LTL Clause Samples

LTL. Given a set of variables V , we assume to be given a set Expr(V ) of Boolean expressions over V as in [21]. In particular, in this paper, we consider standard arithmetic predicates (<, , >, , . . .) and functions (+, , . . .) over integer and real variables. We de ne the set of LTL formulas over the variables V with the following grammar rule: φ := p | φ A φ | φ V φ | чφ | Xφ | φUφ where p ranges over Expr(V ). We use the following standard abbreviations: := p p, := , φ ψ := ( φ) ψ, Fφ := Uφ, Gφ := F φ. LTL formulas are interpreted over traces over V , which are in nite sequences of assignments to V . We refer the reader to [8] for a formal de nition of the semantics. Given a transition system S = V, I, T and an LTL formula φ over V , S = φ if and only if for all traces σ of S, σ = φ. Note that we are considering in general in nite-state transition systems for which the problem is undecidable. Our meth- ods are based on SMT-based algorithms as those implemented in nuXmv [3]. At runtime, we evaluate a formula over the pre x of an in nite execution trace using the standard semantics of runtime veri cation [17]. In particular, a nite trace π violates a formula φ i , for any su x π′, the concatenation of π and π′ violates φ. Contract Re nement. To simplify the presentation, in this paper, we de ne a contract re nement independently from the component interfaces. In practice, in OCRA [6], contracts are speci ed in terms of component input/output ports and the re nement has to take into account the connections among ports in component decomposition. A contract C over the variables V is a pair A, G of LTL formulas over V representing respectively an assumption and a guarantee. We also denote A by