@inproceedings{4440,
  abstract     = {We present a methodology for proving temporal properties of the divergent runs of reactive systems with real-valued clocks. A run diverges if time advances beyond any bound. Since the divergent runs of a system may satisfy liveness properties that are not satisfied by some convergent runs, the standard proof rules are incomplete if only divergent runs are considered. First, we develop a sound and complete proof calculus for divergence, which is based on translating clock systems into discrete systems. Then, we show that simpler proofs can be obtained for stronger divergence assumptions, such as unknown -divergence, which requires that all delays have a minimum duration of some unknown constant . We classify all real-time systems into an infinite hierarchy, according to how well they admit the translation of eventuality properties into equivalent safety properties.},
  author       = {Henzinger, Thomas A and Kopke, Peter},
  booktitle    = {3rd International Symposium on Formal Techniques in Real-Time and Fault-Tolerant Systems},
  location     = {Lübeck, Gernany},
  pages        = {351 -- 372},
  publisher    = {Springer},
  title        = {{Verification methods for the divergent runs of clock systems}},
  doi          = {10.1007/3-540-58468-4_173},
  volume       = {863},
  year         = {1994},
}

@article{4501,
  abstract     = {We extend the specification language of temporal logic, the corresponding verification framework, and the underlying computational model to deal with real-;time properties of reactive systems. The abstract notion of timed transition systems generalizes traditional transition systems conservatively: qualitative fairness requirements are replaced (and superseded) by quantitative lower-bound and upper-bound timing constraints on transitions. This framework can model real-time systems that communicate either through shared variables or by message passing and real-time issues such as timeouts, process priorities (interrupts), and process scheduling. We exhibit two styles for the specification of real-time systems. While the first approach uses time-bounded versions of the temporal operators, the second approach allows explicit references to time through a special clock variable. Corresponding to the two styles of specification, we present and compare two different proof methodologies for the verification of timing requirements that are expressed in these styles. For the bounded-operator style, we provide a set of proof rules for establishing bounded-invariance and bounded-responce properties of timed transition systems. This approach generalizes the standard temporal proof rules for verifying invariance and response properties conservatively. For the explicit-clock style, we exploit the observation that every time-bounded property is a safety property and use the standard temporal proof rules for establishing safety properties.},
  author       = {Henzinger, Thomas A and Manna, Zohar and Pnueli, Amir},
  issn         = {0890-5401},
  journal      = {Information and Computation},
  number       = {2},
  pages        = {273 -- 337},
  publisher    = {Elsevier},
  title        = {{Temporal proof methodologies for timed transition systems}},
  doi          = {10.1006/inco.1994.1060},
  volume       = {112},
  year         = {1994},
}

@article{4503,
  abstract     = {We describe finite-state programs over real-numbered time in a guarded-command language with real-valued clocks or, equivalently, as finite automata with real-valued clocks. Model checking answers the question which states of a real-time program satisfy a branching-time specification (given in an extension of CTL with clock variables). We develop an algorithm that computes this set of states symbolically as a fixpoint of a functional on state predicates, without constructing the state space. For this purpose, we introduce a μ-calculus on computation trees over real-numbered time. Unfortunately, many standard program properties, such as response for all nonzeno execution sequences (during which time diverges), cannot be characterized by fixpoints: we show that the expressiveness of the timed μ-calculus is incomparable to the expressiveness of timed CTL. Fortunately, this result does not impair the symbolic verification of "implementable" real-time programs-those whose safety constraints are machine-closed with respect to diverging time and whose fairness constraints are restricted to finite upper bounds on clock values. All timed CTL properties of such programs are shown to be computable as finitely approximable fixpoints in a simple decidable theory.},
  author       = {Henzinger, Thomas A and Nicollin, Xavier and Sifakis, Joseph and Yovine, Sergio},
  issn         = {0890-5401},
  journal      = {Information and Computation},
  number       = {2},
  pages        = {193 -- 244},
  publisher    = {Elsevier},
  title        = {{Symbolic model checking for real-time systems}},
  doi          = {10.1006/inco.1994.1045},
  volume       = {111},
  year         = {1994},
}