the read model. Depending on the time model some parse constructs and checks are enabled and/or disabled. For instance, variables of type clock and MTL 0,∞ properties are only allowed if the dense time semantics has been specified. By default the system uses the discrete time semantics of the original NUXMV. Notice also that, depending on the specified semantics, the commands available to the user change to allow only the analyses supported for the chosen semantics. -We extended the parser to support the specification of symbolic timed automata (definition of clock variables, specification of urgent transitions and state invariants, etc.). Moreover, we extended the parser to allow for the specification of MTL 0,∞ properties, and we extended the LTL bounded operators not only to contain constants, but also complex expressions over clock variables. See Fig. 2 for a simple example showing some of the new language constructs. -We extended the symbol table to support the specification of clock variables, and we extended the type checker to properly handle the new defined variables, expression types and language constructs. -We added new modules for the encoding of the symbolic timed automata into equivalent transition systems to verify with the existing algorithms of NUXMV. -We extended the traces for NUXMV to support timed traces (lasso-shaped traces where some clock variables may diverge).
-We modified the encoding for the loops in the bounded model checking algorithms to take into account that traces may contain diverging variables to allow for the verification and validation of LTL and MTL 0,∞ properties.
For portability, NUXMV has been developed mainly in standard C with some new parts in standard C++. It compiles and executes on Linux, MS Windows, and MacOS.

Language Extensions
Timed Transition Systems. Discrete-time transition systems are described in NUXMV by a set V of variables, an initial condition I(V ), a transition condition T (V, V ) and an invariant condition Z(V ). Variables are introduced with the keyword VAR and can have type Boolean, scalar, integer, real or array. The initial and the invariant conditions are introduced with the keyword INIT and INVAR and are expressions over the variables in V . The transition condition is introduced with TRANS and is an expression over variables in V and V , where for each variable v in V , V contains the "next" version denoted in the language by next(v). Expressions may use standard symbols in the theory associated to the variable types and user-defined rigid functions that are declared with the keyword FUN.
The input language of NUXMV has been extended to allow the specification of timed transition systems (TTS), which are enabled by the annotation @TIME DOMAIN continuous at the beginning of a model description.
Besides the standard types, in the timed case, state variables can be declared of type clock. All variables of type different from clock are discrete variables.
The language provides a built-in clock variable, accessible through the reserved keyword time. It represents the amount of time elapsed from the initial state until now. time is initialized to 0 and its value does not change in discrete transitions. While all other clock variables can be used in any expression in the model definition, time can be used only in comparison with constants.
Initial, transition, and invariant conditions are specified in NUXMV with the keywords INIT, TRANS, and INVAR, as in the discrete case. In particular, TRANS allows to specify "arbitrary" clock resets. Like all other NUXMV state variables, if a clock is not constrained during a discrete transition, its next value is chosen non-deterministically.
Clock variables can be used in INVAR only in the form ϕ → φ, where ϕ is a formula built using only the discrete variables and φ is convex over the clock variables. This closely maps the concept of location invariant described for timed automata: all locations satisfying ϕ have invariant φ.
An additional constraint, not allowed in the discrete-time case, is introduced with the keyword URGENT followed by a predicate over the discrete variables, which allows to specify a set of locations in which time cannot elapse.
Comparison with Timed Automata. Timed automata can be represented by TTSs by simply introducing a variable representing the locations of the automaton. Note that, in TTS, it is possible to express any kind of constraint over clock variables in discrete transitions, while in timed automata it is only possible to reset them to 0 in transitions or compare them to constants in guards. Moreover, the discrete variables of a timed automaton always have finite domain, while in TTSs, also the discrete variables might have an infinite domain. This additional expressiveness allows to describe more complex behaviors (e.g. it is straightforward to encode stopwatches and comparison between clocks) losing the decidability of the model checking problem.
Specifications. NUXMV's support for LTL has been extended to allow for the use of MTL 0,∞ operators [12] and other operators such as event-freezing functions [13] and dense version of LTL X and Y operators. MTL 0,∞ bounded operators extend the LTL ones of NUXMV to allow for bounds either of the form [c,∞), where c is a constant greater or equal to 0, e.g. F[0,+oo) ϕ, or generic expressions over parametric/frozen variables: e.g. F [0, 3+v] ϕ where v is a frozen variable.
In timed setting, next and previous operators come in two possible versions. The standard LTL operators X and Y require to hold, respectively after and before, a discrete transition. Dually, X˜and Y˜have been introduced to allow to predicate about the evolution over time of the system. They are always FALSE in discrete steps and hold in time elapses if the argument holds in the open interval immediately after/before (resp.) the current step. The disjunction X(ϕ) ∨ X˜(ϕ) allows to check if the argument ϕ holds after the current state without distinction between time or discrete evolution.
The event-freezing operators at next and at last, written @F˜and @O˜, are binary operators allowed in LTL specifications. The left-hand side is a term, while the righthand side is a temporal formula. They return the value of the term respectively at the next and at the last point in time in which the formula is true. If the formula will [has] never happen [happened] the operator evaluates to a default value. time until and time since are two additional unary operators that can be used in LTL specifications of timed models. Their argument must be a Boolean predicate over current and next variables. time until(ϕ) evaluates to the amount of time elapse required to reach the next state in which ϕ holds, while time since(ϕ) evaluates to the amount of time elapsed from the last state in which ϕ held. As for the @F˜and @Oõ perators if no such state exists they are assigned to a default value.

Extending Traces
Timed Traces. The semantics of NUXMV has been extended to take into account the timing aspects in case of super-dense time. While in the discrete time case, the execution trace is given by a sequence of states connected by discrete transitions (i.e., satisfying the transition condition), in the super-dense time case the execution trace is such that every pair of consecutive states is a discrete or a timed transition. As in the discrete case, discrete transitions are pair of states satisfying the transition condition. As in timed automata, in a timed transition time elapses for a certain amount (referred to as delta time), clocks increase of the same amount, while discrete variables do not change.
Lasso-Shaped Traces with Diverging Variables. Traditionally, the only infinite paths supported by NUXMV have been those in lasso shape, i.e. those traces which can be represented by a finite prefix s 0 , s 1 , . . . , s l (called the stem) followed by a finite suffix s l+1 , . . . , s k ≡ s l (called the loop), which can be repeated infinitely many times. While this representation is sufficient for finite-state systems (because in a finite-state setting if a system does not satisfy an LTL property, then a lasso-shaped counter-example trace is guaranteed to exist), this is an important limitation in an infinite-state context, in which lasso-shaped counter-examples are not guaranteed to exist. (As a simple example, consider a system M := {x}, (x = 0), (x = x + 1) in which x ∈ Z. Then M |= GF(x = 0), but clearly M has no lasso-shaped trace). In fact, this is especially relevant for timed transition systems, which, by the presence of the always-diverging variable time, admit no lasso-shaped trace.
In order to overcome this limitation, we introduce new kinds of infinite traces, which we call lasso-shape traces with diverging variables (to allow also for representing traces with variables whose value might be diverging). We modified the bounded model checking algorithms to leverage on this new representation to then extend the capabilities to find witnesses for a given property. This representation significantly extends the capabilities of NUXMV to find witnesses for violated LTL and MTL properties on timed transition systems (see experimental evaluation).

Definition 1.
Let π := s 0 , s 1 , . . . , s l , . . . be an infinite trace of a system M over variables V . We say that π is a lasso-shaped trace with diverging variables iff there exist indexes 0 ≤ l ≤ k, a partitioning of V into sets X and Y (V = X Y ) and an expression f y (V ) over V for every variable y ∈ Y such that, for every i > k,

as function of previous state).
Intuitively, the idea of lasso-shaped traces with diverging variables is to provide a finite representation for infinite traces that is more general then simple lasso-shaped ones, and which allows to capture more interesting behaviors of timed transition systems. Extended BMC for Traces with Divergent Clocks. The definition above requires the existence of the functions f y for computing the updates of diverging variables. In case y is a clock variable, we can define a region φ y in which y can diverge (i.e., f y = y+δ, where δ is the delta time variable).
In order to capture lasso-shaped traces with diverging variables, we can modify the BMC encoding as follows. Let representing the BMC encoding of [14] at depth k with all possible loop-backs 0 ≤ l ≤ k for a given formula ϕ. The encoding is extended as follows: The correctness of the encoding relies on a safe choice of the set Y , falling back to the incomplete lasso-shaped case when some syntactic restrictions on the expressions containing clocks are not met (see appendix for more details).

Related Work
There are many tools that allow for the specification and verification of infinite state symbolic synchronous transition systems. Given the focus of this paper, here we restrict our attention to tools supporting timed systems and/or MTL properties.
Uppaal [15], the reference tool for timed systems verification, supports only bounded variable types and therefore finite asynchronous TTS. Properties are limited to a subset of the branching-time logic TCTL [16,17]. LTSmin [18] and Divine [19] are two model checkers that support the Uppaal specification language and properties specified in LTL. RTD-Finder [20] handles only safety properties for real-time componentbased systems specified in RT-BIP. The verification is based on a compositional computation of an invariant over-approximating the set of reachable states of the system and leverages on counterexample-based invariant refinement algorithm. The ZOT Bounded Model/Satisfiability Checker [21] supports different logic languages through a multilayered approach based on LTL with past operators. Similarly to NUXMV, ZOT supports dense-time MTL. It leverages only on SMT-based Bounded Model Checking, and is therefore unable to prove that properties hold. Atmoc [22] implements an extension of IC3 [7] and K-induction [23] to deal with symbolic timed transition systems. It supports both invariant and MTL 0,∞ properties, although for the latter it only supports bounded model checking. CTAV [24] reduces the model checking problem for an MTL 0,∞ property ϕ to a symbolic language emptiness check of a timed Büchi automata for ϕ.
Differently from all the above tools NUXMV is able to prove MTL 0,∞ properties on timed transition systems with infinite domain variables.
For the evaluation we considered (i) scalable benchmarks taken from competitor tools distributions and from the literature; (ii) handcrafted benchmarks to stress various language features. In particular, we considered different versions of the Fisher mutual exclusion protocol (correct and buggy) with different properties, different versions of the emergency diesel generator problem (previously studied with Atmoc [22]). Finally we considered also the validity checks of some MTL properties also taken from [22]. We run all the experiments on a PC equipped with a 3.7 GHz Xeon quad core CPU and 16 Gb of RAM, using a time/memory limit of 1000 s/10 Gb for each test. We refer the reader to [26] to retrieve all the data to reproduce this experimental evaluation.  Fig. 5. In the plots NUXMV refers to runtime for the IC3 with implicit abstraction in lockstep with BMC with the modified loop condition algorithm, and NUXMV-bmc refers to runtime for BMC alone with the modified loop condition algorithm. The results show that NUXMV is competitive with and in many cases performs better than other state-of-the-art tools, especially on validity problems for MTL 0,∞ .

Conclusions
We presented the new version of NUXMV, a state-of-the art symbolic model checker for finite and infinite-state transition systems, that we extended to allow for the specification of synchronous timed transition systems and of MTL 0,∞ properties. To support the new features, we extended the NUXMV language, we allowed for the specification MTL 0,∞ formulas with parametric intervals, we adapted the model checking algorithms to find for lasso-shaped traces (over discrete semantics) where clocks may diverge. We evaluated the new features comparing NUXMV with other verification tools for timed automata, considering different benchmarks. The results show that NUXMV is competitive with and in many cases performs better than state-of-the-art tools, especially on validity problems for MTL 0,∞ .
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.