Keywords: Timed automata, Verification, Partial order reduction, Statespace explosion, Local time semantics . . .

C Sync-subsumption check for local zones xviii

Partial order reduction

. It is one of the standard approaches used to tackle the problem of state-space explosion for systems consisting of several components operating

Titre : Réduction d'ordre partiel pour les systèmes temporisés Résumé : Dans cette thèse, nous étudions le problème d'accessibilité dans les réseaux d'automates temporisés. Nous nous concentrons sur la question de l'explosion de l'espace d'états causée par les entrelacements d'actions dans les exécutions de ces réseaux. Nous proposons deux solutions différentes pour atténuer l'effet de cette explosion combinatoire. La première est un algorithme d'accessibilité basé sur une sémantique temporelle locale pour les réseaux d'automates temporisés. La seconde est un cadre pour les méthodes de réduction d'ordre partiel pour ces mêmes réseaux.

L'approche standard pour résoudre le problème d'accessibilité d'un automate temporisé implique l'exploration d'un graphe dirigé, connu sous le nom de graphe de zone de cet automate. Dans notre travail, nous considérons une sémantique alternative pour les réseaux d'automates temporisés, appelée sémantique temporelle locale, qui a été introduite par Bengtsson et al [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF], ainsi que la notion correspondante de graphes de zone locale. Cette nouvelle approche consiste à considérer une échelle de temps locale à chaque processus, et à ne synchroniser ces temps locaux que lorsque les processus exécutent une action commune. Le principal défi ici est que les graphes de zones locales sont infinis en général. Nous surmontons ce défi en concevant un nouvel algorithme qui vérifie l'accessibilité dans un réseau en calculant une troncature finie de son graphe de zone locale. Nous montrons que plusieurs noeuds dans le graphe de zone standard, qui correspondent à différents entrelacements des mêmes actions, sont remplacés par un seul noeud dans le graphe de zone locale. L'évaluation expérimentale de notre algorithme montre le gain d'un ordre de grandeur par rapport aux algorithmes de référence sur plusieurs exemples standards.

Dans la deuxième partie de cette thèse, nous nous concentrons sur l'application des techniques de réduction d'ordre partiel à l'exploration des graphes de zones locales. La réduction d'ordre partiel est une technique largement utilisée pour combattre l'explosion combinatoire de l'espace d'états. Elle consiste à identifier une petite partie de l'espace d'états dont l'exploration est suffisante pour vérifier le système. Nous décrivons pourquoi ceci est difficile à réaliser dans un cadre temporisé. Nous identifions ensuite une sous-classe de réseaux d'automates temporisés, que nous appelons systèmes à désynchronisation bornée, pour lesquels nous développons des algorithmes de réduction d'ordre partiel. Nous présentons plusieurs exemples pour cette sous-classe, motivés par des benchmarks standards. Nous fournissons également une évaluation d'un prototype de l'implémentation de ces méthodes en utilisant l'outil TChecker [START_REF] Herbreteau | [END_REF].

Mots-clés : Automates temporisés, Vérification, Réduction d'ordre partiel, Explosion de l'espace d'état Title: Partial order reduction for timed systems Abstract: In this thesis, we study the reachability problem for networks of timed automata. We focus on the issue of state-space explosion due to interleavings in these networks, and provide two different solutions for alleviating the effects of this explosion. The first is a reachability algorithm based on a local time semantics for networks of timed automata, and the second is a framework for partial order reduction methods for networks of timed automata.

The standard approach for solving the reachability problem for a timed automaton involves exploring a directed graph, known as the zone graph of the timed automaton. In our work, we consider an alternate semantics for networks of timed automata, called local time semantics, which was introduced by Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF], and the related notion of local zone graphs. The approach in local time semantics is to make time local to each process, and synchronize the local times of processes when they execute a common action. The main challenge here is that local zone graphs are infinite in general. We overcome this challenge by designing a new algorithm that checks reachability in a network by computing a finite truncation of the local zone graph of the network. We show that multiple nodes in the standard zone graph that correspond to different interleavings of the same sequence are replaced by a single node in the local zone graph. Experimental evaluation of our algorithm shows an order of magnitude gain with respect to state of the art algorithms on several standard benchmark examples.

In the second part of this thesis, we shift our focus to applying partial order reduction techniques to the exploration of local zone graphs. Partial order reduction is a widely used technique that combats the combinatorial explosion of search space by identifying a small part of the state space whose exploration is sufficient to verify the system. We describe why this is difficult to achieve in the timed setting. We then identify a subclass of networks of timed automata which we call bounded spread systems for which we develop partial order reduction algorithms. We exhibit several examples motivated by standard benchmark models that belong to this subclass. We also provide an evaluation of a prototype of the implementation of these methods using the tool TChecker [START_REF] Herbreteau | [END_REF].

I would like to first thank my advisors Igor, Frédéric and Srivathsan. The work in this thesis would not have been possible without their constant guidance, support and encouragement.

Both Igor and Frédéric have taken pains to ensure that I am comfortable during my stay at Bordeaux, especially during the pandemic. I am grateful to them for their constant care and concern. Throughout the course of my PhD, I have had the opportunity to learn a lot from them, starting from their way of approaching a problem to writing simple and elegant proofs. I admire their approach and outlook towards research. I feel fortunate to be advised by Igor and Frédéric and express my deepest gratitude for their mentorship.

I am also grateful to Igor for patiently guiding me with the writing of this thesis -his valuable comments and advice have been vital in vastly improving it. The prototype of our algorithms in the tool TChecker is thanks to the efforts of Frédéric, and I thank him for all his hard work towards incorporating our results in TChecker. I would also like to thank Frédéric for going through the thesis carefully and giving several valuable comments and suggestions that have enhanced the presentation of the thesis. Thanks to Frédéric for helping me with French translations and helping me navigate the bureaucratic system at Bordeaux.

I have learnt a lot from the several long and enjoyable discussions with Srivathsan throughout the last 3 years. It was Srivathsan who introduced me to timed automata during my Masters at CMI. His approach of stripping the problem to its basics and then attacking it has helped me in my work. He has always been ready to help and advise me in times of need, and I could not have asked for a better mentor.

I would like to thank the reviewers of this thesis, Laure Petrucci and Thomas Chatain, for taking the time to read this thesis, for evaluating my work, and for providing valuable feedback. I would also like to thank the reviewers and the examiners, Jérôme Leroux, Silvano Dal Zilio and David Ilcinkas for the interesting questions and perspectives during the defense.

I would like to thank UMI Relax for funding this cotutelle thesis and extend my thanks to Madhavan Mukund and Pascal Weil for giving me this opportunity. I would also like to thank Pascal for the several interesting vii viii lunch discussions during my stay at Bordeaux. I would like to express my gratitude to the members of my Comité de suivi, Yves Métivier and Diego Figueira, for their advice and guidance.

I take this opportunity to thank the administrative staff at LaBRI, University of Bordeaux and CMI for their help with all of the administrative formalities.

I would like to thank my officemates Quentin, Jonathan, Jana and Noureddine for making Office 123 my home away from home. Thanks to Marthe for feeding us with cookies from time to time ! Many thanks to Quentin and Christélé for hosting the 'traditional' Board game nights that we all enjoyed a lot.

I would also like to thank Sougata, Soumyajit, Kanka, Mallika, Aline, Debam, Varun, Attila, Raj, Ritam, Jay, Ani, Karim 1 and 2, Trang, Josephine, Shih-shun, Tidiane, Sidoine, Kinda, Roopayan and many others for making life in Bordeaux memorable.

I would like to thank my teachers at CMI, IMSc and NIT Calicut, who introduced me to various areas of computer science. I am grateful to Amaldev Manuel and Paul Gastin for introducing me to research in Automata theory, logic and algebra during my Masters at CMI. I have learnt a lot from both of them and I thank both of them for working with me, teaching me several lessons in research and for the great discussions we had.

I would like to thank my friends, Nithin, Pranav, Vishnu, Sayan, Ashish, Krishnendu, Rajit, who have been an integral part of my life. I am grateful to Nithin for his support and valuable suggestions at various stages of my work. Thanks also to Sayan, Pranav and Ashish for providing me with detailed feedback about the manuscript at various points. I would also like to thank all my friends from CMI and NIT Calicut who have been an integral part of my life.

I was introduced to computer science by Prof. Murali Krishnan during my bachelors at NIT Calicut. I owe him a deep debt of gratitude for all I have learned from him, and for his support, guidance and mentorship.

I am deeply indebted to Prof. A G Menon for always being there to advise me and for all his kind words of encouragement ever since I first met him as a small boy at IISc. I would like to thank Prof. Vinod and Mr. K Radhakrishnan for their advice and encouragement.

I would like to thank all my friends and relatives for their support and encouragement. I will not list them, but I would like to express my gratitude to each and everyone of them.

Lastly, I thank my parents, sister, and grandmother for their unconditional love and support. My parents have always done everything possible to help me pursue my interests. They are a source of inspiration for me and if I have accomplished anything, I owe it to them.

Résumé de la thèse

Les systèmes cyber-physiques sont largement utilisés dans divers domaines tels que l'industrie automobile, la santé, l'avionique et l'industrie manufacturière. Des contrôleurs industriels aux stimulateurs cardiaques, en passant par les systèmes automobiles autonomes, ils sont omniprésents dans la société actuelle et jouent un rôle central dans l'assistance et l'amélioration de divers aspects de notre vie quotidienne. Ces systèmes ont généralement des spécifications, exprimées sous forme de contraintes sur leur comportement. Très souvent, ces systèmes sont essentiels à la sécurité ; même une chance infime de comportement erroné entraînerait une perte de vie ou de biens. Il est donc crucial de s'assurer que ces systèmes répondent toujours à leurs spécifications.

La vérification formelle est un domaine de recherche consacré à l'élaboration de procédures permettant de résoudre ce problème. La vérification des systèmes cyber-physiques consiste à modéliser les composants du système en tant qu'objets mathématiques abstraits, et à concevoir des algorithmes permettant de vérifier que le comportement de ces systèmes est conforme aux attentes. Les automates temporisés sont un formalisme pratique, utilisé lorsque les systèmes à modéliser sont associés à des contraintes temporelles. Il est souvent plus naturel de modéliser ces systèmes par un réseau d'automates temporisés qui fonctionnent simultanément et se synchronisent sur des actions communes.

L'explosion de l'espace d'états est un défi important dans la conception de procédures de vérification pour les réseaux d'automates. Cette explosion fait référence à la croissance exponentielle de la taille de l'espace d'états du réseau lorsque la taille du réseau augmente. Nous montrons que si l'explosion de l'espace d'états est déjà un défi pour les réseaux d'automates non temporisés, cela empire dans le cas des automates temporisés, car chaque entrelacement stocke l'information temporelle et conduit à un état temporisé potentiellement différent.

Les réductions d'ordre partiel sont une famille de techniques employées pour résoudre le problème de l'explosion combinatoire en réduisant l'espace d'états à parcourir par un algorithme de vérification. Son application aux réseaux de systèmes non temporisés est bien étudiée [START_REF] Valmari | Stubborn sets for reduced state space generation[END_REF][START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF][START_REF] Doron | All from one, one for all: on model checking using representatives[END_REF][START_REF] Parosh | Source sets: A foundation for optimal dynamic partial order reduction[END_REF], mais son transfert à des systèmes temporisés reste un défi [BJLY98, ix x DGKK98, HLL + 14].

Cette thèse vise à développer les fondements des méthodes d'ordre partiel pour les réseaux d'automates temporisés, afin d'obtenir des solutions algorithmiques évolutives et des outils pour leur vérification. Nous considérons la sémantique temporelle locale [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] pour les réseaux d'automates temporisés et travaillons avec le graphe de zones locales, le graphe de zones dans cette sémantique. L'obstacle majeur lorsque l'on travaille avec des graphes de zones locales est qu'ils sont infinis en général. Nous proposons des techniques pour obtenir des troncatures finies de ces graphes de zones locales. Grâce à ces techniques, nous sommes en mesure de développer un cadre qui permet l'application de techniques d'ordre partiel à l'exploration du graphe de zone local de ces réseaux. Nous identifions ensuite certaines classes de réseaux d'automates temporisés et proposons un algorithme de réduction d'ordre partiel pour les réseaux appartenant à ces classes. Nous fournissons également une évaluation d'un prototype de l'algorithme de réduction d'ordre partiel sur quelques exemples en utilisant l'outil TChecker [START_REF] Herbreteau | [END_REF].

Problème d'accessibilité pour les automates temporisés

Nos principaux objets d'intérêt sont les réseaux d'automates temporisés. Un automate temporisé [START_REF] Alur | Automata for modeling real-time systems[END_REF][START_REF] Alur | A theory of timed automata[END_REF] est un automate fini dont les états sont équipés d'un ensemble de variables non négatives à valeurs réelles appelées horloges. Les horloges sont initialement fixées à zéro et augmentent à la même vitesse. Les transitions de l'automate sont associées à une conjonction de contraintes d'horloge, appelées gardes, où chaque clause de la conjonction implique la comparaison d'une horloge avec un nombre naturel. D'un point de vue opérationnel, cela signifie que la transition ne peut être prise que si les valeurs des horloges satisfont la garde associée à la transition. De plus, certaines horloges peuvent être remises à zéro lors de la prise d'une transition. De plus, un automate temporisé possède également un état initial et un ensemble d'états acceptants. Le comportement erroné du système est modélisé comme l'atteinte d'un état acceptant de l'automate temporisé. Le problème d'accessibilité d'un automate temporisé demande s'il existe une exécution de l'automate d'un état initial à un état acceptant. Par conséquent, vérifier si le système a une exécution erronée se traduit par le problème d'accessibilité de l'automate temporisé qui modélise le système. Les algorithmes de vérification pour les automates temporisés ont été largement étudiés et sont à la base de nombreux outils de vérification tels que TChecker [START_REF] Herbreteau | [END_REF], UPPAAL [LPY97, BDL + 06], KRONOS [BDM + 98], HYTECH [START_REF] Henzinger | HYTECH: A model checker for hybrid systems[END_REF], LTSmin [KLM + 15], CMC [START_REF] Laroussinie | CMC: A tool for compositional model-checking of real-time systems[END_REF], PAT [START_REF] Sun | PAT: Towards flexible verification under fairness[END_REF] and Theta [THV + 17].

L'un des principaux défis rencontrés dans l'étude du problème de l'acces-sibilité provient du fait que l'espace des valuations d'un automate temporisé est de taille infinie indénombrable. L'approche standard pour vérifier l'accessibilité des automates temporisés est basée sur l'exploration d'un graphe dirigé appelé graphe de zone de l'automate temporisé [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF] dont les noeuds sont des paires (état, zone) constituées d'un état de l'automate et d'une zone [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF]. Une zone est un ensemble de valeurs qui être représentée efficacement en utilisant des contraintes de différence entre horloges. Il a été démontré [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF] qu'un automate temporisé A possède une exécution acceptante si et seulement s'il existe un chemin dans le graphe de zones de A vers un noeud avec un état acceptant. Ainsi, le problème d'accessibilité de l'automate temporisé se résume maintenant à la recherche d'un noeud avec un état acceptant dans le graphe de zone de A. Cependant, cette approche comporte un piège : le graphe de zones peut être infini et, par conséquent, un algorithme explorant le graphe de zones peut ne pas terminer. Diverses techniques d'abstraction permettant de calculer des troncatures finies des graphes de zones, qui préservent les exécutions de l'automate, ont été étudiées [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF][START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF][START_REF] Frédéric Herbreteau | Better abstractions for timed automata[END_REF][START_REF] Gastin | Fast algorithms for handling diagonal constraints in timed automata[END_REF].

L'approche du graphe de zone fonctionne bien pour les réseaux d'automates temporisés contenant un petit nombre de composantes. Cependant, lorsque le nombre de composantes augmentent, nous sommes confrontés au problème de l'explosion de l'espace d'états. Nous soulignons que si l'explosion de l'espace d'état est déjà un défi pour les réseaux d'automates non temporisés, elle l'est encore plus pour les réseaux d'automates temporisés. Dans un réseau de processus (non temporisés), les différents entrelacements d'un même ensemble d'actions indépendantes conduisent au même état. Ce n'est pas le cas dans les graphes de zones des réseaux d'automates temporisés, car les informations de temporisation (telles que l'ordre de remise à zéro des horloges) sont stockées dans ces zones. En conséquence, pour un ensemble d'actions donné, chaque entrelacement conduit à un noeud potentiellement différent du graphe de zones. Par conséquent, l'algorithme d'exploration du graphe de zones ne s'adapte pas bien lorsque le nombre de composantes du réseau augmente.

Notre travail

Dans cette thèse, nous considérons le problème de l'explosion de l'espace d'états dû aux entrelacements dans les réseaux d'automates temporisés, et la thèse contribue aux fondements des méthodes d'ordre partiel pour ces réseaux. Dans notre travail, nous considérons la sémantique temporelle locale pour les réseaux d'automates temporisés, qui est une sémantique alternative pour ces réseaux introduite par Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF]. La sémantique temporelle locale est basée sur une idée nouvelle et élégante : faire progresser xii le temps dans chaque processus de manière indépendante, et synchroniser les temps locaux des processus lorsqu'ils doivent effectuer une action commune. Dans la sémantique standard, puisque l'écoulement du temps est toujours synchronisé entre tous les processus du réseau, il existe une notion de temps global. En revanche, dans la sémantique temporelle locale, chaque processus a sa propre horloge de référence qui suit son temps local. Nous travaillons avec des valuations locales, des zones locales et des graphes de zones locales, qui sont analogues aux valuations standard, aux zones standard et aux graphes de zones standard, respectivement. Dans le cadre de notre travail, nous proposons deux solutions différentes pour relever le défi de l'explosion de l'espace d'états pour les réseaux d'automates temporisés.

Sémantique temporelle locale et test d'accessibilité efficace pour les réseaux d'automates temporisés

Dans la première partie de la thèse, nous montrons quelques propriétés des graphes de zones locales. En utilisant ces propriétés, l'exploration du graphe de zones locales d'un réseau s'avère être une alternative plus attrayante que l'exploration du graphe de zones standard. Cependant, cette approche est entravée par l'absence d'un mécanisme permettant de garantir la finitude du graphe de zones locales. Cela crée le besoin d'une technique d'abstraction (similaire aux techniques d'abstraction pour les zones standard) pour les zones locales afin de rendre le graphe des zones locales fini.

Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] et Minea [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] ont proposé des techniques d'abstraction pour les zones locales. Nous montrons que chacune des solutions proposées présente certains défauts qui limitent leur applicabilité. Ainsi, il n'existait pas de moyen efficace d'utiliser la sémantique temporelle locale. Nous résolvons ce problème en introduisant une abstraction pour les zones locales, appelée sync-subsumption. Grâce à cette abstraction, nous sommes en mesure de calculer un système de transition fini appelé le graphe local sync qui est en général plus petit que le graphe de zone standard qui est exploré dans l'algorithme d'accessibilité standard. Nous proposons un nouvel algorithme d'accessibilité pour les réseaux d'automates temporisés qui est basé sur l'exploration du "graphe local sync" du réseau. Nous présentons également les résultats expérimentaux de l'application de l'algorithme à quelques exemples en utilisant un prototype implémenté dans l'outil TChecker [START_REF] Herbreteau | [END_REF]. Notre algorithme est étonnamment performant sur certains exemples, et sur aucun exemple, il n'est pire que l'algorithme standard utilisant le graphe de zone.

Fondements de la réduction de l'ordre partiel pour les réseaux d'automates temporisés

Dans la deuxième partie de cette thèse, nous proposons un algorithme de réduction d'ordre partiel pour le problème d'accessibilité d'une sous-classe de xiii réseaux d'automates temporisés. Nous discutons d'abord l'application d'une méthode existante de réduction d'ordre partiel au "graphe local sync" et expliquons pourquoi cela n'est pas correct. Par conséquent, si nous voulons appliquer la réduction de l'ordre partiel à l'exploration des graphes de zones locales des réseaux d'automates temporisés, nous avons besoin d'une autre version finie des graphes de zones locales qui répondent aux exigences de la réduction de l'ordre partiel.

À cette fin, nous proposons une nouvelle abstraction pour les zones locales, nommée a * M , qui est basée sur une relation de simulation pour les valeurs locales. En appliquant l'abstraction a * M aux graphes de zones locales, nous obtenons un graphe qui se prête à une réduction d'ordre partielle. Cependant, nous montrons que l'abstraction a * M n'est pas finie en général. Nous observons que la difficulté critique pour obtenir des abstractions finies de graphes de zones locales réside dans la divergence arbitraire entre les horloges de référence de différents processus. Garder la trace des différences arbitrairement grandes entre les horloges de référence constituent une difficulté majeure inhérente au travail avec des zones locales. Pour préciser cette idée, nous introduisons le concept de spread d'une valuation, qui est défini comme la différence maximale entre deux horloges de référence dans la valuation. Nous limiterons notre attention à une sous-classe de réseaux d'automates temporisés, que nous appellerons les systèmes à désynchronisation bornée, c'est-à-dire les réseaux pour lesquels, étant donné toute séquence d'actions réalisable dans son graphe local, il est possible de trouver une exécution où la différence entre les horloges de référence est bornée à tout moment. Nous proposons également quelques conditions pour vérifier si un réseau d'automates temporisés est à désynchronisation bornée.

Nous considérons une abstraction modifiée, nommée a D M , et qui correspond à l'abstraction a * M paramétrée par une constante D. Nous montrons que si un réseau est à désynchronisation bornée par une borne D, l'application de l'abstraction a D M tout en explorant le graphe de zone locale produit un graphe fini qui est correct pour l'accessibilité, et qui se prête à une réduction d'ordre partielle.

Nous identifions ensuite deux classes de réseaux d'automates temporisés, que nous appelons respectivement systèmes global-local et systèmes clientserveur, et nous proposons des procédures spécialisées de réduction d'ordre partiel pour les réseaux à limites étendues appartenant à ces catégories. Enfin, nous fournissons une évaluation d'un prototype sur quelques exemples en utilisant l'outil TChecker [START_REF] Herbreteau | [END_REF].

Chapter 1

Introduction

Cyber-physical systems are used extensively in various fields such as automotive industries, healthcare, avionics, and manufacturing. From industrial controllers to pacemakers and autonomous automobile systems, they are ubiquitous in today's society and have central roles in assisting and improving various aspects of our daily life.

Cyber-physical systems are usually associated with some constraints, and the requirements to satisfy these constraints are often very strict. In many cases, the restrictions on the behaviour of these systems are expressed in terms of time constraints. In other words, these systems may be expected to perform actions respecting certain time deadlines. Consider the example of a pacemaker. A pacemaker monitors the timing signals that it receives from sensors planted in the heart. If the pacemaker detects a timing pattern symptomatic of arrhythmia at any point of time, it is expected to generate electrical impulses. These signals are to be delivered by electrodes to the heart muscles, which causes them to contract and thereby pump blood. It is crucial that whenever a bad pattern in signals is detected, the pacemaker acts on it within a specified time window. Even a remote chance of erroneous behaviour or malfunctioning incurs a loss of human life and property. Therefore, it is vital to have some mechanism to ensure the correct behaviour of these systems at all times, so much so that this is tantamount to ensuring the smooth functioning of our society.

Formal verification is a research area that attempts to ensure the correct behaviour of systems by providing automated algorithmic solutions. Specifically, cyber-physical systems are modelled using abstract mathematical objects and algorithms are designed to verify that the behaviour of such systems is as desired. Timed automata are a convenient formalism used in situations where the systems we want to model have associated temporal constraints. It is often more natural to model these systems as a network of timed automata that operate concurrently and synchronize on joint actions.

State-space explosion is a significant challenge in designing verification 1 algorithms for complex systems modelled by networks containing a large number of components. In fact, in practice, a lot of popular cyber-physical systems are modelled using large networks. Hence, the scalability of algorithmic solutions is as critical as their correctness and efficiency. Partial order reduction refers to a family of techniques employed to address the issue of state-space explosion by reducing the state space to be searched by a verification algorithm. Its application to networks of untimed systems is well studied [START_REF] Valmari | Stubborn sets for reduced state space generation[END_REF][START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF][START_REF] Doron | All from one, one for all: on model checking using representatives[END_REF][START_REF] Parosh | Source sets: A foundation for optimal dynamic partial order reduction[END_REF], but their transfer to timed setting [BJLY98, DGKK98, HLL + 14] remains a challenge.

The partial order techniques crucially depend on an effective way to compute the independence relation between actions. While this is relatively easy to compute for untimed systems, in timed systems, since there is always an implicit synchronization between the components of the network because of time, it is not easy to compute the independence relation between actions of networks of timed automata. This constitutes the principal difficulty in extending partial order reduction techniques to networks of timed automata.

This thesis aims to develop foundations for partial order methods for networks of timed automata, so as to obtain scalable algorithmic solutions and tools for their verification. We consider the local time semantics [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] for networks of timed automata and work with the local zone graph, the zone graph in this semantics. The major obstacle while working with local zone graphs is that they are infinite in general. We propose techniques to obtain finite truncations of these local zone graphs. Thanks to these techniques, we are able to develop a framework that allows the application of partial order techniques to the exploration of the local zone graph of these networks. We then identify some classes of networks of timed automata and propose a partial order reduction algorithm for networks belonging to these classes. We also provide an evaluation of a prototype of the partial order reduction algorithm on some examples using the tool TChecker [START_REF] Herbreteau | [END_REF].

Reachability problem for timed automata

The primary objects of our interest are networks of timed automata. A timed automaton [AD90, AD94] is a finite state automaton equipped with a set of non-negative real-valued variables called clocks. The clocks are initially set to zero and increase at the same rate. The transitions of the automaton are associated with a conjunction of clock constraints, referred to as guards, where each clause in the conjunction involves the comparison of a clock with a natural number. Operationally, this means that the transition can be taken only if the value of the clocks satisfies the guard associated with the transition. In addition, some clocks can be reset (i.e., their values can be set to 0) on taking a transition. Moreover, a timed automaton also has an The clock variables allow us to measure the timing information associated to executions of the timed automaton and restrict and control its behaviour. For instance, we can measure the time elapsed between the execution of two transitions, or enforce that a transition is executed only after a specified amount of time.

A fundamental problem arising in the study of timed automata is the reachability problem. The reachability problem for a timed automaton asks if there exists a run of the automaton from an initial state to an accepting state. As mentioned earlier, timed automata are used to model cyberphysical systems. The erroneous behaviour of such a system can be modelled as reaching a special "bad" state of the timed automaton modelling it. Therefore, checking whether the system has an erroneous execution translates to checking the reachability of the timed automaton. Verification algorithms for timed automata have been widely studied and are the basis for a number of verification tools such as TChecker [START_REF] Herbreteau | [END_REF], UPPAAL [LPY97, BDL + 06], KRONOS [BDM + 98], HYTECH [START_REF] Henzinger | HYTECH: A model checker for hybrid systems[END_REF], LTSmin [KLM + 15], CMC [START_REF] Laroussinie | CMC: A tool for compositional model-checking of real-time systems[END_REF], PAT [START_REF] Sun | PAT: Towards flexible verification under fairness[END_REF] and Theta [THV + 17].

One of the main challenges encountered in the study of the reachability problem stems from the fact that the space of valuations of a timed automaton is uncountably infinite. Recall that a timed automaton is a deterministic finite state automaton (DFA) whose transitions are associated with guards involving clock variables. For any fixed sequence of transitions in the underlying DFA, we have uncountably many executions of the timed automaton, where each execution differs from the other in the assignment to the clock variables (valuations) in at least one of the steps of the execution. We illustrate this in Figure 1.2, where we show some runs of the timed automaton from Figure 1

• • • • • • • • • • • • • • • Figure 1
.2: Uncountably infinite space of executions of the timed automaton A. δ = 2 in an execution denotes a time elapse of 2 time units in the respective state, after which a transition is taken. Observe that the state r is associated with an uncountably infinite set of valuations. As a consequence, we have an uncountably infinite set of executions of A.

To tackle this problem, we first need a way to handle this uncountably infinite set of valuations effectively. The standard approach to overcome this involves using a symbolic representation to analyse timed automata.

One of the earliest solutions to deal with the uncountably infinite set of valuations was proposed by Alur and Dill, presented in [START_REF] Alur | A theory of timed automata[END_REF]. Their idea is to partition the set of valuations into a finite number of sets, called regions. Regions are essentially sets of valuations that are indistinguishable by any timed automaton. This means that if a run is feasible from a valuation in a region, then it is also feasible from any valuation in the region. Equipped with this notion of regions, Alur and Dill propose a transition system called the region graph of the timed automaton. Exploring the region graph of a timed automaton is a valid way to solve the reachability problem; however, in practice, it turns out that the region graphs are too large to be of use for efficiently checking the reachability of timed automata.

The most widely used approach for checking reachability in timed automata is based on the notion of zones [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF], which are sets of valuations that can be represented efficiently using difference constraints between clocks. Consider a timed automaton A with initial state q 0 and initial valuation v 0 . If we consider the execution of a specific sequence of transitions from (q 0 , v 0 ), we end up with a state whose associated set of valuations is uncountably infinite. It turns out that for any sequence of transitions, this set of valuations can be expressed as a zone. In particular, we can associate a state and a zone to each sequence of transitions. This idea is used to construct a zone graph of the timed automaton [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF] whose nodes are (state, zone) pairs consisting of a state of the automaton and a zone representing a set of clock valuations [START_REF] David | Timing assumptions and verification of finite-state concurrent systems[END_REF]. Figure 1.3 gives a timed automaton and its zone graph. It was also shown [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF] that a timed automaton A has an accepting run if and only if there is a path in the zone graph of A to a node with an accepting state. Thus, the reachability problem of the timed automaton now amounts to a search for a node with an accepting state in the zone graph. However, this approach has a catch -the zone graph could be infinite, and therefore, an algorithm exploring the zone graph might not terminate. Various sound and complete abstraction techniques that allow us to compute finite truncations of zone graphs have been widely studied, and this area still witnesses active research [START_REF] Daws | Model checking of realtime reachability properties using abstractions[END_REF][START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF][START_REF] Frédéric Herbreteau | Better abstractions for timed automata[END_REF][START_REF] Gastin | Fast algorithms for handling diagonal constraints in timed automata[END_REF]. One way to get an abstraction is to make use of a subsumption relation on zones. Roughly, what this means is that if a zone Z is subsumed by another zone Z , then every sequence of actions that is feasible from (q, Z) is also feasible from (q, Z ). Hence, an algorithm exploring the zone graph does not need to explore paths from (q, Z), and only needs to explore from (q, Z ). Termination is guaranteed if the subsumption relation induces a finite number of maximal zones.

The zone graph approach works well for networks of timed automata containing a small number of components. However, as the number of participating components increases, we are faced with the problem of statespace explosion, which we discuss next.

State-space explosion

State-space explosion refers to the exponential growth in the size of the transition system describing the semantics of a network of processes due to multiple interleavings of the same set of transitions. We will now illustrate this phenomenon with the help of an example. Consider a network of n processes, each having k states. The size of the resultant product automaton grows exponentially with respect to n. In particular, if the network is such that there are no synchronizations between the participating components, then the resultant product automaton has k n states. Further, if we consider a sequence of n actions, each belonging to a different process, then there are n! different interleavings of this sequence, one per each possible ordering of these actions. We give an example of a network of three (untimed) processes and its product automaton in Figure 1.4. Note that 3! paths go from the initial state (p 0 , q 0 , r 0 ) to the state (p 1 , q 1 , r 1 ). These paths correspond to the transitions a 1 , b 1 and c 1 executed in different orders.

A1 A2 A3 p 0 p 1 p 2 q 0 q 1 q 2 r 0 r 1 r 2 a1 b1 d d c1 d
p 0 , q 0 , r 0 p 1 , q 0 , r 0 p 0 , q 1 , r 0 p 0 , q 0 , r 1 p 1 , q 1 , r 0 p 0 , q 1 , r 1 p 1 , q 0 , r 1 p 1 , q 1 , r 1 p 2 , q 2 , r 2 In the product automaton of a network of (untimed) processes, different interleavings of the same sequence lead to the same state. Unfortunately, this is not the case in zone graphs of networks of timed automata as timing information (such as the order of reset of clocks) is stored in these zones.

Consider a simple network of timed automata as given in Figure 1.5. Variables x, y are clocks, and {x} denotes the reset of clock x. As mentioned earlier, the zone graph maintains the resultant (state, zone) pairs for each sequence of transitions. Hence, the zone reached after executing the sequence ab contains configurations where x is reset before y, while the zone reached on executing ba contains configurations where y is reset before x. This implies that the valuations of the former zone satisfy the constraint x ≤ y, while the valuations of the latter zone satisfy the constraint y ≤ x. Thus, the sequences ab and ba lead to different zones. Note that in an untimed version of this network, we would have only one instance of the state (p 1 , q 1 ) in the product automaton. On the other hand, in the zone graph, we have two nodes with the state (p 1 , q 1 ), one per each possible ordering of clocks {x, y}. This indicates that the problem of state-space explosion is much more severe for networks of timed automata. The number of different interleavings of Partial order reduction has also been implemented in the model checking tool SPIN [START_REF] Godefroid | Partial-Order Methods for the Verification of Concurrent Systems -An Approach to the State-Explosion Problem[END_REF][START_REF] Holzmann | An improvement in formal verification[END_REF].

The general principle of partial order reduction techniques is the following: classify executions of a system into equivalence classes and explore only one representative from each equivalence class. Specifically, two executions that are interleavings of concurrent independent transitions are deemed to belong to the same equivalence class. This idea of grouping runs into equivalence classes on the basis of commuting pairs of adjacent independent transitions has its roots in the work of Mazurkiewicz [START_REF] Mazurkiewicz | Trace theory[END_REF].

Consider the network of untimed automata given in Figure 1.4. Observe that if we are only interested in the reachability of the tuple (p 2 , q 2 , r 2 ), we do not need to explore the complete product transition system. In this regard, all paths from (p 0 , q 0 , r 0 ) to (p 2 , q 2 , r 2 ) are equivalent. So, it is sufficient to explore a smaller transition system, referred to as a reduced transition system. The part of the transition system A N given by the red edges in Figure 1.4 is an example of a reduced transition system.

Next, we discuss how such a reduced transition system can be constructed. From the example in Figure 1.4, we can see that we are avoiding the exploration of multiple interleavings of actions a 1 , b 1 and c 1 , as all the interleavings lead to the same state -in other words, the order in which they are executed is irrelevant. We need to identify sets of actions such that the order of execution of these actions is irrelevant. We now formalize this notion. Given a transition system T , we say that an action a is enabled from a state s in T , if there exists a transition s a -→ s in T . We say that two actions a and b are independent in a state s of T [KP92], if they satisfy the following conditions:

Forward diamond property If a and b are enabled from s, and s a -→ s 1 and s b -→ s 2 are the respective transitions from s, then b is enabled from s 1 and a is enabled from s 2 .

Diamond property If either ab or ba is feasible from s, then both ab and ba are feasible from s and moreover, both ab and ba result in the same state. The diamond property is pictorially represented by the diamond structure given in Figure 1.6.

We say that two actions a and b are independent, if they are independent in each state s of T . From the definition above, we can see that if two actions a and b are independent in a state s, then both the sequences ab and ba are feasible from s, and both lead to the same state. As illustrated in Figure 1.6, if we are only interested in the reachability of state s , it is sufficient to explore only the action a from the state s. Since a and b are independent, it is guaranteed that b will be enabled from the state s 1 reached on the execution of a from s. Effectively, we are postponing the execution of the action b, as we are sure that it will be enabled later. Suppose that we have a method to check the independence of actions from a state. Then, from each state of the transition system, we can identify a subset of the set of enabled actions, such that it is sufficient to explore this set of actions. In other words, the requirement is that each action that is not explored is guaranteed to be enabled later. It is possible now to consider a reduced transition system that includes only those states that are reachable from the initial state via only those actions picked in the aforementioned subset of enabled actions from each state.

Clearly, this reduced transition system is sound, i.e., if there is an accepting run in the reduced transition system, then it is also a run in the original transition system. A crucial requirement is that this reduced transition system is also complete. In other words, if there is an accepting run in the original transition system, then there should also be an accepting run in the reduced transition system. One could easily compute such a reduced transition system after computing the full transition system and then looking at equivalent paths, but this defeats the whole purpose of partial order reduction. Consequently, the reduced transition system should be computed on the fly. An important condition here is that we must only use information, that is either readily available from a state or that we already know from the exploration of the system so far, to choose the subset of actions to be explored from that state.

To summarize, we want to compute a function that maps each state of the transition system to a subset of enabled actions such that • the resultant reduced transition system is complete.

• this function is computed on the fly, using only local information from each state.

Observe that the trivial function that returns the set of all enabled actions for each state produces a transition system that satisfies the requirements 1. Introduction above. However, there is no reduction in terms of state-space or the number of transitions in the reduced transition system, and therefore, this function is useless. Hence, it is imperative to require that the function maps a state to a small subset of enabled actions from that state; the smaller this set is, the better the reduction observed.

Our work

This thesis contributes to the foundations of partial order methods for networks of timed automata. In our work, we consider the local time semantics for networks of timed automata from [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] and work with local valuations, local zones, and local zone graphs. These are analogous to standard valuations, standard zones, and standard zone graphs, respectively. As a part of our work, we propose two different solutions to tackle the challenge of state-space explosion for networks of timed automata.

In the first part of the thesis, we show some properties of local zone graphs. By making use of these properties, the exploration of the local zone graph of a network turns out to be a more appealing alternative than the exploration of the standard zone graph. However, this approach is hampered by the absence of a mechanism to ensure the finiteness of the local zone graph. We solve this problem by introducing a subsumption relation for local zones, referred to as sync-subsumption. Thanks to this subsumption, we are able to compute a finite transition system called the local sync graph which is in general smaller than the zone graph that is explored in the standard reachability algorithm. We propose a new reachability algorithm for networks of timed automata that is based on the exploration of the local sync graph of the network. We also present the experimental results of applying the algorithm to some examples using a prototype implemented in the tool TChecker [START_REF] Herbreteau | [END_REF]. This results of this part of the thesis appear in the paper [START_REF] Govind | Revisiting local time semantics for networks of timed automata[END_REF].

The natural next step to further optimize the aforementioned algorithm is to apply a partial order reduction method while exploring the local sync graph. Unfortunately, we do not have an effective procedure to compute the independence relation of actions in local sync graphs. Therefore, if we are to apply partial order reduction to the exploration of local zone graphs of networks of timed automata, we need an alternate finite version of local zone graphs, for which we have an effective procedure to compute the independence relation.

To this end, we propose a new abstraction for local zones, a D M abstraction, that is based on a simulation relation for local valuations. We also introduce the notion of spread of a network of timed automata and specify when a network of timed automata is spread-bounded. We show that if a network is spread-bounded (with a bound D), applying the a D M abstraction while exploring the local zone graph yields a finite transition system, called LZG D M , that is sound and complete with respect to reachability. Moreover, we show that it is easy to compute an approximation of the independence relation between the actions of the LZG D M of a network of spread D. We then identify two classes of networks of timed automata, which we refer to as global-local systems and client-server systems respectively, and propose specialized partial order reduction procedures for spread-bounded networks belonging to these categories. Finally, we provide an evaluation of a prototype on some examples using the tool TChecker [START_REF] Herbreteau | [END_REF].

Local time semantics and efficient reachability testing for networks of timed automata

For applying partial order reduction to a network of processes, it is crucial to have an effective way to compute the independence relation (see conditions given in page 8) between the actions of the network. For networks of untimed processes, independence of actions can be tested using a simple syntactic check: if two actions of the network have no common process participating in them, then they are independent. We refer to the set of processes participating in an action as the domain of the action. Further, we say that two actions have disjoint domains if they have no common process participating in them. Then, the check boils down to the following: if two actions have disjoint domains, then they are independent. Additionally, we say that two sequences of actions are equivalent if one can be obtained from the other by permuting adjacent actions with disjoint domains.

Observe that in the standard semantics for networks of timed automata, two actions having disjoint domains do not necessarily satisfy the conditions for independence. Consider the example of a network with two processes, as shown in Figure 1.7. In the network of timed automata A, although a and b are actions local to their respective processes, there is an intrinsic dependence between the two processes, which arises due to implicit constraints imposed by time. Observe that network A can execute the sequence ab (sequence ab is feasible), while the sequence ba is not feasible. We do not know of any effective way to compute independence between actions in the standard semantics of networks of timed automata. There have been some attempts to come up with effectively checkable sufficient conditions for independence between actions in the standard semantics for networks of timed automata [DGKK98, HLL + 14]. The global nature of time elapse in a network of timed automata induces implicit dependencies between actions of different processes. This seems to be the major obstacle to getting effectively checkable conditions for independence between actions in networks of timed automata.

Local time semantics is an alternate semantics for networks of timed automata that addresses this very problem. Introduced by Bengtsson et

p 0 p 1 p 2 q 0 q 1 q 2 A 1 A 2 A = A 1 × A 2 a x ≤ 1 c b y ≥ 2 c (p0, q0) x = 0, y = 0 (p1, q0) x = 0, y = 0 (p0, q1) x = 2, y = 2 (p1, q1) x = 2, y = 2 (p2, q2) x = 2, y = 2 δ = 0 a δ = 2 b δ = 2 b c x ≤ 1 a X Figure 1
.7: A network of timed automata and some runs in the standard semantics al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF], local time semantics is based on a novel and elegant idea: make time in each process progress independently, and synchronize local times of processes when they need to perform a common action. In the standard semantics, since time elapse is always synchronized across all processes of the network, there is a notion of global time. In contrast, in local time semantics, each process has its own reference clock that tracks its local time. Thus, for each process, we have a variable t p which tracks the local time of the process: essentially t p is a clock that is never reset. In local time semantics, instead of working with standard clocks, we work with an offset representation of clocks. For each clock x, we consider an offset variable x that stores the time-stamp at which x was last reset.

Observe that in the network from Figure 1.5, depending on the local time in processes A 1 and A 2 , the sequence ab may result, on a global time scale, in a occurring before b, as well as b occurring before a. As a result, the set of valuations reached after the local run ab does not remember the order in which a and b occurred. Thus, sequences ab and ba lead to the same set of configurations: those obtained after doing a and b concurrently, as shown in Figure 1.8. It turns out that in local time semantics, two actions with disjoint domains satisfy the conditions for independence between actions (see conditions given in page 8). Further, we show that the local time semantics and the standard semantics are equivalent if we consider reachability with local valuations in which all the reference clocks are equal, referred to as

p 0 p 1 p 2 q 0 q 1 q 2 A 1 A 2 A = A 1 × A 2 a x ≤ 1 c b y ≥ 2 c (p0, q0) t1 = 0, x = 0 t2 = 0, y = 0 (p1, q0) t1 = 1, x = 0 t2 = 0, y = 0 (p0, q1) t1 = 0, x = 0 t2 = 2, y = 0 (p1, q1) t1 = 1, x = 0 t2 = 2, y = 0 (p1, q1) t1 = 2, x = 0 t2 = 2, y = 0 (p1, q1) t1 = 2, x = 0 t2 = 2, y = 0 δ1 = 1 a δ2 = 2 b δ2 = 2 b δ1 = 1 a δ1 = 1 c Figure 1
.8: Runs in local time semantics. Here, x and y represent the offset clock variables corresponding to clocks x and y, respectively. The variables t 1 and t 2 denote the reference clocks of processes A 1 and A 2 , respectively. synchronized valuations. In other words, there is a run in the local time semantics to a state with a synchronized valuation if and only if there is a run in the global semantics to this state. Together, these facts make local time semantics a more apt setting to apply partial order reduction than the standard semantics. Analogous to standard zones and zone graphs, in the setting of local time semantics, we have the notions of local zones and local zone graphs, whose nodes are pairs of the form (state, local zone). In local zone graphs, two actions with disjoint domains satisfy the conditions for independence between actions (see conditions given in page 8). We remark that two actions with disjoint domains satisfy only the diamond property and not the forward diamond property (see conditions given in page 8). Thus, we have a relaxed version of the condition for independence, which we show is still sufficient for applying partial order reduction. Further, it can be shown that the local zone graph of a network is sound and complete with respect to reachability. This means that instead of exploring the standard zone graph (which is the procedure used in the standard test for reachability) one could explore the local zone graph. Moreover, it can be shown that the local zone graph has the following very useful property: if a sequence of actions σ from a node (q, Z) of the local zone graph reaches the node (q , Z ), then all the sequences equivalent to σ are feasible from (q, Z); furthermore, they all lead to the same node (q , Z ).

Equivalent sequences of actions in a network of timed automata behave quite differently in the standard zone graph and the local zone graph, as shown in Figure 1.9. Recall that two sequences of actions are equivalent if one can be obtained from the other by permuting adjacent actions with disjoint domains. Let σ be a sequence of actions from the initial node (q 0 , Z 0 ) of the standard zone graph. Let {σ 1 , σ 2 , • • • , σ l } be the set of all sequences equivalent to σ. Observe that not all of these sequences are feasible in the standard zone graph; for instance, in Figure 1.9, the sequences σ 2 and σ l-2 are not feasible in the standard zone graph. Even if they are feasible, these sequences lead to potentially different nodes in the standard zone graph. On the contrary, in the local zone graph, all the sequences equivalent to σ are feasible from (q 0 , Z 0 ) and they all lead to the same node.

This ensures that if a sequence of actions σ is feasible in the local zone graph of a network, then all execution sequences equivalent to σ are also feasible. Local zone graphs are therefore ideal for handling interleavings.

Further, we show that this observation ties in neatly with a surprising property for standard zone graphs shown by Salah et al. [START_REF] Ben Salah | On interleaving in timed automata[END_REF]: for any sequence of actions σ, the union of zones reached by the interleavings of σ is also a zone. For instance, in Figure 1.9, l i=1 Z i is a zone. We refer to this zone as the aggregated zone of the sequence σ. Salah et al. [START_REF] Ben Salah | On interleaving in timed automata[END_REF] argue that for a given sequence, one can write a zone-like constraint defining all the runs of the interleavings of the sequence. Then the aggregated zone is obtained

(q0, Z0) (q, Z1) (q, Z3) (q, Zl-1) (q, Zl) σ1 σ2 X σ3 σl-2 X σl-1 σl • • • Standard zone graph (q0, Z0) (q, Z) σ1 σ2 σ3 σl-2 σl-1 σl • • • sync(Z)
Local zone graph Figure 1.9: Comparison of behaviour of equivalent sequences in the standard zone graph and the local zone graph simply by projecting this big constraint on relevant components. Salah et al. use this observation in an algorithm where, when all the interleavings of a sequence σ have been explored, the resulting zones are aggregated to a single zone and further exploration is restricted to this aggregated zone.

We point out there are some obstacles in the approach by Salah et al. using aggregated zones to get efficient algorithms to check reachability. First, their approach requires one to work with sets of constraints whose size grows with the length of a sequence. This is both inefficient and limited to finite sequences. Secondly, this approach requires detecting from time to time whether aggregation can happen. Finally, another limitation of this approach is that it works only for acyclic automata.

We show that the aggregated zone of a sequence σ can be obtained by restricting the local zone Z reached on σ to synchronized valuations. We refer to the restriction of a local zone Z to only synchronized valuations as the synchronized zone of Z, denoted as sync(Z). Thus, we provide a way to automate this periodic detection of the completion of the exploration of all the interleavings of a sequence σ and the aggregation of the resulting zones. Therefore, an algorithm that answers the question of reachability by exploring the local zone graph appears to be a better solution.

However, we are faced with a major roadblock in this approach: local zone graphs are not finite in general, and therefore, an algorithm exploring a local zone graph may not terminate. This creates the need for an abstraction technique (similar to the abstraction techniques for standard zones) for local zones to make the local zone graph finite. Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] and Minea [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] have proposed abstraction techniques for local zones. We show that each of the proposed solutions has some flaws that restrict their applicability. In the paper that introduced local time semantics, Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] defined a subsumption relation between local zones but did not 1. Introduction provide an algorithm to compute it. This meant that there was no effective way to use local time semantics. Later Minea [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] proposed a widening operator on local zones to construct finite local zone graphs. We show that the solution in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] contains a bug, and it is not clear whether this approach can be fixed. In summary, up until now, there is no known way to compute finite local zone graphs.

We propose a new subsumption operator between local zones, referred to as sync-subsumption, denoted aLU sync , that ensures termination of exploration of the local zone graph. We show that given a local zone Z, sync(Z) can be expressed as a standard zone. In sync-subsumption, we consider the containment of local zones with respect to synchronized valuations. It allows us to define the local sync graph, which is the local zone graph reduced by applying the sync-subsumption operation. We show that the local sync graph can be used to answer the reachability problem for networks of timed automata. This gives a new reachability algorithm for networks of timed automata that works with local zones but uses abstractions over standard zones. Recall that given a local zone Z, sync(Z) can be expressed as a standard zone. Consequently, the abstractions used in our algorithm are, in fact, abstractions over standard zones. This allows us to take advantage of the numerous improvements to abstraction operators over standard zones, developed over the years [DT98, BBLP06, HSW12, GMS19].

Thus, computing the local zone graph gives a more direct and efficient algorithm than Salah et al. to compute aggregated zones. Moreover, our algorithm is not restricted to acyclic timed automata.

To summarize,

• We adopt the local time semantics introduced by Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] and develop a series of basic results about local valuations, local regions, and local zones.

• We point out a flaw in the abstraction procedure proposed by Minea [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] to get a finite local zone graph.

• We propose a new subsumption technique called sync-subsumption, denoted as aLU sync , to get a finite local zone graph. This gives a new reachability algorithm for networks of timed automata that works with local zones. To the best of our knowledge, this is the only reachability algorithm based on the exploration of the local zone graph. We observe that our new subsumption is much more aggressive than the standard a LU subsumption. Further, we show that this new way of computing the local zone graph gives a more direct and efficient algorithm than that of Salah et al. [START_REF] Ben Salah | On interleaving in timed automata[END_REF] to compute aggregated zones.

• We report on experiments performed with a prototype implementation of the algorithm. The algorithm performs surprisingly well on some examples, and on no example, it is worse than the standard zone graph algorithm.

1.4.2 Foundations for partial order reduction for networks of timed automata

In the second part of this thesis, we propose a partial order reduction algorithm for the reachability problem for networks of timed automata.

As already discussed in Section 1.3, developing partial order methods for networks of untimed systems is well studied and has proven quite successful in optimizing the running time and memory consumption of verification procedures for these systems. Despite this huge success, their extension to networks of timed systems has largely remained a challenge. Our first attempt to develop a partial order reduction algorithm for networks of timed automata involves applying an existing partial order reduction method to the algorithm based on the exploration of local zone graphs, which is introduced in the first part of the thesis. Recall that local zone graphs are not finite in general, and hence, we worked with local sync graphs, obtained by applying sync-subsumption to local zone graphs. However, we do not know how to compute the independence relation between the actions of a local sync graph. In particular, disjointness of domains, which was a sufficient condition for the independence of actions in local zone graphs, does not imply independence in local sync graphs. This seems to be a direct consequence of the sync-subsumption. Thus, there is no hope for applying partial order reduction to the exploration of the local sync graph. So, if we are to develop a partial order reduction procedure based on the exploration of local zone graphs, we need to first develop a different subsumption relation that renders a finite local zone graph for which the independence relation between actions is easy to compute.

We observe that the critical difficulty in obtaining finite abstractions of local zone graphs lies in the arbitrary divergence between reference clocks of different processes. Keeping track of arbitrarily large differences between reference clocks is a major inherent difficulty when working with local zones. To avoid this problem, we will restrict our attention to those networks for which, given any feasible sequence of actions in its local zone graph, it is possible to find a run where the difference between reference clocks is bounded at all times. To make this idea precise, we introduce the concept of spread of a valuation, which is defined as the maximum difference between two reference clocks in the valuation. We say that a run is D-spread-bounded if the spread of all valuations in the run are bounded by a non-negative integer D. A network is D-spread-bounded if every local run has an equivalent run that is D-spread-bounded. If a network is D-spread-bounded for some D, we say the network is spread-bounded. Equipped with this notion, we restrict our attention to spread-bounded networks. A large number of models in 1. Introduction examples in the literature are in fact spread-bounded, and hence, we focus on designing efficient verification procedures for these systems.

We show that when computing a covering relation between two nodes of the local zone graph of a D-spread-bounded network, it is sufficient to consider containment with respect to the behaviour of valuations of spread D. We define a subsumption relation for local zone graphs that does precisely this. Thanks to this subsumption, we can obtain a finite transition system, for which we show that disjointness of domains allows us to compute independence of actions. This sets the stage for applying partial order reduction to the exploration of the local zone graphs of such networks.

We now give a brief overview of our new subsumption relation and the resultant transition system. We first propose a simulation relation for valuations in the local time semantics. Based on this simulation relation, we define an abstraction operator a * M and a subsumption relation based on this abstraction that we refer to as a * M subsumption. We show that a * M subsumption is not finite in general. We consider a modified subsumption relation, which we refer to as a D M subsumption, that is parameterized by a constant D. Rather than checking if a local zone Z is a * M -subsumed by another local zone Z , we check if spread D (Z) is a * M -subsumed by spread D (Z ), where spread D (Z) is the set containing only the local valuations of spread D in Z. We denote this as Z D M Z . This is enough as for a D-spread-bounded network, we need to focus only on valuations of spread D. We refer to the transition system obtained by applying a D M subsumption to the local zone graph of a network as the LZG D M of the network. We prove that if a network is D-spread-bounded, then exploring the LZG D M of this network yields the correct answer for the reachability problem of the network. Essentially, the subsumption operation D M is a generalization of the aLU sync operation (see Definition 5.5). While the aLU sync operator compares only the synchronized valuations in two zones, the D M operator compares all valuations of spread at most D.

We show that actions with disjoint domains in the LZG D M of a D-spreadbounded network satisfies the diamond property (see conditions given in page 8). We remark that, just as in the case of LZG's, actions with disjoint domains do not satisfy the forward diamond property in LZG D M 's. We identify two classes of networks of timed automata, which we refer to as global-local systems and client-server systems. After giving some sufficient conditions for a network to have bounded spread, we propose two respective variants of the implementation -global-local POR and client-server POR. We remark that the global-local POR method is quite general in its applicability -it can be applied to any spread-bounded network, albeit with varying results depending on the nature of synchronizations. On the other hand, the client-server POR is focussed on networks where there is a centralized server process interacting with several client processes.

We also provide an evaluation of a prototype on some examples using the tool TChecker [START_REF] Herbreteau | [END_REF]. We first describe how our procedure works on some toy examples and then explain how we get gains for these systems. Further, we discuss the result of applying our procedure on some classical benchmarks for timed automata and discuss the performance on these models.

To summarize:

• We point out that we do not have an effective way to compute the independence relation between actions of a local sync graph. Consequently, we do not know how to apply partial order reduction directly on a local sync graph.

• This shows the need to develop a different subsumption relation for local zone graphs, one that renders a finite local zone graph that is amenable to partial order reduction. We define an alternate subsumption relation, denoted as a * M , that is based on a simulation relation between local valuations. However, a * M subsumption is not finite in general. • We introduce the notion of spread of a network of timed automata and give some sufficient conditions implying when a network is spreadbounded.

• We define a new subsumption relation, referred to as D M subsumption whose application to the local zone graph of a network results in a finite transition system called LZG D M of the network. We prove that if a network is D-spread-bounded, then exploring the LZG D M of this network yields the correct answer for the reachability problem.

• We identify two classes of networks of timed automata, which we refer to as global-local systems and client-server systems, and propose specialized partial order reduction algorithms based on the exploration of LZG D M , for spread-bounded networks belonging to these classes.

• We provide an evaluation of a prototype on some examples using the tool TChecker [START_REF] Herbreteau | [END_REF]. Our algorithm generates zone graphs that are an order of magnitude smaller than that produced by the standard reachability algorithm on some examples, while on some other examples, the size of the zone graph generated by our algorithm is larger than that of the standard zone graph. Here, we consider the number of nodes of the zone graph as a measure of the size of the zone graph.

Related work

In this section, we briefly overview work that is broadly focussed on alleviating the challenge posed by state-space explosion to the verification of concurrent 1. Introduction systems. We first discuss some of the landmarks in the development of partial order reduction techniques for networks of untimed systems. We then proceed to discuss some of the works that attempt to develop partial order reduction methods for concurrent timed systems.

State-space explosion

The challenge posed by state-space explosion to the verification of concurrent systems has been a subject of intensive research, and over the years, various solutions have been proposed to overcome this challenge (for an excellent survey, see [START_REF] Clarke | Model checking and the state explosion problem[END_REF]). AAJS17] and the development of foundations for partial order reductions for networks of timed automata is the central focus of this thesis. An alternate, but similar well-studied approach to combat state-space explosion is based on the idea of unfoldings [START_REF] Kenneth | Trace theoretic verification of asynchronous circuits using unfoldings[END_REF][START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF]. While the partial order reduction methods aim to explore only one representative from the set of all equivalent executions, the unfoldings based methods represent the set of all equivalent executions as a single partial order.

Partial order reduction for untimed systems

The study of developing partial order reduction methods for concurrent systems has been a topic of extensive research, and there is a large body of published studies devoted to the topic. Some of the widely used partial order reduction techniques are Stubborn sets by Valmari [START_REF] Valmari | A stubborn attack on state explosion[END_REF][START_REF] Valmari | Stubborn sets for reduced state space generation[END_REF], Ample sets by Peled [START_REF] Doron | All from one, one for all: on model checking using representatives[END_REF][START_REF] Doron | Combining partial order reductions with onthe-fly model-checking[END_REF], and Persistent sets by Godefroid [START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF][START_REF] Godefroid | Partial-Order Methods for the Verification of Concurrent Systems -An Approach to the State-Explosion Problem[END_REF]. These techniques, which were developed independently, are similar in spirit but differ in the actual choice of the subsets that are computed. They have been hugely successful in making the verification of concurrent systems more efficient.

The idea of dynamic partial order reduction was introduced by Flanagan et al. [START_REF] Flanagan | Dynamic partial-order reduction for model checking software[END_REF], where the independence relation between actions of the network is computed dynamically. This technique is observed to yield a greater reduction in state space than the static partial order reduction methods mentioned above. Sleep sets is an orthogonal approach introduced by Godefroid [God90] that focuses on reducing the number of transitions rather than the state space. Sleep sets can be used in conjunction with the ample/stubborn/persistent sets.

The development of partial order methods is still a very active area of research to this day, as evidenced by the recent development of source sets by Abdulla et al. [START_REF] Parosh | Source sets: A foundation for optimal dynamic partial order reduction[END_REF]. In their work, the authors present source sets as a basis for optimal dynamic partial order reduction.

Local time semantics and issues of finiteness

The work that constitutes the primary basis for our work is by Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF], in which the authors introduce ideas of local time semantics and local zone graphs. While the local zone graph has several useful properties related to the independence of actions, it was not clear how to compute a finite local zone graph.

To this end, Minea [START_REF] Minea | Partial Order Reduction for Verification of Timed Systems[END_REF][START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] proposed a subsumption operation on local zones and designed a partial order reduction algorithm using this operation. Unfortunately, as we already mentioned, we demonstrate that this subsumption operation has a flaw that is not evident to repair. As a consequence, the partial order reduction procedure proposed in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] is not sound. As discussed in Section 1.4.1, we propose an alternate subsumption relation for local zone graphs, that proceeds via computation of aggregated zones.

Recall that coming to the same state with different zones inflicts a considerable blowup in the zone graph, since the same paths are explored independently from each of these zones. This has also been observed in the context of multi-threaded program verification by Sousa et al. [START_REF] Sousa | Abstract interpretation with unfoldings[END_REF]. Solving this problem in the context of program analysis requires over-approximation of the aggregated state. Fortunately, in the context of timed automata, the result of aggregating these zones is still a zone, as observed by Salah et al. [START_REF] Ben Salah | On interleaving in timed automata[END_REF]. Our contribution towards efficient computation of aggregated zones is thus an important advance in timed automata verification.

Lugiez et al. [START_REF] Lugiez | A partial order semantics approach to the clock explosion problem of timed automata[END_REF] develop a partial-order semantics for networks of timed automata, which is similar in spirit to the local time semantics. However, the approach uses a different framework that is referred to as event zones. To obtain finiteness, an abstraction based on the maximal lower and upper bounds is employed. An exact correspondence between the work of 1. Introduction Lugiez et al. and our work on local zone graphs with sync-subsumption remains to be explored.

Partial order reduction for networks of timed automata

We have so far discussed works where the authors considered the local time semantics to obtain more commutativity between actions. Another approach to developing partial order reduction based procedures for timed systems involves detecting semi-commutations in the standard semantics. The idea of this approach can be summarized as follows: if a sequence of actions ab is guaranteed to produce a zone that is always contained in the zone produced by the sequence ba, then it is enough to explore only ba. Dams et al. [START_REF] Dams | Partial-order reduction techniques for real-time model checking[END_REF] propose heuristics that statically find some pairs of actions like this. Since these are quite rare, Hansen et al. [HLL + 14], have developed a kind of CEGAR algorithm for dynamically finding such pairs. They have obtained significant gains on some examples.

An alternative approach to decrease the effect of state-space explosion for networks of timed automata, based on unfoldings introduced by Bouyer et al. [START_REF] Bouyer | Timed unfoldings for networks of timed automata[END_REF] and Cassez et al. [START_REF] Cassez | Symbolic unfoldings for networks of timed automata[END_REF][START_REF] Chatain | Complete finite prefixes of symbolic unfoldings of safe time petri nets[END_REF][START_REF] Chatain | Back in time petri nets[END_REF]. In their works, the authors propose a verification algorithm that extends the unfolding based method to networks of timed automata. Here, they define a timed unfolding for a network of timed automata and propose an algorithm that computes a finite prefix of this timed unfolding. This finite prefix can be used to answer questions such as reachability for the network.

Partial order reduction procedures have also been proposed for other formalisms used to model real-time distributed systems, such as Time Petri Nets (TPN). Recently, in [BJL + 18], the authors have proposed an algorithm that applies stubborn set reduction to verification of timed-arc Petri nets with urgent behaviour.

Chapter 2

Preliminaries

In this chapter, we formally introduce the concepts, notations and definitions essential to understand this thesis. In the first part of this chapter, we introduce the notion of timed automata and discuss the standard approaches in the literature to solve the reachability problem for timed automata. In the latter part of this chapter, we introduce partial order reduction methods and discuss the basic principles of these techniques.

Timed automata

A clock is a variable that ranges over non-negative real numbers. We denote the set of clocks by X. Given a set of clocks X, let Φ(X) denote a set of clock constraints, where each clock constraint is a conjunction of comparisons of clocks with constants. Formally, Φ(X) is given by the grammar

φ := x ∼ c | φ ∧ φ
where x ∈ X, c ∈ N, and ∼ ∈ {<, ≤, =, ≥, >}. Definition 2.1 (Timed automaton [START_REF] Alur | A theory of timed automata[END_REF]). A timed automaton A is given by a tuple (Q, Σ, X, T, q 0 , F ), where Q is a finite set of states, X is the set of clocks, Σ is a finite alphabet of actions, q 0 ∈ Q is the initial state, F ⊆ Q is the set of accepting states and

T ⊆ Q × Σ × Φ(X) × 2 X × Q is a transition relation.
T contains transitions of the form (q, a, g, R, q ), where q is the source state, q is the target state, a is the action triggering the transition, R is the set of clocks that are reset on the transition, and g is a guard, i.e., a clock constraint that needs to be satisfied for the transition to execute.

Remark. We do not consider constraints of the form x -y ∼ c for guards in our timed automata. Constraints of the form x -y ∼ c are called diagonal constraints, and timed automata that allow diagonal constraints are typically harder to work with. It is known that diagonal constraints do not add any expressive power to timed automata and can be eliminated [START_REF] Alur | A theory of timed automata[END_REF][START_REF] Bérard | Characterization of the expressive power of silent transitions in timed automata[END_REF]. We now define some basic operations on valuations, namely, guard satisfaction, reset, and time elapse. We say that a valuation v satisfies a constraint φ, denoted v |= φ, when each constraint in φ is satisfied when the variable x in the constraint is replaced by v(x). Let R be a subset of the set of clocks X. We write [R]v to denote the operation of resetting clocks in R; in other words, [R]v is the valuation where clock x is 0 if x ∈ R, and it is v(x) otherwise.

We denote by v + δ the valuation obtained by increasing the value of all clocks from the valuation v by δ ∈ R ≥0 . It is the valuation obtained after a time elapse of δ time units from v. An example of a timed automaton is given in Figure 2.1. The timed automaton A has three states p, q and r and has two clocks, x and y. State p is the initial state, and r is the only accepting state of A. We can interpret the timing information associated with A as follows. The transition a from p to q has to be taken within 4 time units after the start of the run. Likewise, the transition b can only be taken 5 time units after the start. Note that the transition b resets the clock x. Since the next transition c has guard x ≤ 2, c has to be taken within 2 time units of taking the transition b. The next b must occur at least 5 time units after c, and so on.

Definition 2.3. The semantics of a timed automaton A as in Definition 2.1, is given by an infinite-state transition system TS(A). The nodes of TS(A) are of the form (q, v), where q is a state of A and v is a standard valuation of the clocks of A. There are two kinds of transitions:

• delay transitions: (q, v) δ - → (q, v + δ), • action transitions: (q, v) a -→ (q , v ), if (q, a, g, R, q ) ∈ T , v |= g and v = [R]v.
The transition relation → is a union of all delay and action transitions. The initial state of TS(A) is the node (q 0 , 0), where q 0 is the initial state and 0 is the valuation mapping all the clocks to 0. The accepting states are of the form (q, v), where q ∈ F and v is an arbitrary valuation.

Definition 2.4 (Run of a timed automaton). A run of a timed automaton is a sequence of transitions from the initial state of TS(A).

An example of a run of the timed automaton

A from Figure 2.1 is (p, x = 0, y = 0) δ=3 --→ a -→ (q, x = 3, y = 3) δ=2 --→ b - → (r, x = 0, y = 5) δ=2 --→ c - → (q, x = 2, y = 0) • • •
A run is accepting if the final state of the run is accepting.

We are interested in the reachability problem of a timed automaton, which is defined formally as follows.

Definition 2.5 (Reachability problem). The reachability problem for a timed automaton A is to decide if there is a run of A from an initial state to an accepting state.

As we already discussed in the introduction, in practice, a network of timed automata is often used rather than a single timed automaton. A network of timed automata is a set of timed automata operating concurrently.

Definition 2.6 (Network of timed automata). Let Σ 1 , . . . , Σ k be finite alphabets, not necessarily mutually disjoint. Let X 1 , . . . , X k be mutually disjoint sets of clocks (X i ∩ X j = ∅ for all pairs i = j). A network of timed automata is a tuple A 1 , . . . , A k , where each A i := (Q i , Σ i , X i , T i , q i 0 , F i ) is a timed automaton. The timed automata A 1 , . . . , A k are called processes. We write Proc to denote the set of all processes. Figure 2.2 gives an example of a network of timed automata that consists of two processes A 1 and A 2 .

Note that the set of actions Σ i of a network are not necessarily disjoint. Given an action a, if a ∈ Σ i , we say that A i participates in a. We make this notion precise by defining the domain of an action. Definition 2.7 (Domain of an action). We define the domain of an action a ∈ Σ, denoted as dom(a), as the set of timed processes participating in the action a. Formally, dom(a) = {i | a ∈ Σ i }.

For instance, in the network of timed automata given in Figure 2.2, we have dom(a) = {1}, dom(b) = {2} and dom(d) = {1, 2}.

Definition 2.8. A transition whose domain contains more than one element is called a synchronization transition. A synchronization action could have guards and resets in each participating component. If the guard of a synchronization transition in a component of the network is satisfied, we say that the transition is locally enabled in that component.

A1 A2 p 0 p 1 p 2 q 0 q 1 q 2 a x ≤ 3 b y ≥ 2 d x ≤ 5 d y ≥ 4 Figure 2.2: A network of timed automata
In the network given in Figure 2.2, observe that the action d is a synchronization transition. Given a standard valuation v, we see that d is locally enabled in A 1 if v(x) ≤ 5, and locally enabled in

A 2 if v(y) ≥ 4.
Next, we define the semantics of a network of timed automata.

Definition 2.9 (Semantics of a network of timed automata). The semantics of a network N := A 1 , . . . , A k is given by a timed automaton A N = (Q × , Σ × , X × , T × , q 0 × , F × ), where

• Q × = Q 1 × Q 2 × • • • × Q k • Σ × = i=k i=1 Σ i • X × = i=k i=1 X i • q 0 × = (q 0 1 , q 0 2 , . . . , q 0 k ) • F × = { (q 1 , q 2 , . . . , q k ) | q i ∈ F i for all i }
• there is a transition of the form (q 1 , q 2 , . . . , q k ) a,g --→ R (q 1 , q 2 , . . . , q k ) in

T × when -(q i , a, g i , R i , q i ) in T i for all i ∈ dom(a), g := i g i and R := i R i , -q i = q i for all i ∈ dom(a),
The semantics of N is the transition system TS(A N ) of the automaton A N . We denote it TS(N ) for short.

From the semantics of the network of timed automata, we can see that a synchronization transition can only be executed if it is locally enabled in all its participating components. Consider the network of timed automata given in Figure 2.2. Here, d can only be executed from a standard valuation v that satisfies v(x) ≤ 5 and v(y) ≥ 4. Observe that all the components participating in a synchronization action are affected by (a possible) change of state, whereas those which do not participate remain in their current states.

Offset valuations

As discussed in the introduction, in this thesis, we consider two different semantics for networks of timed automata -the standard semantics (which we call global semantics) and the local time semantics. We would like to maintain a uniform representation for valuations in both semantics. To this end, rather than using the standard valuations, we choose to represent valuations of clocks using their offsets from the total time elapsed by the timed automaton. We discuss the offset representation of valuations (in the global semantics, and in later sections, the local time semantics) in detail. Since the offset representation of valuations in global semantics is non-standard, we present a translation between valuations in the standard representation and the offset representation.

For each clock x ∈ X, we introduce an offset clock variable x, henceforth simply referred to as an offset clock. Let X = { x | x ∈ X} be the set of all offset clocks. The value of x is the time-stamp at which x was last reset. We also introduce a variable t that tracks the global time: technically, t is a clock that is never reset. We refer to this clock as the reference clock. The idea is that the value of clock x is encoded as the difference t -x. At the initial valuation, all the offset clocks and the reference clock have the same value. As time progresses, the offset clocks do not increase while the reference clock does, thereby increasing the difference between the reference clock and the offset clocks. Whenever a clock is reset, its offset clock is set to the value of the reference clock at the time of the reset.

Definition 2.10 (Offset valuations). An offset valuation v is a function

v : X ∪ {t} → R ≥0 such that v( x) ≤ v(t) for all offset clocks x ∈ X.
Observe that in the offset representation, each variable x ∈ X stores the time of last reset of x. Following this intuition, the time-stamp at which a clock is reset can never be greater than the total time elapsed, hence we have the constraint v( x) ≤ v(t), for all offset valuations v.

An initial offset valuation is any valuation in which all the offset clocks have the same value as the reference clock, i.e., v 0 (t) = v 0 ( x) for all offset clocks x ∈ X. Note that the actual value of the reference clock does not matter -what is important is that all the offset clocks and the reference clock have the same value.

Translations between offset and standard valuations

We introduce the operation std, which is a translation from offset valuations to standard valuations. Note that we use v to represent standard valuations, and v for offset valuations.

Definition 2.11 (std). For a given offset valuation v, we can obtain a standard valuation std(v):

std(v)(x) = v(t) -v( x),
for all x ∈ X.

Conversely, given a standard valuation v, there are many offset valuations corresponding to it. One such offset valuation can be obtained by the following transformation:

v(t) = max{v(x) : x ∈ X} v( z) =v(t) -v(z)
for all z ∈ X.

Note that this is just one of the many offset valuations v such that std(v) = v.

We illustrate this as follows: Let v be an offset valuation such that std(v) = v. Consider an offset valuation v such that v (t) = v(t) + δ, and v ( x) = v( x) + δ for all offset clocks x ∈ X. It is easy to see that std(v ) = v too.

Operations on offset valuations

As we have seen, to give a semantics of a timed automaton we need some operations on clock valuations, namely, delay, reset, and guard satisfaction operations. In this section we discuss these operations for offset valuations.

• Delay: An offset variable x stores the time-stamp at which the clock x was last reset. Following this intuition, a delay operation increases the value of the reference clock t and leaves the offset clocks unchanged. Formally, for δ ∈ R ≥0 , we denote by v + δ, the offset valuation defined by:

(v + δ)(t) = v(t) + δ (v + δ)( x) = v( x) for all x ∈ X
• Reset: Resetting the clocks in R ⊆ X, yields an offset valuation [R]v obtained by setting the value of clocks that are reset to the value of the reference clock:

([R]v)(t) = v(t) ([R]v)( x) = v(t) if x ∈ R, v ( x) otherwise
• Guard satisfaction: Given an offset valuation v and a clock constraint g, we say that v satisfies the guard g, written as v |= g, if the standard valuation std(v) from Definition 2.11 satisfies g.

We now state Lemma 2.1 that relates the operations on offset valuations to the operations on standard valuations.

Lemma 2.1. We have the following:

• If v |= g, then std(v) |= g. • If v = [R]v, then std(v ) = [R](std(v)). • If v = v + δ, then std(v ) = std(v) + δ for δ ∈ R ≥0 .
Proof. The first item follows from the definition of guard satisfaction for offset valuations.

For the second item, we know that v (t) = v(t), and v

( x) = v( x), if x ∈ R and v ( x) = v (t) otherwise. Let v = std(v) and v = std(v ). Then, we observe that if x ∈ R, v (x) = v (t)-v ( x) = v (t)-v (t) = 0. If x ∈ R, v (x) = v (t)-v ( x) = v(t) -v( x) = v(x). Thus, v = [R]v.
For the third item, we know that v (t) = v(t) + δ, and v

( x) = v( x) for all x ∈ R. Let v = std(v) and v = std(v ). Then, it follows that v (x) = v (t) -v ( x) = v(t) + δ -v( x) = (v(t) -v( x)) + δ = v(x) + δ. Thus, v = v + δ.
Standard approaches to solve the reachability problem. We now discuss some standard approaches to solving the reachability problem of timed automata. One of the main challenges associated with studying problems pertaining to timed automata stems from the fact that the space of valuations of the timed automata is uncountably infinite. To work with timed automata we first need a way to handle this uncountable set of valuations effectively. There have been numerous attempts at doing this using different techniques [START_REF] Bouyer | From Qualitative to Quantitative Analysis of Timed Systems[END_REF]. We discuss some of these approaches in the subsequent sections. The approaches we discuss employ the idea of using some symbolic representation to analyse these systems.

Regions

The earliest solution to deal with the uncountably infinite set of valuations was proposed by Alur et al. in [START_REF] Alur | A theory of timed automata[END_REF]. Their approach involved partitioning the set of valuations into a finite number of sets, called regions. In this section, we discuss their original approach and present a similar notion for the setting of offset valuations.

First, we present the definition of the classical region equivalence as stated in Alur et al. [START_REF] Alur | A theory of timed automata[END_REF]. We proceed to propose a region equivalence for offset valuations, which leads to the notion of offset regions. We then prove that there is a bijection between the region equivalence in the standard setting (as introduced in [START_REF] Alur | A theory of timed automata[END_REF]) and the region equivalence for offset valuations that we introduce here. Further, using this notion of regions, we introduce a transition system called the offset region graph of a timed automaton, which captures all the behaviours of the timed automaton. We show that the offset region graph gives us a way to solve the reachability problem, but this method turns out to be inefficient in practice.

For x ∈ R, we write x and {x} to denote the integral part and fractional part of x, respectively. In other words, x denotes the greatest integer smaller than or equal to x. For example, 7.3 = 7 and -2.1 = -3. The fractional part of x, written as {x} is defined as x -x . Thus, {7.3} = 0.3 and -2.1 = 0.9. Note that {x} ≥ 0 for all x ∈ R.

Region equivalence for standard valuations

Definition 2.12 (Neighbourhood of a standard valuation (nbd(v))). A standard valuation v is defined to be in the neighbourhood of v, written as v ∼ v, if for all clocks x, y ∈ X, we have:

• v(x) = v (x) ,
• {v(x)} = 0 iff {v (x)} = 0,

• {v(x)} ≤ {v(y)} iff {v (x)} ≤ {v (y)}.

We denote by nbd(v) the set of all standard valuations in the neighbourhood of v. Definition 2.13 (Classical region equivalence (∼ M )). Let M ∈ N ∪ {-∞} be a constant. For a standard valuation v, we define Bounded M (v) = {x ∈ X | v(x) ≤ M }. Two standard valuations are said to be region equivalent w.r.t. M , written as v ∼ M v if Given an automaton A, the bound M is obtained by choosing the maximum constant appearing in a guard of A. If there are no guards in A, then M is set to -∞.

• Bounded M (v) = Bounded M (v ),
Observe that the notions of region and neighbourhood are closely related. If all clocks are bounded (which corresponds to having M = ∞) then the region of a standard valuation is the same as its neighbourhood.

Definition 2.14 (Region). Let M ∈ N ∪ {-∞} be a constant. An M -region is an equivalence class of ∼ M . We simply say region instead of M -region, when M is clear from the context.

Alternate representation of regions

Given a constant M ∈ N ∪ {-∞}, each M -region can be uniquely identified by specifying the following information [AD94]:

1. for each x ∈ X, one constraint from the set:

{x = c | c = 0, • • • , M } ∪ {c -1 < x < c | c = 1, • • • , M } ∪ {x > M } 2.
for each pair of clocks x, y ∈ X which satisfy the constraints of the form c -1 < x < c and d -1 < y < d, whether {x} < {y}, {x} = {y} or {x} > {y}.

Counting all the possible combinations of the constraints, it can be shown [START_REF] Alur | A theory of timed automata[END_REF] that number of distinct M -regions is bounded by the function

|X|! • 2 |X| • Π x∈X (2M + 2).

Region equivalence for offset valuations

We now introduce the notions of neighborhood and region equivalence in the context of offset valuations.

Definition 2.15 (Neighbourhood of an offset valuation). For offset valuations v and v , we say v is in the neighbourhood of v , written as v ≈ v , if for all offset clocks x, y ∈ X ∪ {t}, we have v(x) -v(y) = v (x) -v (y) . The set of all offset valuations in the neighbourhood of v is denoted by nbd(v).

Definition 2.16 (Region equivalence for offset valuations (≡ M )). Let M ∈ N∪ {-∞} be a constant. For an offset valuation v, we define

Bounded M (v) = { x ∈ X | v(t) -v( x) ≤ M }. We write v ≡ M v if • Bounded M (v) = Bounded M (v ) • v B ≈ v B
where v B and v B denote the offset valuations restricted to the set of variables B = Bounded M (v).

Definition 2.17 (Offset region). Let M ∈ N ∪ {-∞} be a constant. An offset region is an equivalence class of ≡ M . We write [v] M for the offset region of v.

We will now show that the notion of regions in the standard setting and offset setting are closely connected. But first, we prove a few technical lemmas which will be useful to prove this result.

Lemma 2.2. For x ∈ R, {x} = 0 iff x = --x .

Proof. {x} = 0 ⇔ x = x . Similarly, we have {x} = 0 ⇔ -x = -x . Since we know that x = -(-x), we have {x}

= 0 ⇔ x = --x . Lemma 2.3. For x, y, z ∈ R, {z -x} ≤ {z -y} iff x -y = x -z + z - y + 1. Proof. x -y = x -z + z -y = x -z + z -y + {x -z} + {z -y} = x -z + z -y + 1 -{z -x} + {z -y}
This gives the statement of the lemma.

Lemma 2.4. Let v ≈ v . Then, for the reference clock t and offset clocks x, y ∈ X, we have

{v(t) -v( x)} ≤ {v(t) -v( y)} iff {v (t) -v ( x)} ≤ {v (t) -v ( y)}.
Proof. Consider two offset clocks x and y. From Lemma 2.3, we have the following conditions on v( x) -v( y) and v ( x) -v ( y):

v ( x) -v ( y) = v ( x) -v (t) + v (t) -v ( y) + 1 iff {v (t) -v ( x)} ≤ {v (t) -v ( y)} v( x) -v( y) = v( x) -v(t) + v(t) -v( y) + 1 iff {v(t) -v( x)} ≤ {v(t) -v( y)} Since v ≈ v , we know that v( x) -v( y) = v ( x) -v ( y) v ( x) -v (t) = v( x) -v(t) v (t) -v ( y) = v(t) -v( y)
From the above conditions, it is easy to see that {v

(t)-v ( x)} ≤ {v (t)-v ( y)} iff {v(t) -v( x)} ≤ {v(t) -v( y)}.
Lemma 2.5. Suppose that v ≈ v . Then, for all offset clocks x, y ∈ X, we have

1. v(t) -v( x) = v (t) -v ( x) 2. {v(t) -v( x)} = 0 iff {v (t) -v ( x)} = 0 3. {v(t) -v( x)} ≤ {v(t) -v( y)} iff {v (t) -v ( x)} ≤ {v (t) -v ( y)} Proof.
1. Follows from the definition of ≈.

2. Let {v(t)-v( x)} = 0. Then, we know by Lemma 2.

2 that v(t)-v( x) = -v( x) -v(t) . Since v ≈ v , we know that v (t) -v ( x) = v(t) -v( x) v ( x) -v (t) = v( x) -v(t)
As a consequence, we have

v (t) -v ( x) = -v ( x) -v (t) . By Lemma 2.2, this implies that {v (t) -v ( x)} = 0.
3. Follows from Lemma 2.4.

Lemma 2.6. Suppose that v ≈ v . Then, std(v) ∼ std(v ).

Proof. Follows from Lemma 2.5 and the definition of the operation std.

Lemma 2.7. Suppose that v ∼ v . Then, v ≈ v , for arbitrary offset valuations v and v such that std(v) = v and std(v ) = v .

Proof. Since v ∼ v , we know that v(x) = v (x) . This implies that for all x ∈ X, we have v(t -x) = v (t -x) . From the definition of ∼ for standard valuations, we also know that {v(x)} ≤ {v(y)} if and only if {v (x)} ≤ {v (y)}. This implies that {v(t

) -v( x)} ≤ {v(t) -v( y)} if and only if {v (t) -v ( x)} ≤ {v (t) -v ( y)}. But we know that v( x -y) = v( x -t) + v(t -y) + 1 -{v(t -x)} + {v(t -y)} .
Since v (t -y) = v(t -y) and v ( x -t) = v( x -t) (as seen in the first part of the proof), using Lemma 2.3, it can be seen that v

( x -y) = v( x -y) . Lemma 2.8. v ≈ v iff std(v) ∼ std(v ).
Proof. The proof follows from Lemmas 2.6 and 2.7.

Lemma 2.9.

v ≡ M v iff std(v) ∼ M std(v ). Proof. Let v ≡ M v . From the definition of ≡ M , we have Bounded(v) = Bounded(v ). This means that v(t) -v( x) > M if and only if v (t) - v ( x) > M for an offset clock x. As a consequence, std(v)(x) > M if and only if std(v )(x) > M . It immediately follows that Bounded(std(v)) = Bounded(std(v )). Further, since v ≡ M v , v B ≈ v B . From Lemma 2.6, we have std(v) B ∼ std(v ) B .
In the converse direction, consider two standard valuations v and v such that v ∼ M v . Let v and v be offset valuations such that std(v) = v and std(v ) = v . We know that if v(x) > M , then v (x) > M . By the definition of std operation, this implies that if v(t) -v( x) > M , then v (t) -v ( x) > M . As a consequence, Bounded(v) = Bounded(v ). Moreover, from Lemma 2.7 and the fact that v B ∼ v B , we have v B ≈ v B .

We will now state Lemma 2.10 that shows that given a maximal constant M , the number of offset regions is finite.

Lemma 2.10. The number of regions as well as offset regions (Definition 2.17) is bounded by

O(|X|! • 4 |X| • (M + 1) |X| ).
Proof. By Lemma 2.9, we know that there is a bijection between the standard regions and offset regions.

Recall the alternate definition of standard regions given in Section 2.3. From this definition, we know that number of distinct regions is bounded by the function |X|! • 2 |X| • Π x∈X (2M + 2). Simplifying this expression, we get the bound O(|X|! • 4 |X| • (M + 1) |X| ). From the bijection between standard regions and offset regions given by Lemma 2.9, it follows that the number of offset regions is also bounded by the same function.

This implies the statement of the lemma.

Time-abstract simulation

Since there are uncountably many valuations, we need some way to group valuations. Region equivalence is one such method. Here we consider a more general approach of grouping valuations that are not distinguishable with respect to the reachability of states. We formalize this idea by defining a time-abstract simulation relation [START_REF] Tasiran | Verifying abstractions of timed systems[END_REF] between offset valuations. Definition 2.18 (Time-abstract simulations). Given a timed automaton A := (Q, Σ, X, T, q 0 , F ), a time-abstract simulation for A is a relation A between the (state, offset valuation) pairs of A, such that, if (q, v) A (q , v ), then

• q = q;
• for every action a, delay δ ∈ R ≥0 , and a transition of A of the form

(q, v) δ - → a -→ (q 1 , v 1 ), there exists δ ∈ R ≥0 such that (q , v ) δ -→ a -→ (q 1 , v 1 ) and (q 1 , v 1 ) A (q 1 , v 1 ). An offset valuation v is A -simulated by v , in symbols v A v , if (q, v) A (q, v ) for all states q ∈ Q of A.
We will now show that the ≡ M relation between offset valuations is a time-abstract simulation relation for every timed automaton in which the maximum constant appearing in a guard is at most M . Lemma 2.11. Let v ≡ M v . For every delay δ, there exists a δ such that v + δ ≡ M v + δ .

Proof. Consider differences w.r.t. offset clocks in v + δ and v + δ . A delay of δ increases the value of differences of the form t -x by δ and decreases the differences of the form x -t by δ. Note that all the other differences of the form x -y are not altered by a delay transition.

We fix δ = δ . It can be observed that v + δ ≡ M v + δ . Now, we need to fix {δ } such that v + δ ≡ M v + δ . Elapsing {δ} from v + δ may either keep the difference v(t -x) in the same integer or move it up to the next integer, depending on the value of {v(t -x)}.

Consider an ordering ≤ f r of offset clocks such that x ≤ f r y if {v(t-x)} ≤ {v(t -y)}. Let the ordering ≤ f r be of the form :

x 1 ≤ f r x 2 ≤ f r • • • ≤ f r x k .
Let x i be such that {v(t -x i )} + {δ} < 1 and {v(t -x i+1 )} + {δ} ≥ 1. If no such x i exists, it means that {δ} from v + δ keeps all the differences v(t -x) in the same integer interval. In this case, we can choose δ = δ. Otherwise, we choose {δ } such that 1 -{v (t -x i )} > {δ } > 1 -{v (t -x i+1 )}. By denseness of reals, such a δ exists.

It remains to verify that v+δ ≡ M v +δ . It is easy to see that if (v+δ)(tx) > M , then (v +δ )(t-x) > M . Hence, Bounded(v +δ) = Bounded(v +δ ).

Next, consider the differences of the form t -x (where x ∈ Bounded(v + δ)). We have shown above that (v +δ )(t-x) = (v+δ)(t-x) . By symmetry, we also have that (v + δ )( x -t) = (v + δ)( x -t) . Lastly, consider differences of the form x -y ( x, y ∈ Bounded(v + δ).) Since the delay transition leaves these differences unaltered and integral values of such differences were equal in v and v, they continue to remain equal in v + δ and v + δ.

We define (q, v) ≡ M (q, v ) when v ≡ M v .

Lemma 2.12. ≡ M is a time-abstract simulation for A if the maximum constant used in a guard in A is at most M .

Proof. Consider a delay transition of δ from (q, v). Lemma 2.11 states that if (q, v) δ -→ (q, v 1 ) there is a delay (q, v )

δ -→ (q, v 1 ) such that v 1 ≡ M v 1 .
Next, consider an action transition a from (q, v). Let a with the guard g reset the set of clocks R.

Since v ≡ M v , v(t -x) > M iff v (t -x) > M for all x ∈ X. Further, if x ∈ Bounded(v), then v(t -x) = v (t -x) and v( x -t) = v ( x -t)
. This implies that v satisfies g iff v satisfies g. Therefore, (q, v) can execute a iff (q, v ) can execute a. Let (q, v) a -→ (q , v 1 ) and (q, v ) a -→ (q , v 1 ). Next, we consider the reset operation. If x is reset, the differences t -x and x -t are set to 0 in the resultant offset valuation. This implies that for each clock x ∈ R, t -x and x -t are set to 0 in both v 1 and v 1 . Since resets leave the differences of the form t -x unchanged for x ∈ R, the conditions w.r.t. these differences are satisfied. Next, consider the differences of the form x -y, where x, y ∈ Bounded(v 1 ). If x, y ∈ R, we know that this difference is equal to 0 in both v 1 and v 1 . If x ∈ R and y ∈ R, we know that v 1 ( x -y) = v(t -y). Similarly, we have

v 1 ( x -y) = v (t -y). Since v ≡ M v , we have v 1 ( x -y) = v 1 ( x -y) and v 1 ( y -x) = v 1 ( y -x) .
Finally, if x, y ∈ R, we know that the difference x -y are preserved from v to v 1 (similarly for v to v 1 ). Since v ≡ M v , the conditions w.r.t. differences of this form follows. Therefore, we have v 1 ≡ M v 1 .

Offset region graph

In Section 2.3, we introduced the notion of offset regions. We showed that offset valuations that belong to the same offset region are equivalent with respect to reachability. In other words, for two offset valuations v, v belonging to the same region, there is a run to a state q from (q, v) iff there is a run to q from (q, v ). Finally, we also showed that the number of distinct offset regions is bounded.

Equipped with the notion of offset regions, we now introduce a transition system that can be used to answer the reachability problem for timed automata. We introduce the notion of offset region graph, a transition system whose nodes are (state, offset region) pairs. Definition 2.19 (Offset region graph). The offset region graph of a timed automaton A, denoted by RG(A), is a transition system whose nodes are of the form (q, R), where q is a state of A and R is an offset region w.r.t. the equivalence ≡ M A , where M A is the maximum constant used in a guard in A. The initial node of the offset region graph is (q 0 , R 0 ), where R 0 is the offset region containing all the initial valuations. A node (q, R) of the offset region graph is said to be accepting if q is an accepting state of A. (q, R) t -→ RG (q , R ) is a transition of the offset region graph if there are offset valuations v, v and a delay

δ ∈ R ≥0 such that v ∈ R, v ∈ R and (q, v) δ - → t - → (q , v ).
Next, we show that transitions in the offset region graph faithfully represent transitions of the automaton. This feature of the offset region graph is known as the pre-stability property of offset regions.

Lemma 2.13. Let (q, R) t -→ RG (q , R ) be a transition of the offset region graph. For every v ∈ R, there is a delay δ ∈ R ≥0 and v ∈ R such that

(q, v) δ - → t - → (q , v ). Proof. Since (q, R) t - → RG (q , R ) is a transition of RG(A), there exist offset valuations v ∈ R, v ∈ R and a delay δ ∈ R ≥0 such that (q, v) δ - → t - → (q , v ).
Pick any offset valuation v 1 from R. We know that v 1 ≡ M v. By Lemma 2.12, we know that (q, v 1 )

δ -→ t - → (q, v 1 ) such that v 1 ≡ M v . Since v 1 ≡ M v , we have v 1 ∈ R . Lemma 2.14. A has a run (q, v) σ -→ (q , v ) iff there is a path (q, R) σ -→ (q , R ) in RG(A) such that v ∈ R and v ∈ R .
Proof. Consider a run of A of the form

(q 0 , v 0 ) δ 1 -→ a 1 -→ (q 1 , v 1 ) δ 2 -→ a 2 -→ (q 2 , v 2 ) • • • an -→ (q n , v n ).
By definition of RG(A), there exists a path in RG(A) of the form

(q 0 , R 0 ) a 1 -→ (q 1 , R 1 ) a 2 -→ (q 2 , R 2 ) • • • an -→ (q n , R n ) such that v i ∈ R i for i ∈ {0, 1, 2, • • • , n}.
In the converse direction, consider a path of RG(A) of the form

(q 0 , R 0 ) a 1 -→ (q 1 , R 1 ) a 2 -→ (q 2 , R 2 ) • • • a n-1 ---→ (q n-1 , R n-1 ) an -→ (q n , R n )
We show here that there is a run of A of the form

(q 0 , v 0 ) δ 1 -→ a 1 -→ (q 1 , v 1 ) δ 2 -→ a 2 -→ (q 2 , v 2 ) • • • a n-1 ---→ (q n-1 , v n-1 ) an -→ (q n , v n ) such that v i ∈ R i for all i ∈ {0, 1, 2, • • • , n}.
The proof follows by induction on the length of the path in RG(A). The base case is straightforward. For the induction step, consider the transition (q n-1 , R n-1 ) an -→ (q n , R n ). By induction hypothesis, we know that there is a run

(q 0 , v 0 ) δ 1 -→ a 1 -→ (q 1 , v 1 ) δ 2 -→ a 2 -→ (q 2 , v 2 ) • • • a n-1 ---→ (q n-1 , v n-1 ) such that v i ∈ R i for i ∈ {0, 1, 2, • • • , n -1}.
In particular, we know that v n-1 ∈ R n-1 . Using Lemma 2.13, we know that there is a delay

δ n ∈ R ≥0 such that (q n-1 , v n-1 ) δn -→ an -→ (q n , v n ) such that v n ∈ R n .
Corollary 2.1. A has an accepting run iff there is a path in RG(A) from an initial node to an accepting node.

The offset region graph gives us a way to solve the reachability problem of timed automata by exploring the offset region graph of the timed automaton. However, in practice, offset region graphs are too large to check for reachability in timed automata efficiently. In the next section, we discuss more efficient ways to solve the reachability problem.

Zones

The most widely used approach for checking reachability in a timed automaton is based on reachability in a graph called the zone graph of a timed automaton. In this section, we will discuss this approach in detail. We will introduce zones [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF], which are sets of valuations that can be represented efficiently using difference constraints between clocks.

As discussed already, one of the main challenges encountered in the study of timed automata arises from the uncountably infinite space of its valuations. To overcome this problem, we use a symbolic representation to analyze these systems. Regions, that we introduced in Section 2.3, was one instance of such a symbolic representation of valuations. Building on the concept of regions, the idea of a region graph was introduced by Alur [START_REF] Alur | A theory of timed automata[END_REF]. We presented a variant of the region graph in the offset setting, called offset region graph in Section 2.4. Intuitively, in the region graph of a timed automaton A, for each run in A, we have a path passing through all the regions of valuations in this run (the proof is similar to the proof of Lemma 2.14). However, from Lemma 2.10, we know that the number of regions grows exponentially with the number of clocks in the timed automaton. As a consequence, in practice, the region graph turns out to be too large to construct it efficiently. Zones are another way of grouping valuations. Although in principle, their number can also grow exponentially with the number of clocks, in most cases, the approach through zones is much more efficient than through regions. Consider a sequence of actions of the timed automaton A. There are uncountably many runs of A with the same underlying action sequenceeach one different from the others in the assignment to the clock variables in at least one step of the run. Since the timing information associated to these runs could be different, each run ends with a potentially different valuation. In other words, we end up with a set of valuations associated to this action sequence. For each sequence of actions, it turns out that a simple set of constraints can describe this associated set of valuations. In this section, we discuss this symbolic representation.

We first define a transition relation between sets of valuations. It will be very useful in the subsequent discussions.

Definition 2.20 (Symbolic transition). Let A be a timed automaton and W be an arbitrary set of valuations of A. Given a transition t of A, we define (q, W )

t - → (q , W ) if W = {v | ∃v ∈ W, ∃δ ∈ R ≥0 s.t. (q, v) t - → δ - → (q , v )} is non-empty.
The symbolic transition computes the set W by taking each valuation v ∈ W that can execute the transition t, computing the valuation obtained after executing t from v and considering the set of all valuations that can reached by a time-elapse from the resulting valuation.

Next, we define some special sets of valuations, that can be defined using some simple constraints between the clocks. Let X = {x 1 , x 2 • • • , x k } be a set of clocks. We introduce a new clock x 0 that stands for the constant 0. We can then define an augmented set of clocks X = X ∪ {x 0 }. Definition 2.21 (Standard zones). A standard zone is a set of valuations defined by a conjunction of constraints of the form x -y c, where x, y ∈ X are clocks, c ∈ Z is a constant, and ∈ {<, ≤} stands for a strict, or non-strict inequality.

In the rest of this section, we will refer to standard zones simply as zones. A simple example of a zone over the set of clocks {x, y} is:

(x 0 -x ≤ 0) ∧ (x -x 0 ≤ 2) ∧ (x 0 -y ≤ -1) ∧ (x -y ≤ 4) .
Note that another, shorter, representation of this zone is as follows

(x ≥ 0) ∧ (x ≤ 2) ∧ (y ≥ 1) ∧ (x -y ≤ 4) .
We will be using an analogous simplified representation for standard zones in the rest of this thesis. This zone is represented pictorially by the area shaded in red in Figure 2.4.

Bengtsson and Yi [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] show that if one starts with a set of valuations W that is a zone, then the set of valuations W obtained on execution of a symbolic transition from W is also a zone. Further, let W 0 be the set of all x ≤ 2 y ≥ 1

x ≥ 0

x -y ≤ 4

Figure 2.4: An example of a zone valuations reachable by time-elapse from the initial valuation 0. The set of valuations W 0 can be described by a set of difference constraints between clocks, in the following way:

W 0 := x∈X (x ≥ 0) ∧ x,y∈X (x -y = 0)
The constraint says that the values of all clocks are the same and at least 0.

Clearly, W 0 is a zone. Extending the above argument to a sequence of symbolic transitions, it follows that any set of valuations W that is reachable from (q 0 , W 0 ) by a sequence of symbolic transitions is a zone. In other words, starting from (q 0 , W 0 ), any sequence of symbolic transitions yields a node (q, W ), where W is a zone. Using this idea, we build a transition system called the zone graph, which is discussed in detail in Section 2.7

Consider the zone given in Figure 2.4. Observe that the constraint x -y ≤ 4 does not actually contribute to the definition of the zone. Even if we were to remove this constraint, or change this constraint to x -y ≤ 3, the zone does not change. In such situations, we say that the constraint is not tight and that the zone is not canonical. We will now explain these concepts formally.

Before formalizing the notion of tightness of a constraint, we first define an order between the constraints used in the definitions of zones. Observe that in Definition 2.21, we consider constraints of the form ( , c) with c ∈ Z. From now on, we also consider the constraint (<, ∞), whose meaning will be explained at the time of its use. Definition 2.22 (Ordering between constraints). We have ( 1 , c 1 ) ( 2 , c 2 ) when

• either c 1 < c 2 • or c 1 = c 2 , and 1 is < while 2 is ≤.
The intuition is that if we have x -y 1 c 1 and x -y 2 c 2 , then the first constraint is more restrictive than the second.

Definition 2.23 (Tight constraints). Let Φ be a set of constraints, and φ : x -y 1 c 1 be a constraint in Φ. We say that φ is tight in Φ if replacing φ in Φ by any another constraint φ : x -y 2 c 2 such that ( 2 , c 2 ) ( 1 , c 1 ) results in a different set of valuations. We say simply that φ is tight, when Φ is clear from the context.

Equipped with this definition, we can now formally define when a zone is canonical.

Definition 2.24 (Canonical form of a zone). A zone Z is in canonical form if each constraint defining Z is tight.

Note that in the zone from Figure 2.4, if we change the constraint, x -y ≤ 4 to x -y ≤ 2, then the constraint is tight. This is because if we further tighten this constraint, then the set of valuations that satisfy this set of constraints is different from the original zone.

Representation of zones

Zones are commonly represented using difference bound matrices and distance graphs. In this section, we define these data structures and explain how they are used to represent zones.

Recall that X is the original set of clocks X augmented with an additional clock x 0 representing the constant 0, and the ordering between the constraints (see Definition 2.22). We now introduce some notation that will be useful in presenting both of these data structures.

Definition 2.25. For a zone Z and clocks x i , x j ∈ X , we define Z x i x j as the -smallest constraint ( , c) such that all valuations in Z satisfy x i -x j c.

Observe that Z x i x j is always defined when Z is non-empty, since all valuations satisfy x i -x j ∞.

Difference bound matrices (DBMs)[Dil89, Ben02]

A difference bound matrix (DBM) is a data structure that is widely used to represent zones. First introduced in [BM83], DBMs were reintroduced in the context of timed automata by Dill [START_REF] David | Timing assumptions and verification of finite-state concurrent systems[END_REF].

Definition 2.26 (Difference bound matrix representation of a standard zone [START_REF] David | Timing assumptions and verification of finite-state concurrent systems[END_REF]). Given a zone over a set of clocks X = {x 1 , x 2 , • • • , x n }, the difference bound matrix representation of Z is given by a (n + 1) × (n + 1) matrix M , where each entry of M is of the form ( , c), where c ∈ Z and ∈ {≤, <} or (<, ∞). In particular, given a zone Z, the (i, j) th entry of the DBM of Z is M ij = ( , c), if there is a constraint x i -x j c in the set of constraints defining Z. If there is no constraint of the form x i -x j c, then M ij = (<, ∞). If there are multiple constraints of the form x i -x j c, we choose ( , c) which is minimal w.r.t. the ordering (see Definition 2.22.)

Given a difference bound matrix M , the zone defined by M is given by the set of valuations satisfying the conjunction of constraints of the form x i -x j ij c ij , where M ij = ( ij , c ij ). In these constraints, the variable x 0 stands for the constant 0.

Distance graphs

We now discuss a graphical representation of zones, referred to as distance graphs. A distance graph is a representation of a zone as a weighted graph, whose vertex set is the augmented set of clocks X = X ∪{x 0 }, and the weight of the edge between a pair of vertices represents the constraint between the clocks that are its end-points. More precisely, between any two vertices, there is an edge with a weight ( , c), where c ∈ Z ∪ {∞} and ∈ {≤, <}.

An edge x ( ,c)

---→ y in the distance graph is interpreted as the constraint y -x c. Given a distance graph G, we use G xy to denote the weight of the edge from x to y in G.

Definition 2.27 (Distance graph of a standard zone). Given a zone Z over a set of clocks X, the distance graph of Z, denoted by G Z , is given by the graph whose vertices are clocks from X and edges x -→ y between each pair of vertices x, y of G Z are such that the weight of the edge is ( , c), if there is a constraint y -x c in the set of constraints defining Z. If there is no constraint of the form y -x c, then the edge from x to y is labeled (<, ∞) in G Z . If there are multiple constraints of the form y -x c, we choose the weight of the x → y edge to be ( , c) that is minimal w.r.t. the ordering (see Definition 2.22.)

Given a distance graph G = (V, E), the zone defined by G, referred to as Z G , is the set of valuations over the clocks V (G), satisfying the conjunction of constraints of the form y -x c xy , for every edge in E(G) of the form x ( ,cxy) ----→ y. For a distance graph G, we write [[G]] for the set of solutions to the constraints given by G.

The distance graph of the zone Z from Figure 2.4 is as depicted in Figure 2.5.

Observe that we can define the notion of a canonical distance graph, where the weight of each edge x → y in the distance graph G Z is given by Z yx is as defined in Definition 2.25. We now discuss how a zone can be converted into its canonical form. We present this using the distance graph representation of the zone. From the discussion on distance graphs and difference bound matrices, it is clear that one representation of a zone can be easily obtained from the other.

x 0 x y (≤, 2) (≤, 0) (≤, 4) (≤, -1)

Canonicalization of a zone

Recall the definition of ordering on constraints (Definition 2.22): ( 1 , c 1 ) ( 2 , c 2 ). We define the operation of addition of constrains that permits us to formulate an important notion of negative cycle.

Definition 2.28 (Negative cycle in a distance graph). We define an operation of addition on constraints:

(

1 , c 1 ) + ( 2 , c 2 ) = (<, ∞) if c 1 = ∞ or c 2 = ∞ = (≤, c 1 + c 2 ) if 1 =≤ and 2 =≤ = (<, c 1 + c 2 ) otherwise
A cycle in a distance graph is negative if the sum of the edge weights along the cycle is strictly less in ordering than (≤, 0).

Equipped with these definitions, we can now define when a distance graph is said to be in canonical form.

Definition 2.29. A distance graph G is said to be in canonical form if it has no negative cycle and for each pair of vertices x, y of G, the weight of the edge from x to y is not greater than the sum of the weights along any path from x to y.

For instance, consider the distance graph in Figure 2.5. The edge y -→ x has weight (≤, 4). However, the sum of the weights of the edges y -→ x 0 and x 0 -→ x is (≤, 1), which is smaller than the y -→ x edge weight. Thus, the distance graph is not in canonical form. The distance graph G in canonical form can be obtained by changing the edge weight y -→ x to (≤, 1). Given a distance graph, we can compute the canonical form of the distance graph by running an all pairs shortest path algorithm, such as the Floyd-Warshall algorithm [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] on the distance graph. This algorithm has a running time of O(n 3 ), where n is the number of vertices in the graph. Since the distance graph of a zone over the set of clocks X has |X| + 1 vertices, the canonical form of zone can be computed in O(|X| 3 ) time.

Next, we state a folklore result [START_REF] Shostak | Deciding linear inequalities by computing loop residues[END_REF] connecting the emptiness of a zone with a property of its distance graph.

Proposition 2.1. [START_REF] Shostak | Deciding linear inequalities by computing loop residues[END_REF] Let Z be a zone and let G Z be its distance graph. Then, Z is empty if and only if G Z has a negative cycle.

This result implies that emptiness of a zone can be checked by looking for a negative cycle in its distance graph.

Intersection of distance graphs: Given two distance graphs G 1 and G 2 over the same set of vertices, the intersection of G 1 and G 2 , denoted as G 1 ∩ G 2 , is given by the distance graph, where the weight of each edge is equal to the minimum w.r.t.

ordering, of the corresponding weights in G 1 and G 2 . Note that, for any two clocks, G 1 ∩ G 2 contains the tighter of the constraints between those in G 1 and those in G 2 . So, each valuation in the zone defined by G 1 ∩ G 2 satisfies the constraints from both G 1 and G 2 . Thus, given two zones Z 1 and Z 2 , the intersection of Z 1 and Z 2 is given by computing G 1 ∩ G 2 , where G 1 and G 2 are the distance graphs of Z 1 and Z 2 , respectively.

Offset zones

In this section, we discuss offset zones, which are zones over valuations in the offset representation. We show their correspondence with zones over standard valuations defined in Section 2.5. In order to avoid confusion, we shall use Z to denote offset zones, while the standard zones will be denoted by Z.

Definition 2.30 (Offset zones). An offset zone is a set of offset valuations determined by a conjunction of constraints of the form x 1 -x 2 c, where

x 1 , x 2 ∈ X ∪ {t}, ∈ {<, ≤} and c ∈ Z.
From the definition of an offset valuation, for any offset valuation v, we have v( x) ≤ v(t) for each offset variable x ∈ X. If each valuation in a zone Z satisfies a constraint φ, then we say that Z satisfies φ. Then, Lemma 2.15 follows.

Lemma 2.15. An offset zone satisfies x ≤ t for each x ∈ X. This implies that the set of constraints defining an offset zone will always include constraints of the form x ≤ t for each offset clock x ∈ X.

An example of an offset zone over the set of clocks x, y is:

( x -t ≤ 0) ∧ (t -x ≤ 2) ∧ ( y -t ≤ -1) ∧ ( y -x ≤ 4) .

Offset distance graphs

In this section, we discuss the distance graph representation for offset zones.

The idea is quite similar to the distance graph representation of standard zones with only a few differences in details. We introduce variables Z x y for zone Z and offset clocks x, y ∈ X ∪ {t}. For defining Z x y , we use the ordering between constraints as introduced in Definition 2.22.

Definition 2.31. For an offset zone Z and x i , x j ∈ X ∪ {t}, we define Z x i x j as the -smallest constraint ( , c) such that all valuations in Z satisfy x i -x j c.

Note that Z x i x j is always defined since all offset valuations satisfy x ix j ∞. Definition 2.32 (Distance graph of offset zones). Given a zone Z over a set of clocks X, the distance graph of Z, denoted by G Z , is given by the graph whose vertices are clocks from X ∪ {t} and edges x -→ y between each pair of vertices x, y of G Z are such that the weight of the edge is ( , c y x ), if there is a constraint y -x c y x in the set of constraints defining Z. If there is no constraint of the form y -x c, then the edge from x to y in G Z is labeled (<, ∞). If there are multiple constraints of the form y -x c, we choose the weight of the x → y edge to be ( , c) that is minimal w.r.t. the ordering (see Definition 2.22.) We will write G x y to denote the weight of the edge x → y in the distance graph G.

Given a distance graph G = (V, E), the zone defined by G, referred to as Z G , is the set of valuations over clocks V (G), satisfying the conjunction of constraints of the form x -y c, for every edge in E(G) of the form y

c x y --→ x,
where the weight of the edge c x y is ( , c).

The distance graph of the offset zone from page 45 is depicted in Figure 2.6.

Remark (Comparison with a distance graphs of standard zones). Note that vertices of the distance graph of an offset zone Z, are offset clocks x from X with an additional vertex for the reference clock t. This is because offset clocks are compared with t, in contrast with the standard setting, where clocks are compared with 0, represented by the clock x 0 . This explains why in standard zones we have a vertex x 0 , while in offset zones the role of x 0 is played by t.

t x y (≤, 0) (≤, 2) (≤, 4) (≤, -1)

Translation between offset zones and standard zones

We define an operation std which takes an offset zone and returns a standard zone.

Definition 2.33 (Standard zone from an offset zone). Given an offset zone Z, std(Z) is the zone given by the distance graph which is obtained by

• reversing the direction of all the edges in the distance graph of Z,

• replacing the reference clock in the distance graph of Z by clock x 0 , and

• replacing every offset clock x by the standard clock x.

We now provide an intuition for the transformation defined above. We use the relations between standard and offset zones described in Section 2.2. In particular we will use function std converting an offset valuation to a standard one. Let v be an offset valuation and v = std(v). Then, we know that

v( x) -v( y) = v(t) -v( y) -(v(t) -v( x)) = v(y) -v(x) Similarly, v(t) -v( x) = v(x) -0 v( x) -v(t) = 0 -v(x) From the above observations, it is clear that if v satisfies a constraint x -y ≤ c, then v satisfies the constraint y -x ≤ c. Similarly, if v satisfies a constraint x -t ≤ d, then v satisfies the constraint 0 -x ≤ d.
Lemmas 2.16 and 2.17 below state that for every offset valuation v in Z, std(v) ∈ std(Z), and for every standard valuation v in std(Z), if an offset valuation v satisfies std(v) = v, then v in Z.

Lemma 2.16. Let Z be an offset zone. For every valuation v ∈ Z, we have std(v) ∈ std(Z).

Proof. Let Z = std(Z). Recall that in the distance graph of Z, G Z , the weight of an edge is the weight of the reverse edge in the distance graph of Z, G Z , with the modification that the reference clock t is replaced by the 0 clock and the offset clocks are replaced by the standard clocks.

Consider an offset valuation v ∈ Z.

Let v = std(v). We know that v(x) = v(t) -v( x) for all clocks x ∈ X. Hence, we have v(x) -0 = v(t)-v( x) for all clocks x ∈ X. Consequently, since v satisfies the constraints v(t) -v( x) ≤ G Z xt , we have v(x) -0 ≤ G Z 0x (since G Z xt = G Z 0x ) and since v satisfies v( x) -v(t) ≤ G Z t x , we have v satisfies 0 -v(x) ≤ G Z x0 (since G Z t x = G Z x0 ).
Additionally, the value of differences between offset clocks also undergo a similar transformation on translation from the offset to the standard setting:

i.e., v(x) -v(y) = v( y) -v( x) for all clocks x, y ∈ X. As a result, v satisfies all constraints of the form v(x) -v(y) ≤ G Z yx , since v satisfies the constraint v( y) -v( x) ≤ G Z
x y . This means that v satisfies all the constraints of Z and hence, we have v ∈ Z.

Therefore, for any offset valuation v in the offset zone Z, the standard valuation std(v) ∈ std(Z).

Lemma 2.17. Let Z be an offset zone. For every v ∈ std(Z), and every offset valuation v such that std(v) = v, we have v ∈ Z.

Proof. Let Z = std(Z) and v ∈ Z. Consider an arbitrary offset valuation v, such that std(v) = v. We show below that v ∈ Z. Recall that in the distance graph of Z, G Z , the weight of an edge is the weight of the reverse edge in the distance graph of Z, G Z , with the reference clock t replaced by the 0 clock and the offset clocks replaced by the standard clocks.

We know that v(x) = v(t) -v( x) for all clocks x ∈ X. This implies that, we have

v(x) -0 = v(t) -v( x) for all x ∈ X. But we know that v satisfies the constraints 0 -v(x) ≤ G Z x0 and v(x) -0 ≤ G Z 0x for all clocks x ∈ X. Consequently, v will also satisfy the constraint v( x) -v(t) ≤ G Z t x and v(t) -v( x) ≤ G Z
xt , respectively, for all offset clocks x ∈ X. Additionally, the value of difference between clocks also undergo the following transformation on translation from the offset to the standard setting:

i.e., v( x) -v( y) = v(y) -v(x) for all clocks x, y ∈ X. Therefore, since v satisfies the constraint v(y) -v(x) ≤ G Z xy , v will satisfy the constraint v( x) -v( y) ≤ G Z y x for all offset clocks x, y ∈ X.
This means that v satisfies all the constraints in Z. Therefore, it follows that v ∈ Z.

Operations on offset zones

Let g be a guard and R a set of clocks. We define the following operations on zones:

Z g := {v ∈ Z | v |= g} [R]Z := {[R]v | v ∈ Z} - → Z := {v | ∃ v ∈ Z, ∃δ ∈ R ≥0 s. t. v = v + δ}
We say that a zone is time-

elapsed if Z = - → Z .
Lemma 2.18. Let Z be an offset zone. Then, Z g , [R]Z and -→ Z are offset zones.

Proof. We will show that the sets of valuations obtained on applying these operations continue to be an offset zone. Let G Z be the canonical distance graph of Z. Note that we use the term removing an edge x → y from a distance graph to say that the value of this edge is assigned to (<, ∞). We say a path is lighter than another to indicate that the weight of the former path is less than the weight of the latter path. In the same spirit, we use the term lightest path from x to y to refer to the path with the minimum weight from x to y.

Guard intersection:

The set of constraints defining the offset zone Z g is obtained by extending the set of constraints of Z with constraints t -x ∼ c, for each constraint of the form x ∼ c in g. This follows from the definition of when an offset valuation satisfies a guard, as given in Section 2.2.

Reset: Let G 1 be the distance graph obtained by removing from G Z all edges involving x and adding the edges x (≤,0) ---→ t and t (≤,0) ---→ x, for each clock x ∈ R. Let G 1 be the distance graph obtained by canonicalizing G 1 . We will show that the set of valuations defined by

G 1 is [R]Z, i.e., [[G 1 ]] = [R]Z.
Consider edges of the form y -→ z in G 1 , where y, z ∈ R. We now show that the weight of such edges does not change from G Z to G 1 . First, observe that the first step in this transformation, i.e., removal of edges, cannot lead to lighter paths in distance graphs. Next, we inspect whether the newly added edges of weight (≤, 0) between x and t (from x to t and t to x) where x ∈ R can contribute to a lighter path from y to z in G 1 . Suppose that there was a lighter path from y to z using such a newly added edge between x and t. Consider the shortest and the lightest path.

• Suppose that the new lighter path used the x (≤,0) ---→ t edge. Since there are no other incoming edges to x, the path cannot reach x without first going to t. However, this would imply that this lighter path is of the

form y → • • • u → t (≤,0) ---→ x (≤,0) ---→ t → s → • • • z. Removing the part t (≤,0) ---→ x (≤,0) ---→ t of weight 0 yields a path y → • • • u → s → • • • z in G Z
whose weight is the same. But this is a contradiction, as we have taken the shortest path.

• Suppose that the new lighter path is of the form y →

• • • t - → x - → u - → • • • - → z. Recall that the only outgoing edge from x in G 1 is to t. As a consequence, if there is an edge x to u in G 1 , it is because of a path x (≤,0) ---→ t - → u.
But this implies that our path can be rewritten

as y - → • • • t (≤,0) ---→ x (≤,0) ---→ t - → u - → • • • - → z.
The same argument as in the previous case applies.

Once again, we can remove the smaller cycle t

(≤,0) ---→ x (≤,0) ---→ t of weight 0 to obtain the path y → • • • u → s → • • • z in G Z ,
whose weight is lesser than the weight of the edge y -→ z. As in the first case, this leads to a contradiction.

This shows that the weight of an edge y

- → z such that y, z ∈ R does not change from G Z to G 1 . We will now show that [[G 1 ]] = [R]Z [R]Z ⊆ [[G 1 ]]: Pick v ∈ [R]Z. We know that v = [R]v for some v ∈ Z. We have v (t) = v(t), v (t) -v ( x) = v(t) -v( x) if x / ∈ R and v (t) -v ( x) = 0 if x ∈ R. It follows that v satisfies all the constraints of G 1 . Hence, [R]Z ⊆ [[G 1 ]]. [[G 1 ]] ⊆ [R]Z: Consider a valuation v ∈ [[G 1 ]].
We construct a new distance graph G whose edges are as follows:

• For clocks x ∈ R, G has the edges t (≤,v( x)-v(t)) --------→ x and x (≤,v(t)-v( x)) --------→ t. • For clocks x, y ∈ R, G has the edge x (≤,v( y-x))
-------→ y.

• For clocks x ∈ R, there are no edges involving x in G . This signifies that the weight of such an edge is (<, ∞).

Notice that v ∈ [[G ]]. Also, observe that G is a canonical zone.
Observe that a solution to G Z ∩ G gives a valuation v such that

• v satisfies all the constraints of G Z .

• v and v agree on all the constraints involving clocks that are not reset.

• since v ∈ [[G 1 ]], for all clocks x ∈ R, we have v( x) = v(t).
It is easy to see that v ∈ Z and v is obtained by a reset from v . Therefore, we have v ∈ [R]Z. Now, we need to show that G Z ∩ G is non-empty. Suppose that there is a negative cycle in G Z ∩ G . Since there were no negative cycles in G Z or G , the new negative cycle should contain edges from both G Z and G . Further, since both G Z and G are canonical, the negative cycle should alternate between edges of G Z and G .

Consider an edge x -→ y, where x, y ∈ R. Recall that the weight of such edges does not change from

G Z to G 1 . Since v ∈ [[G 1 ]], we know that v( y) -v( x) ≤ c, (2.1)
where (≤, c) is the weight of the edge x -→ y in G Z . Further, observe that the weight of the edge x -→ y in G has weight v( y) -v( x). From 2.1, we can see that this edge in G Z ∩ G has to be from G . Thus, all edges in G Z ∩ G of the form x -→ y where x, y ∈ R come from G . This implies that the negative cycle cannot be limited to the offset clocks that were not reset.

Also, observe that since there are no edges in G involving clocks x where x ∈ R, any edges involving these clocks must come from G Z . Suppose our negative cycle contained a clock x such that x ∈ R. By our criterion for the negative cycle, either the incoming or the outgoing edge associated to x should come from G , which we know is not possible as there are no edges associated to s in G . Consequently, this implies that the negative cycle cannot involve clocks that are reset.

Thus, from the above observations, it is clear that the negative cycle cannot be restricted to just offset clocks -it should pass through t.

Let the negative cycle be of the form

x - → • • • - → y - → t - → z - → u - → • • • - → x
Suppose that the edge t -→ z comes from G . Then, the edge z -→ u should come from G Z . However, since u / ∈ R, we know that the edge z -→ u in G Z ∩ G comes from G , which is contrary to our requirement. Thus, the edge t -→ z comes from G Z . As a consequence, the incoming edge to t, namely, y -→ t, should be from G .

We have already seen that all the edges of the form x -→ y such that x, y ∈ R can only be from G . Since G is canonical we can replace all these edges by a single edge to get the negative cycle

x - → t - → z - → x
Further, since x -→ t and z -→ x are both from G , we can replace it by a single edge. Thus, the situation boils down to a negative cycle of just 2 edges of the form z

( ,k 1 ) ----→ t ( ,k 2 ) ----→ z
where the edge z

( 1 ,k 1 )
----→ t is from G and the edge t

( 2 ,k 2 ) ----→ z is from G Z . From our assumption, since this is a negative cycle, we have ( 1 , k 1 ) + ( 2 , k 2 ) < (≤, 0). Since we know that k 1 = v(t) -v( z), this implies v(t) -v( z) + k 2 < 0 We know that the edge t → z in G 1 is unchanged from G Z , since z ∈ R. Further, since we know that v ∈ [[G 1 ]], we have v( z) -v(t) ≤ k 2 , which implies v(t) -v( z) + k 2 ≥ 0
This is a contradiction. Thus, our assumption that there was a negative cycle was wrong.

Time-elapse: Let G 1 be the distance graph obtained by removing from G Z , the edges of the form x → t for each x ∈ X. We will show that

[[G 1 ]] = - → Z . First observe that G 1 is canonical.
We know that G Z is canonical -so, the lightest path between any two clocks x and y is the weight of the edge between the two clocks. The transformation from G Z to G 1 only involves the removal of some edges which cannot lead to lighter paths.

- → Z ⊆ [[G 1 ]]: Let v ∈ - → Z . We know that v = v + δ for some v ∈ Z.
This means that v is obtained by increasing the value of the reference clock t from v, while keeping the values of the offset clocks unchanged. This gives

v ( x) -v ( y) = v( x) -v( y) and v (t) -v ( x) ≥ v(t) -v( x)
for all offset clocks x, y. Since v ∈ Z and hence satisfies the constraints in [[G 1 ]], it follows that v satisfies them as well.

[

[G 1 ]] ⊆ - → Z : Consider v ∈ [[G 1 ]].
We construct a new distance graph G with the following edge information:

• For all clocks x ∈ X, we have the edges x

(≤,v(t)-v( x))
--------→ t.

• We do not have edges of the form t -→ x.

• For clocks x, y ∈ X, we have edges x

(≤,v( y)-v( x)) ---------→ y.
Observe that G is canonical. We remark that a valuation that satisfies the constraints in G need not satisfy x ≤ t, and consequently, need not be an offset valuation. Further, note that

[[G ]] is non-empty as v ∈ [[G ]
]. Thus, G does not have a negative cycle.

A solution to G Z ∩ G gives a valuation v such that v ∈ Z and v is obtained by a time elapse elapse from v , and hence will imply v ∈ -→ Z . We will now show that G Z ∩ G is non-empty. Suppose that there is a negative cycle in G Z ∩ G . Since there was no negative cycle in G Z or G , the new negative cycle should contain edges from both the distance graphs. Further, since both G Z and G are canonical, the negative cycle should alternate between edges of G Z and G .

Recall that the edges between offset clocks, say x and y, do not change from where (≤,c) is the weight of the edge x -→ y in G Z . In other words, for each edge of the form x -→ y, the weight of this edge in G is smaller than the weight of the edge in G Z . As a consequence, we know that all edges of the form

G Z to G 1 . Since v ∈ [[G 1 ]], it follows that v( x) -v( y) ≤ c,
x - → y in G Z ∩ G come from G .
From the above observations, it is clear that the negative cycle should pass through t. Let the negative cycle be of the form z -→

• • • x - → t - → y - → • • • - → z.
Since the edge t -→ y has weight (<, ∞) in G , we know that this edge should come from G Z . Further, since the edges should alternate between G Z and G , the x -→ t edge should come from G . Consider the segment x -→ t -→ y of this negative cycle -let this segment have weight ( , k). Clearly, ( , k) is less than the weight of the edge x -→ y in G (which is equal to (≤, v( y -x))), or we would have used this edge for the negative cycle. Thus, (≤, v( y

-x)) > ( , k) which implies (≤, v( x -y)) + ( , k) < (≤, 0). This implies that x - → t - → y - → x is a negative cycle. Since both x -
→ t and y -→ x edges come from G and G is canonical, we can replace these two edges by a single edge. We now have the negative cycle y -→ t -→ y, where y -→ t edge comes from G with weight (≤, v(t -y)), and t -→ y edge with weight ( , k

) comes from G Z . Recall that v ∈ [[G 1 ]],
and G 1 has the same incoming edges to t as in G Z . This implies that v( y -t) k. In other words, we have

(≤, v( y -t)) ≤ ( , k) (2.2)
We know that y

(≤,v(t-y)) ------→ t ( ,k)
---→ y is a negative cycle. From 2.2, we know that if we replace the weight of the t -→ y edge by (≤, v( y -t)), which is the weight of the t -→ y edge in G , we should still have a negative cycle. But this is a contradiction, as we know that G does not have negative cycles. Thus, our assumption that G Z ∩ G has a negative cycle was wrong. As a consequence, we know that Z ∩ [[G ]] is not empty.

Offset zone graph

As already discussed in Section 2.5, if we start with (q, W ), where W is a standard zone, then the set of valuations W in (q , W ) obtained after an execution of a symbolic transition (see Definition 2.20) is also a standard zone [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF]. Further, the set of all valuations reachable by time-elapse from the initial valuation v 0 is also a zone. It follows that if we start from (q 0 , W 0 ), any sequence of symbolic transitions yields a node (q, W ), where W is a zone. This observation allows to construct a transition system called the zone graph, whose nodes are (state, zone) pairs [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF]. We have already discussed offset zones and have established the correspondence between standard zones and offset zones in Section 2.6. In this section, we build on these ideas and propose the notion of a transition system called offset zone graph, whose nodes are (state, offset zone) pairs. This graph may be viewed as the analogue of the standard zone graph in the offset setting.

Definition 2.34 (Offset zone graph). The offset zone graph OZG(A) of a timed automaton A := (Q, Σ, X, T, q 0 , F ) is a transition system whose • nodes are of the form (q, Z), where q ∈ Q and Z is a time-elapsed offset zone.

• transition relation is defined as follows:

(q, Z) a --→ (q , Z ) if q a,g --→ R q is a transition in T and Z = -------→ [R](Z ∧ g) is non-empty.
• initial state is of the form (q 0 , Z 0 ), where Z 0 is the initial zone, which is the set of valuations obtained by time-elapse from an initial valuation v 0 , i.e.,

Z 0 = {v 0 + δ | δ ∈ R ≥0 }.
• accepting state is of the form (q, Z), where q ∈ F .

Figure 2.7 gives a timed automaton and its offset zone graph. Lemma 2.19 (Pre and Post properties of offset zones). Let A be a timed automaton and OZG(A) be the offset zone graph of A. Let σ be a sequence of actions.

p q r a b c x ≤ 2 y ≥ 3 {x} {y} (a) A timed automaton A p t -x ≥ 0 t -y ≥ 0 x -y = 0 q t -x ≥ 0 t -y ≥ 0 x -y = 0 r t -x ≥ 0 t -y ≥ 3 x -y ≥ 3 q t -x ≥ 0 t -y ≥ 0 y -x ≥ 0 a b c b (b) Offset zone graph of A
• Suppose that (q, v)

σ -→ (q , v ) is a run of A and (q, Z) is a node of OZG(A) with v ∈ Z. Then, there is a path (q, Z) σ -→ (q , Z ) in OZG(A) such that v ∈ Z . • Suppose that (q, Z) σ -→ (q , Z ) is a path in OZG(A) and v ∈ Z . Then, there is a run of A of the form (q, v) σ -→ (q , v ) such that v ∈ Z.

Making zone graphs finite

The reachability problem for timed automata is reduced to the reachability in the offset zone graph of timed automata (see Definition 2.34). However, the zone graph of a timed automaton may not be finite. Therefore, an algorithm that decides the reachability problem for a timed automaton by exploring its zone graph is not guaranteed to terminate. To ensure termination of this algorithm, some finite truncation of this zone graph is needed.

We define an abstraction operator, which is a function mapping sets of valuations to sets of valuations [BBLP06, DT98, HSW12, GMS19, BBFL03]. Definition 2.35 (Abstraction operator [START_REF] Behrmann | Static guard analysis in timed automata verification[END_REF]). An abstraction operator a : P(R X ≥0 ) → P(R X ≥0 ), where X = X ∪ {t}, is a function from sets of offset valuations to sets of offset valuations such that W ⊆ a(W ) and a(a(W )) = a(W ), where W is a set of offset valuations. An abstraction operator is finite, if its range is finite.

Remark. Abstraction operators, as found in the standard literature on timed automata [BBFL03, DT98, HSW12], are normally defined for standard valuations. However, since our work mainly deals with offset valuations, we adapt the definitions to the offset setting.

An abstraction operator a defines an abstract semantics, referred to as the simulation graph of the automaton based on a, whose definition follows.

Definition 2.36 (Simulation graph based on an abstraction). Given a timed automaton A, and an abstraction operator a, the simulation graph of A based on a, denoted by SG a (A), is a transition system whose • states are of the form (q, W ), where q is a state of A and W is a set of offset valuations.

• initial state is of the form (q 0 , W 0 ), where W 0 = a(Z 0 ), where Z 0 is the initial zone, i.e., Z 0 = {v 0 + δ | δ ∈ R ≥0 }, where v 0 is an initial valuation.

• transition relation is:

(q, W ) t - → a (q , a(W )) if W = a(W ) and W = {v | ∃ v ∈ W, ∃ δ ∈ R ≥0 s.t. (q, v) t - → δ - → (q , v )} is non-empty.
We now define when SG a (A) is said to be sound and complete for a timed automaton A and an abstraction operator a.

Soundness: SG a (A) is said to be sound if for every path (q 0 , W 0 )

ρ -→ a (q, W ) in SG a (A) where W 0 = a(Z 0 ) is the abstraction of the initial zone, there are valuations v 0 ∈ Z 0 and v ∈ W such that (q 0 , v 0 ) ρ -→ (q, v). Completeness: SG a (A) is said to be complete if for every run of A of the form (q 0 , v 0 ) σ -→ (q, v), there is a path in SG a (A) of the form (q 0 , W 0 ) σ -→ a (q, W ), such that v ∈ W .
From the definitions of soundness and completeness of SG a (A), it is clear that if we can compute an abstraction operator a such that SG a (A) is sound, complete and finite, then it is sufficient to explore SG a (A) to decide the reachability problem for A. In the next section, we discuss ways to design such abstraction operators which give rise to sound, complete and finite simulation graphs.

Abstractions from simulations

A convenient way to construct abstraction operators is using simulation relations between valuations. We formalize this notion by using the idea of a time-abstract simulation (see Definition 2.18).

An abstraction a based on A is defined as

a(W ) = {v | ∃v ∈ W with v A v }
Next, in Lemmas 2.20 and 2.21, we show some properties of the transitions of the simulation graph of a timed automaton. We then use these properties in Lemma 2.23 to prove that the simulation graph of a timed automaton is sound and complete.

Lemma 2.20. Let W be an arbitrary set of valuations.

If (q, W ) b - → (q 1 , W 1 ) and (q, a(W )) b - → a (q 1 , W 1 ), then W 1 = a(W 1 ). Proof. Recall that (q, a(W )) b - → a (q 1 , W 1 ) stands for (q, a(W )) b - → (q 1 , W 1 ) and W 1 = a(W 1 ).
To show a(W 1 ) ⊆ W 1 we observe that W ⊆ a(W ) by the definition of the abstraction. Then, W 1 ⊆ W 1 by the definition of the transition. Finally, a(W 1 ) ⊆ a(W 1 ) = W 1 by the monotonicity of the abstraction.

To show that

W 1 ⊆ a(W 1 ), consider v 1 ∈ W 1 = a(W 1 ). By definition, there is v 1 ∈ W 1 such that v 1 A v 1 . From the definition of transition (q, a(W )) b - → (q 1 , W 1 ), we get a valuation v ∈ a(W ) such that (q, v ) δ - → b - → (q , v 1 ) for some δ, Since v ∈ a(W ), there is v ∈ W with v A v and a transition (q, v) δ -→ b - → (q , v 1 ), for some δ and some v 1 with v 1 A v 1 . We have v 1 ∈ W 1 by the definition of W 1 . Moreover, v 1 A v 1 A v 1 , showing that v 1 ∈ a(W 1 ).
Using the property given in Lemma 2.20 and the definition of the simulation graph, we now show that there is a path σ in the offset zone graph to a node (q, Z) if and only if there is a path σ to (q, a(Z)).

Lemma 2.21.

Let (q 0 , Z 0 ) σ -→ (q n , Z n ) be a path in OZG(A). Then, there exists a path (q 0 , W 0 ) σ -→ a (q n , W n ) in SG a (A), such that W n = a(Z n ). Proof. Let the path σ = b • σ be as follows: (q 0 , Z 0 ) b - → (q 1 , Z 1 ) σ -→ (q n , Z n ). Take W 0 = a(Z 0 ). Consider (q 0 , W 0 ) b - → a (q 1 , W 1 )
. By Lemma 2.20, it follows that W 1 = a(Z 1 ). Repeating the same argument with W 1 and Z 1 , we eventually get a path (q 0 , W 0 )

σ -→ a (q n , W n ) in SG a (A) with W n = a(Z n ). Lemma 2.22. Let (q 0 , W 0 ) σ -→ a (q, W ) be a path in SG a (A). There exists a run in A of the form (q 0 , v 0 ) σ -→ (q, v), where v 0 ∈ W 0 and v ∈ W .
Proof. Using Lemma 2.20, we know that there is a path (q 0 , Z 0 ) σ -→ (q, Z) with W 0 = a(Z 0 ) and W = a(Z). For every v ∈ Z, by the pre property of offset zones, there is a run of A of the form (q 0 , v 0 ) σ -→ (q, v) for some v 0 ∈ W 0 .

Lemma 2.23. If a is based on a time-abstract simulation for A, then SG a (A) is sound and complete.

Proof. The soundness of SG a (A) follows from Lemma 2.22.

For completeness, consider a run of A of the form (q 0 , v 0 ) σ -→ (q, v). By Lemma 2.19, we know that there is a run in OZG(A) of the form (q 0 , Z 0 ) σ -→ (q, Z), such that v ∈ Z. By Lemma 2.21 we get (q 0 , W 0 ) σ -→ (q, W ) in SG a (A) such that Z ⊆ W . Thus, we have the completeness of SG a (A).

Lemma 2.23 suggests that one can use the abstraction based on the coarsest simulation relation for a given automaton. However, it is known that computing the coarsest simulation relation for a given timed automaton is Exptime-hard [START_REF] Laroussinie | The state explosion problem from trace to bisimulation equivalence[END_REF]. Therefore, in the next section we explore if it is actually possible to compute some (not necessarily the coarsest) finite-time abstract simulation for a timed automaton.

Abstractions from the structure of the timed automaton

Instead of computing the coarsest relation for a given timed automaton, we look at some easily computable parameters and base the simulation relation on them. These parameters will be the maximal constants used in guards of the automaton. We then introduce a relation between offset valuations that is a time-abstract simulation for all automata whose guards are within the constants used to define the relation. This relation turns out to be easier to compute than the coarsest time-abstract simulation relation for a timed automaton [START_REF] Frédéric Herbreteau | Better abstractions for timed automata[END_REF].

Behrmann et al. [START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF] introduced a preorder relation LU between standard valuations. Here, L and U are functions bounding the constants that can be used in guards. We adapt this to the offset setting to define a preorder relation LU between offset valuations. We then show that this preorder relation is actually a time-abstract simulation for every timed automaton with constants in guards bounded by L and U . The definition of LU directly gives efficiently computable conditions to decide if two valuations are related by LU .

To help us to define LU , we now introduce the notion of LU bounds for a timed automaton. Consider two functions L, U : X → N ∪ {-∞} assigning to each clock a bound that is a natural number or -∞. Intuitively, -∞ means that the clock is not used. We say that a guard g conforms to L and U if

• for every upper bound constraint in g of the form x < c or x ≤ c, we have c ≤ U (x).

• for every lower bound constraint in g of the form x > c or x ≥ c, we have c ≤ L(x).

Observe that if L is not bigger than L in the pointwise ordering, meaning that L(x) ≤ L (x) for every clock x, then, when g conforms to L, it also conforms to L . Similarly for U .

Definition 2.37 (LU bounds for an automaton). Given a timed automaton A, the LU bounds for A are the smallest functions L and U , such that all the guards on all the transitions of A conform to L and U .

We recall the definition of LU-preorder between standard valuations, as given in [START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF].

Definition 2.38 (LU-preorder). Given two standard valuations v and v , we say v LU v if for all clocks x ∈ X :

• either v(x) = v (x), • or L(x) < v (x) ≤ v(x), • or U (x) < v(x) ≤ v (x).
We now define LU-preorder between offset valuations by adapting Definition 2.38 to the offset setting,using the translation from offset valuations to standard valuations. Definition 2.39 (LU-preorder for offset valuations). Let v and v be offset valuations.

v LU v if and only if for all x ∈ X • either v(t) -v( x) = v (t) -v ( x) • or L x < v (t) -v ( x) ≤ v(t) -v( x) • or U x < v(t) -v( x) ≤ v (t) -v ( x) Lemma 2.24. v LU v iff std(v) LU std(v ).
Proof. The proof follows from Definition 2.11 and Definition 2.38.

Lemma 2.25. If A is a timed automaton whose guards conform to LU , then the relation LU is a time-abstract simulation for A.

Proof. Let v LU v . Consider a delay of δ from the valuation v. It is easy to see that v + δ LU v + δ, since the differences of the form t -x increase by the same value in both v + δ and v + δ.

Next, consider an action transition a from the state (q, v) with guard g and reset R. We show that if v |= g, then v |= g. Let g be of the form x ≤ c. For an offset clock, there are three possibilities for the difference t -x.

• v(t -x) = v (t -x). It is clear that v |= g iff v |= g. • L x < v (t -x) ≤ v(t -x). Let v |= g. This means that v(t -x) ≤ c. But since v (t -x) ≤ v(t -x), it follows that v (t -x) ≤ c. Hence, v |= g. • U x < v(t-x) ≤ v (t-x). Since c ≤ U x , we have c < v(t-x). Therefore, v |= g is never true.
Suppose that g is of the form x ≥ c. Again, there are three possibilities for the difference t -x.

• v(t -x) = v (t -x). It is clear that v |= g iff v |= g. • L x < v (t -x) ≤ v(t -x). It may be observed that v |= g is always true, since v (t -x) > L x ≥ c. • U x < v(t -x) ≤ v (t -x). v |= g implies that v(t -x) ≥ c. Since v (t -x) ≥ v(t -x), we can observe that v (t -x) ≥ c and therefore v |= g.
Since v |= g is true whenever v |= g is true, it is clear that (q, v ) can execute the action a if (q, v) can execute a. Let (q, v) a -→ (q , v 1 ) and (q, v ) a -→ (q , v 1 ). If a clock x is reset, then the differences t -x and x -t get set to 0 in the resultant valuation. This implies that t -x and x -t get set to 0 in v 1 and v 1 . Since resets leave the other differences unaltered, it is clear that v 1 LU v 1 .

In the following we will use a LU , the abstraction operator based on the time-abstract simulation relation LU . For the sake of completeness, we formally define it below.

Definition 2.40 (a LU abstraction). Given bounds L and U for a network of timed automata, for a set of valuations W we define:

a LU (W ) = {v | ∃v ∈ W s.t. v LU v }
Next, we define when a zone is a LU -simulated by another zone.

Definition 2.41 (a LU simulation for zones). Given zones Z and Z , we say

Z is a LU simulated by Z if Z ⊆ a LU (Z ).
We now proceed to show that this abstraction operator has finite range when applied over zones. This is done using the notions of region and neighbourhood introduced earlier in Definitions 2.15 and 2.16.

Lemma 2.26. Let M be the maximal value of L and U functions.

If v LU v and v 1 ∈ [v] M , then there is a valuation v 1 ∈ nbd(v ) such that v 1 LU v 1 . In particular v 1 ∈ [v ] M .
Proof. For simplicity we prove the lemma for standard valuations. The proof for offset valuations follows the same lines, but needs to talk about differences between v(t) and v(x) which complicates the writing.

We partition the set of clocks into three subsets:

• big clocks: are clocks x such that v(x) > M ;

• fixed clocks: are clocks z such that v(z) < min(L(x), U (x));

• flexible clocks: are clocks y that are none of the above.

Consider a valuation v 1 ∈ [v] M . We need to find a valuation v 1 ∈ nbd(v ). For big clocks, we set v 1 (x) = v (x). Similarly, for fixed clocks, v 1 (z) = v (z).
For the flexible clocks, we need to work bit more. The integer part of flexible clocks is determined: requirement v 1 ∈ nbd(v ) implies that the integer part of v 1 (y) must be the same as the integer part of v (y) for every clock.

We need to define the values of the fractional parts of flexible clocks. For this, we list the flexible clocks in an arbitrary order, say y 1 , . . . , y l and find the fractional part of the v value of one flexible clock after the other. Observe that the order of fractional parts of fixed and flexible clocks is the same in v and v 1 , because of v 1 ∈ [v] M . Moreover the order of fractional parts of fixed clocks in v is by definition the same as in v. So, the order of fractional parts of v(z 1 ), . . . , v(z k ), v(y 1 ), . . . , v(y l ) is the same as of v 1 (z 1 ), . . . , v 1 (z k ), v 1 (y 1 ), . . . , v 1 (y l ).

We proceed by induction on i = 0, . . . , l. Suppose that the order of fractional parts of v(z 1 ), . . . , v(z k ), v(y 1 ), . . . , v(y i ), v (y 1 ), . . . , v (y i ) is the same as that of v 1 (z 1 ), . . . , v 1 (z k ), v 1 (y 1 ), . . . , v 1 (y i ), v 1 (y 1 ), . . . , v 1 (y i ). The base case of i = 0 is true by the above paragraph. We find the value of the fractional part of v 1 (y i+1 ) that would make this statement true also for y i+1 . This is quite direct. Suppose that v (y i+1 ) is between v(z a ) and v (y b ) for b ≤ i. Then, we choose for v (y i+1 ) the fractional value that will put it in between v(z a ) and v (y b ). This is always possible as real numbers are dense. There is a special case when v (y i+1 ) is equal to some of the other values, say v(z a ), but in that case, we just put v 1 (y i+1 ) = v(z a ).

Thus, we have constructed a valuation v 1 ∈ nbd(v ) such that the order of the fractional parts in v(z 1 ), . .

. , v(z k ), v(y 1 ), . . . , v(y l ), v (y 1 ), . . . , v (y l ) is the same as in v(z 1 ), . . . , v(z k ), v 1 (y 1 ), . . . , v 1 (y l ), v 1 (y 1 ), . . . , v 1 (y l ).
We claim that v LU v 1 . For this, we look at the definition of the LU preorder (Definition 2.38). We observe that from

v ∈ [v] M , we can infer that if v(x) > L(x), then v 1 (x) > L(x); and analogously for U (x). If x is a big clock, then v(x) > L(x), U (x)
. This means that v (x) > L(x). By the observation from the previous paragraph v 1 (x) > L(x), U (x). Since v 1 ∈ nbd(v ), we have v 1 > L(x), and we are done.

If z is a fixed clock, then v(z) = v (z), and v 1 (z) = v 1 (z); so we are done also in this case.

If y is a flexible clock, then we have two cases. If v(y) > L(y), then

L(y) ≤ v (y) ≤ v(y). From v ∈ [v] M ,
we deduce that the integer parts of v (y) and v(y) are the same. From v 1 ∈ nbd(v ), we deduce that the integer parts of v 1 (y) and v (y) are the same. Thus, we have L(y) ≤ v 1 (y), v 1 (y). If the integer parts of v (y) and v(y) are different, then we get as desired v 1 (y) ≤ v 1 (y). If they are the same, then we get v 1 (y) ≤ v 1 (y) because we have taken care of the order of fractional parts when constructing v 1 . The argument when v(y) > U (x) is analogous. Lemma 2.9 which gives a bijection between standard regions and offset regions and Lemma 2.24 which gives the relation between LU equivalence for standard valuations and offset valuations allow us to state Lemma 2.26 for offset valuations also.

Corollary 2.2. Let M be the maximal value of L and U functions. If

v LU v and v 1 ∈ [v] M , then there is a valuation v 1 ∈ nbd(v ) such that v 1 LU v 1 . In particular v 1 ∈ [v ] M .
Lemma 2.27. If W is closed under region equivalence relation ≡ M , for M the maximum of L and U functions, then so is a LU (W ).

Proof. We show that for arbitrary W as in assumption of the lemma, if a valuation v ∈ a LU (W ), and

v 1 ∈ [v] M , then v 1 ∈ a LU (W ) (see Defini- tion 2.15). As v ∈ a LU (W ), there is v ∈ W such that v LU v . By Corollary 2.2, we know that there exists a valuation v 1 ∈ nbd(v ) such that v 1 LU v 1 . Since W is neighborhood closed, v 1 ∈ W , and in consequence v 1 ∈ a LU (W ).
From the discussion above it is clear that a LU (W ) is a union of Mregions, for every zone W . From Lemma 2.10, we know that the number of M -regions is finite. This implies that the number of distinct sets a LU (W ) is finite. Thus, a LU (W ) has finite range.

Lemma 2.28. SG a LU (A) is finite, sound and complete.

Proof. The soundness and completeness of SG a LU (A) follows from Lemma 2.23. The finiteness of SG a LU (A) follows from Lemma 2.27, which says that a LU .

Since SG a LU (A) is an abstraction of the zone graph of A which is sound, complete and finite, checking the reachability of a state of the timed automaton A can be done by exploration of SG a (A).

Standard reachability algorithm

In this section, we present the standard reachability algorithm for timed automata using the ideas introduced in this chapter. The algorithm takes as input a timed automaton A := (Q, Σ, X, T, q 0 , F ), computes its LU bounds (Definition 2.37), and constructs a simulation graph SG a (A) as in Definition 2.36 using the abstraction a LU from Definition 2.40.

Thanks to Lemma 2.20, the algorithm can store pairs (q, Z) and not (q, a LU (Z)). This is important as a LU (Z) may not be a zone, so we do not have an efficient way to store a LU (Z). What we need instead is an efficient method to test a LU (Z) ⊆ a LU (Z ). Observe that by monotonicity, this is equivalent to a test Z ⊆ a LU (Z ). We prefer a more compact notation

Z a LU Z instead of Z ⊆ a LU (Z ).
Algorithm 1 starts the exploration from the initial node (q 0 , Z 0 ). It keeps a list Visited of all the nodes constructed by the algorithm, and a list Waiting of nodes that have been constructed but whose successors have not been computed yet. In the beginning, both lists contain the initial node (q 0 , Z 0 ). In each iteration, the algorithm removes a node from Waiting and adds to Waiting all its successors. There are two exceptions to this behavior. First, if an accepting state is reached, then the algorithm terminates. Second, if a node to be inserted to Waiting is a LU smaller than some already visited node, then there is no point in adding it to Waiting.

We also optimize the algorithm further, by adding the following step: whenever a node (q, Z) is added to Waiting and Visited, we remove any node (q, Z ) in Waiting and Visited such that Z a LU Z. We will show that this does not affect the correctness of the algorithm.

Algorithm 1 Reachability algorithm for a timed automaton Input : Timed automaton A := (Q, Σ, X, T, q 0 , F ). Output : true iff A has a run reaching an accepting state.

1: Set Waiting = Visited := {(q 0 , Z 0 )} 2: if q 0 is accepting then return true 3: while Waiting = ∅ do 4:
remove some (q, Z) from Waiting

5:

for all (q , Z ) s.t. (q, Z) a -→ (q , Z ) for some a do 6:

if q is accepting then

7: return true 8: else if ∃ (q , Z ) ∈ Visited s.t. Z a LU Z then 9: Skip 10: else 11: for (q , Z ) ∈ Visited do 12: if Z a LU Z then 13:
Remove (q , Z ) from Visited and Waiting 14:

Add (q , Z ) to Waiting and Visited 15: return false

Correctness of the algorithm

We will now prove that Algorithm 1 is correct. The soundness of the algorithm is given by Lemma 2.30, while the completeness follows from Lemma 2.33.

Lemma 2.29. If a node (q, Z) is in the list Waiting of Algorithm 1, then A has a run (q 0 , v 0 ) to (q, v), for some valuation v ∈ Z.

Proof. Directly from the algorithm, we see that if (q, Z) is in Waiting, then there is a sequence of actions σ such that (q 0 , Z 0 ) σ -→ (q, Z). The claim of the lemma follows from Lemma 2.22.

Lemma 2.30. (Soundness) If Algorithm 1 returns true, then A has an accepting run.

Proof. Algorithm 1 can return true by either executing line 2 or line 7. Line 2 is only executed in the special case when the initial state q 0 of A is an accepting state -we know that in this case, the claim is vacuously true. Next, consider the case when line 7 is executed. We can infer from the algorithm that this happens only when a node (q, Z) has just been removed from Waiting, and (q, Z) a -→ (q , Z ) is such that q is an accepting state. By Lemmas 2.29 and 2.22, we know that A has an accepting run.

Lemma 2.31. If a node (q, Z) is added to Visited at some step of Algorithm 1, then at each step afterwards there is a node (q, Z ) in Visited such that Z a LU Z . Proof. Suppose that a node (q, Z) was added to Visited at some stage of Algorithm 1. If (q, Z) is in Visited until the termination of the algorithm, then we are done. Suppose not. We can see that line 13 is the only step of the algorithm that removes a node (q, Z) from Visited. But in this case, we can observe that another node (q, Z ) is added to Visited such that Z a LU Z . Again, if (q, Z ) is removed at a later point in the algorithm, then by the same argument, we know that another state (q, Z ) such that Z a LU Z is added to Visited.

Lemma 2.32. Let σ be path in OZG(A):

(q 0 , Z 0 ) a 1 -→ (q 1 , Z 1 ) a 2 -→ • • • (q n-1 , Z n-1 ) an -→ (q n , Z n ).
If Algorithm 1 does not return true at the termination, then for every 0 ≤ i ≤ n there exists a state (q i , Z i ) in the set Visited such that Z i a LU Z i . Proof. Suppose that Algorithm 1 does not return true. We will give a proof by induction on the number of transitions in σ.

Base case: The node (q 0 , Z 0 ) is added to Visited in Line 1 of the algorithm. By Lemma 2.31, until the end of the execution of the algorithm, there is some node (q 0 , Z ) ∈ Visited such that Z 0 a LU Z . Induction step: By induction hypothesis, there exists a node (q i , Z i ) in Visited, such that Z i a LU Z i . Assume w.l.o.g. that (q i , Z i ) is a maximal node in Visited with respect to a LU ordering. Since (q i , Z i ) is in Visited, we know that it must have also been in Waiting at some stage of the algorithm. Further, since we know that the algorithm terminated when Waiting is empty, at some stage of the algorithm, this node (q i , Z i ) must have been removed from Waiting.

From the run σ, we know that (q i , Z i )

a i+1 ---→ (q i+1 , Z i+1 ). From Lemma 2.25, we know that a LU is a simulation relation. So, (q i , Z i ) a i+1 ---→ (q i+1 , Z i+1 ), for some Z i+1 such that Z i+1 a LU Z i+1 .
If this node is added to Visited, then by Lemma 2.31, we know that until the end of the execution of the algorithm, there is some node (q i+1 , Z i+1 ) ∈ Visited such that Z i+1 a LU Z i+1 . In this case, we are done. Now, suppose that (q i+1 , Z i+1 ) is not added to Visited. This could happen due to two reasons:

• (q i+1 , Z i+1
) is an accepting node. In this case, Algorithm 1 would have terminated by returning true. But by our assumption, this is not the case.

• There exists (q i+1 , Z i+1 ) in Visited such that Z i+1 a LU Z i+1 . Since Z i+1 a LU Z i+1 , by transitivity of a LU , we can also conclude in this case.

Lemma 2.33. (Completeness) If OZG(A) has a reachable accepting node, then Algorithm 1 returns true.

Proof. Suppose that Algorithm 1 terminated by returning false. Then, by Lemma 2.32, if there is a run to an accepting node (q, Z) of OZG(A), it follows that (q, Z) is in Visited when the algorithm terminates. But this is not possible as the accepting state is never added to Visited.

From Lemma 2.30 and Lemma 2.33, we can infer that Algorithm 1 is correct. The termination of the algorithm is guaranteed by the finiteness of a LU , given by Lemma 2.27.

Partial order reduction

Concurrent systems, such as a network of processes, have several components operating in parallel. We first set up some basic definitions and notation before motivating the key ideas of partial order reduction techniques.

Definition 2.42 (Process). A process is a tuple S, Σ, s 0 , -→, F , where S is a set of states, Σ is a finite alphabet of actions, -→ ⊆ S × Σ × S is a transition relation between states, s 0 ∈ S is an initial state and F ⊆ S is a set of accepting states. We write s a -→ s to denote that (s, a, s ) ∈ -→. We sometimes refer to -→ as the successor relation of the process.

Given a process A p and a state s of A p , we say that action a is enabled in state s if there exists a transition s a -→ s .

Definition 2.43 (Run of the process). A run of the process A p from a state s is a sequence of transitions starting in s: s

a 1 -→ s 1 a 2 -→ s 2 • • • an -→ s n . We denote it by s σ -→ s n where σ = a 1 • a 2 • • • a n is
a sequence of actions. We say that a run is accepting if the final state of the run is an accepting state.

Definition 2.44 (Network of processes). Let Σ 1 , Σ 2 , . . . , Σ k be a collection of finite alphabets, not necessarily disjoint. A network of processes is a tuple A 1 , A 2 , . . . , A k where each A i is a process given by (S i , Σ i , s 0 i , → i , F i ).

For each action a ∈ Σ, we define the domain of the action a as the set of processes participating in that action. Formally, dom(a) = {p | a ∈ Σ p }.

We refer to the actions whose domain contains more than one process as synchronization actions. All other actions are referred to as local actions.

Definition 2.45 (Semantics of a network). The semantics of a network of processes N is given by a transition system

T N = (S × , i=k i=1 Σ i , s 0 × , = ⇒, F × ) where • the set of states S × = S 1 × S 2 × • • • × S k , • the initial state s 0 × = (s 0 1 , s 0 2 , . . . , s 0 k ),
• the set of final states

F × = { (s 1 , s 2 , . . . , s k ) | s i ∈ F i for all i },
• there is a transition (s 1 , s 2 , . . . , s k )

a =⇒ (s 1 , s 2 , . . . , s k ) if -for all i ∈ dom(a), action a is enabled in s i -s i a -→ i s i for all i ∈ dom(a)
, and s i = s i for all i ∈ dom(a).

For each state s of T N , let Act(s) denote the set of transitions enabled in s. Likewise, let Act i (s) denote the set of transitions enabled from s in process A i .

Verification of a network N is usually carried out by the exploration of the transition system T N modelling the semantics of the network. A state of the transition system T N is a tuple containing a state of each component of N . This implies that the size of the state space of T N is the product of the sizes of the state spaces of the components of N . As a consequence, the size of the transition system modelling the semantics of the network grows exponentially with respect to the number of components of the network. This dramatic increase in state space is commonly referred to as state-space explosion.

State-space explosion means that verification of a network by exhaustive exploration of a transition system modelling the network is not a scalable solution [START_REF] Clarke | Model checking and the state explosion problem[END_REF]. Various solutions have been proposed to overcome the challenge posed by state-space explosion [CG18, CGJ + 03]. Partial order reduction is one such technique that tries to reduce the size of the state space of the transition system that needs to be explored in order to carry out the verification of a system.

We now examine the underlying reasons for state-space explosion in networks of processes. Consider the network of processes N 1 depicted in Figure 2.8. In this case, the transition system that is used to study N 1 is the product automaton of the network, denoted as A N 1 . Observe that the product automata of a network contains all possible orderings of concurrent actions in the network. For example, in A N 1 shown in Figure 2.8, there are 3! paths that go from the initial state (p 0 , q 0 , r 0 ) to the state (p 1 , q 1 , r 1 ). In general, if we consider a sequence of n concurrent actions each belonging to a different process, then there are n! different interleavings of this sequence, one per each possible ordering of these actions. Thus, to summarize, the fundamental reason for state-space explosion is that all the orderings of concurrent actions in the network are feasible in the transition system modelling the network. However, the exploration of all the interleavings of concurrent actions may not be necessary for the verification of a property. For instance, consider the transition system T 1 given in Figure 2.9. In T 1 , if we are only interested in the reachability of the accepting state (p 2 , q 2 , r 2 ), and do not care about the path via which we reach this accepting state, we do not need to completely explore T 1 . In this regard, all paths from (p 0 , q 0 , r 0 ) to (p 2 , q 2 , r 2 ) are equivalent. Therefore, it suffices to explore only one of these paths; for instance, the path given by red edges. We can consider a smaller transition system T r 1 that is restricted to the states in T 1 reachable via the red edges from its initial state. This is the idea behind partial order reduction: partial order reduction techniques work by identifying a small part of the state space (referred to as the reduced transition system), whose exploration is sufficient to carry out the verification of the relevant property. The development of various partial order methods [START_REF] Valmari | Stubborn sets for reduced state space generation[END_REF][START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF][START_REF] Doron | All from one, one for all: on model checking using representatives[END_REF] have proven quite useful in improving the performance of verification procedures for concurrent systems, both in terms of their running time and memory consumption. p 0 , q 0 , r 0 p 1 , q 0 , r 0 p 0 , q 1 , r 0 p 0 , q 0 , r 1

p 1 , q 1 , r 0 p 0 , q 1 , r 1 p 1 , q 0 , r 1 p 1 , q 1 , r 1 p 2 , q 2 , r 2 a1 b1 c1 b1 c1 a1 c1 b1 a1 c1 a1 b1 d T 1 p 0 , q 0 , r 0 p 1 , q 0 , r 0 p 1 , q 1 , r 0 p 1 , q 1 , r 1 p 2 , q 2 , r 2 a1 b1 c1 d T r 1 Figure 2
.9: A transition system and a reduced transition system Consider a network of n processes with k states each. If the network is such that each action of a process is completely independent of the actions of any other process of the network (in the sense that no action in the network requires participation of more than one process), then the resultant product automaton has k n states. While applying partial order reduction, the idea is that the state space of the original transition system grows exponentially w.r.t. the number of components in the network, while that of the reduced transition system is expected to grow at a lower rate. Indeed, in the example of network given in Figure 2.8, if we increase the number of processes, the size of the reduced transition system only grows linearly w.r.t. the number of components in the network. In general, the magnitude of the reduction depends on the extent of independence between actions in the network. Nevertheless, even if we do not always observe a massive reduction in state space, the reduction obtained by partial order methods is crucial to design efficient verification procedures for networks containing several components.

In the next section, we introduce some basic principles of partial order reduction methods.

Principles of partial order reduction

The goal of this section is to explain the fundamental principles of partial order reduction methods.

We are interested in the reachability problem for a network of processes, defined as follows.

Input: a network of processes N Output: Yes, if there is a path from an initial state of T N to a final state;

No, otherwise A standard solution to this problem is by an on-the-fly exploration of T N starting from the initial state. As mentioned in the introduction of this chapter, this solution is not scalable and partial order reduction is one of the standard ways to alleviate the issue of scalability. The goal of partial order reduction is to identify a small part of T N , whose exploration is sufficient to verify the system. The idea is that executions of T N can be classified into equivalence classes based on the property to be verified, and it is sufficient to consider only a representative from each equivalence class. For example, in the network from Figure 2.9, all the executions of T 1 that go from (p 0 , q 0 , r 0 ) to (p 2 , q 2 , r 2 ) are equivalent w.r.t. reachability. So, to answer the reachability problem for this network, it is sufficient to explore only one of these executions. This means that it is sufficient to restrict the exploration of T to the part reachable via red edges. We refer to this smaller transition system T r whose exploration is sufficient as the reduced transition system.

We formalize these notions in the following definitions.

Definition 2.46 (Reduced Transition System). Let T = S, Σ, s 0 , -→, F be a transition system and let -→ r ⊆ -→ be a subset of the successor relation of T . We then define the reduced transition system induced by -→ r , denoted by T r , as the restriction of T to the states reachable from s 0 using only transitions in -→ r . Formally, T r is given by the tuple S r , Σ, s 0 , -→ r , F r , where S r is the smallest set such that s 0 ∈ S r , and if s ∈ S r and s a -→ r s for some a ∈ Σ, then s ∈ S r . The set of accepting states of T r is given by F r = S r ∩ F . We refer to the transition relation -→ r that generates T r as the reduced set of actions.

Next, we specify the conditions that should be satisfied by the reduced set of actions -→ r for the reduced transition system to be useful. Since we are interested in computing a reduced set that preserves the status of the reachability of the original transition system, we refer to our reduced sets as reachability-complete sets.

Definition 2.47 (Reachability-complete set). Consider a transition system T = S, Σ, s 0 , -→, F , a transition relation -→ r ⊆ -→ and the reduced transition system T r induced by -→ r . We say that -→ r is reachability-complete for T , if T r contains an accepting state whenever an accepting state is reachable from s 0 in T .

Observe that if no accepting state is reachable in T , then the above definition puts no restrictions on T r . Otherwise we require that at least one of the reachable accepting states is present in T r .

Corollary 2.3. Suppose that T = S, Σ, s 0 , -→, F is a transition system, and -→ r ⊆ -→ that is reachability-complete for T . For T r the reduced transition system induced by -→ r : T r has an accepting run if and only if T has an accepting run.

Next, we address the question of how such a reachability-complete set can be computed. Before doing this, it is necessary to formalize a few notions whose understanding is crucial for the design of a reachability-complete set.

Independence of actions:

We say that two actions are independent in a state of a transition system, if both the orders of execution of these actions are feasible from that state, and irrespective of the order in which they are executed, the same state is reached. Recall that if an action a is feasible from a state s, then we say that a is enabled from s. We formalize this notion as follows.

Definition 2.48 (Independence of actions [START_REF] Katz | Defining conditional independence using collapses[END_REF]). Let T be a transition system. Two actions a and b are said to be independent in T if they satisfy the following conditions for every state s of T : From the definitions, it should be clear that if two actions are independent, then they commute; in other words, the order in which they are executed does not matter. This leads us to our next definition. Definition 2.49. [Equivalent sequences [START_REF] Mazurkiewicz | Trace theory[END_REF]] We say that two sequences u and w are equivalent modulo independence, denoted u ∼ w if w can be obtained form u by repeatedly permuting pairs of adjacent independent actions. From the definition of independence, it is clear that if two sequences are equivalent modulo independence, both of them result in the same state. Thanks to this equivalence, if we are only interested in reachability, then we do not need to consider all the sequences; rather, it is enough to consider a representative from each equivalence class.

Let T be a transition system, and let -→ r be the subset of its transitions. Consider a reduced transition system T r restricted to states that are reachable from the initial state via -→ r edges. If we have the guarantee that for each execution sequence of T , there is an equivalent execution sequence in T r , then we know that T r has an accepting run if and only if T has an accepting run. This implies that -→ r is reachability-complete and therefore, it suffices to explore the reduced transition system T r to answer the reachability problem for T . The various partial order reduction methods, such as Stubborn sets by Valmari [START_REF] Valmari | A stubborn attack on state explosion[END_REF][START_REF] Valmari | Stubborn sets for reduced state space generation[END_REF], Ample sets by Peled [START_REF] Doron | All from one, one for all: on model checking using representatives[END_REF][START_REF] Doron | Combining partial order reductions with onthe-fly model-checking[END_REF] and Persistent sets by Godefroid [START_REF] Godefroid | Using partial orders to improve automatic verification methods[END_REF][START_REF] Godefroid | Partial-Order Methods for the Verification of Concurrent Systems -An Approach to the State-Explosion Problem[END_REF], give ways to compute such -→ r .

Chapter 3

Local time semantics

As discussed in Chapter 2, the most widely used approach to solve the reachability problem for networks of timed automata is by the computation and exploration of a finite truncation of the offset zone graph of the network. We point out that this approach suffers severely from state-space explosionas the number of components in the network increases, the number of nodes in the offset zone graph of the network grows exponentially. As a result, for large networks of timed automata which contain several components, this standard approach to check reachability is not effective. In this chapter, we first analyze this explosion of state space for offset zone graphs of networks of timed automata. We show that the state-space explosion, which was already severe for untimed networks, is compounded by the timing information of clocks that is stored in the states of timed automata. As a consequence, the magnitude of explosion for timed networks is worse than that for untimed networks.

To tackle the challenge posed by state-space explosion, application of partial order reduction techniques to the offset zone graph of networks of timed automata seems to be an appealing proposition. An effective method to compute the independence relation (see Definition 2.48) between actions of the network is a crucial precondition for developing partial order reduction techniques for the verification of the network. For networks of untimed automata, disjointedness of domain gives such an effective check for independence that is easily computable. Unfortunately, we show that this idea does not work for networks of timed automata. We mention that we do not know of any effective way to compute the independence relation between actions of a network of timed automata.

As a workaround, we consider an alternate semantics for networks of timed automata, namely the local time semantics. The goal of this chapter is to introduce local time semantics for networks of timed automata. We will present the basic operations of local time semantics and show some basic properties of these operations. We will also discuss some properties of runs in this semantics, using which we highlight the differences between local time semantics and the standard semantics. We will show that these properties make local time semantics a more apt setting to apply partial order reduction. Finally, we will show that as far as reachability of a state of the network is concerned, local time semantics is equivalent to the standard semantics. In later chapters, we will use local time semantics to develop an alternate, more scalable procedure for the reachability problem of networks of timed automata.

Remark. In order to clearly distinguish between local time semantics and the standard semantics, we refer to the standard semantics as global semantics. Extending this convention, we sometimes refer to offset valuations, offset zones and offset zone graph as global valuations, global zones and global zone graph, respectively.

State-space explosion for networks of timed automata

Recall that we had discussed the challenge posed by state-space explosion to the verification of networks of (untimed) processes in Section 2.10. Observe that in the product automaton of a network of untimed processes, different interleavings of the same sequence lead to the same state. For example, in the transition system T 1 from Figure 2.9, from the state (p 0 , q 0 , r 0 ), the sequences abc, bca and cab all lead to the same state (p 2 , q 2 , r 2 ). Unfortunately, this is not the case in global zone graphs of networks of timed automata as various timing information, such as the order of reset of clocks, is stored in the zones. We now illustrate this using an example.

p 0 p 1 q 0 q 1 r 0 r 1 a {x} b {y} c {z} A 1 A2 A3 Figure 3.1: Network A ×
Consider the network of timed automata given in Figure 3.1 and the global zone graph of this network given in Figure 3.2. Note that in the network a, b and c are actions local to timed automata A 1 , A 2 and A 3 respectively. Observe that the zone reached on executing an ordering of these actions is different from the zone reached on executing a different ordering. For instance, the run abc resets clocks in the order x before y before z, while the run cab resets clocks in the order z before x before y. This implies that the valuations of the offset zone reached via the sequence abc satisfy the constraint x ≤ y ≤ z, while the valuations of the offset zone reached by the sequence cab satisfy the constraint z ≤ x ≤ y. In this way, each execution of a different ordering of actions a, b, c leads to a different zone, as can be observed from Figure 3.2. Note that in an untimed version of this network, we would have only one instance of the state (p 1 , q 1 , r 1 ) in the product automaton. (see Figure 1.4.) On the other hand, in the global zone graph from Figure 3.2, we have six nodes with state (p 1 , q 1 , r 1 ), one per each possible ordering of clocks {x, y, z}. This illustrates that the problem of state-space explosion is much more severe for networks of timed automata.

(p0, q0, r0) x = y = z (p1, q0, r0) x ≥ y = z (p0, q1, r0) y ≥ x = z (p0, q0, r1) z ≥ x = y (p1, q1, r0) y ≥ x ≥ z (p1, q0, r1) z ≥ x ≥ y (p1, q1, r0) x ≥ y ≥ z (p0, q1, r1) z ≥ y ≥ x (p1, q0, r1) x ≥ z ≥ y (p0, q1, r1) y ≥ z ≥ x (p1, q1, r1) z ≥ y ≥ x (p1, q1, r1) y ≥ z ≥ x (p1, q1, r1) z ≥ x ≥ y (p1, q1, r1) x ≥ z ≥ y (p1, q1, r1) y ≥ x ≥ z (p1, q1, r1) x ≥ y ≥ z

Why local time semantics?

From the discussion in Section 3.1, it is clear that to have effective verification procedures for large networks of timed automata, we need to have a strategy to combat the blow-up of state space. As we have seen in Section 2.10, partial order reduction is one such technique. An effective way to compute the independence relation between actions is crucial to apply partial order reduction to the transition system.

For networks of untimed systems we have a syntactic check that gives an over-approximation of the independence relation between actions in the network. Recall that we say that two actions a and b have disjoint domains if the set of processes participating in actions are disjoint, i.e., dom(a) ∩ dom(b) = ∅. The following lemma shows that disjointness of domain can be used as an approximation of the independence relation. The proof follows by definitions.

Lemma 3.1. For every pair of actions a, b of a network of processes, if a and b have disjoint domains, then a and b are independent.

It is tempting to see if the aforementioned simple syntactic check gives us a sufficient condition for independence of actions in networks of timed automata as well. Unfortunately, it turns out that this check cannot be extended to the networks of timed automata. We illustrate this using the example of a network A which contains two timed automata, A 1 and A 2 , as given in Figure 3.3. The action a is a local action of A 1 and b is a local action of A 2 . Observe that while the sequence ab is feasible in A, the sequence ba is not feasible. Thus, even if two actions belong to different components, they are not independent in networks of timed automata.

p 0 p 1 q 0 q 1 A 1 A 2 A = A 1 × A 2 a x ≤ 1 b y ≥ 2 (p0, q0) x = 0, y = 0 (p1, q0) x = 0, y = 0 (p0, q1) x = 2, y = 2 (p1, q1) x = 2, y = 2 δ = 0 a δ = 2 b δ = 2 b x ≤ 1 a X Figure 3.3: Actions with disjoint domains are not independent in A.
The reason for this difference can be interpreted as follows. Recall that an action transition only changes the state and clock values of the components participating in it. Since we do not permit shared clocks in our networks of timed automata, the value of a clock of a component cannot be modified by an action of another component. Thus, in a network of timed automata, the independence relation involving only action transitions is similar to the untimed case, i.e., two action transitions are independent if the set of automata participating in these transitions are disjoint. The independence relation involving only delay transitions is also quite natural. Since a delay transition changes the value of all the clocks in the network by the same rate, any two delay transitions are mutually independent. However, when we consider the independence relation between an action transition and a delay transition, things get more complicated. Both the action transition and the delay transition could potentially alter the value of a clock of an automaton participating in the action. Therefore, there is a dependency between delay transitions and action transitions.

We will now formalize the ideas that are discussed above. We first state when two executions of a network of timed automata are considered equivalent.

Definition 3.1. We say that two sequences of actions u and w are equivalent, written u ∼ w, if u can be obtained from w by repeatedly permuting adjacent actions with disjoint domains.

The following lemma shows that if two equivalent sequences are enabled in a network of timed automata, they lead to the same state.

Lemma 3.2. For two equivalent sequences u ∼ w: if there are two runs (q, v) u -→ (q u , v u ), and (q, v) w -→ (q w , v w ), then q u = q w . Proof. Consider the basic case when there are two actions a and b with disjoint domains and u = ab, w = ba. Since a and b are on disjoint processes, executing ab or ba (whenever possible) leads to the same (discrete) state by definition.

Consider a general u. Sequence w is obtained by repeatedly permuting adjacent actions. From the basic case of the lemma, each permutation preserves the source and target (discrete) states, if it is feasible.

Observe that in the statement of Lemma 3.2, we cannot assert that v u = v w . Even further, the existence of the run (q, v) u = =⇒ (q u , v u ) does not imply that a run from (q, v) on w is feasible. As already discussed, this happens due to global time delays, i.e., delays that involve all the processes. For example, consider a network of timed automata A as given in Figure 3.3. The network has actions a having guard x ≤ 1 and b having guard y ≥ 2 in process A 1 and A 2 , respectively. Observe that from the initial valuation one can execute ab but not ba. This illustrates that, unlike for untimed networks, disjointness of domain does not imply independence in networks of timed automata.

To summarize, since the elapse of time in each process is synchronized at all points of time, there are implicit dependencies between actions of different processes, induced by the global nature of time. If the elapse of time is decoupled, then we may be able to recover commutativity between actions with disjoint domains.

We consider local time semantics as an alternate semantics for networks of timed automata that satisfies this requirement. Introduced by Bengtsson et al. in 1998 [BJLY98], in this semantics, time elapses independently in each process. Whenever a set of processes execute a synchronized action (see Definition 2.8) the reference times of all these processes are synchronized. This way, two actions with disjoint domains become commutative.

Consider the example of the network from Figure 3.3. Recall that the run ba was not feasible in the standard semantics of the network. Observe that in local time semantics, while the process A 2 executing b elapses 2 time units, A 1 is allowed to not elapse time at all. As a consequence, the run ba becomes feasible. The local runs are as shown in Figure 3.4.

p 0 p 1 q 0 q 1 A 1 A 2 A = A 1 × A 2 a x ≤ 1 b y ≥ 2 (p0, q0) x = 0, y = 0 (p1, q0) x = 0, y = 0 (p0, q1) x = 0, y = 2 (p1, q1) x = 0, y = 2 δ1 = 0 a δ2 = 2 b δ2 = 2 b δ1 = 0 a

Local valuations

Recall the definition of offset valuations in Definition 2.10. As in the case of offset valuations, we choose an offset representation for local valuations, the reasons for which we will discuss later. Thus, for each clock x, we have an offset variable x that stores the time-stamp at which x was last reset. We replace the reference clock t which was tracking the global time, with individual reference clocks t p for each process A p which track the local time of each process. We set X p = X p ∪ {t p } and X = p X p .

Definition 3.2. A local valuation v is a valuation over the set of clocks X such that v( x) ≤ v(t p ) for all processes p ∈ Proc and all clocks x ∈ X p .

This restriction captures the intuition that t p is a reference clock for process p, and it is never reset. In this setting, the value v(t p ) -v( x) of clock

x is defined relative to the reference clock t p of process p such that x ∈ X p . We will use the notation v for local valuations to distinguish from standard valuations v and offset valuations v. We will sometimes write v(x -y) to denote v(x) -v(y).

We formally define the operations in local time semantics below.

• Local-time elapse: For a process p ∈ Proc and δ ∈ R ≥0 , the operation v + p δ increments v(t p ), the value of the reference clock t p of process p by δ, and leaves all the other variables unchanged. Formally,

(v + p δ)(t p ) = v(t p ) + δ (v + p δ)(x) = v(x) for all x ∈ X \ {t p }
• Reset: We denote by [R]v the valuation obtained after resetting the clocks in R ⊆ X and defined by:

([R]v)(t p ) = v(t p ) for all reference clocks t p ([R]v)( x) = v(t p ) if x ∈ R and x ∈ X p = v( x) otherwise
Consider a local valuation v of a network of two timed automata A 1 and A 2 , such that x is the clock of A 1 and y is the clock of A 2 .

v : t 1 = 4, x = 0, t 2 = 4, y = 2
The valuation v obtained on reset of clock x is as given below.

v : t 1 = 4, x = 4, t 2 = 4, y = 2 • Guard satisfaction: A local valuation v satisfies a clock constraint g, denoted v |= g if each constraint in g holds upon replacing x by value v(t p ) -v( x)
where p is the process such that x ∈ X p .

Next, we define the notion of a synchronized local valuation, sometimes simply referred to as synchronized valuation.

Definition 3.3. A local valuation v is synchronized if for every pair of processes p 1 , p 2 , the values of their reference clocks are equal:

v(t p 1 ) = v(t p 2 ). For a synchronized local valuation v, let global(v) be the offset valuation v such that v( x) = v( x) for all offset clocks x ∈ X and v(t) = v(t 1 ) = • • • = v(t k ).
Conversely, to every offset valuation v, we associate the synchronized local valuation local(v) = v where v( x) = v( x) and v(t p ) = v(t) for every reference clock t p .

We now state Lemma 3.3 that relates the operations on synchronized local valuations to operations on offset valuations. Lemma 3.3. Suppose v is a synchronized local valuation and v = global(v). Then, we have the following:

• v |= g iff v |= g. • Let v = [R]v and v = [R](v). Then, v = global(v ). • Let v = v + δ, and v = v + p δ, for all processes p ∈ P roc. Then, v = global(v ).
Proof. The first item follows from the definitions of guard satisfaction for local valuations and offset valuations.

For the second item, we know that v (t) = v(t), and v

( x) = v( x) if x ∈ R and v ( x) = v (t) otherwise. We also have v (t p ) = v(t p ), for all reference clocks t p and v ( x) = v( x), if x ∈ R and v ( x) = v (t p ), where x ∈ X p , otherwise. Then, we observe that if x ∈ R, v ( x) = v( x) = v ( x). If x ∈ R, v (x) = v (t p ) = v(t p ) = v(t) = v (t). Thus, we have v = global(v ).
For the third item, we know that v (t) = v(t) + δ, and v ( x) = v( x) for all offset clocks x. About v , we know v (t p ) = v(t p ) + δ, for all reference clocks t p . Since v was synchronized, we know that v is too, and since v = global(v), we have global(v

)(t) = v(t) + δ. Further, v ( x) = v( x) = v( x) = v ( x)
for all offset clocks x. Thus, we have v = global(v ).

We now define the local step of a network of timed automata.

delay δ ∈ R ≥0 in process p ∈ P roc is a step (q, v) p,δ --→ st (q, v + p δ). For an action b, we have a step (q, v) b - -→ st (q , v ) if for each p ∈ dom(b) the unique b transition of p is T p (b) = (q(p
), g p , R p , q (p)), and the following hold:

• start times are synchronized: v(t p 1 ) = v(t p 2 ), for each p 1 , p 2 ∈ dom(b);
• guards are satisfied: v g p , for each p ∈ dom(b);

• resets are performed: v = [ p∈dom(b) R p ]v;
• other processes do not move: q(p) = q (p), for each p ∈ dom(b).

The main difference between local time semantics and global semantics is the presence of local delay. As a result, each process can be in a different local time as emphasized by the reference clocks in each process. In consequence, in local action steps we require that, when processes execute a common action, their local times should be the same. We will now give some examples of local steps. Consider the network A given in Figure 3.5. Consider the following run σ of A,

(s 0 , r 0 , v 0 ) p 1 ,δ 1 ---→ (s 0 , r 0 , v 1 ) a -→ (s 0 , r 1 , v 2 )
In this run, (s 0 , r 0 , v 0 )

p 1 ,δ 1 ---→ (s 0 , r 0 , v 1 ) is a local delay step and (s 0 , r 0 , v 1 ) a -→ (s 0 , r 1 , v 2 ) is a local action step.
Observe that a standard delay δ on all processes can be simulated by a sequence of local delays on every process separately, as

1,δ --→ st • • • k,δ --→ st . For a sequence of local delays ∆ = (p 1 , δ 1 ) . . . (p n , δ n ) we will write (q, v) ∆ - -→ st (q, v ) to mean (q, v) p 1 ,δ 1 ---→ st (q, v 1 ) p 2 ,δ 2 ---→ st • • • (pn,δn) ----→ st (q, v ). Definition 3.5 (Local run). A local run from a configuration (q 0 , v 0 ) is a sequence of local steps. For a sequence of actions u = b 1 . . . b n , we write (q 0 , v 0 ) u - -→ (q n , v n ) if for some sequences of local delays ∆ 0 , . . . , ∆ n there is a local run (q 0 , v 0 ) ∆ 0 --→ st (q 0 , v 0 ) b 1 - -→ st (q 1 , v 1 ) ∆ 1 --→ st • • • bn - -→ st (q n , v n ) ∆n --→ st (q n , v n )
Observe that a run may start and end with a sequence of delays.

Independence in local time semantics

In this section, we will discuss some properties of runs in local time semantics. We will compare and contrast local runs and global runs, and show that local runs have a key independence property that is not true for global runs. First, we will show that, in contrast to global semantics, in local time semantics, two actions with disjoint domains satisfy the conditions for independence between actions.

Lemma 3.4 (Independence). Suppose that dom(a)∩dom(b) = ∅. If (q, v) ab - -→ (q , v ), then (q, v) ba - -→ (q , v ). If (q, v) a - -→ (q a , v a ) and (q, v) b - -→ (q b , v b ), then (q, v) ab - -→ (q ab , v ab ) for some q ab and v ab . Proof. Take a run (q, v) ∆a --→ (q, v a ) a - -→ (q a , v a ) ∆ b --→ (q a , v b ) b - -→ (q , v b ) ∆ - -→ (q , v ).
Let ∆ b be the sequence of delays from ∆ a or ∆ b involving processes in dom(b), i.e., pairs (p, δ p ) from ∆ a or ∆ b such that p ∈ dom(b). Let ∆ a be a sequence of delays in ∆ a involving processes in dom(a); and finally let ∆ be the delays in ∆ a ∪ ∆ b ∪ ∆ which were not counted in ∆ a or ∆ b . Since dom(a) ∩ dom(b) = ∅ we get that the following sequence is a run:

(q, v) ∆ b --→ (q, v b ) b - -→ (q b , v b ) ∆ a --→ (q , v a ) a - -→ (q , v a ) ∆ --→ (q , v ).
For the second part, suppose that we have the sequences (q, v)

∆a --→ a - -→ ∆ a --→ (q a , v a ) and (q, v) ∆ b --→ b - -→ ∆ b --→ (q b , v b ).
Let ∆ 1 be the delays involving processes in dom(a) in ∆ a , and ∆ 2 the delays of processes in dom(b) in ∆ b . As

dom(a) ∩ dom(b) = ∅, (q, v) ∆ 1 --→ a - -→ ∆ 2 --→ b - -→ (q ab , v ab ) is a local run.
We illustrate the independence of actions with disjoint domains using an example, given in Figure 3.5. Observe that the network is the same as that in Figure 3.3. From the runs shown, it can be seen that in local time semantics, both ab and ba are feasible. This is in contrast with the global semantics where the sequence ba is not feasible.

s 0 s 1 r 0 r 1 a x ≤ 1 b y ≥ 2 p 1 p 2 A = p 1 × p 2 (s0, r0) t1 = 0, x = 0 t2 = 0, y = 0 (s1, r0) t1 = 1, x = 0 t2 = 0, y = 0 (s0, r1) t1 = 0, x = 0 t2 = 2, y = 0 (s1, r1) t1 = 1, x = 0 t2 = 2, y = 0 δ1 = 1 a δ2 = 2 b δ2 = 2 b δ1 = 1 a
Local run of A with local valuations Recall that two sequences of actions are equivalent, written u ∼ w if one can be obtained from the other by repeatedly permuting adjacent actions with disjoint domains (see Definition 3.1). Directly from Lemma 3.4, we obtain Lemma 3.5.

If (q 0 , v 0 ) u - -→ (q n , v n ) and u ∼ w, then (q 0 , v 0 ) w - -→ (q n , v n ).
Proof. Since u ∼ w, we know that w can be obtained from u by repeatedly permuting adjacent actions with disjoint domains.

Let the local run u be of the form

(q 0 , v 0 ) b 1 - -→ (q 1 , v 1 ) b 2 - -→ • • • (q i-1 , v i-1 ) b i - -→ (q i , v i ) b i+1 ---→ (q i+1 , v i+1 ) • • • bn - -→ (q n , v n )
Suppose that b i+1 is the first action of w. We know from the definition of ∼ that for 0 ≤ k ≤ i, b k and b i+1 have disjoint domains. By repeatedly applying Lemma 3.4, we can commute b i+1 with b i , b i-1 and so on up to b 1 . After doing this, we obtain a local run of the following form:

(q 0 , v 0 ) b i+1 ---→ (q 1 , v 1 ) b 1 - -→ • • • (q i-1 , v i-1 ) b i-1 ---→ (q i , v i ) b i - -→ (q i+1 , v i+1 ) • • • bn - -→ (q n , v n )
Since u ∼ b i+1 u and w = b i+1 w , we can use induction for the pair u ∼ w to obtain a run on w from (q 1 , v 1 ) to (q n , v n ).

Thus, in local time semantics, if a run u exists from (q 0 , v 0 ) and u ∼ w, then w is guaranteed to exist. Recall that w need not be feasible in global semantics. Further, the two equivalent sequences not only reach the same state q n , but also the same local valuation v n (again in contrast with Lemma 3.2 for global-time semantics).

Equivalence of local and global runs

We show below that, despite local runs having much more freedom than global runs (as time can elapse independently in every process), with respect to state reachability, the two concepts turn out to be equivalent.

Remark.

In order to distinguish between steps in global semantics and local time semantics, we denote transitions in local time semantics by --→, while transitions in global semantics are denoted by = =⇒.

Before we prove the equivalence between global and local runs, we develop some intermediate observations.

Every action step in a local run:

(q 0 , v 0 ) ∆ 0 --→ st (q 0 , v 0 ) b 1 - -→ st (q 1 , v 1 ) . . . ∆ n-1 ----→ st (q n-1 , v n-1 ) bn - -→ st (q n , v n ) ∆n --→ st (q n , v n )
has its execution time; namely the step

(q i-1 , v i-1 ) b i - -→ st (q i , v i ) has the execution time v i-1 (t p ) = v i (t p ) for p ∈ dom(b i ).
Observe that by definition of a step, the choice of p does not matter, as long as p is in the domain of b i .

We will say that a local run is soon if for every i, the execution time of b i is not bigger than the execution time of b i+1 . Lemma 3.6.

If (q 0 , v 0 ) u - -→ (q n , v n ) is a local run, then there is w ∼ u such that (q 0 , v 0 ) w - -→ (q n , v n ) is a soon local run.
Proof. Consider a sequence u = b 1 . . . b n and a run (q 0 , v 0 )

∆ 0 --→ st (q 0 , v 0 ) b 1 - -→ st (q 1 , v 1 ) • • • ∆ n-1 ----→ st (q n-1 , v n-1 ) bn - -→ st (q n , v n ) ∆n --→ st (q n , v n ).
, v 0 ) u - -→ (q n , v n ).
We can, if necessary, repeat this operation from u till we get the desired w.

Lemma 3.7. If (q, v) u --→ (q , v ) is a local run where v and v are synchronized valuations, then there is w ∼ u and a global run (q, global(v))

w = =⇒ (q , global(v )).
Proof. Let (q, v) = (q 0 , v 0 ) and (q , v ) = (q n , v n ). We take a local run, and assume that it is soon thanks to Lemma 3.6:

(q 0 , v 0 ) ∆ 0 --→ st (q 0 , v 0 ) b 1 - -→ st (q 1 , v 1 ) ∆ 1 --→ st • • • • • • (q n-1 , v n-1 ) ∆ n-1 ----→ st (q n-1 , v n-1 ) bn - -→ st (q n , v n ) ∆n --→ st (q n , v n ) .
Let θ i be the execution time of action b i . For convenience, we set θ 0 = v 0 (t p ) and θ n+1 = v n (t p ), for some process p. Since v 0 and v n are synchronized, the choice of p is irrelevant. We claim that there is a global run (q 0 , v 0 )

δ 1 = =⇒ st b 1 = =⇒ st (q 1 , v 1 ) δ 2 = =⇒ st b 2 = =⇒ st • • • δ i = =⇒ st b i = =⇒ st (q i , v i ) with • v 0 = global(v 0 ) • δ i = θ i -θ i-1 for i = 1, . . . , n • v i (t) = v i (t p )
for some p ∈ dom(b i ) and

• v i ( x) = v i ( x) for all other clocks x
This statement is proved by induction on i. For i = n, this statement gives an offset valuation v n such that v n (t) = v n (t p ) where p ∈ dom(b n ) and for all other clocks v n ( x) = v n ( x). Note that valuations v n and v n differ only in the values of the reference clocks. Moreover, in v n , all reference clocks are at θ n+1 . A global delay of

δ n+1 = θ n+1 -θ n from (q n , v n ) gives (q n , v n ) such that v n = global(v n ). Lemma 3.8. If (q, v) u = =⇒ (q , v ) is a global run, then there is a local run (q, local(v)) u - -→ (q , local(v )).
Proof. A global run can be directly converted to a local run by changing a global delay to a sequence of local delays.

From Lemma 3.7 and Lemma 3.8, we get the following lemma. Lemma 3.9. If (q, v) u --→ (q , v ) is a local run where v and v are synchronized local valuations, there exists a global run (q, global(v))

w = =⇒ (q , global(v )) for some w ∼ u. Conversely, if (q, v) u = =⇒ (q , v ) is a global run, then there is a local run (q, local(v)) u - -→ (q , local(v )).
The reachability problem with respect to local time semantics is defined as before: q is reachable if there is a local run (q 0 , v 0 ) u --→ (q, v) for some v where v 0 = local(v 0 ). Note that here, q 0 and v 0 denote the initial state and the initial (local) valuation respectively. By adding some local delays at the end of the run we can always assume that v is synchronized. Lemma 3.9 thus implies that the reachability problem in local time semantics is equivalent to the standard one in global semantics.

Chapter 4

Local zone graph

In Chapter 3, we introduced the local time semantics for networks of timed automata. The goal of this chapter is to introduce concepts analogous to global zones (Definition 2.30) and global zone graphs (Definition 2.34) for the setting of local time semantics.

We first show that it is not possible to represent sets of valuations obtained via runs in the local time semantics using the standard representation of zones. This is because the standard representation of zones is not compatible with the operations of local time semantics (specifically, the local time elapse operation) as illustrated in Lemma 4.1. This means that we need a different representation of zones to represent sets of local valuations. To this end, we introduce the notion of local zones, which uses difference constraints involving offset clocks and reference clocks. We show that local zones are closed under the operations of local time semantics.

We then introduce the concept of local zone graph as the analogue of the global zone graph for the setting of local time semantics. Two sequences are said to be equivalent if one can be obtained from the other by commuting adjacent actions with disjoint domains. We show that in the local zone graph, actions that have disjoint domains satisfy the diamond property (see Definition 2.48.) Extending this observation, we show that local zone graphs satisfy the following very useful property: if a sequence of actions is feasible from a node of the local zone graph, then all sequences equivalent to this sequence are feasible from that node, and moreover, they all lead to the same node. This suggests that as in the case of untimed networks, in local zone graphs, disjoint domains can be used as a condition for independence between actions. Since our goal is to apply partial-order reduction to networks of timed automata, the aforementioned property gives us incentive to use local zone graphs over global zone graphs to answer the reachability problem. However, we point out that the local zone graph may be infinite and so cannot be used directly to check reachability of networks of timed automata.

The results in this chapter appeared in [START_REF] Govind | Revisiting local time semantics for networks of timed automata[END_REF]. 85

Why local zones?

The Proof. Consider a set of clocks X = {x 1 , t 1 , x 2 , t 2 }, and a zone Z defined by the following constraints:

t 1 = t 2 , x 1 = x 2 , x 1 ≤ t 1 , x 2 ≤ t 2
The last two constraints ensure that Z contains only local valuations. Note that there is a network of timed automata where Z can indeed be reached from the initial valuation.

Consider the set D of local valuations obtained after a local delay from some valuation in Z. It is easy to see that each valuation in D satisfies the constraint t 1 -x 1 = t 2 -x 2 since Z satisfies this constraint, and the constraint is invariant under local time elapse. We cannot use this constraint directly to define a zone, since it is not of the form y 1 -y 2 c.

Suppose that D is a zone. We consider the constraints of the form y 1 -y 2 c that are satisfied in D.

• No constraint of the form y -0 c can be true for all valuations in D, since Z contains valuations with arbitrary big values for each variable y ∈ X.

• A constraint of the form 0 -y c can be true only if c ≥ 0. Indeed, this constraint translates to -c y, and D could have a valuation with arbitrary small values of y. As a consequence, D satisfies a trivial constraint y ≥ 0.

• Constraints t i -x i c cannot hold in D, as the value of t i can be arbitrarily bigger than the value of x i .

• A constraint x i -t i c holds in D only if c ≥ 0, since the difference between x i and t i can be arbitrarily small in Z.

• All the remaining constraints are of the form y j -y i c with y i ∈ {x i , t i }, y j ∈ {x j , t j }, and i = j. None of them can hold because local time elapse can make this difference arbitrarily big.

This implies that the only zone constraints satisfied by D are x i ≤ t i . However, these constraints do not imply t 1 -x 1 = t 2 -x 2 . As a consequence, D cannot be a zone. Thus, it is not possible to use the standard representation of zones to represent local time transitions.

Local zones

In this section, we will introduce local zones to represent sets of local valuations. As demonstrated using Lemma 4.1, the standard method of storing difference constraints between clocks is not sufficient to capture all the operations of local time semantics. So, we will adopt an offset representation of clock valuations to store sets of local valuations, where for each clock x, we have an offset clock x that stores the time-stamp at which x was last reset. Local zones are defined by difference constraints involving offset clocks and reference clocks.

Remark. Local zones can be viewed as the offset representation of standard zones extended to the setting of local time semantics. The main difference is that since the progress of time is synchronized in global semantics, offset zones uses only one reference clock t. Since the progress of time is decoupled in local time semantics local zones use a reference clock t p for each process A p in the network.

We now formally define local zones. Recall that

X p = { x | x ∈ X p }, X p = X p ∪ {t p } and X = p X p .
Definition 4.1. A local zone is a zone over local valuations: a set of local valuations defined by constraints y 1 -y 2 c where y 1 , y 2 ∈ X .

Recall that a local valuation v satisfies v( x) ≤ v(t p ) for each process p and each x ∈ X p . We denote local zones using the notation Z along with subscripts or superscripts, to distinguish from standard zones and offset zones. We say that a local valuation v belongs to Z, written as v ∈ Z, if v(y 1 ) -v(y 2 ) c for each constraint y 1 -y 2 c of Z. We say that a zone Z is said to be in canonical form if each constraint defining Z is tight.

We say that two local valuations v 1 and v 2 are same up-to time shift, denoted as v 1 ∼ ts v 2 , if v 1 (x -y) = v 2 (x -y) for all x, y ∈ X . The following lemma establishes that local zones are closed under time shift. Lemma 4.2. For each local zone Z, and local valuations v 1 ∼ ts v 2 which are same up-to time shift,

v 1 ∈ Z iff v 2 ∈ Z. Proof. Since v 1 (x -y) = v 2 (x -y) for all pairs of clocks, valuation v 1 satisfies a constraint x -y c iff v 2 satisfies it.
Recall the distance graph representation for offset zones discussed in Definition 2.32. We have similar notions of distance graph for local zones also. Recall that a distance graph is said to be in canonical form if for each pair of variables y 1 , y 2 , the shortest path from y 2 to y 1 is given by the weight of the edge y 2 → y 1 . Sometimes, we use the term removing an edge y 2 → y 1 from G to mean that the value of this edge is assigned as (<, ∞). Given two distance graphs G 1 , G 2 , we write min(G 1 , G 2 ) for the graph where each edge weight is the minimum of the corresponding weights from G 1 and G 2 . For a distance graph G, we write [[G]] for the set of solutions to the constraints given by G. We have

[[min(G 1 , G 2 )]] = [[G 1 ]] ∩ [[G 2 ]].

Operations on local zones

We now define the following operations on local zones, corresponding to the basic operations of local time semantics namely local time elapse, intersection with a guard, and reset of clocks:

• local-elapse(Z) = {v + p δ p : v ∈ Z, δ p ∈ R ≥0 } where delay is applied for each process p,

• Z g = {v | v g}, • [R]Z = {[R]v | v ∈ Z} for every R ⊆ X.
We will show that local zones are closed under all these operations.

Lemma 4.3. For a local zone Z, the set local-elapse(Z) is a local zone.

Proof. We define the following operation on distance graphs: local-elapse(G) is a distance graph obtained from distance graph G by removing all edges y → t p where y ∈ X and t p is a reference clock. Note that these edges are the incoming edges to reference clocks. Let G Z be the canonical distance graph of Z. We will prove that the distance graph local-elapse(G Z ) is the canonical distance graph representing local-elapse(Z).

For notational convenience we will consider an operation of time elapse for one process, say A p . Then, the time-elapse operation local-elapse is a composition of time elapse for all processes A p .

We consider the set

Z + = {v + p δ p : v ∈ Z, δ p ∈ R ≥0 }
and the distance graph G + obtained from G Z by removing all incoming edges to t p .

First observe that G + is canonical. This means that the value of each edge x → y in G + is the minimum over the paths from x to y. If y is not a reference clock, then this is straightforward, as all paths from x to y in G + exist also in G Z and G Z is canonical. If y is a reference clock (say t p ), then there are no paths arriving at t p , so indeed the value of the shortest path from x to t p is ∞.

The inclusion

Z + ⊆ [[G + ]] is direct.
Each valuation in Z + satisfies all the constraints given by the edges of G Z except for the edges x → t p .

It remains to prove [[G + ]] ⊆ Z + . Consider a v + in Z + . Consider two quantities: Consider v that is identical to v + on all clocks but for t p , for which we set v(t p ) = v + (t p ) -d. In other words v + = v + p d. We find it convenient to use the notation v = v +p d. It suffices to show that v ∈ Z, as this will imply v + ∈ Z + . Our choice of d ensures v(t p -x) xtp c xtp for all constraints coming from edges x xtp cxt p -----→ t p of G Z , and v(x -y) yx c yx corresponding to edges

d 1 = max{v + (t p ) -v + (x) -c xtp : x ≤cxt p ----→ y is a edge in G} d 2 = max{v + (t p ) -v + (x) -c xtp : x <cxt p ----→ y is a edge in G} Notice that quantity d 1 is considered over edges x
y yxcyx ----→ x for all x, y ∈ X \ {t p }. The problem is to show v(x -t p ) tpx c tpx for each x ∈ X \ {t p }. Equivalently we want to show: (≤, v(t p -x)) + ( tpx , c tpx ) ≥ (≤, 0) (4.1)
Let w be the variable which corresponds to the chosen d: that is, either d = d 1 = v + (t p -w) -c wtp and wtp =≤, or d = d 2 = v + (t p -w) -c wtp + ε and wtp =<. By our choice of v, we have:

v(t p -w) = c wtp if wtp is ≤ c wtp -ε if wtp is < (4.2)
Rewriting (4.1) in terms of w, we want to show:

(≤, v(t p -w)) + (≤, v(w -x)) + ( tpx , c tpx ) ≥ (≤, 0) (4.3)
We have already seen that v(x -w) wx c wx . Moreover, due to the canonicity of G Z , the weight ( wx , c wx ) of the edge w → x is smaller than or equal to the weight ( wtp , c wtp ) + ( tpx , c tpx ) of the path w → t p → x. This gives (≤, v(x -w)) ≤ ( wtp , c wtp ) + ( tpx , c tpx ). Adding (≤, v(w -x)) to both sides of this inequality results in:

(≤, 0) ≤ (≤, v(w -x)) + ( wtp , c wtp ) + ( tpx , c tpx ) (4.4)
Substitute the value of v(t p -w) from (4.2) to the left hand side of (4.3). When wtp is ≤, this substitution gives the right hand side of (4.3) and hence we can conclude the inequality (4.3). We are left with the case when wtp is <. In this case, the left hand side of (4.3) becomes (≤, c wtp -ε) + (≤, v(w -x)) + ( tpx , c tpx ). Here is where the choice of ε > 0 matters. Since wtp is <, (4.4) entails v(x-w)+c wtp +c tpx > 0 for every x ∈ X \ {t p }. Choose ε := 1 2 min{v(x -w) + c wtp + c tpx | x ∈ X \ {t p }}. With this choice, we have c wtp -ε + v(w -x) + c tpx > 0 thereby allowing us to conclude (4.3) also for this case.

Lemma 4.4. For each guard g, the set of local valuations satisfying g is a local zone.

Proof. The set of constraints defining the offset zone Z g is obtained by extending the set of constraints of Z with constraints t p -x ∼ c, for every constraint of the form x ∼ c in g, where x ∈ X p .

Lemma 4.5. For a set of clocks R, and a local zone Z, the set [R]Z is a local zone.

Proof. We will show that the set of local valuations obtained on applying the reset operation to a local zone continues to be a local zone. Let G Z be the canonical distance graph of Z. Note that we use the term removing an edge x → y from a distance graph to say that the value of this edge is assigned as (<, ∞). We say a path is lighter than another to indicate that the weight of the former path is less than the weight of the latter path. In the same spirit, we use the term lightest path from x to y to refer to the path with the minimum weight from x to y.

Let G 1 be the distance graph obtained by removing from G Z all edges involving x and adding the edges x (≤,0)

---→ t p and t p (≤,0)

---→ x, for each clock x ∈ R such that x ∈ X p . Let G 1 be the distance graph obtained by canonicalizing G 1 . We will show that the set of valuations defined by

G 1 is [R]Z, i.e., [[G 1 ]] = [R]Z.
Consider edges of the form y -→ z in G 1 , where y, z ∈ R. Notice that y and z could be reference clocks as well. We now show that the weight of such edges does not change from G Z to G 1 . First, observe that the first step in this transformation, i.e., removal of edges, cannot lead to lighter paths in distance graphs. Next, we inspect whether the newly added edges of weight (≤, 0) between x and t p (from x to t p and t p to x) where x ∈ R can contribute to a lighter path from y to z in G 1 . Suppose that there was a lighter path from y to z using such a newly added edge between x and t p . Consider the lightest such path from y to z.

• Suppose that the new lighter path used the x (≤,0) ---→ t p edge. Since there are no other incoming edges to x, the path cannot reach x without first going to t p . However, this would imply that this lighter path is of the

form y → • • • u → t p (≤,0) ---→ x (≤,0) ---→ t p → s → • • • z. Removing the part t p (≤,0) ---→ x (≤,0) ---→ t p of weight 0 yields a path y → • • • u → s → • • • z in G Z
whose weight is the same. But this is a contradiction, as we have taken the shortest path.

• Suppose that the new lighter path is of the form y →

• • • t p - → x - → u - → • • • - → z. Recall that the only outgoing edge from x in G 1 is to t p . As a consequence, if there is an edge x - → u in G 1 , it is because of a path x (≤,0)
---→ t p -→ u. But this implies that our path can be

rewritten as y - → • • • t p (≤,0) ---→ x (≤,0) ---→ t p - → u - → • • • - → z.
Using the same argument as in the previous case, we arrive at a contradiction. Thus, the weight of an edge y -→ z such that y, z ∈ R does not change from G Z to G 1 .

We will now show that

[[G 1 ]] = [R]Z [R]Z ⊆ [[G 1 ]]: Pick v ∈ [R]Z. We have v (t p ) = v(t p ) for all reference clocks t p , v (t p )-v ( x) = v(t p )-v( x) if x / ∈ R and x ∈ X p and v (t p )-v ( x) = 0 if x ∈ R and x ∈ X p . Observe that v satisfies all the constraints of G 1 . Hence, [R]Z ⊆ [[G 1 ]]. [[G 1 ]] ⊆ [R]Z: Consider a valuation v ∈ [[G 1 ]].
We construct a new distance graph G whose edges are as follows:

• For clocks x, y ∈ R, G has the edge x (≤,v(y-x))
-------→ y. Note that x and y could be reference clocks here.

• For clocks x ∈ R such that x ∈ X p , G has the edges t p (≤,v( x)-v(tp)) ---------→ x and x (≤,v(tp)-v( x))
---------→ t p .

• For clocks x ∈ R, there are no edges involving x in G . This signifies that the weight of such an edge is (≤, ∞).

Notice that v ∈ [[G ]]. Also, observe that G is a canonical zone.
Observe that a solution to G Z ∩ G gives a valuation v such that v ∈ Z and v is obtained by a reset from v , and hence will imply v ∈ [R]Z. Now, we need to show that G Z ∩ G is non-empty. Suppose that there is a negative cycle in G Z ∩ G . Since there were no negative cycle in G Z or G , the new negative cycle should contain edges from both G Z and G . Further, since both G Z and G are canonical, the negative cycle should alternate between edges of G Z and G .

Consider an edge x -→ y, where x, y ∈ R. Recall that the weight of such an edge does not change from

G Z to G 1 . Since v ∈ [[G 1 ]], we know that v(y) -v(x) ≤ c, (4.5)
where (≤, c) is the weight of the edge x -→ y in G Z . Further, observe that the weight of the edge x -→ y in G has weight v(y) -v(x). From 4.5, we can see that this edge in G Z ∩ G has to be from G . Thus, all edges in G Z ∩ G of the form x -→ y where x, y ∈ R come from G . This implies that the negative cycle cannot be limited to the clocks that were not reset.

Also, observe that since there are no edges in G involving x where x ∈ R, any edges involving these clocks must come from G Z . Suppose our negative cycle contained a clock x such that x ∈ R. By our criterion for the negative cycle, either the incoming or the outgoing edge associated to x should come from G , which we know is not possible as there are no edges associated to s in G . This implies that the negative cycle cannot involve clocks that are reset.

Let the negative cycle be of the form

x - → • • • - → y - → t p - → z - → u - → • • • - → x
where t p is a reference clock and all other clocks could be either reference clocks or offset clocks that were not reset. Suppose that the edge t p -→ z comes from G . Then, the edge z -→ u should be from G Z . However, since u / ∈ R, we know that the edge z -→ u in G Z ∩ G comes from G , which is contrary to our requirement. Thus, the edge t p -→ z comes from G Z . As a consequence, the incoming edge to t p , namely y -→ t p , should be from G . We have already seen that all the edges of the form x -→ y such that x, y ∈ R can only be from G . Since G is canonical we can replace all these edges by a single edge to get the negative cycle

x - → t p - → z - → x
Further, since x -→ t p and z -→ x are both from G , we can replace it by a single edge. Thus, the situation boils down to a negative cycle of just 2 edges of the form z

( ,k 1 ) ----→ t p ( ,k 2 ) ----→ z
where the edge z

( 1 ,k 1 )
----→ t p is from G Z and the edge t p

( 2 ,k 2 )
----→ z is from G . From our assumption, since this is a negative cycle, we have (

1 , k 1 ) + ( 2 , k 2 ) < (≤, 0). Since we know that k 2 = v(z) -v(t p ), this implies v(z) -v(t p ) + k 1 < 0
We know that the edges between z and

t p in G 1 is unchanged from G Z , since z ∈ R. Further, since we know that v ∈ [[G 1 ]], we have v(t p ) -v(z) ≤ k 1 , which implies v(z) -v(t p ) + k 1 ≥ 0
This is a contradiction. Thus, our assumption that there was a negative cycle was wrong.

The operations of local time elapse, guard intersection, and reset, enable us to describe a local step (q, Z) b --→ (q , Z ) on the level of local zones. This is done in the same way as for global zones. Observe that a local step is indexed only by an action, as the aspect of time is taken care of by the local time elapse operation. Definition 4.2. There is a transition (q, Z) b --→ (q , Z ) provided for each process p ∈ dom(b) its unique transition on b is (q(p), g p , R p , q (p)) for some g p and R p , Z = local-elapse(Z 2 ) and

Z = ∅ with Z 2 = [ p∈dom(b) R p ]Z 1 and Z 1 = Z ∩ p∈dom(b) Z gp ∩ {t p 1 = t p 2 | p 1 , p 2 ∈ dom(b)}.
For a sequence of actions u we write (q, Z) u --→ (q , Z ) for a sequence of transitions indexed by elements of u.

Local zone graph

Equipped with the notion of local zones, we can now construct a local zone graph and show that it is sound and complete for reachability testing. We say a local zone is time-elapsed if Z = local-elapse(Z). Definition 4.3 (Local zone graph). For a network of timed automata N the local zone graph of N , denoted LZG(N ), is a transition system whose nodes are of the form (q, Z) where q is a state of the network and Z is a time elapsed local zone, and whose transitions are steps (q, Z) b --→ (q , Z ). The initial node (q 0 , Z 0 ) consists of the initial state q 0 of the network and the local zone Z 0 = local-elapse({v 0 }), v 0 is the initial (local) valuation.

Next, we prove the pre/post properties of runs on local zones. Lemma 4.6 (Pre and post properties of runs on local zones). Let u be a sequence of actions.

• If (q, v) u --→ (q , v ) and v ∈ Z for some time-elapsed local zone Z, then (q, Z) u --→ (q , Z ) and v ∈ Z for some local zone Z .

• If (q, Z) u - -→ (q , Z ) and v ∈ Z then (q, v) u - -→ (q , v ), for some v ∈ Z.
Proof. Proof follows by induction on the length of u.

For the pre property: Suppose that u is a single action a. Then, (q, v) a --→ (q , v ) implies there is a sequence of local steps: (q, v)

∆ - -→ (q, v 1 ) a - -→ (q , v 2 ) ∆ --→ (q , v ). Since v ∈ Z and Z is local time elapsed, we have v 1 ∈ Z.
By definition of (q, Z) a --→ (q , Z ) we get v ∈ Z . The induction step follows by a similar argument, and noting the fact that Z is local time-elapsed in (q, Z) a --→ (q , Z ). For the post property: When u is a single action, the definition entails that there is a v ∈ Z such that (q, v)

a - -→ ∆ - -→ (q , v ). When u = a 1 . . . a n , consider the sequence of zones (q, Z) a 1 - -→ (q 1 , Z 1 ) • • • (q n-1 , Z n-1 )
an --→ (q , Z ), use a similar argument to obtain a v n-1 ∈ Z n-1 and then the induction hypothesis for the shorter sequence a 1 . . . a n-1 .

Directly from Lemma 4.6 we obtain the main property of local zone graphs which allows us to use it for reachability testing.

Theorem 4.1. For a given network of timed automata N , there is a run of the network reaching a state q iff for some non-empty local zone Z, node (q, Z) is reachable in LZG(N ) from its initial node.

Remark. The proof of Theorem 4.1 is based on Lemma 3.9 which says that if there is a local run to a configuration (q, v) where v is a synchronised valuation, then the state q is reachable. The "non-empty" in the statement of Theorem 4.1 is meant to highlight the requirement that the zone contains at least one synchronized local valuation. This is because if the zone contains at least one local valuation, then it also contains a synchronized valuation (obtained by synchronizing this local valuation).

Notice that LZG(N ) may still be infinite and it cannot be used directly for reachability checking. This problem will be addressed in Chapter 5.

Commutativity in the local zone graph

In this section, we discuss some important properties of the local zone graph with respect to concurrency. In Section 3.4, we showed that in local time semantics for networks of timed automata, two actions with disjoint domains are independent. Specifically, we showed that two actions with disjoint domains satisfied the diamond property as well as the forward diamond property (see Definition 2.48.) In this section, we investigate if these properties extend to the setting of local zone graphs.

Diamond property: First, we examine if the diamond property holds for actions with disjoint domains in the local zone graph.

Lemma 4.7. Let dom(a) ∩ dom(b) = ∅. If (q, Z) ab - -→ (q , Z ), then (q, Z) ba - -→ (q , Z ).
Proof. Suppose that (q, Z) ab --→ (q , Z ab ). We will show that there is (q, Z) ba --→ (q , Z ba ), and that Z ab ⊆ Z ba . By symmetry this will show the lemma.

Take v ∈ Z ab . Using the backward (post) property of steps on zones (Lemma 4.6) we get a run:

(q, v) a - -→ (q a , v a ) ∆a --→ (q a , v a ) b - -→ (q , v b ) ∆ b --→ (q , v ),
where v ∈ Z. Using commutation on the level of runs, Lemma 3.4, we get a run (q, v)

∆ b --→ (q, v b ) b - -→ (q b , v b ) ∆ a --→ (q b , v a ) a - -→ (q , v a ) ∆ a --→ (q , v )
Now using the forward (pre) property of steps on zones from Lemma 4.6 we obtain that Z ba exists and v ∈ Z ba . Thus, it is clear that the diamond property holds for actions with disjoint domains in the local zone graph. Extending Lemma 4.7 to longer sequences of actions, we get the following property, which states that if a run σ is feasible from a zone in the local zone graph, then all runs equivalent to σ (in the sense of ∼ equivalence as given in Definition 3.1) are feasible from that zone and lead to the same zone.

Corollary 4.1. If (q, Z) u - -→ (q , Z ) and u ∼ w, then (q, Z) w - -→ (q , Z ).
Forward diamond property: We show that actions with disjoint domains do not satisfy the forward diamond property in the local zone graph. In Lemma 4.8, we point out that even if two actions a and b have disjoint domains and are individually enabled from a local zone (q, Z), the sequence ab need not be enabled from (q, Z). Observe that this is in contrast to the situation at the valuation level for local time semantics as given in Lemma 3.4. Lemma 4.8. There exists a local zone (q, Z) and actions a and b such that dom(a) ∩ dom(b) = ∅, both actions a and b are feasible from (q, Z) but neither ab nor ba is feasible from (q, Z).

Proof. Let P 1 and P 2 be processes with clocks {x 1 , y 1 } and {x 2 , y 2 } respectively. Consider a transition sequence consisting of four synchronized actions:

ρ : ---→ {y 2 } ---→ {x 2 } x 2 ≥1 ----→ {y 1 } y 2 ≤3 ----→ {x 1 }
Since all actions are synchronized, the local zone obtained after the sequence ρ is Z ρ which will satisfy the following constraints (recall that the clocks maintain the timestamps of the last resets):

0 ≤ y 2 ≤ x 2 ≤ y 1 ≤ x 1 and x 1 -y 2 ≤ 3 and y 1 -x 2 ≥ 1
Because of these interleaved constraints, for each valuation v ∈ Z ρ :

v( x 1 ) -v( y 1 ) = 2 =⇒ v( x 2 ) -v( y 2 ) = 0 and v( x 2 ) -v( y 2 ) = 2 =⇒ v( x 1 ) -v( y 1 ) = 0
Now, consider two local actions with guards: g 1 : y 1 ≥ 3 ∧ x 1 ≤ 1 and g 2 : y 2 ≥ 3 ∧ x 2 ≤ 1. Guard g 1 implies that x 1 -y 1 ≥ 2 and similarly g 2 implies that x 2 -y 2 ≥ 2. Intersecting Z ρ with g 1 gives valuations in which v( x 1 ) -v( y 1 ) ≥ 2 and v( x 2 ) -v( y 2 ) ≤ 0. Similarly, intersecting Z ρ with g 2 gives the other symmetric combination. Hence from the set obtained by taking action g 1 , action g 2 is not enabled and vice versa. However, both g 1 and g 2 are enabled at Z ρ . Thus, combining Lemma 4.8 and Corollary 4.1, we can conclude the following: Disjoint domains is not a sufficient condition to conclude that two actions are independent. In other words, just because two actions a and b have disjoint domains, we cannot postpone the execution of one of them in favor of the other. However, if we know that ab is feasible, then ba is feasible as well.

Aggregate zones in local zone graph

We know from Corollary 4.1 that starting from a local zone all equivalent interleavings of a sequence of actions u end up in the same local zone. This is in stark contrast to the global zone graph, where each interleaving results in a possibly different global zone (see Figure 4.1). Let MZ(q, Z, u) = {v | ∃v ∈ Z, ∃w, w ∼ u and (q, v) w = =⇒ (q , v )} denote the union of all these global zones.

Salah et al. [START_REF] Ben Salah | On interleaving in timed automata[END_REF] have shown that, surprisingly, MZ(q, Z, u) is always a global zone. We call it aggregated zone, and the notation MZ is in the memory of Oded Maler. In the same work, this observation was extended to

A = A1 A2 A1 A2 p 0 p 1 q 0 q 1 a {x} b {y} t ≥ 0 x = y = 0 t ≥ x x ≥ y = 0 t ≥ y y ≥ x = 0 t ≥ y y ≥ x ≥ 0 t ≥ x x ≥ y ≥ 0 a b b a t1 ≥ x = 0 t2 ≥ y = 0 t1 ≥ x ≥ 0 t2 ≥ y = 0 t1 ≥ x = 0 t2 ≥ y ≥ 0 t1 ≥ x ≥ 0 t2 ≥ y ≥ 0 a b b a
Global zone graph Local zone graph an algorithm for acyclic timed automata that from time to time merged zones reached by equivalent paths to a single global zone. We prove below that this aggregated zone can, in fact, be obtained directly in the local zone graph: the aggregated (global) zone is exactly the set of synchronized valuations obtained after executing u in the local zone semantics. Here we need some notation: let Z be a global zone and Z a local zone; define

sync(Z) = {v ∈ Z | v is synchronized} local(Z) = {local(v) | v ∈ Z} global(sync(Z)) = {global(v) | v ∈ sync(Z)
If (q, Z) u - -→ (q , Z ), we have MZ(q, Z, u) = global(sync(Z )), otherwise MZ(q, Z, u) = ∅.
Proof. Pick v ∈ MZ(q, Z, u). There exists w ∼ u, v ∈ Z and a global run (q, v) w = =⇒ (q , v ). From Lemma 3.9, there exists a local run (q, local(v)) w --→ (q , local(v )). By assumption, local(v) ∈ Z. Hence from the pre property of local zones (Lemma 4.6), there exists (q, Z) w --→ (q , Z w ) such that local(v ) ∈ Z w . As local(v ) is synchronized, we get local(v ) ∈ sync(Z w ). But, by Corollary 4.1, Z w = Z . This proves local(v ) ∈ sync(Z ) and hence v ∈ global(sync(Z )).

For the other direction take v ∈ global(sync(Z )). As (q, Z) u --→ (q , Z ), by post property of local zones (Lemma 4.6) there is a local run (q, v u ) u --→ (q , local(v )) for some v u ∈ Z. Since v u ∈ Z, it is obtained by a local time elapse from some v ∈ local(Z). Hence v is synchronized and global(v) ∈ Z. From Lemma 3.9 we get that for some w ∼ u there is a global run (q, global(v))

w = =⇒ (q , v ). Hence v ∈ MZ(q, Z, u).
Theorem 4.2 gives an efficient way to compute aggregated zones: it is sufficient to compute local zone graphs. Computing local zone graphs is not more difficult than computing global zone graphs. But, surprisingly, on the level of zones, the combinatorial explosion due to interleaving does not occur in local zone graphs, thanks to the theorem above. Hence, this gives an incentive to work with local zone graphs instead of global zone graphs.

This contrasts with the aggregation algorithm in [START_REF] Ben Salah | On interleaving in timed automata[END_REF] which requires to store all the paths to a global zone and detect situations where zones can be merged, that is, when all the equivalent permutations have been visited. Another important limitation of the algorithm from [START_REF] Ben Salah | On interleaving in timed automata[END_REF] is that it can only be applied to acyclic zone graphs. If local zone graphs can be computed for general timed automata (which contain cycles), we can get to use the aggregation feature for all networks (and not only acyclic ones). To do this, there is still a major problem left: local zone graphs could be infinite when the automata contain cycles.

Chapter 5

Making local zone graphs finite

In Chapter 4, we introduced local zone graphs for networks of timed automata. We proved in Theorem 4.1 that local zone graphs are sound and complete w.r.t. reachability, i.e., there is a path from the initial node to a node (q, Z) in the local zone graph of a timed automaton A if and only if q is reachable in A. We also showed that the local zone graph of a network of timed automata has the following useful property: starting from a node of the local zone graph, all equivalent interleavings of a sequence of actions end up in the same node. We pointed out that this is in stark contrast to the case in the global zone graph, where each interleaving results in a potentially different global zone. We showed that this property makes it an attractive option to use the exploration of local zone graph, rather than the global zone graph, to answer the reachability problem for networks of timed automata. Unfortunately, local zone graphs may not be finite and an algorithm that proceeds by exploring the local zone graph is not guaranteed to terminate. To ensure termination of such an algorithm, we need some way to compute a finite truncation of local zone graph, whose exploration is sufficient.

We face a similar problem in the case of global zone graphs, which are also infinite in general. The standard approach to make a global zone graph finite involves using a node covering relation between the nodes of the global zone graph (discussed in detail in Section 2.8). In order to use the local zone graph to answer the reachability problem for networks of timed automata, we need such a covering relation between nodes of the local zone graph.

In this chapter we first examine some of the solutions proposed in the literature to obtain a node covering relation between nodes of the local zone graph. We point out that these solutions either have some fatal flaws or are not effectively computable. We then go on to propose a new node covering relation for nodes of the local zone graph that is based on a relation between local zones that we call sync-subsumption. It allows us to define a 99 transition system called local sync graph that is the local zone graph reduced by applying this new node covering relation. We propose an algorithm that uses the exploration of local sync graphs to answer the reachability problem for networks of timed automata.

Applying a partial order reduction procedure to the exploration of a local sync graph is one way to make this procedure even more efficient. However, we do not know how to compute the independence relation of actions of local sync graphs, and as a consequence, do not know how to apply partial order reduction to local sync graphs.

The results in this chapter appeared in [START_REF] Govind | Revisiting local time semantics for networks of timed automata[END_REF].

Approaches to get finiteness for local zone graphs

The standard approach to make a global zone graph finite involves using a subsumption relation between global zones. The subsumption relation is defined using an abstraction operator a (see Definition 2.35). The relation a LU (discussed in detail in Section 2.8) is one such subsumption relation between global zones that uses the a LU abstraction operator. Abstraction operators are usually based on a simulation relation between global valuations (see Definition 2.18). Abstractly, a simulation relation is a relation between valuations that clubs together those valuations that are indistinguishable with respect to runs from them. Recall that simulation relations between global valuations are usually parameterized by certain maximum constants occurring in guards, for instance the region equivalence for global valuations (see Definition 2.16) which is parameterized by the maximum constant M occurring in guards, and the LU preorder (see Definition 2.39) which is parameterized by L and U , the maximum constants respectively used in a lower bound and upper bound guards. Additionally, if it is known that there are only finitely many distinct sets a(Z) where Z is a global zone, the subsumption relation based on a can be used to obtain an effective procedure to answer the reachability problem for timed automata, as was shown in Section 2.8.

Observe that the existence of a simulation relation for global valuations (LU preorder) was crucial to obtain an abstraction operator, a LU , for global zones (Definition 2.40). The fact that a LU over global zones is a simulation relation of finite index was used to obtain conditions to guarantee termination of exploration of the global zone graph.

In this section, we present some of the solutions in standard literature to the problem of obtaining a subsumption relation for local zones. For each of these solutions, we show that there are technical problems that restrict its effectiveness.

Catch-up equivalence

In the work that introduced local time semantics and local zone graphs, Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] define an equivalence between local valuations, referred to as catch-up equivalence. They also propose an extension of catch-up equivalence to local zones. In their work, they show that catch-up equivalence for local zones is a simulation relation of finite index. Then, following the same ideas as for global zones, one can hope to construct a finite local zone graph using a subsumption relation between local zones based on catch-up equivalence. Since this graph is guaranteed to be finite, this could be used to answer the reachability problem. In this section we present the definition of catch-up equivalence and discuss the problems associated with this approach.

We say two synchronized local valuations v and v are region-equivalent if v ≡ M v , where v = global(v) and v = global(v ) (for region equivalence, see Definition 2.16). Equivalence classes of synchronized local valuations are called synchronized regions. Bengtsson et al. [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF] propose to extrapolate the region equivalence that is defined on synchronized valuations to nonsynchronized valuations by introducing the notion of catch-up transitions.

Recall that in local time semantics, each process has a different reference clock. Intuitively, a catch-up transition is one that allows processes which are lagging behind w.r.t. to the reference clock value, to catchup with the processes having higher values of reference clocks. Essentially, by doing this, we are allowing the system to move to a state that is "more synchronized in time". Definition 5.1 (Catch-up transition). A local delay transition (q, v) δ -→ i (q, v ) is called a catch-up transition if the maximum value of reference clocks at v is not greater than the maximum value of reference clocks at v, i.e., max

p∈Proc v (t p ) ≤ max p∈Proc v(t p )
For example, consider a network N 1 of two timed automata and a local valuation v of N 1 where: v(t 1 ) = 10, v(t 2 ) = 12. Now consider the valuation v 1 obtained by executing a local delay of δ = 2 in process A 1 . We have v 1 (t 1 ) = v 1 (t 2 ) = 12. Here, δ is an example of a catch-up transition. However, observe that not all local delay transitions are catch-up transitions. For instance, a local delay transition of δ = 5 in process A 1 from v takes us to a valuation v 2 where v 2 (t 1 ) = 15, v 2 (t 2 ) = 12 -here, the maximum value of reference clocks at v 2 is greater than the maximum value of reference clocks at v, and we end up with a valuation which is no more synchronized than the valuation v that we started out with. Hence, δ is not a catch-up transition.

We denote by R(q, v) the set of all synchronized regions that can be reached from the (state, local valuation) pair (q, v) by action transitions or catch-up transitions. Definition 5.2 (Catch-up equivalence). (q, v) and (q , v ) are said to be catch-up equivalent if the set of synchronized regions reachable from both these states are the same; i.e., (q, v) ∼ catch-up (q , v ) if R(q, v) = R(q , v ) From Lemma 2.10, we know that the number of synchronized regions is finite. As a consequence, we can conclude that catch-up equivalence also has finite index.

Unfortunately, the question of effective algorithms to check for catch-up equivalence was left open in [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF]. To the best of our knowledge, there is no efficient procedure to check if two local valuations are catch-up equivalent. Therefore, catch-up equivalence, though useful theoretically, cannot be used to obtain terminating procedures to check reachability via the exploration of local zone graphs.

Minea's approach

Building on [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF], another finite abstraction of the local zone graph was proposed by Minea [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF][START_REF] Minea | Partial Order Reduction for Verification of Timed Systems[END_REF]. In this section, we discuss this approach and point out that it carries a bug, and it is not evident how to repair this bug.

The approach in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] is founded on an equivalence between local valuations along the lines of the region equivalence proposed by Alur et al. [START_REF] Alur | A theory of timed automata[END_REF] (see Section 2.3). We present the equivalence as presented in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] below. Note that in this section, the set of all offset variables including the reference clocks is denoted as T + . Definition 5.3 (Equivalence defined in Section 3.7 of [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF]). Fix a network of timed automata N = A 1 , . . . , A k . Let c max be the maximum constant used in the guards of N . Two local valuations v and v are said to be equivalent, written as v reg v if for all variables x, y ∈ T + (including the reference clocks):

• either v( x) -v( y) = v ( x) -v ( y) , • or v( x) -v( y) > c max and v ( x) -v ( y) > c max , • or v( x) -v( y) < -c max and v ( x) -v ( y) < -c max .
The equivalence is extended to configurations: (q, v) reg (q , v ) if q = q and v reg v .

We now state an observation about the equivalence from Definition 5.3 made in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF].

Let v reg v w.r.t. c max . Then:

1. If g is a guard with a constant smaller than c max , then v |= g iff v |= g.

For each

clock set R, [R]v reg [R]v .
3. For each i ∈ {1, . . . , k} and δ ≥ 0 there exists δ ≥ 0 such that v + i δ reg v + i δ .

Based on this observation, it is claimed that reg is a simulation relation. We state the proposition given in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] below.

Let (q, v) reg (q, v ) be equivalent configurations.

1. If (q, v) a -→ (q 1 , v 1 ), there exists (q 1 , v 1 ) such that (q, v ) a -→ (q 1 , v 1 ) and (q 1 , v 1 ) reg (q 1 , v 1 ).

2. If (q, v) δ -→ i (q, v 1 ) there exists δ ∈ R ≥0 such that (q, v ) δ -→ i (q, v 1 ) and (q, v 1 ) reg (q, v 1 ).

We will now show that this claim is not correct. In particular, we show that it is possible to construct a local delay transition that can distinguish two local configurations that are reg equivalent.

Proposition 5.1. There exist local valuations v and v and a delay δ such that v reg v , but for no delay δ , we have v + δ reg v + δ .

Proof. Consider a network N 1 of two timed automata A 1 and A 2 , such that X 1 = {x}, X 2 = {y}. This gives X = { x, t 1 , y, t 2 }. Let c max = 3. Define valuations v and v as follows:

v : x = 0, t 1 = 0, y = 0, t 2 = 4 v : x = 0, t 1 = 0, y = 0, t 2 = 5

Note that the differences between variables in v are either 0, 4 or -4 and the corresponding differences in v are 0, 5 or -5. Hence by definition, v reg v . Consider valuation v + 1 2 obtained by local delay of 2 units in process A 1 from v:

v + 1 2 : x = 0, t 1 = 2, y = 0, t 2 = 4
Observe that in v + 1 2, the difference x -t 1 = -2 and t 1 -t 2 = -2 both of which are greater than -c max . We claim there is no local delay δ such that v + 1 2 reg v + 1 δ . Valuation v + 1 δ is given by x = 0, t 1 = δ , y = 0, t 2 = 5. If v + 1 2 reg v + 1 δ , on the one hand, we need -δ = -2, hence δ ≤ 2, and on the other hand, we need δ -5 = -2, which entails δ ≥ 3. This is not possible.

Note that Proposition 5.1 contradicts the statement 3 of the claim made in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF]. The main problem is that even from a valuation where the difference between a pair of reference clocks is bigger than the maximum constant, by executing local delays, this difference can be brought within the maximum constant. This situation is fundamentally different from the standard semantics, where if a clock is above the maximum constant in a valuation, further delays keep it above this constant. This allowed the region equivalence to work in the global semantics.

Using the propositions given in their work, the following theorem is proposed in [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF].

Definition 5.4 (Maximization operator, Section 3.7 of Minea). Given a canonical representation of a local zone Z, the maximized zone max(Z) with respect to c max is obtained by the following modifications on Z. For each x, y ∈ X and each constraint φ := x -y c: if c > c max remove the constraint φ, and if c < -c max , change φ to x -y < -c max . Canonicalize the resulting set of constraints.

Clearly the number of maximized zones is finite. Given a network N , we can now define a transition system MaxOZG(N ) as follows: nodes are of the form (q, Z) where Z is a maximized zone; there is a transition (q, Z) a --→ (q , max(Z )) if there is a transition (q, Z) a --→ (q , Z ) in OZG(N ); the initial node is of the form (q 0 , max(Z 0 )) where (q 0 , Z 0 ) is the initial node of OZG(N ). Theorem 5 of [START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF] (which talks about LTL model checking) can be rephrased for the question of reachability as follows. There is a run of the network N reaching a state q iff for some non-empty (maximized) zone Z, (q, Z) is reachable in MaxOZG(N ) from its initial node. A natural implication of this theorem is the soundness and completeness of MaxOZG(N ) w.r.t. reachability.

Using the observation that we made in Proposition 5.1, we are now able to state the following theorem.

Theorem 5.1. MaxOZG(N ) is not sound for reachability.

Proof. We will make use of valuations v and v given in the proof of Proposition 5.1. We will come up with an automaton network A 1 , A 2 such that:

(1) accepting state is not reachable; (2) valuation v is reachable in the network and hence is present in a reachable zone; (3) maximization of the zone containing v adds v to the zone; (4) the accepting state is reachable from v. This entails that the maximization operation is not sound.

To achieve this, it is convenient to add an extra clock z in component A 2 and a fictitious clock 0 which is never reset. Figure 5.1 gives the network. Note that c max = 3. Although clock y does not appear in A 2 , one can assume that there are other transitions from q 0 that deal with y. For simplicity, we avoid illustrating these transitions explicitly. Also, when we write x = 2 we mean x -0 = 2. In the discussion below, v, v are valuations restricted to x, y, t 1 and t 2 .

In order to reach the state p 2 , the synchronization action c needs to be taken: transition sequence a 1 c requires c to be taken at global time 4, and

A1 A2 p 0 p 1 p 2 q 0 q 1 q 2 q 3 a1 c b1 b2 c x = 2 {x} x = 2 z = 2 {z} z = 3 {z} p 0 , q 0 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 0 z = 0 p 1 , q 0 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 0 z = 0 p 0 , q 1 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 2 z = 2 p 1 , q 1 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 2 z = 2 p 0 , q 2 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 5 z = 5 p 1 , q 2 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 5 z = 5 a 1 b 1 b 1 a 1 b 2 b 2 a 1 OZG( A1, A2 ) p 0 , q 0 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 0 z = 0 p 1 , q 0 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 0 z = 0 p 0 , q 1 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 2 z = 2 p 1 , q 1 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 2 z = 2 p 0 , q 2 x = 0, t 1 ≥ 0 y = 0, t 2 ≥ 3 z ≥ 3, t 2 ≥ z p 1 , q 2 x = 2, t 1 ≥ 2 y = 0, t 2 ≥ 3 z ≥ 3, t 2 ≥ z p 2 , q 3 x = 2, t 1 ≥ 4 y = 0, t 2 ≥ 4 z ≥ 3, t 2 ≥ z a 1 b 1 b 1 a 1 b 2 b 2 a 1 c
MaxOZG( A1, A2 )

Sync-subsumption for local zones

We have seen that the existing approaches to obtain a finite local zone graph have problems that render them ineffective. From an analysis of these problems, we can conclude that a finite abstraction of the differences between reference clocks constitutes the main challenge. We propose a solution which bypasses the need to worry about such differences: restrict to synchronized valuations for subsumption.

We briefly recall the operators sync and global that we introduced in Section 4.5. The sync operator when given a local zone returns the set of synchronized valuations in the local zone, i.e., sync(Z) = {v ∈ Z | v is synchronized}. The global operator when applied to a synchronized local valuation v, yields the offset valuation v such that v(t) = v(t i ) and v( x) = v( x) for offset clocks x ∈ X. The global operator can be extended to sets of synchronized local valuations as follows: global(sync(Z)) = {v | v = global(v), v ∈ Z}. We have already seen in Lemma 4.9 that global(sync(Z)) is a global zone.

Subsumptions over global zones are well studied (we discuss in detail one such subsumption, a LU , in Section 2.8). Taking an off-the-shelf finite abstraction that is based on a simulation a and a subsumption relation a between global zones based on this abstraction, we propose to do the following: given two local zones Z 1 and Z 2 , we perform a subsumption test global(sync(Z 1 )) a global(sync(Z 2 )).

We consider a LU as this off-the-shelf abstraction. We know that a LU is finite when considered over global zones (shown in Lemma 2.27). As a consequence, we know that there are only finitely many zones of the form global(sync(Z)) that are pairwise incomparable w.r.t. a LU subsumption.

Remark. Observe that we could have used any abstraction based on a simulation relation, that is finite when considered over global zones. For instance a M [START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF], which is another such abstraction operator, would also have been a suitable candidate.

Recall that we use the notation Z a

LU Z to indicate that the global zone Z is subsumed by the global zone Z . We now define aLU sync between local zones. Definition 5.5. Given two configurations s := (q, Z) and s := (q , Z ) of the local zone graph, we write s aLU sync s if q = q and global(sync(Z)) a LU global(sync(Z )).

From the above discussion, it is clear that aLU sync is a finite index subsumption relation for local zones. Equipped with such a relation, we can now define local sync graphs, that are essentially finite truncations of local zone graphs. We will prove in Theorem 5.2 that local sync graphs are sound and complete w.r.t. reachability. The above definition essentially translates to this algorithm: explore the local zone graph say in a BFS fashion, and subsume (cover) using aLU sync . The local sync graph of a network is not unique as it depends on the order of exploration. Using Lemma 2.27, we can conclude that a local sync graph is always finite. Theorem 5.2 below states that local sync graphs are sound and complete for reachability, and this algorithm is correct.

Theorem 5.2 (Soundness and completeness of local sync graphs). Consider a network of timed automata N , and LU -bounds compatible with guards in N . A state q is reachable in N iff a node (q, Z), with Z non-empty, is reachable from the initial node in a local sync graph for N constructed with aLU sync .

Proof. If (q, Z) is reachable in a local sync graph then it is trivially reachable in the local zone graph and the (backward) implication follows from soundness of local zone graphs (see Theorem 4.1).

For the other direction which implies completeness of local sync graphs, let us take a global run: (q 0 , v 0 )

δ 1 ,b 1 = = =⇒ (q 1 , v 1 ) • • • δn,bn
===⇒ (q n , v n ). Consider a local sync graph G. By induction on i, for every (q i , v i ) we will find a reachable uncovered node (q i , Z i ) of G, and a synchronized local valuation v i ∈ Z i such that v i LU global(v i ). This proves completeness, since every reachable (q i , v i ) will have a reachable representative node in the local sync graph.

The induction base is immediate, so let us look at the induction step.

Consider the global step (q i , v i )

δ i ,b i = = =⇒ (q i+1 , v i+1 ). Since v i LU global(v i ),
there is a delay δ i such that (q i , global(v i ))

δ i ,b i = = =⇒ (q i+1 , v i+1
) and v i+1 LU v i+1 . As the global delay δ i can be thought of as a sequence of local delays, we have the local run (q i , v i )

∆,b i ---→ (q i+1 , v i+1 ), where v i+1 = local(v i+1 ).
Note that v i+1 is synchronized and v i+1 LU global(v i+1 ). From the preproperty of local zones (Lemma 4.6) there exists a transition (q i , Z i )

b i - -→ (q i+1 , Z i+1 ) with v i+1 ∈ Z i+1 ; in fact, v i+1 ∈ sync(Z i+1 ). If (q i+1 , Z i+1
) is uncovered, take v i+1 for v i+1 and Z i+1 for Z i+1 (needed by the induction step). Otherwise, from condition C4, there is an uncovered node (q i+1 , Z i+1 ) such that global(sync(Z i+1 )) a LU global(sync(Z i+1 )). This gives v i+1 ∈ sync(Z i+1 ) such that global(v i+1 ) LU global(v i+1 ). Now take v i+1 for v i+1 and Z i+1 for Z i+1 .

We have already seen in Section 4.5 that the aggregated zone of σ is given by sync(Z), where (q, Z) is the node reached on σ in the local zone graph. Since we are considering containment with respect to synchronized valuations, it is easy to see that we maintain aggregated zones in local sync graphs as well. Observe that a node being covered implies that further exploration from that node is suspended. Recall that while all the equivalent sequences of σ lead to the same node in the local zone graph, they could potentially lead to different nodes in the global zone graph. Suppose that there is a covering from the node (q, Z) reached on a sequence σ in the local zone graph. This has the effect of suspending further exploration from all the sequences equivalent to σ. Further, if (q, Z) is covered in the local zone graph, it does not imply that the node (q, Z) of the global zone graph is covered, where (q, Z) is reached on a sequence σ , such that σ ∼ σ. As a consequence, a subsumption in the local zone graph has the effect of stopping the exploration of several executions of the global zone graph. In this sense, sync-subsumption in the local zone graph can be perceived as being "more aggressive" than subsumptions in the global zone graph.

Thus, we have shown that local sync graph, obtained by using syncsubsumption while exploring local zone graphs, is sound and complete with respect to reachability. Furthermore, we have seen that local sync graphs handle interleavings of concurrent actions better than the global zone graph. Thanks to these results, we have an algorithm to test reachability of networks of timed automata that proceeds by exploring the local sync graph.

Efficient reachability algorithm using local sync graphs

In this section, we present a new reachability algorithm for networks of timed automata that is based on the exploration of local sync graphs. The algorithm takes as input a network of timed automata N , computes its LU -bounds (see Definition 2.37), and constructs a variant of a local sync graph of N , as given in Definition 5.6. An efficient algorithm for sync-subsumption between local zones, i.e., to check if a local zone Z is sync-subsumed by another local zone Z , is given in appendix C. This allows us to store and manipulate local zones while considering the synchronization of these local zones for comparisons; in other words, we do not need to separately store sync(Z)'s or a(sync(Z))'s.

The algorithm proceeds similarly to the standard reachability algorithm, with the main difference that while the standard reachability algorithm constructs and explores the global zone graph and uses the a LU -subsumption between standard zones, our algorithm explores the local zone graph and considers the aLU sync -subsumption between local zones. Just as the standard algorithm, Algorithm 2 starts the exploration of the local zone graph of N from the initial node (q 0 , Z 0 ) and maintains two lists of nodes: the list Visited stores all the nodes constructed by the algorithm, and the list Waiting stores all the nodes that have been constructed but whose successors have not been computed yet.

Observe that Algorithm 2 removes the covered nodes in lines 8 and 13. Hence, the resulting graph, represented by the set Visited, is not a local sync Algorithm 2 Reachability algorithm for networks of timed automata based on the exploration of its local sync graph Input : A network of timed automata N . Output : true iff N has a run reaching an accepting state.

1: Set Waiting = Visited := {(q 0 , Z 0 )} 2: if q 0 is accepting then return true 3: while Waiting = ∅ do 4:

remove some (q, Z) from Waiting for all (q , Z ) s.t. (q, Z) a -→ (q , Z ) for some a do 6:

if q is accepting and sync(Z ) = ∅ then Remove (q , Z ) from Visited and Waiting 14:

Add (q , Z ) to Waiting and Visited 15: return false graph according to Definition 5.6. Still, it has all the expected properties that ensure its correctness: every node in Visited is reachable in LZG(N ), and for every reachable node (q, Z) in LZG(N ), there exists a node (q, Z ) in Visited such that (q, Z) aLU sync (q, Z ).

Correctness of the algorithm

We will now prove that Algorithm 2 is correct. The soundness of the algorithm is given by Lemma 5.1, while the completeness follows from Lemma 5.3.

Lemma 5.1. (Soundness) If Algorithm 2 returns true, then N has an accepting run.

Proof. Algorithm 2 returns true by either executing line 2 or line 7. Line 2 is only executed when the initial state q 0 of N is an accepting state -in this case, the claim is vacuously true. Next, consider the case when line 7 is executed. We can infer from the algorithm that this happens only when a node (q, Z) has just been removed from Waiting, and (q, Z) a -→ (q , Z ) is such that q is an accepting state and sync(Z ) is non-empty. Since (q, Z) was in Waiting, it follows from the algorithm that there is a sequence of actions σ such that (q 0 , Z 0 ) σ -→ (q, Z). This implies that there is a path (q 0 , Z 0 ) σ.a --→ (q , Z ) in LZG(N ). From Lemma 4.6, we know that there is a local run (q 0 , v 0 ) σ.a --→ (q , v ) where v ∈ Z is a synchronized local valuation (follows from the fact that sync(Z ) is non-empty). Then, by Lemma 3.9, we know that N has a run (q 0 , global(v 0 )) -→ (q , global(v )). Since q is accepting, this is an accepting run of N .

Lemma 5.2. Let σ be path in LZG(N ):

(q 0 , Z 0 ) a 1 -→ (q 1 , Z 1 ) a 2 -→ • • • (q n-1 , Z n-1 ) an -→ (q n , Z n ).
If Algorithm 2 does not return true at termination, then for each 0 ≤ i ≤ n, there exists a state (q i , Z i ) in the set Visited such that Z i aLU sync Z i .

Proof. The proof of the lemma is quite similar to the proof of Lemma 2.32, with the main difference that in this proof, we deal with local zones and aLU sync subsumption, in the place of global zones and a LU subsumption, respectively.

Lemma 5.3. (Completeness) If LZG(N ) has a path to a node (q, Z), where q is accepting and sync(Z) is non-empty, then Algorithm 2 returns true.

Proof. Suppose that the Algorithm 2 terminated by returning false. Then, by Lemma 5.2, if there is a run to an accepting node (q, Z) of LZG(N ), it follows that (q, Z) is in Visited when the algorithm terminates. But this is not possible because the accepting state is never added to Visited. The only other possibility is that sync(Z) = ∅, but we know that this is not the case.

From Lemma 5.1 and Lemma 5.3, we can infer that Algorithm 2 is correct. The termination of the algorithm is guaranteed by the finiteness of aLU sync , which is a direct consequence of the finiteness of a LU over global zones, given by Lemma 2.27.

An optimization for Algorithm 2

Recall that in the proof of completeness of local sync graph, we consider a local run that sees only synchronized local valuations. Thus, when we construct a path in the local zone graph, we are considering a path passing through sync(Z)'s. Here, we propose an optimization to Algorithm 2 that uses this observation: we ignore exploration from the local zones which contain no synchronized valuations.

First, observe that by restricting exploration from a node, the soundness of the local sync graph is not compromised. Next, we consider the completeness of the restricted local sync graph. Recall that in the proof of completeness of local sync graphs, we consider a global run and trace this run though the nodes of the local zone graph. Observe that in each of the zones encountered in this sequence, there is at least one synchronized valuation, namely the valuation v (or the synchronized valuation v such that v LU v ) seen during the run. Thus, by removing the nodes which has zones with no synchronized valuations, the feasibility of the required sequence is not affected. As a consequence, the restricted local zone graph is complete.

Consider the restricted local sync graph of a network N obtained by removing from the local sync graph of N (given by Definition 5.6) nodes (q, Z) such that sync(Z) = ∅.

Lemma 5.4. Suppose that LZG(N ) has a path to a node (q, Z), where q is accepting and sync(Z) is non-empty. Then the restricted local sync graph of N also has path to the node (q, Z).

Proof. Let (q 0 , Z 0 ) σ -→ (q, Z) and sync(Z) = ∅. Since sync(Z) = ∅, it follows that there exists a sequence σ , such that σ ∼ σ and σ is a global run.

From Theorem 4.2, we know that if (q 0 , Z 0 ) σ -→ (q, Z), then (q 0 , Z 0 ) σ -→ (q, Z). Further, since we know that σ is a global run, we know that each local zone in the path (q 0 , Z 0 ) σ -→ (q, Z) contains at least one synchronized valuation, namely the local(v), where v is a valuation seen in the global run. As a consequence, (q, Z) is reachable in the restricted local sync graph.

As a consequence of Lemma 5.4, we have the following optimization.

Corollary 5.1 (Optimization). Let (q, Z) be a node of the LZG(N ) such that sync(Z) = ∅. Then (q, Z) need not to be stored, and its successors need not be explored.

Algorithm 3 presented below, is the resulting updated procedure to check reachability. It is a revised version of Algorithm 2 incorporating the optimization 5.1, implemented by line 8 of the algorithm. Notice that sync(Z 0 ) is not empty since Z 0 contains initial valuations which are by definition synchronized.

Why local sync graphs are not amenable to POR

In this chapter, we have proposed a new algorithm for testing reachability via exploration of the local sync graph. We have discussed theoretical reasons why the algorithm may be more efficient than the standard reachability algorithm. A natural next step to speed up this algorithm further is to apply a partial order reduction technique while exploring the local sync graph. However, there is an obstacle to directly applying partial order reduction to local sync graphs. As already discussed, we need to first have an effective way to compute the independence relation between actions in the local sync graph. For local zone graphs, we had showed that if two actions have disjoint domains, then they satisfy the diamond property -in other words, the order in which they are executed does not matter. It was this property that made Algorithm 3 Reachability algorithm for timed automata based on the exploration of the restricted local sync graph Input : A network of timed automata N . Output : true iff N has a run reaching an accepting state.

1: Set Waiting = Visited := {(q 0 , Z 0 )} 2: if q 0 is accepting then return true 3: while Waiting = ∅ do 4:

remove some (q, Z) from Waiting for all (q , Z ) s.t. (q, Z) a -→ (q , Z ) for some a do 6:

if q is accepting and sync(Z ) = ∅ then for (q , Z ) ∈ Visited do

14: if Z aLU sync Z then 15:
Remove (q , Z ) from Visited and Waiting 16:

Add (q , Z ) to Waiting and Visited 17: return false local zone graph ideal for applying partial order reduction. It turns out that disjointness of domains does not imply independence of actions in local sync graphs. In particular, in local sync graphs, two actions with disjoint domains violate both the diamond and the forward diamond property. In the next section, we demonstrate this using examples. We already saw in Lemma 4.8 that two actions with disjoint domains need not satisfy the forward diamond property in the local zone graph. We gave local zone (q, Z) and two actions a and b such that a and b have disjoint domains and are individually enabled from (q, Z), the sequence ab is not enabled from (q, Z). We will now show that two actions with disjoint domains need not satisfy the diamond property either.

aLU sync does not preserve the set of enabled actions

We remark that even without forward diamond property it is in principle possible to apply partial-order reduction during exploration. For instance, in the local zone graph, actions with disjoint domains do not satisfy the forward diamond property; yet partial order reduction is feasible in the local zone graph, as actions with disjoint domains satisfy the diamond property in the local zone graph. Had the local zone graph been a finite object, this would have yielded us a working POR procedure for networks of timed automata.

To make the local zone graph finite, we proposed the sync-subsumption between local zones. Unfortunately, sync-subsumption does not preserve the set of enabled actions. In other words, if Z is covered by Z , an action a that is enabled from Z need not be enabled from Z . As a consequence, actions with disjoint domains do not satisfy the diamond property. We explain this in detail using an example.

Consider the local zone graph given in Figure 5.2. Let Z 2 and Z 2 be as

((p0, q0), Z0) ((p1, q0), Z1) ((p0, q1), Z2)) ((p1, q1), Z3) ((p2, q2), Z4) ((p0, q1), Z 2 a b b d a X
Figure 5.2: An example of a local sync graph to illustrate that local sync graphs are not amenable to partial order reduction techniques. Observe that sync-subsumption does not preserve the set of enabled actions from the zone Z 2 . As a consequence, the diamond property does not hold in the local sync graph.

follows and let a be an action with guard x < 5.

Z 2 : x = y = 0 ∧ t 1 -x ≥ 3 ∧ t 2 -y ≥ 10 Z 2 : x = y = 0 ∧ t 1 -x ≥ 9 ∧ t 2 -y ≥ 10 Clearly, sync(Z 2 ) = sync(Z 2 ) = t 1 = t 2 ∧ t 1 -x ≥ 10 ∧ t 2 -y ≥ 10.
It follows that Z 2 aLU sync Z 2 . However, in this situation a is enabled from Z 2 but not from Z 2 .

This issue primarily arises because the aLU sync -inclusion depends only on the synchronized valuations of the two zones, while completely disregarding the non-synchronized valuations. As a consequence, if an action is enabled only from non-synchronized valuations from a local zone Z, it may not be enabled from a local zone Z that covers Z.

As a consequence, we cannot directly apply a partial order reduction method to the exploration of local sync graph. Consider the local sync graph given in Figure 5.2. A partial order reduction algorithm has two (seemingly equivalent) options from the node (p 0 , q 0 , Z 0 ) -either to explore the action a or the action b. The algorithm has no preference in this situation. So, an algorithm that chooses exploration of a reaches the node (p 1 , q 0 , Z 1 ) from which b is enabled. In this case, the algorithm will report that (p 1 , q 1 , Z 3 ) (and eventually (p 2 , q 2 , Z 4 )) is reachable. On the other hand, if the algorithm chooses b, then it reaches the node (p 0 , q 1 , Z 2 ) which is covered by the node (p 0 , q 1 , Z 2 ). Observe that while a was enabled from Z 2 , it is not enabled from Z 2 . (We give an example of such a bad situation later in Figure 5.3.)

p 0 p 1 p 3 q 0 q 1 A 1 A 2 A = A 1 × A 2 d x > 1 e a x < 1 b y ≥ 2 (p0, q0, Z0) t1 -x ≥ 0 t2 -y ≥ 0 x -y = 0 (p0, q1, Z1) t1 -x ≥ 0 t2 -y ≥ 2 y -x = 0 (p0, q1, Z2) t1 -x > 1 t2 -y ≥ 2 x -y =
As a consequence, the algorithm will not report that (p 1 , q 1 , Z 3 ) is reachable, which we know is wrong. Thus, if we want to apply partial order reduction to local sync graphs, we need to find a way to account for this phenomenon -perhaps some way to predict when an action may be disabled. Unfortunately, we do not know of a way to do this. We now give an example of this pathological situation in the local sync graphs. Consider the network A and its local sync graph given in Figure 5.3. Observe that from the initial node, the path dbe and the action b both lead to nodes of the local zone graph with the same state (p 0 , q 1 ) and the same set of synchronized valuations. As a consequence, if the path dbe is explored before exploring the action b, the node (p 0 , q 1 , Z 2 ) reached by b is sync-subsumed by the node (p 0 , q 1 , Z 1 ) reached by dbe, as shown in Figure 5.3. Further, we can see that the action a which is enabled from (p 0 , q 1 , Z 2 ) is not enabled from (p 0 , q 1 , Z 1 ).

Thus, to summarize, in order to make the local zone graph finite, we introduced a subsumption relation aLU sync between local zones. With the subsumption relation, the exploration of the graph is guaranteed to terminate, but the price to pay was that the diamond property was no longer true. As a consequence, it is not clear how to apply a partial-order reduction procedure on this graph. If we want to develop a partial order reduction procedure for networks of timed automata, we need to go back to local zone graphs and develop another subsumption technique that renders a transition system for which the independence relation between actions is easy to compute.

Chapter 6

A framework for applying partial order reduction using local zones

In Chapter 5, we proposed a new reachability algorithm for networks of timed automata based on the exploration of local zone graphs. In the algorithm, we compute a transition system called the local sync graph which is a finite truncation of the local zone graph. We discussed theoretical reasons why local sync graphs may be smaller than the standard zone graph. We would now like to apply partial order reduction to the reachability checking procedure based on the exploration of local zone graphs. In this way, we hope to achieve the gains due to both approaches -local time semantics, as well as partial order reduction.

However, we are faced with a major hurdle in this approach -as we pointed out in Section 5.4, we do not know to compute the independence relation between actions in local sync graphs. As a consequence, we do not know how to apply partial order reduction to local sync graph. So, if we want to apply partial order reduction while simultaneously using the local time semantics, we need to develop an alternate subsumption relation between local zones.

From our analysis of the challenges to applying partial order reduction to local sync graphs, we identify the following key problem: aLU sync subsumption does not preserve the set of all paths from a node of the local zone graph. An example illustrating this is discussed in Section 6.1. We would like our new subsumption operator to be path-preserving, i.e., if (q, Z) is covered by (q, Z ), then all the paths from (q, Z) are feasible from (q, Z ) as well. However, we show that, in general, it is not possible to obtain a finite quotient of the local zone graph that is path-preserving.

Recall that a finite quotient of the standard zone graph was constructed using the a LU abstraction [START_REF] Behrmann | Static guard analysis in timed automata verification[END_REF] that arises from a simulation relation for global valuations. Proceeding in a similar way, we propose a relation ≡ *

M between local valuations and prove that ≡ * M is a simulation relation (see Definition 2.18). Based on this simulation relation, we then define an abstraction operator a * M over local zones. It turns out that a * M is not finite in general. We observe that the main reason for this is the divergence between reference clocks of the different processes. In general, keeping track of arbitrarily large differences between reference clocks appears to be a major inherent difficulty when trying to design finite abstractions for local zone graphs.

We avoid this problem by restricting our attention to those networks, for which, given any feasible sequence of actions in its local zone graph, it is possible to find a run of the network where the differences between reference clocks is bounded at all times. In order to make this idea precise, we introduce the concept of spread of a valuation, which is the maximum difference between two reference clocks in the valuation. We say that a run is D-spread-bounded if the spread of all the valuations in the run are bounded by a non-negative integer D. A network is D-spread-bounded if every local run has an equivalent run that is D-spread-bounded. If a network is D-spreadbounded for some D, we simply say that the network is spread-bounded. Equipped with this notion, we restrict our attention to spread-bounded networks.

Let N be a network of timed automata that is D-spread-bounded. We show that when computing a covering relation between two nodes of the local zone graph of N , it is sufficient to consider containment with respect to the behaviour of valuations of spread D. We define a subsumption relation a D M for local zone graphs that does precisely this. a D M is parameterized by a constant D and compares sets of valuations of spread D. Essentially, this is a generalization of the idea of aLU sync introduced in Section 5.2 -while aLU sync compares the set of synchronized valuations in two local zones, a D M compares the set of valuations of spread D. We refer to the transition system obtained by applying the a D M subsumption to the local zone graph of a network as the LZG D M of the network. We then show that for a D-spread-bounded network of timed automata, it is sufficient to compute the LZG D M of the network to answer the reachability problem. We remark that the independence relation of LZG D M of a network is easy to compute. By defining the notion of the LZG D M of a D-spread-bounded network, we lay the foundations for applying partial order reduction to these networks. Finally, we motivate the idea of a source-set based partial order reduction method for LZG D M of a D-spread-bounded network. We prove that if N is D-spread-bounded, then applying the source set to the LZG D M (N ) is sound and complete w.r.t. reachability. We make this notion concrete in Chapter 8, where we propose an algorithm that applies partial order reduction to the exploration of the LZG D M of a network of timed automata.

No finite quotient for local zone graphs

As already shown in Chapter 4, the local zone graph of a network of timed automata is a symbolic representation of the local time semantics of the network that is sound and complete with respect to reachability. As local zone graphs are not finite in general, we need finite abstractions (see Definition 2.35) for local zone graphs to ensure the termination of a reachability procedure based on the exploration of local zone graphs. We now introduce the notion of an abstract local zone graph, which is a finite representation of a local zone graph. An abstraction operator a : P(R X ≥0 ) → P(R X ≥0 ) is a function from sets of local valuations to sets of local valuations. Definition 6.1 (Abstract local zone graphs). Given a timed automaton A, and an abstraction operator a, the abstract local zone graph based on a, denoted as LZG a (A) is a transition system with states of the form (q, W), where q is a state of A and W = a(W) is a set of local valuations. The initial state is (q 0 , W 0 ), where W 0 = a(Z 0 ) and Z 0 is the initial zone of LZG(A), and transitions are of the form (q, W)

t - → a (q , a(W )) if W = a(W) and W = {v | ∃ v ∈ W, ∃ δ ∈ R ≥0 s.t. (q, v) t - → δ - → (q , v )} is non-empty.
The abstraction a is said to be complete if for any path in LZG(A) of the form (q 0 , Z 0 ) σ -→ (q, Z), there is a path in LZG a (A) of the form (q 0 , W 0 ) σ -→ a (q, W), where W 0 = a(Z 0 ). a is said to be sound if for any path in LZG a (A) of the form (q 0 , W 0 ) ρ -→ a (q, W) there is a path in LZG(A) of the form (q 0 , Z 0 ) ρ -→ (q, Z). Definition 6.2 (Transition compatible abstraction). Let A be a timed automaton and let LZG(A) be the local zone graph of A and LZG a (A) be the abstract local zone graph based on an abstraction a. Let f be a mapping from the nodes of LZG(A) to the nodes of LZG a (A), such that for all nodes η, η 1 , η 2 of LZG(A)

• η and f (η) have the same control state.

• if η 1 t - → η 2 is a transition in LZG(A), then f (η 1 ) t - → a f (η 2 ) is a transition in LZG a (A).
If such a mapping f exists, then we say that a is transition compatible. Lemma 6.1. If a is transition compatible, then a is complete.

Proof. Let a be transition compatible and let f be the corresponding mapping from the nodes of LZG(A) to the nodes of LZG a (A).

Then, it can be observed that if σ is a path in LZG(A) leading to a node η, there exists a path σ to the node f (η) in LZG a (A). By definition of f , the nodes η and f (η) have the same control state.

We will now present a network of timed automata, for which we will show that there exists no finite abstraction that is both sound and transition compatible. The network A (Figure 6.1) that consists of two processes A 1 and A 2 , was originally presented in a similar context in Lugiez et al. [START_REF] Lugiez | A partial order semantics approach to the clock explosion problem of timed automata[END_REF]. It is easy to see that any accepting run of the network executes an equal number of a's and b's followed by the global action c.

A = A 1 A 2 A 1 A 2 p 0 p 1 q 0 q 1 a x = 1; {x} b y = 1; {y} c x = 1 c y = 1
Figure 6.1: A network with no finite quotient for LZG Consider the local zone graph of A, denoted as LZG(A). Let (p 0 , q 0 , Z i,j ) be the node of LZG(A) reached on the execution a i b j (let i > j) from the initial node:

(p 0 , q 0 , Z 0 )

a i b j --→ (p 0 , q 0 , Z i,j )
We denote by η i,j the node (p 0 , q 0 , Z i,j ) of the local zone graph.

Lemma 6.2. From the node η i,j in the local zone graph of A, the only sequence of the form b * c reaching the accepting state is b i-j c.

Proof. We know that the network A accepts the language

L A = {(ab + ba) * c}
This is the set of all global runs accepted by A. As a consequence, any local-time run of A which leads to an accepting state should see an equal number of a's and b's. This follows from the soundness of local time semantics w.r.t. the global semantics.

From the soundness of local zone graphs w.r.t. the local time semantics, we know that any sequence of actions which leads to an accepting node of the local zone graph must have an equal number of a's and b's. Therefore, if the path ρ leads to an accepting state from η i,j , since ρ cannot contain a's (by assumption), the number of b's in ρ must be i -j, and the number of c's must be 1. Moreover, the action c cannot occur before any occurrence of the action b, since the execution of c disables the action b. The only sequence of actions which satisfies this criterion is b i-j c. Corollary 6.1. There are infinitely many distinct nodes η i,j in the local zone graph of A. Lemma 6.3. There is no finite abstraction for local zone graphs that is sound and transition compatible.

Proof. Consider the network A and its local zone graph LZG(A). Let a be an abstraction of LZG(A) that is sound and transition compatible. We will show that a cannot be finite. Let LZG a (A) denote the abstract local zone graph of A based on a. Since a is transition compatible, there exists a mapping f from the nodes of LZG(A) to the nodes of LZG a (A), such that for any node η of LZG(A), η and f (η) have the same control state and if

η 1 t - → η 2 is a transition in LZG(A), then f (η 1 ) t - → a f (η 2 ) is a transition in LZG a (A).
From Corollary 6.1, we know that there are infinitely many nodes η i,j in LZG(A).

To show that a is not finite, we will show that

f (η i,j ) = f (η k,l ) if i -j = k -l
Let us assume, for the sake of contradiction, that this is not the case. This implies that there exist two nodes of LZG(A), η i,j and η k,l , such that f (η i,j ) = f (η k,l ), and i -j = k -l.

From Lemma 6.2, we know that from the node η i,j , the sequence b i-j c leads to an accepting node of LZG(A). Since a is transition compatible, we know that the sequence b i-j c leads to an accepting node from f (η i,j ) in LZG a (A). Similarly, we know that the sequence b k-l c leads to an accepting node from f (η k,l ) in LZG a (A). Since f (η i,j ) = f (η k,l ), we know that b k-l c leads to an accepting node from f (η i,j ) in LZG a (A).

Since the sequence a i b j leads to the node η i,j in LZG(A), we know that a i b j leads to f (η i,j ) in LZG a (A). Therefore, we can see that the path a i b j b k-l c leads to an accepting node in LZG a (A). Since the abstraction a is sound, this means that the run a i b j b k-l c leads to an accepting state in LZG(A). But we know from Lemma 6.2 that this is true only if i -j = k -l, which contradicts our assumption.

The network A (Figure 6.1) demonstrates a major inherent difficulty when trying to develop finite abstractions for local zone graphs. Recall that for local zone graphs, there is such a finite quotient that is based on a LU abstraction and a M abstraction [START_REF] Behrmann | Static guard analysis in timed automata verification[END_REF][START_REF] Behrmann | Lower and upper bounds in zone-based abstractions of timed automata[END_REF].

Observe that the paths posing problems in LZG(A) are those for which the difference between local times (the values of reference clocks) of two processes grows arbitrary. Our approach will be to restrict our attention to only runs passing only through valuations where the difference between local times is bounded. We say that such a run has bounded spread. The first step is to develop a generalization of a LU to an abstraction on local zones that preserves all runs of bounded spread. We construct such an abstraction, referred to as a * M , in the next section. We then address the main challenge of using it efficiently to check reachability.

A region equivalence for local valuations

In Section 2.3, we had presented the notion of regions for global valuations. In this section, we introduce a similar notion of regions for local valuations, referred to as M * -regions. As in the standard setting, we assume that we are given a bounds function M that determines for each clock x, the maximal constant M (x) used in a guard involving x. We will use a slightly different version of this bounds function which is defined over offset clocks and reference clocks. Our objective is to develop a notion of regions taking into account the bounds function. In contrast to the standard setting, even for a fixed M the number of M * -regions will be infinite. But we can still define a notion of an abstraction of a local zone similar to a LU abstraction in the standard setting.

We recall the notation that we use with respect to the set of clocks here. X p denotes the set of clocks of a process A p , and X = ∪ p∈Proc X p . Further, we use the following notation for clocks in the offset setting:

X p = { x | x ∈ X p }, X p = X p ∪ {t p } and X = p X p .

M * -regions

In this section, we introduce a notion of regions for local valuations. We will show that the idea is quite similar to the notion of regions in the setting of offset valuations, discussed in Section 2.3. We first restate a few technical lemmas that we had used to prove results for regions of offset valuations. These are presented with proofs in Section 2.3. We will use these lemmas to prove results about the region equivalence for local valuations. Lemma 6.4. For all x ∈ R \ Z, we have {-x} = 1 -{x}. Lemma 6.5. For x, y, z ∈ R, {z -x} ≤ {z -y} iff x -y = x -z + zy + 1. Lemma 6.6. For x, y, z ∈ R, {x -z} ≤ {y -z} iff {z -x} ≥ {z -y}. Definition 6.3. For local valuations v and v , we define v ≈ * v if for all pairs of offset clock variables (including reference clocks) x, y ∈ X , we have v(x -y) = v (x -y) . Lemma 6.7. Let v ≈ * v . Then, for variables x, y, z ∈ X , we have {v(z -

x)} ≤ {v(z -y)} iff {v (z -x)} ≤ {v (z -y)}.
Proof. Follows from Lemma 6.5 and Definition 6. Proof. We assume that δ < 1. If δ ≥ 1 then we can decompose it into its integral part and fractional part and repeat the reasoning.

We divide the variable differences into three sets:

C + = {t p -z | z ∈ X \ {t p }} C -= { z -t p | z ∈ X \ {t p }} C 0 = { x -y | x, y ∈ X \ {t p }}
A local delay of δ increases the value of differences in C + , decreases the ones in C -and leaves the C 0 differences unaltered. Consider an element φ ∈ C + . Based on the relation between δ and 1 -{v(φ)}, its value either stays in the same integer interval, or moves to the next integer point, or to the next integer interval. A symmetric change happens in C -. We now make this idea more precise.

u(t p -z) = v(t p -z) + δ = v(t p -z) + {v(t p -z)} + δ = v(t p -z) + 1 -{v( z -t p )} + δ u( z -t p ) = v( z -t p ) -δ = v( z -t p ) + {v( z -t p )} -δ
From the above calculations, we observe two properties:

u(t p -z) = v(t p -z) + 1 iff δ ≥ {v( z -t p )} (6.1) u( z -t p ) = v( z -t p ) -1 iff δ > {v( z -t p )} (6.2)
Note that the difference in the inequalities (≥ in (6.1) and > in (6.2)) is expected, since for any x ∈ R we have -x = -x if {x} = 0, and -x = -x -1 otherwise. Among the ordering of fractional parts of differences in C -for v, consider ( z 1 -t p ), ( z 2 -t p ) that are consecutive in this ordering such that {v( z 1 -t p )} ≤ δ < {v( z 2 -t p )}.

We now propose a δ as required. From Lemmas 6.6 and 6.7, we know that the fractional parts of differences in C -are ordered in the same way in v and v . We take any δ with {v ( z

1 -t p )} ≤ δ < {v ( z 2 -t p )}, such that in addition δ = {v ( z 1 -t p )} if δ = {v( z 1 -t p )}. Let u = v + δ .
Since we started with v ≈ * v , from (6.1) and (6.2) we get u ≈ * u .

Thanks to these intermediate results, we can now propose a region equivalence for local valuations, for the given clock bounds. As in the standard setting, we consider a bound function M that maps each clock to a non-negative integer. For convenience, we consider a modified function M tailored for clocks in the offset setting. For standard clocks, just as in the standard case, M (x) gives the maximal constant used in a guard involving x. For reference clocks t p , we set

M (t p ) = ∞. That is, M ( x) = M (x) for offset clocks x ∈ X M (t p ) = ∞ for reference clocks t p ∈ X
The notion of M * -equivalence that we propose ensures that two local valuations can simulate each other in an arbitrary timed automata whose guards respect M bounds. Definition 6.4 (M * -equivalence). Let M : p∈P roc X p ∪ {t p } → N ∪ {∞, -∞} be a bounds function mapping each clock to a non-negative constant, -∞ or ∞. For a local valuation v, let

Bounded(v) = p∈P roc {x ∈ X p | v(t p -x) ≤ M (x))}
Note that by definition, all the reference clocks belong to Bounded(v).

Two local valuations are M * -equivalent, denoted as v

≡ * M v , if • Bounded(v) = Bounded(v ) • v B ≈ * v B where v B and v B denote the valuations v and v restricted to clocks in B = Bounded(v).
We write [v] M * to denote the equivalence class of v under ≡ * M and refer to it as the M * -region of v.

For example, consider the network A (Figure 6.1), that contains two processes A 1 and A 2 . Let t 1 , t 2 be the reference clocks of A 1 , A 2 respectively. From the network, we have

M ( x) = M ( y) = 1, M (t 1 ) = M (t 2 ) = ∞.
A local region for N is given by one of the four possible intervals [0, 0], (0, 1), [1, 1], (1, ∞) for the differences t 1 -x, t 2 -y and x -y and one of the infinitely many intervals [0, 0], (0, 1), [1, 1], (1, 2), [2, 2], . . . for (the modulus of) t 1 -t 2 . This is because by Definition 6.4, all reference clocks t p are automatically in Bounded(v) and the exact integral values between their differences need to be maintained. As a consequence, there are infinitely many M * -regions. The example of network A (Figure 6.1) shows that this is the price to pay for working with local valuations.

We say that a network of timed automata conforms to bounds function M if for each process p and clock x ∈ X p , all the guards testing x use constants not bigger than M (x). We write (q, v) ≡ * M (q, v ) when v ≡ * M v . Recall the definition of a simulation relation given in Definition 2.18. A simulation relation on the local time semantics is a binary relation between configurations (q, v) (q, v ) such that:

• is reflexive and transitive,

• for every local delay-action sequence (q, v)

∆,b
--→ (q 1 , v 1 ), there exists a local delay sequence ∆ such that (q, v )

∆ ,b --→ (q 1 , v 1 ) and (q 1 , v 1 ) (q 1 , v 1 ).
The relation is a bisimulation if is also symmetric. Proposition 6.1. Let M be a bounds function. Consider a network of timed automata conforming to M . The relation (q, v) ≡ * M (q, v ) is a bisimulation.

Proof. From Lemma 6.8, we know that for each local delay transition (q, v) δ -→ p (q, u) there is a local delay (q, v ) δ -→ p (q, u ) such that u ≡ * M u . Next, we consider the case of action transitions. Since v ≡ * M v , we have v(t p -x p ) > M (x p ) iff v (t p -x p ) > M (x p ), for all x p ∈ X p and p ∈ Proc. Moreover, when x p is bounded, v(t p -x p ) = v (t p -x p ) and v( x p -t p ) = v ( x p -t p ) . Hence, v satisfies a guard x p ∼ c with ∼ ∈ {<, ≤, >, ≥} and c ≤ M (x p ) iff v satisfies the guard. Further, as a reset of x p results in v(

x p ) = v(t p ), it is clear that if v ≡ * M v , then [R]v ≡ * M [R]v .
From Proposition 6.1, we infer that [v] M * is a region analogous to the standard case, for the setting of local valuations.

Abstraction operation a *

M

Equipped with the notion of M * -regions we can define the operation of a * M -abstraction for local zones. In the standard setting, a LU abstraction of a zone is a union of all LU -regions intersecting the zone. Analogously, we define a * M abstraction of a local zone to be the union of all M * -regions intersecting the local zone. Definition 6.5 (a * M abstraction). For a local zone Z, we define a *

M (Z) := {v | ∃ v ∈ Z with v ≡ * M v }.
Recall that in the standard setting, the abstraction of a zone is not a zone. Similarly, in our setting, the abstraction of a local zone may not be a local zone. In Section 6.4, we will show that in spite of this, the non-inclusion test Z ⊆ a * M (Z ) can be done efficiently. Observe that a * M abstraction is not finite in general. This is a direct consequence of the existence of infinitely many M * -regions. For instance, in the local zone graph of A (Figure 6.1), the local zone Z ij reached on the execution a i b j has the constraints:

t 1 -x ≥ i ∧ t 2 -y ≥ j ∧ x -y = i -j. Pick a valuation v ij with: t 1 -x = 1 ∧ t 2 -y = 1 ∧ t 1 -t 2 = i -j ∧ x -y = i -j.
From the constraints in zone Z ij , we see that for a pair i , j different from i, j we have v ij ∈ Z i j due to the x -y constraint. Hence for two different zones of the form Z ij , it cannot be the case that one subsumes the other. This gives an infinite local zone graph, even with the a * M abstraction. In Section 6.3, we will examine situations when the a * M abstraction becomes finite.

Bounding the spread

In Section 6.2, we proposed a relation ≡ * M between valuations in the local time semantics, and we proved that ≡ * M is a simulation relation for local valuations. Further, we showed that the abstraction relation a * M constructed using this simulation is not finite. We observe that the key issue that prevents us from obtaining finite abstractions of local zone graphs is the lack of bound on the differences between reference clocks.

As a solution to this problem, we restrict our attention to those networks for which, given any feasible sequence of actions in its local zone graph, it is possible to find a run where the difference between reference clocks is always bounded. To make this idea precise, we introduce the notion of the spread of a valuation, which is defined as the maximum difference between two reference clocks in the valuation. We say a run is spread-bounded if the spread of all valuations in the run is bounded by some non-negative integer D. Equipped with this notion, we restrict our attention to those networks in which each run has an equivalent spread-bounded run. For local zone graphs of networks of timed automata that are D-spread-bounded, we show that it is sufficient to look at valuations of spread D, in order to get a finite local zone graph, that is amenable to partial order reduction.

We will now formally define the notion of spread and spread-boundedness.

Definition 6.6. The spread between processes A p , A q in a valuation v is the absolute value of the difference between their reference clocks: |v(t p ) -v(t q )|.

We say that a valuation v has spread D if the spread between every pair of processes in v is at most D.

Definition 6.7. Consider a run in the local time semantics

(q 0 , v 0 ) ∆ 1 --→ a 1 -→ (q 1 , v 1 ) ∆ 2 --→ a 2 -→ • • • (q n-1 , v n-1 ) ∆n --→ an -→ (q n , v n )
We say that it is D-spread if all v 0 , . . . , v n have spread D.

We now present examples of D-spread runs of a network. Consider the network A given in Figure 6.1. Observe that between the execution of two a actions, the process A 1 needs to elapse exactly one unit of time. Likewise, between the execution of two b actions, the process A 2 needs to elapse exactly one unit of time.

Consider the following run of A.

(p0, q0) t1 = 0, x = 0 t2 = 0, y = 0 (p0, q0) t1 = 1, x = 1 t2 = 0, y = 0 (p0, q0) t1 = 2, x = 2 t2 = 0, y = 0 (p0, q0) t1 = 2, x = 2 t2 = 1, y = 1 (p0, q0) t1 = 2, x = 2 t2 = 2, y = 2 (p1, q1) t1 = 3, x = t2 = 3, y = ∆1 a ∆2 a ∆3 b ∆4 b ∆5 c Figure 6.2: A run of A of spread 2
From inspection of the run given in Figure 6.2, we see that the maximum spread between A 1 and A 2 is in v 2 , and v 2 (t 1 -t 2 ) = 2. Thus, the spread between A 1 and A 2 in v 2 is 2 and as a consequence, the run is 2-spread.

Consider another run of A given in Figure 6.3.

(p0, q0) t1 = 0, x = 0 t2 = 0, y = 0 (p0, q0) t1 = 1, x = 1 t2 = 1, y = 0 (p0, q0) t1 = 1, x = 1 t2 = 1, y = 1 (p0, q0) t1 = 2, x = 2 t2 = 2, y = 1 (p0, q0) t1 = 2, x = 2 t2 = 2, y = 2 (p1, q1) t1 = 3, x = t2 = 3, y = ∆1 a b ∆2 a b ∆3 c Figure 6.3: A run of A of spread 0
From Figure 6.3, we see that for all valuations in the run, the spread between A 1 and A 2 is 0, and therefore, the run is 0-spread.

Next, we define when a network of timed automata is said to be spreadbounded. Definition 6.8. A network of timed automata N is said to be D-spreadbounded if every local run of N can be converted to a D-spread run by adjusting the delays.

Observe that if a network N is D 1 -spread, from Definition 6.8, it follows that N is D 2 -spread, for all D 2 ≥ D 1 . On a different note, we remark that in order to convert a run to a D-spread run, we can adjust also the delays of processes that do not participate in the next action.

Just as we defined sync(Z) as the restriction of the local zone Z to synchronized local valuations (see Section 5.2), we define spread D (Z) as the restriction of Z to local valuations of spread D. This allows us to define a finite abstraction operation, and a subsumption operation based on it. Definition 6.9 (a D M -subsumption). Let D be an integer and M a bounds function. For a zone Z we define:

spread D (Z) = Z ∩ {t p -t q ≤ D : p, q ∈ Proc} .
We define the a D M subsumption operation, denoted as

Z D M Z , by spread D (Z) ⊆ a * M (spread D (Z )) .
Definition 6.10 (LZG D M (N )). Let N be a network of timed automata conforming to a bound function M . A local zone graph with a D M -subsumption for N , denoted LZG D M (N ), is a graph whose nodes are pairs (q, Z) where q of a state of N and Z is a local zone. The initial node of LZG D M (N ) is the initial node (q 0 , Z 0 ) of LZG(N ) and for each node (q, Z) either:

• the node is uncovered, namely, for each transition (q, Z)

a - -→ (q , Z ) in LZG(N ) there is transition (q, Z) a - -→ (q , Z ) in LZG D M (N ) if spread D (Z ) is not empty; or
• the node is covered, namely, (q, Z) has no outgoing transitions, and there exists an uncovered node (q, Z ) such that Z D M Z .

Note that the definition implies that the initial node is uncovered. In Theorem 4.1, we reduced the reachability problem for N to reachability in LZG(N ). More precisely, N has a run executing a chosen action α iff there is a path in LZG(N ) starting from the initial node and containing the α edge. The next sequence of lemmas implies that LZG D M (N ) is sound and complete w.r.t. reachability. In other words, we will show that LZG D M (N ) can be used in place of LZG(N ). Moreover, LZG D M (N ) is a finite abstraction of LZG(N ). Additionally, if N is D-spread-bounded then we can use a partial order reduction method while exploring it.

Remark. Until now, we always defined acceptance as reaching a state of the network. We show that it is possible to convert a standard network that accepts by reaching an accepting state to a network that accepts by executing an action at the end. A detailed discussion of this transformation is presented in Appendix B. Lemma 6.9. For every D and a bounds function M that does not map any offset clock to ∞, the graph LZG D M (N ) is finite.

Proof. First, observe that there are only finitely many sets of the form a * M (spread D (Z)) for some zone Z. Indeed, such a set is a collection of M *regions of local valuations belonging to spread D (Z). We will show that there is a bound on the constants in constraints defining [v] M * (cf. Definition 6.4) for v ∈ spread D (Z). As the spread of v is bounded by D, the difference between each pair of reference clocks t p and t q is bounded by D. If a clock x is unbounded then there are no constraints between x and other variables. If x is a clock of A p , and x is bounded then t p -x p < M ( x p ). This implies that t q -x p < M ( x p ) + D for all other reference clocks t q . For the constraint x-t p < c, we know that c ≤ 0 since x ≤ t p . Then, it follows that -c ≤ M ( x p ), as otherwise x -t p < -M ( x p ) giving t p -x > M ( x p ), which is inconsistent with t p -x p < M ( x p ). Lastly, for a constraint of the form x -y < c, we can deduce, for the same reasons that c ≤ D + max(M ( x), M ( y)).

Having defined LZG D

M and proved its finiteness, we now state a property of D M subsumption, which will be useful in proving results about LZG D M later.

Lemma 6.10. Suppose that N is a D-spread-bounded system conforming to the bounds function M and (q, Z) is a node reachable in

LZG D M (N ). Then, if Z D M Z and (q, Z) a -→ (q 1 , Z 1 ), then (q, Z ) a -→ (q 1 , Z 1 ) for some Z 1 with Z 1 D M Z 1 . Proof. Since (q, Z) a -→ (q 1 , Z 1 ), by the pre-post property of local zones, for each v 1 ∈ Z 1 , we have v ∈ Z such that (q, v) a - -→ (q 1 , v 1 ). Consider v 1 that is D-spread-bounded.
Since N is D-spread-bounded, every local run of N can be converted to a D-spread run. As a consequence, we can assume that v is D-spread-bounded. By definition of a D M subsumption, there is a v ∈ Z such that v ≡ * M v . Since v is D-spread-bounded, so is v , by definition of ≡ * M . Further, from Proposition 6.1, we also have (q, v )

a - -→ (q 1 , v 1 ) such that v 1 ≡ * M v 1 .
Since LZG D M is obtained from LZG by removing some transitions, we immediately obtain Lemma 6.11. Lemma 6.11. For each action α, if action α is reachable by a path in LZG D M (N ), then it is also reachable by a path in LZG(N ). Now, it remains to show that LZG D M is complete. This is given by Lemma 6.12. The proof follows similarly to the proof of completeness of local sync graphs (Theorem 5.2). Lemma 6.12. Given a network of timed automata N , consider M -bounds function compatible with guards in N . If q is reachable in N , then in LZG D M (N ) a node (q, Z) is reachable from the initial node, for some nonempty zone Z.

Proof. Consider a global run of N : (q 0 , v 0 )

δ 1 ,b 1 = = =⇒ (q 1 , v 1 ) • • • δn,bn ===⇒ (q n , v n ).
By induction on i, for every (q i , v i ) we can find a reachable uncovered node (q i , Z i ) of LZG D M (N ), and a local (in fact, synchronized) valuation v i , such that v i ∈ Z i and local(v i ) ≡ * M v i . Since a synchronized valuation has spread D by definition, this establishes the completeness of LZG D M , since every reachable (q i , v i ) will have a reachable representative node in LZG D M (N ). The argument is quite similar to the proof of Theorem 5.2, with the difference that in this proof, we consider a * M subsumption instead of a LU subsumption. The base case of the induction follows directly. Next, we look at the induction step. Consider the global step (q i , v i )

δ i ,b i = = =⇒ (q i+1 , v i+1
). Since the global delay δ i can be thought of as a sequence of local delays, we have the local run (q i , local(v i ))

∆ i ,b i ---→ (q i+1 , local(v i+1 )). By induction hypothesis, we have v i ∈ Z such that v i ≡ * M local(v i ).
From Lemma 6.1, we know that there exists a delay ∆ i such that (q i , v i )

∆ i ,b i ---→ (q i+1 , v i+1 ) such that v i+1 ≡ * M local(v i+1 ). Since local(v i+1
) is a synchronized valuation, from the definition of ≡ * M , it follows that v i+1 is also synchronized. Using the pre-property of local zones (Lemma 4.6), there exists a transition (q i , Z i )

b i - -→ (q i+1 , Z i+1 ) with v i+1 ∈ Z i+1 (in fact, v i+1 ∈ sync(Z i+1 )). If (q i+1 , Z i+1
) is uncovered, then v i+1 and Z i+1 are as needed for the induction step. Otherwise, by the definition of LZG D M (Definition 6.10), there exists an uncovered node

(q i+1 , Z i+1 ) such that Z i+1 D M Z i+1 . Since v i+1 ∈ spread D (Z i+1 ), we have v i+1 ∈ spread D (Z i+1 ) such that v i+1 ≡ * M v i+1 .
In this case, we take v i+1 for v i+1 and Z i+1 for Z i+1 .

We now present an alternate way to obtain the completeness for LZG D M . Observe that the LZG D M with D = 0, is the graph we would get if we use a M subsumption instead of a LU subsumption, while computing the local sync graph. Further, observe that using a * M subsumption instead of a LU subsumption does not affect the correctness of local sync graph. Then, from the completeness of local sync graphs, we immediately get the completeness of LZG D M with D = 0, for all networks. Since increasing the parameter spread D while computing LZG D M maintains the reachable nodes of LZG D M with lower values of D, this does not affect the completeness.

Partial order reduction for LZG D M

As promised, in this section, we will show how it is possible to use partial order exploration in LZG D M . We will adopt a quite abstract view of partial order reduction. Later we will explain our choice by showing that it would not make sense to refer to diamonds in LZG D M when defining a reduction. A partial order reduction can be seen as a way of defining a function source : Q → P(Σ) assigning a set of actions to each state of N . A source transition in LZG is a transition (q, Z) a --→ (q , Z ) in LZG such that a ∈ source(q). Observe, that source depends only on the state component of the configuration. A source path is a path consisting of only source transitions.

A source function is complete for a LZG, if whenever there is a path executing α then there is a source path executing α. Note that if α is not reachable then every source function is complete. If α is reachable, and we are given a path to α then we can take a source function that chooses exactly this path. Our goal is to have a source function that is easier to calculate than solving the reachability problem in the first place.

We define a path with subsumption edges as a path of LZG D M in which edges can either edges of the LZG or subsumption edges between nodes of the LZG. Now, we can also talk about source paths with subsumption edges. Lemma 6.13. Suppose that N is a D-spread-bounded system conforming to the bounds function M . For every path (q 0 , Z 0 )

a 1 - -→ (q 1 , Z 1 ) a 2 - -→ . . . (q n , Z n ) in LZG(N )
, there exists a path with subsumption edges in LZG D M (N ) (q 0 , Z 0 )

a 1 - -→ (q 1 , Z 1 ) a 2 - -→ . . . (q n , Z n ), such that spread D (Z n ) ⊆ a * M (spread D (Z n )).
If the initial path is a source path, so is the path in LZG D M .

Proof. Consider a path σ = a 1 a 2 • • • a n in LZG(N ). Consider a local run that is an instantiation of this path: (q 0 , v 0 )

a 1 - -→ (q 1 , v 1 ) a 2 - -→ . . . an --→ (q n , v n ).
Since N is D-spread-bounded, we may assume that each valuation in this run has spread D. We will show, by induction on i, that the path a 1 a 2 • • • a n exists in LZG D M (N ). From our induction hypothesis, we know that there is a path till (q i , Z i ) and that there is a D-spread-bounded valuation v i ∈ Z i , with a path (q i , v i )

a i+1 ---→ (q i+1 , v i+1 ) a i+2 ---→ • • • an --→ (q n , v n )
where all valuations are D-spread-bounded. Clearly, the induction hypothesis holds for the initial configuration. For the induction step we look at the definition of LZG D M . If (q i , Z i ) is not covered, then we have (q i , Z i ) a i+1 ---→ (q i+1 , Z i+1 ) with v i+1 ∈ Z i+1 . In this case, we are done with the induction step.

Next, consider the case where (q i , Z i ) is covered. In this case, there is an uncovered node (q i , Z i ) with

Z i D M Z i . By definition of a D M subsumption, there is a v i ∈ Z i such that v i ≡ * M v i . Since v i is D-spread-bounded, by definition of ≡ *
M , we know that v i is also D-spread-bounded. We also have a run (q i , v i )

a i+1 ---→ (q i+1 , v i+1 ) a i+2
---→ . . . an --→ (q n , v n ) by Proposition 6.1. Since N is D-spread-bounded, we can assume that this run is D-spread-bounded. Thus, we are done with the induction step in this case also.

Finally, since source depends only on the state component, the above path is a source path if the initial one was.

From Lemma 6.11 and Lemma 6.13, we immediately get Theorem 6.1. Theorem 6.1. Suppose that N is a D-spread-bounded system conforming to M . If source is a complete function for LZG(N ) then α is reachable on a run of N iff it is reachable on a source path of LZG D M (N ).

The formulation given above with source sets may seem more abstract than necessary -we will now explain why this is useful. We first examine more closely whether the diamond and the forward diamond properties (see Definition 2.48) hold in LZG D M (N ) for actions with disjoint domains. We show that, in general, actions with disjoint domains do not satisfy the diamond property in LZG D M (N ). We illustrate this schematically using an example in Figure 6.4. Let N be a network of timed automata and let a and b be actions of the network, such that dom(a) ∩ dom(b) = ∅. Then, from Lemma 4.7, we know that there is a diamond in LZG(N ) between the actions a and b. Consider the LZG D M (N ) given in Figure 6.4. Suppose that the node (s b , Z b ) is covered by (s b , Z b ). Further, suppose that a is an outgoing action from (s b , Z b ) and leads to a node (s ab , Z ab ). Observe that the node (s ab , Z ab ) may be covered by another node (s ab , Z ab ) in LZG D M (N ). It is possible that the node (s ab , Z ab ) may not be covered by the node (s ab , Z ab ), or vice versa. Thus, in LZG D M (N ), effectively, the diamond between a and b in LZG(N ) is torn apart by two subsumptions, as illustrated in Figure 6.4.

(s0, Z0) (sa, Za) (s b , Z b ) (s ab , Z ab ) (s ab , Z ab ) (s b , Z b ) (s ab , Z ab ) a b b D M D M a LZG D M (N )
Despite the lack of diamonds in LZG D M , Theorem 6.1 allows us to apply any source set based method on LZG D M (N ). Suppose that we have an algorithm that given a network N computes for every state q, the set of actions source(q). If this source function is complete for LZG(N ) then we can use it for exploration in LZG D M (N ). By Theorem 6.1, there is a source path in LZG D M (N ) executing the given action α iff there is a source path in LZG(N ). By Theorem 4.1 the later statement is equivalent to N having a run executing α.

Testing Z ⊆ a * M (Z )

The results of Section 6.3 imply that we can use LZG D M (N ) for checking reachability provided N is D-spread-bounded and conforms to the bounds function M . In this section, we address the question of constructing LZG D M (N ) efficiently. In principle, this can be done with a standard exploration algorithm if the subsumption relation a D

M can be computed efficiently. We show that checking a D M subsumption between two local zones can be done with efficiency similar to that of testing subsumption in the standard setting.

In this section, we show that given two local zones Z and Z , checking if

Z D M Z can be done in O(| X | 2 ) time
, where X is the set of all clocks (including offset clocks and reference clocks). Observe that the complexity is the same as in the global case, although in our setting we need to take into account the reference clocks. As in the global case, the complexity follows by showing that if inclusion does not hold, then there is a negative cycle witness over just two clocks, as shown in Proposition 6.2. However, the final test (Theorem 6.2) has subtle differences from the previous test on global zones.

Recall that in the representation of global zones using difference bound matrices (see Section 2.5), a special zero clock is added whose value is always 0. The value of a clock x in the global situation is read with respect to this zero clock as x -0. In the local-time situation, the reference clocks act as different zeroes and hence there is a choice of which x -t q to pick. In the inclusion test, we need to carefully choose this offset. The goal of this section is to provide the actual inclusion test through a sequence of intermediate technical observations, closely resembling the global test.

First, we state Lemma 6.14, that follows directly from the definition of the abstraction (see Definition 6.5). Lemma 6.14. Let Z, Z be non-empty local zones. We have that Z ⊆ a * M (Z ) iff there exists a valuation v ∈ Z such that [v] M * ∩ Z is empty.

Our objective is to efficiently find a valuation v that witnesses the noninclusion. For the rest of this section, we consider zones to be represented using (canonical) distance graphs (see Section 2.5). Recall that in a distance graph, an edge x ( ,c) ---→ y translates to y -x c. Note that we use x to denote the smallest integer greater than or equal to x. Definition 6.11 (Local zone representation for a region). Given a local valuation v, define local zone G v to be the canonical form of the following set of constraints:

1. for each process A p and clock x ∈ X p such that x ∈ Bounded(v),

add constraint t p -x > M x if M x = -∞ (which translates to edge t p (<,-Mx) ------→ x) or the constraint t p -x ≥ 0 if M x = -∞ (which translates to edge t p (≤,0) ---→ x).
2. for every x, y ∈ Bounded(v), add x -y < v(x -y) if v(x -y) is not an integer, and x -y ≤ v(x -y) otherwise (which gives edge y -→ x with the appropriate weight) Lemma 6.15. For each valuation v, we have

[[G v ]] = [v] M * .
Proof. Follows directly from definitions.

We now define a ceiling function for weights. Definition 6.12. Given a weight (≤, c) with c ∈ R ≥0 , we define (≤, c) = (<, c ) if c is not an integer, and (≤, c) = (≤, c) otherwise. When the weight is of the form (<, c) we define (<, c) = (<, c ) if c is not an integer, and (<, c) = (<, c + 1) otherwise.

We remark that there is some asymmetry in Definition 6.12 when the weight is of the form (<, c). The reason for adopting this convention will be clear from the proof of Lemma 6.17, where we use it for the first time. A more detailed discussion about the choice of this convention is available in in [START_REF] Srivathsan | Abstractions for timed automata[END_REF]. Lemma 6.16. In the canonical distance graph G v , the edge y → x (the tightest constraint for x -y in [v] M * ) is given by:

[v] M * yx =            (<, ∞) y ∈ Bounded(v) (≤, v(t p -y)) + (<, -M x ) y ∈ Bounded(v), x ∈ Bounded(v) , M x = -∞ (≤, v(t p -y)) y ∈ Bounded(v), x ∈ Bounded(v), M x = -∞ (≤, v(x -y))
otherwise where t p is the reference clock of the process A p such that x ∈ X p .

Proof. Let the graph obtained from constraints given in Definition 6.11 be called G v . This graph on canonicalization gives G v .

The lemma follows from a sequence of observations on G v . If y is unbounded then there there is no outgoing edge from y so there is no path to x. So suppose that y is bounded. If x is also bounded then actually the shortest path from y to x in G v is given by the edge y → x. To see this, assume to the contrary, that there is a shorter path y → • • • → x. Together with the edge x → y this path would form a negative cycle.

The last case is when x is unbounded. Then, the only edge containing

x is coming from its reference clock: it is t p

(<,-Mx) ------→ x or t p (≤,0) ---→ x.
So, all the paths from y to x use the edge t p → x. Since t p is bounded by definition, by the first observation, the shortest path from y to t p has weight (≤, v(t p -y)) . Proposition 6.2. Let Z be an arbitrary local zone. Then, [v] M * ∩ Z is empty iff there exist two variables x, y such that:

1. y ∈ Bounded(v), x is either a reference clock or a process clock with M x = -∞ and 2.

[v] M * yx + Z xy < (≤, 0).

Proof. We assume that zones [v] M * and Z are represented by their canonical distance graphs G v and G Z . The intersection [v] M * ∩ Z is empty iff there is a negative cycle in min(G v , G Z ). Let us call this negative cycle N . Since both the zones are canonical, we can assume that the edges of N alternate between those of G v and G Z . We will now establish that this cycle can be reduced to a cycle containing only two variables. Consider an unbounded variable x ∈ N with M x = -∞. The only edges in G v involving x are of the form y → x with y ∈ Bounded(v). Since the consecutive edges of N should alternate between G v and G Z , this implies that the incoming edge should be from a bounded variable and the outgoing edge should be to a bounded variable. Thus, we cannot have two consecutive unbounded variables in N .

Suppose that there are two variables b

1 , b 2 ∈ N with b 1 , b 2 ∈ Bounded(v).
2 → b 1 from G v is a negative cycle. Hence b 1 → x 1 • • • x k → b 2 → b 1 with b 2 → b 1 from G v
is a shorter negative cycle. Due to this reason, we can assume, without loss of generality, that N contains at most two variables from Bounded(v), and when there are exactly two of them they are connected by a direct edge, implying that N contains only these two variables.

Thus, we now have a cycle b 1 → x → b 2 → b 1 in N . Since the edges of N should alternate between G v and G Z , we know that two consecutive edges of this cycle should be from the same graph. Since both G v and G Z are canonical, we can replace these two edges with a direct edge, to get a cycle of the same weight. Thus, we now have a cycle over two vertices, where at least one of them is a bounded variable.

Chapter 7

Spread-bounded systems

In Chapter 6, we proposed a subsumption relation D M for local zones that is based on a simulation relation between local valuations, and introduced the transition system obtained by applying the D M subsumption to the local zone graph of a network, referred to as the LZG D M of the network. We showed that if a network of timed automata is D-spread-bounded, then it is sufficient to explore the LZG D M of the network to answer the reachability problem for the network. Furthermore, using Theorem 6.1, we showed that the properties of LZG D M allow us to use a partial order reduction technique while exploring the LZG D M of the network. In Chapter 8, we will propose an algorithm that applies a partial order reduction method based on source sets to the LZG D M of a network.

However, constructing the LZG D M of a network of timed automata (and then applying partial order reduction to the LZG D M ) is sound and complete with respect to reachability only if the network is D-spread-bounded. Therefore, it is crucial to have ways to identify when a network is spread bounded and compute a tight bound D on the spread of the network.

In this chapter, we first illustrate, by the means of an example, that there are networks of timed automata which have unbounded spread. This demonstrates the need for efficiently checkable conditions to say when a network is spread-bounded. We define two classes of networks of timed automata, which we refer to as global-local systems and client-server systems, respectively. We give customized conditions for spread-boundedness of networks belonging to both these classes.

A major handicap of the D M subsumption is that in general, it preserves more information than the sync-subsumption. For subsumption between two nodes of the LZG, while the sync-subsumption only compares synchronized valuations in the zones, the D M subsumption involves comparing all the valuations of some fixed spread D. As a consequence, the D M subsumption may result in lesser coverings and consequently, a bigger zone graph, when compared to the zone graph generated using the sync-subsumption. Thus, if a network of timed automata is 0-spread-bounded, we have the best of both worlds -we are able to work with smaller zone graphs in the first place, while also benefiting from the gains due to partial order reduction.

Lastly, we show that, in general, the problem of deciding whether a network of timed automata is 0-spread-bounded is hard. We prove that given a network of timed automata, deciding whether the network is 0-spreadbounded is Pspace-complete. We also show that deciding whether a network of timed automata is D-spread-bounded is Pspace-hard.

Definitions: Here we briefly recall some of the definitions pertaining to this chapter. Let N = {A 1 , A 2 , • • • , A n } be a network of timed automata. The spread between processes A p and A q of N in a valuation v is defined as the absolute value of the difference between their reference clocks, |v(t p ) -v(t q )|. We say that a valuation v has spread D if the spread between every pair of processes in v is at most D. Given a local run σ of N , we say that σ is D-spread if all valuations of σ have spread D. We say that N is said to be D-spread-bounded if every local run of N can be converted to a D-spread run by adjusting the delays.

Systems with unbounded spread

In this section, we present an example of a network of timed automata that has unbounded spread. In doing so, we illustrate a typical situation that prevents a system from having a bounded spread.

Consider a network A that consists of two processes, A 1 and A 2 , as shown in Figure 7.1.

Lemma 7.1. A is not spread-bounded.

Proof. Consider the run a m bc of A. In this run, the process A 1 executes m times the self-loop a on state p 0 . Note that each iteration of this loop takes exactly 1 time unit. In parallel, the process A 2 needs to execute a local action b in a bounded time (without elapsing more than 1 time unit) and then synchronize with A 1 . So, A 2 reaches q 1 in less than 1 time unit. As a consequence, after executing the loop on action a for m times, the spread between A 1 and A 2 is at least m -1. The two automata are in states p 0 and q 0 , and the local time of A 1 is at least m and the local time of A 2 is less than 1. Thus, the run a m bc is feasible in local time semantics and has spread at least m -1. Since m can be arbitrary, the spread of this network is not bounded. This example shows that not all networks of timed automata are spreadbounded. Thus, if we are to apply partial order reduction method to a

A = A 1 A 2 A 1 A 2 p 0 p 1 q 0 q 1 q 1 a x = 1; {x} c b y < 1 c Figure 7
.1: Example of a network of timed automata with unbounded spread network of timed automata, we need to be sure that the network is spreadbounded. Therefore, it is crucial to have ways to identify when a network is spread-bounded and compute the bound D on the spread of the network. This is our focus in the next sections.

We define two classes of networks of timed automata, namely global-local systems and client-server systems. We then propose conditions for spreadboundedness for networks belonging to these classes and give bounds for the spread of such networks.

Global-local systems

We introduce a special class of networks of timed automata where each communication action synchronizes all the components of the network. We say a network

N = {A 1 , A 2 , • • • , A n } is a global-local system if it satisfies two properties:
(gl-trans) N has only two kinds of actions -local actions whose domain is {A i } for some i, and global actions whose domain is

{A 1 , A 2 , • • • , A n }.
(gl-final) Every accepting state of N is only reachable by executing a global action in the end. In other words, if a tuple (q 1 , • • • , q n ) is an accepting state, then for 1 ≤ i ≤ n each incoming transition to q i is labelled by a global action.

An execution of a global-local system is a sequence that alternates between subsequences containing only local actions and subsequences containing only global actions. From Lemma 4.7, we know that in a sequence of local actions, actions of different processes can be commuted as they have disjoint domains. However, no local action can be commuted with a global action, as they do not have disjoint domains. We also cannot commute two global actions. Effectively, this means that a global action cannot be commuted with any other action. As a consequence, any commuting of actions that we do has to be restricted to the sequence of local actions between two global actions.

We will now give sufficient conditions for a global-local system to be spread-bounded. In Section 7.2.1, we focus on conditions for 0-spreadboundedness. Later, in Section 7.2.2 we will discuss conditions to conclude that a global-local system is spread-bounded, but not necessarily 0-spreadbounded.

Conditions for 0-spread

In this section, we investigate when a global-local system is 0-spread. We propose some sufficient conditions for a global-local system to be 0-spread.

By definition, the valuation obtained immediately after executing a global action has spread 0. We observe that one way to make a run 0-spread is to make the execution times of all local actions between two global actions identical. A local fragment of the run can be converted to this form, if one of the following are possible:

1. all local actions can be delayed so that they can be executed at the time of the next global action, or 2. all local actions can be accelerated so that they can be executed at the time of the preceding global action.

If it is possible to transform every sequence of local actions in this way, then, the whole run can be converted to a 0-spread run.

As a preparatory step, for every local state of a process and every clock, we calculate if there is an active, upper or lower bound guard in this state. This is analogous to computing LU bounds for clocks with the exception that here, we only need to know if the bound is -∞ or not; we do not care for the exact value of the bound. Definition 7.1. For a local state q of a process, we define UGV (q) to be the set of clocks x such that there is a path from q to a transition with an upper bound guard on x, and x is not reset on the path. Similarly we define LGV (q) but for lower bound guards. Definition 7.2. A state q of an automaton is locally-relaxed if for each sequence of local actions q = q 1

g 1 --→ R 1 q 2 g 2 --→ R 2 . . . g k --→ R k q k+1 : 1. If g i has an upper bound guard on x, then x ∈ R 1 ∪ • • • ∪ R i-1 ; in
particular, g 1 has no upper bound guard.

2. If x ∈ R i then x does not have a lower bound guard in g i+1 , . . . , g k , and x ∈ LGV (q k+1 ).

A state is locally-tense if 1. there are no lower bound guards in g 1 , . . . , g k , and

2. If x ∈ R 1 ∪ • • • ∪ R k then x ∈ UGV (q k+1 ).
Our strategy is to convert a run to a 0-spread run without changing the execution times of global actions. For locally-relaxed states, we will execute all the local actions just before the next global action. Condition 1 says that there should be no upper bound guard that could prevent executing a transition later than in the original run. Condition 2 ensures that there are no problems later; since we reset x later than in the original run, in the future we do not allow lower bounds. For example, consider the following run --→ {x} x>10 ---→. Observe that this run requires an elapse of 10 units of time between the first and the second transitions -as a consequence, the two transitions cannot both be executed just before the global action. Observe that the condition that we discussed disqualifies such a sequence.

For locally-tense states the idea is to execute all local actions immediately after the preceding global action. So, we need condition 1 that guarantees that there are no lower bound guards in the sequence, to be sure that we are allowed to do this. Since we execute local actions sooner, the resets happen sooner. This should not cause any problem for the rest of the run. Condition 2 ensures this by eliminating the possibility of upper bound guards involving a clock that is reset in the rest of the run.

Having defined the notion of locally-relaxed and locally-tense states, we now introduce the notion of a tame global-local system, in which all reachable states are of one of these two forms. Definition 7.3. A global-local system is tame iff every reachable configuration consists entirely of locally-relaxed states or entirely of locally-tense states.

We will now show that if a global-local system is tame, then it is 0-spread.

Theorem 7.1. If A is a tame global-local system, then A is 0-spread.
Proof. Consider a run of A:

(q 0 , v 0 ) u 1 -→ * (q 1 , v 1 ) w 1 = =⇒ * • • • (q 2n-2 , v 2n-2 ) un -→ * (q 2n-1 , v 2n-1 ) wn = =⇒ * (q 2n , v 2n )
Here u i 's are sequences of local actions and w i 's are sequences of global actions (denoted by = =⇒ arrows). Observe that the valuation obtained after the execution of each action in a sequence w i of global actions has spread 0 by definition. Therefore, we do not need to modify the time of execution of any action in w i 's. We need to convert the sequences u i of local actions to a 0-spread run. We will execute each action in a sequence u i at the same time. If the configuration reached after w i-1 is locally-tense, we will execute each action in u i at the time of execution of the last action in w i-1 . Otherwise, we will execute each action in u i at the time of execution of the first action of w i .

Consider one such sequence of local actions (q i , v i )

u i+1 ---→ * (q i+1 , v i+1
). We assume that we have managed to construct a 0-spread run till (q i , v i ) and maintain following invariant.

Invariant 7.1.1. (q i , v i ) satisfies the following 1. v i (t p ) = v i (t p ) for each reference clock t p , 2. if there are active x > c bounds from q i , then v i ( x) ≤ v i ( x), 3. if there are active x < c bounds from q i , then

v i ( x) ≥ v i ( x).
Note that here, by active, we mean active in the graph of one of the processes. The local run u i+1 looks as follows:

(q i,0 , v i,0 ) δ 1 -→ g 1 --→ R 1 (q i,1 , v i,1 ) δ 2 -→ g 2 --→ R 2 . . . δ l -→ g l -→ R l (q i,l , v i,l )
where q i,0 = q i , v i,0 = v i and q i,l = q i+1 , v i,l = v i+1 .

Suppose q i consists of locally-tense states. We replace the run u i+1 with the following run:

(q i,0 , v i,0 ) 0 - → g 1 --→ R 1 (q i,1 , v i,1 ) 0 - → g 2 --→ R 2 . . . 0 - → g l -→ R l (q i,l , v i,l ) δ - → (q i,l , v i+1 )
where v i,0 = v i . The difference is that we do not have any delay between consecutive actions, and just do an accumulated delay at the end.

We will show the following claim.

Invariant 7.1.2. All pairs v i,j , v i,j satisfy the following

1. v i,j (t p ) ≤ v i,j (t p ) for each reference clock t p , 2. if there is an active x < c bound from q i , then v i,j ( x) ≥ v i,j ( x), or x ∈ R 1 , . . . , R j-1 and v i,j ( x) = v i,j (t p ), where x is a clock of process A p .
Observe that this invariant allows us to execute the sequence, since by our assumption, all guards in g 1 , . . . , g l are upper bound guards.

The invariant clearly holds for j = 0, as we have assumed that the pair v i , v i satisfies a stronger assumption 7.1.1. For j ≥ 1 we have the first item immediately from the definition. The second item holds by easy analysis.

In this way, we arrive at the pair v i,l , v i,l satisfying the above two conditions. We consider δ such that v i+1 (t p ) = v i+1 (t p ), for all reference clocks t p . This establishes the first item from the general invariant.

For the second item, if x ≥ c is active in q i+1 , we have two cases. If

x ∈ R 1 , . . . , R l , then v i+1 ( x) = v i (t p ) = v i (t p ) and v i+1 ( x) ≥ v i (t p ).
As a consequence, we have v i+1 ( x) ≤ v i+1 ( x). If x is not reset, then x had an active upper bound already in q i , so we can use the induction assumption.

For the third item, if x ≤ c is active in q i+1 , then x ∈ UGV (q i+1 ). As a consequence, x is not reset in R 1 , . . . , R l and so, we use the induction assumption. Thus, we are done with the case when q i consists of locally-tense states.

Next, we consider the case where q i consists entirely of locally-relaxed states. We replace the original run u i+1 with the following run:

(q i,0 , v i ) δ - → (q i,0 , v i,0 ) 0 - → g 1 --→ R 1 (q i,1 , v i,1 ) 0 - → g 2 --→ R 2 . . . 0 - → g l -→ R l (q i,l , v i,l )
where v i,l = v i+1 . Observe that we first do the accumulated delay between the two global actions and then do all local actions in 0-time. We will show the following.

Invariant 7.1.3. All pairs v i,j , v i,j satisfy the following 1. v i,j (t p ) ≥ v i,j (t p ) for each reference clock t p , 2. if there is an active x > c bound from q i , then v i,j ( x) ≤ v i,j ( x).

3. if g j is of the form x < c, then v i,j ( x) = v i,j (t p ), where x is a clock of process A p .

Invariant 7.1.3 guarantees the feasibility of the sequence. The invariant holds for j = 0, as a stronger assumption 7.1.1 holds on these valuations. For j = 1, consider δ such that v i,1 (t p ) = v i+1 (t p ). Then, we have the first part of invariant 7.1.3. The second item continues to hold from the induction hypothesis, as we do not reset any clocks.

For 1 < j ≤ n, the first part of invariant 7.1.3 is immediate. From the definition of locally-relaxed (condition 2), we know that if x ∈ LGV (q i,j ), then

x / ∈ R 1 ∪ • • • ∪ R j .
The second part of invariant 7.1.3 follows as a consequence. For the third part, from the definition of locally-relaxed states (Definition 7.2), we know that if g j is of the form x < c, then x ∈ R 1 ∪ • • • ∪ R j-1 . Thus, we have the first item of the general invariant 7.1.1.

For the second item, if x ≥ c is active in q i+1 , then x ∈ LGV (q i+1 ). From condition 2, we know that x / ∈ R 1 ∪ • • • ∪ R l . Since x is not reset, x had an active lower bound already in q i , so we can use the induction assumption.

For the third item, if x ≤ c is active in q i+1 , we have two cases.

If x ∈ R 1 ∪ • • • ∪ R l , then v i+1 ( x) = v i+1 (t p ). Since we know that v i+1 ( x) ≤ v i+1 (t p ) and v i+1 (t p ) ≥ v i+1 (t p ), we get v i+1 ( x) ≥ v i+1 ( x). If x is
not reset in the sequence, then x had an active upper bound already in q i , and so, we use the induction assumption. Thus, invariant 7.1.1 also holds for the case when q i consists entirely of locally-relaxed states.

A condition for bounded spread

In this section, we discuss a situation when global-local systems are spreadbounded, but not necessarily 0-spread. The intuition is that if the network synchronizes by executing a global action often, then the spread cannot be too big.

Lemma 7.2. Suppose that A is a global-local system, such that there is a bound l on the number of consecutive local actions in a run of A. Then, A is l(M + 1)-spread-bounded, where M is the maximum constant used in a guard in A.

Proof. Pick any run of A and consider the part of the run consisting of only local actions. We know that such a local run is enclosed between two global actions a 1 and a 2 and is of the following form.

a 1 -→ (q i,0 , v i,0 ) δ 1 -→ g 1 --→ R 1 (q i,1 , v i,1 ) δ 2 -→ g 2 --→ R 2 . . . δ l -→ g l -→ R l (q i,l , v i,l ) δ - → (q i,l , v i,l ) a 2 -→ (q i+1 , v i+1 )
Observe that the valuations v i,0 and v i,l are synchronized. Consequently, we can talk about duration of this execution, given by v i+1 (t p ) -v i,0 (t p ), where t p is a reference clock. If the duration is not bigger than lM , then clearly, all the valuations appearing in the sequence are l(M + 1)-spread-bounded.

If the duration is bigger than lM , then it means that in the local sequence, there is an action taking more than M time. Observe that if an action requires a time elapse of more than M time units, then it can elapse arbitrary time bigger than M . So, if we have such an action, then we can adjust the time elapsed before that action in the interval (M, +∞). We observe that for any such action, the delay before it can be shortened at will to at most (M + 1). In this way, we obtain an execution of duration at most l(M + 1).

To summarize, we can modify the sequence so that each action requires a delay of at most (M + 1) time units. As the sequence is of length at most l, its duration of execution is at most l(M + 1).

Corollary 7.1. A global-local system is spread-bounded if no process has a loop containing only local actions.

Client-server systems

In this section, we introduce another special class of networks, which we refer to as client-server systems. In these networks, we have a server process and several client processes. We denote the server process by S, and the client processes by C 1 , C 2 , • • • , C k . These systems can have three kinds of actions:

• local actions of a client, whose domain is {C i } for some i,

• local actions of the server whose domain is {S},

• synchronization actions involving a client and the server, whose domain is {S, C i } for some i.

In the context of client-server systems, we will refer to actions that synchronize a client and the server as communication actions.

We will now give sufficient conditions for a client-server system to be spread-bounded. We will first focus on conditions for 0-spread-boundedness. Later, we will discuss conditions to conclude that a client-server system is spread-bounded, but not necessarily 0-spread-bounded.

Conditions for 0-spread

In this section, we give some sufficient conditions for a client-server system to be 0-spread. First, we introduce the notion of a tame client.

Definition 7.4. We say that a client C p is tame if no local action of C p has a clock bound or a reset. In Lemma 7.3, we will prove the 0-spread-boundedness of client-server systems in which all the clients are tame.

Lemma 7.3. A client-server system with tame clients is 0-spread.

Proof. Let S be the server process. Consider a run:

(q 0 , v 0 ) δ 1 -→ b 1 -→ (q 1 , v 1 ) δ 2 -→ b 2 -→ • • • (q n-1 , v n-1 ) δn -→ bn -→ (q n , v n ) Define v i as v i (t p ) = v i (t s )
for all reference clocks t p , and v i ( x) = v( x) for all other variables. We show that the run with all v i replaced by v i is a 0-spread run. Consider an action in the given run : (q i , v i )

δ i -→ b i -→ (q i+1 , v i+1 ). We need to show that (q i , v i ) δ i -→ b i -→ (q i+1 , v i+1 ) is feasible.
We look at this transition closely.

(q i , v i ) δ i -→ (q i , v i + δ i ) b i -→ (q i+1 , [R i ](v i + δ i )) We show that (q i , v i ) δ i -→ (q i , v i + δ i ) b i -→ (q i+1 , [R i ](v i + δ i ))
is possible where δ i is a vector consisting of delay δ i (s) for each process of the network. In other words, each process does exactly the same delay, the delay executed by the server originally.

If b i is a local action, by assumption there are no guards in b i and so, the transition is feasible. If b i is a synchronization of the client C p with the server, then

(v i + δ i )(t s ) = (v i + δ i )(t p ). Moreover, v i (t s ) = v i (t s ) by definition of v i . This gives (v i + δ i )(t p ) = (v i + δ i )(t s ) = (v i + δ i )(t s ) = (v i + δ i )(t p )
. So the transition is feasible as the guards of b i involve only the clocks of C p and S.

Next, we propose a more general condition to say that a client-server system is 0-spread. This approach is targeted at client-server systems with identical client processes, which are quite common in the standard literature. In such a setting, we show that if a simpler client-server system, consisting of just one client and the server satisfies a condition, then we can conclude that the original client-server system is 0-spread. We specify the condition that the simpler client-server system should satisfy in Definition 7.5 Definition 7.5. Consider network A consisting of only two processes: a client and a server. The network is client-0-spread if every run in the local time semantics can be made 0-spread by adjusting only the local delays of the client.

Lemma 7.4. Consider a client-server system with identical client processes. If the network consisting of the server and one client of the network is client-0-spread, then the network with an arbitrary number of clients is 0-spread.

Proof. Let N be a client-server system with identical client processes, such that the network consisting of the server and one client of the network is client-0-spread. We will show that we can convert any local run of N to a 0-spread run.

Consider a local run of N :

(q 0 , v 0 ) δ 1 -→ b 1 -→ (q 1 , v 1 ) δ 2 -→ b 2 -→ • • • (q n-1 , v n-1 ) δn -→ bn -→ (q n , v n )
Consider a client C p . Consider the actions in the run belonging to the client C p and the server. By definition of client-0-spread systems, we know that the reference time of C p can be made equal to the reference time of the server in each valuation of this run. Further, observe that for all other valuations in the run, the reference time of client C p does not affect the feasibility of the action, as the action belongs to another process. So, we can keep the reference time of C p synchronized with the reference time of the server in these valuations. Thus, the reference time of the client C p is equal to the reference time of the server in all the valuations. We repeat this for all the clients. Note that we can do this any order, since by Lemma 3.4, local actions of different clients can be commuted.

We now make this idea precise. Define v i as v i (t p ) = v i (t s ) for all reference clocks t p and v i ( x) = v( x) for all other variables. The run with all v i replaced by v i is feasible and is a 0-spread run.

Conditions for bounded spread

In this section, we discuss some situations when client-server systems are spread-bounded, but not necessarily 0-spread. We will present two such cases, one in which there is a bound on time elapsed between two consecutive communications of each client, and the other in which all the timing constraints of the system are of a specific form.

Systems with time bound on consecutive communications

Here we consider client-server systems in which there is a bound on the time elapsed between consecutive communication actions with each client. We will show that such networks are spread-bounded.

Lemma 7.5. Suppose that N is a client-server system such that each client communicates with the server every D time units. Then N is 2D spreadbounded.

Proof. Consider a local run of N .

(q 0 , v 0 ) δ 1 -→ a 1 -→ (q 1 , v 1 ) δ 2 -→ a 2 -→ • • • (q n-1 , v n-1 ) δn -→ an -→ (q n , v n )
We show that without any modification this run is 2D-spread-bounded. Take a position i and consider |v i (t p ) -v i (t q )|, for arbitrary processes A p and A q . We know that v i (t q ) is at least as big as the time of the last synchronization of A q with the server. Similarly, v i (t p ) is not bigger than the time of the next synchronization of A p with the server. So

v i (t q ) ≥ v i (t s ) -D and v i (t p ) ≤ v i (t s ) + D.
Systems where the only timing constraints are at wait states Here, we consider client-server systems in which the timing constraints are only used to model wait states where the system needs to elapse a certain amount of time in the state before executing an outgoing action.

p 0 p 1 p 2 a {x} b x ≥ k c x ≥ k Figure 7.2: Wait states
Ptime. This gives a Pspace procedure for checking if A is not 0-spread. The lemma follows as Pspace is closed under complement.

We now turn to showing the lower bound. We give a reduction from the emptiness problem for timed automata to the 0-spread-boundedness problem of a network of timed automata.

Let A be a timed automaton. We construct a network of timed automata N which consists of processes A , B and C as shown in Figure 7.3. Process A is obtained from automaton A by adding a self-loop on an action a from each accepting state of A. The action a is a fresh global action (not appearing in A) which synchronizes the processes A , B and C. The process B has a clock x and the process C has a clock y. We reset x in B and y in C on the global action a. There is a local action b in B which has guard x > k and a local action c in C with the guard y < k.

s ∈ F a A A p 0 p 1 p 2 q 0 q 1 q 1 a {x} b x > k a {y} c y < k B C Figure 7.3: Network N Proposition 7.2. A is non-empty iff the network N is not 0-spread-bounded.
Proof. Suppose that A has an accepting run σ to an accepting state s of A.

Note that σ is also a local run of A. Consider this local run σ in N -from the initial state of A to the state s. Since every action in σ is a local action of N , this run only passes through synchronized valuations (we can keep the processes B and C synchronized during this run). Now, consider the extension of this run by the execution of actions a, b and c, in that respective order. It may be observed that the valuation obtained after executing b is not a synchronized valuation. Further, it maybe observed that after executing b, no synchronized valuation can execute the action c. Thus, σabc is a local-run of the network, which has non-zero spread. On the other hand if A does not have an accepting run, a cannot be executed. In this case, all the runs of N are runs of A. Thus, N is 0-spread.

Remark. Since the network N considered in the proof of Lemma 7.2 is a global-local system, the Pspace bound also applies to such systems.

Theorem 7.2. Checking if a network of timed automata is 0-spread is Pspace-complete.

Deciding D-spread is Pspace-hard

In this section, we investigate the hardness of checking if a system is D-spread.

We will show that this problem is Pspace-hard.

To prove the hardness result, we give a reduction from the emptiness problem for timed automata to D-spread-boundedness problem of a network of timed automata. The proof is very similar to the proof of Pspace-hardness of the 0-spread-boundedness problem.

Given a timed automaton A, we construct a network of timed automata N which consists of processes A , B and C as shown in Figure 7.4. Process A is obtained from automaton A by adding a self-loop on a fresh global action a which synchronizes the processes A , B and C. The clock x of the process B and the clock y of the process C are reset on a. There is a local action b in B which has guard x > k + D and a local action c in C with the guard y < k. Observe that the newly constructed network is similar to the network constructed in the 0-spread-boundedness proof (Figure 7.3), except for the fact that the action b has guard

x > k + D instead of x > k. s ∈ F a A A p 0 p 1 p 2 q 0 q 1 q 1 a {x} b x > k + D a {y} c y < k B C Figure 7.4: Network N
We now state Proposition 7.3 that states that the D-spread-boundedness problem is Pspace-hard. The proof is similar to the proof of Proposition 7.2 that shows that Pspace-hardness of the 0-spread-boundedness problem.

Proposition 7.3. A is non-empty iff the network N is not D-spread- bounded. Theorem 7.3. Checking if a network of timed automata is D-spread-bounded is Pspace-hard.
Chapter 8

Implementation of partial order reduction in TChecker

In Chapter 6, we showed that if a network of timed automata is D-spread bounded, then the LZG D M of the network (the transition system obtained by applying D M subsumption to the local zone graph of the network) can be used to check the reachability of the network. Moreover, using Theorem 6.1, we showed that we can apply a partial order reduction technique based on source sets to the exploration of the LZG D M of a network of timed automata, provided it is D-spread bounded. In this chapter, we work with the assumption that the networks that we consider are spread bounded and that we know a bound D on the spread of these networks. In other words, whenever we consider D M subsumption for two nodes of the local zone graph of a network, we assume that the network is D-spread bounded.

In this chapter, we discuss an implementation of a partial order reduction procedure for networks of timed automata that is provided in the tool TChecker [START_REF] Herbreteau | [END_REF]. We discuss two variants of the POR implementation, namely global-local POR and client-server POR, that are customized and targeted at the two kinds of networks of timed automata that we introduced in Chapter 7, namely, global-local systems (see Section 7.2) and client-server systems (see Section 7.3), respectively.

Before discussing the implementation, we first discuss the application of an abstract partial order reduction method, namely reachability-complete set reduction to a simple transition system in Section 8.1. Equipped with the ideas introduced in this discussion, we then move on to the application of a reachability-complete set reduction method to finite truncations of local zone graphs of networks of timed automata.

In our implementation, we compute a reduction of a finite version of the LZG of a network N , denoted as POR -LZG r (N ). Given a network of timed automata N , we consider the local zone graph of N with the D M subsumption between its nodes. We first augment LZG(N ) by storing some 157 additional information in its nodes to get the POR-zone graph of N (denoted as POR -LZG(N )). This additional information is crucial in computing the subset of actions that are to be explored from a node in the restricted transition system that we want to obtain. Thus, effectively, POR -LZG(N ) can be viewed as LZG D M (N ), with each node augmented with some additional information. Further, our reduced transition system, POR -LZG r (N ), can be viewed as the part of POR -LZG(N ) that is reachable from the initial node of POR -LZG(N ) using the reduced set of actions proposed by our implementation.

In this chapter, we present a general POR-reachability algorithm (Algorithm 5) that takes three inputs, namely a network N of timed automata, a subroutine Next that gives the successor relation of POR -LZG r (N ), and a node covering relation between the nodes of POR -LZG(N ). The implementation of the procedure Next and the node covering relation depends on the POR method that we use. We will propose two different implementations of Next and the node-covering relation , one each for global-local systems and client server systems. Finally, in Section 8.5, we propose optimizations to the Next procedures that exploit specific properties of global-local and client-server systems, respectively.

Partial order reduction for transition systems

In this section, we discuss the application of partial order reduction to a simple untimed transition system. We introduce the notion of a reachabilitycomplete set for a transition system and define the idea of a reduced transition system that is obtained by the application of a reachability-complete set reduction to a transition system. We then prove that the reduced transition system is sound and complete with respect to reachability. These ideas will be useful when we discuss the application of partial order reduction to the LZG D M of a D-spread bounded network of timed automata. We first recall the definitions of a transition system and recall the notion of a run of the transition system. Definition 8.1 (Transition system). A transition system is a tuple S, Σ, s 0 , -→ , F , where S is a set of states, Σ is a finite alphabet of actions, -→ ⊆ S ×Σ×S is a transition relation between states, s 0 ∈ S is an initial state and F ⊆ S is a set of accepting states. We write s a -→ s to denote that (s, a, s ) ∈ -→. We sometimes refer to -→ as successor relation of the transition system.

Definition 8.2 (Run of the transition system). A run in the transition system T from a state s is a sequence of transitions starting in s: s

a 1 -→ s 1 a 2 -→ s 2 • • • an -→ s n . We denote it by s σ -→ s n where σ = a 1 • a 2 • • • a n is a sequence of actions.
The reachability problem for a transition system T asks if there is a run of T from its initial state to an accepting state.

We now introduce the notion of a simulation relation over a transition system. Definition 8.3 (Simulation relation). Given a transition system T , we say that ⊆ S × S is a simulation relation over T if for all s 1 s 2 , s 1 a -→ s 1 implies that there exists a s 2 such that s 2 a -→ s 2 , and s 1 s 2 . We say s simulates s if s s .

Lemma 8.1. Given a transition system T = S, Σ, s 0 , -→, F and a simulation relation over T , if s s and s σ -→ s n , then s σ -→ s n , for some s n such that s n s n .

Proof. Let σ be a run from s of the following form

s a 1 -→ s 1 a 2 -→ • • • s n-1 an -→ s n .
We will show that there is a run of the form

s a 1 -→ s 1 a 2 -→ • • • s n-1 an -→ s n such that s i s i , for 1 ≤ i ≤ n.
The proof follows by induction on n, the number of transitions in σ. The base case where n = 0 follows trivially, since we have s s .

Consider the induction step. By induction hypothesis, we know that there is a run σ of the form

s a 1 -→ s 1 a 2 -→ • • • a k -→ s k such that s i s i for 1 ≤ i ≤ k. From the run σ, we know that s k a k+1 ---→ s k+1 .
Further, since is a simulation relation and s k s k , we know that there exists a s k+1 such that s k a k+1 ---→ s k+1 and s k+1 s k+1 . Therefore, the run σ that we have constructed can be extended by the transition a k+1 to get the run s

a 1 -→ s 1 a 2 -→ • • • a k -→ s k a k+1 ---→ s k+1 where s i s i for 1 ≤ i ≤ k + 1.
Thanks to Lemma 8.1, we can propose Algorithm 4 to check the reachability of a transition system. The procedure takes two inputs, a transition system T = S, Σ, s 0 , -→, F , and a simulation relation over T , and checks if an accepting state is reachable in T . Lemma 8.2. If a state s is in the list Waiting of Algorithm 4, then s is reachable in T .

Algorithm 4 Reachability algorithm Input: A transition system T = S, Σ, s 0 , -→, F and a simulation relation over T . Output: true iff accepting state reachable in T . Remove s from Visited and Waiting

1: Set Waiting = Visited := {s 0 } 2: if s 0 is

14:

Add s to Waiting and Visited 15: return false Proof. We show that the statement of the lemma is a loop invariant of Algorithm 4. Before the first iteration of the loop, we know that Waiting = {s 0 }. Since s 0 is vacuously reachable in T , the statement is true at the beginning of the loop. Now, assume that the loop invariant holds before an iteration of the loop (line 4.) Thus, we know that each state in the list Waiting at this point is reachable in T . In the iteration of the loop, we pick a state s from Waiting and add some states s to Waiting such that s a -→ s for some a ∈ Σ. Consider such a state s that is added to Waiting in this iteration of the loop. Since we know that s is reachable in T , we have a run s 0 σ -→ s in T . We can extend this run by a to get s 0 σ -→ s a -→ s . Then, it follows that s is also reachable in T . Thus, we know that if a state s is added to Waiting in this iteration of the loop, then s is reachable in T . Therefore, the statement of the lemma continues to hold at the end of the loop. Proof. We know that Algorithm 4 can return true by either executing line 2 or line 7. Line 2 is only executed in the special case when the initial state is an accepting state. In this case, we know that the claim is vacuously true. Next, consider the case when line 7 is executed. We can infer from the algorithm that this happens only when a state s has has just been popped from Waiting and there exists a s a -→ s such that s is accepting. Since s has just been popped from Waiting, from Lemma 8.2, we know that s is reachable in T . It follows that s is a reachable accepting state in T . Hence, T has an accepting run.

Lemma 8.4. If a state s is added to Visited at some step of Algorithm 4, then at every step afterwards there is a state s in Visited such that s s . Proof. Let s be a state which has been added to Visited at some step of Algorithm 4. If s is in Visited till the termination of the algorithm, then we are done. Suppose not. The only step of the algorithm which removes a state s from Visited is line 13. But we can see that in this case we have s ∈ Visited and s s because of the guard before line 13. Further, if s is removed at a later point in the algorithm, then we know that another state s such that s s is added to Visited. Then, s serves as the candidate state in Visited that covers s. Lemma 8.5. Let σ be run of T of the form

s 0 a 1 -→ s 1 a 2 -→ • • • a n-1 ---→ s n-1 an -→ s n
If the algorithm does not return true, then at the termination of the algorithm for every 0 ≤ i ≤ n, there exists a state s i in the set Visited such that s i s i .

Proof. Suppose that the algorithm does not return true. The proof follows by induction on the number of transitions in σ.

For the base case, we know that the state s 0 is added to Visited in line 1 of the algorithm. By Lemma 8.4, till the end of the execution there will be some s 0 ∈ Visited with s 0 s 0 .

By induction hypothesis, assume that there exists a state s i in Visited, such that s i s i . Assume that it s i is the -biggest such state. To be in Visited, s i must also have been in Waiting at some stage. Since when the algorithm terminates the list Waiting is empty, at some moment s i must have been popped from Waiting.

From the run in T , we know that s i a i+1

---→ s i+1 . Since is a simulation relation in T and s i s i , we have s i a i+1 ---→ s i+1 , where s i+1 s i+1 . If s i+1 is added to Visited, then by Lemma 8.4, we are done. If s i+1 is not added to Visited, then there are two possibilities:

• s i+1 is an accepting state. In this case, Algorithm 4 terminates by returning true, and we have assumed that it is not the case.

• There exists a state s i+1 in Visited such that s i+1 s i+1 . But in this case, we have s i+1 s i+1 s i+1 . By transitivity of relation, s i+1 s i+1 . Thus, in this case we have s i+1 in Visited, such that s i+1 s i+1 . Proof. Clearly the algorithm terminates, as every state is added to the list Waiting at most once. By Lemma 8.5, if there is a run to an accepting state s, then s must be added to Visited at some stage. But this is impossible because no accepting state can be added to Visited (with the exception of the case when s 0 is an accepting state; In this case however, the algorithm terminates at line 2.).

Reachability-complete set reduction

In this section, we discuss the application of a partial order reduction technique to the exploration of a transition system. We first introduce the notion of a reduced transition system generated by a subset of the successor relation. Definition 8.4 (Reduced transition system). Let T = S, Σ, s 0 , -→, F be a transition system and let -→ r ⊆ -→ be a subset of the successor relation of T . We then define the reduced transition system induced by -→ r , denoted by T r , as the restriction of T to the states reachable from s 0 using only transitions in -→ r . Formally, T r is given by the tuple S r , Σ, s 0 , -→ r , F r , where S r is the smallest set such that s 0 ∈ S r , and if s ∈ S r and s a -→ r s for some a ∈ Σ, then s ∈ S r . The set of accepting states of T r is given by F r = S r ∩ F .

Next, we specify a property that the subset of actions should satisfy for the reduced transition system to be sound and complete with respect to reachability.

Definition 8.5 (Reachability-complete set). Consider a transition system T = S, Σ, s 0 , -→, F , a transition relation -→ r ⊆ -→ and the reduced transition system T r induced by -→ r . We say that -→ r is reachability-complete for T , if T r contains an accepting state whenever an accepting state is reachable from s 0 in T .

Observe that if no accepting state is reachable in T , then the above definition puts no restrictions on T r . Otherwise we require that in T r remains at least one of the reachable accepting states.

Before going further, we state a property of POR -LZGs that follows immediately from its definition and Corollary 4.1.

Lemma 8.6. If (q, Z, r) u -→ (q , Z , r ) and u ∼ w, then (q, Z, r) w -→ (q , Z , r ), for arbitrary r .

We now present a general POR-reachability algorithm (Algorithm 5). It is a parametrization of the standard reachability algorithm for generic transition systems (Algorithm 4) with a function calculating the transition relation and the covering relation. The POR-reachability procedure takes three inputs:

1. a network N of timed automata.

2. a subroutine Next that takes as input a node (q, Z, r) of POR -LZG(N ) and returns a set of successors {(q 1 , Z 1 , r 1 ), . . . , (q k , Z k , r k )} such that (q, Z) -→ (q i , Z i ) in LZG(N ) for each 0 ≤ i ≤ k.

a node covering relation between nodes of the POR -LZG(N ).

The implementation of the procedure Next that computes the successors of a given node in the POR-zone graph depends on the POR method that we use. We will propose two different implementations: one for global-local systems, called Next gl presented in Algorithm 6, and one for client server systems, called Next cs presented in Algorithm 8. The details about the exact mechanism of how the rank determines the set of successors from a node is explained in the descriptions of Next gl and Next cs algorithms given in Sections 8.3 and 8.4.

A transition relation -→ r determines Next in a direct way:

(q , Z , r ) ∈ Next(q, Z, r) when (q, Z, r) a -→ r (q , Z , r ) for some a.

In later sections, we will introduce -→ gl determining Next gl , and -→ cs determining Next cs .

Likewise, the node covering relation also depends on the POR method that we use. The node-covering relation for global-local systems and clientserver systems are defined in Sections 8.3 and 8.4, respectively. Lemma 8.7. Suppose that POR -LZG r (N ) has a path to a node (q, Z, r). Then, N has a local run (q 0 , v 0 ) -→ (q, v), for some v ∈ Z.

Proof. Let (q 0 , Z 0 , 0) σ -→ (q, Z, r) be a path in POR -LZG r (N ). From the definition of POR -LZG r , this implies that there is a path in LZG(N ) of the form (q 0 , Z 0 ) σ -→ (q, Z). Then, from the soundness of the local-zone graph given by Theorem 4.1, we know that N has a run of the form (q 0 , v 0 ) -→ (q, v), for some v ∈ Z.

Algorithm 5 POR reachability algorithm Input: A network of timed automata N , a procedure Next : (Q × Z × N) → 2 (Q×Z×N) , and a node covering relation . Output: true iff accepting state reachable in ZG(N ).

1: Set Waiting = Visited := {(q 0 , Z 0 , 0)} 2: if q 0 is accepting then return true 3: while Waiting = ∅ do 4:

(q, Z, r) = pop(Waiting)

5:

for all (q , Z , r ) ∈ N ext(q, Z, r) do 6:

if q is accepting then else if ∃ (q , Z , r ) ∈ Visited s.t. (q , Z , r ) (q , Z , r ) then for (q , Z , r ) ∈ Visited do 12:

if (q , Z , r ) (q , Z , r ) then 13:

Remove (q , Z , r ) from Visited and Waiting 14:

Add (q , Z , r ) to Waiting and Visited 15: return false Lemma 8.8. Suppose that N has a run to an accepting state. Then, if -→ r is complete for reachability for POR -LZG(N ), then there is a path to an accepting node in POR -LZG r (N ).

Proof. Consider a run of N of the form

(q 0 , v 0 ) δ 1 -→ a 1 -→ (p 1 , v 1 ) • • • a n-1 ---→ (p n-1 , v n-1 ) δn -→ an -→ δ n+1 ---→ (p n , v n )
where q n is an accepting state of N .

By completeness of LZG, there exists a path in LZG(N ) of the form

(q 0 , Z 0 ) a 1 -→ (p 1 , Ẑ1 ) a 2 -→ • • • (p n-1 , Ẑn-1 ) an -→ (p n , Ẑn ) such that v 0 ∈ Z 0 , v n ∈ Ẑn and v i ∈ Ẑi , for each i ∈ {1, • • • , n -1}.
By definition of POR -LZG(N ), we have a path in POR -LZG(N ) of the following form (q 0 , Z 0 , r 0 )

a 1 -→ (p 1 , Ẑ1 , r 1 ) a 2 -→ • • • (p n-1 , Ẑn-1 , r n-1 ) an -→ (p n , Ẑn , r n ).
Since -→ r is complete for reachability for POR -LZG(N ), we have a path of the following form (q 0 , Z 0 , r 0 )

β 1 -→ r (q 1 , Z 1 , r 1 ) β 2 -→ • • • (q l-1 , Z l-1 , r l-1 ) β l -→ (q l , Z l , r l ).
where q l is an accepting state of N . This path is an accepting path in POR -LZG r (N )

Global-local POR

In this section, we propose a POR implementation that is customized and targeted at a class of network of timed automata called global-local systems. We describe a procedure Next gl that computes the successors of a node of the POR-zone graph and a covering relation gl for the nodes of the POR-zone graph of a global-local system.

Global-local systems

We first briefly recall the properties of global-local systems discussed in detail in Section 7.2. A global-local system N = {A 1 , A 2 , • • • , A n } satisfies two properties:

(gl-trans) N has only two kinds of actions -local actions whose domain is {A i } for some i, and global actions whose domain is

{A 1 , A 2 , • • • , A n }.
(gl-final) Every accepting state of N is only reachable through a global action. If a tuple (q 1 , • • • , q n ) is an accepting state, then for 1 ≤ i ≤ n each incoming transition to q i is labelled by a global action.

Remark. Suppose that N is a network satisfying the condition (gl-trans). Then, N can be transformed to a global-local system by introducing a dummy accepting state in each process, and adding transitions labelled by a new global action from the (original) accepting states to this dummy accepting state.

Successor computation for global-local systems

The idea of -→ gl is to make processes move in turns: first, we move the first process, then the second, etc. until a global action occurs that restarts this mechanism. This is where we use the third component r -it records the process which executed the last action. Given a node (q, Z, r) of the POR -LZG of a global-local system, only actions involving processes A i for i ≥ r are proposed by Next gl . Definition 8.6. We define a subset -→ gl of -→ transitions. Given a node (q, Z, r) of POR -LZG and a transition (q, Z) a -→ (q , Z ) of LZG, we have (q, Z, r) a -→ gl (q , Z , r ) if either: (i) a is a local action of a process A r for some r ≥ r; or (ii) a is a global action and r = 0.

The associated function Next gl computing the set of -→ gl successors of node is presented in Algorithm 6.

Lemma 8.12. The successor relation -→ gl is complete for reachability for transition systems of global-local systems.

Algorithm 6 Next gl (q, Z, r) Input: A node (q, Z, r) of the POR-zone graph of a global-local network of timed automata A Output: a set Source of successors of (q, Z, r).

1: Source := ∅ 2: for every transition (q, Z)

a -→ (q , Z ) do 3:
if a is a global action then 4:

Add (q , Z , 0) to Source Add (q , Z , r ) to Source 9: return Source Proof. Suppose that N is a global-local system. Let POR -LZG gl (N ) be the reduced transition system of POR -LZG(N ) induced by -→ gl . We show that the reduced system is reachability complete. Consider a path:

(q 0 , Z 0 , 0) σ 1 -→ (q 1 , Z 1 , r 1 ) g 1 -→ (q 2 , Z 2 , 0) σ 2 -→ (q 3 , Z 3 , r 3 ) g 2 -→ (q 4 , Z 4 , 0) • • • (q 2n-2 , Z 2n-2 , 0) σn -→ (q 2n-1 , Z 2n-1 , r 2n-1 ) gn -→ (q 2n , Z 2n , 0)
in POR -LZG(N ), where σ i 's are sequences of local actions and g i 's are global actions. Observe that after executing a global action, the rank, i.e., the third component of a configuration is 0.

It is enough to show that there are r 1 , . . . , r 2n-1 and σ 1 , . . . , σ n such that a path of the form (q 0 , Z 0 , 0)

σ 1 -→ gl (q 1 , Z 1 , r 1 ) g 1 -→ gl (q 2 , Z 2 , 0) σ 2 -→ gl (q 3 , Z 3 , r 3 ) g 2 -→ gl (q 4 , Z 4 , 0) • • • (q 2n-2 , Z 2n-2 , 0) σ n -→ gl (q 2n-1 , Z 2n-1 , r 2n-1 ) gn -→ gl (q 2n , Z 2n , 0)
exists in POR -LZG gl (N ). We will additionally ensure that σ i ∼ σ i .

Firstly, we know that the initial node of POR -LZG(N ) has rank 0. Further, recall that, if a global action is feasible from a node of POR -LZG(N ), then it is allowed by -→ gl (irrespective of the rank of the node). Next, consider a segment consisting of only local actions in the aforementioned path in POR -LZG(N ):

(q i 0 , Z i 0 , r i 0 ) a 1 -→ (q i 1 , Z i 1 , r i 1 ) a 2 -→ (q i 2 , Z i 2 , r i 2 ) • • • a l -→ (q i l , Z i l , r i l ).
Each action in this sequence involves only one process. By Lemma 8.6, we can commute actions of different processes in this sequence, to get an interleaving resulting in the same final node, (q i l , Z i l , r i l ), except maybe for the last component of the triple. For every process A j , consider the subsequence σ j of the above sequence consisting only of actions of process j. Since there may be no actions of some process in some segment, we consider only non-empty sequences: σ j 1 , σ j 2 , . . . , σ j k for some 1 ≤ j 1 < j 2 < • • • < j k ≤ n. Recalling the definition of -→ gl , we see that in POR -LZG gl (N ), we have a path (q i 0 , Z i 0 , 0)

σ j 1
--→ gl (q j 1 , Z j 1 , j 1 )

σ j 2 --→ gl (q j 2 , Z j 2 , j 2 ) • • • σ j k --→ gl (q j k , Z j k , j k ) .
This shows how, for all i, we can obtain σ i from σ i , and this completes the proof.

The next step is to define the appropriate covering relation gl that is a simulation w.r.t. -→ gl . One option would be to just require equality on the third component of triples. The definition we adopt allows for more coverings.

Definition 8.7 (Node-covering relation gl ). For nodes of a POR -LZG we define a covering relation: (q, Z, r) gl (q , Z , r ) if q = q , Z D M Z and r ≤ r. Lemma 8.13. If N is a global-local system, then gl is a simulation relation in POR -LZG gl (N ).

Proof. Let (q, Z, r) gl (q, Z , r ) in POR -LZG gl (N ). Observe that by the definition of the covering: the first components must be the same, Z D M Z , and r ≤ r. We show that if (q, Z, r) a -→ gl (q 1 , Z 1 , r 1 ), then there exists a node (q 1 , Z 1 , r 1 ) in POR -LZG gl (N ) such that (q, Z , r ) a -→ gl (q 1 , Z 1 , r 1 ), and (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ). Observe that the simulating node (q 1 , Z 1 , r 1 ) differs from (q 1 , Z 1 , r 1 ) only in the second component.

Since Z D M Z , we know by Lemma 6.10 that (q, Z ) a -→ (q 1 , Z 1 ) for some

Z 1 with Z 1 D M Z 1 .
If a is a global action, we have (q, Z , r ) a -→ gl (q 1 , Z 1 , 0) in POR -LZG gl (N ). As in this case also r 1 = 0, we obtain the following desired result: (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ).

Otherwise, a is a local action of some process A r 1 . Since a is enabled from (q, Z, r) in POR -LZG gl (N ), we know that r 1 ≥ r. As r ≤ r, from the definition of -→ gl , we know that (q , Z , r ) a -→ gl (q 1 , Z 1 , r 1 ). It is clear that (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ).

Thanks to Lemma 8.12 and Lemma 8.13, we can use Theorem 8.2 to get a reachability algorithm for global-local systems.

Lemma 8.14. Algorithm 5 using Next gl and gl solves the reachability problem for global-local systems.

Extended global-local systems

In order to broaden the applicability of our global-local POR technique, we now propose a more general class of systems, which we call extended global-local systems, and show how to apply global-local POR on these systems. In these extended global-local systems, we do not impose restrictions on communications between processes. The price to pay will be reduced concurrency, or even no concurrency at all if there is a communication action between every pair of processes.

As before, an action is global if it synchronizes all the processes of the network. Otherwise an action is non-global. As a consequence, a local action of a process is a non-global action, but there are also communication actions that are non-global. A network N = {A 1 , A 2 , • • • , A n } is said to be an extended global-local system if it satisfies property (gl-final) from page 167. Thus, given an accepting state (q 1 , • • • , q n ) of N where q i is a state of A i for 1 ≤ i ≤ n, each incoming transition to q i is labelled by a global action. Recall that by a remark on page 167, every network can be transformed to a network satisfying (gl-final).

Successor computation for extended global-local systems

The idea is to group processes into equivalence classes: two processes belong to the same equivalence class if there is a non-global action that can synchronize them. The approach we are going to propose can be viewed as applying the standard global-local POR algorithm to a system where processes are "total synchronizations of equivalence classes of processes".

We describe in more detail the equivalence relation on processes. We say that two processes can communicate with each other if there is a non-global action with the two processes in its domain. We will work with equivalence classes of "can communicate with each other" relation. To have some notation for these equivalence classes, we define a mapping groupid that assigns an integral value to each process A i : it is the smallest value j such that process A j belongs to the equivalence class of A i . Notice that if two processes can synchronize on a non-global action, then they have the same groupid. We define groupid of a non-global action to be the groupid of processes involved in this action. For convenience, we also define groupid(a) = 0 for all global actions a.

We can now define a restricted transition relation -→ egl . It is a generalization of Definition 8.6. Definition 8.8. We define a subset -→ egl of -→ transitions. Given a node (q, Z, r) of POR -LZG and a transition (q, Z) a -→ (q , Z ) of LZG, we have (q, Z, r) a -→ egl (q , Z , groupid(a)) provided groupid(a) ≥ r, or a is a global action.

An algorithm for computing -→ egl transitions in presented in Algorithm 7.

Algorithm 7 Next egl (q, Z, r) Input: A node (q, Z, r) of the POR-zone graph of an extended global-local network of timed automata A.

Output: Source(q, Z, r)

1: Source := ∅ 2: for every transition (q, Z)

a -→ (q , Z ) do 3:
if a is global then 4:

Add (q , Z , 0) to Source if (r ≥ r) then 8:

Add (q , Z , r ) to Source Proof. The proof follows closely along the lines of the completeness for global-local systems (Lemma 8.12.)

Let POR -LZG egl (N ) be the reduced transition system of POR -LZG(N ) induced by -→ egl . We show that the reduced system is reachability complete. Consider a path:

(q 0 , Z 0 , 0) σ 1 -→ (q 1 , Z 1 , r 1 ) g 1 -→ (q 2 , Z 2 , 0) σ 2 -→ (q 3 , Z 3 , r 3 ) g 2 -→ (q 4 , Z 4 , 0) • • • (q 2n-2 , Z 2n-2 , 0) σn -→ (q 2n-1 , Z 2n-1 , r 2n-1 ) gn -→ (q 2n , Z 2n , 0)
in POR -LZG(N ), where σ i 's are sequences of non-global actions and g i 's are global actions. Observe that after the execution of a global action, the rank of a configuration is 0.

It is enough to show that there are r 1 , . . . , r 2n-1 and σ 1 , . . . , σ n such that a path of the form (q 0 , Z 0 , 0)

σ 1 -→ egl (q 1 , Z 1 , r 1 ) g 1 -→ egl (q 2 , Z 2 , 0) σ 2 -→ egl (q 3 , Z 3 , r 3 ) g 2 -→ egl (q 4 , Z 4 , 0) • • • (q 2n-2 , Z 2n-2 , 0) σ n -→ egl (q 2n-1 , Z 2n-1 , r 2n-1 ) gn -→ egl (q 2n , Z 2n , 0)
exists in POR -LZG egl (N ). We will ensure that σ i ∼ σ i .

First, we know that the initial node of POR -LZG(N ) has rank 0. Further, recall that, if a global action is feasible from a node of the POR -LZG(N ), then it is allowed by -→ egl (irrespective of the rank of the node).

Next, consider a segment consisting of non-global actions in the aforementioned path in POR -LZG(N ):

(q i 0 , Z i 0 , r i 0 ) a 1 -→ (q i 1 , Z i 1 , r i 1 ) a 2 -→ (q i 2 , Z i 2 , r i 2 ) • • • a l -→ (q i l , Z i l , r i l ).
We know that two actions with different groupid have disjoint domains, and hence, can be commuted thanks to Lemma 8.6. For every j, consider the subsequence σ j of the above sequence consisting only of actions with groupid = j. Since there may be no actions of some process in a segment, we consider only non-empty sequences: σ j 1 , σ j 2 , . . . , σ j k for some 1

≤ j 1 < j 2 < • • • < j k ≤ n.
Recalling the definition of -→ egl we see that in POR -LZG egl (N ) we have a path (q i 0 , Z i 0 , 0)

σ j 1 --→ egl (q j 1 , Z j 1 , j 1 ) σ j 2 --→ egl (q j 2 , Z j 2 , j 2 ) • • • σ j k --→ egl (q j k , Z j k , j k ) .
This shows how, for all i, we can obtain σ i from σ i , and this completes the proof.

To complete the construction we need to define a covering relation and show that it is a simulation w.r.t. -→ egl . We show that we can in fact, use the same relation gl as in Definition 8.7.

Lemma 8.16. If N is an extended global-local system, then gl is a simulation relation in POR -LZG egl (N ).

Proof. The proof is very similar to that of Lemma 8.13.

Let (q, Z, r) gl (q, Z , r ) in POR -LZG egl (N ). Observe that by the definition of the covering: the first components must be the same, Z D M Z , and r ≤ r. We show that if (q, Z, r) a -→ egl (q 1 , Z 1 , r 1 ), then there exists a node (q 1 , Z 1 , r 1 ) in POR -LZG egl (N ) such that (q, Z , r ) a -→ egl (q 1 , Z 1 , r 1 ), and (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ). Observe that the simulating node (q 1 , Z 1 , r 1 ) differs only on the second component from (q 1 , Z 1 , r 1 ).

Since Z D M Z , we know by Lemma 6.10 that (q, Z ) a -→ (q 1 , Z 1 ) for some

Z 1 with Z 1 D M Z 1 . If a is a global action, we have (q, Z , r ) a -→ egl (q 1 , Z 1 , 0) in POR -LZG egl (N ).
As in this case also r 1 = 0, we have (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ).

Otherwise, a is a non-global action and groupid(a) = r 1 . Since a is enabled from (q, Z, r) in POR -LZG egl (N ), we know that r 1 ≥ r. As r ≤ r, from the definition of -→ egl , we know that a is enabled from (q , Z , r ) and we have (q , Z , r ) a -→ egl (q 1 , Z 1 , r 1 ). Here, it is clear that (q 1 , Z 1 , r 1 ) gl (q 1 , Z 1 , r 1 ).

Thanks to Lemma 8.15 and Lemma 8.16, we can use Theorem 8.2 to get a reachability algorithm for extended global-local systems.

Lemma 8.17. Algorithm 5 using Next egl and gl solves the reachability problem for extended global-local systems.

Client-server POR

In this section, we propose a POR implementation that is customized and targeted at a class of networks of timed automata called client-server systems. We describe a procedure Next cs that computes the successors of a node of the POR-zone graph and a covering relation cs for the nodes of the POR-zone graph of a client-server system.

Client-server systems

We first briefly recall the properties of client-server systems discussed in detail in Section 7.3. In these networks, we have a server process (denoted by S) and several client processes (denoted by C 1 , C 2 , • • • , C k ). For convenience, we suppose that S, is the process number 0. These systems can have three kinds of actions

• local actions in a client, whose domain is {C i } for some i,

• local actions in the server which has domain {S},

• synchronization actions involving a client and the server, that have domain {S, C i } for some i.

So, for every action a, dom(a) is either a singleton {S} or {C i }, or a pair {S, C i }, for some client C i . We refer to synchronizations involving processes S and C i as communication actions.

Further, the definition of client-server systems also imposes conditions on how an accepting state can be reached in the system -in a client-server system, each process needs to execute a communication action with the server just before reaching an accepting state.

Recall that an accepting state is a global state, i.e., a tuple (q 0 , q 1 , • • • , q n ), where q 0 is a state of S and q i is a state of process in C i , for 1 ≤ i ≤ n. Then, the aforementioned implies that given an accepting state (q 0 , q 1 , • • • , q n ) of N , for 1 ≤ i ≤ n, each incoming transition to q i is labelled by a communication action with the server.

Remark. Suppose that N is a network which satisfies all the properties of client-server systems except the condition on the reachability of accepting states. N can be transformed to a client-server system by introducing a dummy accepting state in each process, and adding incoming transitions from all the (original) accepting states to this dummy accepting state, such that each of these transitions is labelled by a new communication action with the server.

Successor computation for client-server systems

The idea of -→ cs is to choose one client and continue executing actions of that client till it does a communication action; then, a next client is chosen. The third component r, keeps the index of the process that has executed the last action. Definition 8.9. We define a subset -→ cs of -→ transitions of POR -LZG. Given a node (q, Z, r) of POR -LZG and a transition (q, Z) a -→ (q , Z ) of LZG, we have (q, Z, r) a -→ cs (q , Z , r ) if either:

• when r = 0: a is a local action of the client r , or a involves the server and r = 0.

• when r > 0: a is a local action of the client r and r = r, or a is a communication action of the client r with the server and r = 0.

The associated function Next cs computing the set of -→ cs successors of a node is presented in Algorithm 8.

Algorithm 8 Next cs (q, Z, r) Input: A node (q, Z, r) of the POR-zone graph of a network of timed automata

N = S, C 1 , C 2 , • • • C k Output: Succ(q, Z, r)
1: Succ := ∅ 2: for every transition (q, Z) a -→ (q , Z ) do Add (q , Z , r ) to Succ 9: return Succ Lemma 8.18. The successor relation -→ cs is complete for reachability for transitions systems of client-server systems.

Proof. Let POR -LZG cs (N ) be the reduced transition system of POR -LZG(N ) induced by -→ cs . We show that the reduced transition system is reachability complete. The proof is by induction on the length of a path to a final state.

Consider a path (q 0 , Z 0 , 0)

σ -→ (q 1 , Z 1 , r 1 ) b - → (q 2 , Z 2 , 0) ρ -→ (q 3 , Z 3 , 0) in POR -LZG(N )
, where b is the first action of the server in the sequence. Hence, all actions in σ are local actions of clients. Observe that such an action b must exist as, by our assumption on client-server systems, each process needs to execute a communication action just before reaching an accepting state. Moreover this implies that the rank in the last configuration is 0, but there may be other ranks on ρ in the segment of the path between q 2 and q 3 . If b is a local action of the server, all actions in σ commute with b. By Lemma 8.6, the following is also a path in POR -LZG(N ):

(q 0 , Z 0 , 0) b - → (q 1 , Z 1 , 0) σ -→ (q 2 , Z 2 , r 2 ) ρ -→ (q 3 , Z 3 , 0)
By the induction assumption, we have a path (q 1 , Z 1 , 0) σρ -→ cs (q 3 , Z 3 , 0). We also have (q 0 , Z 0 , 0) b -→ cs (q 1 , Z 1 , 0) by the definition of -→ cs . This gives us a path in POR -LZG cs (N ).

The other case is when b is a communication action with a client r. In this case, we split σ into two subsequences: σ 1 consisting of local actions of client r, and σ 2 consisting of local actions of other clients. All actions of σ 2 commute with b. By Lemma 8.6 the following is also a path in POR -LZG(N ):

(q 0 , Z 0 , 0) σ 1 -→ (q 1 , Z 1 , 0) b - → (q 1 , Z 1 , 0) σ 2 -→ (q 2 , Z 2 , r 2 ) ρ -→ (q 3 , Z 3 , 0)
By the induction assumption, we have (q 1 , Z 1 , 0)

σ 2 ρ --→ cs (q 3 , Z 3 , 0) in POR -LZG cs (N ).
From the definition of -→ cs we get (q 0 , Z 0 , 0)

σ 1 -→ cs (q 1 , Z 1 , r) b - → cs (q 1 , Z 1 , 0)
This gives us a desired execution.

In order to apply our reachability testing algorithm, it remains to define a covering relation cs that is a simulation w.r.t. -→ cs .

Definition 8.10. For nodes of POR -LZG(N ), we define a covering relation (q, Z, r) cs (q , Z , r ) if q = q , Z D M Z and r = r or r = 0. Lemma 8.19. If N is a client-server system, then cs is a simulation relation in POR -LZG cs (N ).

Proof. Let (q, Z, r) cs (q, Z , r ) in POR -LZG cs (N ). Observe that by the definition of the covering: the first components must be the same, Z D M Z , and r = r , or r = 0. We show that if (q, Z, r) a -→ cs (q 1 , Z 1 , r 1 ), then there exists a node (q 1 , Z 1 , r 1 ) in POR -LZG cs (N ) such that (q, Z , r ) a -→ cs (q 1 , Z 1 , r 1 ), and (q 1 , Z 1 , r 1 ) cs (q 1 , Z 1 , r 1 ). Observe that the simulating node (q 1 , Z 1 , r 1 ) differs from (q 1 , Z 1 , r 1 ) only in the second component.

Since Z D M Z , we know by Lemma 6.10 that (q, Z ) a -→ (q 1 , Z 1 ) for some

Z 1 with Z 1 D M Z 1 .
Both when r = r or r = 0, we have (q, Z , r ) a -→ cs (q 1 , Z 1 , r 1 ) in POR -LZG cs (N ). As a consequence, we have (q 1 , Z 1 , r 1 ) cs (q 1 , Z 1 , r 1 ).

Thanks to Lemma 8.18 and Lemma 8.19, we can use Theorem 8.2 to get a reachability algorithm for client-server systems.

Lemma 8.20. Algorithm 5 using Next cs and cs solves the reachability problem for client-server systems.

Extended client-server systems

In this section, we present the application of the client-server POR technique to a more general class of systems, referred to as extended client-server systems. We hope that this extension would help broaden the scope of our client-server POR technique.

In these systems, we allow arbitrary synchronizations involving nonserver processes. Thus, we have a server process and disjoint groups of client processes that have synchronizations within the groups. Our approach can be viewed as considering each such group of client processes as a client and applying client-server POR on the resultant client-server system.

We use an idea similar to the one we used for extended global-local systems (see Section 8.3.2): we group client processes into equivalence classes. We say that two client processes can communicate with each other if there is an action with the two processes in its domain. This relation "can communicate with each other" is an equivalence relation and it partitions the set of client processes into equivalence classes. The equivalence class of a client process C is the set of client processes C such that C and C can communicate with each other without the server, i.e., there is sequence of communication actions not involving the server linking C and C .

Given a network {C 0 , C 1 , C 2 , • • • , C k }, we assume that the process C 0 is the server, while the others are clients. We define a mapping groupid that assigns an integral value to each process C i such that

• The server has groupid = 0. It is the unique process with groupid = 0.

• For a client C i , we define groupid(C i ) as the smallest j > 0 such that the process C j belongs to the equivalence class of C i .

It follows from the definition of groupid, that if there is an action synchronizing two clients C i and C j such that i, j > 0, then groupid(C i ) = groupid(C j ).

The function groupid defines an equivalence relation on clients. We have three categories of actions:

• client actions involving only clients with the same groupid,

• local server actions involving only the server,

• communication actions involving the server and some clients, all with the same groupid.

We define the groupid of a client action as the groupid of processes involved in this action. Otherwise, groupid of an action is 0.

The degenerate case of this situation is when all the clients have the same groupid. In this case there is no restriction on possible communication actions, but there will also be no gain when applying the method we are going to present.

The only restriction we impose is that the final state of each process should be only reachable by a communication action with the server.

Successor computation for extended client-server systems

The idea of -→ ecs is to choose one groupid and let the processes of this groupid execute till a communication action with the server; after that some other group of processes is chosen. The third component now keeps track of the groupid of the last action. Definition 8.11. We define a subset -→ ecs of -→ transitions. Given a node (q, Z, r) of POR -LZG and a transition (q, Z) a -→ (q , Z ) of LZG we have (q, Z, r) a -→ ecs (q , Z , groupid(a)) under the condition that either: (i) r = 0, or (ii) a is an action involving processes with groupid = r.

Algorithm 9 Next ecs (q, Z, r) Input: A node (q, Z, r) of the POR-zone graph of a network of timed automata N and a map groupid : {S, C 1 , C 2 , • • • C k } → N Output: Source(q, Z, r) 1: Source := ∅ 2: for every transition (q, Z) a -→ (q , Z ) do Proof. Let POR -LZG ecs (N ) be the reduced transition system of POR -LZG(N ) induced by -→ ecs . We show that the reduced system is reachability complete. The proof is by induction on the length of a path to a final state.

Consider a path (q 0 , Z 0 , 0)

σ -→ (q 1 , Z 1 , r 1 ) b - → (q 2 , Z 2 , r 2 ) ρ -→ (q 3 , Z 3 , r 3 )
POR. At the end of the section, we present the revised versions of the Next procedures with these optimizations incorporated -Next * gl (Algorithm 10) and Next * cs (Algorithm 11), respectively. Note that, in this section, we work with the more generic framework of extended global-local systems and extended client server systems.

Global-local POR

Recall that the conditions on global-local systems stipulate that an accepting state in an extended global-local system can only be reached by executing a global action at the end. Here, we discuss some optimizations to the Next egl procedure that exploit this property of extended global-local systems. Each of these optimizations essentially identifies nodes of the POR -LZG of the network from which paths cannot contain global actions, and stops the exploration from these nodes.

First optimization For the first optimization, we introduce the notion of gl(i, q, r), which is an over-approximation of the set of global actions that process A i can execute from a node with state q and rank r. Two things are to be noted here. First, if groupid(A i ) < r, then from a node with rank r, process A i is not allowed to execute its local actions before the next global action. Second, this is a syntactic construct -the timing information associated to a node has no bearing on the value of gl(i, q, r). We now make this notion precise. Definition 8.12 (gl(i, q, r)). Let N = A 1 , A 2 , • • • A k be a global-local system. We define a set of global actions gl(i, q, r) for i, r ∈ {1, . . . , k}, and q a state of N . If groupid(A i ) < r, then gl(i, q, r) is the set of global actions g such that there is an outgoing transition labelled g from q. If groupid(A i ) ≥ r, then gl(i, q, r) is the set of global actions g such that there is a state q reachable from q by a sequence of non-global transitions whose groupid is groupid(A i ) and an outgoing transition labelled g from q .

We use this notion to curtail exploration from those nodes of POR -LZG(N ) from which we are sure that there is no run containing a global action. Lemma 8.24. Let N be an extended global-local system, and let (q, Z, r) be a node of POR -LZG egl (N ). If there exist two processes A i and A j such that gl(i, q, r) ∩ gl(j, q, r) = ∅, then an accepting state cannot be reached from (q, Z, r).

Proof. Recall that, by the definition of global-local systems, an accepting path should end with a global action. If gl(i, q, r) ∩ gl(j, q, r) = ∅, then this means that there is no global action that can be executed from (q, Z, r) or any node reachable from it (independently of Z). Optimization 1. For an extended global-local system N , if (q, Z, r) is a node of POR -LZG egl (N ) such that gl(i, q, r) ∩ gl(j, q, r) = ∅, for some i, j, then (q, Z, r) need not be stored and its successors need not be explored.

Example for Optimization 1: Consider the network N presented in Figure 8.1a. We present the POR-zone graph, POR -LZG gl (N ), as produced by Algorithm 6 in Figure 8.1b. The nodes that will be removed by Optimization 1 are highlighted in red. To understand the working of this optimization, we pick one such node, (A, B), 2 , and explain why this node is removed by Optimization 1. Observe that the location A of process A 1 does not have any outgoing global actions. This means that gl(1, B, 2) = ∅ and as a consequence, gl(1, B, 2) ∩ gl(2, B, 2) = ∅. Hence, the node (A, B), 2 can be removed, and its successors need not be explored.

Second optimization Here, we present another optimization, Optimization 2 for the Next procedure for global-local systems. Before presenting the optimization, we first state Lemma 8.25 that gives a key property of the transition relation of the reduced POR-zone graph. Note that we refer to the set of clocks X i ∪ t i as clocks of process A i . Then, Z| <p denotes the projection of Z to the clocks of processes

A 1 , A 2 , • • • , A p-1 .
Lemma 8.25. Let N be an extended global-local system. Let (q, Z, r) be a node of POR -LZG egl (N ) and let (q, Z, r) a -→ egl (q , Z , r ) be a transition in POR -LZG egl (N ). If a is a local action, then Z | <r ⊆ Z| <r .

Proof. Let v be a valuation in Z . By the pre-property of transitions on zones (Lemma 4.6), we know that there exists a valuation v in Z such that (q, v) a -→ δ -→ (q , v ). By commutativity of transitions in local time semantics, we can commute the delay transitions in processes whose groupid is less than r (denoted by δ <r ) to the beginning of the sequence to obtain a sequence of the form

(q, v) δ<r --→ (q, v 1 ) a -→ δ ≥r --→ (q 1 , v )
where δ ≥r is the local delay in processes with groupid at least r. Since Z is local-time-closed, we have v 1 ∈ Z. We observe that v 1 | <r = v | <r . As v was arbitrary, this implies that Z | <r ⊆ Z| <r .

We now introduce the notion of nextglobal(q, Z, r) which gives an overapproximation of the set of first global actions on paths from (q, Z, r) in the POR -LZG egl . Consider a path σ starting from the node (q, Z, r) in the POR -LZG egl . Recall that only the local actions of processes A i for i ≥ r can be executed before a global action is executed. Therefore, such a global action c must satisfy two conditions:

• there must be an outgoing transition c from q i , for all i < r;

• a transition c must be reachable by a sequence of local actions of groupid = i, for all i ≥ r.

Formally, we can define nextglobal(q, Z, r) using the notion of gl(i, q, r) introduced in Definition 8.12.

Definition 8.13. nextglobal(q, Z, r) =

A i ∈P roc gl(i, q, r).

If no action in the set nextglobal(q, Z, r) is feasible from some node reachable from (q, Z, r), then we can conclude that no outgoing path from (q, Z, r) can be accepting. We prove this in Lemma 8.26. Let sync <r denote the constraint t 1 = t 2 = • • • = t r-1 that synchronizes the reference clocks of processes 1 to r -1. For a global action c and a state q, we let g c,q <r denote the conjunction of the guards of processes 1, . . . , r -1 on their transitions on c from q. Recall that we only consider deterministic automata. We let g c,q <r = f alse if an automaton i < r has no transition on c from q. Lemma 8.26. Let N be an extended global-local system, and let (q, Z, r) be a node of POR -LZG egl (N ). Let (q, Z, r) be a node of POR -LZG egl (N ) such that for all actions c ∈ nextglobal(q, Z, r), Z ∧ sync <r ∧ g c,q <r = ∅, Then, a path from (q, Z, r) in POR -LZG egl (N ) cannot contain a global action.

Proof. Since Z ∧ sync <r ∧ g c,q <r = ∅ for all actions c in nextglobal(q, Z, r), we know that no global action is enabled from (q, Z, r). Let (q, Z, r) a -→ (q , Z , r ) be a local action in POR -LZG egl (N ). By definition of global-local POR, we know that this local action has groupid at least r. Observe that the components 1, . . . , r -1 of q and q are the same. From Lemma 8.25, we know that Z ∧ sync <r ∧ g c,q <r = ∅. This implies that no global action is enabled from (q , Z , r ).

By repeating this reasoning, we can see that a path from (q, Z, r) cannot contain a global action.

As a consequence of Lemma 8.26, we get Optimization 2.

Optimization 2. Let N be an extended global-local system N , and let (q, Z, r) be a node of POR -LZG egl (N ) such that for all actions a in nextglobal(q, Z, r) we have Z ∧ sync <r ∧ g a = ∅. Then, by Lemma 8.26, (q, Z, r) need not be stored and its successors need not be explored.

Example for Optimization 2: Consider the network N 3 given in Figure 8.2a. The network consists of three processes A 1 , A 2 and A 3 . Observe that the accepting state of N 3 , (p 2 , q 2 , r 5 ), is marked in green. Further, note that the global actions are denoted in red. The POR-zone graph of N 3 is given in Figure 8.2b.

The nodes marked in red will be removed by Optimization 2. In each of these nodes, there is a common global action in the future, but no global action can be enabled from the node or any of its successors. For instance, consider the node (p 0 , q 1 , r 0 ), Z 8 , 2 of POR -LZG egl (N 3 ). The global action g is an outgoing action from the state p 0 in A 1 and the state q 1 in A 2 , and is reachable by local actions from r 0 in A 3 . So, this node will not be eliminated by Optimization 1. However, observe that the set Z 8 ∧ (t 1 = t 2 ) ∧ (x 1 = 5) is empty since Z 8 implies ( x 1 = y 1 ) ∧ (t 2 -y 1 ≥ 100) (recall that x 1 = 5 is translated as t 1 -x 1 = 5 in the offset settings). Therefore, the action g is never enabled from this node, even if we follow the sequence of local actions in A 3 . In a similar way, all the nodes highlighted in POR -LZG egl (N 3 ) as shown in Figure 8.2b will not be explored due to Optimization 2.

We now present a revised version of the successor computation procedure, Next * gl (Algorithm 10) with the two optimizations incorporated into it. Optimization 1 is reflected in line 8, and Optimization 2 is given by line 9 of the algorithm.

Algorithm 10 Next * gl (q, Z, r) Input: A node (q, Z, r) of the POR-zone graph of a network of timed automata N Output: A set of successors of (q, Z, r).

1: Succ := ∅ 2: for every transition (q, Z) a -→ (q , Z ) do 3: if a is global then 4:
Add (q , Z , 0) to Succ (∀i, j gl(i, q , r ) ∩ gl(j, q , r ) = ∅) ∧ 9: not (∀ c∈nextglobal(q ,Z ,r ) . Z ∧ sync <r ∧ g c = ∅) then 10: 11:

Add (q , Z , r ) to Succ 12: return Succ

Client-server POR

In this section, we discuss an optimization to the Next ecs procedure that exploit properties of extended client-server systems. Recall that in an extended client-server system, each client process needs to execute a communication action with the server just before reaching an accepting state. As a consequence, if we can deduce that on all paths from a given node of POR -LZG ecs (N ) there cannot be a communication action, then we can avoid further exploration from this node.

Let the network of timed automata N = S, C 1 , C 2 , • • • C k be a clientserver system. Let q be a state. By comm(q, 0) we denote the set of communication actions of the server that label outgoing transitions from q.

We also introduce a more complicated notion comm * (q, r), for rank r > 0. It gives an over-estimation of the set of communication actions that can be executed by processes of groupid equal to r. Note that from a node of rank r, either all the actions are explored (if r = 0) or only actions of processes whose groupid is r are explored till the next communication with a server (if r = 0). Definition 8.14. Let q be a state of N and let r > 0 be a rank. A communication action c belongs to comm(q, 0) if there is an outgoing server transition labeled by c from q. A communication action c belongs to comm * (q, r) if there is a sequence of client actions with groupid equal to r, leading to a state q with an outgoing transition labeled c. Lemma 8.27. Let N be an extended client-server system, and let (q, Z, r) be a node of POR -LZG ecs (N ) with r > 0. If comm * (q, r) ∩ comm(q, 0) = ∅, then there can be no communication action on a path from (q, Z, r) in POR -LZG ecs (N ).

Proof. From the node (q, Z, r), only actions of processes with groupid equal to r are explored. Recall that comm(q, r) denotes the set of all communication actions that are reachable by a sequence of local actions of processes with groupid equal to r. Since comm * (q, r)∩comm(q, 0) = ∅, we know that no such action is enabled from the current location of the server. This means that no communication action is enabled from (q, Z, r) nor can it become enabled by only executing client actions with groupid equal to r in POR -LZG ecs (N ).

As a corollary of Lemma 8.27, we immediately get Optimization 3. Optimization 3. Let N be an extended client-server system. Let (q, Z, r) be a node of POR -LZG ecs (N ) such that comm * (q, r) ∩ comm(q, 0) = ∅. Then, by Lemma 8.27, (q, Z, r) need not to be stored, and its successors need not be explored.

Example for Optimization 3: Consider the network A given in Figure 8.3a.

The network consists of two client processes A 1 and A 2 , and a server process S. Note that the communication actions of the network are denoted in red. A part of the POR-zone graph of A is given in Figure 8.3b. Consider the node (p 2 , q 1 , s 1 ), Z 4 , 2 of POR -LZG ecs (A) that is marked in red. Observe that c 2 is the only communication action that is reachable from q 1 via (exclusively) local actions. This is expressed as comm * ((p 2 , q 1 , s 1 ), 2) = {c 1 }. However, the set of outgoing actions from the current state s 1 of server is {c 2 }, i.e., comm((p 2 , q 1 , s 1 ), 0) = {c 2 }. Since comm * ((p 2 , q 1 , s 1 ), 2) ∩ comm((p 2 , q 1 , s 1 ), 0) = ∅, we know that there is no common communication action in the future from this node or any of its successors. Therefore, the node (p 2 , q 1 , s 1 , Z 4 ) will be removed by Optimization 3. (p 0 , q 0 , s 0 ), Z 0 , 0 (p 1 , q 0 , s 0 ), Z 1 , 1 (p 2 , q 0 , s 1 ), Z 2 , 0 (p 2 , q 1 , s 1 ), Z 4 , 2 (p 3 , q 0 , s 1 ), Z 3 , 1 (p 4 , q 0 , s 0 ), Z 5 , 0 (p 4 , q 1 , s 1 ), Z 6 , 2 (p 4 , q 2 , s 1 ), Z 7 , 0 Algorithm 11 Next * cs (q, Z, r) Input: A node (q, Z, r) of POR -LZG ecs (N ) of a client-server network N Output: A set of successors of 9q, Z, r)

1: Succ := ∅ 2: for every transition (q, Z) a -→ (q , Z ) do 3: if r = 0 or 4:
(there is C i ∈ dom(a) with 5: groupid(C i ) = r, and comm * (q, r) ∩ comm(q, 0) = ∅) then

Experiments

In this thesis, we have proposed two different solutions to address the challenge of state-space explosion for the reachability problem for networks of timed automata. The first solution, based on the computation of the local sync graph (Definition 5.6) of the network, while the second solution involves applying partial order reduction to a finite truncation of the local zone graph of the network. A prototype of both of these algorithms has been implemented in the tool TChecker [START_REF] Herbreteau | [END_REF]. In this chapter, we discuss the experiments with these implementations on standard benchmarks for timed automata. We compare the performance of these implementations with the standard UPPAAL reachability algorithm, which is the state-of-the-art solution to solve the reachability problem for timed automata.

In the first part of this chapter, we focus on the implementation of Algorithm 3 discussed in Chapter 5. The second part of this chapter is concerned with the implementation of the POR-reachability procedure (Algorithm 5) that was proposed in Chapter 8. We compare the results of running the implementations of these procedures alongside the results for the classical UP-PAAL reachability algorithm. All the three algorithms solve the reachability problem for a network of timed automata by computing a transition system and exploring it to search for an accepting state. The classical reachability algorithm computes a transition system called the global zone graph of the network, while Algorithm 3 computes the local sync graph of the network (see Definition 5.6) and Algorithm 5 computes the POR-zone graph (see Section 8.2) of the network.

For both our implementations, we first introduce some toy models (that are essentially simple networks that are easy to understand), and illustrate the working of our implementations on these simple networks. Equipped with this understanding, we discuss the results of running these implementations on bigger models that constitute the standard benchmarks for timed automata. We also give a comparison of their performance to that of the classical UPPAAL reachability algorithm provided in TChecker and provide tables that display the exhibit the results.

As a metric of the performance of the algorithms, for each network of timed automata that we run experiments on, we consider three parameters for comparison: the number of visited nodes and stored nodes in the transition system computed by the algorithm, and the runtime of the algorithm. We analyse the performance of our implementations and wherever applicable, we articulate the reasons for the gains, or lack thereof, of our implementation with respect to the standard procedure.

Remark (Runtime of the algorithm). TChecker runs 2 threads for every execution: a computation thread and a garbage collection thread. The user time sums the running time of both threads, whereas the total time is the maximum of the two times. For the purposes of experiments in this chapter, we have taken the total time as an estimate of the running time.

Efficient reachability testing using local sync graphs

In this section, we discuss the implementation of Algorithm 3 that solves the reachability problem for a network of timed automata by the construction of its local sync graph. We will refer to this implementation as the local sync graph implementation (LSG-implementation). We discuss the performance of the LSG-implementation, and compare its performance with the implementations of the classical UPPAAL reachability algorithm provided in TChecker.

We first introduce a toy-model for which the LSG-implementation computes local sync graphs that are an order of magnitude smaller than the global zone graphs computed by the standard reachability procedure. Using this toy-model, we will analyse the working of LSG-implementation by studying the local sync graph of the model that it generates. We compare and contrast the global zone graph and the local sync graph of the toy model and explain the source of gains for the model.

Toy model for LSG implementation

Our toy model is given by a network of timed automata N , with n identical processes, as depicted in Figure 9.1. Note that the actions b and c are global actions, while all other actions are local actions. Each automaton A i executes local action a i , after which one of the global actions, b or c is executed.

Table 9.1 presents results of our experiments on instances of the toy model with different number of processes. From Table 9.1, we can observe an order of magnitude gains for our toy models. We now clarify the source of these gains by explaining the working of the LSG implementation on this In both A 1 and A 2 , there is a local action a i followed by a global action b or c. Observe that when A 1 and A 2 perform local actions a 1 and a 2 , doing a 1 a 2 or a 2 a 1 leads to the same control-state of the automaton. From Figure 9.2a, we can see that in the global zone graph of N , the paths a 1 a 2 and a 2 a 1 lead to different zones Z 1 and Z 2 , in the global zone graph. As a result, we have two copies of the node with the control state (B, B), one per each interleaving of the local actions. On the other hand, the two paths result in the same zone Z (containing both Z 1 and Z 2 ) in the local sync graph (see Figure 9.2b). In this way, our new reachability procedure is able to construct a local zone graph that is an order of magnitude smaller than the global zone graph of the network, as can be observed from

A B C D a1 {x1} b x1 ≥ 1 c x1 < 1 A 1 A B C D a2 {x2} b x2 ≥ 1 c x2 < 1 A 2 • • • A B C D an {xn} b xn ≥ 1 c xn < 1 A n N = A 1 × • • • A n

Benchmark models

In this section, we discuss the results of the experiments done using the LSGimplementation for some of the classical benchmarks for timed automata. We compare our implementation with two implementations of the standard reachability procedure based on the exploration of the global zone graph of the network: TChecker and UPPAAL [LPY97, BDL + 06], the state-of-the-art verification tool for timed automata. All the three implementations use a breadth-first search with subsumption. Note that in the case of local sync graph, the subsumption used is the aLU sync subsumption (see Definition 5.5). Table 9.2 presents results of our experiments with standard models from the literature (except Parallel that is a model we have introduced). The model Parallel as presented in Figure 9.3, is a network consisting of n identical processes A 1 , • • • , A n , that do not communicate with one another, and a centralized process Lock that communicates with each process A i . (One can see that Parallel is a client-server system, as defined in Section 7.3.) The actions acquire and release are communication actions, while all other actions are local actions.

Local sync graphs yield no gain on 3 standard examples (which are not given in Table 9.2): CSMA/CD [TY01], FDDI [START_REF] Daws | The tool KRONOS[END_REF] and Fischer [START_REF] Tripakis | Analysis of timed systems using time-abstracting bisimulations[END_REF]. In these models, the three algorithms visit and store the same In contrast, we observe significant improvements on other standard models (Table 9.2). Observe that due to subsumption, the order in which nodes are visited impacts the total number of visited nodes. UPPAAL and our prototype TChecker (Global ZG column) may not visit the same number of nodes despite the fact that they implement the same algorithm. In our prototype we use the same order of exploration for Global ZG and Local ZG. CorSSO [START_REF] Yu | SAT-based model checking for region automata[END_REF] and Critical region [START_REF] Morbé | Fully symbolic model checking for timed automata[END_REF] are standard examples from the literature. Dining Philosophers [LNZ05] is a modification of the classical problem where a philosopher releases her left fork if she cannot take her right fork within a fixed amount of time. We observe an order of magnitude gains for most of these four models. The reason is that, as we illustrated using our toy model in Section 9.1.1, in most states, when two processes can perform actions a and b, doing ab or ba leads to the same control-state of the automaton. Hence, a difference between ab and ba (if any) is encoded in distinct zones Z ab and Z ba obtained along these two paths in the global zone graph. In contrast, the two paths result in the same zone Z (containing both Z ab and Z ba ) in the local sync graph. In consequence, our approach that combines the local zone graph and abstraction using synchronized zones is very efficient in this situation. For each model we report the number of concurrent processes.

A B C x 1 ≤ 3 a1 {x1} b1 x 1 ≥ 1 acquire x 1 < 1 {x 1 } release x1 ≥ 1 A 1 • • •

POR-implementation in TChecker

In this section, we discuss the experiments performed with the implementation of the partial order reduction procedure implemented in TChecker [START_REF] Herbreteau | [END_REF].

We discuss the performance of the POR-reachability algorithm as implemented in TChecker, and compare its performance with two other implementations: the classical UPPAAL reachability algorithm and the LSGimplementation discussed in Section 9.1. We recall that our POR-reachability algorithm computes a transition system called the POR-zone graph (denoted as POR -LZG r ), discussed in detail in Section 8.2. For a comparison of the three procedures, for each model, we compile the results of experiments in a table. For each procedure, the table gives the number of visited nodes and stored nodes in the transition system computed by the procedure, and the runtime of the procedure, for the model with different number of processes.

Remark. We run the algorithm with the default values of parameters for smaller models, which produce zone graphs of order 1000 nodes. For larger zone graphs, we increase the values of these parameters to block-size = 100, 000, 000 and table-size = 65, 536, 000, as the size of the models increase.

Recall that we had proposed two variants of the POR implementationnamely, global-local POR (Section 8.3) and client-server POR (Section 8.4), targeted at two classes of networks of timed automata, global-local systems and client-server systems, respectively. Thus, each model can be classified into one of the following categories, each of which represents a situation that can arise when applying our POR technique: We will first present some toy models, one from each of the categories. We discuss the performance of our POR-implementation on these toy models, and explain the reasons for the gains or lack of gains observed while running the implementation on the model. By doing this, we hope to present and distinguish the situations, favourable and unfavourable for our methods. We then discuss the working of our POR-implementation on some of the classical benchmarks for timed automata, and explain the gains (or lack of gains) for our algorithm on these models.

Toy models

In this section, we will introduce some toy models and discuss the results of applying the POR-implementation on these networks. We describe, in some detail, how our procedure works on these toy models. Through these examples, we hope to convey to the reader, an intuition of the working of our implementation and the source of gains or lack thereof, for these models.

We will consider five toy models, one from each of the categories given in the classification given above.

Type 1: Global-local toy model where POR works

Here, we present a toy global-local model for which our global-local POR method is much more efficient than the standard reachability procedure. The model is given by a network of timed automata N , with n identical processes, as depicted in Figure 9.4. Note that the action g is a global action, while all other actions are local actions. Each automaton in this network is of the form of a chain of local actions with a global action at the end. Thus, each process is free to execute its sequence of local actions independently, and in the end jointly execute a global action.

Table 9.3 presents the result of experiments on instances of the model in Figure 9.4 with different number of processes.

From the definition of tame model (see Definition 7.3) , we can see that the model in Figure 9.4 is a tame model. As a consequence, from Lemma 7.1, it immediately follows that it is 0-spread. We run the globallocal POR-reachability algorithm with the parameter spread set to 0, for this model. We now explain the working of the global-local POR-reachability algorithm on this model. We do this by considering the instance of N with 2 processes, A 1 and A 2 . The global zone graph and the POR-zone graph for this network are given in Figures 9.5a and 9.5b, respectively. Observe that A 1 has a sequence of local actions a 1 b 1 c 1 followed by a global action g. Similarly, A 2 has a sequence of local actions a 2 b 2 c 2 followed by the global action g. From Figure 9.5a, we can see that the global zone graph of N explores all the possible interleavings of these sequences of local actions. As a result, we have a diamond composed of these local actions in the global zone graph.

On the other hand, in POR -LZG r (N ), we explore only one interleaving of We will now see how this is accomplished. The initial node of POR -LZG r (N ) has rank 0, which means that local actions of all the processes are explored from this node. Consider the node (A, B) reached by exploring the local action a 2 in A 2 . Recall that this node has rank 2. Using Optimization 1 for global-local POR, we are able to conclude that no global action is possible from this node or any of its successors in POR -LZG r (N ). Thus, the exploration of this node is not useful, as far as reachability is concerned. Therefore, we avoid the exploration of this node and its successors. In a similar manner, until we reach the local state (D, A) in POR -LZG r (N ), we are able to infer that exploration of local actions in A 2 are useless w.r.t. reachability. So, a local action of process A 2 is explored only when there are no more local actions left to be explored in A 1 . In this way, our global-local POR method is able to construct a POR-zone graph that is linear in the size of the network, while the global zone graph is exponential in the size of the network.

A, A B, A A, B C, A B, B A, C D, A C, B B, C A, D D, B C, C B, D D, C C, D D, D E, E a 1 a 2 b 1 a 2 a 1 b 2 c 1 a 2 b 1 b 2 a 1 c 2 a 2 c 1 b 2 b 1 c 2 a 1 b 2 c 1 c 2 b 1 c 2 c 1 g (a) Global zone graph A, A , 0 B, A , 1 C, A , 1 D, A , 1 D, B , 2 D, C , 2 D, D , 2 E, E , 0 A, B , 2 B, B , 2 C, B , 2 a 2 a 2 a 2 a 1 b 1 c 1 a 2 b 2 c 2 g (b) POR-zone graph

Type 2: Global-local toy model where POR does not work

In this section, we present a toy model that illustrates a typical situation where our global-local POR technique does not fare well. The toy model is given by the network of automata given by the network N , as given in Figure 9.6. As was the case for the toy model in Section 9.3.1, we can see that the model in Figure 9.6 is a tame model and it immediately follows that it is 0-spread. 9.6 with different number of processes. The POR-implementation was run with spread set to 0.

To understand the lack of gains for this model, we first consider a simpler network A given in Figure 9.7. Consider the POR-zone graph of A produced by our global-local POR-algorithm without the optimizations, given in Figure 9.8b. Comparing the global zone graph of A, ZG(A) (Figure 9.8a), and POR -LZG r (A), we can see that even though we have far fewer interleavings in POR -LZG r (A) as compared to the global zone graph, the number of states is the same in both the transition systems. Thus, if we consider the number Next, we consider the POR-zone graph of A, POR -LZG r (A), computed by the optimized version of our POR-procedure, given in Figure 9.8c. (Note that the red nodes are not part of POR -LZG r (A).) Recall that Optimization 1 was used to eliminate nodes of the POR-zone graph from which no global action is possible in the future. Observe that Optimization 1 helps in eliminating a lot of nodes from POR -LZG r (A) that are irrelevant to reachability. A crucial reason why Optimization 1 worked was that the initial state did not have any global outgoing actions. Had there been outgoing global action g on all the states, Optimization 1 would not have removed any node of the POR-zone graph. This is, in fact, the situation in the model in Figure 9.6 -there is a self-loop on the global action g on the states A and B. As a result, in this network, the global action g is enabled from all configurations of states. Thus, in this situation, Optimization 1 is no longer useful. As a consequence, we would not get any gains due to our global-local POR implementation.

Remark. Despite the lack of gains with our global-local POR-method, observe that in Table 9.4, the runtime of the POR-implementation is lesser than that of the standard algorithm and the LSG implementation. This is because the number of interleavings in the POR-zone graph is much lesser than the number of interleavings in the global zone graph and the local sync graph of the model.

Type 3: Client-server toy model where POR works

In this section, we present a toy client-server model for which our client-server POR method is more efficient than the standard reachability procedure. We discuss the working of client-server POR method on this model and explain the source of gains. The model, as depicted in Figure 9.9, is a network of timed automata N containing a server process and n (identical) client processes. Note that in the process Client i , the action c (highlighted in red) is a communication with the server, while all other actions are local actions. Since the network has no timing constraints, we can convert any run to a run in which each action is executed in 0 time. Therefore, we can conclude that the model has spread 0. We consider the global zone graph and POR-zone graph of spread 0, of the toy client-server model. The clientserver POR-reachability algorithm is run with the parameter spread set to 0. Table 9.5 presents the results of experiments on instances of the model in Figure 9.9 with different number of clients.

We now explain the working of the client-server POR-reachability algorithm by illustrating how our procedure works on an instance of this toy model. For simplicity, we consider the instance of the model with just 2 clients. Figure 9.10a gives the global zone graph and Figure 9.10b gives the POR-zone graph of this network.

Observe that there is a sequence of actions a 1 b 1 d 1 e 1 c in A 1 and a 2 b 2 d 2 e 2 c in A 2 . We can see, from Figure 9.10a, that all the interleavings of the sequences a 1 b 1 d 1 e 1 c and a 2 b 2 d 2 e 2 c are explored in the global zone graph. As a consequence, we are forced to explore a lot of intermediate states in the global zone graph, which do not lead to any new accepting states, and therefore do not provide any additional information w.r.t. reachability. Now, consider the POR-zone graph of this network. Here, we start with the initial node (s 0 , s 0 , I) whose rank is 0. From this node, we explore all enabled actions. Next, consider a successor of this node in the POR-zone graph -the node (s 1 , s 0 , I). This node has rank 1. Recall that from a node of rank r, if r = 0, only actions of process A r are explored till the next communication with a server. Thus, even though the action a 2 is enabled from the node (s 1 , s 0 , I), the client-server POR procedure postpones the exploration of a 2 to a later point. Note that from a lot of states (as demonstrated above for (s 1 , s 0 , I)) in the POR-zone graph, the exploration of many actions is postponed, thereby avoiding the exploration of nodes which do not contribute any new information with respect to reachability.

More concretely, thanks to our client-server POR algorithm, once we start exploring the actions of a client, we continue to explore only local actions of that client until we see a communication action. Thus, the client-server POR method ensures that we do not explore all execution orders in POR -LZG r (N ). Rather, we explore only two symmetric orders -the sequence of actions of A 1 followed by the sequence of actions in A 2 , and the sequence of actions of A 2 followed by the sequence of actions in A 1 . In this way, we obtain a POR-zone graph that is much smaller (w.r.t. the number of nodes) than the global zone graph.

Type 4: Client-server toy model where POR does not work

In this section, we present a typical situation where our client-server POR technique does not give us any gains. Consider a client-server system A, in which every action of each process is a communication action (see Figure 9.11). This means that each node of the POR-zone graph has rank 0. As a consequence, from every node of the POR-zone graph, all the actions will be explored. Thus, there is no reduction in the number of nodes when we compare the POR-zone graph of A, when compared to the global zone graph of A. 9.11.

Type 5: Toy model with unbounded spread

We have already presented an example of a network of timed automata that has unbounded spread in Section 7.1. We repeat this example here, so as to illustrate a typical situation that prevents a system from having a bounded spread. Consider a network A of two processes, A 1 and A 2 , as shown in Figure 9.12.

A = A 1 A 2 A 1 A 2 p 0 p 1 q 0 q 1 q 1 a x = 1; {x} c b y < 1 c Figure 9
.12: Example of a network with unbounded spread We can show that the run a m bc of A is possible in local time semantics and has spread at least m -1, which implies that the spread of A is not bounded. For a proof, see Lemma 7.1.

Bigger benchmarks

In this section, we discuss the results of the experiments with our PORimplementation on some of the classical benchmarks for timed automata. We will consider some networks of timed automata inspired from classical benchmarks and classify them into one of the categories of the classification given in page 193. Using the intuition obtained from the working of the POR-algorithm on the toy models, we explain the gains (or lack thereof) for our POR-implementation on these models.

Type 1: Global-local model where POR works

Here, we consider a global-local system for which our global-local POR method turns out to be more efficient than the standard reachability procedure. We consider the global-local variant of the Fire-alarm model, a model from the standard benchmarks for timed automata.

Fire-alarm model

Standard model. The standard Fire-alarm model [START_REF] Muñiz | Timed automata with disjoint activity[END_REF] is a network consisting of n processes, referred to as Sensor processes, and a server process. Each process in the model is modelled using a timed automaton as depicted in Figure 9.13.

Ini Wait

Sent Fin In this model, the values of constants K 1 , K 2 , K 3 differ for each process, and are chosen in such a way that the process Sensor i executes the action Sent → Fin before the process Sensor i+1 executes the action Ini → Wait, for each 0 ≤ i < n. The value of the constant D depends on the number of processes and is chosen in such a way that all the sensors end their cycle simultaneously, D seconds after the process Sensor 1 starts execution. Thus, in each global run of the network, the process Sensor i reaches the Fin state before the process Sensor i+1 starts execution of its cycle. Once each Sensor process reaches the Fin state, each of them executes the action Fin → Ini simultaneously, and completes the cycle.

x i ≤ K1 x i ≤ K2 x i ≤ D x i ≤ K3 x i ≥ K1 x i ≥ D {x i } x i ≥ K3
Global-local model. For running our implementation, we consider a global-local variant of this model. Our Fire-alarm global-local model is as depicted in Figure 9.14. Note that, while the action g from Reset to Ini is a global action, all other actions are local actions. In our model, we consider the same values of K 1 , K 2 and K 3 for all sensor processes. In this way, we relax the strong restrictions on the order of execution of sensors that existed in the standard model.

Since this modified Fire-alarm model is a global-local system, we can apply our global-local POR on this model. Lemma 9.1 states that the Firealarm global-local model has a spread of D. Consequently, we can apply global-local POR with spread set to D on this model.

Ini Wait

Sent Fin Reset

x i ≤ K1 x i ≤ K2 x i ≤ D x i ≤ K3 x i ≥ K1 x i ≥ D {x i } x i ≥ K3
(q 0 , v 0 ) σ 1 -→ (q 1 , v 1 ) g 1 -→ (q 2 , v 2 ) σ 2 -→ (q 3 , v 3 ) g 2 -→ (q 4 , v 4 ) • • •
where σ i 's are sequences of local actions and g i 's are global actions.

Observe that the valuations v 2i+1 are synchronized valuations, for all i ≥ 0, as these valuations have to execute global actions. Further, note that in each of these valuations, x 1 = x 2 = • • • = x n . Now, we examine the maximum difference between reference clocks that can appear in valuations in the sequence of local actions (q 0 , v 0 ) σ 1 -→ (q 1 , v 1 ). We know that for all valuations in σ i , we have

x 1 = x 2 = • • • = x n .
Further, we know that in all these valuations t i -x i ≤ D. This implies that t i -t j ≤ D, for all i, j ∈ {1, 2, • • • , n}. Thus, we have a timed automaton for each process, and a timed automaton which stores the shared variable id, as shown in Figure 9.15. We now describe the functioning of the Fischer standard model. Each process has four states: A, Req, Wait and CS. Initially it is in the A state. After elapsing an arbitrary amount of time in the A state, the process checks whether the shared variable is currently free (by checking if the value of id is 0). If id is not being accessed by any other process, within k time units, the process declares its intent to access the critical section by setting the value of id to its index, i. After waiting for at least k time units, the process checks that the value of id is still i (makes sure that some other process has not accessed and written into it) and then enters the critical section. If the value of id is no longer i after k time units, it means that some other process is trying to access the critical section and has issued a later request. In this case, the process waits in the state Wait until the critical section is free again and then goes back to the Req state. To allow this behaviour, we introduce n copies of the variable ID, which we call local cache C i of the process A i . Thus, we have a local cache C i for each process and these cache synchronize on writes. The network is of the form

A 1 × C 1 × • • • × A n × C n
where C i are the caches as given in the Figure 9.16. This system is a global-local system if we consider (A 1 × C 1 ) × • • • × (A n × C n ) as the network -we consider the product of A i × C i so that it becomes a single automaton. In the resulting system the ID-toi actions are global actions, while all other actions are local actions.

Note that there are self-loops for each global action on each state of the Fischer product process (A i × C i ). As shown in Section 9.3.2, networks in which there are common outgoing global actions from each state are not favourable to our global-local POR technique, as Optimization 1 will not remove any node in the POR-zone graph of this network, as every node has outgoing global actions. Hence, we cannot hope to have any gains in these models.

We generalize this observation further as follows: The processes participating in the models such as Fischer and CSMA/CD have to keep track of a central resource at all times. This central resource could be a shared variable in the case of Fischer, or the status of the shared bus in the case of CSMA/CD. As a consequence, when we model these protocols using globallocal networks, we are forced to add global actions reflecting the modification of the status of this common shared resource in each state of all the processes. This is detrimental for the performance of our global-local POR algorithm.

Table 9.8 presents the result of experiments on instances of the Fischer global-local model with different number of processes. The WCET model consists of a server process, called Cache, and four processes for each client i, namely Program i , Core i , I-Cache i and D-Cache i , given in Figure 9.17 and Figure 9.18. These four processes of each client have mutual synchronizations between them and all the processes have synchronizations with the server.

As already mentioned, the process Program i has to execute a set of instructions n times. Some of these instructions require accessing a shared variable, and therefore, mutual exclusion is required for these instructions. This is accomplished by using a lock variable. The status of the lock is stored in the server in a Boolean variable locked -therefore, the actions involving lock are synchronizations with the server. There are three actions involving the lock variable -the check-locked action which checks that the lock is not free, the lock action which checks that the lock is free and acquires the lock, and the unlock action which checks that the lock is not free and releases the lock. These actions are represented as self-loops in all states in the server.

When a client needs to access a shared variable (this is modelled in the state Check-lock of the process Program), it checks the status of the lock by communicating with the server. If the lock is not free (for instance, if the shared variable is being accessed by some other client), Program goes to the LD-ID-lock state by executing the check-locked action and continues its execution. If the lock is free, Program executes the communication action lock and then proceeds to execute the instructions which required the shared variable. Once the client completes the execution of these instructions, the process Program releases the lock by executing the communication action unlock from the unlock state. This cycle is repeated n times. The model that we consider here, referred to simply as WCET-model, is a variant of the original model. The model is as given in Figure 9.17.

We now describe the processes in some detail.

• Program i (Figure 9.17)

This process models a program that executes a specific set of instructions n times. We model the behaviour of a program by a sequence of exec-instr actions, followed by a exec-instr-done action. Observe that each of these actions are synchronizations with the process Core i . The process Program also has lock and unlock actions, that are designed for ensuring mutual exclusion, as discussed above. The process Program also has a Finished action which signals the completion of all instructions by the program. Note that the actions lock, unlock and Finished are communication actions, i.e., synchronizations with the server.

• Core i (Figure 9.17)

The Core i process starts its execution by executing the exec-instr action that is a synchronization with Program i . After executing the exec-instr action, the Core i process issues request to access the instruction cache and data cache by executing the access-I action with the processes I-Cache i and the access-D action with D-Cache i , respectively. The successful completion of the access requests to the instruction cache and the data cache are signalled by the execution of the actions access-I-done (jointly with I-Cache i ) and access-D-done (jointly with D-Cache i ), respectively. Upon completion of the cache access, Core i signals it to Program i by executing the exec-instr-done action. The Core i process also executes the action done jointly with Program i , the purpose of which is to signal to the program that the core is not in the middle of its execution. Observe that Core i has "wait states" which requires the elapse of a certain amount of time in them.

• I-Cache i (Figure 9.18)

The I-Cache process is meant to simulate the working of the instruction cache of the architecture. Once the Core issues a request to access the instruction cache by executing the access-I action, if there is a Cache hit, the I-Cache executes the access-I-done action after waiting for at least K 3 time units. Otherwise, I-Cache executes the action access-cache-s, which indicates a request to access the secondary cache. Note that this is a communication action with the server process.

• D-Cache i (Figure 9.18)

Just as the I-Cache process simulates the working of the instruction cache, the D-Cache process simulates the working of the data cache of the architecture. Once the Core issues a request to access the data cache by executing the access-D action, if there is a Cache hit, the D-Cache executes the Data-done action after at least K 4 time units. Otherwise, D-Cache executes the action access-cache-s, which indicates a request to access the secondary cache and is a communication action with the server process.

The server simulates the secondary cache and stores a Boolean variable called "locked", which is used to ensure mutual exclusion, whenever required.

We now demonstrate that this model is an extended client-server model (see Section 8.4.2). For ease of reference, we denote by WCET i the set {Program i , Core i , I-Cache i , D-Cache i }. The synchronizations in the model are of the following formulated

• communication actions involving the server and processes from the set WCET i , for some i ∈ {1, . . . , n}.

• synchronizations involving processes from the set WCET i .

Observe that there are no synchronizations between a process from WCET i and WCET j , where i = j. Further, the only timing constraints in the WCET model are of the form of wait states. It may be observed that the WCET model is an example of a client-server network with wait states, that are considered in Lemma 7.6. Directly from the lemma, it follows that the WCET model is spread bounded with a bound of N • W , where N is the number of wait states of a process that can appear in a run of N , and W is an upper bound on the wait time associated to a wait state in N . We apply our client-server POR to the WCET model, with the parameter spread set to 1000, which is greater than N • W in this case. Table 9.9 presents the number of visited nodes and stored nodes in the global zone graph, local sync graph and the POR -LZG r of instances of the WCET model for different number of clients, and the respective runtime of the procedures. Note that the results in the Table 9.9 are for the WCET model with the value of n set to 1. Observe that this model falls under the category of the client-server models. However, each action of a client is synchronized with the server, i.e., each action in this model is a communication action. This means that there is no concurrency in this model, and consequently no hope of getting any reduction with our POR-reachability algorithm. 9.4.5 Type 5: Models that are spread-unbounded Dining philosophers model. In this section, we consider a timed version of the classical Dining Philosophers protocol, inspired from a model presented in Lugiez et al. [START_REF] Lugiez | A partial order semantics approach to the clock explosion problem of timed automata[END_REF]. The classical model involves a certain number of philosophers who are seated around a table with a fork placed between each of them, and the philosophers are required to have dinner respecting certain conditions. A philosopher can only eat when she has forks placed to her left and right. Further, each fork can only be held by one philosopher at a time.

Our Dining Philosophers model consists of n processes modelling philosophers and n identical processes modelling forks. We have a timed automaton for each process as depicted in Figure 9.20. In our model, we have a timeout to release the acquired fork if the other fork cannot be obtained within a fixed time, in order to avoid deadlocks.

The Fork automaton has two states -free and taken. If the automaton is in free state, it signifies that the fork is free to be acquired, whereas if it is in taken state, it means that the fork is currently being held by a philosopher. Whenever a philosopher wants to acquire a fork, the process modelling that philosopher synchronizes with the Fork automaton to execute the take action which changes the state from free to taken. Similarly, when a fork is released by a philosopher, the process modelling it synchronizes with the respective fork automaton to do the rel action, and changes its state from taken to free.

The timed automaton modelling Philosopher has four states -Idle, Acq, Eat and Release. The automaton is initially in the state Idle. Recall that Philosopher i uses Fork i-1 and Fork i to eat. After elapsing an arbitrary amount of time in the Idle state, Philosopher i checks whether Fork i-1 is currently free; if it is free, it is acquired. Within K 1 time units of acquiring Fork i-1 , Philosopher i tries to acquire Fork i . If it is not possible to acquire Fork i within K 1 time units, Fork i-1 is released and Philosopher i goes back to Idle state. On the other hand, if she manages to acquire Fork i , the philosopher proceeds to Eat state, where she spends K 2 time units (the duration of the dinner). Exactly after spending K 2 time units in the Eat state, the Philosopher releases both forks in zero time and goes to Idle state.

Next, we will show that the Dining Philosophers model given in Figure 9.20 is not spread bounded.

Lemma 9.2. The Dining Philosophers model is not spread bounded.

Proof. Consider the instance of the Dining Philosophers model with 4 philosophers and 4 forks. Recall that Philosopher 1 needs Fork 1 and Fork 4 to eat, Philosopher 3 needs Fork 2 and Fork 3 , and so on. Further, assume that the duration of dinner is d time units.

Consider the situation where Philosopher 1 has acquired Fork 4 -the system is now in the state (Acq, Idle, Idle, Idle) for the philosophers. Now, suppose Philosopher 3 acquires Fork 2 and Fork 3 . At this point, the state of philosophers

Idle Acq

Eat Release take i-1 {x i } rel i-1

x i = K1 take i x i ≤ K1 {x i } rel i x i = K2 {x i } rel i-1
x i ≤ 0 free taken take i rel i

Philosopher i

Fork i Next, we show that the network can reach a synchronized valuation from the aforementioned valuation of large spread. This is accomplished by Philosopher 1 executing the loop: Eat → Release → Idle → Acq and catching up with the local time of Philosopher 3 -after which the processes can do a transitive synchronization, where Philosopher 1 synchronizes with Fork 1 , then Fork 1 synchronizes with Philosopher 2 , followed by synchronization between Fork 2 and Philosopher 3 .

The run given above is a local-time run, which has no equivalent k-spread run. This implies that the system is not k-spread, for any value of k. In other words, it is not spread bounded.

Chapter 10

Conclusion

The key contributions of this thesis are a systematic study of state-space explosion in the verification of networks of timed automata caused due to interleaving of the components and solutions for alleviating the effects of this explosion. We believe that these are important steps towards obtaining scalable verification procedures for various classes of timed automata. In this chapter, we summarize the work presented in this thesis, and identify some directions for future research.

Summary of our contributions

We provide two different solutions for the state-space explosion problem in verification of networks of timed automata. The first one is an algorithm that tests the reachability of networks of timed automata based on the exploration of the local zone graph of the network. The second is a framework for partial order reduction methods for networks of timed automata and POR algorithms for some classes of timed automata.

In order to design our algorithm, we revisit the local time semantics of timed automata and local zone graphs [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF]. We discover a very useful fact which says that local zones compute aggregated zones [START_REF] Ben Salah | On interleaving in timed automata[END_REF], where an aggregated zone is a union of all the global zones obtained by equivalent executions. We use this fact as a theoretical foundation to design an algorithm for constructing local zone graphs using subsumption on aggregated zones. Furthermore, we show that the existing techniques that use subsumption operations on local zones [START_REF] Bengtsson | Partial order reductions for timed systems[END_REF][START_REF] Minea | Partial order reduction for model checking of timed automata[END_REF][START_REF] Minea | Partial Order Reduction for Verification of Timed Systems[END_REF] do not work. We propose a new subsumption for local zone graphs based on standard abstractions for timed automata, where the subsumption is applied on synchronized zones. The restriction to synchronized zones is crucial as standard abstractions cannot handle multiple reference clocks. Our algorithm is the first efficient implementation of local zone graphs and aggregated zones.

213

Experimental results show an order of magnitude gain with respect to state of the art algorithms on several standard examples.

We remark that a natural progression for this work is to apply standard partial order techniques to the aforementioned algorithm. Unfortunately, we do not have an effective way to compute the independence relation between actions in the finite local zone graph that we construct. Consequently, we cannot apply a partial order reduction method on this transition system.

Next, we propose a region equivalence for local valuations and show that this region equivalence is a simulation relation for local valuations. Furthermore, building on this region equivalence, we propose a new subsumption relation, which we call a * M subsumption. However, the transition system obtained by applying the a * M subsumption to local zone graphs is not finite in general. We identify that the fundamental difficulty in designing a finite subsumption for local zone graphs is the arbitrary divergence between the reference clocks of different processes of the network. Equipped with this understanding, we define the spread of a network of timed automata to be the maximum divergence between reference clocks across processes and restrict our attention to networks that are spread-bounded.

We modify the a * M subsumption to design a new subsumption relation, called a D M subsumption, that is parameterized by a constant D. By applying the a D M subsumption while exploring the local zone graph of a network, one obtains a finite transition system, denoted LZG D M . We show that if the spread of a network is bounded by D, then the LZG D M of the network is sound and complete with respect to reachability. Further, we give a condition that computes an approximation of the independence relation of the LZG D M of a D-spread-bounded network. We identify two classes of networks of timed automata, referred to as global-local systems and client-server systems, respectively, and propose partial order reduction methods for spread-bounded networks belonging to these categories. We also provide an evaluation of a prototype of the implementation of these methods on some examples using the tool TChecker [START_REF] Herbreteau | [END_REF].

Directions for future research

The main directions for future research are to develop better partial order reduction methods for networks of timed automata. We have proposed a framework for applying partial order reduction to networks of timed automata, and proposed POR-algorithms for some classes of timed automata. Refining our algorithm to optimize it further, and expanding its applicability to more classes is an important direction for immediate future research. It is also desirable to carry out further experimental investigations to determine the effectiveness of our POR-reachability algorithms.

The scope of our techniques is restricted to networks of simple timed automata. In particular, classes of timed automata with more behavior, such as timed automata with diagonal constraints [START_REF] Alur | A theory of timed automata[END_REF], updatable timed automata [START_REF] Bouyer | Updatable timed automata[END_REF], priced timed automata [START_REF] Bouyer | Quantitative analysis of real-time systems using priced timed automata[END_REF] and probabilistic timed automata [START_REF] Kwiatkowska | Automatic verification of real-time systems with discrete probability distributions[END_REF] fall outside the scope of our technique. Generalizing our technique to allow its application to these more general models is a broader and more ambitious research direction.

We list some other open problems below.

Computing the spread of a given network of timed automata. The POR-reachability procedure that we introduce in Chapter 8 can only be applied to networks of timed automata that are spread-bounded. Consequently, it is crucial to have ways to check if a network is spread bounded and compute an upper bound on the spread of the network. In Chapter 7, we propose some efficiently checkable syntactic conditions on a network that imply bounds on its spread. Identifying more such efficiently checkable sufficient conditions is an immediate open question of interest. A more challenging question would be to obtain a characterization of networks of timed automata of a specified spread.

Further, it would be interesting to design an efficient procedure that takes a network of timed automata as input and outputs the spread of the network. We believe that such a procedure would significantly enhance the applicability of our POR-reachability procedure.

Analogue of a LU subsumption. The a D M subsumption for local zones proposed in Chapter 6 is analogous to the standard a M subsumption for standard zones. In the setting of standard zone graphs, it is known that the a LU subsumption produces zone graphs with fewer nodes than the a M subsumption. So, defining an analogue of the a LU subsumption for local zones has the potential to make the POR-reachability algorithm more efficient.

Optimizations to POR-reachability algorithm. We have proposed separate POR-reachability procedures for global-local systems. Further investigation of the global-local and client-server POR algorithms and designing optimizations to make these procedures more efficient is an interesting line of work.

Semi-commutation in global-zone graphs. In this thesis, we work predominantly in the setting of local-time semantics. It may also be possible to come up with partial order reduction techniques in the standard semantics. In the standard setting, this would involve looking at sequences and checking if a given sequence is semi-commutable. This direction has already been Adapting POR-reachability algorithm for specific models. We have proposed a POR-reachability procedure for the general class of network of timed automata. In various subclasses of networks of timed automata such as timed automata with only one clock, timed automata with urgent behavior etc., it may be possible to exploit the specific properties of these subclasses to optimize the performance of out POR-reachability procedure further. Adapting the algorithm to specific subclasses of networks of timed automata is an essential direction of study.

Complexity of the D-spread-boundedness problem. In Chapter 7, we show that the D-spread-boundedness problem is Pspace-hard. However, we have not given an upper bound for the complexity of the D-spreadboundedness problem. proving a concrete upper bound for the complexity of the D-spread-boundedness problem is an interesting open question. with state invariants. From the discussion in Section A.2.1, we can assume that the initial state of A does not have a state invariant. Pick any state q of A (other than the initial state). For each invariant x c of state q, we modify each transition of the form p a,g --→ R q as follows:

• if x ∈ R, then the guard g is replaced by the guard g ≡ g ∧ x c.

• otherwise, if c ≤ 0, then the guard is left unchanged, i.e., g ≡ g.

if c > 0, then we remove the transition.

Finally, we remove the invariant x c associated to the state q. Repeat this transformation for each state of A, except the initial state.

Let N = {A 1 , • • • , A n } be the network obtained by carrying out the aforementioned transformation independently to each process of the network N = {A 1 , A 2 , • • • , A n }. By definition, no process of N does not have state invariants of the form x c.

It is easy to see that for each valuation v, we have

v |= g and [R]v |= x c ⇔ v |= g
We can then prove that any local run of N is feasible in N , and vice versa. Both the directions of the proof follow by induction on the number of steps in the run, with the help of A.2.2. Specifically, we show that a run (q 0 , v 0 ) σ -→ (q, v) of N is feasible in N , by inducting on the number of steps in the run. The converse direction also follows by a similar argument.

We now give a bound on the time taken for this transformation. Consider a state s of a process A i of the network N . We assume that s has only one invariant of the form x c for a given clock x; if there were two invariants of the form x c 1 and x c 2 in a state, where c 1 > c 2 , we can ignore the invariant x c 2 . It is easy to see that, for the process A i , the transformation takes |Q i |.|X i |.|T i | time. We carry out the transformation independently to each process of the network. Thus, the network N can be constructed in time

O(Q max • T max • X max • n), where Q max = max 1≤i≤n Q i , T max = max 1≤i≤n T i and X max = max 1≤i≤n X i .
Next, we give a bound on the size of the network N . The number of states and transitions in the new network N is the same as that in N . The only aspect in which N is different from N is in the guards of the transitions and the invariants of states. Consider a transition in A i with guard g. The new guard g of this transition in A i can have X i additional constraints. Consider a transition with guard g in N and guard g in N . The guard g can have up to X new atomic constraints more than the guard g. Thus, the size of the new network N differs from the size of the original network N

(q 0 , v 0 ) ∆ 0 --→ (q 0 , v 0 ) a 1 -→ (q 1 , v 1 ) ∆ 1 --→ (q 1 , v 1 ) a 2 -→ • • • ∆ l-1 ---→ (q l-1 , v l-1 ) a l -→ (q l , v l ) ∆ l -→ (q l , v l )
where v 0 is an initial local valuation and v l is a synchronized valuation.

We will show that σ is a run in N as well. Pick a configuration (q i , v i ), 0 ≤ i ≤ l, in the run σ. We will show that (q i , v i ) a i+1 ---→ (q i+1 , v i+1 ) is feasible in N . Suppose that the transition q i a i+1 ---→ q i+1 has the guard g p in process A p , where p ∈ dom(a i+1 ). Similarly, suppose that the transition q i a i+1 ---→ q i+1 in the new network N has the guard g p in process A p . From the definition of N , we know that g p ≡ g p ∧ Inv p (q i ).

From the run σ of N , we know that v i |= Inv p (q i ) for all p ∈ Proc. Further, since a i+1 is feasible from (q i , v i ), we know that for each p ∈ dom(a i+1 ), v i |= g p . From these observations, we can conclude that for each p ∈ dom(a i+1 ), we have v i |= g p ∧ Inv p (q i ). This implies that a i+1 is feasible from (q i , v i ) in N as well.

Further, observe that since N has no state invariants, the delay ∆ i is feasible. So, the delay transition (q i , v i ) ∆ -→ (q i , v i ) is also feasible in N . Thus, we have shown that each step of the run σ is feasible in N .

Lemma A.3. Each accepting run of N is feasible in N as well.

Proof. Consider an accepting run ρ of N .

(q 0 , v 0 ) From the guards on the action start, we know that v 0 = v 0 . Thus, we have the run (q 0 , v 0 ) ρ -→ (q l , v l ) in N , where q 0 is the initial state of N and v 0 is an initial local valuation. Further, from the definition of N , we know that the action end can only be executed from an accepting state of N . Hence, q l is an accepting state. Since end is a global action, it follows that v l is a synchronized valuation.

∆ 0 --→ (q 0 , v 0 ) a 1 -→ (q 1 , v 1 ) ∆ 1 --→ (q 1 , v 1 ) a 2 -→ • • • ∆ l-1 ---→ (q l-1 , v l-1 ) a l -→ (q l , v l ) ∆ l -→ (q l , v l ) q 0 i p i q i r i t i f i • • • (a) Process A i of network N Initi q 0 i p i q i r i t i f i Finali • • • start xi ≤ 0 end (b) Process A i of network N
Note that if we start with a global-local system N , then the network N in compact form obtained as a result of the transformation is also a global-local system.

B.2. Client-server systems

In this section, we will show that we can convert any client-server system N to a client-server system N in compact form, such that N is accepting iff N is accepting. Note that the technique described in Section B.1 can also be applied to client-server systems; however, in this case, the resultant network in compact form is not a client-server system. We would like to apply our client-server POR technique on the network in the compact form. In order to allow this, we propose here a different transformation that yields a client-server system in compact form.

Let N = {S, C 1 , C 2 , • • • , C k } be a client-server system, where the server process is given by S = (Q s , Σ s , X s , T s , q 0 s , F s , Inv s ) and each client process is of the form C i = (Q i , Σ i , X i , T i , q 0 i , F i , Inv i ). We first give the transformation of the client processes. For each client C i of N , let C i = (Q i , Σ i , X i , T i , q 0 i , F i , Inv i ) be the process obtained by adding

• new states Init i and Final i with no state invariants. Thus, In C i , we have Q i = Q i ∪ {Init i , Final i }, q 0 i = Init i and F i = {Final i }, Inv i (Init i ) ≡ true and Inv i (Final i ) ≡ true.

• new communication actions start i and end i ; Σ i = Σ i ∪ {start i , end i }.

• the following transitions to T i :

-Init i start i ---→ q 0 i . -q end i --→ Final i , for all states q ∈ F i .
The transformation is illustrated in Figure B.2. Next, we give the transfor-

q 0 i p i q i r i t i f i • • • (a) Client C i of network N Initi q 0 i p i q i r i t i f i Finali • • • start i end i (b) Client C i of network N Figure B
.2: Transformation of client-server system into a client-server system in compact form: client processes mation of the server process. Let S = (Q s , Σ s , X s , T s , q 0 s , F s , Inv s ) be the process obtained by adding to the server process S of N

• new states Init s and Final s with no state invariants. Thus, we have Q s = Q s ∪ {Init s , Final s }, q 0 s = Init s and F s = {Final s }, Inv s (Init s ) ≡ true and Inv s (Final s ) ≡ true.

• new communication actions start 1 , start 2 , • • • , start k and end 1 , end 2 , • • • , end k , i.e., Σ s = Σ s ∪ 1≤j≤k {start j , end j }.

• new clocks z 1 , z 2 . Thus, X s = X s ∪ {z 1 , z 2 }.

• the following transitions to T s :

-

Init s start j ---→ z 1 ≤0
Init s , for 1 ≤ j < k.

-

Init s start k ---→ z 1 ≤0
q 0 s .

-

q end 1 ---→ {z 2 }
Final s , for all states q ∈ F .

-Final s

end j ---→ z 2 ≤0
Final s , for 1 < j ≤ k. Further, from definition of N , the only incoming transition to the accepting state F i of A i is labelled by the action end i . Moreover, from the definition of guards of the actions end 1 , • • • , end k in the server process S , it follows that these actions can only be executed consecutively, in 0 time. Hence, any accepting path of N must end with the sequence of communication actions end 1 • • • end k . Therefore, N is a client-server system in compact form, with the sequence of actions end k playing the role of the special action α.

Next, observe that the guards on the corresponding transitions ensure that the start actions can only be executed in 0 time. Similarly, the end actions can only be executed in 0 time from some (q, v), where q is an accepting state. Since the end actions are communication actions that can only be executed in 0 time, it is guaranteed that v is a synchronized valuation. As a consequence, we have Lemma B.2. Lemma B.2. N is accepting iff N is accepting.

Proof. Suppose that N is accepting. This means that there is a run σ of N of the form (q 0 , v 0 ) σ -→ (q l , v l ), where q l is an accepting state of N , v 0 is an initial local valuation and v l is a synchronized valuation. From the definition of N , we know that the following run is feasible in N . Note that we write Init to denote the state (Init s , Init 1 ,• • • , Init k ) and Final to denote the state

(Final s , Final 1 ,• • • , Final k ). (Init, v 0 ) start 1 ---→ start 2 ---→ • • • start k ---→ (q 0 , v 0 ) σ -→ (q l , v l ) end 1 ---→ end 2 ---→ • • • end k ---→ (Final, v l )
Conversely, suppose that N is accepting. We know that any accepting run of N is of the form

(Init, v 0 ) start 1 ---→ start 2 ---→ • • • start k ---→ (q 0 , v 0 ) ρ -→ (q l , v l ) end 1 ---→ end 2 ---→ • • • end k ---→ (Final, v l )
From the guards on the actions start 1 , • • • , start k , we know that no time is elapsed and no clocks are reset between v 0 and v 0 . We have the run (q 0 , v 0 ) ρ -→ (q l , v l ) in N , where q 0 is the initial state and v 0 is an initial local valuation. From the definition of N , we know that • the action end i is only enabled from an accepting state of A i .

• the actions end 1 , • • • , end k are executed in 0 time.

As a consequence, we can conclude that q l is an accepting state. Further, since the actions end 1 , • • • , end k are communication actions that are executed in 0 time, it is guaranteed that v l is a synchronized valuation. Therefore, the run ρ is an accepting run of N .

We remark that if we start with a client-server system N , then the network N in compact form obtained as a result of the transformation is also a client-server system.

We now propose an equivalent condition for global zones in the offset setting using the translation of offset zones to standard zones. Recall the translation of offset zones to standard zones as given in Definition 2.33. From this translation and Lemma C.1, we get the following a LU subsumption check for offset zones: Lemma C.2. Let Z and Z be non-empty offset zones. Then, Z a LU Z if and only if there exist two offset clock variables x and y, such that Z t x ≥ (≤, -U x ) and Z y x < Z y x and Z y x + (<, -L y ) < Z t x Henceforth, we work with this condition over offset zones, rather than the former condition over standard zones.

Next, we show that synchronized zones can be efficiently computed from local time-elapsed zones, as given by the following lemma.

Lemma C.3. Given a local-time elapsed zone Z, the distance graph of sync(Z) in the canonical form, is obtained from the distance graph of Z by the following steps:

• Set the weight of all t i -→ t j edges to (≤, 0)

• Set the weight of all t i -→ x edge to min{G Z t i , x | t i ∈ T } Proof. Let Z be a local-time elapsed zone and let G Z be the canonical distance graph of Z. Since Z is local-time elapsed, we know that all edges of the form x → t for x ∈ X and t ∈ T has weight (<, ∞).

Let Z = Z ∧ t i ,t j ∈T (t i = t j ). Each edge in G Z of the form t i → t j for t i , t j ∈ T has weight (≤ 0). Let Z be the zone obtained by canonicalizing Z . We consider the edges of G Z . Recall that we say a path is lighter than another, if the weight of the former is lesser than the weight of the latter path.

x → t i The lightest path of this form, where x ∈ X to any t i ∈ T is (<, ∞).

Consider a lighter path from x to t. It must be of the form x → • • • → y → t j → • • • → t i . Since the edge y → t j has weight (<, ∞), this path has weight (<, ∞).

t i → t j The lightest path between any two reference clocks t i and t j is (≤, 0). We know that the weight of the edge t i → t j in G Z is (≤, 0). Now, suppose that there is a lighter path in G Z . Since all edges between reference clocks have weight (≤, 0), this path can only be of the form t i → • • • → x → t j . Once again, since each edge x → t j has weight (<, ∞), this path also has weight (<, ∞).

x → y The lightest path between two offset clocks is given by the direct edge between them from G Z .

Space complexity The naive aLU sync subsumption check also uses additional space of the order of O((c + n) 2 ) since we are required to store the distance graphs of sync(Z) and sync(Z ), and in the subsequent step, std(global(sync(Z))) and std(global(sync(Z ))). In contrast, the explicit check given in Lemma C.3 needs only constant space. The only part of the check that requires space involves computing the minimum of weights of all t i -→ x edges in the distance graph of Z, for i ∈ {1, 2, • • • , k} -this computation only requires constant space.

In practice, whenever a new zone Z is visited while exploring the local zone graph, we would need to compute sync(Z) and then the standard zone Z = std(global(sync(Z))) and store the distance graph of these zones, in addition to the distance graph of the local zone. The algorithm would need to store this standard zone Z for every local zone Z that has been seen, and whenever a new zone Z is seen, check if this zone is aLU sync subsumed by some zone that has already been seen. In contrast, if the direct aLU sync check is used, there is no need to store any of this additional information for local zones -this is because any relevant edge weight that is required for subsumption checks can be directly obtained from the distance graphs of the local zones.

Figure 1

 1 Figure 1.1: A timed automaton A. The guard associated with a transition is given under the transition. We write {x} under the transition b to denote that the clock x is reset by b.

Figure 1

 1 Figure 1.3: A timed automaton and its zone graph

Figure 1

 1 Figure 1.4: A network of three (untimed) processes

Figure 1

 1 Figure 1.5: A network A and its zone graph

  Figure 1.6: Diamond property

Figure 2 . 1 :

 21 Figure 2.1: An example of a simple timed automaton A

  and • v B ∼ v B where v B and v B denote the standard valuations restricted to the variables in B = Bounded M (v).

Figure 2 .Figure 2 . 3 :

 223 Figure 2.3 gives the regions for two clocks x and y with M = 2.

Figure 2 . 5 :

 25 Figure 2.5: Distance graph of the zone given in Figure 2.4. All the edges that are not displayed have weight (<, ∞).

Figure 2 . 6 :

 26 Figure 2.6: Distance graph of the offset zone given in page 45. All the edges that are not displayed have weight (<, ∞).

Figure 2 .

 2 Figure 2.7: A timed automaton and its offset zone graph

  Figure 2.8: A network of processes

Forward

  diamond property If a and b are enabled from s, and s a -→ s 1 and s b -→ s 2 are the respective transitions from s, then b is enabled from s 1 and a is enabled from s 2 .Diamond property If either ab or ba is feasible from s, then both ab and ba are feasible from s and moreover, both ab and ba result in the same state. The diamond property is pictorially represented by the diamond structure given in Figure2.10.

Figure 2

 2 Figure 2.10: Diamond due to interleaving of actions a and b

Figure 3

 3 Figure 3.2: Zone graph of A × given in Figure 3.1

Figure 3 . 4 :

 34 Figure 3.4: Local runs of the network A.

  Definition 3.4 (Local steps of a network of timed automata). There are two kinds of local steps in a network N : local delay, and local action. A local

Figure 3 . 5 :

 35 Figure 3.5: Independence in local time semantics

  Suppose that the order of execution times of b i and b i+1 is reversed. Then, dom(b i ) ∩ dom(b i+1 ) = ∅ by the definition of a run. So we can take u = b 1 . . . b i+1 b i . . . b n where the order of b i and b i+1 is reversed. Since u ∼ u , by Lemma 3.5 we have a run (q 0

  ≤cxt p ----→ y with a weak inequality and d 2 over edges x <cxt p ----→ y with a strict inequality. If d 1 ≤ 0 and d 2 < 0, then v + satisfies all the constraints of G Z , so v + ∈ Z. Otherwise, either d 1 = max(d 1 , d 2 ) and d 1 > 0 or d 2 = max(d 1 , d 2 ) and d 2 ≥ 0. In the former case, set d := d 1 . In the latter case, set d := d 2 + ε where ε > 0 is chosen based on a criterion given later in the proof.

Figure 4 . 1 :

 41 Figure 4.1: Local zone graph and global zone graph of a network. If two actions of a given sequence σ reset clocks, then two interleavings of σ with a different ordering of these actions lead to different nodes of the global zone graph (if both of them are feasible.).

Figure 5 . 1 :

 51 Figure5.1: Accepting state is not reachable in the network A 1 , A 2 , but MaxOZG( A 1 , A 2 ) says otherwise.

  Definition 5.6 (Local sync graph). A local sync graph G of a network of timed automata N based on a, is a tree and a subgraph of LZG(N ) satisfying the following conditions: C0 each node of G is labeled either covered or uncovered ; C1 the initial node of LZG(N ) belongs to G and is labeled uncovered; C2 each node of G is reachable from the initial node; C3 for each uncovered node s, all its successor transitions s a --→ s occurring in LZG(N ) should be present in G;C4 for each covered node s ∈ G there is an uncovered node s ∈ G such that s aLU sync s . A covered node has no successors.

  else if ∃ (q , Z ) ∈ Visited s.t. Z aLU sync Z then

  else if sync(Z ) = ∅ then 9: Skip 10: else if ∃ (q , Z ) ∈ Visited s.t. Z aLU sync Z then 11:

Figure 5

 5 Figure 5.3: An example of two nodes in the local sync graph where syncsubsumption does not preserve the set of enabled actions.

  3. In Lemma 6.8, we show that local valuations that are ≈ * -equivalent can mutually simulate each other w.r.t. the local passage of time. Note that we denote by δ --→ p a delay of δ time units in process A p . Lemma 6.8. Let v ≈ * v . For every local delay v δ --→ p u, there exists a δ such that v δ --→ p u where u ≈ * u .

Figure 6 . 4 :

 64 Figure 6.4: The diamond between a and b in LZG is torn apart by two subsumptions in LZG D M

  First, note that the constraints between b 1 , b 2 in G v can take two forms: either 1. b 1 (≤,c) ---→ b 2 and b 2 (≤,-c) ----→ b 1 , or 2. b 1 (<,c) ---→ b 2 and b 2 (<,-c+1) ------→ b 1 . Consider the path b 1 → x 1 • • • x k → b 2 in N . Let the weight of this path be ( , d). If ( , d) is bigger than or equal to weight of the edge b 1 → b 2 of G v , then this sequence can be replaced with the edge b 1 → b 2 to get a shorter negative cycle. If not, ( , d) is strictly less than the weight of b 1 → b 2 : that is, ( , d) < (≤, c) or ( , d) < (<, c) depending on case 1 or case 2 above. This entails that ( , d) plus the weight of the edge b

  Lemma 8.3. (Soundness) If Algorithm 4 returns true, then T has an accepting run.

  Corollary 8.1. (Completeness) If T has a reachable accepting state, then Algorithm 4 returns true.

9

  : return Source Lemma 8.15. The successor relation -→ egl is complete for reachability for transition systems of extended global-local systems.

3 :r

 3 if r = 0 or C r ∈ dom(a) then 4: if S ∈ dom(a) then = i for some C i ∈ dom(a) 8:

3 :

 3 if r = 0 or there is C i ∈ dom(a) with groupid(C i ) = r then 4: if S ∈ dom(a) then 5: , Z , r ) to Source 9: return Source Lemma 8.21. The successor relation -→ ecs is complete for reachability for transition systems of extended client-server systems.

  Figure 8.1: An example that illustrates the effect of Optimization 1 of global-local POR

  Figure 8.2: An example that illustrates the effect of Optimization 2 of global-local POR

  Figure 8.3: An example that illustrates the effect of Optimization 3 of Client-server POR

r

  = i for some C i ∈ dom(a) 10:Add (q , Z , r ) to Succ 11: return Succ Chapter 9

Figure 9

 9 Figure 9.1: A toy model to explain the working of the LSG implementation

Figure 9

 9 Figure 9.3: Parallel model

Type 1 .

 1 Spread bounded global-local model where POR works Type 2. Spread bounded global-local model where POR does not work Type 3. Spread bounded client-server model where POR works Type 4. Spread bounded client-server model where POR does not work Type 5. Models with unbounded spread -so, our methods do not apply

  Figure 9.4: A toy global-local model for which our global-local POR obtains good gains

Figure 9 . 5 :

 95 Figure 9.5: Global zone graph and POR-zone graph (without the zone information) of the instance of model in Figure 9.4 with 2 processes

Figure 9

 9 Figure 9.6: A toy global-local model for which global-local POR does not give gains.

Figure 9

 9 Figure 9.7: Network A

  Figure9.8: Global zone graph and POR-zone graph generated by the PORimplementation with and without Optimization 1, of network A as given in Figure9.7. We have omitted the zone information for all the zone graphs.

Figure 9

 9 Figure 9.9: A toy client-server model for which our client-server POR gives good gains

Figure 9 .

 9 Figure 9.10: Global zone graph and POR-zone graph (without the zone information) of the instance of model in Figure 9.9 with 2 clients.

Figure 9

 9 Figure 9.11: A toy client-server model A for which our client-server POR does not give any gains

  Figure 9.13: Standard Fire-alarm model

Figure 9

 9 Figure 9.14: Fire-alarm global-local model

  Figure 9.15: Fischer standard model

  Figure 9.16: Fischer global-local model

  Figure9.17: WCET Model

Figure 9 .

 9 Figure 9.18: WCET Model

Figure 9

 9 Figure 9.19: Fischer client-server model

Figure 9 .

 9 Figure 9.20: Dining Philosophers model

  investigated in Dams et al. [DGKK98] and Hansen et al.[HLL + 14]. We think further exploration along these lines might prove useful.

  Figure A.1: Transformation of a network to a network without state invariants

Figure B. 1 :

 1 Figure B.1: Transformation of global-local system into a global-local system in compact form

  Figure B.3: Transformation of client-server system into a client-server system in compact form: server process The transformation described above is illustrated in Figure B.3. Let N be the network {S, C 1 , C 2 , • • • , C k }.It is clear that the initial state and accepting states of processes in N do not have state invariants. Further, from definition of N , the only incoming transition to the accepting state F i of A i is labelled by the action end i . Moreover, from the definition of guards of the actions end 1 , • • • , end k in the server process S , it follows that these actions can only be executed consecutively, in 0 time. Hence, any accepting path of N must end with the sequence of communication actions end 1 • • • end k . Therefore, N is a client-server system in compact form, with the sequence of actions end k playing the role of the special action α.Next, observe that the guards on the corresponding transitions ensure that the start actions can only be executed in 0 time. Similarly, the end

  goal of this section is to introduce local zones, a concept similar to zones, but for local time semantics. The specificity of local time semantics is local time elapse. So a natural first attempt to do this is to use the representation which was used for standard zones (see Section 2.5), and implement local time elapse as an operation on zones. A zone in such a standard representation is defined by constraints y 1 -y 2 c where c ∈ Z and y 1 , y 2 ∈ X ∪ {t 1 , . . . t k }. A prerequisite for being able to use a representation of zones for the symbolic reachability checking algorithm based on local time semantics is that it should be closed under the operations of local time semantics that were discussed in Chapter 3, namely guard intersection, reset and local time elapse. In Lemma 4.1, we show that the standard representation of zones is not closed under local time elapse operation.Lemma 4.1. In the standard representation of sets of local valuations, there is a zone Z such that the set of all valuations reachable by local time elapse from Z is not a zone.

  Consider a state q, a sequence of actions u and a time elapsed global zone Z. Consider the local zone Z = local-elapse(local(Z)).

	Theorem 4.2.

} Lemma 4.9. For each global zone Z and local zone Z: sync(Z) and local(Z) are local zones and global(sync(Z)) is a global zone.

Proof. sync(Z) is the local zone Z ∧ i,j (t i = t j ); local(Z) is the local zone obtained by replacing t with some t i in each constraint, and adding the constraints i,j (t i = t j ); global(sync(Z)) is obtained by replacing each t i with t in each constraint of sync(Z).

  accepting then return true 3: while Waiting = ∅ do

	4: 5:	s = pop(Waiting) for all s s.t s a -→ s do
	6:	if s is accepting then
	7:	return true
	8:	else if ∃ s ∈ Visited s.t. s	s then
	9:	Skip
	10:	else
	11:	for s ∈ Visited do
	12:	if s	s then
	13:

  From Lemma 8.3 and Corollary 8.1, we have Theorem 8.1, that gives the correctness of Algorithm 4. Theorem 8.1. Algorithm 4 returns true if and only if T has a reachable accepting state.

  Table 9.1.

	Models		Global ZG			Local SG
	(# processes)	visited	stored	time visited stored	time
	2	7	7	0.033	6	6 0.030
	3	18	18 0.078s	10	10 0.049s
	4	67	67 0.283s	18	18 0.322s
	5	328	328 1.360s	34	34 0.203s
	8	109,603 109,603 5m19s	258	258 2.267s

Table 9 .

 9 1: Experimental results for the toy model given in Figure9.1. The table gives the statistics of the global zone graph and the local sync graph with different number of processes.Remark. Observe that we have two global actions from the state B of each component, namely b with a lower bound guard, and c with an upper bound guard. The purpose of these two actions is to force the a LU subsumption to differentiate between the zone reached by the different interleavings of local actions a 1 and a 2 . Had there been only one global action, when using the a LU subsumption, one zone gets subsumed by the other zone since there is no active lower bound (or upper bound) from the resultant state. We remark that if we use a M -subsumption while computing the global zone graph, we do not need the two global actions b and c in the model to differentiate the zones Z 1 and Z 2 .

Table 9 .

 9 2: Experimental results obtained by running UPPAAL and our prototype TChecker (Global ZG and Local ZG) on a MacBook Pro 2013 with 4 2.4GHz Intel Core i5 and 16 GB of memory. The timeout is 90 seconds.

	Models	UPPAAL	Global ZG		Local ZG
	(# processes)	visited stored	sec. visited stored sec. visited stored	sec.
	CorSSO 3	64378 61948	1.48 64378 61948 1.41	1962	1962	0.05
	CorSSO 4	timeout	timeout	23784	23784	0.69
	CorSSO 5	timeout	timeout	281982 281982 16.71
	Critical reg. 4	78049 53697	1.45 75804 53697 2.27	44490	28400	2.40
	Critical reg. 5	timeout	timeout	709908 389614 75.55
	Dining Phi. 7	38179 38179 34.61 38179 38179 7.28	2627	2627	0.32
	Dining Phi. 8	timeout	timeout	8090	8090	1.65
	Dining Phi. 9	timeout	timeout	24914	24914	7.10
	Dining Phi. 10	timeout	timeout	76725	76725 30.20
	Parallel 6	11743 11743	4.82 11743 11743 1.09	256	256	0.02
	Parallel 7	timeout	timeout	576	576	0.04
	Parallel 8	timeout	timeout	1280	1280	0.11

  toy global-local model for which our global-local POR obtains good gains

	Models		Global ZG		Local sync graph	POR-zone graph
	(# processes) visited stored	time visited stored	time visited stored	time
	2	17	17	0.078	17	17	0.077	8	8 0.040
	3	65	65	0.319	65	65	0.349	11	11 0.044s
	4	257	257	1.745s	257	257	2.295s	14	14 0.062s
	5	1,025	1,025 10.264s	1,025	1,025 10.159s	17	17 0.091s
	8	65,537 65,537 14m51s 65,537 65,537 14m52s	26	26 0.113s

Table 9

 9

	.3: Experimental results for the toy global-local model with different
	number of processes. Experiments for models with up to 4 processes were
	run with default values of parameters. For the model more than 4 processes,
	the computation of global zone graphs and local sync graphs were done
	with values of parameters set to block-size = 100, 000, 000 and table-size
	= 65, 536, 000.

Table 9 .

 9 4: Experimental results obtained by running prototype TChecker on the toy global-local model given in Figure9.6. Experiments for models of up to 4 processes were run with default values of parameters. For the model with 8 processes, experiments were done with values of parameters set to block-size = 100, 000, 000 and table-size = 65, 536, 000. Table9.4 presents the results of experiments on instances of the model in Figure

Table 9 .

 9 6: Experimental results for the toy client-server model given in Figure

Table 9 .

 9 7 presents the result of experiments on instances of the Fire-alarm global-local model with different number of processes.9.4.2 Type 2: Global-local model where POR does not workIn this section, we focus on the global-local variants of some benchmark models, for which our global-local POR does not perform well. We consider one such model, the Fischer global-local model, and analyse the performance of POR-implementation on this model in detail. The standard Fischer model has n processes A 1 , . . . , A n and a common variable id, that is stored in a separate process.

	Fischer global-local model
	Standard Fischer model.

Table 9

 9 .7: Experimental results obtained by running prototype TChecker on the Fire-alarm global-local model for different number of processes. Experiments for models of up to 5 processes were run with default values of parameters. For the model with more than 5 processes, experiments were done with values of parameters set to block-size = 100, 000, 000 and table-size = 65, 536, 000.

  ,877 47,084,877 > 1,027m29s 29,648,493 29,648,493 > 472m31s 3,608,470 2,204,254 200m49.445sTable9.9: Experimental results for the WCET model given in Figure9.17 for different number of clients. Experiments were done with values of parameters set to block-size = 100, 000, 000 and table-size = 65, 536, 000.

	Models		Global ZG			Local SG			POR-zone graph
	(# clients)	visited	stored	time	visited	stored	time	visited	stored	time
	1	138	138	2.260s	138	138	2.339s	113	101	2.287s
	2	9,379	9,379	1m5.354s	8,803	8,803	53.081s	6260	4520	1m5.344s
	3	647,338	647,338	95m19.460s	524,650	524,650 81m31.305s	168,463	114,319	11m4.878s
	4	47,084

Preliminaries

Local time semantics

Acknowledgements

s0, s0, I s1, s0, I s0, s1, I s2, s0, I s1, s1, I s0, s2, I s3, s0, I s2, s1, I s1, s2, I s0, s3, I s4, s0, I s3, s1, I s2, s2, I s1, s3, I s0, s4, I s5, s0, I s4, s1, I s3, s2, I s2, s3, I s1, s4, I s0, s5, I s5, s1, I s4, s2, I s3, s3, I s2, s4, I s1, s5, I s5, s2, I s4, s3, I s3, s4, I s2, s5, I s5, s3, I s4, s4, I s3, s5, I s5, s4, I s4, s5, I s5, s5, I a1 a2 b1 a2 a1 b2 d1 a2 b1 b2 a1 d2 e1 a2 d1 b2 b1 d2 a1 e2 c1 a2 e1 b2 d1 d2 b1 e2 d1 e2 a2 c1 b2 e1 d2 d1 e2 b1 c2 a1 b2 c1 d2 e1 e2 d1 c2 b1 d2 c1 e2 e1 c2 d1 e2 c1 c2 e1 c2 c1

(a) Global zone graph s0, s0, I , 0 s5, s5, I , 0 s1, s0, I , 1 s2, s0, I , 1 s3, s0, I , 1 s4, s0, I , 1 s5, s0, I , 0 s5, s1, I , 2 s5, s2, I , 2 s5, s3, I , 2 s5, s4, I , 2 s0, s1, I , 2 s0, s2, I , 2 s0, s3, I , 2 s0, s4, I , 2 s0, s5, I , 0 s1, s0, I , 1 s2, s0, I , 1 s3, s0, I , 1 s4, s0, I , 1 a1 a2 b1 b2 d1 d2 e1 e2 c1 c2 a2 a1 b2

Finally, consider an unbounded variable x ∈ N with M x = -∞. Again, the only edges in G v involving x are of the form y → x with y ∈ Bounded(v).

The weight of y → x equals the path y → t p (≤,0) ---→ x. Replacing the edge with this path still gives a negative cycle. Now, note that in zone Z , every valuation satisfies x -t p ≤ 0. Therefore the weight Z tpx ≤ (≤, 0) and replacing t p (≤,0) ---→ x with the edge t p ( ,Z tpx ) -----→ x also gives a negative cycle. The original N had an outgoing edge x → x 1 coming from Z . Since Z is canonical, the edges t p → x → x 1 can be replaced with t p → x 1 with weight coming from Z . This eliminates x from N .

These observations reduce the negative cycle to the form required by the lemma.

We will now try to compute the least value of [v] M * yx for v ∈ Z. Note that for v ∈ Z such that v(t q -y) > M y , the value of [v] M * yx is (<, ∞) by Lemma 6.16. So, for these valuations, the inequality 2 never holds. Therefore, we first look at valuations in Z ∩ (t q -y ≤ M y ). We consider two cases, depending on whether x is bounded. We say that a valuation v is x-bounded if x ∈ Bounded(v); otherwise, we say that v is x-unbounded. Lemma 6.17. When Z∩(t q -y ≤ M y ) is non-empty and has only x-bounded valuations, the least value of [v] M * yx for v ∈ Z is given by -Z xy .

Proof. Let G 1 be the distance graph obtained from G Z by replacing the weight of the edge y → t q with min(Z ytq , (≤, M y )). The set [[G 1 ]] equals Z ∩ (t q -y ≤ M y ) and contains only x-bounded valuations by assumption. From Lemma 6.16, we know that the value of [v] M * yx for v ∈ [[G 1 ]] is given by (≤, v(x -y)) . To find the least value of this quantity, we need the largest value of v(y -x) among valuations in [[G 1 ]]. This value can be inferred from the weight ( 1 , w 1 ) of the shortest path from x to y in G 1 .

Here, the inequality 1 could be a weak inequality ( 1 =≤) or a strong inequality ( 1 =<). When the inequality is weak, this means that for all v ∈ [[G 1 ]], we have v(y -x) ≤ w 1 . This implies that for all v ∈ [[G 1 ]], we have v(x -y) ≥ -w 1 . In this case, the least value of (≤, v(x -y)) is given by (≤, -w 1 ), which is equal to -Z xy according to Definition 6.12.

For the case of strong inequality, the situation is slightly more complicated. In this case, we know that for all v ∈ [[G 1 ]], v(y -x) < w 1 . This implies that for all v ∈ [[G 1 ]], we have v(x -y) > -w 1 . This means that for all v ∈ [[G 1 ]], we have v(x -y) ≥ -w 1 + ε, for some ε < 1. In this case, the least value of (≤, v(x -y)) is equal to (≤, -w 1 + ε ), which is given by (≤, -w 1 + 1). This is again equal to -Z xy , as per Definition 6.12.

Observe that the shortest path from x to y in G Z also has weight ( 1 , w 1 ). The differences between G 1 and G Z are only due to the modification of the weight of the edge y → t p . But a shortest weight path from x to y cannot 6.4. Testing Z ⊆ a * M (Z ) 137 take the edge y → t p as this would produce a path in which y appears twice.

Hence ( 1 , w 1 ) = Z xy and the lemma follows.

Lemma 6.18. Assume that M x = -∞. When Z ∩ (t q -y ≤ M y ) is nonempty and has only x-unbounded valuations, the least value of [v] M * yx from v ∈ Z is given by (<, -M x ) + -Z tpy .

Proof. The proof proceeds as in Lemma 6.17, with the change that now, by Lemma 6.16, the value of [v] M * yx is given by (≤, v(t p -y)) + (<, -M x ). We need the least value of v(t p -y) and hence the greatest value of v(y -t p ). As in the proof of Lemma 6.17, consider the graph G 1 obtained by replacing the weight of the edge y → t q by min(Z ytq , (≤, M y )) in G Z . The shortest path from t p to y is given by Z tpy and hence the least value of

yx is given by:

Proof. We will find the least value β 1 among x-bounded valuations and the least value β 2 among x-unbounded valuations and then take min(β 1 , β 2 ). To find β 1 , consider the graph G 1 obtained from G Z by modifying the weight of edges y → t q to min(Z ytq , (≤, M y )) and x → t p to min(Z xtp , (≤ , M x )). The set [[G 1 ]] gives the set of x-bounded valuations in Z∩(t q -y ≤ M y ). This set is non-empty by the assumption made in the lemma. Among these valuations, [v] M * yx is given by (≤, v(x -y)) . We now proceed as in the proof of Lemma 6.17 to find the shortest path from x to y in G 1 . The newly added edge x → t p could influence this, and we get the shortest path to be min(Z xy , (≤, M x ) + Z tpy ). Hence:

To find β 2 , consider the graph G 2 obtained from G Z by modifying edge y → t q to min(Z ytq , (≤, M y )) and t p → x to min(Z tpx , (<, -M x )). The set [[G 2 ]] gives the set of x-unbounded valuations in Z∩(t q -y ≤ M y ). Again, this set is non-empty by the assumption made in the lemma. For these valuations, from Lemma 6.16, we know that [v] M * yx is given by v(t p -y) + (<, -M x ). We now proceed as in the proof of Lemma 6.18 to find the shortest path from t p to y in G 2 . This is given by min(Z tpy , (<, -M x ) + Z xy ). Observe that (<, M x ) -Z xy = (<, M x ) -Z xy + (<, 1). Hence:

We want to get β 1 and β 2 in terms of the same cases so that we can find the minimum.

When Z xy ≤ (≤, M x ) + Z tpy , we get Z xy + (<, -M x ) ≤ (<, 0) + Z tpy by adding (<, -M x ) on both sides. This implies that Z xy + (<, -M x ) ≤ Z tpy . Hence in this case min(β 1 , β 2 ) is given by -Z xy .

When Z xy > (≤, M x ) + Z tpy , there is a corner situation when still Z tpy ≥ (<, -M x ) + Z xy and otherwise Z tpy < (<, M x ) + Z tpy . In the latter case, min(β 1 , β 2 ) is given by -Z tpy + (<, -M x ). It remains to resolve the former case. This happens when

) is given by β 1 . This proves the lemma.

yx among valuations in Z is given by:

This gives the first case in the lemma. Otherwise, Lemmas 6.17, 6.18 and 6.19 give this value based on whether Z ∩ (t q -y ≤ M y ) contains only x-bounded, only x-unbounded or both kinds of valuations, respectively. In each of the cases, we can show that the value is given by the maximum of the two quantities required by the lemma. Let G be the distance graph obtained by taking G Z and modifying the weight of the y → t q edge to min(Z ytq , (≤, M y )). The set of valuations [[G ]] is Z ∩ (t q -y ≤ M y ), which is non-empty in our case.

Suppose that [[G ]] contains only x-bounded valuations, Lemma 6.17 gives the least value of [v] M * yx to be -Z xy . Since every valuation in [[G ]] is xbounded, G entails t p -x ≤ M x and the shortest path from x to t p is at most (≤, M x ) -let us call this path G xtp . We then have G xtp ≤ (≤, M x ). Now, consider the shortest path from x to y in G . Call it G xy . By property of distance graphs, we have G xy ≤ G xtp +G tpy . The paths leading to y do not get affected by the addition of y → t q to G Z . Hence G xy = Z xy and G tpy = Z tpy . This gives

When [[G ]] contains only x-unbounded valuations, Lemma 6.18 gives the least value of [v] M * yx to be (<, -M x ) + -Z tpy . Since every valuation in [[G ]] in x-unbounded, we have the shortest path G tpx ≤ (<, -M x ). Note that G tpy ≤ G tpx +G xy . From the same argument as in the case for only x-bounded valuations, we have that Z tpy ≤ (<, -M x ) + Z xy . Adding (<, M x ) to both sides, we get (<, M x ) + Z tpy ≤ Z xy , which implies that (<, -M x ) -Z tpy ≥ -Z xy . Hence, (<, -M x ) + -Z tpy = max( -Z xy , (<, -M x ) + -Z tpy ).

When [[G ]] contains both x-bounded and x-unbounded valuations, Lemma 6.19 gives two cases. When Z xy ≤ (≤, M x ) + Z tpy , the least value of [v] M * yx 6.4. Testing Z ⊆ a * M (Z ) 139 is -Z xy . This is equal to max( -Z xy , (<, -M x ) + -Z tpy ) by the same argument as in the only x-bounded case. When Z xy > (≤, M x ) + Z tpy , the least value of [v] M * yx is (<, -M x ) + -Z tpy . Now, since Z xy > (≤, M x ) + Z tpy , it is clear that Z xy > (<, M x ) + Z tpy , where we have changed (≤, M x ) to (<, M x ). We then have that (<, -M x ) + -Z tpy = max( -Z xy , (< , -M x ) + -Z tpy ). Theorem 6.2. Let Z, Z be non-empty zones. Then, Z ⊆ a * M (Z ) iff there exist two variables x, y such that Z tqy ≥ (≤, -M y ) and Z xy < Z xy and Z xy + (<, -M x ) < Z tpy where t p , t q are reference clocks and x ∈ X p ∪ {t p } and y ∈ X q ∪ {t q }, respectively.

Proof. (⇒): Suppose that Z ⊆ a * M (Z ). Then, there exists v ∈ Z such that [v] M * ∩ Z = ∅. By Proposition 6.2, this means there are two variables x, y with y ∈ Bounded(v) and M x = -∞ such that [v] M * yx + Z xy < (≤, 0). Hence the valuation in Z with the least value of [v] M * yx satisfies this constraint. Proposition 6.3 gives this least value. Plugging this value to this constraint and noting that ( , -d) + ( , d ) < (≤, 0) iff ( , d ) < ( , d) gives the right hand side of the theorem.

(⇐): When the three conditions in the right hand side of the theorem hold, then the valuation v with the least value of [v] M * yx as given by Proposition 6.3 satisfies [v] M * yx + Z xy < (≤, 0). This implies that [v] M * ∩ Z = ∅ and hence Z ⊆ a * M (Z ).

Observe that the variables x, y in the check in Theorem 6.2 can denote the reference clocks t p , t q also respectively. In that case, M x = ∞, M y = ∞ respectively. We now propose a simplified version of the test in Theorem 6.2 that deals with the cases where x and y are reference clocks separately. Corollary 6.2. Let Z, Z be non-empty zones. Then, Z ⊆ a * M (Z ) iff there exist two variables x ∈ X p ∪ {t p }, y ∈ X q ∪ {t q } such that

This is modelled by a reset in all the incoming actions to the state, followed by a lower bound guard of the form x ≥ k on all the outgoing actions. We give an example of a wait state in Figure 7.2. We refer to the maximum constant associated to an outgoing action from a wait state as the wait time of the state. We now show that in client-server systems where the only timing restrictions come from wait states are spread-bounded.

Lemma 7.6. Let N be a client-server system such that all the timing constraints in each process of N are associated to wait states, and these wait states are not part of any cycle in the respective process. Then N is spread-bounded, with a bound N • W on the spread, where N is the maximum number of wait states in a process of N , and W is an upper bound on the wait time associated to a wait state in N .

Proof. Consider a run of N . From this run, we can remove any delay that is not executed from a wait state, since the value of a clock is checked only from a wait state.

In the run thus obtained, observe that the value of any reference clock t i is such that 0 ≤ v(t i ) ≤ N • W . This implies that the value of the spread at any point in the run is bounded by N • W .

Deciding 0-spread is Pspace-complete

In this section, we examine how hard it is to detect if a system is 0-spread. We show that the problem of deciding whether a given network of timed automata is 0-spread is Pspace-complete. As in the rest of the document, we assume that the given network of timed automata is deterministic: that is, the underlying finite automaton of each component is deterministic.

Let L g (A) be the set of all action sequences u such that there exists a local run (q 0 , v 0 ) u -→ (q, v) where all the valuations are synchronized. In other words, u is a 0-spread run. This also gives a run in the standard global semantics of timed automata. Note that L g (A) is prefix-closed.

A regular language L over a finite alphabet and an independence relation is trace closed if for every word u ∈ L, all words obtained from u by commuting independent actions (for a definition of independent actions, see Definition 2.48) are also in L.

Proof. Take a run (q 0 , v 0 ) u -→ (q, v) passing only through synchronized valuations. From Lemma 3.5, for every w ∼ u, automaton A has a local run (q 0 , v 0 ) w -→ (q, v). If A is 0-spread-bounded, then w can be converted to a 0-spread run. Hence w ∈ L g (A).

If A is not 0-spread-bounded, there exists a local run (q 0 , v 0 ) u -→ (q, v) which cannot be realized with synchronized valuations. Since the network A is deterministic, every run on u has to pass through the same sequence of states as in the local run (q 0 , v 0 ) u -→ (q, v). Hence there can be no other run on u passing through only synchronized valuations. This gives u / ∈ L g (A), and proves the backward direction.

The following lemma is a general observation about regular languages equipped with an independence relation.

Lemma 7.8. If a language L is not trace closed then there are, possibly empty, words u, v and two independent letters a, b such that ubav ∈ L and uabv ∈ L.

Proof. Suppose it it not the case. Consider two trace equivalent words w 1 ∼ w 2 with w 1 ∈ L. By definition of trace equivalence, w 2 is obtained from w 1 by some finite number of permutations of adjacent independent letters. By our assumption w 2 ∈ L. This implies L is trace closed, a contradiction. Lemma 7.9. A language of a deterministic automaton is not trace closed if there are two independent letters a, b, and a reachable state q such that q ab -→ q 1 , q ba -→ q 2 with L(q 1 ) = L(q 2 ).

Proof. Let us take u, v and a, b as in Lemma 7.8. The state q is the state reached on u. Then, v is accepted from q 1 but not from q 2 . The region graph of the network A contains nodes of the form (q, r) where q is a state and r is a (standard) region (see Section 2.3). There is an edge (q, r) a -→ (q , r ) if there exists v ∈ r and (global) delay ∆ ∈ R ≥0 such that (q, v) ∆,a --→ (q , v ) with v ∈ r . Let R(A) be the region graph of A seen as an automaton with all states marked accepting. Note that if some action a is not enabled from a node (q, r), then there is no transition on a from state (q, r) of R(A). Therefore R(A) is an incomplete DFA. It can be completed by adding a single sink state.

Lemma 7.10. L g (A) is accepted by DFA R(A). The size of R(A) is singly exponential in the size of A, the transitions from a given state can be computed in Ptime.

Proposition 7.1. Checking if a network is 0-spread-bounded can be done in Pspace.

Proof. A network A is not 0-spread-bounded iff L g (A) is not trace closed (Lemma 7.7). Consider a deterministic finite automaton R(A) recognizing L g (A) (Lemma 7.10). So, A is not 0-spread if there exist a, b and q as in Lemma 7.9. Observe that testing L(q 1 ) = L(q 2 ) can be done in Pspace as R(A) is of exponential size and the successor relation can be computed in Corollary 8.2. Suppose that T = S, Σ, s 0 , -→, F is a transition system, and -→ r ⊂ -→ that is reachability-complete for T . For T r the reduced transition system induced by -→ r : T r has an accepting run if and only if T has an accepting run.

Implementation of partial order reduction in TChecker

In this section, we explain the implementation of partial order reduction in TChecker. We consider two kinds of networks of timed automata, referred to as global-local systems and client-server systems, and propose two respective variants of the implementation -global-local POR (Section 8.3) and clientserver POR (Section 8.4).

Recall that the standard reachability algorithm (Algorithm 4) takes a transition system T = S, Σ, s 0 , -→, F and solves the reachability problem on T . We have also remarked that if we are only interested in reachability, then we could take a smaller successor relation -→ r and explore the reduced transition system T r provided it is reachability-complete. The difficulty is to find -→ r without completely exploring T in advance. We are interested in the local zone graph (LZG) of a network of timed automata. We will use the structure of this transition system to compute -→ r on the fly. But we cannot do this directly. For this purpose, we store some additional information in the nodes of LZG, which helps in computing the subset of actions that are to be explored from that node in the restricted transition system that we want to obtain. This augmented LZG is referred to as the POR-zone graph, denoted by POR -LZG. Thus, POR -LZG can be viewed as LZG, with each node augmented with some additional information. Further, the transition system POR -LZG r can be viewed as the part of POR -LZG (and therefore the LZG) that can be reached using actions in -→ r from the initial node of the POR -LZG.

We now describe the POR-zone graph in detail. Let N be a network of timed automata and let LZG(N ) be the local zone graph of N . As seen earlier in Section 4.3, the nodes of LZG(N ) are of the form (q, Z) where q is a state of N and Z is a local zone. The POR-zone graph of N , denoted as POR -LZG(N ), is a transition system whose nodes are nodes of LZG(N ) annotated by an additional parameter called the rank of that node, which helps in deciding the set of successors to be explored from that node. Thus, a node of POR -LZG(N ) is of the form (q, Z, r) where (q, Z) is a node of LZG(N ) and r ∈ {0, . . . , n}, where n is the number of processes in the network N . The transition relation of POR -LZG(N ) is defined as follows: if (q, Z) a -→ (q , Z ) in LZG(N ), and (q, Z, r) is a node of POR -LZG(N ), then (q, Z, r) a -→ (q , Z , r ), where r ∈ {0, . . . , n}. In the sequel we will choose particular values of r , but this will depend on the method that we will use. Lemma 8.9. If a node (q, Z, r) is in the list Waiting of Algorithm 5, then N has a local run (q 0 , v 0 ) to (q, v), for some valuation v ∈ Z.

Proof. We will prove that the following statement is a loop invariant of Algorithm 5: If a node (q, Z, r) is in the list Waiting of Algorithm 5, then (q, Z, r) is reachable in POR -LZG r (N ). Then, using the soundness of POR -LZG r (N ) as given by Lemma 8.7, we can conclude that there is a local run in N of the form (q 0 , v 0 ) -→ (q, v), for some v ∈ Z. The proof of the loop invariant follows as in the proof of Lemma 8.2 with POR -LZG r (N ) as the transition system.

The proofs of soundness (Lemma 8.10) and completeness of (Lemma 8.11) of Algorithm 5 follow similarly to the proofs of Lemma 8.3 and Corollary 8.1, that respectively gives the soundness and completeness of the standard reachability algorithm, Algorithm 4. Remark. When we write reachable in Lemma 8.11, we mean "reachable with a synchronized valuation". However, recall that we consider timed automata without state invariants and time-elapsed zones. This means that every reachable local zone contains a synchronized valuation.

Using Lemma 8.10 and Lemma 8.11, we can now state Theorem 8.2.

Theorem 8.2. Let N be a network of timed automata. Suppose that -→ r is complete for reachability for POR -LZG(N ). Suppose that Next is determined by -→ r , and is a simulation relation w.r.t. -→ r . Algorithm 5 returns true if and only if an accepting state is reachable in POR -LZG r (N ).

Proof. Lemma 8.10 gives us the forward direction of the theorem that says that if Algorithm 5 returns true, then N has a reachable accepting state.

The reverse direction is given by Lemma 8.8 and Corollary 8.11.

In Section 8.3 and Section 8.4, we will propose Next functions and relations for different kinds of networks of timed automata. We will use the above theorem to show that the instance of Algorithm 5 is correct for those functions.

in POR -LZG(N ), where b is the first action of the server in the sequence. Such an action b must exist as, by our assumption on extended client-server systems, the final state can be reached only with a communication action. Hence, all actions in σ are actions not involving the server.

If b is a local action of the server, all actions in σ commute with b. By Lemma 8.6 the following is also a path in POR -LZG(N ):

By the induction assumption we have a path (q 1 , Z 1 , 0) σρ -→ cs (q 3 , Z 3 , r 3 ). We have also (q 0 , Z 0 , 0) b -→ cs (q 1 , Z 1 , 0) by the definition of -→ cs . This gives us a path in POR -LZG ecs (N ).

The other case is when b is a communication action with clients of groupid = r. In this case, we split σ into two subsequences: σ 1 consisting of actions of client with groupid = r, and σ 2 consisting of actions of other clients. All actions of σ 2 commute with b. By Lemma 8.6 the following is also a path in POR -LZG(N ):

By the induction assumption we have (q 1 , Z 1 , 0)

From the definition of -→ cs we get (q 0 , Z 0 , 0)

This gives us an execution of the desired form.

For the node covering relation, we use the same relation cs as for clientserver systems (Definition 8.10). The proof of the lemma is practically the same as that of Lemma 8.19. Lemma 8.22.

is a simulation relation for POR -LZG(N ), if N is an extended client-server system.

Thanks to Lemma 8.21 and Lemma 8.22, we can use Theorem 8.2 to get a reachability algorithm for extended client-server systems.

Lemma 8.23. Algorithm 5 using Next ecs and cs solves the reachability problem for extended client-server systems.

Optimizations for POR reachability algorithm

In this section, we study some properties of global-local and client-server systems and use these properties to propose some optimizations for the respective POR implementations, namely global-local POR and client-server Appendix A

Models with state invariants

In this section, we show that the scope of our techniques can be extended to the more generic setting of networks of timed automata with state invariants. Introduced by Henzinger et al. [START_REF] Henzinger | Symbolic model checking for real-time systems[END_REF], a timed automaton with state invariants is one where each state of the automaton is associated to a set of constraints of the form x ∼ c, where x ∈ X is a clock of the automaton, c is a non-negative integer and ∼ ∈ {≤, <, =, ≥, >}. We show that we can convert any network of timed automata with state invariants to a network of timed automata without state invariants, such that the networks are equivalent w.r.t. local time reachability.

A.1. Definitions

In this section, we will present some basic definitions for networks of timed automata with state invariants. Recall that Φ(X) is the set of clock constraints over the set of clocks X, where each clock constraint is of the form x ∼ c, where x ∈ X, c ∈ N, and ∼∈ {<, ≤, =, ≥, >}. We use ≺ to denote either < or ≤, and to denote either > or ≥.

Definition A.1 (Timed automaton with state invariants). A timed automaton with state invariants, A, is given by a tuple (Q, Σ, X, T, q 0 , F, Inv), where Q is a finite set of states, X is a (finite) set of clocks, Σ is a finite alphabet of actions, q 0 ∈ Q is the initial state, F ⊆ Q is the set of accepting states. T is a finite set of transitions of the form (q, g, a, R, q ) where q ∈ Q is the source state, q ∈ Q is the target state, g ∈ Φ(X) is a clock constraint over X, R ⊆ X is the set of clocks reset, and a ∈ Σ. Finally, Inv : Q → 2 Φ(X) associates an invariant from Φ X to states from Q.

Remark. Note that we do not consider invariants of the form x -y ∼ c. While invariants of the form x -y ∼ c can be eliminated using the techniques discussed in this section, the resultant network would contain diagonal constraints (see remark in page 23), which is not in the purview of this thesis.

We work with networks

) is a timed automaton with state invariants. We also do not allow shared clocks in our networks, i.e., X i ∩ X j = ∅, for all i, j ∈ Proc.

We now define local time semantics for networks of timed automata with invariants. Recall that in local time semantics, we have the notion of a local delay. A local delay δ ∈ R ≥0 in process p ∈ P roc is a step (q, v) p,δ --→ (q, v + p δ). For a sequence of local delays ∆ = (p 1 , δ 1 ) . . . (p n , δ n ) we will write (q, v) ∆ -→ (q, v ) to mean (q, v)

----→ (q, v ). We write q(p) to denote the location of process A p in the state q of N . In other words, if the state q is a tuple of the form (q 1 , • • • , q n ), then q(p) = q p . There are two kinds of local steps in a network N : local delay, and local action.

, and v |= p∈Proc Inv p (q(p));

• Local action: For an action b, we have a step (q, v) b -→ (q , v ) if for each p ∈ dom(b) the unique b transition of the process A p is T p (b) = (q(p), g p , R p , q (p)), and the following hold:

start times are synchronized: v(t p 1 ) = v(t p 2 ), for each p 1 , p 2 ∈ dom(b);

guards are satisfied: v g p , for each p ∈ dom(b);

invariants are satisfied: v |= Inv p (q (p)), for each p ∈ Proc;

other processes do not move: q(p) = q (p), for each p ∈ dom(b).

A run in the local time semantics is a sequence of local steps:

where v 0 is an initial local valuation. Note that the valuations on a local run may not be synchronized. We make the standard assumption that v 0 |= p∈Proc Inv p (q 0 (p)).

A.2. Elimination of invariants

We now show that we can convert any network of timed automata to a network of timed automata without invariants, such that both the networks are equivalent w.r.t. reachability. We do this via a sequence of transformations, each of which eliminates some invariants from the network, while preserving the reachability properties of the network.

A.2.1 Initial and accepting states

In Section B, we show that we can transform any network of timed automata N into a network in compact form N (see Appendix B), such that the reachability properties are preserved. Observe that the initial state and accepting states of each process of N does not have state invariants. Therefore, without loss of generality, we can assume that the initial state and accepting states of each process of the given network does not have state invariants.

A.2.2 Restriction to upper-bound invariants

We will now show that we can eliminate invariants of the form x c from any network of timed automata. We define the size of a timed automaton as the sum of number of states and the total information associated to transitions. Concretely, the size of a timed automaton A is defined as the

A are the set of states, transitions and clocks of A and g max is the maximum number of atomic constraints in the guard of a transition in A.

Lemma A.1. For every network of timed automata Proof. Observe that lower-bound invariants (invariants of the form x c) satisfy the property that once such an invariant is true, it remains true under time-elapse. So, it is sufficient to check the satisfaction of such invariants for the valuation with which the state is reached. We propose a transformation to convert a timed automaton into a timed automaton without lower-bound invariants. Let A be a timed automaton by O(T N • |X|), where T N is the number of transitions in N (and N ) and

Thus, without loss of generality, we can assume that the given network of timed automata is such that for each process of the network • all invariants are of the form x ≺ c.

• initial state and accepting states do not have state invariants.

Next, we present a transformation that eliminates upper-bound constraints from a given network of the aforementioned form, such that the new network is accepting iff the original network is accepting.

A.2.3 Elimination of upper-bound invariants

We consider a network

Recall that Inv i associates an invariant from Φ X i to states from Q i . We write q(p) to denote the location of process A p in the state q of N . In other words, if the state q is a tuple of the form (q 1 , • • • , q n ), then q(p) = q p . We will abuse the notation to write Inv p (q) to denote Inv p (q(p)).

We have already shown in Section A.2 that we can assume, without loss of generality, that each process of the network N has only invariants of the form x ≺ c, and has no invariants in initial state or accepting states of processes. Thus, if q ∈ F i , then we have Inv(q) ≡ true.

We will show that we can construct a new network N by pushing all the invariants in each state of each process A i of N to the guards on all the outgoing transitions. We now make the transformation precise. The required network is defined as

The process A i of N is obtained by transforming the process A i of N as follows:

• For each state q of the process A i of N , we set Inv i (q) ≡ true.

• For each transition q a,g

Thus, the process A i is different from A i in only the guards of transitions and the invariants of states. The transformation is illustrated in Figure A.1.

We will now show that N has an accepting run if and only if N has an accepting run.

Lemma A.2. Each run in N is also feasible in N .

where v 0 is an initial local valuation and q l is an accepting state and v l is a synchronized valuation.

We will show that the run ρ is feasible in N .

From the definition of N , we know that the set of constraints present in each guard of N is strictly contained in the set of constraints present in the respective guard in N . As a consequence, if a i+1 is feasible from v i in N , then a i+1 is feasible from v i in N also. So, all that is left to show is that each valuation in the run satisfies the respective state invariant.

First, we show that it is enough to show that v i |= Inv p (q i ) for all p ∈ Proc, where 0 ≤ i ≤ l. This is a direct consequence of the fact that all the invariants in N are of the form

We will now show that v i |= Inv p (q i ) for all p ∈ Proc, where 0 ≤ i ≤ l. Suppose that the transition q i a i+1 ---→ q i+1 has the guard g p and g p , in process A p and A p , respectively. Recall that from the definition of N , we have g p ≡ g p ∧ Inv p (q i ).

Consider v i such that 0 ≤ i ≤ l. We need to show that v i |= Inv p (q i ) for all p ∈ Proc. Since a i+1 is feasible from v i , we know that for each p ∈ dom(a i+1 ), v i |= g p . As a consequence, we have v i |= Inv p (q i ), for all p ∈ dom(a i+1 ).

It remains to show that v i |= Inv p (q i ) for p ∈ dom(a i+1 ).

We have two cases for such a process A p .

• Suppose that A p participates in an action in ρ after a i+1 . Let a k+1 be the first such action, i.e., p ∈ dom(a k+1 ) for some i < k < l such that p ∈ dom(a j ) for i < j ≤ k. Let the guard of a k+1 in A p be g and in A p be g . From the definition of N , we know that g ≡ g ∧ Inv p (q k ).

Since a k+1 is feasible from v k , we know that v k |= g . As a consequence, we have v k |= Inv p (q k ). Further, we know that the process A p has not participated in an action from (q i , v i ) to (q k , v k ). Consequently, the location of A p is the same in q i and q k , i.e., q i (p) = q k (p). Hence, we also have Inv p (q k ) ≡ Inv p (q i ). Further, we know that v k (t p ) ≥ v i (t p ) and v k ( x) = v i ( x) for all x ∈ X p . Since v k |= Inv p (q k ), we have v i |= Inv p (q i ).

• Suppose that A p does not participate in any of the actions a i+1 , • • • , a l . But since the run ρ is accepting, this implies that the location of A p in q i is part of an accepting state. From our assumption, this implies that Inv p (q i ) ≡ true. As a consequence, in this case also, we have v i |= Inv p (q i ).

From Lemma A.2 and Lemma A.3, we get Theorem A.1.

Theorem A.1. N is accepting iff N is accepting.

The network N can be obtained from

and X i are the set of states, transitions and clocks of process A i , respectively. Further, the size of the network N is greater than the size of N by O(T N •|X|), where T N is the set of transitions in N and X = 1≤i≤n X i . The arguments for these results follow similarly to the proof of Lemma A.1.

Appendix B

Networks of timed automata in compact form

In this section, we show that any network of timed automata can be transformed into a network of timed automata that accepts by executing a special action, and has no invariants in initial and accepting states, such that reachability properties are preserved. Note that we work with networks of timed automata with state invariants in this section. Definition B.1 (Network of timed automata in compact form). A network of timed automata N = {A 1 , • • • , A n } is said to be in compact form if it satisfies the following properties:

• N accepts by executing a special action α. In other words, if σ is an accepting run of N , then the final action of σ is the special action α.

• For each process A i of N , neither the initial state nor the accepting states have state invariants.

We say that a network is accepting if it has an accepting run. We will show that we can convert any network N to a network N in compact form, such that N is accepting iff N is accepting. We will provide two different constructions, one for global-local systems and one for client-server systems. Note that the conversion technique for global-local systems is quite general, and can be applied to any network of timed automata. However, in the case of client-server systems, the resultant network in compact form is not a client-server system. Since we would like to apply our client-server POR technique on the network in the compact form, we propose here an alternate transformation that yields a client-server system in compact form.

B.1. Global-local systems

In this section, we will show that we can convert any global-local system N to a global-local system N in compact form, such that N is accepting iff N is accepting.

Let N = {A 1 , A 2 , • • • , A n } be a global-local system, where each process

) is a timed automaton with state invariants. For each process A i of N , let A i = (Q i , Σ i , X i , T i , q 0 i , F i , Inv i ) be the process obtained by adding

• new states Init i and Final i with no state invariants. In the process A i , we have

• new global actions start and end, i.e., Σ i = Σ i ∪ {start, end}.

• the following transitions to T i :

i , where x is some clock in X i .

q end --→ Final i , for all states q ∈ F i .

The transformation is illustrated in Figure

In a process A i of N , observe that the initial state and accepting states do not have invariants. Further, note that the only incoming transition to the accepting state of a process A i of N is labelled by the action end. As a consequence, any accepting run of N has to end by the execution of the global action end. Hence, the network N is a global-local system in compact form. Further, the guards on the corresponding transitions ensure that the global action start can only be executed from the initial valuation. Furthermore, the action end can only be executed from an accepting state of N and a synchronized valuation. As a consequence, we have Lemma B.1. Lemma B.1. N is accepting iff N is accepting.

Proof. Suppose that N is accepting. This means that there is a run σ of N of the form (q 0 , v 0 ) σ -→ (q l , v l ), where q l is an accepting state of N , v 0 is an initial local valuation and v l is a synchronized valuation. From the definition of N , we can conclude that the following run is feasible in N . Note that we write Init to denote the state (Init

Sync-subsumption check for local zones

In this section, we give a direct test to check sync-subsumption (see Definition 5.5) between local zones. • Computing sync(Z) and sync(Z ). From Lemma 4.9, we know that upon synchronizing a local zone, we still have a local zone.

• Converting sync(Z) and sync(Z ) to offset zones by applying the global operation. By Lemma 4.9, the operator global converts a local zone into a global zone. Let Z = global(sync(Z)) and Z = global(sync(Z )). We further apply the std operator on the offset zones Z and Z to get standard zones Z and Z respectively.

• Applying the a LU check for Z and Z .

We will now propose a simpler and more direct test to detect this. We denote by Z xy the weight of the edge x → y in the distance graph of Z. We now recall the standard test to check if Z a LU Z .

Lemma C.1. ---→ t j ,c

--→ x. The minimum weight of such a path is given by min{Z t j , x | t j ∈ T }.

Suppose that there is a lighter path from t i to x. Note that this path cannot use edges of the form y → t j , as these edges have weight (<, ∞).

Suppose that this path is of the from t i

where the t i

---→ t j part of the path consists entirely of reference clocks. The part involving reference clocks can be substituted by the simple edge t i (≤,0) ---→ t j . Further, observe that all edges from t j to x are from G Z . Since G Z is canonical, this part of the path can be substituted by the simple edge t j -→ x. Then, the path reduces to

It is easy to see that this path cannot be lighter. This is a huge improvement over the naive computation of synchronized zones, which would first involve adding edges of weight 0 between reference clocks and then canonicalizing it. Let n be the number of processes and c be the number of clocks in the network. The naive computation takes time O(c + n) 3 , whereas the computation given in Lemma C. From Lemma C.2, we know that Z a LU Z , if there do not exist two offset clock variables x, y such that Z t x > (≤, -U x ) and Z y x < Z y x and Z y x + (<, -L y ) < Z t x

The key observation is that weights of the relevant edges of G Z and G Z can be directly obtained from G Z and G Z , without modifying G Z and G Z . From Lemma C.3, we know that the weight of the t -→ x edge in G Z , where Z = global(sync(Z)), is given by min{G Z t i , x | t i ∈ T } in G Z . Similarly, the weight of the y -→ x edge in G Z is equal to the weight of the y -→ x edge in G Z .

As a consequence, the weights of the relevant edges of G Z can be obtained from G Z -either directly, in the case of x -→ y edges and or by finding the minimum of all t i -→ x edges for the t -→ x edges. Further, note that the only edges required from G Z are the y -→ x edges, which is the same as the respective y -→ x edge in G Z . Therefore, these edges may be directly taken from G Z . 3. Applying the a LU check on the offset zones obtained in the previous step -this procedure takes O((c + 1) 2 ) time.

Gain over the naive approach

As can be seen above, the naive aLU sync subsumption check involves five steps -applying procedure (1) and (2) on both the zones Z and Z and then doing the check (3) on the standard zones obtained. The time complexity of the procedure is O(c + n) 3 . On the other hand, the explicit check given in Lemma C.3, involves only one step which takes O(c 2 + c • n) time.

Furthermore, while the naive check would involve computation over both Z and Z , in the direct check, no computation needs to be done on Z . This is because the only edge weights from Z required for the test are of edges of the form x -→ y. Since the weight of these edges is the same as weights of the respective y -→ x edges in the distance graph of Z , these edge weights may be directly obtained from the distance graph of Z .