SMT-based BMC for Dense Timed Interpreted Systems and EMTLK

Properties

Agnieszka M. Zbrzezny

1 a

, Andrzej Zbrzezny

2 b

and Bo

zena Wo

zna-Szcze

sniak

2 c

Faculty of Mathematics and Computer Science, University of Warmia and Mazury,

Słoneczna 54, 10-710 Olsztyn, Poland

Department of Mathematics and Computer Science, Jan Długosz University in Cze¸stochowa,

Armii Krajowej 13/15, 42-200 Cze¸stochowa, Poland

Keywords:

Satisﬁability Modulo Theories, Bounded Model Checking, The Existential Fragment of the Epistemic Metric

Temporal Logic, Dense Timed Interpreted Systems.

Abstract:

The use of automated veriﬁcation, performed by the analysis of their models, is often recommended to assess

the correctness of safety-critical systems, failure of which could cause dramatic consequences for both people

and hardware. In the past, several automated veriﬁcation methods, including model checking, have been pro-

posed and consequently applied for the trustworthy development of real-time multi-agent systems (RTMAS).

In this paper, we investigate a Satisﬁability Modulo Theories based Bounded Model Checking (SMT-BMC)

method for EMTLK (the existential fragment of an epistemic Metric Temporal Logic) that is interpreted over

models generated by Dense Timed Interpreted Systems (DTIS). In particular, we translate the existential model

checking problem for EMTLK to the existential model checking problem for a variant of an epistemic Linear

Temporal Logic with a new set of propositional variables (called ELTLK

), and we provide an SMT-BMC

technique for ELTLK

. We have implemented our technique and tested it using the Timed Generic Pipeline

Paradigm scenario. Our preliminary experimental results allow us to draw positive conclusions regarding the

future applications of our new method in the automated veriﬁcation of other benchmarks for RTMAS modelled

by DTIS.

1 INTRODUCTION

With the development and deployment of multi-

agent systems (MAS) (Wooldridge, 2009) growing

demand has emerged to develop robust and compre-

hensive MAS veriﬁcation techniques. Model check-

ing (Clarke et al., 1999) is a well known, automatic

veriﬁcation technique, which helps to establish the

correctness of systems. Its main idea is to represent

a system as a labelled transition system (model) and a

property as a modal formula, and automatically check

whether the formula holds in the model. However,

model checking of even moderately large MAS can

be difﬁcult due to an exponential growth of the num-

ber of states with the number of components. This

phenomenon is known as the state explosion prob-

lem. Several state reduction techniques and symbolic

model checking approaches have been developed to

https://orcid.org/0000-0001-9897-3561

https://orcid.org/0000-0003-2771-9683

https://orcid.org/0000-0002-1486-6572

avoid this problem.

One of the symbolic model checking approaches

is bounded model checking (BMC) (Me¸ski et al.,

2014; Zbrzezny et al., 2015). BMC is a veriﬁcation

technique designed for ﬁnding witnesses of existen-

tial properties. Its main idea is to represent a wit-

ness of ﬁnite length by a propositional formula or a

quantiﬁer-free ﬁrst-order formula; next, check the re-

sulting formula with a SAT solver or an SMT solver.

If the formula is satisﬁable, a satisfying assignment

returned by the SAT or SMT solver can be translated

into a concrete witness showing that the property is

violated. Otherwise, the bound is increased. Further-

more, the process repeated. Note that the satisﬁability

modulo theories problem (SMT) (Biere et al., 2009)

is a generalisation of the SAT problem (Biere et al.,

2009), where propositional variables are replaced by

predicates from various background theories, such as

linear, real, and integer arithmetic. In this paper, we

investigate an SMT-based BMC for a real-time ver-

sion of MAS with semantics based on interpreted sys-

tems (IS) (Fagin et al., 1995).

Zbrzezny, A., Zbrzezny, A. and Wo´zna-Szcze

sniak, B.

SMT-based BMC for Dense Timed Interpreted Systems and EMTLK Properties.

DOI: 10.5220/0010882100003116

In Proceedings of the 14th International Conference on Agents and Artiﬁcial Intelligence (ICAART 2022) - Volume 1, pages 345-352

ISBN: 978-989-758-547-0; ISSN: 2184-433X

345

The formalism of IS provides a useful frame-

work to model MASs, and to verify various classes

of temporal and epistemic properties of MAS. The

timed interpreted system (TIS) (Wo

zna-Szcze

sniak

and Zbrzezny, 2016) formalism extends the IS formal-

ism to make possible reasoning about discrete real-

time and epistemic properties of MASs. Especially,

TIS provides computationally grounded semantics on

which it is possible to interpret discrete time-bounded

temporal modalities as well as epistemic modalities.

In this paper, we extend the TIS formalism to a new

dense timed interpreted system (DTIS) formalism that

yields computationally grounded semantics for real-

time MAS, enabling the interpretation of both the

dense time-bounded temporal modalities and tradi-

tional epistemic modalities. The resulting transition

system that models the DTIS behaviour, which we

call the dense timed model (DTM), can evolve in two

different ways: with action transitions and with time

transitions. An action transition occurs whenever an

enabled join action is taken. It takes no time and may

cause a change of agents’ location and clock resets. A

time transition affects only the clocks, which are in-

creased by a certain (real) value and correspond to the

passage of continuous time. Furthermore, due to the

real-valued clock variables, the state space of DTM is

inﬁnite. To represent inﬁnite paths of DTM by ﬁnite

paths, thereby making the bounded model checking

analysis feasible, we deﬁne an equivalence relation in

the set of all the valuations for the clock variables that

induce a ﬁnite number of states that preserve time and

action transitions.

To express the MASs’ requirements various exten-

sions of standard temporal logics, for example Linear

Temporal Logic (LTL) (Clarke et al., 1999) or Metric

Temporal Logic (MTL) (Koymans, 1990), with epis-

temic (Fagin et al., 1995) modalities have been pro-

posed. LTL allows for expressing properties about

each execution of a system, e.g., any occurrence of

a problem eventually triggers the alarm. LTL, how-

ever, is inadequate to express speciﬁcations for MAS

whose correct behaviour depends on quantitative tim-

ing requirements. MTL extends LTL by constrain-

ing the temporal operators by time intervals and ad-

mits the speciﬁcation of quantitative time require-

ments, e.g., every problem is followed within 30 time

units by an alarm. MTLK (Wo

zna-Szcze

sniak and

Zbrzezny, 2016) is an epistemic extension of MTL

interpreted over discrete timed models generated by

TIS, and it allows for the representation of the quan-

titative, but discrete-time, the temporal evolution of

epistemic states of the agents. For example, an agent

P knows that each time a problem occurs, then is it

followed within 30 discrete-time units by an alarm.

In this paper, we consider an existential version of

MTLK (called EMTLK) with the pointwise semantics

(Bouyer, 2009) and the time domain being the non-

negative real numbers. We interpret EMTLK over

models generated by DTIS. The EMTLK allows for

the representation of the quantitative temporal evolu-

tion of epistemic states of the agents. For example,

it is not true that an agent P knows that each time

a problem occurs, then is it followed within 30 time

units by an alarm.

Contributions. We study an SMT-based BMC

method for EMTLK that is interpreted over models

generated by DTIS. We ﬁrst deﬁne the DTIS and its

dense timed model. Next, we translate the existential

model checking problem for EMTLK to the existen-

tial model checking problem for a variant of an epis-

temic LTL with a new set of propositional variables

(called ELTLK

). Finally, we deﬁne an SMT-based

BMC technique for ELTLK

. We have implemented

our technique and tested it using the Timed Generic

Pipeline Paradigm scenario to illustrate new model

checking techniques.

2 DENSE TIMED INTERPRETED

SYSTEM

Each interpreted systems formalism consists of a set

of agents and the environment in which the agents op-

erate. Therefore, we assume a non-empty and ﬁnite

set of agents A = {1,... ,n}, and a special agent E

that models the environment. The set of agents A to-

gether with the environment E constitute a MAS.

In order to model our agents formally, and to de-

ﬁne the DTIS, we start by establishing the notation

used through the paper. By IR we denote the set of

non-negative real numbers, and by IR

the set of pos-

itive real numbers. We also assume the following:

• X =

c∈A

∪ X

is a ﬁnite set of non-negative

real variables, called clocks, such that X

∩X

for all c,d ∈ A ∪ {E}.

• v : X 7→ IR is a total clock valuation function that

assigns to each clock x ∈ X a non-negative real

value v(x).

• The set IR

|X |

consists of all the clock valuations.

• For Y ⊆ X the valuation v

= v[Y := 0] is deﬁned

as: ∀x ∈ Y , v

(x) = 0 and ∀x ∈ X \Y , v

(x) = v(x).

• For δ ∈ IR, the valuation v

= v + δ is deﬁned as:

∀x ∈ X , v

(x) = v(x) + δ.

• Let x ∈ X , c ∈ IN, and ∼∈ {≤,<,=,>,≥}. The

set C (X ) of clock constraints over the set of

clocks X is deﬁned by the following grammar:

cc := x ∼ c | cc ∧ cc.

ICAART 2022 - 14th International Conference on Agents and Artiﬁcial Intelligence

346

• For any clock valuation v ∈ IR

|X |

and cc ∈ C (X ),

the satisfaction relation v |= cc is deﬁned as fol-

lows: v |= x ∼ c iff v(x) ∼ c, and v |= cc ∧ cc

iff

v |= cc and v |= cc

• P V =

c∈A

P V

∪P V

is a set of propositional

variables such that P V

∩ P V

0, for all c,d ∈

A ∪ {E }.

The formalism of dense timed inter-

preted system (DTIS) is a tuple D =

({L

,ι

,Σ

}

c∈A∪{E}

,{t

}

c∈A

where

• L

is a non-empty and ﬁnite set of local states of

agent (environment) c. Each local state of an agent

captures the complete information about the system

that the agent has at a given moment. We assume

that the local states of E are ”public”.

• ι

⊆ L

is a non-empty set of initial local states of

agent (environment) c.

• Σ

is a non-empty and ﬁnite set of local actions of

agent (environment) c that are used to model the

temporal evolution of the system. It is assumed that

the special null action ε

belongs to Σ

, and that

all actions are ”public”. Each element of the set

Σ = Σ

× ... × Σ

× Σ

is called the joint action.

• X

is a non-empty and ﬁnite set of clocks of agent

(environment) c. We assume that the clocks of the

environment E are ”public”.

• P

: L

7→ 2

is a local protocol function that as-

signs to every local state a set of local actions that

can be executed at that state.

• V

: L

→ 2

P V

is a valuation function that assigns

to each local state a set of propositional variables

that are true at that state.

• I

: L

→ C (X

) is an invariant function that speci-

ﬁes the amount of time agent (environment) c may

spend in its local states.

• t

: L

× L

× C (X

) × 2

× Σ → L

is a (partial)

evolution function for agent c ∈ A.

• t

: L

× C (X

) × 2

× Σ → L

is a (partial) evo-

lution function for the environment E .

We deﬁne the semantics of DTIS D by associating a

dense timed model that is a tuple M = (Σ, S,ι,T,V ),

where

• Σ is the set of joint actions.

• S =

∏

c∈A∪{E}

× IR

) is the non-empty set

of all global states. For a global state s =

((`

),. .. ,(`

),(`

)) ∈ S, the symbol

(s) = `

denotes the local component of agent

c ∈ A ∪{E } in s, and v

(s) = v

denotes the clock

valuation of agent c ∈ A ∪ {E} in s.

• ι =

∏

c∈A∪{E}

(ι

× {0}

) is the non-empty set

of all initial global states such that ι ⊆ S.

• T ⊆ S ×(Σ∪IR)×S is a transition relation deﬁned

by action and time transitions:

– Action transition: for any a ∈ Σ, (s, a,s

) ∈

T iff for all c ∈ A, there exists a transi-

tion t

(s),l

(s),cc

,Y,a) = l

) such that

(s) |= cc

∧ I

(s)) and v

) = v

(s)[Y :=

0] and v

) |= I

)), and there exists

a transition t

(s),cc

,Y,a) = l

) such

that v

(s) |= cc

∧ I

(s)) and v

) =

(s)[X

:= 0] and v

) |= I

)).

– Time transition: let δ ∈ IR

, (s,δ,s

) ∈ T iff

for all c ∈ A ∪ {E }, l

(s) = l

) and v

(s) |=

(s)) and v

) = v

(s) + δ and v

) |=

(s)).

• V : S → 2

P V

is the valuation function deﬁned as

V (s) =

c∈A∪{E}

(s))

We assume that the relation T is total, i.e. for any s ∈ S

there exists s

∈ S and there exist either a non-empty

joint action a ∈ Σ or real number δ ∈ IR such that it

holds T (s,a,s

) or T (s, δ,s

). Furthermore, given a

DTIS and an agent c ∈ A, we assume the following

deﬁnition of the indistinguishability relation : for any

s,s

∈ S, s ∼

iff l

) = l

(s).

A run ρ in a dense timed model that is based on the

transition relation T is an inﬁnite sequence of global

states s

−→ s

−→ ... such that s

∈ S, a

∈ Σ,

and δ

∈ IR

for all i ∈ IN. An assumption that δ

∈

implies that runs are strongly monotonic, that is,

every two action transitions must be separated by a

time one.

3 EMTLK WITH A DENSE

SEMANTICS

In what follows we assume that ◦ ∈ {∧, ∨}.

Deﬁnition 3.1. Let p ∈ P V , c ∈ A, and I be an inter-

val in IR of the form: [a,b) or [a,∞), for a,b ∈ IN and

a 6= b. Then the formulae α of EMTLK are deﬁned

inductively:

α := t | f | p | ¬p | α ◦ α | αU

α | G

α | K

α.

The linear-time operators U

and G

are read

as “bounded until” and “bounded globally”, re-

spectively. The derived basic modal operators for

“bounded eventually” and “bounded release” are de-

ﬁned as follows: F

def

= tU

α and αR

def

= βU

(β ∧

α) ∨ G

β. Hereafter, if the interval I is of the form

[0,∞), we omit it for the simplicity of the presenta-

tion. The epistemic operator K

is read as “agent c

considers possible” and it is dual to the standard epis-

temic operator K

, which is read as “agent c knows”.

To deﬁne the semantics we need the notions of

a path λ

corresponding to run ρ, and of a duration

function D

: IN 7→ IR

as in (Bouyer, 2009).

SMT-based BMC for Dense Timed Interpreted Systems and EMTLK Properties

347

Let M = (Σ,S,ι,T,V ) be a dense timed model,

and ρ = s

−→ s

−→ . .. a run in M. Each

run generates the unambiguous path λ

: IN → S, be-

cause we consider only the strongly monotonic runs.

Further, Π(s) denotes the set of all the paths starting

at s ∈ S, and Π =

∈ι

Π(s

) is the set of all the paths

starting at all initial states. Finally, given a run ρ and

a position j > 0, a duration function D

( j) returns the

sum of all the time transitions along the run ρ till the

position j.

Deﬁnition 3.2. Let α and β be EMTLK formulae, M

the dense timed model, and λ

a path. By λ

[n] we de-

note the path λ

with a designated formula evaluation

position n ∈ IN. An EMTLK formula α is true along

a path λ

(in symbols M,λ

|= α) iff M,λ

[0] |= α,

where

• M,λ

[n] |= p iff p ∈ V (λ

(n)),

• M,λ

[n] |= ¬p iff p 6∈ V (λ

(n)),

• M,λ

[n] |= αU

β iff (∃ j ≥ n)



( j) − D

(n)) ∈ I and M,λ

[n + j] |= β

and (∀n 6 i < j)(M,λ

[n + i] |= α)



• M,λ

[n] |= G

β iff (∀ j ≥ n)



( j)−D

(n)) ∈ I

implies M,λ

[n + j] |= β



• M,λ

[n] |= K

α iff (∃π ∈ Π)(∃i ≥ 0)(π(i) ∼

(n) and M,π[i] |= α).

The semantics of the Boolean constants t and f, and

propositional operators ∨ and ∧ is deﬁned in the stan-

dard way.

The EMTLK formula ϕ is existentially valid in the

model M (written M |= ϕ) iff M,λ

|= ϕ for some path

∈ Π. The existential model checking problem asks

whether M |= ϕ.

4 TRANSLATION FROM EMTLK

TO ELTLK

Deﬁnition 4.1. Let I be an interval as assumed in

Def. 3.1, I V the set of all intervals in IR, and

P V

I V

= {q

| I ∈ I V }. The formulae α of ELTLK

are deﬁned inductively:

α := t | f | υ | ¬υ | α ◦ α | αUα | Gα | K

where υ ∈ P V ∪ P V

I V

and c ∈ A.

The modal operators U and G are read as the “un-

til” and the “globally”, respectively. The modal oper-

ator K

is the standard epistemic modality for “agent

c considers possible”.

Deﬁnition 4.2. Let α and β be ELTLK

formulae, M

the dense timed model, and λ

a path. By λ

[n] we de-

note the path λ

with a designated formula evaluation

position n ∈ IN. The satisﬁability relation |=

, which

indicates truth of an ELTLK

formula in the model M

along the path λ

with the starting point n and at the

depth d > n, is deﬁned inductively as follows:

• M,λ

[n]|=

p iff p ∈ V (λ

(d)),

• M,λ

[n]|=

¬p iff p 6∈ V (λ

(d)),

• M,λ

[n]|=

iff D

(d) − D

(n) ∈ I,

• M,λ

[n]|=

¬q

iff D

(d) − D

(n) 6∈ I,

• M,λ

[n]|=

αUβ iff (∃ j ≥ d)



M,λ

[d]|=

β and

(∀d 6 i < j) (M,λ

[d]|=

α)



• M,λ

[n]|=

Gβ iff (∀i ≥ d) M,λ

[d]|=

β,

• M,λ

[n]|=

α iff (∃λ

∈ Π)(∃i ≥ 0) (λ

(i) ∼

(d) and M,λ

[0]|=

α).

The semantics of the Boolean constants t and f, and

propositional operators ∨ and ∧ is deﬁned in the stan-

dard way.

An ELTLK

formula ϕ is existentially valid in the

model M (written M |= ϕ) iff M,λ

[0] |=

ϕ for some

path λ

∈ Π. The existential model checking problem

asks whether M |= ϕ.

Let p ∈ P V , α, β be formulae of EMTLK. We

deﬁne the translation from EMTLK into ELTLK

a function tr : EMTLK → ELTLK

in the following

way: tr(t) = t, tr(f) = f, tr(p) = p, tr(¬p) = ¬p,

tr(α ∧ β) = tr(α) ∧ tr(β), tr(α ∨ β) = tr(α) ∨ tr(β),

tr(αU

β) = tr(α)Utr(q

∧ β), tr(G

β) = G(¬q

∨

tr(β)), tr(K

α) = K

tr(α).

Observe that the translation of literals as well as

Boolean connectives is straightforward. The transla-

tion of U

r ensures that β holds somewhere in the in-

terval I (expressed by the requirement q

∧ tr(β)), and

α holds always before β. Similarly, the translation of

ensures that β always holds in the interval I (ex-

pressed by the requirement ¬q

∨ tr(β)).

The following theorem can be proven by induction

on the length of the EMTLK formula.

Theorem 4.1. Let M be the dense timed model, and

ϕ an EMTLK formula. Then, M |= ϕ iff M |= tr(ϕ).

5 SMT-BASED BMC OF ELTLK

PROPERTIES

5.1 Bounded Semantics

We start by recalling some basic deﬁnitions of k-path

and loop that allow to represent inﬁnite paths of the

dense timed model M in a ﬁnite way.

Deﬁnition 5.1. Let M be the dense timed model,

k ∈ IN, and 0 6 l 6 k. A k-path is a pair

(π,l), also denoted by π

, where π is a ﬁnite se-

quence π = (s

,. .. ,s

) of states such that for each

ICAART 2022 - 14th International Conference on Agents and Artiﬁcial Intelligence

348

0 6 j < k, either (s

−→ s

j+1

) for some δ ∈

, or (s

−→ s

j+1

) for some a ∈ Σ, and ev-

ery action transition is preceded by at least one

time transition. A k-path π

is a loop, written

for short, if l < k, l

(π(k)) = l

(π(l)) for each

agent c ∈ A, and (v

(π(k)),...,v

(π(k)),v

(π(k))) '

(π(l)),. .. ,v

(π(l)),v

(π(l))), where ' is the

equivalence relation on the set of all the clock val-

uations deﬁned as in (Alur et al., 1993).

If a k-path π

is a loop, then it represents the inﬁ-

nite path of the form uv

, where u = (π(0), .. ., π(l))

and v = (π(l + 1), .. ., π(k)). We denote this unique

path by

. Note that for each j ∈ IN,

l+ j

k+ j

Furthermore, by Π

(s) we denote the set of all the

k-paths starting at s ∈ S, and we deﬁne the set of

all the k-paths starting at all initial states in S as:

∈ι

Deﬁnition 5.2 (Bounded Semantics). Let α and β be

ELTLK

formulae, M the dense timed model, π

a k-

path, and 0 6 n,d 6 k. The satisﬁability relation |=

which indicates truth of an ELTLK

formula in the

model M along the k-path π

with the starting point n

and at the depth d is deﬁned inductively as follows:

• M,π

[n] |=

p iff p ∈ V (π

(d)),

• M,π

[n] |=

¬p iff p /∈ V (π

(d)),

• M,π

[n] |=

iff

1. D

(d) − D

(n) ∈ I, if π

is not a loop,

2. D

(d) − D

(n) ∈ I, if π

is a loop and d > n,

3. D

(d + k − l) − D

(n) ∈ I, if π

is a loop and

d < n,

• M,π

[n] |=

¬q

iff M, π

[n] 6|=

• M,π

[n] |=

αUβ iff (∃

d6 j6k

)



M,π

[d] |=

β and

(∀

d6i< j

)M,π

[d] |=





is a loop and

(∃

l< j<d

) M,π

[d] |=

β and (∀

l<i<k

)M,π

[d] |=

and (∀

d6i6k

)M,π

[d] |=



• M,π

[n] |=

Gβ iff loop(π

) and

(∀

i6k

)(i > min(d, l) implies M,π

[d] |=

β),

• M,π

[n] |=

α iff (∃π

∈ Π

)(∃

0≤i≤k

)

(M,π

[0] |=

α and π(d) ∼

(i)).

The semantics of the Boolean constants t and f, and

propositional operators ∨ and ∧ is deﬁned in the stan-

dard way.

Observe that to evaluate propositional vari-

ables we use only ﬁnite preﬁxes of the sequence

(0),D

(1),. ..). Namely, if a k-path π

is not a

loop, then we have to consider the preﬁx of the length

k only. However, if a k-path π

is a loop, then we have

to consider the preﬁx of the length k + k − l.

An ELTLK

formula ϕ is existentially k-valid in

the model M, written M |=

ϕ, iff M,π

[0] |=

ϕ for

some k-path π

starting at the initial state.

The proof of Lemma 5.1 below is based on induc-

tion on the length of the given formula. It is analogous

to the proof of Lemma 7 from the paper (Biere et al.,

1999).

Lemma 5.1. Let M be the dense timed model. For

each ELTLK

formula ϕ, each k-path π

in M, each

0 ≤ m ≤ k and each 0 ≤ d ≤ k, if M,π

[m] |=

ϕ, then

there exists a path π

such that π

[..k] = π

and: m ≤ d

and M,π

[m] |=

ϕ or m > d and M,π

[m] |=

d+k−l

ϕ.

The proof of the Lemma 5.2 below is based on

the well-known fact that if the LTL formula is true on

some inﬁnite path, it is also true on an inﬁnite path of

the form uv

, where u and v are ﬁnite sequences of

states (Biere et al., 1999).

Lemma 5.2. Let M the dense timed model, π a path

in the model, and k ≥ 0. For each ELTLK

formula ϕ,

each 0 ≤ m ≤ k and each 0 ≤ d ≤ k, if M,π[m] |=

ϕ,

there exists a k-path π

such that M, π

[m] |=

ϕ.

Theorem 5.1 shows that for some speciﬁc bound,

bounded and unbounded semantics are equivalent.

The proof of Theorem 5.1 follows directly from Lem-

mas 5.1 and 5.2.

Theorem 5.1. Let M be the dense timed model for

the dense timed interpreted system D, ϕ an ELTLK

formula, and ψ = tr(ϕ) an ELTLK

formula. Then,

M |= ψ iff there exists k > 0 such that M |=

ψ.

5.2 Translation to SMT

The presented SMT encoding of the BMC problem

for ELTLK

and for a DTIS is based on the SMT en-

coding presented in (Zbrzezny and Zbrzezny, 2017).

It consists in encoding of both the transition relation

of the dense timed model M, and the ELTLK

formula

tr(ϕ) as a quantiﬁer-free ﬁrst-order formula. The nov-

elty of the encoding lies in encoding of both the tran-

sition relation of the dense timed model, and the ﬁnite

preﬁx of the sequence (D

(0),D

(1),. ..).

Let M be a dense timed model, ϕ an EMTLK for-

mula, ψ = tr(ϕ) the ELTLK

formula, and k ∈ IN

a bound. The main idea of the SMT-based BMC

method consists in translating the BMC problem, i.e.,

M |=

ψ, to the satisﬁability problem of the following

formula:

[M,ψ]

:= [M

ψ,ι

]

∧ [ψ]

M,k

The deﬁnition of the formula [M,ψ]

assumes

that each global state s ∈ S of M can be repre-

sented by a valuation of a symbolic global state

w = (w

,. .. ,w

) that consists of symbolic local

states. Each w

is a pair (w

) of individual inte-

ger variables ranging over the natural numbers (en-

coding a local state of the agent c) and individual real

SMT-based BMC for Dense Timed Interpreted Systems and EMTLK Properties

349

variables ranging over the real numbers (encoding a

clock valuation of the agent c). Similarly, each action

a ∈ Σ can be represented by a valuation of a symbolic

joint action a that is a vector of the individual vari-

ables ranging over the natural number.

The formula [M

ψ,ι

]

constrains the f

(ψ) sym-

bolic k-paths to be valid k-paths of M, while the for-

mula [ψ]

M,k

encodes a number of constraints that must

be satisﬁed on these sets of k-paths for ψ = tr(ϕ) to

be satisﬁed. Note that the exact number of neces-

sary symbolic k-paths depends on the checked for-

mula ψ, and it can be calculated using the function

: EMTLK → IN as in (Me¸ski et al., 2014). The

number of k-paths sufﬁcient to validate ψ is given by

the function that is deﬁned as

(ψ) = f

(ψ) + 1.

Let w and w

be two different symbolic states,

a a symbolic action,

δ a symbolic time passage,

and u be a symbolic number. We assume def-

initions of the following auxiliary quantiﬁer-free

ﬁrst-order formulae as in (Zbrzezny, 2012): I

(w)

that encodes the state s of the dense timed model

M, p(w) that encodes the set of states of M in

which p ∈ P V holds, H

) that encodes

equivalence of two local states for c ∈ A ∪ E ,

H(w, w

) that encodes equivalence of two global

states such that (w

,. .. ,w

) = (w

,. .. ,w

)

and (v

,. .. ,v

) ' (v

,. .. ,v

), T

(w,a, w

)

that encodes action transitions of M, and T

(w,

δ,w

)

that encodes time transitions of M. A pair consisting

of a sequence of symbolic transitions and a symbolic

number is called a symbolic k-path. Let π

denote

the j-th symbolic k-path: (

0, j

−→ ...

−→

0, j

1, j

−→

−→ ...

−→ w

1, j

2, j

−→ ...

−→ w

k−1

k, j

−→ w

k, j

where w

i, j

are symbolic states, a

i, j

are symbolic ac-

tions, and u

is a symbolic number for 0 ≤ i ≤ k and

1 ≤ j ≤

(ψ). Further, let the function Gt

(π

) en-

code a global time on the symbolic k-path π

at the

depth m.

The formula [ψ]

M,k

encodes the bounded seman-

tics of an ELTLK

formula ψ = tr(ϕ), and it is deﬁned

on the same sets of individual variables as the formula

ψ,ι

]

Let F

(ψ) = { j ∈ IN | 1 ≤ j ≤

(ψ)}, and

[ψ]

[m,n,A]

denote the translation of ψ along the n-th

symbolic path π

with the starting point m by using

the set A ⊆ F

(ψ). Then, the next step is a transla-

tion of an ELTLK

formula ψ to a quantiﬁer-free ﬁrst-

order formula

[ψ]

M,k

:= [ψ]

[0,1,F

(ψ)]

Deﬁnition 5.3 ((Zbrzezny, 2012)). Let M be a dense

timed model, ψ an ELTLK

formula, and k ≥ 0 a

bound. We deﬁne inductively the translation of ψ

over a path number n ∈ F

(ψ) starting at the sym-

bolic state w

d,n

at the depth m as shown below, where

= min(A):

• [q

]

[d,n,A]

[k,m]

k−1

l=0



(π

) − Gt

(π

) ∈ I ∧

¬H(w

k,n

l,n

)



∨

k−1

l=0



(π

) − Gt

(π

) ∈

I ∧ H(w

k,n

l,n

)



, if m ≥ d,

k−1

l=0



(π

) − Gt

(π

) ∈ I ∧

¬H(w

k,n

l,n

)



∨

k−1

l=0



d+k−l

(π

) −

(π

) ∈ I ∧ H(w

k,n

l,n

)



, if d < m,

• [¬q

]

[d,n,A]

[k,m]

:= ¬[q

]

[d,n,A]

[k,m]

• [K

α]

[d,n,A]

[k,m]

s∈ι

0,n

) ∧

j=0



[α]

[ j,n

(A)]

[k,m]

∧ H

d,n

j,n

)



For the Boolean constants t and f, propositional vari-

ables ∈ P V , propositional operators ∨ and ∧, and

temporal operators U and G the translation is de-

ﬁned as in (Zbrzezny, 2012; Wo

zna-Szcze

sniak and

Zbrzezny, 2016; Zbrzezny and Zbrzezny, 2017).

Let w

i, j

, a

i, j

, and

i, j

are, respectively, symbolic

states, symbolic actions, and symbolic time passage

for 0 ≤ i ≤ k and 1 ≤ j ≤

(ψ). Now, we can deﬁne

the formula [M

ψ,ι

]

as follows:

s∈ι

0,0

) ∧

(ψ)

j=1

H(w

0,0

0, j

)∧

(ψ)

j=1

l=0

l = u

∧

(ψ)

j=1



0, j

δ,w

1, j

)∧

k−1

i=1



i, j

δ,w

i+1, j

) ∨ T

i, j

i+1, j

)



∧

k−2

i=1



i, j

δ,w

i+1, j

) ∨ T

i+1, j

δ,w

i+2, j

)





The following theorem states that the translation

is correct and complete.

Theorem 5.2. Let M be a dense timed model, ϕ

an EMTLK formula, and tr(ϕ) an ELTLK

formula.

Then, for every k ∈ IN, M |=

tr(ϕ) iff, the quantiﬁer-

free ﬁrst-order formula [M, tr(ϕ)]

is satisﬁable.

6 EXPERIMENTAL RESULTS

In this section, we experimentally evaluate the perfor-

mance of our new translation. To this aim, we have

conducted the experiments using the slightly modiﬁed

ICAART 2022 - 14th International Conference on Agents and Artiﬁcial Intelligence

350

timed generic pipeline paradigm (TGPP) (Wo

zna-

Szcze

sniak and Zbrzezny, 2014).

The DTIS for the TGPP (Zbrzezny and Zbrzezny,

2017) consists of n + 2 agents: a Producer producing

data within the certain time interval ([a,b]) or being

inactive, a Consumer receiving data within the cer-

tain time interval ([c,d]) or being inactive within the

certain time interval ([g,h]), and a chain of n inter-

mediate Nodes that can be ready for receiving data

within the certain time interval ([c, d]), processing

data within the certain time interval ([e, f ]) or send-

ing data. We assume that a = c = e = g = 1 and

b = d = f = h = 2 · n + 2, where n represents a num-

ber of nodes. We have tested the TGPP dense timed

interpreted system model, scaled in the number of in-

termediate nodes on the following EMTLK formulae

that existentially hold in the model of TGPP (n is the

number of nodes, ConRec stands for ConsReceived,

and PrdSend stands for ProdSend):

• ϕ

= G(K

(PrdSend ⇒ F

[0,2n+2)

(ConRec))). It

states that Producer knows that each time Producer

produces data, then Consumer receives this data in

time less than 2n + 1.

• ϕ

= K

[0,2n+2)

(ConRec))). It states that

Consumer knows that Producer knows that ﬁnally

Consumer will receive data in time less than 2n+2.

• ϕ

= K

(ConRec ⇒ F

[0,2n+1)

(¬ConRec)). It states

that Producer knows that time Consumer receives

data, then Consumer is ready to receive data in time

less than 2n + 1 after that Consumer will receive

data.

The number of considered k-paths for the properties

, and ϕ

is equal to 2, and for the property ϕ

equal to 3.

We have performed our experiments on

a computer equipped with I7-3770 processor,

32 GB of RAM, and the operating system Linux.

We implemented our SMT-BMC algorithm as a

standalone program that is written in C++. We used

the SMT-solvers Z3 (Moura and Bjørner, 2008) in

version 4.8.9, and Yices2 (Dutertre, 2014) in version

2.6.2.

The line charts in Figures 1-3, show the total time

and the memory consumption for all the tested prop-

erties. Our SMT-BMC program generated SMT ﬁles

that we have tested using SMT-solvers. The results we

have got allowed us to conﬁrm the efﬁciency of our

method. By the way, we can compare the efﬁciency

of mentioned above SMT-solvers. For all the formu-

lae Yices SMT-solver outperforms Z3, and it could

verify the TGPP system with more nodes.

1000

2000

3000

4000

5000

6000

1 5 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150

Time in sec.

Number of Nodes

SMT − Yices

SMT − Z3

Total time usage for the TGPP and ϕ

1000

10000

100000

1×10

1 5 10 20 30 40 50 60 70 80 90 100110120130140150

Memory in kB

Number of Nodes

SMT − Yices

SMT − Z3

Memory usage for a TGPP and ϕ

Figure 1: ϕ

: TGPP with n nodes.

2000

4000

6000

8000

10000

12000

14000

16000

18000

1 2 3 4 5 6

Time in sec.

Number of Nodes

SMT − Yices

SMT − Z3

Total time usage for the TGPP and ϕ

10000

100000

1×10

1 2 3 4 5 6

Memory in kB

Number of Nodes

SMT − Yices

SMT − Z3

Memory usage for a TGPP and ϕ

Figure 2: ϕ

: TGPP with n nodes.

200

400

600

800

1000

1200

1400

1 2 3 4 5

Time in sec.

Number of Nodes

SMT − Yices

SMT − Z3

Total time usage for the TGPP and ϕ

1000

10000

100000

1×10

1 2 3 4 5

Memory in kB

Number of Nodes

SMT − Yices

SMT − Z3

Memory usage for a TGPP and ϕ

Figure 3: ϕ

: TGPP with n nodes.

7 CONCLUSIONS AND FUTURE

WORK

We have proposed, implemented, and experimentally

evaluated SMT-based BMC method for dense timed

interpreted systems and for properties expressible in

SMT-based BMC for Dense Timed Interpreted Systems and EMTLK Properties

351

EMTLK with the semantics over dense timed inter-

preted systems. The method is based on a translation

of the existential model checking for EMTLK to the

existential model checking for ELTLK

, and then on

the translation of the existential model checking for

ELTLK

to the quantiﬁer-free ﬁrst-order formula.

The paper presents preliminary experimental re-

sults only, but they show that the proposed veriﬁca-

tion method is quite efﬁcient and worth exploring. We

plan to explore also the SAT-based BMC method.

REFERENCES

Alur, R., Courcoubetis, C., and Dill, D. (1993). Model

checking in dense real-time. Information and Com-

putation, 104(1):2–34.

Biere, A., Cimatti, A., Clarke, E., and Zhu, Y. (1999). Sym-

bolic model checking without BDDs. In TACAS’99,

volume 1579 of LNCS, pages 193–207. Springer-

Verlag.

Biere, A., Heule, M., van Maaren, H., and Walsh, T. (2009).

Handbook of Satisﬁability: Volume 185 Frontiers in

Artiﬁcial Intelligence and Applications. IOS Press.

Bouyer, P. (2009). Model-checking timed temporal logics.

Electr. Notes Theor. Comput. Sci., 231:323–341.

Clarke, E., Grumberg, O., and Peled, D. (1999). Model

Checking. The MIT Press.

Dutertre, B. (2014). Yices 2.2. In Proceedings of CAV’2014,

pages 737–744.

Fagin, R., Halpern, J., Moses, Y., and Vardi, M. Y. (1995).

Reasoning about Knowledge. MIT Press. ISBN: 0-

262-06162-7.

Koymans, R. (1990). Specifying real-time properties with

metric temporal logic. Real-Time Systems, 2(4):255–

299.

Me¸ski, A., Penczek, W., Szreter, M., Wo

zna-Szcze

sniak,

B., and Zbrzezny, A. (2014). BDD- versus SAT-based

bounded model checking for the existential fragment

of linear temporal logic with knowledge: algorithms

and their performance. Autonomous Agents and Multi-

Agent Systems, 28(4):558–604.

Moura, L. D. and Bjørner, N. (2008). Z3: an efﬁcient SMT

solver. In Proceedings of TACAS’2008, volume 4963

of LNCS, pages 337–340. Springer-Verlag.

zna-Szcze

sniak, B. and Zbrzezny, A. (2014). Check-

ing MTL properties of discrete timed automata

via bounded model checking. Fundam. Inform.,

135(4):553–568.

Wooldridge, M. (2009). An introduction to multi-agent sys-

tems - Second Edition. John Wiley & Sons.

zna-Szcze

sniak, B. and Zbrzezny, A. (2016). Checking

EMTLK properties of timed interpreted systems via

bounded model checking. Studia Logica, 104(4):641–

678.

Zbrzezny, A. (2012). A new translation from ECTL

∗

SAT. Fundamenta Informaticae, 120(3-4):377–397.

Zbrzezny, A. M., Wo

zna-Szcze

sniak, B., and Zbrzezny,

A. (2015). SMT-based bounded model checking

for weighted epistemic ECTL. In Proceedings of

EPIA’2015, pages 651–657. Springer.

Zbrzezny, A. M. and Zbrzezny, A. (2017). Simple SMT-

based bounded model checking for timed interpreted

systems. In Proceedings of IJCRS’2017, volume

10314 of LNAI, pages 487–504. Springer.

ICAART 2022 - 14th International Conference on Agents and Artiﬁcial Intelligence

352