DeepAI

# Decidability of Timed Communicating Automata

We study the reachability problem for networks of timed communicating processes. Each process is a timed automaton communicating with other processes by exchanging messages over unbounded FIFO channels. Messages carry clocks which are checked at the time of transmission and reception with suitable timing constraints. Each automaton can only access its set of local clocks and message clocks of sent/received messages. Time is dense and all clocks evolve at the same rate. Our main contribution is a complete characterisation of decidable and undecidable communication topologies generalising and unifying previous work. From a technical point of view, we use quantifier elimination and a reduction to counter automata with registers.

04/28/2018

### Binary reachability of timed pushdown automata via quantifier elimination and cyclic order atoms

We study an expressive model of timed pushdown automata extended with mo...
05/28/2021

### Fast zone-based algorithms for reachability in pushdown timed automata

Given the versatility of timed automata a huge body of work has evolved ...
12/08/2020

### Modular Analysis of Tree-Topology Models

We investigate networks of automata that synchronise over common action ...
01/28/2021

### Continuous One-Counter Automata

We study the reachability problem for continuous one-counter automata, C...
03/21/2018

### Distributed Mechanism Design for Multicast Transmission

In the standard Mechanism Design framework (Hurwicz-Reiter), there is a ...
03/24/2022

### Zone extrapolations in parametric timed automata

Timed automata (TAs) are an efficient formalism to model and verify syst...
09/04/2019

### On the k-synchronizability of systems

In this paper, we work on the notion of k-synchronizability: a system is...

## 1 Introduction

Timed automata (ta) were introduced almost thirty years ago by Alur and Dill [7, 8] as a decidable model of real-time systems elegantly combining finite automata with timing constraints over a densely timed domain. To these days, ta are still an extremely active research area, as testified by recent works on topics such as the reachability problem [26], a novel analysis technique based on tree automata [6], and the binary reachability relation [39]. Decidability results on ta have been extended to include discrete data structures such as counters [11, 1], stacks [14, 24, 42, 10, 4, 38, 22, 23, 21], and lossy FIFO channels [3]; cf. the recent survey [43] for more examples of ta extensions.

In this paper, we study systems of timed communicating automata (tca) [30], which are networks of ta processes exchanging messages over FIFO channels (queues) of unbounded size111The original name communicating timed automata [30] refers to a version of tca with untimed channels. In order to stress that we consider timed channels, we speak about timed communicating automata.. Messages are additionally equipped with densely-valued clocks which elapse at the same rate as local ta clocks. When a message is sent, a logical constraint between local and message clocks specifies the initial values for the latter; if multiple values are allowed, a satisfying one is chosen nondeterministically. Symmetrically, when a message is received, a logical constraint on local and message clocks specifies whether the reception is possible.

We consider three kinds of clocks: classical clocks over the rationals , integral clocks over the nonnegative integers , and fractional clocks over the unit interval . All clocks evolve at the same rate; an integral clock behaves the same as a classical clock, except that in constraints it evaluates to the underlying integral part; when a fractional clock reaches value , its value is wrapped around . Integral and fractional clocks are complementary in the sense that they express two perpendicular features of time: Integral clocks are unbounded but discrete, and fractional clocks are bounded but dense. For classical and integral clocks , we consider inequality and modulo constraints; for fractional clocks we consider order constraints , where . In the presence of fractional clocks, constraints on classical and integral clocks are inter-reducible. Nevertheless, we consider separately classical, integral, and fractional clocks, mainly for two reasons. First, in our main result below we can point out with greater precision what makes the model computationally harder. Second, from a technical standpoint it is sometimes more convenient to manipulate classical clocks—their constraints are invariant w.r.t. the elapse of time; sometimes integral clocks—they reduce the impedance when converting to counters.

The non-emptiness problem asks whether there exists an execution of the tca where all processes start and end in predefined control locations, with empty channels both at the beginning and at the end of the execution. It is long-known that already in the untimed setting of communicating automata (ca) the model is Turing-powerful [15], and thus all verification questions such as non-emptiness are undecidable. Decidability can be regained by restricting the communication topology, i.e., the graph where vertices are processes , and there is an edge whenever there is a channel from process to process . A polytree is a topology whose underlying undirected graph is a tree; a polyforest is a disjoint union of polytrees. Our main result is a complete characterisation of the decidable tca topologies.

theoremthmmain Non-emptiness of tca is decidable if, and only if, the communication topology is a polyforest s.t. in each polytree there is at most one channel with inequality tests. Notice that fractional clocks do not influence decidability, as neither do modulo constraints; the characterisation depends only on which polytrees contain inequality tests, on classical or integer clocks. This subsumes recent analogous characterisations for tca with untimed channels in discrete [19, Theorem 3] and dense time [19, Theorem 5]. It is worth remarking that we consider timed channels, which were not previously considered with the exception of the work [9], which however discussed only discrete time. More precisely, it was shown there that, with (integral) non-diagonal inequality tests of the form , the topology is decidable [9, Theorem 4], while is undecidable [9, Theorem 3]. Since our undecidability result holds already in discrete time, it follows from Theorem 1 that is undecidable; additionally, new undecidable topologies can be deduced, such as with with integral inequality tests and untimed.

Regarding decidability, Theorem 1 vastly generalises all the previously known decidability results, since it considers the more challenging case of timed channels, it includes more topologies, a richer set of clocks comprising both classical, integral, and fractional clocks, a richer set of constraints comprising both diagonal and non-diagonal constraints, and the more general setting of dense time. In particular, combining timed channels with diagonal constraints on message and local clocks was not previously considered. Our characterisation completes the picture of decidable tca topologies in dense time.

#### Technical contribution.

While our undecidability results are essentially inherited from [19], the novelty of our approach consists in two main technical contributions of potentially independent interest, which are used to show decidability. First, we show that diagonal channel constraints reduce to non-diagonal ones by the method of quantifier elimination; cf. Lemma 4 in Sec. 4. This is a novel technique in the study of timed models and we believe that its application to the study of timed models has independent interest, as recently shown in the analysis of timed pushdown automata [21].

Our second technical contribution is the encoding of fractional clocks into -valued registers over the cyclic order , i.e., the ternary relation that holds whenever going clockwise on the unit circle starting at , we first visit , and then . Cyclic order provides the most suitable structure to handle fractional values and simplifies the technical development. We believe this has wider application to the analysis of timed systems.

With the two technical tools above in hand, for a given tca over a polyforest topology we build an equivalent register automaton with counters (rac) of exponential size. We establish decidability of non-emptiness for rac by reducing to finite automata with counters. If every polytree has at most one channel with integral inequality tests, then one zero tests suffices, and the latter model is decidable [40, 13]. In the simpler case that no channel has integral inequality tests, we obtain just a Petri net, for which reachability is decidable [35, 29, 31, 32] and EXPSPACE-hard [33]; the exact complexity of Petri nets is a long-standing open problem.

#### Related work.

Communicating automata (ca) were introduced in the early 80’s as a fundamental model of concurrency [15, 37]. As a way of circumventing undecidability, restricting the communication topology to polyforest has been already cited [37, 41]. Other popular methods include allowing messages to be nondeterministically lost [17, 5, 18] (later generalised to include priorities [25]); restricting the analysis to half-duplex communication [16] (later generalised to mutex communication [28]); restricting the communication policy to bounded context switching [41]; weakening the FIFO semantics to the bag semantics allowing for the reordering of messages [20]. The model of ca has been extended in diverse directions, such as ca with counters [27], with stacks [28], lossy ca with data [2], and time [3].

## 2 Preliminaries

Let be the set of natural, the integer, the rational, and the nonnegative rational numbers. Let be the rational unit interval. For , let and denote its integral and, resp., fractional part; for , let the cyclic difference be and the cyclic addition be . For , let denote the congruence modulo , which we extend to by iff . For a set of variables and a domain , let be the set of valuations for variables in taking values in . For a valuation , a variable , and a new value , let be the new valuation which assigns to , and agrees with on . For a subset of variables , let be the restricted valuation agreeing with on . For two disjoint domains and , let be the valuation which agrees with on and with on .

#### Labelled transition systems.

A labelled transition system (lts) is a tuple where is a set of configurations, with two distinguished initial and final configurations, resp., a set of actions, and a labelled transition relation. For simplicity, we write instead of , and for a sequence of actions we overload this notation as if there exist intermediate states s.t., for every , . For a given LTS , the non-emptiness problem asks whether there is a sequence of actions s.t. .

#### Clock constraints.

Let be a set of clocks of type either classical , integral , or fractional . A clock constraint over is a boolean combination of the atomic constraints

 (ineq uality) (mo dular) (or der) (non-diagonal) x0 ≤k x0 ≡mk y0 =0 (diagonal) x0−x1 ≤k x0−x1 ≡mk y0 ≤y1.

where are either both classical or integral clocks, fractional clocks, , and . As syntactic sugar we also allow and variants with any in place of . A clock valuation is a mapping assigning a non-negative rational number to every clock in . Let be the clock valuation s.t.  for every clock . For a valuation and a clock constraint , satisfies , written , if is satisfied when classical clocks are evaluated as , integral clocks as , and fractional clocks as . In particular, is equivalent to if are classical clocks, and to if are integral clocks.

#### Timed communicating automata.

A communication topology is a directed graph with nodes representing processes and edges representing channels whenever can send messages to . We do not allow multiple channels from to since such a topology would have an undecidable non-emptiness problem (stated below).

A system of timed communicating automata (tca) is a tuple where is a communication topology, a finite set of messages, a set of channel clocks for messages sent on channel , and, for every , is a timed communicating automaton with the following components: is a finite set of control locations, with two distinguished initial and final locations therein, a set of local clocks, and a set of transitions of the form , where determines the kind of transition:

• is a local operation without side effects;

• is a global time elapse operation which is executed by all processes at the same time; all local and channel clocks evolve at the same rate;

• is a operation testing the values of clocks against the test constraint ;

• resets clock to zero;

• sends message to process over channel ; the send constraint over specifies the initial values of channel clocks;

• receives message from process via channel ; the receive constraint over specifies the final values of channel clocks.

We allow transitions containing a sequence of operations as syntactic sugar. We assume w.l.o.g. that test constraints ’s are atomic, that is the maximal constant used in any inequality or modulo constraint, that all modular constraints are over the same modulus , that all the sets of local and channel clocks are disjoint, and similarly for the sets of locations and thus operations ; consequently, we can just write without risk of confusion. A tca has untimed channels if . A channel has inequality tests if there exists at least one operation or where is an inequality constraint or over (classical or integral) channel clocks .

#### Semantics.

A channel valuation is a family of sequences of pairs , where is a message and is a valuation for channel clocks in . For , let be the clock valuation which adds to the value of every clock, i.e., , and for a channel valuation with let where . The semantics of a tca is given as the infinite lts , where the set of configurations consists of triples of control locations for every process , a local clock valuation , and channel valuations for every channel ; the initial configuration is , where is the initial location of , all local clocks are initially , and all channels are initially empty; similarly, the final configuration is ; the set of actions is , and transitions are determined as follows. For a duration we have a transition

 ⟨(ℓp)p∈P,μ,u⟩δ→⟨(\mathcalligrarp)p∈P,ν,v⟩ (†)

if for all processes there is a time elapse transition , , and . For an operation , we have a transition whenever has a transition , for every other process the control location stays the same, and are determined by a case analysis on :

• if , then , and ;

• if , then , , and ;

• if , then , and ;

• if , then , there exists a valuation for clock channels s.t. , message is added to this channel , and every other channel is unchanged ;

• if , then , message is removed from this channel provided that clock channels satisfy , and every other channel is unchanged .

tca are equivalent if the non-emptiness problem has the same answer for , .

## 3 Main result

We characterise completely which tca topologies have a decidable non-emptiness problem.

[Inequality vs. emptiness tests] A similar characterisation for untimed channels appeared previously in [19], where channels can be tested for emptiness. In that setting, it was shown that non-emptiness of discrete-time tca with untimed channels is decidable precisely for polyforest topologies where in each polytree there is at most one channel which can be tested for emptiness. Since a timed channel with inequality tests can simulate an untimed channel with emptiness tests, our decidability result generalises [19] to the more general case of timed channels, and our undecidability result follows from their characterisation. The simulation is done as follows. Suppose processes want to cooperate in such a way that can test whether the channel

is empty. Time instants are split between even and odd instants. All standard operations of

are performed at odd instants. At even time instants, sends to a special message with initial age by performing . Process simulates an emptiness test on by receiving message with the same age . This is indeed correct because if some other message was sent by afterwards, then would have age , since all other operations happen at odd instants.

###### Proof of the “only if” direction.

If the topology is not a polyforest, i.e., it contains an undirected cycle, then it is well-known that non-emptiness is undecidable already in the untimed setting [15, 37]. If the topology is a polyforest, but it contains a polytree with more than one timed channel with integral inequality tests, then undecidability follows from [19, Theorem 3] already in discrete time, since non-emptiness tests (on the side of the receiver) can be simulated by timed channels with inequality tests as remarked above. ∎

#### Plan.

The rest of the paper is devoted to the decidability proof. In Sec. 4 we simplify the form of constraints. In Sec. 5 we define a more flexible desynchronised semantics [30] for the elapse of time, and in Sec. 6 a more restrictive rendezvous semantics [37] for the exchange of messages. Applying these two semantics in tandem allows us to remove channels at the cost of introducing counters (cf. [19]). Notice that fractional constraints are so far kept unchanged. In Sec. 7 we introduce register automata with counters (rac) where registers are used to handle fractional values, and counters for integer values; we show that reachability is decidable for rac. Finally, in Sec. 8 we simulate the rendezvous semantics of tca by rac. Omitted proofs can be found in Sec. A.

## 4 Simple tca

A tca is simple if: it contains only integral and fractional clocks; send constraints are of the form (for a channel clock); receive constraints of the form , for an integral clock , and of the form for fractional clocks . We present a non-emptiness preserving transformation of a given tca into a simple one.

#### Remove integral clocks.

We remove integral clocks, by expressing their constraints as combinations of classical and fractional constraints. Unlike integral and fractional constraints, classical constraints with are invariant under the elapse of time. For every integral clock , we introduce a classical and a fractional clock

which are reset at the same moment as

. A constraint on clocks is replaced by the equivalent . The same technique can handle modulo constraints and channel clocks.

#### Copy-send.

A tca is copy-send if channel clocks are always copies of local clocks of the sender process, i.e., , and all send constraints of process are equal to

 ψpcopy ≡ ⋀xpi∈Xp^xpqi=xpi. (1)

Non-emptiness of tca’s reduces to non-emptiness of copy-send tca’s.

###### Proof.

Let be a tca. We construct an equivalent copy-send tca by letting sender processes ’s send copies of their local clocks to receiver processes ’s; the latter verifies at the time of reception whether there existed suitable initial values for channel clocks of . This transformation relies on the method of quantifier elimination to show that the guessing of the receiver processes can be implemented as constraints.

We perform the following transformation for every channel . Let classical local and channel clocks be of the form , and let fractional clocks be of the form . Consider a pair of transmission (of ) and reception (of ) transitions and , where are of the form

 ψp≡ ⋀(i,j)∈Ipxpqi−xpj∼pijkpij∧⋀(i,j)∈Ipqxpqi−xpqj∼pqijkpqij ∧ (inequality) ⋀(i,j)∈Jpxpqi−xpj≡Mhpij∧⋀(i,j)∈Jpqxpqi−xpqj≡Mhpqij ∧ (modular) ⋀(i,j)∈Kpypqi≈pijypj∧⋀(i,j)∈Kpqypqi≈pqijypqj, and (order) ψq≡ ⋀(i,j)∈Iqxpqi−xqj∼qijkqij∧⋀(i,j)∈Jqxpqi−xqj≡Mhqij∧⋀(i,j)∈Kqypqi≈qijyqj,

with , sets of pairs of clock indices, and integer constants. (It suffices to consider diagonal constraints since non-diagonal ones can be simulated. We don’t consider reception constraints on since they are invariant under time elapse and can be checked directly at the time of transmission; thence the asymmetry between and .) In the new copy-send tca , we have a classical channel clock for every classical local clock of , and similarly a new fractional clock for every . Let be clock valuations at the time of transmission and reception, respectively. The initial value of is . We assume the existence of two special clocks which are always zero upon send, i.e., , and thus when the message is received equal the total integer, resp., fractional time that elapsed between transmission and reception. This allows us to recover, at reception time, the initial value of local clocks and the final value of channel clocks as follows:

 μ(xpi) =ν(^xpqi)−ν(^xpq0), ν(xpqi) =μ(xpqi)+ν(^xpq0). (2) μ(ypi) =ν(^ypqi)⊖ν(^ypq0), ν(ypqi) =μ(ypqi)⊕ν(^ypq0). (3)

We replace transitions with , resp., , where the original message is replaced by (thus guessing and verifying the correct pair of send-receive constraints ), the send constraint is the copy constraint , and the new reception formula is with obtained from , resp., by performing the substitutions below (following (2), (3)):

 xpi↦^xpqi−^xpq0,xpqi↦xpqi+^xpq0,ypi↦^ypqi⊖^xpq0,ypqi↦ypqi⊕^xpq0.

We can rearrange the conjuncts as , where

 ψq¯xpq ≡ ⋀(i,j)∈Ipxpqi−(^xpqj−^xpq0)∼pijkpij∧⋀(i,j)∈Ipqxpqi−xpqj∼pqijkpqij∧⋀(i,j)∈Iq(xpqi+^xpq0)−xqj∼qijkqij∧ ⋀(i,j)∈Jpxpqi−(^xpqj−^xpq0)≡Mhpij∧⋀(i,j)∈Jpqxpqi−xpqj≡Mhpqij∧⋀(i,j)∈Jq(xpqi+^xpq0)−xqj≡Mhqij ψq¯ypq ≡ ⋀(i,j)∈Kpypqi≈pij^ypqj⊖^ypq0∧⋀(i,j)∈Kpqypqi≈pqijypqj∧⋀(i,j)∈Kqypqi⊕^ypq0≈qijyqj.

The formula above is not a clock constraint due to the quantifiers. Thanks to quantifier elimination, we show that it is equivalent to a quantifier-free formula , i.e., a constraint.

Classical clocks. We show that is equivalent to a quantifier-free formula . By highlighting , we can put in the form (we avoid the indices for readability)

where does not contain , the ’s are of one of the three types: , , or , and similarly the ’s are of one of the three types , , or . We can now eliminate the existential quantifier on and obtain the equivalent formula . Atomic formulas in are again of the same types as above: If , then . If , then . If , then . In any other case, i.e., if and , then is already a constraint not containing any ’s ( appears on both side of each inequality and we can remove it) and thus does not participate anymore in the quantifier elimination process. The same reasoning applies to the modulo constraints. We can thus repeat this process for the other variables , and we finally get a constraint equivalent to of the form , where the ’s are of the form or , and similarly the ’s are of the form or . Thus, is the constraint we are after. Notice how speaks only about new channel clocks ’s (which hold copies of -clocks ’s) and local -clocks .

Fractional clocks. With a similar argument we can show that is equivalent to a quantifier-free formula ; the details are presented in App. A.1. To conclude, we have shown that the reception formula is equivalent to the constraint , as required. ∎

#### Atomic channel constraints .

Thanks to the previous part, channel clocks are copies of local clocks. As a consequence, we can assume w.l.o.g. that send and receive constraints are atomic. Let , be a send-receive pair, where the ’s are atomic. By sending times in a row the same message as , we can split the receive operation into . Moreover, if a receive constraints uses only , or resp., then we can assume that the corresponding send constraint is just or, resp., —all other channel clocks are irrelevant. Consequently, all channel constraints can in fact be assumed to be atomic.

#### Atomic channel constraints .

We further simplify atomic channel constraints by only sending channel clocks initialised to , and having receive constraints of the form of equalities between a channel and a local clock; this holds for both classical and fractional clocks. Consider a send/receive pair (S)  and (R)