A more complete TLA

Abstract

Abstract. This paper defines a generalization of Lamport's Temporal Logic of Actions. We prove that our logic is stuttering-invariant and give an axiomatization of its propositional fragment. We also show that standard TLA is as expressive as our extension once quantification over flexible propositions is added. BackgroundTemporal logics are routinely used for the specification and analysis of reactive systems. However, Lamport [10] has identified a shortcoming of standard linear-time temporal logic (LTL): because it is based on a global notion of "next state", it does not allow to relate specifications written at different levels of abstraction. He has therefore maintained that specifications should be invariant under "stuttering", that is, finite repetitions of identical states, and has proposed the Temporal Logic of Actions (TLA) [12,13,6]. Characteristically, TLA formulas contain the "next-time" operator only in a restricted form and can therefore not distinguish between stuttering-equivalent behaviors. Several case studies have established TLA as a useful formalism for describing systems; on the theoretical side, researchers have studied questions such as the description of real-time and hybrid systems [3,11], the representation of assumption-commitment reasoning [4,5], and the expressiveness of propositional TLA [18]. Moreover, Lamport has developed a formal specification language TLA+ based on TLA.Although TLA has been found to be expressively complete for stuttering-invariant ω-regular languages [18], this does not necessarily imply that specifications can be expressed in a natural way. In fact, the syntactic restrictions imposed by Lamport that ensure invariance under stuttering occasionally make it hard to express seemingly simple properties. For example, whereas the requirement "eventually P will be true, and Q will hold at some later state" is expressed by the formula 3(P ∧ 3Q), as in standard LTL, the analogous requirement "eventually action A will be performed, some time later followed by action B" is not expressed as easily. Eventual occurrence of action A is expressed by the formula 3 A v , where A describes the action as a relation on pairs of states, and v is (roughly speaking) the tuple of all state components of interest. One might therefore expect to express the informal requirement above by a formula such as 3 A ∧ 3 B v v , but TLA does not allow temporal formulas to occur inside an action formula (i.e., inside angle brackets). In some cases one can identify a state formula pA that is true iff action A has happened sometime in the past: for example, A might represent a request for a resource, and pA could be defined from the system's logfile. In those cases, we can express our requirement by the formula 3 pA ∧ B v . This

LTL over Integer Periodicity Constraints

“…5. First-order temporal logics of actions such as TLA [Lam94] (see also extensions in [Mer99,EK02]) can be viewed as variants of LTL over concrete domains in which the domain is not fixed.…”

Formal specification and verification

“…cannot be expressed in TLA because there is no next-time operator that could be applied to temporal formulas. A generalization of TLA, together with a system of rules that is complete for the propositional fragment of that logic, appears in [55].…”

The Specification Language TLA+

“…Although the separation between the two tiers is natural when writing system specifications, it is not a prerequisite to obtaining stuttering invariance. The logic TLA * [37] generalizes TLA in that it distinguishes between pure and impure temporal formulas. Whereas pure formulas of TLA * contain impure formulas in the same way that temporal formulas of TLA contain transition formulas, impure formulas generalize transition formulas in that they admit Boolean combinations of F and c G, where F and G are pure formulas and c is the next-time modality of temporal logic.…”