arXiv subjects

Martin Zimmermann

Publications and source records attributed to Martin Zimmermann.

At least 19 recordsLinked to original sources

arXiv2026

The Complexity of Asynchronous HyperLTL

Hyperproperties express, e.g., information-flow properties of systems, which involves the simultaneous reasoning about multiple execution traces of a system. Consequently, HyperLTL, the most important specification logic for hyperproperties, extends LTL with quantification over traces. However, HyperLTL can only express synchronous hyperproperties. Recently, several logics for asynchronous hyperproperties have been proposed. Here, we focus on AHLTL, asynchronous HyperLTL, which extends HyperLTL with quantification over trajectories that control the relative speed at which time progresses on the quantified traces. Model-checking AHLTL is known to be undecidable while satisfiability is known to be $\Sigma_1^1$-hard, but the precise complexity of both problems is open. Here, we close these gaps and show that model-checking is equivalent to truth in second-order arithmetic while satisfiability is $\Sigma_1^1$-complete if the trajectory is existentially quantified and $\Sigma_1^1$-hard and in $\Sigma_2^1$ if the trajectory is universally quantified.

cs.LO↗

arXiv2026

Logics for Context-free Hyperproperties

We introduce a novel logic for the specification of context-free hyperproperties, which capture, e.g., the flow of information in security-critical recursive systems. Intuitively, the logic extends visibly pushdown automata by quantification over traces, just like HyperLTL, the most important logic for regular hyperproperties, extends LTL by quantification over traces. Using a game-based approach, we show that model-checking is decidable for formulas with a single quantifier alternation, provided the stack height of the visibly pushdown automaton only depends on the traces bound to the variables of the first quantifier block. A single quantifier alternation suffices to express many information-flow properties studied in the literature. Complementarily, we show that model-checking is undecidable for formulas with a single quantifier alternation, if the stack behavior of the visibly pushdown automaton may depend on the second quantifier block. This also implies that model-checking is undecidable for almost all fragments with more than one quantifier alternation.

cs.LO↗

arXiv2025

TAPAAL HyperLTL: A Tool for Checking Hyperproperties of Petri Nets

Petri nets are a modeling formalism capable of describing complex distributed systems and there exists a large number of both academic and industrial tools that enable automatic verification of model properties. Typical questions include reachability analysis and model checking against logics like LTL and CTL. However, these logics fall short when describing properties like non-interference and observational determinism that require simultaneous reasoning about multiple traces of the model and can thus only be expressed as hyperproperties. We introduce, to the best of our knowledge, the first HyperLTL model checker for Petri nets. The tool is fully integrated into the verification framework TAPAAL and we describe the semantics of the hyperlogic, present the tool's architecture and GUI, and evaluate the performance of the HyperLTL verification engine on two benchmarks of problems originating from the computer networking domain.

cs.LO↗

arXiv2025

The Complexity of Generalized HyperLTL with Stuttering and Contexts

We settle the complexity of satisfiability and model-checking for generalized HyperLTL with stuttering and contexts, an expressive logic for the specification of asynchronous hyperproperties. Such properties cannot be specified in HyperLTL, as it is restricted to synchronous hyperproperties. Nevertheless, we prove that satisfiability is $\Sigma_1^1$-complete and thus not harder than for HyperLTL. On the other hand, we prove that model-checking is equivalent to truth in second-order arithmetic, and thus much harder than the decidable HyperLTL model-checking problem. The lower bounds for the model-checking problem hold even when only allowing stuttering or only allowing contexts.

cs.LO↗

arXiv2025

Time for Timed Monitorability

Monitoring is an important part of the verification toolbox, in particular in situations where exhaustive verification using, e.g., model-checking is infeasible. The goal of online monitoring is to determine the satisfaction or violation of a specification during runtime, i.e., based on finite execution prefixes. However, not every specification is amenable to monitoring, e.g., properties for which no finite execution can witness satisfaction or violation. Monitorability is the question of whether a given specification is amenable to monitoring, and has been extensively studied in discrete time. Here, we study the monitorability problem for real-time properties expressed as Timed Automata. For specifications given by deterministic Timed Muller Automata, we prove decidability while we show that the problem is undecidable for specifications given by nondeterministic Timed B\"uchi automata. Furthermore, we refine monitorability to also determine bounds on the number of events as well as the time that must pass before monitoring the property may yield an informative verdict. We prove that for deterministic Timed Muller automata, such bounds can be effectively computed. In contrast we show that for nondeterministic Timed B\"uchi automata such bounds are not computable.

cs.FL↗

arXiv2025

The Complexity of Generalized HyperLTL with Stuttering and Contexts

We settle the complexity of satisfiability, finite-state satisfiability, and model-checking for generalized HyperLTL with stuttering and contexts, an expressive logic for the specification of asynchronous hyperproperties. Such properties cannot be specified in HyperLTL, as it is restricted to synchronous hyperproperties. Nevertheless, we prove that satisfiability is $\Sigma_1^1$-complete and thus not harder than for HyperLTL. On the other hand, we prove that model-checking and finite-state satisfiability are equivalent to truth in second-order arithmetic, and thus much harder than the decidable HyperLTL model-checking problem and the $\Sigma_0^1$-complete HyperLTL finite-state satisfiability problem. The lower bounds for the model-checking and finite-state satisfiability problems hold even when only allowing stuttering or only allowing contexts.

cs.LO↗

arXiv2025

Prophecies all the Way: Game-based Model-Checking for HyperQPTL beyond $\forall^\exists^$

Model-checking HyperLTL, a temporal logic expressing properties of sets of traces with applications to information-flow based security and privacy, has a decidable, but TOWER-complete, model-checking problem. While the classical model-checking algorithm for full HyperLTL is automata-theoretic, more recently, a game-based alternative for the $\forall^*\exists^*$-fragment has been presented. Here, we employ imperfect information-games to extend the game-based approach to full HyperQPTL, which features arbitrary quantifier prefixes and quantification over propositions and can express every $\omega$-regular hyperproperty. As a byproduct of our game-based algorithm, we obtain finite-state implementations of Skolem functions via transducers with lookahead that explain satisfaction or violation of HyperQPTL properties.

cs.LO↗

arXiv2025

You May Delay, but Time Will Not: Timed Games Under Delayed Control

Inspired by Martin Fr\"anzle's persistent and influential work on capturing and handling delay inherent to cyber-physical systems in the formal verification of such systems, we study timed games where controllable actions do not take effect immediately, but only after some delay, i.e., they are scheduled for later execution. We show that solving such games is undecidable if an unbounded number of actions can be pending. On the other hand, we present a doubly-exponential time algorithm for games with a bound on the number of pending actions, based on a reduction to classical timed games. This makes timed games under delayed control with bounded schedules solvable with existing tools like UPPAAL.

cs.FL↗

arXiv2025

The Complexity of Fragments of Second-Order HyperLTL

We settle the complexity of satisfiability, finite-state satisfiability, and model-checking for several fragments of second-order HyperLTL, which extends HyperLTL with quantification over sets of traces: they are all in the analytical hierarchy and beyond

cs.LO↗

arXiv2024

The Complexity of HyperQPTL

HyperQPTL and HyperQPTL$^+$ are expressive specification languages for hyperproperties, properties that relate multiple executions of a system. Tight complexity bounds are known for HyperQPTL finite-state satisfiability and model-checking. Here, we settle the complexity of satisfiability for HyperQPTL as well as satisfiability, finite-state satisfiability, and model-checking for HyperQPTL$^+$: the former is $\Sigma^2_1$-complete, the latter are all equivalent to truth in third-order arithmetic, i.e., all four are very undecidable.

cs.LO↗

arXiv2024

Synchronous Team Semantics for Temporal Logics

We present team semantics for two of the most important linear and branching time specification languages, Linear Temporal Logic (LTL) and Computation Tree Logic (CTL). With team semantics, LTL is able to express hyperproperties, which have in the last decade been identified as a key concept in the verification of information flow properties. We study basic properties of the logic and classify the computational complexity of its satisfiability, path, and model checking problem. Further, we examine how extensions of the basic logic react to adding additional atomic operators. Finally, we compare its expressivity to the one of HyperLTL, another recently introduced logic for hyperproperties. Our results show that LTL with team semantics is a viable alternative to HyperLTL, which complements the expressivity of HyperLTL and has partially better algorithmic properties. For CTL with team semantics, we investigate the computational complexity of the satisfiability and model checking problem. The satisfiability problem is shown to be EXPTIME-complete while we show that model checking is PSPACE-complete.

cs.LO↗

arXiv2024

Exploiting Assumptions for Effective Monitoring of Real-Time Properties under Partial Observability

Runtime verification of temporal properties is essential for ensuring the correctness and reliability of real-time systems, particularly in cyber-physical systems. A significant challenge in this domain is the effective prediction of property failure or success, especially when dealing with partially observable systems. This paper addresses these challenges by developing an Assumption-Based Runtime Verification (ABRV) approach for a continuous real-time setting. Our method exploits assumptions about the system's behavior, specified as Timed Automata, to enable monitors to predict future outcomes and handle unobservable system parts, such as internal faults. Properties to be monitored are specified using Metric Interval Temporal Logic (MITL). The approach also includes formalizing observations with data and time uncertainty using sequences of timed constraints. We present a zone-based online algorithm for computing the monitoring verdict, implemented on top of the UPPAAL tool. Experimental evaluation on proof-of-concept cases demonstrates the approach's feasibility and effectiveness, illustrating how assumptions facilitate earlier verdicts, enable monitoring of properties dependent on unobservable events, and provide insights into scalability.

cs.FL↗

arXiv2024

The Reachability Problem for Neural-Network Control Systems

A control system consists of a plant component and a controller which periodically computes a control input for the plant. We consider systems where the controller is implemented by a feedforward neural network with ReLU activations. The reachability problem asks, given a set of initial states, whether a set of target states can be reached. We show that this problem is undecidable even for trivial plants and fixed-depth neural networks with three inputs and outputs. We also show that the problem becomes semi-decidable when the plant as well as the input and target sets are given by automata over infinite words.

cs.LG↗

arXiv2024

The Complexity of Data-Free Nfer

Nfer is a Runtime Verification language for the analysis of event traces that applies rules to create hierarchies of time intervals. This work examines the complexity of the evaluation and satisfiability problems for the data-free fragment of nfer. The evaluation problem asks whether a given interval is generated by applying rules to a known input, while the satisfiability problem asks if an input exists that will generate a given interval. By excluding data from the language, we obtain polynomial-time algorithms for the evaluation problem and for satisfiability when only considering inclusive rules. Furthermore, we show decidability for the satisfiability problem for cycle-free specifications with a NExpTime lower bound and undecidability for satisfiability of full data-free nfer.

cs.LO↗

arXiv2024

Tracy, Traces, and Transducers: Computable Counterexamples and Explanations for HyperLTL Model-Checking

HyperLTL model-checking enables the automated verification of information-flow properties for security-critical systems. However, it only provides a binary answer. Here, we introduce two paradigms to compute counterexamples and explanations for HyperLTL model-checking, thereby considerably increasing its usefulness. Both paradigms are based on the maxim ``counterexamples/explanations are Skolem functions for the existentially quantified trace variables''. Our first paradigm is complete (everything can be explained), but restricted to ultimately periodic system traces. The second paradigm works with (Turing machine) computable Skolem functions and is therefore much more general, but also shown incomplete (not everything can computably be explained). Finally, we prove that it is decidable whether a given finite transition system and a formula have computable Skolem functions witnessing that the system satisfies the formula. Our algorithm also computes transducers implementing computable Skolem functions, if they exist.

cs.LO↗

arXiv2024

Efficient Runtime Verification of Real-Time Systems under Parametric Communication Delays

Timed B\"uchi automata provide a very expressive formalism for expressing requirements of real-time systems. Online monitoring and active testing of embedded real-time systems can then be achieved by symbolic execution of such automata on the trace observed from the system. This direct construction however only is faithful if observation of the trace is immediate in the sense that the monitor (or test harness, respectively) can assign exact time stamps to the actions it observes, which is rarely true in practice due to the substantial and fluctuating parametric delays introduced by the circuitry connecting the observed system to its monitoring or testing device. We present purely zone-based online monitoring and testing algorithms, which handle such parametric delays exactly without recurrence to costly verification procedures for parametric timed automata. We have implemented our algorithms on top of the real-time model checking tool UPPAAL, and report on encouraging initial results.

cs.FL↗

arXiv2023

The Complexity of Second-order HyperLTL

We determine the complexity of second-order HyperLTL satisfiability, finite-state satisfiability, and model-checking: All three are equivalent to truth in third-order arithmetic. We also consider two fragments of second-order HyperLTL that have been introduced with the aim to facilitate effective model-checking by restricting the sets one can quantify over. The first one restricts second-order quantification to smallest/largest sets that satisfy a guard while the second one restricts second-order quantification further to least fixed points of (first-order) HyperLTL definable functions. All three problems for the first fragment are still equivalent to truth in third-order arithmetic while satisfiability for the second fragment is $\Sigma_1^2$-complete, and finite-state satisfiability and model-checking are equivalent to truth in second-order arithmetic. Finally, we also introduce closed-world semantics for second-order HyperLTL, where set quantification ranges only over subsets of the model, while set quantification in standard semantics ranges over arbitrary sets of traces. Here, satisfiability for the least fixed point fragment becomes $\Sigma_1^1$-complete, but all other results are unaffected.

cs.LO↗

arXiv2023

Strategies Resilient to Delay: Games under Delayed Control vs. Delay Games

We compare games under delayed control and delay games, two types of infinite games modelling asynchronicity in reactive synthesis. Our main result, the interreducibility of the existence of sure winning strategies for the protagonist, allows to transfer known complexity results and bounds on the delay from delay games to games under delayed control, for which no such results had been known. We furthermore analyze existence of randomized strategies that win almost surely, where this correspondence between the two types of games breaks down.

cs.GT↗