Abstract
Timed Automata are a well-known formalism for specifying timed behaviours. In this paper we are concerned with Timed Automata for the specification of timed behaviour of Continuous Time Markov Chains (CTMC), as used in the stochastic temporal logic CSL
. A timed path formula of CSL
is specified by a Deterministic Timed Automaton (DTA) that features two kinds of transitions: synchronizing transitions (triggered by CTMC transitions) and autonomous transitions (triggered when a clock reaches a given threshold). Other definitions of CSL
are based on DTAs that do not include autonomous transitions. This raises the natural question: do autonomous transitions enhance expressiveness and/or conciseness of DTAs? We prove that this is the case and we provide a syntactical characterization of DTAs for which autonomous transitions do not add expressive power, but allow one to define exponentially more concise DTAs.
Introduction
Stochastic logics like CSL [5] allow one to express assertions about the probability of timed executions of Continuous Time Markov Chains (CTMC). In CSL, model executions (typically called “paths”) are specified by two operators: timed neXt and timed Until. CSL has been extended in several ways to include action names (name of the events in the paths) and path properties specified using regular expressions leading to asCSL [6], or rewards, leading to CSRL [7]. Note that asCSL can specify rather complex path behaviour, expressed by regular expressions, but the timing requirements cannot be mixed within these expressions. GCSRL [14] is an extension of CSRL for model checking of CTMC generated by Generalized Stochastic Petri nets (GSPN) [1] taking into account both stochastic and immediate events.
Automata with time constraints have been used to specify path-based performance indices [16] for Stochastic Activity Networks [15], while hybrid automata have been used to define rather complex forms of passage of time [2] for GSPN, as well as generic performance properties [9] that are estimated using simulation. The use of a Deterministic Timed Automaton (DTA) in the stochastic logic CSL
[12] allows to specify paths in terms of state propositions and action names associated to CTMC states and transitions (respectively) and in terms of the timed behaviour of portions of the paths. The CTMC actions are the input symbols for the DTA, and two types of transitions are distinguished: synchronizing transitions that read the input symbols of the CTMC, and autonomous transitions, that are taken by the DTA when the clock reaches some threshold, with priority over synchronizing ones. The determinism requirement ensures that the synchronized product of the DTA and the CTMC is still a stochastic process as all sources of non-determinism are eliminated. CSL
strictly includes [12] CSL and asCSL. Various extensions of CSL
have been presented in the literature. DTA with multiple clocks have been used for defining an extension of CSL
[10, 13] but autonomous transitions are not allowed. In this paper we concentrate on single-clock CSL
with autonomous transitions, as in the original definition of CSL
. Indeed the single-clock limitation is a necessary requirement to reduce the CSL
model-checking problem to the (steady-state) solution of a Markov Regenerative Process, which is the largest class of stochastic processes for which we can compute an exact numerical solution, supported by efficient solution tools [3, 4]. The single-clock setting allows also to investigate whether the definition of CSL
in [10, 13], once limited to a single clock, is equivalent to the original definition of CSL
(introduced in [12]).
Paper Contributions. This paper addresses two research questions. The first one (Sect. 3) is whether the presence of autonomous transitions enhances the expressiveness of DTAs both in terms of timed languages (qualitative comparison) and in terms of probability of accepting the random path of a CTMC (quantitative comparison). We establish that autonomous transitions do enhance expressiveness. Given that eliminating autonomous transitions from a DTA is not always feasible, the second question (Sect. 4) is which are the uses of autonomous transitions that can be emulated by DTA w/o autonomous transitions. We have identified a hierarchy of subclasses of DTA in which the presence of autonomous transitions does not extend expressiveness (and autonomous transitions can therefore be eliminated), but that exponentially improves the DTA size. Only the most interesting proofs and properties have been included in this paper. Missing proofs and the full set of properties can be found in [11].
Context and Definitions
Although our motivations rely on the acceptance of paths of CTMCs featuring atomic propositions that label states and actions that label transitions, we set our work in the general context of acceptance of timed paths, where the 
-th state of a timed path is identified by 
(we count indices from 0), the boolean evaluation of the atomic propositions in that state. 
indicates a delay, or a sojourn time in state i, and 
indicates the time elapsed until exiting state i. A timed path leaves state 
with action 
after a sojourn time in the state equal to 
. The elapsed time can be computed as: 
, with 
.
Definition 1 (Timed Path)
Given a set 
of atomic propositions and a set 
of actions, a timed (infinite) path is a sequence 
such that for all 
.
Example 1
(Timed Path). In writing timed paths we indicate functions 
as the set of elements in 
that evaluate to 
. Given 
and 
, a timed path 
, is interpreted as the system staying in a state that satisfies 
in the time interval [0, 0.5[, at time 0.5 action a takes place and the system moves to a state that satisfies 
, stays there for 1.3 time units and then action b takes place (at the global time 
).
DTA definition includes a clock x and two types of constraints: boundary ones, BoundC = 
and inner ones, InC = 
, with 
, and 
. In the sequel, 
is the largest time constant occurring in a DTA. Before formally defining the syntax and semantic of a DTA (Definitions 2, 3 and 4), let us introduce its main ingredients. During the execution of a stochastic discrete event system (e.g. a Markov chain) that can be represented by a timed path, one manages (1) an index i of the timed path (2) a location, say 
, is matched with the current state of the path indexed by i, and (3) a delay 
until the next state change from i to 
. The function 
mapping the set of locations to the set of boolean expressions over atomic propositions, 
, restricts the possible matchings since the valuation 
must satisfy the formula 
. This matching evolves in three ways depending on the delay 
, elapsed until the next transition 
of the path.
Either after some delay
, there is an outgoing autonomous transition from 
whose boundary condition (say 
) is satisfied and such that 
fulfills 
where 
is the target location of the transition. Then 
is matched with i, delay 
becomes 
, the clock x is increased by 
and the index i is unchanged.Else if there is a synchronizing transition outgoing from
such that (1) after time 
has elapsed its inner condition (say 
) is satisfied, (2) the action 
belongs to the subset of actions associated with the synchronizing transition, and (3) 
satisfies 
where 
is the target location of the transition. Then 
is matched with 
, the new delay 
is set to 
, the clock x is either increased by 
or reset depending on the transition, and the index becomes 
.Otherwise there is no possible matching and the timed path is rejected by the DTA.
In the first two cases above, when 
, the final location, the timed path is accepted by the DTA whatever its future. This is ensured due to 
and the existence of the unique (looping) synchronizing transition from 
with no timing and action conditions. Observe that the synchronization may last forever without visiting 
: in this case the timed path is rejected. Furthermore the synchronization of the stochastic system with the DTA should not introduce non determinism. So (1) the formulas associated with the initial locations are mutually exclusive, (2) synchronizing transitions outgoing from the same location are never simultaneously enabled, (3) autonomous transitions outgoing from the same location are never simultaneously enabled, and (4) autonomous transitions have priority over synchronizing transitions.
Definition 2
(DTA). A single-clock Deterministic Timed Automaton
with autonomous transitions is defined by a tuple 
where L is a finite set of locations, 
is the set of initial locations, 
is the final location, 
is a function that assigns to each location a boolean expression over the set of propositions 
, 
is the set of synchronizing transitions, and 
is the set of autonomous transitions, with 
. 
denotes the transition 
.
Furthermore 
fulfills the following conditions.
Initial determinism.
.-
Determinism on actions.
if
and 
then 
or 
. -
Determinism on autonomous transitions.
if
and 
then 
or 
. Conditions on the final location
.
and 
.
Given a clock constraint 
and a clock valuation 
, 
denotes the satisfaction of 
by 
. Similarly given a boolean formula 
and a valuation of atomic propositions v, 
denotes the satisfaction of 
by v.
Example 2
(DTA). Figure 1, left, shows a DTA with five locations: 
and 
. There is a single initial location, 
. Autonomous transitions are depicted as dotted arcs, while synchronizing are depicted as solid arcs. For readability we omit: (1) the symbol 
on autonomous transitions; (2) the set r when there is no reset; (3) 
if a transition accepts all actions; (4) trivially true guards (like 
) and boolean conditions; (5) the name x of the clock in 
guards. As a result an autonomous transition is depicted as either 
, as between 
and 
, or as 
, as between 
and 
. We informally write “a transition with reset” or “a transition without reset” to indicate the condition 
and 
respectively. The arc from 
to 
represents a synchronizing transition with a clock reset. The arc from 
to 
represents an autonomous transition to be taken when the clock is equal to 1, with no clock reset. Boolean expression of locations are: p, associated with 
and 
, associated with 
.
Fig. 1.
Some examples of DTA.
Let us describe a possible run of this DTA. At time 0.5, it goes from 
to 
by performing action a and resets x. Then at time 1.5, it autonomously comes back to location 
and clock x is again reset. Then it autonomously goes to 
at time 2.5 and later to 
at time 3.5. While irrelevant, x has current value 2.
Definition 3
(Run of
). A run of a DTA 
is a sequence: 
such that for all 
: 
 |
To enforce priority of autonomous transitions,
let
(
)If
then 
and 
else 
.
A run is therefore a path in the DTA where the visited locations are coupled with a valuation of propositions, a clock value and a delay in a consistent way w.r.t. the DTA.
Example 3
(DTA run). Given that v is described in terms of the subset of 
that evaluate to 
, a run for the DTA of Fig. 1, left, is: 
A timed path 
is recognized by a run 
of 
such that the occurrences of the actions in 
are matched by the synchronizing transitions in 
. This requires to define a mapping to match the points in the paths in which synchronizing transitions take place. This can be done by identifying a strictly increasing mapping for the indices of the timed path 
to the subset of the indices of the run 
that correspond to a synchronizing transition. Note that, due to determinism, if such a run exists, it is unique.
Definition 4
(Path recognized by
and
). Let 
be a timed path and 
be a run of a DTA 
. Then 
is recognized by 
if there is a strictly increasing mapping 
(extended to 
, such that for all 
and 
, 
and 
A timed path 
is accepted by 
if 
is recognized by a run 
and 
visits 
.
The language 
of 
is the set of the timed paths 
accepted by 
.
Example 4
(Path recognized by a run). A timed path 
is recognized by the run of Example 3 with mapping 
: 
. The run visits 
and the path is accepted.
We consider timed paths generated by a CTMC with state properties and actions.
Definition 5
(CTMC representation). A continuous time Markov chain with state and action labels is represented by a tuple 
, where S is a finite set of states, 
the initial state, 
is a finite set of action names, 
is a finite set of atomic propositions, 
is a state-labeling function that assigns to each state s a valuation of the atomic propositions, 
is a rate function. If 
, we write 
.
We assume that each state has at least one successor: for all 
, exists 
, 
such that 
. CTMC executions lead to timed paths, and a CTMC is a generator of a random path. We define by 
the probability that the random path of 
is accepted by 
(probability measure of all paths accepted by 
as in [8]).
Autonomous Transitions and Expressiveness
We indicate with 
the whole family of automata of Definition 2 and with 
the subclass of automata with no autonomous transitions: 
The comparison of the expressive power of 
and 
is both qualitative (based on the timed path language) and quantitative (based on accepting probabilities).
Definition 6
Let 
and 
be families of DTA. Then:
is at least as expressive as
w.r.t. language, denoted 
, if for all 
there exists 
such that 
;
is at least as expressive as 
w.r.t. Markov chains, denoted 
, if for all 
there exists 
such that for all Markov chains 
, 
.
As usual, we derive other relations between such families. 
and 
are equally expressive w.r.t. language (resp. Markov chains), denoted 
(resp. 
) if 
and 
(resp. 
and 
). 
is strictly more expressive than
w.r.t. language (resp. Markov chains), denoted 
(resp. 
) if 
and not 
(resp. 
and not 
).
Observe that by definition 
implies 
. We now establish that autonomous resetting transitions extend the expressive power of DTA w.r.t. Markov chains (
). The weaker result w.r.t. language (
) is shown in [11].
Theorem 1
There exists 
such that for all 
there exists a Markov chain 
with 
.
Before proving this theorem, we prove some intermediate properties. We first establish a kind of 0-1 law for DTA in 
and Markov chains. In order to obtain this intermediate result, we introduce some objects. Simple chains are Markov chains with a single action, no atomic proposition (or equivalently with the same valuation for all states) and such that each state s has a single successor state sc(s) reached with rate 
. W.r.t. the acceptance probability of simple chains, we can consider DTAs without actions and atomic propositions. Moreover we add to each DTA an additional garbage location and we split the transitions, so that, w.l.o.g. one can assume that for each location 
of a DTA in 
, there are 
outgoing transitions: 
where 
is the maximal constant occurring in the DTA. The shape of the guards is not a restriction in the context of Markov chains. For all clock valuations 
, the clock valuation 
is defined by:
Let
with 
;If
then 
else 
.
Observe the difference between 
, defined at the syntactical level, which maps a location to its 
successor and sc, defined at the semantical level, which maps a pair consisting in a location and a clock valuation to the new clock valuation obtained by firing the single transition enabled w.r.t. the clock valuation.
We also define the region (multi-)graph 
of such a DTA 
as follows.
V, the set of vertices, is defined by
;Let
be a vertex, then for all j s.t. 
, there is a transition from 
to 
labelled by j with 
if 
and 
otherwise.
One interprets 
as follows. The vertex 
corresponds to the region defined by location 
with clock valuation 0. The vertex 
corresponds to the region defined by location 
with clock valuation in ]0, 1[. The vertex 
for 
corresponds to the region defined by location 
with clock valuation in 
. The vertex 
corresponds to the region defined by location 
with clock valuation in 
. The transition outgoing from 
labelled by j corresponds to the combination of time elapsing to enter the region 
followed by an action of the Markov chain, leading to either 
or to 
, in case of reset.
Given s a state of a Markov chain, 
a location of DTA, and 
a clock valuation, 
denotes the probability of acceptance when the Markov chain starts in s and the DTA starts in 
with clock valuation 
. In particular for a DTA 
applied to a Markov chain 
, 
where 
is the initial state of 
and 
is the initial location of 
such that 
.
Lemma 1
Let s be a state of a simple Markov chain 
and 
be a location of a DTA in 
. Then the function that maps t to 
is continuous and for 
it is equal to:
 |
1 |
The above formula represents the probability of acceptance when the Markov chain starts in s and the DTA starts in 
with clock valuation t, with 
, therefore within the region (l, i). This probability is computed in terms of the probability of having the next CTMC transition within the region (l, i) itself, or any later region (l, j), multiplied by the probability of acceptance from the state reached by accepting the CTMC transition.
Proof
Define 
as the probability that the run associated with a random timed path of 
starting in s when the DTA starts in 
with clock valuation t reaches location 
after performing n actions. Then for 
, 
and 
. Assume that 
is continuous (and so measurable) for all s and 
. Then the following equation holds for 
:
 |
Observe that for 
, 
is constant since if there is a reset then 
and if there is no reset then 
and so the valuation of the clock is irrelevant. Thus the equation can be rewritten as follows.
 |
Observe that 
is uniformly continuous. So pick 
such that for all 
. Let 
. Then for all 
, one bounds 
by the sum of three terms using the above equation to establish that 
. Thus 
is continuous. When 
, 
is constant and so continuous.
Observe that 
. So the mapping 
is measurable as a limit of continuous mappings. Thus Eq. 1 holds for 
: Repeating the same argument as the one for the inductive case yields the result. When 
, 
is constant and so continuous.
Proposition 1
Let 
and 
such that for all Markov chains 
, 
, then 
.
Proof
We will even prove this result when restricting the quantification to Markov chains with a single action and a single valuation of propositions for all states and a single successor for all states. Thus we can omit propositions and actions in the DTA and only consider simple chains.
Let 
be an automaton that satisfies the hypothesis. We want to establish that for all configurations
in some region of
reachable from
, and for all states
s
of a simple Markov chain,
. We do this by induction on the distance from the initial region in the region graph and then we prove that z is either 0 or 1. The basis case of the induction corresponds to the assumption 
, for all 
.
For the inductive step we assume that for a given 
, and for all states s of a simple chain, 
and we prove that the 
, for all 
reachable in one step from 
.
Let 
be an arbitrary simple chain and define 
as the simple chain with a single transition outgoing from its initial state to the initial state of 
whose rate is 
. Let s be the initial state of 
.
By assumption, 
. Define 
by 
when 
and by 
when 
. Equation 1 can be rewitten as 
. Since for all 
, 
, the Laplace transform of 
is equal to 
, i.e. the Laplace transform of the constant function z. By the theorem of unicity of Laplace transforms, this entails that 
except for a set of null measure. However, consider a successor region 
of location 
with clock valuation 
.
Either
(meaning that there has been a reset) and the region has a single point reached with non null probability. So 
.Or
, so by Lemma 1, 
is continuous inside the region w.r.t. 
and thus everywhere equal to z.
So the induction is established. So if a region of 
is reachable in the region graph, then 
. Otherwise 
is not reachable implying that no run is accepting, and thus 
.
We can now prove Theorem 1 (
).
Proof of Theorem 1. The DTA 
in Fig. 1 (lower right) has an action set reduced to a singleton 
(omitted in the figure) and an empty set of propositions. The language of 
is the set of timed paths whose first action occurs at time 
for some 
. Assume by contradiction that there exists 
such that for all Markov chain 
, 
.
Pick an arbitrary Markov chain 
and define 
as the Markov chain which has a single transition from its initial state to the initial state of 
with rate 
. It is routine to check that 
(as only the first transition of 
is relevant) and, consequently, 
and, given the hypothesis, also 
.
can be decomposed as 
where 
is the probability to accept the random timed path and that the first action takes place at most at time 
and 
is the probability to accept the random timed path and that the first action takes place after 
, where 
is the maximal constant of 
. But 
and therefore 
.
On the other hand, let 
be the location of 
reached from its initial location when the value of the clock is greater than 
, its maximal constant. There must be one, if not 
, which contradicts what derived above. We want to design an automaton 
equivalent to 
when reaching 
with clock value greater than 
: any timed path is accepted by 
iff it is accepted by 
when starting in 
with clock valuation greater than 
. For the construction we duplicate the automaton and merge the final location, the initial location is location 
of the first copy, and in the first copy we add to the guard of all transitions the formula 
and redirect the transitions that reset the clock to the corresponding location of the second copy.
But then 
. Since 
and 
is arbitrary, this contradicts Proposition 1 applied to 
.
The DTA in Fig. 1 (upper right) shows that the above counter-example is of practical interest. Consider a periodic system that cycles over phases of duration 2, each split in two sub-phases of duration 1 (for example a running and a reset phase) and that can experience good (G), bad (B), and neutral (N) actions, generated from a CTMC of arbitrary complexity. The depicted DTA allows one to compute the probability of the CTMC behaviours characterized by a good action in the running sub-phase, given that in the preceding phases no bad action has happened in the running phase. Any action is instead allowed during the reset phase.
Autonomous Transitions and Conciseness
We have established that there exists DTAs that cannot be translated into DTAs without autonomous transitions (
). We now investigate whether restricted forms of use of autonomous transitions are as expressive as 
. To this goal we identify two additional subclasses of 
, namely 
and 
, characterized by a limited presence of autonomous transitions and that are in the following subset relationship: 
.
Restricted cycles.
is the subclass of automata 
in which all cycles of 
including an autonomous transition with a reset also include a synchronizing transition 
with 
or 
.No reset on autonomous transitions.
is the subclass of automata 
in which there is no autonomous transition that resets the clock: 
.
The DTA on the left of Fig. 1 belongs to 
: indeed there is an autonomous transition with reset (from 
to 
), therefore it is not in 
, but although the transition is part of a cycle, that cycle also includes a synchronizing transition with reset (from 
to 
). Any DTA with no reset on autonomous transitions is an example of 
. The family 
has been introduced to provide an accurate syntactical characterization of DTA for which the autonomous transitions do not add expressive power. In some sense, the DTA of Theorem 1 emphasizes the interest of 
since the cycle performed by the autonomous resetting transition points out what increases the expressive power. 
, which forbids clock resets on autonomous transitions, removes from CSL
the capacity of combining time constants depending on the time elapsed during (a portion of) an execution. As observed in [12](section 4), clock resets on autonomous transitions are what makes CSL
more expressive than asCSL [6].
The following frame summarizes the results for 
subclasses. 
We first establish that in 
the autonomous resetting transitions can be mimicked in 
using additional finite memory, but with exponential cost.
Proposition 2
There exists an algorithm operating in exponential time that takes as input 
and outputs 
with 
.
Sketch of Proof. The construction (1) duplicates locations by memorizing in the location an integer value, (2) take into account this value for modifying the guard and the destination of the outgoing transitions, and (3) deletes the reset of autonomous transitions. This value corresponds to the accumulated value of constants in the guards of resetting autonomous transitions since the last visit of a synchronizing transition with a reset or a guard 
. The restriction over 
ensures that this value is bounded by some finite integer K. However K may be exponential in the size of 
and thus this transformation is exponential.
The exponential blowup due to the duplication of locations is unavoidable:
Proposition 3
There exists a family 
in 
such that the size of 
is 
and for all 
with 
, 
.
We now prove that autonomous transitions in 
can be eliminated, also at an exponential cost.
Proposition 4
There exists an algorithm operating in exponential time that takes as input 
and outputs 
with 
.
Sketch of Proof. The construction proceeds in two steps: at first, cycles of autonomous transitions are eliminated, then all (linear) paths of autonomous transitions are eliminated. The first construction is quadratic, as we duplicate each location to store in the location the information on the number of autonomous transitions visited since the last visit of a synchronized transition. The idea of this construction is that if a path exceeds the number of autonomous transitions it must visit twice the same autonomous transition without visiting a synchronized transition and so diverges. In words: in the resulting DTA, divergence has been transformed into deadlock. This finite memory has a linear size w.r.t. the size of the original DTA.
The second step consists in eliminating autonomous transitions when there are no such cycles. The key point is to select a location 
which is the source of the last autonomous transition of a maximal path of such transitions. Thus every autonomous transition outgoing from 
reaches some location 
where only synchronized transitions are possible. Roughly speaking, the construction builds a synchronized transition corresponding to a sequence of an autonomous transition followed by a synchronized transition. However the construction is more involved since 
has to be duplicated in order to check which autonomous transition can be triggered (or if no autonomous transition can be triggered). This duplication also has an impact on the incoming transitions of 
. Repeating (at most |L| times) this transformation eliminates all autonomous transitions. The exponential blowup due to the repetition of duplication of locations is unavoidable:
Proposition 5
There exists a family of automata 
in 
such that the size of 
belongs to 
and for all 
with 
the number of its locations is at least 
.
Conclusion and Future Work
We have established that autonomous transitions do enhance expressiveness of single clock DTAs, and more precisely for the less discriminating case of the probability of the random paths of a CTMC accepted by the DTA. This is the most relevant one for comparing some variations of (1-clock) CSL
defined in the literature. This enhanced expressiveness is due to the possibility of associating clock resets with autonomous transitions that occur in a cycle. The small counterexample of Proposition 1 can be seen as the basic construct to study systems with periodic behaviours or periodic phases, with clear practical implications. Even in DTA subclasses for which the autonomous transitions do not enhance expressiveness, they do play a role in defining concise DTAs: removing autonomous transitions may lead to an exponential blow up of the DTA.
We plan to investigate whether the precise identification of the characteristics that enhance expressiveness and conciseness can help the identification of the best algorithms for CSL
model-checking, in particular for the component-based method [4]. Moreover, following the suggestion by an anonymous reviewer, we intend to investigate further consequences of Proposition 1, for example to study systems that include probabilistic choices of autonomous transitions.
Contributor Information
Alberto Leporati, Email: alberto.leporati@unimib.it.
Carlos Martín-Vide, Email: carlos.martin@urv.cat.
Dana Shapira, Email: shapird@g.ariel.ac.il.
Claudio Zandron, Email: zandron@disco.unimib.it.
Susanna Donatelli, Email: donatelli@di.unito.it.
Serge Haddad, Email: haddad@lsv.fr.
References
- 1.Ajmone-Marsan M, Balbo G, Conte G, Donatelli S, Franceschinis G. Modelling with Generalized Stochastic Petri Nets. Hoboken: Wiley; 1995. [Google Scholar]
- 2.Amparore EG, Ballarini P, Beccuti M, Donatelli S, Franceschinis G. Expressing and computing passage time measures of GSPN models with HASL. In: Colom J-M, Desel J, editors. Application and Theory of Petri Nets and Concurrency; Heidelberg: Springer; 2013. pp. 110–129. [Google Scholar]
-
3.Amparore, E.G., Donatelli, S.: MC4CSL
: an efficient model checking tool for CSL
. In: QEST 2010, pp. 153–154. IEEE Computer Society (2010)
- 4.Amparore EG, Donatelli S. Efficient model checking of the stochastic logic CSLTA. Perform. Eval. 2018;123–124:1–34. doi: 10.1016/j.peva.2018.03.002. [DOI] [Google Scholar]
- 5.Aziz A, Sanwal K, Singhal V, Brayton R. Model-checking continuous-time Markov chains. ACM Trans. Comput. Log. 2000;1(1):162–170. doi: 10.1145/343369.343402. [DOI] [Google Scholar]
- 6.Baier C, Cloth L, Haverkort BR, Kuntz M, Siegle M. Model checking Markov chains with actions and state labels. IEEE TSE. 2007;33:209–224. [Google Scholar]
- 7.Baier C, Haverkort B, Hermanns H, Katoen J-P. On the logical characterisation of performability properties. In: Montanari U, Rolim JDP, Welzl E, editors. Automata, Languages and Programming; Heidelberg: Springer; 2000. pp. 780–792. [Google Scholar]
- 8.Baier C, Haverkort B, Hermanns H, Katoen J-P. Model-checking algorithms for continuous-time Markov chains. IEEE TSE. 2003;29(6):524–541. [Google Scholar]
- 9.Ballarini P, Barbot B, Duflot M, Haddad S, Pekergin N. HASL: a new approach for performance evaluation and model checking from concepts to experimentation. Perform. Eval. 2015;90:53–77. doi: 10.1016/j.peva.2015.04.003. [DOI] [Google Scholar]
- 10.TChen, T., Han, T., Katoen, J.-P., Mereacre, A.: Model checking of continuous-time Markov chains against timed automata specifications. Log. Methods Comput. Sci. 7(1:12), 1–34 (2011)
-
11.Donatelli, S., Haddad, S.: Autonomous Transitions Enhance CSA
Expressiveness and Conciseness. Research report, Inria Saclay Ile de France, LSV, ENS Cachan, CNRS, INRIA, Université Paris-Saclay, Cachan, France, Universita degli Studi di Torino, October 2019. https://hal.inria.fr/hal-02306021
-
12.Donatelli S, Haddad S, Sproston J. Model checking timed and stochastic properties with CSL
IEEE TSE. 2009;35(2):224–240. [Google Scholar] - 13.Feng Y, Katoen J-P, Li H, Xia B, Zhan N. Monitoring CTMCs by multi-clock timed automata. In: Chockler H, Weissenbacher G, editors. Computer Aided Verification; Cham: Springer; 2018. pp. 507–526. [Google Scholar]
- 14.Kuntz, M., Haverkort, B.R.: GCSRL-a logic for stochastic reward models with timed and untimed behaviour. In: 8th PMCCS, pp. 50–56 (2007)
- 15.Meyer, J.F., Movaghar, A., Sanders, W.H.: Stochastic activity networks: structure, behavior, and application. In: International Workshop on Timed Petri Nets, pp. 106–115. IEEE CS (1985)
- 16.Obal WD, II, Sanders WH. State-space support for path-based reward variables. Perform. Eval. 1999;35:233–251. doi: 10.1016/S0166-5316(99)00010-3. [DOI] [Google Scholar]