Deciding Hyperproperties Combined with Functional Specifications

Abstract

We study satisfability for HyperLTL with a ?*?* quantifer prefx, known to be highly undecidable in general. HyperLTL can express system properties that relate multiple traces (so-called hyperproperties), which are often combined with trace properties that specify functional behavior on single traces. Following this conceptual split, we frst defne several safety and liveness fragments of ?*?* HyperLTL, and characterize the complexity of their (often much easier) satisfability problem. We then add LTL trace properties as functional specifcations. Though (highly) undecidable in many cases, this way of combining "simple"HyperLTL and arbitrary LTL also leads to interesting new decidable fragments. This systematic study of ?*?* fragments is complemented by a new (incomplete) algorithm for *-HyperLTL satisfability.