HyperTWTL: A Timed Hyperproperty Logic

• HyperTWTL is a hyperproperty specification language that extends Time Window Temporal Logic with explicit trace quantifiers to capture multi-execution timed properties.
• It leverages bounded-time task operators and serial concatenation to concisely express security, concurrency, and performance constraints in cyber-physical systems and robotics.
• It underpins verification and policy synthesis frameworks, enabling automated automata construction and secure reinforcement learning through model checking and MDP-based approaches.

Searching arXiv for HyperTWTL papers to ground the article in the cited literature. HyperTWTL is a hyperproperty specification language obtained by extending Time Window Temporal Logic (TWTL) with explicit quantification over multiple execution traces, thereby enabling the specification of timed relational properties over sets of traces rather than over individual traces alone. In the formalization introduced in "Model Checking Time Window Temporal Logic for Hyperproperties" (Bonnah et al., 2023), HyperTWTL targets security, performance, and concurrency constraints in cyber-physical systems and robotics by combining TWTL’s bounded-time task operators with trace quantifiers and, in the asynchronous setting, trajectory quantifiers. Subsequent work on secure reinforcement learning treats HyperTWTL as a domain-specific language for constraining learning with opacity and security requirements in robotic missions (Bonnah et al., 31 Jul 2025).

1. Origins, motivation, and scope

HyperTWTL is motivated by the distinction between trace properties and hyperproperties. Following the formulation adopted in (Bonnah et al., 2023), a hyperproperty is a set of sets of traces: if $\mathrm{Traces}(M)$ denotes the set of traces of a system $M$, then a hyperproperty $H \subseteq 2^{\mathrm{Traces}(M)}$ classifies which sets of executions are acceptable. This allows direct specification of policies such as noninterference, opacity, observational determinism, robustness, and concurrency consistency, all of which relate multiple runs of a system rather than a single run.

The logic extends TWTL, a domain-specific logic for robotics designed to express time-bounded tasks and deadlines compactly. TWTL includes the hold operator $H^d a$, the within operator $[\phi]^{[\tau,\tau']}$, concatenation $\phi_1 \ \phi_2$, and Boolean connectives. In (Bonnah et al., 2023), TWTL is described as particularly suitable for succinct encodings of robotic mission specifications with deadlines and serial task composition. HyperTWTL adds explicit trace quantifiers so that such bounded-time task structure can be lifted to multi-trace specifications.

This design places HyperTWTL in relation to existing quantified temporal logics such as HyperLTL and HyperMTL. The distinction emphasized in (Bonnah et al., 2023) is that HyperLTL cannot express quantitative time or window-bounded tasks, while HyperMTL introduces timed hyperproperties but does not inherit TWTL’s specific combination of time-window operators and concatenation that yields compact serial-task specifications for robotics. The secure reinforcement learning formulation in (Bonnah et al., 31 Jul 2025) further characterizes HyperTWTL as more expressive than single-trace logics such as LTL and TWTL for multi-trace security constraints, while remaining practically useful through automata-based constructions.

A central application domain is robotics and cyber-physical systems. The sources specifically mention information-flow security, timing side-channel defenses, opacity, service-level agreement constraints, synchronization, linearizability-like relations, and security-aware mission planning (Bonnah et al., 2023, Bonnah et al., 31 Jul 2025).

2. Formal language and core operators

The TWTL grammar given in (Bonnah et al., 2023) is

$$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$

where $a \in AP$, $d \in Z$, and $\tau,\tau' \in Z$ with $M$0.

The HyperTWTL syntax introduced there is

$M$1

Here $M$2 ranges over trace variables and $M$3 over trajectory variables. The synchronous form uses indexed propositions such as $M$4, whereas the asynchronous form uses $M$5.

The reinforcement learning work (Bonnah et al., 31 Jul 2025) presents a closely related synchronous grammar: $M$6 with $M$7 denoting concatenation. This formulation is explicitly restricted to alternation-free HyperTWTL in its automata-based enforcement pipeline.

The meaning of the principal operators is consistent across the sources. The hold operator $M$8 requires that proposition $M$9 be maintained for $H \subseteq 2^{\mathrm{Traces}(M)}$0 time units. The within operator requires satisfaction inside a bounded time window. Concatenation encodes sequential task execution with a one-step gap. The quantifiers $H \subseteq 2^{\mathrm{Traces}(M)}$1 and $H \subseteq 2^{\mathrm{Traces}(M)}$2 range over traces, enabling direct relational specifications across executions. In the asynchronous semantics of (Bonnah et al., 2023), $H \subseteq 2^{\mathrm{Traces}(M)}$3 and $H \subseteq 2^{\mathrm{Traces}(M)}$4 quantify over fair trajectories governing relative trace progress.

A representative formula used in (Bonnah et al., 2023) to illustrate succinct sequencing across traces is

$H \subseteq 2^{\mathrm{Traces}(M)}$5

which states that for every pair of traces, $H \subseteq 2^{\mathrm{Traces}(M)}$6 holds for $H \subseteq 2^{\mathrm{Traces}(M)}$7 steps on $H \subseteq 2^{\mathrm{Traces}(M)}$8 within $H \subseteq 2^{\mathrm{Traces}(M)}$9, and afterward $H^d a$0 holds for $H^d a$1 steps on $H^d a$2 within $H^d a$3.

3. Semantic foundations: synchronous and asynchronous interpretations

In (Bonnah et al., 2023), systems are modeled as Timed Kripke Structures

$H^d a$4

where states are finite, transitions carry discrete time durations, and each state is labeled by atomic propositions. A timed trace is an infinite sequence

$H^d a$5

with timestamps $H^d a$6 and events $H^d a$7 consistent with the state labeling.

The paper first gives TWTL semantics over subtraces $H^d a$8, including clauses for hold, conjunction, negation, concatenation, and within. The concatenation semantics uses earliest completion of the first subformula before requiring the second immediately after, while the within operator searches for a witness position inside the designated time window (Bonnah et al., 2023).

For synchronous HyperTWTL semantics, a partial assignment $H^d a$9 maps each trace variable to a trace-position pair. The semantics

$[\phi]^{[\tau,\tau']}$0

evaluates all indexed propositions at the same discrete time positions across traces. Quantifiers bind trace variables to traces starting at position $[\phi]^{[\tau,\tau']}$1, and the temporal operators are interpreted over aligned time indices. This synchronous interpretation is also the one adopted in the secure reinforcement learning treatment (Bonnah et al., 31 Jul 2025), which assumes synchronized timestamps across quantified traces.

The asynchronous semantics in (Bonnah et al., 2023) introduces trajectory variables and fair trajectories to model differing speeds of time across traces and stuttering. A trajectory is an infinite sequence of non-empty subsets of trace variables indicating which traces advance at each step. A mapping $[\phi]^{[\tau,\tau']}$2 assigns trajectory variables to fair trajectories. Satisfaction is then defined as

$[\phi]^{[\tau,\tau']}$3

with additional constraints in the within operator involving sets $[\phi]^{[\tau,\tau']}$4 and $[\phi]^{[\tau,\tau']}$5, where $[\phi]^{[\tau,\tau']}$6 constrains aligned progress and $[\phi]^{[\tau,\tau']}$7 constrains inter-trace timing variability.

The relationship between these semantics is operationally important. Proposition 2 in (Bonnah et al., 2023) states informally that for a set of traces $[\phi]^{[\tau,\tau']}$8 and an alternation-free asynchronous HyperTWTL formula $[\phi]^{[\tau,\tau']}$9, one can construct a stutter-padded invariant trace set $\phi_1 \ \phi_2$0 and a synchronous formula $\phi_1 \ \phi_2$1 such that

$\phi_1 \ \phi_2$2

This reduction introduces silent events $\phi_1 \ \phi_2$3 to synchronize timestamps while preserving interval patterns.

A further semantic notion introduced in (Bonnah et al., 31 Jul 2025) is the execution deadline $\phi_1 \ \phi_2$4, the maximum time required to verify a HyperTWTL formula. It is defined recursively: quantifiers do not change the deadline; holds contribute $\phi_1 \ \phi_2$5; conjunction uses $\phi_1 \ \phi_2$6; negation preserves the inner deadline; concatenation contributes $\phi_1 \ \phi_2$7; and a within operator contributes the upper bound of its interval. This quantity is later used to construct timed product models for constrained reinforcement learning.

4. Expressiveness for security, opacity, and concurrency

The principal contribution of HyperTWTL is the ability to state bounded-time relations among multiple runs. In (Bonnah et al., 2023), this is framed as essential for information-flow security, side-channel defense, and concurrency properties that cannot be expressed by single-trace TWTL. The logic supports direct reference to propositions indexed by trace variables and, in the asynchronous setting, by trajectory variables.

Several canonical specifications are provided in (Bonnah et al., 2023). A synchronous noninterference-style formula is written as

$\phi_1 \ \phi_2$8

An asynchronous observational determinism formula is

$\phi_1 \ \phi_2$9

A side-channel timing defense formula constrains mission completions to occur within bounded timing proximity across traces despite different progression speeds: $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$0

Concurrency and linearizability-like synchronization are represented through formulas requiring the same states or mission stages to be occupied consistently across runs in corresponding windows. One example from (Bonnah et al., 2023) is

$$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$1

The secure reinforcement learning study (Bonnah et al., 31 Jul 2025) develops this security-oriented expressiveness in a pick-up and delivery mission. It gives an opacity formula

$$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$2

and a side-channel timing countermeasure

$$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$3

These examples collectively establish the characteristic use case of HyperTWTL: bounded-time multi-trace constraints in which agreement, divergence, proximity, and sequencing must be expressed together. The repeated contrast with HyperLTL, HyperMTL, and HyperSTL in (Bonnah et al., 2023) indicates that the key advantage is not merely timed hyperproperty expressiveness, but concise expression of deadline-driven task composition.

5. Verification and model-checking methodology

The model-checking framework in (Bonnah et al., 2023) reduces fragments of HyperTWTL to TWTL model checking. The supported fragments are alternation-free $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$4 and $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$5 formulas, along with bounded single-alternation $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$6 formulas under flattening constraints. The general setting with unrestricted quantifier alternation is reported as undecidable.

The reduction has three principal ingredients. First, self-composition constructs a product model with one copy per quantified trace. Given a formula $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$7, the system is transformed into a self-composed model $$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$8 with as many copies as the number of quantifiers. For two traces, the paper writes

$$\begin{aligned} & \phi:= \top \mid H^{d} a \mid H^{d} \neg a \mid \phi_1 \wedge \phi_2 \mid \neg \phi \mid \phi_1 \phi_2 \mid [\phi]^{[\tau, \tau']} \end{aligned}$$9

Second, the HyperTWTL body is translated into an equivalent TWTL formula over fresh propositions. Indexed atomic propositions such as $a \in AP$0 or $a \in AP$1 are replaced with proposition names tied to individual copies. Where the same proposition is observed across traces, shared fresh names $a \in AP$2 are introduced; where different propositions are used, superscripted copy indices distinguish them (Bonnah et al., 2023).

Third, asynchronous formulas are reduced to synchronous ones by the $a \in AP$3 and $a \in AP$4 construction described earlier. After this preprocessing, existing TWTL verification technology can be used. The paper explicitly states that the PyTWTL tool is employed after translation (Bonnah et al., 2023).

Algorithm 1 in (Bonnah et al., 2023) is summarized as follows: if the formula is asynchronous, compute $a \in AP$5; otherwise keep $a \in AP$6. Then translate HyperTWTL to plain TWTL, generate the self-composed model, and verify the resulting TWTL formula on that model using PyTWTL, returning SAT or UNSAT.

Two correctness results are highlighted. Proposition 1 states that if an equivalent TWTL formula $a \in AP$7 exists for a HyperTWTL formula $a \in AP$8, then

$a \in AP$9

Proposition 2 gives the asynchronous-to-synchronous preservation result for alternation-free formulas (Bonnah et al., 2023).

Complexity bounds are also provided. The asynchronous-to-synchronous translation runs in $d \in Z$0. The HyperTWTL-to-TWTL translation takes $d \in Z$1 in the worst case due to fresh proposition introduction. Model generation by self-composition is $d \in Z$2, where $d \in Z$3 is the number of quantified traces. Alternation-free and bounded $d \in Z$4 fragments are reported as PSPACE-complete, while general $d \in Z$5 alternation fragments are undecidable (Bonnah et al., 2023).

6. Automata constructions and secure reinforcement learning

The secure reinforcement learning framework of (Bonnah et al., 31 Jul 2025) extends the use of HyperTWTL from offline verification to policy synthesis in Markov Decision Processes. The setting models the robot and environment as an MDP

$d \in Z$6

with state labels inducing timed traces. The satisfaction probability of a HyperTWTL formula under a stationary deterministic policy $d \in Z$7 is written as $d \in Z$8, with expectation taken over the distribution on trace sets induced by the policy.

The proposed SecRL pipeline consists of four steps: compile alternation-free HyperTWTL into automata; build a product MDP with the automaton; augment with time to form a Timed MDP and prune infeasible actions; and learn using dynamic Boltzmann softmax reinforcement learning with $d \in Z$9-greedy exploration while optimizing reward subject to HyperTWTL satisfaction (Bonnah et al., 31 Jul 2025).

For closed alternation-free formulas $\tau,\tau' \in Z$0, the paper constructs $\tau,\tau' \in Z$1-equivalent NFAs for quantified subformulas and determinizes them into DFAs using standard subset construction. The synchronized DFA-Kripke product is then formed, and from this a product MDP

$\tau,\tau' \in Z$2

is defined with $\tau,\tau' \in Z$3 and transition probabilities preserved wherever DFA progress is consistent with observed labels. Theorem 2 states that for any stationary deterministic policy, satisfaction probabilities of $\tau,\tau' \in Z$4 are preserved between $\tau,\tau' \in Z$5 and the product MDP $\tau,\tau' \in Z$6 (Bonnah et al., 31 Jul 2025).

A Timed MDP

$\tau,\tau' \in Z$7

is obtained by augmenting the product MDP with a counter ranging over $\tau,\tau' \in Z$8. Reachable states, $\tau,\tau' \in Z$9-probabilistic transitions, and a distance-to-acceptance function $M$00 are defined to support pruning. Offline pruning removes actions for which a lower bound on the probability of reaching the accepting set within the remaining horizon falls below a threshold $M$01, or for which the remaining time is insufficient. This pruning is summarized in Algorithm 1 of (Bonnah et al., 31 Jul 2025).

The reinforcement learning component combines $M$02-greedy and Boltzmann softmax action selection. The softmax policy is

$M$03

and Q-values are updated on the pruned Timed MDP by

$M$04

Theorem 3 states that, under the stated assumptions on $M$05-probabilisticity and bounded distance increase, pruning plus constrained learning ensures satisfaction with probability at least $M$06 within $M$07 (Bonnah et al., 31 Jul 2025).

This suggests a methodological shift: HyperTWTL is not only a specification and verification formalism but also a constraint language for probabilistic policy learning in security-sensitive robotic domains.

7. Empirical studies, limitations, and research directions

The model-checking evaluation in (Bonnah et al., 2023) is based on a TESS surveillance mission modeled as a Timed Kripke Structure with weighted transitions. The mission involves start, surveillance of specified regions, alternative branch tasks, a final visit to region $M$08, and charging at $M$09 or $M$10 within given windows. Seven HyperTWTL properties, including opacity, noninterference, linearizability, mutation testing, side-channel timing defense, observational determinism, and service-level agreement, were translated to TWTL and verified using PyTWTL on Windows 10 with 64 GB RAM and an Intel i9-10900 CPU. The reported verdicts were SAT for $M$11, $M$12, and $M$13, and UNSAT for $M$14, $M$15, $M$16, and $M$17. Representative verification times were 16.30–25.19 seconds, with memory usage 15.21–17.48 MB (Bonnah et al., 2023).

The same paper also demonstrates path synthesis on grid environments using TWTL synthesis after reduction. For a shortest-path objective $M$18, synthesis times increase from 23.08s on a $M$19 grid to 161.17s on a $M$20 grid. An initial-state opacity objective $M$21 is also synthesized with scaling trends in time and memory reported qualitatively in the same setting (Bonnah et al., 2023).

The secure reinforcement learning evaluation in (Bonnah et al., 31 Jul 2025) uses a pick-up and delivery mission on an $M$22 grid with regions $M$23, $M$24, $M$25, $M$26, $M$27, obstacles $M$28, and observable features $M$29. Actions are $M$30. The proposed Softmax-$M$31 RL is compared against Dyna-Q with TWTL constraints and standard Q-learning. Experimental settings include up to 50,000 episodes, sample efficiency evaluation at 30,000 episodes, and parameters $M$32, $M$33, and $M$34. Across opacity and side-channel tasks, the reported $M$35 ratios lie in the range 1.02–1.26, with faster and higher convergence than the baselines. In scalability tests with 20 tasks and 100,000 episodes, execution time grows roughly linearly with grid size and episode horizon, from approximately 425 s at a $M$36 grid with $M$37 to approximately 7,221 s at a $M$38 grid with $M$39 (Bonnah et al., 31 Jul 2025).

The limitations reported in (Bonnah et al., 2023) include undecidability of full HyperTWTL model checking with arbitrary quantifier alternations, the restriction to alternation-free and some bounded $M$40 fragments, and the prohibition on temporal nesting that mixes different traces in a single temporal subformula body. The asynchronous reduction relies on stuttering-insensitive constructions, $M$41-padding, fair trajectories, and bounded-time windows. The reinforcement learning framework adds further assumptions: alternation-free formulas, synchronous timestamps, finite state and action spaces, sufficient observability through the labeling function, and manageable determinization cost (Bonnah et al., 31 Jul 2025).

Future directions in the sources include extending monitoring and synthesis to broader alternation classes, improving algorithms through approaches such as alternating automata or QBF-based bounded model checking, integrating controller synthesis for hyperproperties, improving handling of asynchronous semantics, scaling automata construction via symbolic or online monitoring, and addressing continuous or partially observable domains (Bonnah et al., 2023, Bonnah et al., 31 Jul 2025).

Taken together, these works position HyperTWTL as a timed hyperproperty logic specialized for deadline-driven, multi-trace reasoning in robotics and cyber-physical systems. Its defining technical features are explicit trace quantification, TWTL-style bounded temporal operators, support for both synchronous and asynchronous semantics, and reduction-based verification and synthesis workflows that connect relational temporal specifications to existing automata and planning machinery (Bonnah et al., 2023, Bonnah et al., 31 Jul 2025).