Timed context-free temporal logics (extended version)1footnote 11footnote 1This work was partially supported by someone.

# Timed context-free temporal logics (extended version)111This work was partially supported by someone.

Laura Bozzelli   Aniello Murano   Adriano Peron \IfArrayPackageLoaded
University of Napoli “Federico II”, Napoli, Italy
University of Napoli “Federico II”, Napoli, Italy
###### Abstract

The paper is focused on temporal logics for the description of the behaviour of real-time pushdown reactive systems. The paper is motivated to bridge tractable logics specialized for expressing separately dense-time real-time properties and context-free properties by ensuring decidability and tractability in the combined setting. To this end we introduce two real-time linear temporal logics for specifying quantitative timing context-free requirements in a pointwise semantics setting: Event-Clock Nested Temporal Logic (EC_NTL) and Nested Metric Temporal Logic (NMTL). The logic EC_NTL is an extension of both the logic CaRet (a context-free extension of standard LTL) and Event-Clock Temporal Logic (a tractable real-time logical framework related to the class of Event-Clock automata). We prove that satisfiability of EC_NTL and visibly model-checking of Visibly Pushdown Timed Automata (VPTA) against EC_NTL are decidable and Exptime-complete. The other proposed logic NMTL is a context-free extension of standard Metric Temporal Logic (MTL). It is well known that satisfiability of future MTL is undecidable when interpreted over infinite timed words but decidable over finite timed words. On the other hand, we show that by augmenting future MTL with future context-free temporal operators, the satisfiability problem turns out to be undecidable also for finite timed words. On the positive side, we devise a meaningful and decidable fragment of the logic NMTL which is expressively equivalent to EC_NTL and for which satisfiability and visibly model-checking of VPTA are Exptime-complete.

Timed context-free temporal logics (extended version)thanks: This work was partially supported by someone.

Laura Bozzelli   Aniello Murano   Adriano Peron \IfArrayPackageLoaded
 University of Napoli “Federico II”, Napoli, Italy
 University of Napoli “Federico II”, Napoli, Italy

## 1 Introduction

Model checking is a well-established formal-method technique to automatically check for global correctness of reactive systems [9]. In this setting, temporal logics provide a fundamental framework for the description of the dynamic behavior of reactive systems.

In the last two decades, model checking of pushdown automata (PDA) has received a lot of attention [26, 16, 8, 14]. PDA represent an infinite-state formalism suitable to model the control flow of typical sequential programs with nested and recursive procedure calls. Although the general problem of checking context-free properties of PDA is undecidable, algorithmic solutions have been proposed for interesting subclasses of context-free requirements [4, 8, 16]. A relevant example is that of the linear temporal logic CaRet [4], a context-free extension of standard LTL. CaRet formulas are interpreted on words over a pushdown alphabet which is partitioned into three disjoint sets of calls, returns, and internal symbols. A call denotes invocation of a procedure (i.e. a push stack-operation) and the matching return (if any) along a given word denotes the exit from this procedure (corresponding to a pop stack-operation). CaRet allows to specify LTL requirements over two kinds of non-regular patterns on input words: abstract paths and caller paths. An abstract path captures the local computation within a procedure with the removal of subcomputations corresponding to nested procedure calls, while a caller path represents the call-stack content at a given position of the input. An automata theoretic generalization of CaRet is the class of (nondeterministic) Visibly Pushdown Automata (VPA[8], a subclass of PDA where the input symbols over a pushdown alphabet control the admissible operations on the stack. VPA push onto the stack only when a call is read, pops the stack only at returns, and do not use the stack on reading internal symbols. This restriction makes the class of resulting languages (visibly pushdown languages or VPL) very similar in tractability and robustness to the less expressive class of regular languages [8]. In fact, VPL are closed under Boolean operations, and language inclusion, which is undecidable for context-free languages, is Exptime-complete for VPL.

Real-time pushdown model-checking. Recently, many works [2, 10, 11, 13, 17, 18, 25] have investigated real-time extensions of PDA by combining PDA with Timed Automata (TA[3], a model widely used to represent real-time systems. TA are finite automata augmented with a finite set of real-valued clocks, which operate over words where each symbol is paired with a real-valued timestamp (timed words). All the clocks progress at the same speed and can be reset by transitions (thus, each clock keeps track of the elapsed time since the last reset). The emptiness problem for TA is decidable and Pspace-complete [3]. However, since in TA, clocks can be reset nondeterministically and independently of each other, the resulting class of timed languages is not closed under complement and, moreover, language inclusion is undecidable [3]. As a consequence, the general verification problem (i.e., language inclusion) of formalisms combining unrestricted TA with robust subclasses of PDA such as VPA, i.e. Visibly Pushdown Timed Automata (VPTA), is undecidable as well. In fact, checking language inclusion for VPTA is undecidable even in the restricted case of specifications using at most one clock [18]. More robust approaches [24, 12, 15], although less expressive, are based on formalisms combining VPA and Event-clock automata (ECA[6] such as the recently introduced class of Event-Clock Nested Automata (ECNA[15]. ECA [6] are a well-known determinizable subclass of TA where the explicit reset of clocks is disallowed. In ECA, clocks have a predefined association with the input alphabet symbols and their values refer to the time distances from previous and next occurrences of input symbols. ECNA [15] combine ECA and VPA by providing an explicit mechanism to relate the use of a stack with that of event clocks. In particular, ECNA retain the closure and decidability properties of ECA and VPA being closed under Boolean operations and having a decidable (specifically, Exptime-complete) language-inclusion problem, and are strictly more expressive than other formalisms combining ECA and VPA [24, 12] such as the class of Event-Clock Visibly Pushdown Automata (ECVPA[24]. In [12] a logical characterization of the class of ECVPA is provided by means of a non-elementarily decidable extension of standard MSO over words.

Our contribution. In this paper, we introduce two real-time linear temporal logics, called Event-Clock Nested Temporal Logic (EC_NTL) and Nested Metric Temporal Logic (NMTL) for specifying quantitative timing context-free requirements in a pointwise semantics setting (models of formulas are timed words). The logic EC_NTL is an extension of Event-Clock Temporal Logic (EC_TL[23], the latter being a known decidable and tractable real-time logical framework related to the class of Event-clock automata. EC_TL extends LTL + past with timed temporal modalities which specify time constraints on the distances from the previous or next timestamp where a given subformula holds. The novel logic EC_NTL is an extension of both EC_TL and CaRet by means of non-regular versions of the timed modalities of EC_TL which allow to refer to abstract and caller paths. We address expressiveness and complexity issues for the logic EC_NTL. In particular, we establish that satisfiability of EC_NTL and visibly model-checking of VPTA against EC_NTL are decidable and Exptime-complete. The key step in the proposed decision procedures is a translation of EC_NTL into ECNA accepting suitable encodings of the models of the given formula.

The second logic we introduce, namely NMTL, is a context-free extension of standard Metric Temporal Logic (MTL). This extension is obtained by adding to MTL timed versions of the caller and abstract temporal modalities of CaRet. In the considered pointwise-semantics settings, it is well known that satisfiability of future MTL is undecidable when interpreted over infinite timed words [21], and decidable [22] over finite timed words. We show that over finite timed words, the adding of the future abstract timed modalities to future MTL makes the satisfiability problem undecidable. On the other hand, we show that the fragment NMITL of NMTL (the NMTL counterpart of the well-known tractable fragment MITL [5] of MTL) has the same expressiveness as the logic EC_NTL and the related satisfiability and visibly model-checking problems are Exptime-complete. The oerall picture of decidabilty results is given in table 1.

Some proofs are omitted in the sections and can be found in the Appendix.

## 2 Preliminaries

In the following, denotes the set of natural numbers and the set of non-negative real numbers. Let be a finite or infinite word over some alphabet. By we denote the length of (we write if is infinite). For all , with , is -th letter of , while is the finite subword .

A timed word over a finite alphabet is a word over ( is the time at which occurs) such that the sequence of timestamps satisfies: (1) for all (monotonicity), and (2) if is infinite, then for all , for some (divergence). The timed word is also denoted by the pair , where is the untimed word . A timed language (resp., -timed language) over is a set of finite (resp., infinite) timed words over .

Pushdown alphabets, abstract paths, and caller paths. A pushdown alphabet is a finite alphabet which is partitioned into a set of calls, a set of returns, and a set of internal actions. The pushdown alphabet induces a nested hierarchical structure in a given word over obtained by associating to each call the corresponding matching return (if any) in a well-nested manner. Formally, the set of well-matched words is the set of finite words over inductively defined as follows:

 σw:=ε∣∣a⋅σw∣∣c⋅σw⋅r⋅σw

where is the empty word, , , and .

Fix a word over . For a call position of , if there is such that is a return position of and is a well-matched word (note that is uniquely determined if it exists), we say that is the matching return of along . For a position of , the abstract successor of along , denoted , is defined as follows:

• If is a call, then is the matching return of if such a matching return exists; otherwise ( denotes the undefined value).

• If is not a call, then if and is not a return position, and , otherwise.

The caller of along , denoted , is instead defined as follows:

• if there exists the greatest call position such that either or , then ; otherwise, .

We also consider the global successor of along given by if , and undefined otherwise. A maximal abstract path (MAP) of is a maximal (finite or infinite) increasing sequence of natural numbers such that for all . Note that for every position of , there is exactly one MAP of visiting position . For each , the caller path of from position is the maximal (finite) decreasing sequence of natural numbers such that and for all . Note that all the positions of a MAP have the same caller (if any). Intuitively, in the analysis of recursive programs, a maximal abstract path captures the local computation within a procedure removing computation fragments corresponding to nested calls, while the caller path represents the call-stack content at a given position of the input.

For instance, consider the finite untimed word of length depicted in Figure 1 where , , and . Note that is the unique unmatched call position of : hence, the MAP visiting consists of just position and has no caller. The MAP visiting position is the sequence and the associated caller is position . The MAP visiting position is the sequence and the associated caller is position , and the MAP visiting position consists of just position whose caller path is .

## 3 Event-clock nested automata

In this section, we recall the class of Event-Clock Nested Automata (ECNA[15], a formalism that combines Event Clock Automata (ECA[6] and Visibly Pushdown Automata (VPA[8] by allowing a combined used of event clocks and visible operations on the stack.

Here, we adopt a propositional-based approach, where the pushdown alphabet is implicitly given. This is because in formal verification, one usually considers a finite set of atomic propositions which represent predicates over the states of the given system. Moreover, for verifying recursive programs, one fixes three additional propositions, here denoted by , , and : denotes the invocation of a procedure, denotes the return from a procedure, and denotes internal actions of the current procedure. Thus, we fix a finite set of atomic propositions containing the special propositions , , and . The set induces a pushdown alphabet , where , , and .

The set of event clocks associated with is given by . Thus, we associate with each proposition , five event clocks: the global recorder clock (resp., the global predictor clock ) recording the time elapsed since the last occurrence of if any (resp., the time required to the next occurrence of if any); the abstract recorder clock (resp., the abstract predictor clock ) recording the time elapsed since the last occurrence of if any (resp., the time required to the next occurrence of ) along the MAP visiting the current position; and the caller (recorder) clock recording the time elapsed since the last occurrence of if any along the caller path from the current position. Let be a timed word over and . We denote by the set of positions visited by the MAP of associated with position , and by the set of positions visited by the caller path of from position . For having a uniform notation, let be the full set of -positions. The values of the clocks at a position of the word can be deterministically determined as follows.

###### Definition 1 (Determinisitic clock valuations).

A clock valuation over is a mapping , assigning to each event clock a value in ( is the undefined value). For a timed word over and , the clock valuation over , specifying the values of the event clocks at position along , is defined as follows for each , where and :

It is worth noting that while the values of the global clocks are obtained by considering the full set of positions in , the values of the abstract clocks (resp., caller clocks) are defined with respect to the MAP visiting the current position (resp., with respect to the caller path from the current position).

A clock constraint over is a conjunction of atomic formulas of the form , where , and is either an interval in with bounds in , or the singleton . For a clock valuation and a clock constraint , satisfies , written , if for each conjunct of , . We denote by the set of clock constraints over .

###### Definition 2.

An ECNA over is a tuple , where is a finite set of (control) states, is a set of initial states, is a finite stack alphabet, is the special stack bottom symbol, is a set of accepting states, and is a transition relation, where:

• is the set of push transitions,

• is the set of pop transitions,

• is the set of internal transitions.

We now describe how an ECNA  behaves over a timed word . Assume that on reading the -th position of , the current state of is , and is the event-clock valuation associated with and position . If reads a call , it chooses a push transition of the form and pushes the symbol onto the stack. If reads a return , it chooses a pop transition of the form such that is the symbol on the top of the stack, and pops from the stack (if , then is read but not removed). Finally, on reading an internal action , chooses an internal transition of the form , and, in this case, there is no operation on the stack. Moreover, in all the cases, the constraint of the chosen transition must be fulfilled by the valuation and the control changes from to .

Formally, a configuration of is a pair , where and is a stack content. A run of over a timed word is a sequence of configurations of length ( stands for ) such that , (initialization), and the following holds for all :

Push

If , then for some , and .

Pop

If , then for some , , and either and , or .

Internal

If , then for some , and .

The run is accepting if either is finite and , or is infinite and there are infinitely many positions such that . The timed language (resp., -timed language ) of is the set of finite (resp., infinite) timed words over such that there is an accepting run of on . When considered as an acceptor of infinite timed words, an ECNA is called Büchi ECNA. In this case, for technical convenience, we also consider ECNA equipped with a generalized Büchi acceptance condition consisting of a family of sets of accepting states. In such a setting, an infinite run is accepting if for each Büchi component , the run visits infinitely often states in .

In the following, we also consider the class of Visibly Pushdown Timed Automata (VPTA[13, 18], a combination of VPA and standard Timed Automata [3]. The clocks in a VPTA can be reset when a transition is taken; hence, their values at a position of an input word depend in general on the behaviour of the automaton and not only, as for event clocks, on the word. The syntax and semantics of VPTA is shortly recalled in Appendix A.

## 4 The Event-Clock Nested Temporal Logic

A known decidable timed temporal logical framework related to the class of Event-Clock automata (ECA) is the so called Event-Clock Temporal Logic (EC_TL[23], an extension of standard LTL with past obtained by means of two indexed modal operators and which express real-time constraints. On the other hand, for the class of VPA, a related logical framework is the temporal logic CaRet [4], a well-known context-free extension of LTL with past by means of non-regular versions of the LTL temporal operators. In this section, we introduce an extension of both EC_TL and CaRet, called Event-Clock Nested Temporal Logic (EC_NTL) which allows to specify non-regular context-free real-time properties.

For the given set of atomic propositions containing the special propositions , , and , the syntax of EC_NTL formulas is as follows:

 φ:=⊤∣∣p∣∣φ∨φ∣∣¬φ∣∣dirφ∣∣dir′φ∣∣φUdirφ∣∣φSdir′φ∣∣⊳dirIφ∣∣⊲dir′Iφ

where , is an interval in with bounds in , , and . The operators , , , and are the standard ‘next’, ‘previous’, ‘until’, and ‘since’ LTL modalities, respectively, , , , and are their non-regular abstract versions, and and are the non-regular caller versions of the ‘previous’ and ‘since’ LTL modalities. Intuitively, the abstract and caller modalities allow to specify LTL requirements on the abstract and caller paths of the given timed word over . Real-time constraints are specified by the indexed operators , , , , and . The formula requires that the delay before the next position where holds satisfies ; symmetrically, constraints the previous position where holds. The abstract versions and are similar, but the notions of next and previous position where holds refer to the MAP visiting the current position. Analogously, for the caller version of , the notion of previous position where holds refers to the caller path visiting the current position.

Full CaRet [4] corresponds to the fragment of EC_NTL obtained by disallowing the real-time operators, while the logic EC_TL [23] is obtained from EC_NTL by disallowing the abstract and caller modalities. As pointed out in [23], the real-time operators and generalize the semantics of event clock variables since they allows recursion, i.e., they can constraint arbitrary formulas and not only atomic propositions. Accordingly, the non-recursive fragment of EC_NTL is obtained by replacing the clauses and in the syntax with the clauses and , where . We use standard shortcuts in EC_NTL: the formula stands for (the LTL eventually operator), and stands for (the LTL always operator). For an EC_NTL formula , denotes the number of distinct subformulas of and the set of constants used as finite endpoints in the intervals associates with the real-time modalities. The size of is , where is the size of the binary encoding of the largest constant in .

Given an EC_NTL formula , a timed word over and a position , the satisfaction relation is inductively defined as follows (we omit the clauses for the atomic propositions and Boolean connectives which are standard):

 (w,i)⊨dirφ⇔%thereisj>i such that j=succ(dir,σ,i) % and (w,j)⊨φ(w,i)⊨dir′φ⇔ there is% j
 (w,i)⊨⊳dirIφ⇔there is j>i s.t. j∈Pos(dir,σ,i),(w,j)⊨φ,τj−τi∈I,⇔ and (w,k)⊭φ for % all k∈[i+1,j−1]∩Pos(dir,σ,i)(w,i)⊨⊲dir′Iφ⇔% there is j

A timed word satisfies a formula (we also say that is a model of ) if . The timed language (resp. -timed language ) of is the set of finite (resp., infinite) timed words over satisfying . We consider the following decision problems:

• Satisfiability: has a given EC_NTL formula a finite (resp., infinite) model?

• Visibly model-checking: given a VPTA  over and an EC_NTL formula over , does (resp., ) hold?

The logic EC_NTL allows to express in a natural way real-time LTL-like properties over the non-regular patterns capturing the local computations of procedures or the stack contents at given positions. Here, we consider three relevant examples.

• Real-time total correctness: a bounded-time total correctness requirement for a procedure specifies that if the pre-condition holds when the procedure is invoked, then the procedure must return within time units and must hold upon return. Such a requirement can be expressed by the following non-recursive formula, where proposition characterizes calls to procedure :

• Local bounded-time response properties: the requirement that in the local computation (abstract path) of a procedure , every request is followed by a response within time units can be expressed by the following non-recursive formula, where denotes that the control is inside procedure :

• Real-time properties over the stack content: the real-time security requirement that a procedure is invoked only if procedure belongs to the call stack and within time units since the activation of can be expressed as follows (the calls to procedure and are marked by proposition and , respectively):

Expressiveness results. We now compare the expressive power of the formalisms EC_NTL, ECNA, and VPTA with respect to the associated classes of (-)timed languages. It is known that ECA and the logic EC_TL are expressively incomparable [23]. This result trivially generalizes to ECNA and EC_NTL (note that over timed words consisting only of internal actions, ECNA correspond to ECA, and the logic EC_NTL corresponds to EC_TL). In [15], it is shown that ECNA are strictly less expressive than VPTA. In Section 4.1, we show that EC_NTL is subsumed by VPTA (in particular, every EC_NTL formula can be translated into an equivalent VPTA). The inclusion is strict since the logic EC_NTL is closed under complementation, while VPTA are not [18]. Hence, we obtain the following result.

###### Theorem 1.

Over finite (resp., infinite) timed words, EC_NTL and ECNA are expressively incomparable, and EC_NTL is strictly less expressive than VPTA.

We additionally investigate the expressiveness of the novel timed temporal modalities , , and . It turns out that these modalities add expressive power.

###### Theorem 2.

Let be the fragment of EC_NTL obtained by disallowing the modalities , , and . Then, is strictly less expressive than EC_NTL.

###### Proof.

We focus on the case of finite timed words (the case of infinite timed words is similar). Let and be the timed language consisting of the finite timed words of the form such that is a well-matched word of the form for some , and there is a call position of such that , where is the matching-return of in . can be easily expressed in EC_NTL. On the other hand, one can show that is not definable in (a proof is in Appendix B) . ∎

### 4.1 Decision procedures for the logic Ec_ntl

In this section, we provide an automata-theoretic approach for solving satisfiability and visibly model-checking for the logic EC_NTL which generalizes both the automatic-theoretic approach of CaRet [4] and the one for EC_TL [23]. We focus on infinite timed words (the approach for finite timed words is similar). Given an EC_NTL formula over , we construct in exponential time a generalized Büchi ECNA over an extension of the pushdown alphabet accepting suitable encodings of the infinite models of .

Fix an EC_NTL formula over . For each infinite timed word over we associate to an infinite timed word over an extension of , called fair Hintikka sequence, where , and for all , is an atom which, intuitively, describes a maximal set of subformulas of which hold at position along . The notion of atom syntactically captures the semantics of the Boolean connectives and the local fixpoint characterization of the variants of until (resp., since) modalities in terms of the corresponding variants of the next (resp., previous) modalities. Additional requirements on the timed word , which can be easily checked by the transition function of an ECNA, capture the semantics of the various next and previous modalities, and the semantics of the real-time operators. Finally, the global fairness requirement, which can be easily checked by a standard generalized Büchi acceptance condition, captures the liveness requirements in until subformulas of the form (resp., ) of . In particular, when an abstract until formula is asserted at a position along an infinite timed word over and the MAP visiting position is infinite, we have to ensure that the liveness requirement holds at some position of the MAP . To this end, we use a special proposition which does not hold at a position of iff position has a caller whose matching return is defined. We now proceed with the technical details. The closure of is the smallest set containing:

• , each proposition , and formulas and ;

• all the subformulas of ;

• the formulas (resp., ) for all the subformulas (resp., ) of , where (resp., ).

• all the negations of the above formulas (we identify with ).

Note that and . In the following, elements of are seen as atomic propositions, and we consider the pushdown alphabet induced by . In particular, for a timed word over , we consider the clock valuation specifying the values of the event clocks , , , , and at position along , where .

An atom of is a subset of satisfying the following:

• is a maximal subset of which is propositionally consistent, i.e.:

• and for each , iff ;

• for each , iff ;

• contains exactly one atomic proposition in .

• for all and , either or .

• for all and , either or .

• if , then for all , .

• if , then for all , .

We now introduce the notion of Hintikka sequence which corresponds to an infinite timed word over satisfying additional constraints. These constraints capture the semantics of the variants of next, previous, and real-time modalities, and (partially) the intended meaning of proposition along the associated timed word over (the projection of over ). For an atom , let be the set of caller formulas in . For atoms and , we define a predicate which holds if the global next (resp., global previous) requirements in (resp., ) are the ones that hold in (resp., ), i.e.: (i) for all , iff , and (ii) for all , iff . Similarly, the predicate holds if: (i) for all , iff , and (ii) for all , iff , and additionally (iii) . Note that for to hold we also require that the caller requirements in and coincide consistently with the fact that the positions of a MAP have the same caller (if any).

###### Definition 3.

An infinite timed word over , where , is an Hintikka sequence of , if for all , is a -atom and the following holds:

1. Initial consistency: for all and , .

2. Global next and previous requirements: .

3. Abstract and caller requirements: we distinguish three cases.

• and : , iff ;

• and : , and ( iff the matching call of the return position is defined). Moreover, if , then and .

• : if then and ; otherwise and iff , where . Moreover, if , then and ( iff ).

4. Real-time requirements:

• for all and , iff ;

• for all and , iff .

In order to capture the liveness requirements of the global and abstract until subformulas of , and fully capture the intended meaning of proposition , we consider the following additional global fairness constraint. An Hintikka sequence of is fair if (i) for infinitely many , ; (ii) for all , there are infinitely many s.t. ; and (iii) for all , there are infinitely many such that and .

The Hintikka sequence is initialized if . Note that according to the intended meaning of proposition , for each infinite timed word over , holds at infinitely many positions. Moreover, there is at a most one infinite MAP  of , and for such a MAP  and each position greater than the starting position of , either belongs to and holds, or does not hold. Hence, the fairness requirement for an abstract until subformula of ensures that whenever is asserted at some position of , then eventually holds at some position along . Thus, we obtain the following characterization of the infinite models of , where is the mapping associating to each fair Hintikka sequence of , the infinite timed word over given by .

###### Proposition 1.

Let be a fair Hintikka sequence of . Then, for all and , iff . Moreover, the mapping is a bijection between the set of fair Hintikka sequences of and the set of infinite timed words over . In particular, an infinite timed word over is a model of iff the associated fair Hintikka sequence is initialized.

A proof of Proposition 1 is given in Appendix C. The notion of initialized fair Hintikka sequence can be easily captured by a generalized Büchi ECNA.

###### Theorem 3.

Given an EC_NTL formula , one can construct in singly exponential time a generalized Büchi ECNA  having states, stack symbols, a set of constants , and clocks. If is non-recursive, then accepts the infinite models of ; otherwise, accepts the set of initialized fair Hintikka sequences of .

###### Proof.

We first build a generalized Büchi ECNA  over accepting the set of initialized fair Hintikka sequences of . The set of states is the set of atoms of , and a state is initial if and satisfies Property 1 (initial consistency) in Definition 3. In the transition function, we require that the input symbol coincides with the source state in such a way that in a run, the sequence of control states corresponds to the untimed part of the input. By the transition function, the automaton checks that the input word is an Hintikka sequence. In particular, for the abstract next and abstract previous requirements (Property 3 in Definition 3), whenever the input symbol is a call, the automaton pushes on the stack the atom . In such a way, on reading the matching return (if any) of the call , the automaton pops from the stack and can locally check that holds. In order to ensure the real-time requirements (Property 4 in Definition 3), simply uses the recorder clocks and predictor clocks: a transition having as source state an atom has a clock constraint whose set of atomic constraints has the form

 ⋃⊲dirIψ∈A{x% dirψ∈I}∪⋃¬⊲dirIψ∈A{xdirψ∈ˆI}∪⋃⊳dirIψ∈A{ydirψ∈I}∪⋃¬⊳dirIψ∈A{ydirψ∈ˆI}\vspace−0.2cm

where is either or a maximal interval over disjunct from . Finally, the generalized Büchi acceptance condition is exploited for checking that the input initialized Hintikka sequence is fair. Details of the construction of can be found in Appendix D. Note that has states and stack symbols, a set of constants , and event clocks. If is non-recursive, then the effective clocks are only associated with propositions in . Thus, by projecting the input symbols of the transition function of over , by Proposition 1, we obtain a generalized Büchi ECNA accepting the infinite models of . ∎

We now deduce the main result of this section.

###### Theorem 4.

Given an EC_NTL formula over , one can construct in singly exponential time a VPTA, with states and stack symbols, clocks, and a set of constants , which accepts (resp., ). Moreover, satisfiability and visibly model-checking for EC_NTL over finite (resp., infinite) timed words are Exptime-complete.

###### Proof.

We focus on the case of infinite timed words. Fix an EC_NTL formula over . By Theorem 3, one can construct a generalized Büchi ECNA  over having states and stack symbols, a set of constants , and accepting the set of initialized fair Hintikka sequences of . By [15], one can construct a generalized Büchi VPTA  over accepting , having states and stack symbols, clocks, and a set of constants , where is the number of atomic constraints used by . Note that . Thus, by projecting the input symbols of the transition function of over , we obtain a (generalized Büchi) VPTA satisfying the first part of Theorem 4.

For the upper bounds of the second part of Theorem 4, observe that by [13, 2] emptiness of generalized Büchi VPTA is solvable in time , where is the number of states, is the number of clocks, and is the largest constant used in the clock constraints of the automaton (hence, the time complexity is polynomial in the number of states). Now, given a Büchi VPTA  over and an EC_NTL formula over , model-checking against reduces to check emptiness of , where is the generalized Büchi VPTA associated with . Thus, since Büchi VPTA are polynomial-time closed under intersection, membership in Exptime for satisfiability and visibly model-checking of EC_NTL follow. The matching lower bounds follow from Exptime-completeness of satisfiability and visibly model-checking for the logic CaRet [4] which is subsumed by EC_NTL. ∎

## 5 Nested Metric Temporal Logic (Nmtl)

Metric temporal logic (MTL) [19] is a well-known timed linear-time temporal logic which extends LTL with time constraints on until modalities. In this section, we introduce an extension of MTL with past, we call nested MTL (NMTL, for short), by means of timed versions of the CaRet modalities.

For the given set of atomic propositions containing the special propositions , , and , the syntax of nested NMTL formulas is as follows:

 φ:=⊤∣∣p∣∣φ∨φ∣∣¬φ∣∣φˆUdirIφ∣∣φˆSdir′Iφ\vspace−0.05cm

where , is an interval in