Timed Obstruction Logic (TOL)

• Timed Obstruction Logic (TOL) is a temporal logic that extends Obstruction Logic with clocks, timed delays, and strategic obstruction for real-time multi-agent games.
• It is interpreted over Weighted Timed Automata and Weighted Transition Systems, integrating clock constraints and freeze quantifiers to define dynamic timed behaviors.
• The verification procedure uses symbolic zone graphs and fixed-point iterations, achieving PSPACE-complete complexity similar to classical timed temporal logics like TCTL.

Searching arXiv for the specified papers to ground the article. Use arxiv_search with query "id:(Cortes et al., 7 Oct 2025) OR (Cortes et al., 7 Oct 2025)" Searching for "(Cortes et al., 7 Oct 2025)" on arXiv. Timed Obstruction Logic (TOL) is a temporal logic for specifying and verifying real-time properties in dynamic and timed multi-agent games, especially cybersecurity games in which one player can temporarily and strategically disable transitions subject to a cost bound. It is presented as an extension of Obstruction Logic (OL), is interpreted over Weighted Timed Automata (WTA) and their associated Weighted Transition Systems (WTS), and comes with a verification procedure whose model-checking complexity is PSPACE-complete, not higher than that of classical timed temporal logics such as TCTL (Cortes et al., 7 Oct 2025).

1. Lineage from obstruction games

TOL is introduced for reactive real-time applications embedded in infrastructures such as airports, hospitals, and oil pipelines, where malicious cyber-attacks motivate reliable verification methods and system design tools. The underlying perspective is that Timed Game Theory provides a sound theoretical foundation for modeling strategic interactions between attackers and defenders, and that these interactions unfold in dynamic models whose evolution depends on both discrete and continuous behavior (Cortes et al., 7 Oct 2025).

Its immediate predecessor is Obstruction Logic (OL), a formalism designed for strategic reasoning in dynamic, adversarial settings such as cybersecurity games. In OL, the game arena is a weighted directed graph; the “demon” selects subsets of edges to temporarily disable, constrained by a total cost bound $n$, while the “traveler” tries to achieve temporal objectives such as reachability. The central OL operator has the form $\langle_n\rangle \theta$, with the semantics that there exists a demon strategy, disabling edges with total cost at most $n$, such that all compatible paths satisfy $\theta$ (Leneutre et al., 2024).

TOL extends this obstruction-based view from static or untimed weighted graphs to timed game models. The extension is not merely a change of vocabulary. It adds clocks, clock constraints, timed delays, and real-time objectives, thereby making the obstruction operator meaningful in settings where both actions and the passage of time affect what the players can force (Cortes et al., 7 Oct 2025).

2. Formal language and model class

TOL formulas are interpreted over WTA and WTS. The syntax is given over a set of atomic propositions $AP$, a set of automaton clocks $X$, and a set of clocks $J$ that are local to the formula and disjoint from $X$ (Cortes et al., 7 Oct 2025).

The grammar is:

$\varphi ::= \top \mid p \mid \neg \varphi \mid \varphi_1 \land \varphi_2 \mid \phi \mid \naww{_n} (\varphi_1 U \varphi_2) \mid \naww{_n}(\varphi_1 R \varphi_2) \mid j.\varphi$

Here, $\phi \in \Phi(X \cup J)$ is a clock constraint, the operator $\langle_n\rangle \theta$0 denotes a strategic grade $\langle_n\rangle \theta$1, $\langle_n\rangle \theta$2 is until, $\langle_n\rangle \theta$3 is release, and $\langle_n\rangle \theta$4 is a freeze quantifier that resets the formula clock $\langle_n\rangle \theta$5 to $\langle_n\rangle \theta$6 for the scope of $\langle_n\rangle \theta$7. The paper’s example

$\langle_n\rangle \theta$8

means: “There is a demonic strategy so that along all compatible paths, $\langle_n\rangle \theta$9 holds continuously until, within 7 time units, $n$0 becomes true” (Cortes et al., 7 Oct 2025).

This syntax combines Boolean structure, clock constraints, temporal structure, and strategic grading in a single formalism. The presence of clocks local to formulas is particularly important because deadlines can be expressed without requiring every timing constraint to be built into the automaton itself. This suggests that TOL is intended not only as a specification language for timed models, but also as a property language for timed strategic verification.

3. Semantics of obstruction in timed settings

TOL formulas are evaluated at states $n$1, where $n$2 is a location and $n$3 is a clock valuation. Atomic propositions are read through the state-labeling function, clock constraints are interpreted directly over $n$4, and Boolean connectives are standard (Cortes et al., 7 Oct 2025).

The strategic temporal clauses are the semantic core. For until:

$n$5

iff there is an $n$6-strategy $n$7 such that for all compatible paths, there exists an index $n$8 with $n$9 and for all $\theta$0, $\theta$1.

For release:

$\theta$2

iff there is an $\theta$3-strategy $\theta$4 such that for all compatible paths, either $\theta$5 holds forever, or there exists $\theta$6 such that $\theta$7 holds at $\theta$8 and $\theta$9 holds at every position up to $AP$0 (Cortes et al., 7 Oct 2025).

The freeze quantifier is interpreted by clock reset:

$AP$1

An $AP$2-strategy is a function that, at each step, deactivates a subset of outgoing edges from the current state such that the total cost does not exceed $AP$3. A path is compatible if it never uses deactivated edges. The resulting semantics preserves the adversarial reading inherited from OL, but relocates it inside a timed semantics with both discrete transitions and timed delays (Cortes et al., 7 Oct 2025).

4. Expressive position relative to OL, TCTL, and POTL

The extension from OL to TOL is characterized in the source material by several concrete additions: time and clocks, continuous-time semantics, timed objectives through freeze quantifiers and clock constraints, and strategic reasoning over weighted timed automata rather than static weighted graphs (Cortes et al., 7 Oct 2025). In OL, the obstruction operator governs which paths remain possible in a weighted directed graph; in TOL, the same strategic idea is embedded in a timed game model (Leneutre et al., 2024).

The paper states that TCTL is a fragment of TOL, specifically TOL$AP$4, where the strategic grade is fixed at $AP$5. The translation is expressed as

$AP$6

Accordingly, the grade-$AP$7 obstruction operator acts like the universal path quantifier in TCTL because no deactivation is allowed and all paths are considered. On that basis, TOL is described as strictly more expressive than TCTL: it can express all TCTL properties and, in addition, properties involving dynamic strategic obstruction and real-time objectives (Cortes et al., 7 Oct 2025).

The source also places TOL in relation to the Timed $AP$8-Calculus and Timed ATL (Alternating-time Temporal Logic): TOL can be translated to fragments of the Timed $AP$9-Calculus, and it relates to Timed ATL by extending strategic reasoning to dynamic models with timing constraints (Cortes et al., 7 Oct 2025).

A second comparison arises from the later development of Probabilistic Obstruction Temporal Logic (POTL). That work explicitly references TOL as a related logic extending OL to timed settings, adding that operators such as bounded until $X$0 and bounded release $X$1 in POTL overlap with TOL’s temporal operators. The distinction is that POTL adds probabilistic modeling and reasoning over probabilistic outcomes, whereas TOL is the timed extension centered on real-time constraints, timed transitions, and clocks (Leneutre et al., 2024).

5. Symbolic verification procedure and complexity

The verification procedure for TOL is based on a symbolic zone graph rather than the infinite concrete state space of a WTA. The zone graph symbolically represents sets of states using clock constraints, and the model checker computes, for each subformula, the set of symbolic states satisfying it (Cortes et al., 7 Oct 2025).

For atomic propositions and Boolean connectives, the procedure uses standard set-theoretic operations. For the strategic temporal operators $X$2 and $X$3, it uses backward reachability and fixed-point iteration over the zone graph. The central symbolic operation is the computation of obstruction predecessor sets via the operator $X$4, which collects states that are $X$5-obstruction predecessors of a zone. The source gives the key formula:

$X$6

For the until operator, the fixed-point computation is presented as: $J$0

The algorithm is stated to be sound and complete, and it terminates because the zone graph is finite for finite WTAs with bounded clock constants. The complexity result is PSPACE-completeness. The upper bound follows from symbolic zone graph algorithms as in TCTL; the lower bound is inherited from TCTL because TCTL is encoded as a fragment of TOL. The significance claimed in the paper is precise: TOL increases the expressiveness of properties without incurring any cost in terms of complexity relative to classical timed temporal logics such as TCTL (Cortes et al., 7 Oct 2025).

6. Real-time security properties and practical use

TOL is motivated by real-time cybersecurity and privacy applications, and the source emphasizes its use for describing important timed properties of real-time cybersecurity games. The intended setting is one in which attackers and defenders interact over dynamic timed models, and the verification target is often a time-bounded defensive guarantee (Cortes et al., 7 Oct 2025).

A representative property is:

$X$7

The source explains this as: “It is always the case that if the attacker gets root, then within 3 time units the defender can identify them, for all strategies the Demon can deploy within cost $X$8” (Cortes et al., 7 Oct 2025).

This type of formula illustrates the main contribution of TOL in application terms. It does not describe only untimed reachability or static safety. It combines obstruction, deadlines, and temporal persistence in a single specification. In that sense, TOL is positioned as a logic for dynamic defense, time-bounded response properties, and broader strategic real-time verification in multi-agent systems (Cortes et al., 7 Oct 2025).

The implementation claim in the source is equally specific: the logic and model checking have been implemented in the VITAMIN tool and applied to practical models including pipelines and mesh networks, with encouraging performance on small to medium-sized cases (Cortes et al., 7 Oct 2025). A plausible implication is that the logic was designed with symbolic verification in mind from the outset, rather than as a purely axiomatic extension of OL.

7. Conceptual boundaries and recurring points of confusion

TOL should be distinguished from OL by the presence of clocks, clock constraints, freeze quantifiers, and continuous-time semantics. OL is interpreted over weighted directed graphs and centers on strategic edge deactivation under a cost bound; TOL transfers that obstruction mechanism to weighted timed automata and real-time objectives (Leneutre et al., 2024).

It should also be distinguished from TCTL. The source does not present TOL as a notational variant of TCTL with an extra parameter, but as a logic in which TCTL appears as the fragment TOL$X$9. The additional expressive power comes from strategic obstruction in dynamic timed games, not merely from restating standard timed path quantification (Cortes et al., 7 Oct 2025).

Finally, TOL should not be conflated with POTL. The POTL paper states that bounded temporal operators in POTL overlap with TOL’s temporal operators and that TOL extends OL to timed settings, but POTL incorporates probabilistic elements and is interpreted over Probabilistic Obstruction Temporal Structures. TOL, by contrast, is the timed non-probabilistic logic over WTA and WTS. This suggests a clean conceptual division: OL supplies the obstruction paradigm, TOL adds real-time structure, and POTL adds probabilistic reasoning (Leneutre et al., 2024).