The CAFE MOSAIC (LEI CINDY EDSTROM) company was registered on , in . Current status of the organization and type Sole Proprietor. The registering agent is located at the address . Get the credit report on the CAFE MOSAIC (LEI CINDY EDSTROM). Governing persons are: LEI CINDY EDSTROM. Credt score.


My son just bought a 92 VIvio RXR. One of only a handful in the US. Looking for any info I can come up with on the car. It's a great car, fun to drive. Looking to get a little more speed out of the car by maybe changing the S/C pulley. Any help would be great.


text:
'It just feels so near': Muslim community in shock after New Zealand mosque shootings | CBC News Loaded
'It just feels so near': Muslim community in shock after New Zealand mosque shootings
Police are stepping up their presence around mosques in Ottawa and Gatineau, Que., following a pair of deadly shootings that have left the capital's Muslim community in "absolute shock."
Vigil set for 6 p.m. Friday at the Canadian Tribute to Human Rights monument on Elgin Street
CBC News · Posted: Mar 15, 2019 9:27 AM ET | Last Updated: March 15, 2019
Ahmed Souissi regularly visits the mosque at the centre islamique de l'Outaouais in Gatineau. He said he's struggling to understand the motivation behind Friday's deadly mosque shootings in New Zealand. (CBC)
Police are stepping up their presence around mosques in Ottawa and the Gatineau, Que., area following a pair of deadly shootings that have left the capital's Muslim community in "absolute shock."
Forty-nine people were killed and another 42 injured in attacks at two Christchurch mosques filled with worshippers, in what New Zealand's prime minister is calling one of the country's "darkest days."
At least 49 killed, 20 seriously wounded in attacks on New Zealand mosques
Canada's threat level unchanged, police presence bolstered after New Zealand mosque attacks
In Ottawa, police say they're following a protocol to try to help people in the community feel safe and supported.
As a result of the senseless attacks in #Christchurch , I have issued this letter to our @ottawacity community and faith leaders this morning. #OneCommunity pic.twitter.com/ita6AOOmew
—@ChiefBordeleau
"We have no intelligence to suggest that any group in Ottawa is allied with the suspects in New Zealand, but the possibility of a copycat lone actor is always a concern," wrote police Chief Charles Bordeleau in a letter to the community.
"Police presence alone has been shown to have a definitive effect on discouraging lone actor attackers."
An Ottawa police cruiser is parked outside the Ottawa Mosque on Northwestern Avenue, following Friday's fatal shootings at two mosques in Christchurch, New Zealand. (Jean Delisle/CBC)
'We are with you'
A gathering was held at Ottawa's main mosque, the Ottawa Muslim Association on Northwestern Avenue, at 12:15 p.m. Friday, where residents were invited "to show our solidarity."
Martin Lee, a New Zealander from Christchurch who's been living in Canada since 2007, told CBC News at the gathering that he's been to the mosque where the attack occurred.
He said news of the attack shocked him, and that he had a message for the capital region's Muslim community.
"There's a word, a phrase in Maori, the native language of New Zealand. I'm not Maori, but we use it in New Zealand. 'Kia kaha' — it means to stand strong, effectively it expresses solidarity, it expresses that I see the person for who they are," Lee said.
"And the local New Zealand community would like to say kia kaha to the local Muslim brothers and sisters, our neighbours, our family. Kia kaha — we see you, and we are with you."
A vigil has been scheduled for 6 p.m. ET Friday at the Canadian Tribute to Human Rights monument at the corner of Elgin and Lisgar streets.
There will also be a book of condolence available to sign at the New Zealand High Commission on the 14th floor of 150 Elgin St. from 9 a.m. to 3 p.m. Monday and Tuesday.
Martin Lee organized a group of local New Zealanders to attend midday prayers at Ottawa's main mosque and express solidarity with the local Muslim community after Friday's attack. (Stu Mills/CBC)
Across the river in Gatineau, police said Friday that they're sending more officers to their two mosques around prayer times.
Outside Gatineau's Outaouais Islamic Centre, Ahmed Souissi said he can't understand why this happened.
"Some people think Muslims are enemies of other nations or religions. It's not true. It's better to make an effort to understand [each other]," he said.
"There are [anti-Muslim] extremists, these things can always happen," added Benamar Boudjienan. "There are also politicians who fuel this hatred towards 'the other.'"
The centre's president Hayet Laggoune said in a statement its leadership is shocked and saddened and asks members to be on the lookout for anything suspicious.
Hayet Laggoune, president of the Outaouais Islamic Centre, says their hearts are with the families and wounded in New Zealand. (Lorian Bélanger/Radio-Canada)
'My hands were shaking'
Amira Elghawaby, a human rights advocate in Ottawa and a board member of the Canadian Anti-Hate Network, woke up to the news this morning and said she was in "absolute shock."
"My hands were shaking. My stomach was aching. It was really, really difficult to read," said Elghawaby.
Fingers shaking as I type, thinking of those taken away.

When hate strikes, we are weaker, more vulnerable, battling anxiety as we think of our schools, our places of worship.

The hijabs we wear, kufis, robes, turbans.

No one should be this afraid.#ChristchurchMosqueAttack
—@AmiraElghawaby
The situation still feels raw, she said.
"It wasn't so long ago that we were marking the second anniversary of the Quebec City mosque shooting," said Elghawaby.
"Being a visible Muslim … it just feels so near, even though it's so far away."
Amira Elghawaby, seen here in 2017, says her hands were shaking as she heard the the news about Friday's fatal mosque shootings in Christchurch, New Zealand. (Justin Tang/Canadian Press)
Peace Tower flag lowered
Ottawa's Barâa Arar said she felt this morning that some politicians were "watering down" their condemnation of the attacks and not specifically mentioning that mosques and Muslims were involved.
"Many Muslims around the world are going to be walking into work or their mosque with fear, with sadness and [asking] how this is happening again," said Arar.
The flag on the Peace Tower is being lowered to half-mast until sunset today in memory of the victims.
The Canadian flag at the top of the Peace Tower on Parliament Hill was lowered to half-mast on Friday, and will remain at half-mast until sunset. (CBC News)
With files from Krystalle Ramlakhan, Stu Mills and Claudine Richard
Accused gunman charged with murder in New Zealand mosque massacre
Canadian police bolster presence in wake of New Zealand mosque attacks
New Zealand mosque attacks leave Quebec Muslims feeling 'indescribable pain'

redpajama_set_name: RedPajamaCommonCrawl


text:
Bajaj Finserv profit zooms 71% at ₹1,204 crore in Q2
Our Bureau Mumbai | Updated on October 22, 2019 Published on October 22, 2019
Bajaj Finance posts the highest-ever quarterly net profit of ₹1,506 crore
Bajaj Finserv Limited (BFS), the holding company for the various financial services businesses under the Bajaj Group, reported a 71 per cent jump in consolidated net profit at ₹1,204 crore in the second quarter ended September 30, 2019, against ₹704 crore in the year-ago quarter. BFS participates in the financing business through its 54.81 per cent holding in Bajaj Finance Ltd (BFL) and in the protection business through its 74 per cent holding in two unlisted subsidiaries, Bajaj Allianz General Insurance Company Ltd (BAGIC) and Bajaj Allianz Life Insurance Company Ltd (BALIC). BFS' consolidated total income rose 47 per cent to ₹14,224 crore (₹9,698 crore in the year-ago quarter). Total expenses were up 47 per cent to ₹11,597 crore (₹7,888 crore).
Bajaj Finance
BFL recorded its highest-ever quarterly consolidated net profit of ₹1,506 crore, against ₹923 crore in the year-ago period, recording a 63 per cent jump.
The non-banking finance company's assets under management (AUM), including Bajaj Housing Finance Ltd's ₹25,714-crore AUM, were up 38 per cent year-on-year (y-o-y) to stand at ₹1,35,533 crore as on September 30, 2019.
To support the growth of the business over the next few years, the board of directors of BFL approved, subject to shareholders' approval, the raising of capital through a Qualified Institutional Placement (QIP) for an amount up to ₹8,500 crore by issue of equity shares and/or eligible securities in accordance with applicable SEBI regulations and other laws.
BAGIC's net profit soared 62 per cent to ₹294 crore, against ₹192 crore in the year-ago period. Gross written premium in the reporting quarter increased by 57 per cent to ₹4,279 crore, against ₹2,718 crore.
BALIC shareholders' profit after tax was up 57 per cent to ₹207 crore, against ₹132 crore in the year-ago period. Gross written premium increased by 7 per cent to ₹2,235 crore in Q2 FY20 versus ₹2,083 crore in Q2 FY19.
Bajaj Finserv Ltd


Your stomach acid – too high or too low?
Ever wondered why some people get affected by stomach bugs more than others? It might be exposure to the germs that cause us to get ill, or it could be down to the ability of the body to fight off infection.
Our stomach acid is one of the first lines of defence against pathogenic microbes that we take into the body with our food. There are four simple tips below you can start today to get better stomach acid.
There is a huge number of people on Proton Pump Inhibitors which block stomach acid, and this has an impact on other systems in the body. If we can't get the right kind of nutrients out of our food there is a knock on impact on other body processes.
Digests proteins – Stomach acid activates an enzyme which starts the digestion of proteins called pepsin. If it doesn't get digested properly it can leave you feeling heavy and full, as well as fermenting in the intestines.
Helps digestion – the acid activates secretin which turns on other digestive enzymes. Enzymes are like small chisels that break apart food into smaller molecules.
Kills bacteria on our food – Our gut microbes and our immune system have to work extra hard to keep us safe if there are more pathogenic microbes entering into the body.
You may get symptoms of low stomach acid like heartburn, nausea, feeling like your food sits in your stomach for a long time. Also, IBS type symptoms like constipation, diarrhoea, and bloating are linked to low stomach acid. If you frequently see undigested food in stools or have bad breath it's worth considering how strong your digestive power is. Digestive enzymes and the stomach acid work together to break down our food.
Let me know if you want any help with your digestion – I see nutrition clients for 1:1 nutrition coaching and I'm a qualified Nutritional Therapist.
I'm Anna Mapson, a registered Nutritional Therapist (DipCNM, BANT, CNHC) and creator of the 7 Day Gut Reset online package for gut health improvements. I will be bringing you snippets of useful nutrition and health research as I find them.
Goodness Me Nutrition is all about helping you get the best digestion you can have through finding a diet that works for you. Join my mailing list to stay in touch.


text:
\section{Introduction}\label{sec:1
Ensuring correct functioning of cyber-physical systems is among the most challenging and most important problems in computer science, mathematics, and engineering. Hybrid systems are common mathematical models for cyber-physical systems with interacting discrete and continuous behavior~\cite{DavorenN00,Henzinger96}. Their behavior combines continuous evolution (called {\em flow}) characterized by differential equations and discrete jumps. However, not all relevant cyber-physical systems can be modeled as hybrid systems. Hybrid systems cannot represent physical control systems that are distributed or form a multi-agent system, e.g., distributed car control systems~\cite{HsuESV91} and distributed air traffic control systems~\cite{DowekMC05}. Such systems form {\em distributed hybrid systems}~\cite{DeshpandeGV96,KratzSPL06,DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} with discrete, continuous, structural, and dimension-changing dynamics. Distributed hybrid systems combine the challenges of hybrid systems and distributed systems. Correctness of safety-critical real-time and distributed hybrid systems depends on a safe operation throughout {\em all} states of all possible trajectories, and the behavior at intermediate states is highly relevant~\cite{AlurCD90,DammHO03,DavorenN00,FaberM06,Henzinger96}.

{\em Temporal logics} (TL) use temporal operators to talk about intermediate states~\cite{AlurCD90,EmersonC82,EmersonH86,Pnueli77}. They have been used successfully in model checking~\cite{AlurCD90,ClarkeGP99,Henzinger96,HenzingerNSY92,MysorePM05} of finite-state system abstractions. State spaces of distributed hybrid systems, however, often do not admit equivalent finite-state abstractions~\cite{Henzinger96,MysorePM05}. Instead of model checking, TL can also be used deductively to prove validity of formulas in calculi~\cite{DavorenCM04,DavorenN00}. Valid TL formulas, however, only express very generic facts that are true for all systems, regardless of their actual behavior. Hence, the behavior of a specific system first needs to be axiomatized declaratively to obtain meaningful results. Then, however, the correspondence between actual system operations and a declarative temporal representation may be questioned.

Very recently, a dynamic logic, called {\em quantified differential dynamic logic} (\qdl) has been introduced as a successful tool for deductively verifying distributed hybrid systems~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}. \qdl can analyze the behavior of actual distributed hybrid system models, which are specified operationally. Yet, operational distributed hybrid system models are {\em internalized} within \qdl formulas, and \qdl is closed under logical operators.
However, \qdl only considers the behavior of distributed hybrid systems at final states, which is insufficient for verifying safety properties that have to hold all the time.

We close this gap of expressivity by combining \qdl with temporal logic~\cite{EmersonC82,EmersonH86,Pnueli77}.
In this paper, we introduce a logic, called {\em quantified differential temporal dynamic logic} (\qdtl), which provides modalities for quantifying over traces of distributed hybrid systems based on \qdl. We equip \qdtl with temporal operators to state what is true all along a trace or at some point during a trace. In this paper, we modify
the semantics of the dynamic modality $[\alpha]$ to refer to all {\em traces} of $\alpha$ instead of all final states
reachable with $\alpha$ (similarly for $\langle \alpha \rangle$). For instance, the formula $[\alpha]\Box\phi$ expresses
that $\phi$ is true at each state during all traces of the distributed hybrid system $\alpha$. With this,
\qdtl can also be used to verify temporal statements about the behavior of $\alpha$ at intermediate states during system runs.
As in our non-temporal dynamic logic \qdl~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, we use {\em quantified hybrid programs} as an operational model for distributed hybrid systems, since they admit a uniform compositional treatment of interacting discrete transitions, continuous evolutions, and structural/dimension changes in logic.

As a semantical foundation for combined temporal dynamic formulas, we introduce a hybrid trace semantics for \qdtl. We prove that \qdtl is a conservative extension of \qdl: for non-temporal specifications, trace semantics is equivalent to the non-temporal transition semantics of \qdl~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}.

As a means for verification, we introduce a sequent calculus for \qdtl that successively reduces temporal statements about traces of quantified hybrid programs to non-temporal \qdl formulas. In this way, we make the intuition formally precise that temporal safety properties can be checked by augmenting proofs with appropriate assertions about intermediate states. Like in~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, our calculus works compositionally. It decomposes correctness statements about quantified hybrid programs structurally into corresponding statements about its parts by symbolic transformation.

Our approach combines the advantages of \qdl in reasoning about the behaviour of operational distributed hybrid system models with those of TL to verify temporal statements about traces. We show that \qdtl is sound and relatively complete. We argue that \qdtl can verify practical systems and demonstrate this by studying temporal safety properties in distributed air traffic control. Our primary contributions are as follows:
\begin{itemize}
\item We introduce a logic for specifying and verifying temporal properties of distributed hybrid systems.
\item We present a proof calculus for this logic, which, to the best of our knowledge, is the first verification approach that can handle temporal statements about distributed hybrid systems.
\item We prove that this compositional calculus is a sound and complete axiomatization relative to differential equations.
\item We verify temporal safety properties in a collision avoidance maneuver in distributed air traffic control, where aircraft can appear dynamically.
\end{itemize}

\section{Related Work}\label{sec:2
Multi-party distributed control has been suggested for car control~\cite{HsuESV91} and air traffic control~\cite{DowekMC05}. Due to limits in verification technology, no formal analysis of temporal statements about the distributed hybrid dynamics has been possible for these systems yet. Analysis results include discrete message handling~\cite{HsuESV91} or collision avoidance for two participants~\cite{DowekMC05}.

The importance of understanding dynamic/reconfigurable distributed hybrid systems was recognized in modeling languages SHIFT~\cite{DeshpandeGV96} and R-Charon~\cite{KratzSPL06}. They focused on simulation/compilation~\cite{DeshpandeGV96} or the development of a semantics~\cite{KratzSPL06}, so that no verification is possible yet.

Other process-algebraic approaches, like $\chi$~\cite{BeekMRRS06}, have been developed for modeling and simulation. Verification is still limited to small fragments that can be translated directly to other verification tools like PHAVer or UPPAAL, which do not support distributed hybrid systems.

Our approach is completely different. It is based on first-order structures and dynamic logic. We focus on developing a logic that supports temporal and non-temporal statements about distributed hybrid dynamics and is amenable to automated theorem proving in the logic itself.

Our previous work and other verification approaches for static hybrid systems cannot verify distributed hybrid systems. Distributed hybrid systems may
have an unbounded and changing number of components/participants, which cannot be represented with any fixed number of dimensions of the state space.

Based on~\cite{Pratt79}, Beckert and Schlager~\cite{BeckertS01} added separate trace modalities to dynamic logic and presented a relatively complete calculus. Their approach only handles discrete state spaces. In contrast, \qdtl works for hybrid programs with continuous and structural/dimensional dynamics.

Davoren and Nerode~\cite{DavorenN00} extended the propositional modal $\mu$-calculus with a semantics in hybrid systems and examine topological aspects. In~\cite{DavorenCM04}, Davoren et al. gave a semantics in general flow systems for a generalisation of $\text{CTL}^{\ast}$~\cite{EmersonH86}. In both cases, the authors of~\cite{DavorenN00} and~\cite{DavorenCM04} provided Hilbert-style calculi to prove formulas that are valid for all systems simultaneously using abstract actions.

The strength of our logic primarily is that it is a first-order dynamic logic: it handles actual hybrid programs rather than only abstract actions of unknown effect. Our calculus directly supports verification of quantified hybrid programs with continuous evolution and structural/dimensional changes. First-order dynamic logic is more expressive and calculi are deductively stronger than other approaches~\cite{BeckertS01,Leivan04}.
\section{Syntax of Quantified Differential Temporal Dynamic Logic}\label{sec:3}
As a formal logic for verifying temporal specifications of distributed hybrid systems, we introduce {\em quantified differential temporal dynamic logic} (\qdtl). \qdtl extends dynamic logic for reasoning about system runs~\cite{HarelKT00} with many-sorted first-order logic for reasoning about all $(\forall i : \kern -0.17em A \ \phi)$ or some $(\exists i : \kern -0.17em A \ \phi)$ objects of a sort $A$, e.g.,
the sort of all aircraft, and three other concepts:\vspace{.15cm}\\
{\em Quantified hybrid programs}. The behavior of distributed hybrid systems can be described by quantified hybrid programs~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, which generalize regular programs from dynamic logic~\cite{HarelKT00} to distributed hybrid changes. The distinguish feature of quantified hybrid programs is that they provide uniform discrete transitions, continuous evolutions, and structural/dimension changes along quantified assignments and quantified differential equations, which can be combined by regular control operations.\vspace{.15cm}\\
{\em Modal operators}. Modalities of dynamic logic express statements about all possible behavior $([\alpha]\pi)$ of a system $\alpha$, or about the existence of a trace $(\langle \alpha \rangle \pi)$, satisfying condition $\pi$. Unlike in standard dynamic logic, $\alpha$ is a model of a distributed hybrid system. We use quantified hybrid programs to describe $\alpha$ as in~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}. Yet, unlike in standard dynamic logic~\cite{HarelKT00} or quantified differential dynamic logic (\qdl)~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, $\pi$ is a {\em trace formula} in \qdtl, and $\pi$ can refer to all states that occur {\em during} a trace using temporal operators.\vspace{.15cm}\\
{\em Temporal operators}. For \qdtl, the temporal trace formula $\Box \phi$ expresses that the formula $\phi$ holds all along a trace selected by $[\alpha]$ or $\langle \alpha \rangle$. For instance, the state formula $\langle \alpha \rangle \Box \phi$ says that the state formula $\phi$ holds at every state along at least one trace of $\alpha$. Dually, the trace formula $\Diamond \phi$ expresses that $\phi$ holds at some point during such a trace. It can occur in a state formula $\langle \alpha \rangle \Diamond \phi$ to express that there is such a state in some trace of $\alpha$, or as $[\alpha]\Diamond\phi$ to say that, along each trace, there is a state satisfying $\phi$. In this paper, the primary focus of attention is on homogeneous combinations of path and trace quantifiers like $[\alpha] \Box \phi$ or $\langle \alpha \rangle \Diamond \phi$.
\subsection{Quantified Hybrid Programs}
\qdtl supports a (finite) number of object {\em sorts}, e.g., the sort of all aircraft, or the sort of all cars. For
continuous quantities of distributed hybrid systems like positions or velocities,
we add the sort $\mathbb{R}$ for real numbers. {\em Terms} of \qdtl are built from a set of (sorted) function/variable symbols
as in many-sorted first-order logic.
For representing appearance and disappearance of objects while running QHPs, we use an existence function symbol $\mathsf{E}(\cdot)$ that has
value $\mathsf{E}(o) = 1$ if object $o$ exists, and has value $\mathsf{E}(o) = 0$ when object $o$ disappears or has not been created yet.
We use $0, 1, +, -, \cdot$ with the usual notation and fixed semantics for real arithmetic. For
$n \geq 0$ we abbreviate $f(s_1, \ldots, s_n)$ by $f(\boldsymbol{s})$ using vectorial notation and we use
$\boldsymbol{s} = \boldsymbol{t}$ for element-wise equality.

As a system model for distributed hybrid systems, \qdtl uses {\em quantified hybrid programs} (QHP)~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}. The quantified hybrid programs occurring in dynamic modalities of \qdtl are regular programs from dynamic logic~\cite{HarelKT00} to which quantified assignments and quantified differential equation systems for
distributed hybrid dynamics are added. QHPs are defined by the following grammar ($\alpha$, $\beta$ are QHPs, $\theta$ a term, $i$ a variable of sort $A$, $f$ is a function symbol, $\boldsymbol{s}$ is a vector of terms with sorts compatible to $f$, and $\chi$ is a formula of first-order logic):
\[\alpha, \beta ::= \forall i : \kern -0.17em A \ f(\boldsymbol{s}) : = \theta \ | \ \forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \ | \ ?\chi \ | \ \alpha \cup \beta \ | \ \alpha;\beta \ | \ \alpha^{\ast}\]
The effect of {\em quantified assignment} $\forall i : \kern -0.3em A \ f(\boldsymbol{s}) : = \theta$ is an instantaneous discrete jump assigning $\theta$ to $f(\boldsymbol{s})$ simultaneously for all objects $i$ of sort $A$. The QHP $\forall i : \kern -0.17em C \ a(i) := a(i) + 1$, for example,
expresses that all cars $i$ of sort $C$ simultaneously increase their acceleration $a(i)$. The effect of {\em quantified differential equation} $ \forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi$ is a continuous evolution where, for all objects $i$ of sort $A$, all differential equations
$f(\boldsymbol{s})' = \theta$ hold and formula $\chi$ holds throughout the evolution (the state
remains in the region described by $\chi$). The dynamics of QHPs changes the interpretation
of terms over time: $f(\boldsymbol{s})'$ is intended to denote the derivative of the
interpretation of the term $f(\boldsymbol{s})$ over time during continuous evolution, not the
derivative of $f(\boldsymbol{s})$ by its argument $\boldsymbol{s}$. For $f(\boldsymbol{s})'$ to be defined, we assume $f$ is an
$\mathbb{R}$-valued function symbol. For simplicity, we assume that $f$ does not occur in $\boldsymbol{s}$.
In most quantified assignments/differential equations $\boldsymbol{s}$ is just $i$. For instance, the following QHP expresses that
all cars $i$ of sort $C$ drive by $\forall i : \kern -0.17em C \ x(i)'' = a(i)$ such that their position $x(i)$ changes continuously
according to their respective acceleration $a(i)$.

The effect of test $? \chi$ is a {\em skip} (i.e., no change) if formula $\chi$ is
true in the current state and {\em abort} (blocking the system run by a failed assertion),
otherwise. {\em Nondeterministic choice} $\alpha \cup \beta$ is for alternatives in the behavior of
the distributed hybrid system. In the {\em sequential composition} $\alpha ; \beta$, QHP $\beta$ starts
after $\alpha$ finishes ($\beta$ never starts if $\alpha$ continues indefinitely). {\em Nondeterministic
repetition} $\alpha^{\ast}$ repeats $\alpha$ an arbitrary number of times, possibly zero times.

Structural dynamics of distributed hybrid systems corresponds to quantified assignments to function terms and we model the appearance of new participants in the distributed hybrid system, e.g., new aircraft appearing into the local flight scenario, by a program $n := \mathsf{new} \ A$ (see~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} for details).
\subsection{State and Trace Formulas}
The formulas of \qdtl are defined similarly to first-order dynamic logic plus
many-sorted first-order logic. However, the modalities $[\alpha]$ and $\langle \alpha \rangle$ accept trace formulas that refer to the temporal behavior of {\em all} states along a trace. Inspired by CTL and $\text{CTL}^{\ast}$~\cite{EmersonC82,EmersonH86}, we distinguish between state formulas, which are true or false in states, and trace formulas, which are true or false for system traces.

The {\em state formulas} of \qdtl are defined by the following grammar ($\phi, \psi$ are state formulas, $\pi$ is a trace formula, $\theta_1, \theta_2$ are terms of the same sort, $i$ is a variable of sort $A$, and $\alpha$ is a QHP):
\[\phi, \psi ::= \theta_1 = \theta_2 \ | \ \theta_1 \geq \theta_2 \ | \ \neg \phi \ | \ \phi \wedge \psi \ | \ \forall i : \kern -0.17em A \ \phi \ | \ \exists i : \kern -0.17em A \ \phi \ | \ [\alpha]\pi \ | \ \langle \alpha \rangle \pi\]
We use standard abbreviations to define $\leq, >, <, \vee, \rightarrow$. Sorts $A \not = \mathbb{R}$ have no
ordering and only $\theta_1 = \theta_2$ is allowed. For sort $\mathbb{R}$, we abbreviate $\forall x : \kern -0.17em \mathbb{R} \ \phi$ by $\forall x \phi$.

The {\em trace formulas} of \qdtl are defined by the following grammar ($\pi$ is a trace formula and $\phi$ is a state formula):
\[ \pi ::= \phi \ | \ \Box \phi \ | \ \Diamond \phi \]
Formulas without $\Box$ and $\Diamond$ are {\em non-temporal} \qdl \xspace {\em formulas}. Unlike in CTL, state formulas are true on a trace if they hold for the {\em last} state of a trace, not for the first. Thus, $[\alpha]\phi$ expresses that $\phi$ is true at the end of each trace of $\alpha$. In contrast, $[\alpha]\Box\phi$ expresses that $\phi$ is true all along all states of every trace of $\alpha$. This combination gives a smooth embedding of non-temporal \qdl into \qdtl and makes it possible to define a compositional calculus. Like CTL, \qdtl allows nesting with a branching time semantics~\cite{EmersonC82}, e.g., $[\alpha] \Box ((\forall i : \kern -0.17em C \ x(i) \geq 2) \rightarrow \langle \beta \rangle \Diamond (\forall i : \kern -0.17em C \ x(i) \leq 0))$. In the following, all formulas and terms have to be well-typed. For short notation, we allow conditional terms of the form $\mathsf{if} \kern .17em \phi \kern .17em \mathsf{then} \kern .17em \theta_1 \kern .17em \mathsf{else} \kern .17em \theta_2 \kern .17em \mathsf{fi}$ (where $\theta_1$ and $\theta_2$ have the same sort). This term evaluates to $\theta_1$ if the formula $\phi$ is true and to $\theta_2$ otherwise. We consider formulas with conditional terms as
abbreviations, e.g., $\psi(\mathsf{if}\kern .17em \phi \kern .17em \mathsf{then} \kern .17em \theta_1 \kern .17em \mathsf{else} \kern .17em \theta_2)$ for ($\phi \rightarrow \psi(\theta_1)) \wedge (\neg \phi \rightarrow \psi(\theta_2))$.

\begin{example}
Let $C$ be the sort of all cars. By $x(i)$, we denote the position of car $i$, by $v(i)$ its velocity and by $a(i)$ its acceleration. Then the \qdtl formula
\[ (\forall i : \kern -0.17em C \ x(i) \geq 0) \rightarrow [\forall i : \kern -0.17em C \ x(i)' = v(i), v(i)' = a(i) \with v(i) \geq 0] \Box (\forall i : \kern -0.17em C \ x(i) \geq 0)      \]
says that, if all cars start at a point to the right of the origin and we only allow them to evolve as long as all of them have nonnegative velocity, then they {\em always} stay up to the right of the origin. In this case, the QHP just consists of a quantified differential equation expressing that the position $x(i)$ of car $i$ evolves over time according to the velocity $v(i)$, which evolves according to its acceleration $a(i)$. The constraint $v(i) \geq 0$ expresses that
the cars never move backwards, which otherwise would happen eventually in the case of braking $a(i) < 0$. This formula is indeed valid, and we would be able to use the techniques developed in this paper to prove it.
\end{example}
\section{Semantics of Quantified Differential Temporal Dynamic Logic}\label{sec:4}
In standard dynamic logic~\cite{HarelKT00} and the logic \qdl~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, modalities only refer to the final
states of system runs and the semantics is a reachability relation on states:
State $\tau$ is reachable from state $\sigma$ using $\alpha$ if there is a run of $\alpha$ which terminates
in $\tau$ when started in $\sigma$. For \qdtl, however, formulas can refer to intermediate
states of runs as well. Thus, the semantics of a distributed hybrid system $\alpha$ is the set of its
possible {\em traces}, i.e., successions of states that occur during the evolution of $\alpha$.
\subsection{Trace Semantics of Quantified Hybrid Programs}
A {\em state} $\sigma$ associates an infinite set $\sigma(A)$ of objects with each sort $A$, and
it associates a function $\sigma(f)$ of appropriate type with each function symbol $f$, including $\mathsf{E}(\cdot)$.
For simplicity, $\sigma$ also associates a value $\sigma(i)$ of appropriate type
with each variable $i$. The domain of $\mathbb{R}$ and the interpretation of $0, 1, +, -, \cdot$ is
that of real arithmetic. We assume constant domain for each sort $A$: all states
$\sigma, \tau$ share the same infinite domains $\sigma(A) = \tau(A)$. Sorts $A \not = C$ are disjoint:
$\sigma(A) \cap \sigma(C) = \emptyset$. The set of all states is denoted by $\mathcal{S}$. The state $\sigma_{i}^{e}$ agrees
with $\sigma$ except for the interpretation of variable $i$, which is changed to $e$. In addition, we distinguish a state $\Lambda$ to denote the failure of
a system run when it is {\em aborted} due to a test $?\chi$ that yields {\em false}. In particular, $\Lambda$ can only occur at the end of an aborted system run and marks that there is no further extension.

Distributed hybrid systems evolve along piecewise continuous traces in multi-dimensional space, structural changes, and appearance or disappearance of agents as time passes. Continuous phases are governed by differential equations, whereas discontinuities are caused by discrete jumps. Unlike in discrete cases~\cite{BeckertS01,Pratt79}, traces are not just sequences of states, since distributed hybrid systems pass through uncountably many states even in bounded time. Beyond that, continuous changes are more involved than in pure real-time~\cite{AlurCD90,HenzingerNSY92}, because all variables can evolve along different differential equations. Generalizing the real-time traces of~\cite{HenzingerNSY92}, the following definition captures hybrid behavior by splitting the uncountable succession of states into periods $\nu_i$ that are regulated by the same control law. For discrete jumps, some periods are point flows of duration $0$.

The (trace) semantics of quantified hybrid programs is compositional, that is, the semantics of a complex program is defined as a simple function of the trace semantics of its parts.

\begin{definition}[Hybrid Trace]\label{def:hybridtrace}
A {\em trace} is a (non-empty) finite or infinite sequence $\nu = (\nu_0, \nu_1, \nu_2, \ldots)$ of functions $\nu_k : [0, r_k] \rightarrow \mathcal{S}$ with respective durations $r_k \in \mathbb{R}$ (for $k \in \mathbb{N}$). A {\em position} of $\nu$ is a pair $(k, \zeta)$ with $k \in \mathbb{N}$ and $\zeta$ in the interval $[0, r_k]$; the state of $\nu$ at $(k, \zeta)$ is $\nu_k(\zeta)$. Positions of $\nu$ are ordered lexicographically by
$(k, \zeta) \prec (m, \xi)$ iff either $k < m$, or $k = m$ and $\zeta < \xi$. Further, for a state $\sigma \in \mathcal{S}$, $\hat{\sigma} : 0 \mapsto \sigma$ is the {\em point flow} at $\sigma$ with duration $0$. A trace {\em terminates} if it is a finite sequence $(\nu_0, \nu_1, \ldots, \nu_n)$ and $\nu_n(r_n) \not = \Lambda$. In that case, the last state $\nu_n(r_n)$ is denoted by {\em last}{\kern 0.25em}$\nu$. The first state $\nu_0(0)$ is denoted by {\em first}{\kern 0.25em}$\nu$.
\end{definition}
Unlike in~\cite{AlurCD90,HenzingerNSY92}, the definition of traces also admits finite traces of bounded duration, which is necessary for compositionality of traces in $\alpha;\beta$. The semantics of quantified hybrid programs $\alpha$ as the set $\mu(\alpha)$ of its possible traces depends on valuations $\sigma \llbracket \cdot \rrbracket$ of formulas and terms at intermediate states $\sigma$. The valuation of formulas will be defined in Definition~\ref{def:semanticsofformulas}. Especially, we use $\sigma_{i}^{e}\llbracket \cdot \rrbracket$ to denote the valuations of terms and formulas in state $\sigma_{i}^{e}$, i.e., in state $\sigma$ with $i$ interpreted as $e$.

\begin{definition}[Trace Semantics of Quantified Hybrid Programs]\label{def:tracesemanticsofQHP}
 The {\em trace semantics}, $\mu(\alpha)$, {\em of a quantified hybrid program} $\alpha$, is the set of all its possible hybrid traces and is defined inductively as follows:
\begin{enumerate}
\item $\mu(\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta) = \{ (\hat{\sigma}, \hat{\tau}) : \sigma \in \mathcal{S}$ and state $\tau$ is identical to $\sigma$ except that at each position $\boldsymbol{o}$ of $f$: if $\sigma_i^{e} \llbracket \boldsymbol{s} \rrbracket = \boldsymbol{o}$ for some object $e \in \sigma(A)$, then $\tau(f)(\sigma_i^e\llbracket \boldsymbol{s} \rrbracket) = \sigma_i^e \llbracket \theta \rrbracket.\}$
 \item $\mu(\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi) = \{ (\varphi) : 0 \leq r \in \mathbb{R} \ \text{and } \varphi: [0, r] \rightarrow \mathcal{S}$ is a function satisfying the following conditions. At each time $t \in [0,r]$, state $\varphi(t)$ is identical to $\varphi(0)$, except that at each position $\boldsymbol{o} \ \text{of} \ f: \ \text{if} \ \sigma_i^{e} \llbracket \boldsymbol{s} \rrbracket = \boldsymbol{o}$ for some object $e \in \sigma(A)$, then, at each time $\zeta \in [0,r]$:
     \begin{itemize}
     \item The differential equations hold and derivatives exist (trivial for $r = 0$):
     \[\inferencerule{\mathsf{d} ({\varphi(t)}^{e}_{i}\llbracket f(\boldsymbol{s}) \rrbracket)}{\mathsf{d} t}(\zeta) = ({\varphi(\zeta)}^{e}_{i}\llbracket \theta \rrbracket) \]
     \item The evolution domains is respected: ${\varphi(\zeta)}^{e}_{i} \llbracket \chi \rrbracket = \text{true}.\}$
     \end{itemize}
 \item $\mu(?\chi) = \{ (\hat{\sigma}) : \sigma \llbracket \chi \rrbracket = \text{true} \} \cup \{ (\hat{\sigma}, \hat{\Lambda}): \sigma \llbracket \chi \rrbracket = \text{false}\}$
 \item $\mu(\alpha \cup \beta) = \mu(\alpha) \cup \mu(\beta)$
 \item $\mu(\alpha;\beta) = \{ \nu \circ \varsigma : \nu \in \mu(\alpha), \varsigma \in \mu(\beta) \ \text{when} \ \nu \circ \varsigma \ \text{is defined}\}$; the composition of $\nu = (\nu_0, \nu_1, \nu_2, \ldots)$ and $\varsigma = (\varsigma_0, \varsigma_1, \varsigma_2, \ldots)$ is
     \begin{equation*}
\nu \circ \varsigma = \left\{
\begin{array}{ll}
(\nu_0, \ldots, \nu_n, \varsigma_0, \varsigma_1, \ldots) & \text{if } \nu \ \text{terminates at } \nu_n \ \text{and } \emph{\text{last}} {\kern 0.25em}\nu = \emph{\text{first}}{\kern 0.25em}\varsigma\\
\nu & \text{if } \nu \ \text{does not terminate}\\
\text{not defined} & \text{otherwise}
\end{array} \right.
\end{equation*}
 \item $\mu(\alpha^{\ast}) = \bigcup_{n \in \mathbb{N}} \mu(\alpha^{n})$, where $\alpha^{n+1} := (\alpha^n;\alpha)$ for $n \geq 1$, as well as $\alpha^1 := \alpha$ and $\alpha^{0} := (?\text{true})$.
\end{enumerate}
\end{definition}
\subsection{Valuation of State and Trace Formulas}
\begin{definition}[Valuation of Formulas]\label{def:semanticsofformulas}
 The valuation of state and trace formulas is defined respectively. For state formulas, the {\em valuation} $\sigma \llbracket \cdot \rrbracket$ with respect to state $\sigma$ is defined as follows:
\begin{enumerate}
\item $\sigma \llbracket \theta_1 = \theta_2 \rrbracket = $ true  iff $\sigma \llbracket \theta_1 \rrbracket = \sigma \llbracket \theta_2 \rrbracket$; accordingly for $\geq$.
\item $\sigma \llbracket \phi \wedge \psi \rrbracket =$ true iff $\sigma \llbracket \phi \rrbracket =$ true and $\sigma \llbracket \psi \rrbracket =$ true; accordingly for $\neg$.
\item $\sigma \llbracket \forall i : \kern -0.17em A \ \phi \rrbracket =$ true iff $\sigma_i^e \llbracket \phi \rrbracket =$ true for all objects $e \in \sigma(A)$.
\item $\sigma \llbracket \exists i : \kern -0.17em A \ \phi \rrbracket =$ true iff $\sigma_i^e \llbracket \phi \rrbracket =$ true for some object $e \in \sigma(A)$.
\item $\sigma \llbracket [\alpha] \pi \rrbracket =$ true iff for each trace $\nu \in \mu(\alpha)$ that starts in {\em first}{\kern 0.25em}$\nu = \sigma$, if $\nu \llbracket \pi \rrbracket$ is defined, then $\nu \llbracket \pi \rrbracket =$ true.
\item $\sigma \llbracket \langle \alpha \rangle \pi \rrbracket =$ true iff there is a trace $\nu \in \mu(\alpha)$ starting in {\em first}{\kern 0.25em}$\nu = \sigma$ such that $\nu \llbracket \pi \rrbracket$ is defined and $\nu \llbracket \pi \rrbracket =$ true.

\end{enumerate}

For trace formulas, the {\em valuation} $\nu \llbracket \cdot \rrbracket$ with respect to trace $\nu$ is defined as follows:
\begin{enumerate}
\item If $\phi$ is a state formula, then $\nu \llbracket \phi \rrbracket =$ {\em last}{\kern 0.25em}$\nu \llbracket \phi \rrbracket$ if $\nu$ terminates, whereas $\nu \llbracket \phi \rrbracket$ is not defined if $\nu$ does not terminate.
\item $\nu \llbracket \Box \phi \rrbracket =$ true iff $\nu_{k}(\zeta) \llbracket \phi \rrbracket =$ true for all positions $(k, \zeta)$ of $\nu$ with $\nu_k(\zeta) \not = \Lambda$.
\item $\nu \llbracket \Diamond \phi \rrbracket =$ true iff $\nu_{k}(\zeta) \llbracket \phi \rrbracket =$ true for some position $(k, \zeta)$ of $\nu$ with $\nu_k(\zeta) \not = \Lambda$.

\end{enumerate}
\end{definition}
As usual, a (state) formula is {\em valid} if it is true in all states. Further for (state) formula $\phi$ and state $\sigma$ we write $\sigma \models \phi$ iff $\sigma \llbracket \phi \rrbracket$ = {\em true}. We write $\sigma \not \models \phi$ iff $\sigma \llbracket \phi \rrbracket$ = {\em false}. Likewise, for trace formula $\pi$ and trace $\nu$ we write $\nu \models \pi$ iff $\nu \llbracket \pi \rrbracket$ = {\em true} and $\nu \not \models \pi$ iff $\nu \llbracket \pi \rrbracket$ = {\em false}. In particular, we only write $\nu \models \pi$ or $\nu \not \models \pi$ if $\nu \llbracket \pi \rrbracket$ is defined, which it is not the case if $\pi$ is a state formula and $\nu$ does not terminate.
\subsection{Conservative Temporal Extension
 The following result shows that the extension of \qdtl by temporal operators does not change the meaning of non-temporal \qdl formulas. The trace semantics given in Definition~\ref{def:semanticsofformulas} is equivalent to the final state reachability relation semantics~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} for the sublogic \qdl of \qdtl.

\begin{proposition}\label{prop:cextension}
The logic {\em \qdtl} is a {\em conservative extension} of non-temporal {\em \qdl},
i.e., the set of valid {\em \qdl} formulas is the same with respect to transition reachability
semantics of {\em \qdl}~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} as with respect to the trace semantics of {\em \qdtl} (Definition~\ref{def:semanticsofformulas}).
\end{proposition}
\section{Safety Properties in Distributed Air Traffic Control}\label{sec:5}
In air traffic control, collision avoidance maneuvers~\cite{DowekMC05,TomlinPS98} are used to resolve conflicting flight paths that arise during free flight. We
consider the roundabout collision avoidance maneuver for air traffic control~\cite{TomlinPS98}. In the literature, formal verification of the hybrid dynamics of air traffic control focused on a fixed number of aircraft, usually two. In reality, many more aircraft are in the same flight corridor, even if not all of them participate in the same maneuver. They may be involved in multiple distributed maneuvers at the same time, however. Perfect global trajectory planning quickly becomes infeasible then. The verification itself also becomes much more complicated for three aircraft already. Explicit replication of the system dynamics $n$ times is computationally infeasible for larger $n$. Yet, collision avoidance maneuvers need to work for an (essentially) unbounded number of aircraft. Because global trajectory planning is infeasible, the appearance of other aircraft into a local collision avoidance maneuver always has to be expected and managed safely. See Fig.~\ref{fig:roundabout} for a general illustration of roundabout-style collision avoidance maneuvers and the phenomenon of dynamic appearance of some new aircraft $z$ into the horizon of relevance.
\begin{wrapfigure}{r}{0.30\textwidth}
\vspace{-30pt}
  \begin{center}
    \includegraphics[width=0.30\textwidth]{aircraft}
  \end{center}
  \vspace{-.5cm}
  \caption{\scriptsize{Roundabout collision avoidance maneuver with new appearance}}
  \label{fig:roundabout}
  \vspace{-10pt}
\end{wrapfigure}
\quad The resulting flight control system has several characteristics of hybrid dynamics. But it is not a hybrid system and does not even have a fixed finite number of variables in a fixed finite-dimensional state space. The system forms a distributed hybrid system, in which all aircraft fly at the same time and new aircraft may appear from remote areas into the local flight scenario. Let $A$ be the sort of all aircraft. Each aircraft $i$ has a position $x(i) = (x_1(i), x_2(i))$ and a velocity vector $d(i) = (d_1(i), d_2(i))$. We model the continuous dynamics of an aircraft $i$ that follows a flight curve with an angular velocity $\omega(i)$ by the (function) differential equation:
\begin{equation}
{x_1(i)}' = d_1(i), {x_2(i)}' = d_2(i), {d_1(i)}' = - \omega(i)d_2(i), {d_2(i)}' = \omega(i)d_1(i) \tag{${\mathcal{F}}_{\omega(i)}(i)$}
\end{equation}
This differential equation, which we denote by ${\mathcal{F}}_{\omega(i)}(i)$, is the standard equation for curved flight from the literature~\cite{TomlinPS98}, but lifted to function symbols that are parameterized by aircraft $i$. Now the quantified differential equation $\forall i : \kern -0.17em A \ {\mathcal{F}}_{\omega(i)}(i)$ characterizes that {\em all} aircraft $i$ fly along their respective (function) differential equation ${\mathcal{F}}_{\omega(i)}(i)$ according to their respective angular velocities $\omega(i)$ at the same time. This quantified differential equation captures what no finite-dimensional differential equation system could ever do. It characterizes the simultaneous movement of an unbounded, arbitrary, and even growing or shrinking set of aircraft.

Two aircraft $i$ and $j$ have violated the safe separation property if they falsify the following formula
\[\mathcal{P}(i,j) \equiv i = j \vee (x_1(i) - x_1(j))^{2} + (x_2(i) - x_2(j))^{2} \geq p^2 \]
which says that aircraft $i$ and $j$ are either identical or separated by at least the protected zone $p$ (usually 5mi). For the aircraft control system to be safe, all aircraft have to be safely separated, i.e., need to satisfy $\forall i, j : \kern -0.17em A \ \mathcal{P}(i,j)$. It is crucial that this formula holds at {\em every} point in time during the system evolution, not only at its beginning or at its end. Hence, we need to consider temporal safety properties. For instance, \qdtl can analyze the following temporal safety properties of a part of the distributed roundabout collision avoidance maneuver for air traffic control:
\begin{equation}
\forall i, j : \kern -0.17em A \ \mathcal{P}(i,j) \wedge \forall i, j : \kern -0.17em A \ \mathcal{T}(i,j) \rightarrow [\forall i : \kern -0.17em A \  {\mathcal{F}}_{\omega(i)}(i)] \Box \kern 0.08em \forall i, j : \kern -0.17em A \ \mathcal{P}(i,j) \label{eq:safety}
\end{equation}
\begin{equation}
\begin{array}{l}
\kern 1.1cm \forall i, j : \kern -0.17em A \ \mathcal{P}(i,j) \wedge \forall i, j : \kern -0.17em A \ \mathcal{T}(i,j) \rightarrow \\
 \lbrack \forall i : \kern -0.17em A \ t := 0; \forall i : \kern -0.17em A \  {\mathcal{F}}_{\omega(i)}(i), t' = 1 \with \forall i : \kern -0.17em A \ t \leq T; ?(\forall i : \kern -0.17em A \ t = T)] \Box \kern 0.08em \forall i, j : \kern -0.17em A \ \mathcal{P}(i,j) \label{eq:safetyproperty}
\end{array}
\end{equation}
where $\mathcal{T}(i,j) \equiv d_1(i) - d_1(j) = - \omega(x_2(i) - x_2(j)) \wedge d_2(i) - d_2(j) = \omega(x_1(i) - x_1(j))$, $t$ is a clock variable, and $T$ is some bounded time.

The temporal safety invariant in (\ref{eq:safety}) expresses that the circle phase of roundabout maneuver {\em always} stays collision-free indefinitely for an arbitrary number of aircraft. That is the most crucial part because we have to know the aircraft {\em always} remain safe during the actual roundabout collision avoidance circle. The condition $\forall i, j : \kern -0.17em A \ \mathcal{T}(i,j)$ characterizes compatible tangential maneuvering choices. Without a condition like $\mathcal{T}(i,j)$, roundabouts can be unsafe~\cite{APlatzer10}. For a systematic derivation of how to construct $\mathcal{T}(i,j)$, we refer to the work~\cite{APlatzer10}. As a variation of (\ref{eq:safety}), the temporal safety property in (\ref{eq:safetyproperty}) states that, for an arbitrary number of aircraft, the circle procedure of roundabout maneuver cannot produce collisions at any point in its bounded duration $T$. This variation restricts the continuous evolution to take exactly $T$ time units (the evolution domain region restricts the evolution to $t \leq T$ and the subsequent test to $?(\forall i : \kern -0.17em A \ t = T)$) and no intermediate state is visible as a final state anymore. Thus, the temporal modality $\Box$ in (\ref{eq:safetyproperty}) is truly necessary. We will use the techniques developed in this paper to verify these temporal safety properties in the distributed roundabout flight collision avoidance maneuver.
\section{Proof Calculus for Temporal Properties}\label{sec:6}
In this section, we introduce a sequent calculus for verifying temporal specifications of distributed hybrid systems in \qdtl. With the basic idea being to perform a symbolic decomposition, the calculus transforms quantified hybrid programs successively into simpler logical formulas describing their effects. Statements about the temporal behavior of a quantified hybrid program are successively reduced to corresponding non-temporal statements about the intermediate states.
\subsection{Proof Rules}
In Fig.~\ref{fig:rules}, we present a proof calculus for \qdtl that inherits the proof rules of \qdl from~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} and adds new proof rules for temporal modalities. We use the sequent notation informally for a systematic proof structure. A {\em sequent} is of the form $\Gamma \rightarrow \Delta$, where the {\em antecedent} $\Gamma$ and {\em succedent} $\Delta$ are finite sets of formulas. The semantics of $\Gamma \rightarrow \Delta$ is that of the formula $\bigwedge_{\phi \in \Gamma} \phi \rightarrow \bigvee_{\psi \in \Delta} \psi$ and will be treated as an abbreviation. As usual in sequent calculus, the proof rules are applied backwards from the {\em conclusion} (goal below horizontal bar) to the {\em premise}s (subgoals above bar).\vspace{-.3cm}
\begin{figure}[!ht]
\hspace*{-0.32in}
\begin{minipage}{1.0\linewidth}
\setcounter{mpfootnote}{\value{footnote}}
\renewcommand{\thempfootnote}{\arabic{mpfootnote}}
\begin{tabular}{l l l l l l}
{\scriptsize ({\em ax}) $\inferencerule{}{\phi \rightarrow \phi}$} &
{\scriptsize ($\neg$r) $\inferencerule{\phi \rightarrow }{ \rightarrow \neg \phi}$} &
{\scriptsize ($\neg$l) $\inferencerule{\rightarrow \phi}{ \neg \phi \rightarrow}$} &
{\scriptsize ($\wedge$r) $\inferencerule{\rightarrow \phi \quad \rightarrow \psi}{\rightarrow \phi \wedge \psi}$}  &
{\scriptsize ($\wedge$l) $\inferencerule{\phi, \psi \rightarrow}{\phi \wedge \psi \rightarrow}$} &
{\scriptsize ({\em cut}) $\inferencerule{\rightarrow \phi \quad \phi \rightarrow}{ \rightarrow}$}\\
\vspace{-2.6mm} \\
{\scriptsize ($[;]$) $\inferencerule{[\alpha][\beta]\phi}{[\alpha;\beta] \phi}$} &
{\scriptsize ($\langle ; \rangle$) $\inferencerule{\langle \alpha \rangle \langle \beta \rangle \phi}{\langle \alpha ; \beta \rangle \phi}$} &
{\scriptsize ($[\cup]$) $\inferencerule{[\alpha]\phi \wedge [\beta]\phi}{[\alpha \cup \beta] \phi}$} &
{\scriptsize ($\langle \cup \rangle$) $\inferencerule{\langle \alpha \rangle \phi \vee \langle \beta \rangle \phi}{\langle \alpha \cup \beta \rangle \phi}$} &
{\scriptsize ($[?]$) $\inferencerule{ \chi \rightarrow \phi}{[?\chi]\phi}$} &
{\scriptsize ($\langle ? \rangle$) $\inferencerule{ \chi \wedge \phi}{\langle ?\chi \rangle \phi}$}
\end{tabular}
\begin{tabular}{l}
{\scriptsize ($[']$) $\inferencerule{\forall t \geq 0 ((\forall 0 \leq \tilde{t} \leq t [\forall i : \kern -0.17em A \ \mathcal{S}(\tilde{t})] \chi) \rightarrow [ \forall i : \kern -0.17em A \ \mathcal{S}(t)]\phi)}{[\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi] \phi}$ \footnote[1]{\scriptsize{$t, \tilde{t}$ are new variables, $\forall i : \kern -0.17em A \ \mathcal{S}(t)$ is the quantified assignment $\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := y_{\boldsymbol{s}}(t)$ with solutions $y_{\boldsymbol{s}}(t)$ of the (injective) differential equations and $f(\boldsymbol{s})$ as initial values. See~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR} for the definition of a {\em injective} quantified assignment or quantified differential equation.}}}  \quad \quad
{\scriptsize ($\langle'\rangle$) $\inferencerule{\exists t \geq 0 ((\forall 0 \leq \tilde{t} \leq t \langle \forall i : \kern -0.17em A \ \mathcal{S}(\tilde{t})\rangle \chi) \wedge \langle \forall i : \kern -0.17em A \ \mathcal{S}(t)\rangle\phi)}{\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \rangle \phi}$\footnotemark[1]} \\
\vspace{-2.6mm}\\
{\scriptsize ($[:=]$) $\inferencerule{\mathsf{if} \ \exists i : \kern -0.17em A \ \boldsymbol{s} = [\mathcal{A}] \boldsymbol{u} \ \mathsf{then} \ \forall i : \kern -0.17em A \ (\boldsymbol{s} = [\mathcal{A}] \boldsymbol{u} \rightarrow \phi(\theta)) \ \mathsf{else} \ \phi(f([\mathcal{A}] \boldsymbol{u})) \ \mathsf{fi}}{\phi([\forall i : A\ f(\boldsymbol{s}) := \theta]f(\boldsymbol{u}))}$\footnote[2]{\scriptsize{Occurrence $f(\boldsymbol{u})$ in $\phi(f(\boldsymbol{u}))$ is not in scope of a modality (admissible substitution) and we abbreviate assignment $\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta$ by $\mathcal{A}$, which is assumed to be injective.}}} \\
\vspace{-2.6mm}\\
{\scriptsize ($\langle := \rangle$) $\inferencerule{\mathsf{if} \ \exists i : \kern -0.17em A \ \boldsymbol{s} = \langle \mathcal{A}\rangle \boldsymbol{u} \ \mathsf{then} \ \exists i : \kern -0.17em A \ (\boldsymbol{s} = \langle \mathcal{A}\rangle \boldsymbol{u} \wedge \phi(\theta)) \ \mathsf{else} \ \phi(f(\langle \mathcal{A}\rangle \boldsymbol{u})) \ \mathsf{fi}}{\phi(\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta \rangle f(\boldsymbol{u}))}$\footnotemark[2]}
\end{tabular}
\begin{tabular}{l l l l}
{\scriptsize ({\em skip}) $\inferencerule{\Upsilon([\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta]\boldsymbol{u})}{[\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta] \Upsilon(\boldsymbol{u})}$\footnote[3]{\scriptsize{$f \not = \Upsilon$ and the quantified assignment $\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta$ is injective. The same rule applies for $\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta \rangle$ instead of $[\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta]$.}}} &
{\scriptsize ($[:\kern -0.3em \ast]$) $\inferencerule{\forall j : \kern -0.17em A \ \phi(\theta)}{[\forall j : \kern -0.17em A \ n := \theta]\phi(n)}$} &
{\scriptsize ($\langle :\kern -0.3em \ast \rangle$) $\inferencerule{\exists j : \kern -0.17em A \ \phi(\theta)}{\langle \forall j : \kern -0.17em A \ n := \theta \rangle \phi(n)}$} &
{\scriptsize ({\em ex}) $\inferencerule{\emph{\text{true}}}{\exists n : \kern -0.17em A \ \mathsf{E}(n) = 0}$ } \\
\vspace{-2.6mm} \\
{\scriptsize ($\forall$r) $\inferencerule{\Gamma \rightarrow \phi(f(X_1, \ldots, X_n)), \Delta}{\Gamma \rightarrow \forall x \phi(x), \Delta}$\footnote[4]{\scriptsize{$f$ is a new (Skolem) function and $X_1, \ldots, X_n$ are all free logical variables of $\forall x \kern 0.1em \phi(x)$.}}} &
{\scriptsize ($\exists$r) $\inferencerule{\Gamma \rightarrow \phi(\theta), \exists x \phi(x), \Delta}{\Gamma \rightarrow \exists x \phi(x), \Delta}$\footnote[5]{\scriptsize{$\theta$ is an abbreviate term, often a new logical variable.}}} &
{\scriptsize ($\forall$l) $\inferencerule{\Gamma, \phi(\theta), \forall x \phi(x) \rightarrow \Delta}{\Gamma, \forall x \phi(x) \rightarrow \Delta}$\footnotemark[5]}&
{\scriptsize ($\exists$l) $\inferencerule{\Gamma, \phi(f(X_1, \ldots, X_n)) \rightarrow \Delta}{\Gamma, \exists x \phi(x) \rightarrow \Delta}$\footnotemark[4]}
\end{tabular}
\begin{tabular}{l l}
{\scriptsize (i$\forall$) $\inferencerule{\text{QE}(\forall X, Y (\mathsf{if} \kern 0.17 em \boldsymbol{s} = \boldsymbol{t} \kern 0.17em \mathsf{then} \kern 0.17em \Phi(X) \rightarrow \Psi(X) \kern 0.17em \mathsf{else} \kern 0.17em \Phi(X) \rightarrow \Psi(Y) \kern 0.17em \mathsf{fi}))}{\Phi(f(\boldsymbol{s})) \rightarrow \Psi(f(\boldsymbol{t}))}$\footnote[6]{\scriptsize{$X, Y$ are new variables of sort $\mathbb{R}$. QE needs to be applicable in the premises.}}} &
{\scriptsize (i$\exists$) $\inferencerule{\text{QE}(\exists X \bigwedge_{i}(\Phi_i \rightarrow \Psi_i))}{\Phi_1 \rightarrow \Psi_1 \ \ldots \ \Phi_n \rightarrow \Psi_n}$\footnote[7]{\scriptsize{    Among all open branches, the free (existential) logical variable $X$ of sort $\mathbb{R}$ only occurs in the branch $\Phi_i \rightarrow \Psi_i$.  QE needs to be defined for the formula in the premises, especially, no Skolem dependencies on $X$ occur.                              }}}
\end{tabular}
\begin{tabular}{l l l l}
{\scriptsize ($[]${\em gen}) $\inferencerule{\phi \rightarrow \psi}{\Gamma, [\alpha]\phi \rightarrow [\alpha] \psi, \Delta}$} &
{\scriptsize ($\langle \rangle${\em gen}) $\inferencerule{\phi \rightarrow \psi}{\Gamma, \langle \alpha \rangle \phi \rightarrow \langle \alpha \rangle \psi, \Delta}$} &
{\scriptsize ({\em ind}) $\inferencerule{\phi \rightarrow [\alpha] \phi}{\Gamma, \phi \rightarrow [\alpha^{\ast}]\phi, \Delta}$} &
{\scriptsize ({\em con}) $\inferencerule{v > 0 \wedge \varphi(v) \rightarrow \langle \alpha \rangle \varphi(v - 1)}{\Gamma, \exists v \kern 0.17em \varphi(v) \rightarrow \langle \alpha^{\ast} \rangle \exists v \leq 0 \kern 0.11em \varphi(v), \Delta}$\footnote[8]{\scriptsize{        logical variable $v$ does not occur in $\alpha$.            }}}
\end{tabular}
\begin{tabular}{l l}
{\scriptsize ({\em DI}) $\inferencerule{\chi \rightarrow [\forall i : \kern -0.17em A \ f(\boldsymbol{s})' := \theta] D(\phi)}{\phi \rightarrow [\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi]\phi}$\footnote[9]{\scriptsize{The operator $D$, as defined in~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}, is used to computer syntactic total derivations of formulas algebraically.}}} &
{\scriptsize ({\em DC}) $\inferencerule{\phi \rightarrow [\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi]\psi \quad \phi \rightarrow [\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \wedge \psi]\phi}{\phi \rightarrow [\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi]\phi}$}
\end{tabular}
\begin{tabular}{l l l l}
{\scriptsize ($[\cup]${\tiny $\Box$}) $\inferencerule{[\alpha] \pi \wedge [\beta] \pi}{[\alpha \cup \beta]\pi}$\footnote[10]{\scriptsize{  $\pi$ is a trace formula, whereas $\phi$ and $\psi$ are (state) formulas. Unlike $\phi$ and $\psi$, the trace formula $\pi$ may thus begin with a temporal modality $\Box$ or $\Diamond$.       }}} &
{\scriptsize ($\langle \cup \rangle \diamond$) $\inferencerule{\langle \alpha \rangle \pi \vee \langle \beta \rangle \pi}{\langle \alpha \cup \beta \rangle \pi}$\footnotemark[10]} &
{\scriptsize ($[;]${\tiny $\Box$}) $\inferencerule{[\alpha]\Box\phi \wedge [\alpha][\beta]\Box\phi}{[\alpha; \beta]\Box \phi}$}  &
{\scriptsize ($\langle ; \rangle \diamond$) $\inferencerule{\langle \alpha \rangle \Diamond \phi \vee \langle \alpha \rangle \langle \beta \rangle \Diamond \phi}{\langle \alpha; \beta \rangle \Diamond \phi}$} \\
{\scriptsize ($[?]${\tiny $\Box$}) $\inferencerule{\phi}{[?\chi] \Box \phi}$} &
{\scriptsize ($\langle ? \rangle \diamond$) $\inferencerule{\phi}{\langle ? \chi \rangle \Diamond \phi}$} &
   \quad &
   \quad \\
{\scriptsize ($[:=]${\tiny $\Box$}) $\inferencerule{\phi \wedge [\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta] \phi}{[\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta] \Box \phi}$} &
{\scriptsize ($\langle := \rangle \diamond$) $\inferencerule{\phi \vee \langle \forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta \rangle \phi}{\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta \rangle \Diamond \phi}$}  &
\quad &
\quad \\
{\scriptsize ($[']${\tiny $\Box$}) $\inferencerule{[\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi] \phi}{[\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi] \Box \phi}$ } &
{\scriptsize ($\langle ' \rangle \diamond$) $\inferencerule{\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \rangle \phi}{\langle \forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \rangle \Diamond \phi}$} &
\quad &
\quad \\
{\scriptsize ($[{}^{\ast n}]${\tiny $\Box$}) $\inferencerule{[\alpha; \alpha^{\ast}] \Box \phi}{[\alpha^{\ast}]\Box \phi}$}  &
{\scriptsize ($\langle {}^{\ast n} \rangle \diamond$) $\inferencerule{\langle \alpha; \alpha^{\ast}\rangle \Diamond \phi}{\langle \alpha^{\ast}\rangle \Diamond \phi}$ } &
{\scriptsize ($[{}^{\ast}]${\tiny $\Box$}) $\inferencerule{[\alpha^\ast][\alpha] \Box \phi}{[\alpha^{\ast}]\Box \phi}$} &
{\scriptsize ($\langle{}^{\ast}\rangle\diamond$) $\inferencerule{\langle \alpha^\ast \rangle\langle\alpha\rangle \Diamond \phi}{\langle \alpha^{\ast}\rangle \Diamond \phi}$}
\end{tabular}
\setcounter{footnote}{\value{mpfootnote}}
\end{minipage}
\caption{\scriptsize{Rule schemata of the proof calculus for quantified differential temporal dynamic logic}}
\label{fig:rules}
\end{figure}
\subsubsection{Inherited Non-temporal Rules}
The \qdtl calculus inherits the (non-temporal) \qdl proof rules. For propositional logic, standard rules {\em ax}--{\em cut} are listed in Fig.~\ref{fig:rules}. Rules $[;]$--$\langle ? \rangle$ work similar to those in~\cite{HarelKT00}. Rules $['], \langle ' \rangle$ handle continuous evolutions
for quantified differential equations with first-order definable solutions. Rules $[:=]$--$\langle :\kern -0.3em \ast \rangle$ handle discrete changes for quantified assignments. Axiom {\em ex} expresses that, for sort $A \not = \mathbb{R}$, there always is a new object $n$ that has not been
created yet ($\mathsf{E}(n) = 0$), because domains are infinite. The quantifier rules $\forall$r--i$\exists$ combine quantifier handling of many-sorted logic based on instantiation with theory reasoning by {\em quantifier elimination} (QE) for the theory of reals. The global rules $[]${\em gen}, $\langle \rangle${\em gen} are G\"{o}del generalization rules and {\em ind} is an induction schema for loops with {\em inductive invariant} $\phi$~\cite{HarelKT00}. Similarly, {\em con} generalizes Harel's convergence rule~\cite{HarelKT00} to the hybrid case with decreasing variant $\varphi$~\cite{APlatzer08}. {\em DI} and {\em DC} are rules for quantified differential equations with {\em quantified differential invariants}~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}. Notice that $[\cup], \langle \cup \rangle$ can be generalized to apply to formulas of the form $[\alpha \cup \beta]\pi$ where $\pi$ is an arbitrary trace formula, and not just a state formula as in \qdl. Thus, $\pi$ may begin with $\Box$ and $\Diamond$, which is why the rules are repeated in this generalized form as $[\cup]${\tiny{$\Box$}} and $\langle \cup \rangle \diamond$ in Fig.~\ref{fig:rules}.\vspace{-.3cm}

\vspace{-.1cm}
\subsubsection{Temporal Rules} The new temporal rules in Fig.~\ref{fig:rules} for the \qdtl calculus successively transform temporal specifications of quantified hybrid programs into non-temporal \qdl formulas. The idea underlying this transformation is to decompose quantified hybrid programs and recursively augment intermediate state transitions with appropriate specifications.

Rule $[;]${\tiny $\Box$} decomposes invariants of $\alpha; \beta$ (i.e., $[\alpha; \beta] \Box \phi$ holds) into an invariant of $\alpha$ (i.e., $[\alpha]\Box\phi$) and an invariant of $\beta$ that holds when $\beta$ is started in {\em any} final state of $\alpha$ (i.e., $[\alpha]([\beta]\Box \phi)$). Its difference with the \qdl rule $[;]$ thus is that the \qdtl rule $[;]${\tiny $\Box$} also checks safety invariant $\phi$ at the symbolic states in between the execution of $\alpha$ and $\beta$, and recursively so because of the temporal modality $\Box$. Rule $[:=]${\tiny $\Box$} expresses that invariants of quantified assignments need to hold before and after the discrete change (similarly for $[?]${\tiny $\Box$}, except that tests do not lead to a state change, so $\phi$ holding before the test is all there is to it). Rule $[']${\tiny $\Box$} can directly reduce invariants of continuous evolutions to non-temporal formulas as restrictions of solutions of quantified differential equations are themselves solutions of different duration and thus already included in the continuous evolutions of $\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta$. The (optional) iteration rule $[{}^{\ast n}]${\tiny $\Box$} can partially unwind loops. It relies on rule $[;]${\tiny $\Box$}.
The dual rules $\langle \cup \rangle \diamond$,$\langle ; \rangle \diamond$,$\langle := \rangle \diamond$,$\langle ? \rangle \diamond$,$\langle ' \rangle \diamond$,$\langle {}^{\ast n} \rangle \diamond$ work similarly. Rules for handling $[\alpha]\Diamond \phi$ and $\langle \alpha \rangle \Box \phi$ are discussed in Section~\ref{sec:8}

The inductive definition rules $[{}^{\ast}]${\tiny $\Box$} and $\langle{}^{\ast}\rangle\diamond$ completely reduce temporal properties of loops to \qdtl properties of standard non-temporal \qdl modalities such that standard induction ({\em ind}) or convergence ({\em con}) rules, as listed in Fig.~\ref{fig:rules}, can be used for the outer non-temporal modality of the loop. Hence, after applying the inductive loop definition rules $[{}^{\ast}]${\tiny $\Box$} and $\langle{}^{\ast}\rangle\diamond$, the standard \qdl loop invariant and variant rules can be used for verifying temporal properties of loops without change, except that the postcondition contains temporal modalities.

\subsection{Soundness and Completeness}
The following result shows that verification with the \qdtl calculus always produces correct results about the safety of distributed hybrid systems, i.e., the \qdtl calculus is sound.
\begin{theorem}[Soundness of \qdtl]\label{theo:soundness}
The {\em \qdtl} calculus is sound, i.e., every {\em \qdtl} (state) formula that can be proven is valid.
\end{theorem}

The verification for temporal safety ($[\alpha]\Box \phi$ or $\langle \alpha \rangle \Diamond \phi$), temporal liveness ($[\alpha]\Diamond\phi$ or $\langle \alpha \rangle \Box \phi$), and non-temporal ($[\alpha]\phi$ or $\langle \alpha \rangle \phi$) fragments of distributed hybrid systems has {\em three independent sources} of undecidability. Thus, no verification technique can be effective. Hence, \qdtl cannot be effectively axiomatizable. Both its discrete and its continuous fragments alone are subject to G\"{o}del's incompleteness theorem~\cite{APlatzer08}. The fragment
with only structural and dimension-changing dynamics is not effective either, because it can encode two-counter machines.

\qdl has been proved to be complete relative to quantified differential equations~\cite{DBLP:conf/csl/Platzer10,DBLP:conf/csl/Platzer10:TR}. Due to the modular construction of the \qdtl calculus, we can lift the relative completeness result from \qdl to \qdtl. We essentially show that \qdtl is complete relative to \qdl, which directly implies that \qdtl calculus is even complete relative to an oracle for the fragment of \qdtl that has only quantified differential equations in modalities. Again, we restrict our attention to homogeneous combinations of path and trace quantifiers like $[\alpha] \Box \phi$ or $\langle \alpha \rangle \Diamond \phi$.
\begin{theorem}[Relative Completeness of \qdtl]\label{theo:completeness}
The calculus in Fig.~\ref{fig:rules} is a complete
axiomatization of {\em \qdtl} relative to quantified differential equations.
\end{theorem}
This result shows that both temporal and non-temporal properties of distributed hybrid systems can be proven to exactly the same extent to which properties of quantified differential equations can be proven. It also gives a formal justification that the \qdtl calculus reduces temporal properties to non-temporal \qdl properties.
\section{Verification of Distributed Air Traffic Control Safety Properties}\label{sec:7}
Continuing the distributed air traffic control study from Section~\ref{sec:5}, the \qdtl proofs of the temporal safety invariant in (\ref{eq:safety}) and the temporal safety property in (\ref{eq:safetyproperty}) are presented in Fig.~\ref{fig:proofofverificationsafety} and Fig.~\ref{fig:proofofverificationsafety2}, respectively (for the purpose of simplifying the presentation, we ignore typing information $A$ for aircraft in the proof, because it is clear from the context). Note that temporal and non-temporal properties of the maneuver cannot be proven using any hybrid systems verification technique, because the dimension is parametric and unbounded and may even change dynamically during the remainder of the maneuver. The single proof in Fig.~\ref{fig:proofofverificationsafety} or Fig.~\ref{fig:proofofverificationsafety2} corresponds to infinitely many proofs for systems with $n$ aircraft for all $n$.

Our proofs show that the distributed roundabout maneuver always safely avoids collisions for arbitrarily many aircraft (even with dynamic appearance of new aircraft). The above maneuver still requires all aircraft in the horizon of relevance to participate in the collision avoidance maneuver. In fact, we can show that this is unnecessary for aircraft that are far enough away and that may be engaged in other roundabouts. Yet, this is beyond the scope of this paper.
\begin{figure}[!ht]
\vspace{-3mm}
\hspace*{-0.1in}
\begin{minipage}{1.1\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{{\em true}}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow \forall i, j (2(x_1(i) - x_1(j))(-\omega(x_2(i) - x_2(j))) + 2(x_2(i) - x_2(j))\omega(x_1(i) - x_1(j)) \geq 0$)}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow \forall i, j ( 0 = 0 \wedge 2(x_1(i) - x_1(j))(d_1(i) - d_1(j)) + 2(x_2(i) - x_2(j))(d_2(i) - d_2(j)) \geq 0)$}
\LeftLabel{$[:=]$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em \mathcal{L}(i)] \forall i, j (i' = j' \wedge 2(x_1(i) - x_1(j))(x_1(i)' - x_1(j)') + 2(x_2(i) - x_2(j))(x_2(i)' - x_2(j)') \geq 0)$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}
\vspace{-14mm}
\hspace*{-0.6in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{{\em true}}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\forall i, j ( - \omega d_2(i) - (- \omega d_2(j)) = - \omega(d_2(i) - d_2(j))  \wedge \omega d_1(i) - \omega d_1(j) = \omega(d_1(i) - d_1(j)))$}
\LeftLabel{$[:=]$}
\UnaryInfC{$[\forall i \kern 0.15em \mathcal{L}(i)] \forall i, j ( d_1(i)' - d_1(j)' = - \omega (x_2(i)' - x_2(j)') \wedge d_2(i)' - d_2(j)' = \omega(x_1(i)' - x_1(j)' ))$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}
\vspace{-8mm}
\setlength{\unitlength}{0.75mm}
\begin{picture}(0,0)
\thicklines
\put(28,12){\vector(-1,4){2.6}}
\put(137,12){\vector(1,2){12.5}}
\end{picture}
\hspace*{-0.7in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{$\cdots$}
\LeftLabel{$[:=]$}
\UnaryInfC{$[\forall i \kern 0.15em \mathcal{L}(i)](\forall i, j \kern 0.15em \mathcal{T}(i, j))'$}
\LeftLabel{$DI$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i, j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow [\forall i \kern 0.15em {\mathcal{F}}_{\omega}(i)]\forall i,j \kern 0.15em \mathcal{T}(i,j)$}

				\AxiomC{$\cdots$}
                \LeftLabel{$[:=]$}
				\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow [\forall i \kern 0.15em \mathcal{L}(i)](\forall i, j \kern 0.15em \mathcal{P}(i, j))'$}
				\LeftLabel{$DI$}
				\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i, j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow [\forall i \kern 0.15em {\mathcal{F}}_{\omega}(i) \with \forall i, j \kern 0.15em \mathcal{T}(i, j)]\forall i,j \kern 0.15em \mathcal{P}(i,j)$}

\LeftLabel{$DC$}
\BinaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i, j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow [\forall i \kern 0.15em {\mathcal{F}}_{\omega}(i)]\forall i,j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$[']${\tiny $\Box$}}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i, j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow [\forall i \kern 0.15em {\mathcal{F}}_{\omega}(i)] \Box \kern 0.08em \forall i,j \kern 0.15em \mathcal{P}(i,j)$}
\end{prooftree}}
\end{minipage}
\begin{center}
{\scriptsize Abbreviation: $\mathcal{L}(i) \equiv x_1(i)' : = d_1(i), x_2(i)' : = d_2(i), d_1(i)' := -\omega d_2(i), d_2(i)' := \omega d_1(i)$}
\end{center}
\vspace{-2mm}
\caption{\scriptsize{Proof for temporal collision freedom of roundabout collision avoidance maneuver circle}}
\label{fig:proofofverificationsafety}
\end{figure}

\begin{figure}[t!]
\vspace{-3mm}
\hspace*{-0.1in}
\begin{minipage}{1.1\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{{\em true}}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\chi \wedge \forall i, j \kern 0.15em \mathcal{T}(i, j) \rightarrow \forall i, j (2(x_1(i) - x_1(j))(-\omega(x_2(i) - x_2(j))) + 2(x_2(i) - x_2(j))\omega(x_1(i) - x_1(j)) \geq 0$)}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\chi \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow \forall i, j ( 0 = 0 \wedge 2(x_1(i) - x_1(j))(d_1(i) - d_1(j)) + 2(x_2(i) - x_2(j))(d_2(i) - d_2(j)) \geq 0)$}
\LeftLabel{$[:=]$}
\UnaryInfC{$\chi \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em \mathcal{K}(i)] \forall i, j (i' = j' \wedge 2(x_1(i) - x_1(j))(x_1(i)' - x_1(j)') + 2(x_2(i) - x_2(j))(x_2(i)' - x_2(j)') \geq 0)$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}
\hspace*{-1.0in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{{\em true}}
\LeftLabel{$\mathbb{R}$}
\UnaryInfC{$\chi \rightarrow \forall i, j ( - \omega d_2(i) - (- \omega d_2(j)) = - \omega(d_2(i) - d_2(j))  \wedge \omega d_1(i) - \omega d_1(j) = \omega(d_1(i) - d_1(j)))$}
\LeftLabel{$[:=]$}
\UnaryInfC{$\chi \rightarrow [\forall i \kern 0.15em \mathcal{K}(i)] \forall i, j ( d_1(i)' - d_1(j)' = - \omega (x_2(i)' - x_2(j)') \wedge d_2(i)' - d_2(j)' = \omega(x_1(i)' - x_1(j)' ))$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}[!ht]
\setlength{\unitlength}{0.75mm}
\begin{picture}(0,0)
\thicklines
\put(24.7,9.8){\vector(-1,4){1.6}}
\put(139.6,9.8){\vector(1,2){12.7}}
\end{picture}
\hspace*{-0.9in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{$\cdots$}
\LeftLabel{$[:=]$}
\UnaryInfC{$\chi
\rightarrow [\forall i \kern 0.15em
\mathcal{K}(i)] (\forall i, j \kern 0.15em \mathcal{T}(i,j))'$}
\LeftLabel{$DI$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em
\mathcal{T}(i,j)
\rightarrow [\forall i \kern 0.15em
\mathcal{M}(i) \with \chi] \forall i, j \kern 0.15em \mathcal{T}(i,j)$}

                                                                                \AxiomC{$\cdots$}
                                                                                \LeftLabel{$[:=]$}
                                                                                \UnaryInfC{$\chi \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em \mathcal{K}(i)] (\forall i, j \kern 0.15em \mathcal{P}(i,j))'$}
                                                                                \LeftLabel{$DI$}
                                                                                \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em \mathcal{M}(i) \with \chi \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j)] \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$DC$}
\BinaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em
\mathcal{T}(i,j)
\rightarrow [\forall i \kern 0.15em
\mathcal{M}(i) \with \chi] \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\end{prooftree} }
\end{minipage}
\end{figure}
\begin{figure}[!ht]
\setlength{\unitlength}{0.75mm}
\begin{picture}(0,0)
\thicklines
\put(14.0,9.4){\vector(1,2){4.9}}
\put(147.4,9.4){\vector(-1,2){4.9}}
\end{picture}
\hspace*{-1.7in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{$\cdots$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em
\mathcal{T}(i,j)
\rightarrow [\forall i \kern 0.15em
\mathcal{M}(i) \with \chi] \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$[']${\tiny $\Box$},$[:=]$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em
\mathcal{T}(i,j)
\rightarrow [\forall i \kern 0.15em t := 0][\forall i \kern 0.15em
\mathcal{M}(i) \with \chi]
\Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
                                                                                \AxiomC{$\cdots$}
                                                                                \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em \mathcal{M}(i) \with \chi] \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
                                                                                \LeftLabel{$[?]${\tiny $\Box$},$[:=]$}
                                                                                \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0][\forall i \kern 0.15em \mathcal{M}(i) \with \chi][? \eta] \Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$[;]${\tiny $\Box$}}
\BinaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0][\forall i \kern 0.15em \mathcal{M}(i) \with \chi; ? \eta] \Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}[!ht]
\hspace*{-1.7in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{{\em true}}
\LeftLabel{{\em ax}}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j), \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$\wedge$l}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
                                                              \AxiomC{{\em true}}
                                                              \LeftLabel{{\em ax}}
                                                              \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j), \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
                                                              \LeftLabel{$[:=]$,$\wedge$l}
                                                              \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0] \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$[:=]${\tiny $\Box$}}
\BinaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0]
\Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}[!ht]
\setlength{\unitlength}{0.75mm}
\begin{picture}(0,0)
\thicklines
\put(23.5,7){\vector(1,2){2.9}}
\put(131.4,7){\vector(1,2){16.2}}
\end{picture}
\hspace*{-0.9in}
\begin{minipage}{0.4\linewidth}
{\scriptsize
\begin{prooftree}
\AxiomC{$\cdots$}
\UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j
\kern 0.15em \mathcal{T}(i,j) \rightarrow
[\forall i \kern 0.15em t := 0] \Box \kern 0.08em
\forall i, j \kern 0.15em \mathcal{P}(i,j)$}
                                                  \AxiomC{$\cdots$}
                                                  \UnaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0][\forall i \kern 0.15em \mathcal{M}(i) \with \chi; ?\eta] \Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\LeftLabel{$[;]${\tiny $\Box$}}
\BinaryInfC{$\forall i, j \kern 0.15em \mathcal{P}(i,j) \wedge \forall i, j \kern 0.15em \mathcal{T}(i,j) \rightarrow [\forall i \kern 0.15em t := 0; \forall i \kern 0.15em \mathcal{M}(i) \with \chi; ?\eta] \Box \kern 0.08em \forall i, j \kern 0.15em \mathcal{P}(i,j)$}
\end{prooftree}}
\end{minipage}
\end{figure}
\begin{figure}[!ht]
\[{\scriptsize
\begin{array}{l c}
\text{Abbreviations:} & \mathcal{M}(i) \equiv {\mathcal{F}}_{\omega(i)}(i), t' = 1 \\
& \chi \equiv \forall i \kern 0.15em t \leq T \\
& \eta \equiv \forall i \kern 0.15em t = T \\
& \mathcal{K}(i) \equiv x_1(i)' : = d_1(i), x_2(i)' : = d_2(i), d_1(i)' := -\omega d_2(i), d_2(i)' := \omega d_1(i), t' := 1 \\
\end{array}}\]
\caption{\scriptsize{Proof for temporal collision freedom of roundabout collision avoidance maneuver circle in bounded time}}
\label{fig:proofofverificationsafety2}
\end{figure}

\section{Liveness by Quantifier Alternation}\label{sec:8}
Liveness specifications of the form $[\alpha]\Diamond \phi$ or $\langle \alpha \rangle \Box \phi$ are sophisticated ($\Sigma^1_1$-hard
because they can express infinite occurrence in Turing machines). Beckert and
Schlager~\cite{BeckertS01}, for instance, note that they failed to find sound rules for a discrete case that corresponds
to $[\alpha;\beta]\Diamond \phi$.

For {\em finitary liveness semantics}, we can still find proof rules. In this section,
we modify the meaning of $[\alpha]\Diamond\phi$ to refer to all {\em terminating} traces of $\alpha$. Then,
the straightforward generalization $[;]\diamond$ in Fig.~\ref{fig:rules2} is sound, even in the hybrid
case. But $[;]\diamond$ still leads to an incomplete axiomatization
as it does not cover the case where, in some traces, $\phi$  becomes true at some
point during $\alpha$, and in other traces, $\phi$ only becomes true during
$\beta$. To overcome this limitation, we use a program transformation approach. We instrument the
quantified hybrid program to monitor the occurrence of $\phi$ during all changes: In $[\alpha]\diamond$, $\check{\alpha}$ results from replacing all occurrences of $\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta$ with $\forall i : \kern -0.17em A \ f(\boldsymbol{s}) := \theta; ? (\phi \rightarrow t = 1)$ and $\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi$
with $\forall i : \kern -0.17em A \ f(\boldsymbol{s})' = \theta \with \chi \wedge (\phi \rightarrow t =1)$. The latter is a continuous evolution restricted to the region that satisfies $\chi$ and $\phi \rightarrow t = 1$. The effect
is that $t$ detects whether $\phi$ has occurred during any change in $\alpha$. In particular, $t$
is guaranteed to be $1$ after all runs if $\phi$ occurs at least once along all traces of $\alpha$.
\begin{figure}
\vspace{-5mm}
{\scriptsize \[([;]\diamond) \ \inferencerule{\rightarrow [\alpha]\Diamond \phi, [\alpha][\beta]\Diamond\phi}{\rightarrow [\alpha; \beta]\Diamond \phi} \quad \quad
([\alpha]\diamond) \ \inferencerule{\phi \vee \forall t : \kern -0.17em \mathbb{R}\ [\check{\alpha}]t = 1}{[\alpha]\Diamond\phi} \]}
\vspace{-3mm}
\caption{{\scriptsize Transformation rules for alternating temporal path and trace quantifiers}}
\label{fig:rules2}
\end{figure}
\section{Conclusions and Future Work}\label{sec:9}
For reasoning about distributed hybrid systems, we have introduced a temporal dynamic
logic, \qdtl, with modal path quantifiers over traces and temporal quantifiers
along the traces. It combines the capabilities of quantified differential dynamic logic to reason
about possible distributed hybrid system behavior with the power of temporal logic in reasoning about the behavior along traces. Furthermore, we have presented a proof calculus for verifying temporal safety specifications of quantified hybrid programs in \qdtl.

Our sequent calculus for \qdtl is a completely modular combination of temporal and non-temporal
reasoning. Temporal formulas are handled using rules that augment
intermediate state transitions with corresponding sub-specifications. Purely non-temporal
rules handle the effects of discrete transitions, continuous evolutions, and structural/dimension changes. The modular nature of the \qdtl calculus further enables us to lift the relative completeness result from \qdl to \qdtl. This theoretical result shows that the \qdtl calculus is a sound and complete axiomatization of the temporal behavior of distributed hybrid systems relative to differential equations. As an example, we demonstrate that our logic is suitable for reasoning about temporal safety properties in a distributed air traffic control system.

We are currently extending our verification tool for distributed
hybrid systems, which is an automated theorem prover called KeYmaeraD~\cite{DBLP:conf/icfem/RenshawLP11}, to cover the full \qdtl calculus. Future work includes extending
\qdtl with $\text{CTL}^{\ast}$-like~\cite{EmersonH86} formulas of the form $[\alpha](\psi \wedge \Box \phi)$ to avoid splitting of
the proof into two very similar sub-proofs for temporal parts $[\alpha]\Box\phi$ and non-temporal
parts $[\alpha]\psi$  arising in $[;]${\tiny $\Box$}. Our combination of temporal logic with dynamic
logic is more suitable for this purpose than the approach in~\cite{BeckertS01}, since \qdtl
has uniform modalities and uniform semantics for temporal and non-temporal
specifications. This extension will also simplify the treatment of alternating liveness
quantifiers conceptually.
\bibliographystyle{plain}

redpajama_set_name: RedPajamaArXiv


I don't want anything fancy.
Presentation matters and will continue to matter in the online space. A modern website needs to have a simple, beautiful interface that is easy to use and gorgeous to look at, whether you're a yoga instructor, an attorney, or a restaurant owner.
Analytics are included with each website and it's easy to add Google Analytics tracking to your website. I'll also walk you through the desktop metrics module and the metrics app that lets you use any mobile device to access page views, visitor statistics, sales, and track social media so you're always informed. The app is currently available for iOS and Android devices at no extra cost.
Yes, you probably can, but it will likely not be what you imagined . It has been my experience that people who opt to do their own sites often give up when it turns out to not be as easy as they imagined. Further, clients who chose to manage their own websites after the build ended up accidentally making blank pages, creating dead links, and letting content go out of date, making their sites frustrating and unpleasant to navigate. The only thing more unprofessional than not having a website is having one that is unappealing or outdated.
In 2019, your website is an extension of your physical storefront and the first impression you make to the world. The type of well-executed website I'll help you create will provide a value that is far greater than the upfront and one-time payment you'll have to make, which is often less than half of what a full web design agency would charge.
Of course, your domain is always yours. I'll help you set it up so that your address points at your new Squarespace website.
Squarespace may not be perfect for everyone, but it is ideal for any small business owner, entrepreneur, or blogger who doesn't have an IT team to help keep all the technical stuff up to date but still values clean, modern design. If you have an enterprise with complex IT requirements, databases, or lots of dynamic content, a Squarespace website may not be the right fit.
Not really, and things are rarely as free as they first appear. Once you add in costs for hosting, domains, themes, apps, plugins, and removing third-party ads, you're looking at a price significantly higher than "free." Think of this as a replacement to your IT overhead. With my approach, you won't have to whip out your credit card every time you sneeze to get a website with the features and security you want + control over your content.
Facebook is important and can drive traffic and sales, but it's not a substitute for a website. Facebook is akin to having a booth at a farmer's market — lots of foot traffic, but the creative freedom is limited, the signal-to-noise ratio is low, and in the grand scheme, the visitors belong to the market itself.
I don't want my site to look like a template.
It is true that Squarespace has a tightly curated library of templates to work with. For a professional designer, the templates are there to act as a jumping-off point. My aim is always to create a website that is distinctly branded and uniquely yours but maintains a familiar user experience.
My rates are 40-60% less than the competition due to low overhead and a supportive platform that takes care of the mundane, time-consuming base code writing. Custom web design typically ranges from $5,000—$7,000+ at the low end and some larger agencies only accept projects with budgets greater than $10,000. Squarespace allows designers like me to be extremely competitive in the web design market. Good, thoughtful web design with SEO best practices applied is not easy and not cheap. If you hire a cheap web designer, be prepared to keep paying for all the problems you'll encounter down the road.


Leisureday's static caravan insurance policy has been given a Defaqto 5 Star Rating for 2019.
This means you can be confident you're getting some of the best static caravan insurance cover in the market and a range of benefits that can be tailored to suit your caravanning needs.
Experts at Defaqto analyse the key features, benefits, and terms and conditions of every static caravan insurance policy in the UK. The Star Ratings help you identify at a glance where a product sits in the market in terms of quality of cover.
A Defaqto 5 Star Rating is awarded only to "an excellent product with a comprehensive range of features and benefits". Rather than comparing static caravan insurance policies on price alone, a Defaqto 5 Star Rating gives you reassurance that you'll be getting high quality cover and helps you make a more informed decision when you take out a policy.
We are committed to providing great value insurance and we offer several cover options, allowing you to tailor your policy to suit you and your needs.
To see a full list of our 5 Star cover benefits please call or click for a static caravan, lodge or chalet quote today.


minimise past mistakes.Are the people in your organisation clear on where they are heading?
Have your leaders defined who they are and what they stand for?
Is there alignment in your leadership team?
Are they clear on who they are, what they do and why they do it – as a team?


Do you make crazy amounts of to-do lists and keep yourself organized?
Do you write things down that you've already done just so you can cross them off and feel like you're accomplishing something?
Have taxes been on your list since way back in January and yet you still haven't mailed them off?
Part of the reason I have procrastinated this long (which if you know me, this is definitely not my style) is because they make it so hard. No wonder people don't file and end up having to call one of those sketchy lawyers on the commercials while you're just trying to watch some Law & Order SVU.
I had a couple of jobs this year so naturally I got paid from 3 different states. I worked all of $93 worth in Utah before moving. I worked in Virginia, got paid in Maryland, and lived in Washington DC. That means 4 state filings. That means confusion. At 11:00 p.m., when you're still doing taxes, that means even more confusion!
So I have stacks of paper. Thick stacks of paper. All that needs to happen is sorting and putting into envelopes. Bring to the post office. Doesn't sound like that big of a deal right? You're right, I should be able to do this. I can do this.
Sometimes procrastination is all that feels right. Sometimes what you need to do most is add another item to your to-do list. It should say, "make a cup of hot cocoa (w/coffee)." You can do that. Then you can cross it off!
1. Make a double boiler on your stove. Melt chocolate over simmering water. Add pinch of salt.
2. Meanwhile, heat milk in medium saucepan. Stir in melted chocolate and instant coffee.


Nature and the animal kingdom have always been Andrea Contri's passion. Since he was a child, he has sought direct contact with animals, thanks to the feelings passed on to him by his farming uncles, whose cows, donkeys and chickens were his weekend companions.
His communicating with animals began in 2009 in South Africa during a period of time as a volunteer with the white lions, where he learned the rudiments from the shaman Linda Turker.
Andrea's passion grew as he attended a course on communicating with animals in England in 2010, where he met Wynter Worsthorne, teacher and author of publications on animal communication, from Capetown, S. Africa. Andrea from the outset confirmed his potential through practical exercises where he was able to accurately describe the physical sensations of the animals studied. In the next years Andrea continued regularly to practice with different animals in South Africa: whales, lions, baboons, penguins, feral horses and white lions.
Upon his return to Italy Andrea helped people and their animals to understand each other in depth, thanks to intuitive communication. He has helped peolple amd private structures with his counseling for both domestic and wild animals. He worked together with the Jane Goodall Institute South Africa and the Global White Lion Protection Trust.
From 2013 he collaborate with the magazine "Amici di Paco", "Cerco Cuccia Disperatamente"where he publish articles regarding Animal Talk and how to improve our relationship with animals. He was on several radio show such as: Radio 24, Radio Laghi and Radio Noi Musica.
Introduction to Animal Communication, Worthing, UK (2010) with Wynter Worsthorne.
Lion Talk, Drakenstein Lion Park, Paarl, Weten Cape, SA (2011) with Wynter Worsthorne.
Penguins Talk, Simon's Town, SA (2011) with Wynter Worsthorne.
Whales Talk,Hermanus, SA (2011) with Wynter Worsthorne.
Animal Communication Intensive course, Sacred Star Lion Journey,Tsau!Conservacy, Mpulanga, SA (2011) with Wynter Worsthorne.
Advance Animal Comunication Workshop, Costantia (Cape Town), SA (2013) with Wynter Worsthorne e Anna Breytenbach.
Course - Impara a parlare con gli animali - Milano, IT (2014) with Amelia Kinkade.
The Language of Miracles Animal Communication Program Level I, Isle of Man, (2014) with Amelia Kinkade.
The Language of Miracles Animal Communication Program Level II, Isola di Man, (2014) with Amelia Kinkade.
Course "The Language of Miracles Animal Communication Program Level I"
Course "The Language of Miracles Animal Communication Program Level II"


text:
Are Used Car Salesmen Crazy?
Local TV ads for used car sellers usually have a couple of things in common: they are low budget and they star a salesman who is selling cars so cheaply that he must be out of his mind. It's been this way for years, but why? Who came up with the idea to feign insanity for the sake of car sales?
Earl Muntz Capitalized on Wartime Shortages
The answer is Earl "Madman" Muntz. Muntz began selling used cars in 1941 in southern California. Because of World War II, no new cars were manufactured, so the used car business was coming into its own.
Muntz bought cars in the midwest and then paid servicemen to drive them to California on their way to report to military service. California prices were significantly higher than midwest prices.
In addition to a brilliant business model, he worked with advertiser Mike Shore to come up with an attention-getting campaign. The "Madman" was born.
Billboards depicted Muntz as Napoleon (apparently, that was a thing) and claimed he was crazy for selling automobiles for such low prices. Newspaper ads read, "I wanna give 'em away, but Mrs. Muntz won't let me--SHE'S CRAZY!" Manic radio commercials filled the airwaves and "Madman" Muntz became a household name.
Woofers and Tweeters
Later, Muntz went into the TV business and popularized car stereos. He was continually innovating in the fields of electronics. and automobiles. But his greatest cultural legacy will always be the crazy pitchman persona that keeps local television interesting.
If you are looking to buy a used vehicle from either a crazy person or a sane one, bring it to us at I-86 Truck & Auto Repair. We can give you a used vehicle inspection to help you make a good decision on which automobile is right for you. We would also be happy to assist you with all of your auto care needs. Call us at 716-665-2501.
http://www.thetruthaboutcars.com/2014/03/crazy-ads-car-stereos-how-earl-madman-muntz-changed-car-and-american-culture/
https://www.hemmings.com/magazine/hcc/2017/04/Earl--Madman--Muntz/3750693.html