The advantages of compositional modelling complex systems can hardly be overestimated. On the one hand, compositional modelling facilitates systematic design, allowing the designer to focus on the construction of small models for the components whose operational behavior is mostly well understood, and on the synchronization between the components, which are in general quite evident. On the other hand, it facilitates the interchange of components in a model, enables compositional analysis, and helps on attacking the state explosion problem.
In particular we focus on modelling of stochastic system for dependability and performance analysis, and aim to general models that require more than the usual negative exponential distribution. Indeed, phenomena such as timeouts in communication protocols, hard deadlines in real-time systems, human response times or the variability of the delay of sound and video frames (so-called jitter) in modern multi-media communication systems are typically described by non-memoryless distributions such as uniform, log-normal, or Weibull distributions.
The analysis of this type of model quite often can only be performed through discrete event simulation . However, simulation requires that the model under study is fully stochastic, that is, they should not contain non-deterministic choices. Unfortunately, compositional modelling languages such as stochastic process algebras with general distributions (see  and references therein) and Modest [4, 18, 19], were designed so that the non-determinism arises naturally as the result of composition.
Based on stochastic automata [12, 10, 11] and probabilistic I/O automata , we introduced input/output stochastic automata (IOSA) . IOSAs were designed so that parallel composition works naturally and, moreover, the system becomes fully stochastic –not containing non-determinism– when closed, i.e., when all interactions are resolved and no input is left available in the model. IOSA splits the set of actions into inputs and outputs and let them behave in a reactive and generative manner respectively 
. Thus, inputs are passive and their occurrence depends only on their interaction with outputs. Instead, occurrence of outputs are governed by the expiration of a timer which is set according to a given random variable. In addition, and not to block the occurrence of outputs, IOSAs are required to be input enabled.
We have used IOSA as input language of the rare event simulation tool FIG [7, 6] and have experienced the limitations of the language, in particular when transcribing models originally given in terms of variants of dynamic fault trees (DFT) with repairs . To illustrate the problem, suppose the simple digital system of Fig. 1. We would like to measure the average time that the output O is 1 given that we know the distributions of the times in which the values on inputs A, B, and C change from 0 to 1 and vice-versa. The natural modelling of such system is to define 5 IOSA modules, three of them modelling the behaviour of the input signals and the other two modelling the OR and AND gates. Then we compose and synchronize the 5 modules properly. The main problem is that, while the dynamic behaviour of the input signal modules are governed by stochastically timed actions, the dynamic behavior of the gates are instantaneous and thus, for instance the output D of the OR gate, may change immediately after the arrival of signals A or B. Similar situations arise when modeling the behaviour of DFT under complex gates like priority AND, Spares or Repair boxes. As a consequence, we observe that the introduction of urgent actions will allow for a direct and simple compositional modelling of situations like the one recently described. Also, it is worth to notice that the need for instantaneous but causally dependent synchronization have been observed in many other timed modelling languages, notably, in Uppaal, with the introduction of committed locations, urgent locations and urgent synchronization [3, 2]
Based on IMC  and, particularly, on I/O-IMC , in this article we extended IOSA with urgent actions (Sec. 2). Urgent actions are also partitioned in input and output actions and, though inputs behave reactively and passively as before, urgent outputs are executed instantaneously as soon as the enabling state is reached. We also give semantics to IOSA with urgent actions (from now on, we simply call it IOSA) in terms of NLMP [14, 26] (Sec. 3), and define its parallel composition (Sec. 4.)
The problem is that urgent actions on IOSA introduce non-determinism. Fortunately, non-determinism is limited to urgent actions and, in many occasions, it is introduced by confluent urgent output actions as a result of a parallel composition. Such non-determinism turns to be spurious in the sense that it does not change the stochastic behaviour of the model. In this paper, we characterize confluence on IOSAs (Sec. 5), define the concept of weak determinism, and show that a confluent closed IOSA is weakly deterministic (Sec. 6). Notably, a weakly deterministic IOSA is amenable to discrete event simulation. Milner  has provided a proof that confluence preserves weak determinism but it is confined to a discrete non-probabilistic setting. A similar proof has been used by Crouzen 
on I/O-IMC but, though the model is stochastic, the proof is limited to discrete non-probabilistic transitions. Contrarily, our proof has to deal with continuous probabilities (since urgent action may sample on continuous random variables), hence making use of the solid measure theoretical approach. In particular, we address the complications of defining a particular form of weak transition on a setting that is normally elusive.
Based on the work of Crouzen  for I/O-IMC, in Sec. 7, we provide sufficient conditions to ensure that a closed IOSA is confluent and hence, weakly deterministic. If the IOSA is the result of composing several smaller IOSAs, the verification of the conditions is performed by inspecting the components rather than the resulting composed IOSA.
2 Input/Output Stochastic Automata with urgency.
) to observe the passage of time and control the occurrence of events. These variables are set to a value according to their associated probability distribution, and, as time evolves, they count down at the same rate. When a clock reaches zero, it may trigger some action. This allows the modelling of systems where events occur at random continuous time steps.
Following ideas from , IOSAs restrict Stochastic Automata by splitting actions into input and output actions which will act in a reactive and generative way respectively . This splitting reflects the fact that input actions are considered to be controlled externally, while output actions are locally controlled.
Therefore, we consider the system to be input enabled. Moreover, output actions could be stochastically controlled or instantaneous. In the first case, output actions are controlled by the expiration of a single clock while in the second case the output actions take place as soon as the enabling state is reached. We called these instantaneous actions urgent. A set of restrictions over IOSA will ensure that, almost surely, no two non-urgent outputs are enabled at the same time.
An input/output stochastic automaton with urgency (IOSA) is a structure , where is a (denumerable) set of states, is a (denumerable) set of labels partitioned into disjoint sets of input labels and output labels , from which a subset is marked as urgent. We consider the distinguished silent urgent action which is not amenable to synchronization. is a (finite) set of clocks such that each has an associated continuous probability measure on s.t. , is a transition function, is the set of clocks that are initialized in the initial state, and is the initial state.
In addition, an IOSA with urgency should satisfy the following constraints:
If and , then .
If and , then is a singleton set.
If and then , and .
For every and state , there exists a transition .
For every , if and , and .
There exists a function such that: (i) , (ii) , (iii) if is stable, , and (iv) if then .
where , and is stable, denoted , if there is no such that . ( indicates the existential quantification of a parameter.)
The occurrence of an output transition is controlled by the expiration of clocks. If , indicates that there is a transition from state to state that can be taken only when all clocks in have expired and, when taken, it triggers action and sets all clocks in to a value sampled from their associated probability distribution. Notice that if (which means ) is immediately triggered. Instead, if , is only intended to take place if an external output synchronizes with it, which means, in terms of an open system semantics, that it may take place at any possible time.
Restrictions (a) to (e) ensure that any closed IOSA without urgent actions is deterministic . An IOSA is closed if all its synchronizations have been resolved, that is, the IOSA resulting from a composition does not have input actions (). Restriction (a) is two-folded: on the one hand, it specifies that output actions must occur as soon as the enabling state is reached, on the other hand, since input actions are reactive and their time occurrence can only depend on the interaction with an output, no clock can control their enabling. Restriction (b) specifies that the occurrence of a non-urgent output is locally controlled by a single clock. Restriction (c) ensures that two different non-urgent output actions leaving the same state are always controlled by different clocks (otherwise it would introduce non-determinism). Restriction (d) ensures input enabling. Restriction (e) determines that IOSAs are input deterministic. Therefore, the same input action in the same state can not jump to different states, nor set different clocks. Finally, (f) guarantees that clocks enabling some output transition have not expired before, that is, they have not been used before by another output transition (without being reset in between) nor inadvertently reached zero. This is done by ensuring the existence of a function “” that, at each state, collects clocks that are required to be active (i.e. that have been set but not yet expired). Notice that enabling clocks are required to be active (conditions (f)(ii) and (f)(iii)). Also note that every clock that is active in a state is allowed to remain active in a successor state as long as it has not been used, and clocks that have just been set may become active in the successor state (condition (f)(iv)).
Note that since clocks are set by sampling from a continuous random variable, the probability that the values of two different clocks are equal is 0. This fact along with restriction (c) and (f) guarantee that almost never two different non-urgent output transitions are enabled at the same time.
Example 1. Fig. 2 depicts three simple examples of IOSAs. Although IOSAs are input enabled, we have omitted self loops of input enabling transitions for the sake of readability. In the figure, we represent output actions suffixed by ‘!’ and by ‘!!’ when they are urgent, and input actions suffixed by ‘?’ and by ‘??’ when they are urgent.
3 Semantics of IOSA
The foundations of NLMP is strongly rooted in measure theory, hence we recall first some basic definitions. Given a set and a collection of subsets of , we call a -algebra iff and is closed under complement and denumerable union. We call the pair a measurable space. Let denote the Borel -algebra on the topology . A function is a probability measure if (i) for all countable family of pairwise disjoint measurable sets , and (ii) . In particular, for , denotes the Dirac measure so that . Let denote the set of all probability measures over . Let and be two measurable spaces. A function is said to be measurable if for all , . There is a standard construction to endow with a -algebra  as follows: is defined as the smallest -algebra containing the sets , with and . Finally, we define the hit -algebra as the minimal -algebra containing all sets with .
A non-deterministic labeled Markov process (NLMP for short) is a structure where is a -algebra on the set of states S, and for each label we have that is measurable from to .
The formal semantics of an IOSA is defined by a NLMP with two classes of transitions: one that encodes the discrete steps and contains all the probabilistic information introduced by the sampling of clocks, and another describing the time steps, that only records the passage of time synchronously decreasing the value of all clocks. For simplicity, we assume that the set of clocks has a total order and their current values follow the same order in a vector.
Given an IOSA with , its semantics is defined by the NLMP where
, , with
, for all , where with if and otherwise, and
if there is no urgent for which and , and otherwise, for all .
The state space is the product space of the states of the IOSA with all possible clock valuations. A distinguished initial state is added to encode the random initialization of all clocks (it would be sufficient to initialize clocks in but we decided for this simplification). Such encoding is done by transition . The state space is structured with the usual Borel -algebra. The discrete step is encoded by , with . Notice that, at state , the transition will only take place if , that is, if the current values of all clocks in are not positive. For the particular case of the input or urgent actions this will always be true. The next actual state would be determined randomly as follows: the symbolic state will be (this corresponds to in ), any clock not in preserves the current value (hence if ), and any clock in is set randomly according to its respective associated distribution (hence if ). The time step is encoded by with . It can only take place at units of time if there is no output transition enabled at the current state within the next time units (this is verified by condition ). In this case, the system remains in the same symbolic state (this corresponds to in ), and all clock values are decreased by units of time (represented by in the same formula). Note the difference from the timed transitions semantics of pure IOSA . This is due to the maximal progress assumption, which forces to take urgent transition as soon as they get enabled. We encode this by not allowing to make time transitions in presence of urgent actions, i.e. we check that there is no urgent for which . (Notice that may be .) Otherwise, . Instead, notice the patient nature of a state that has no output enabled. That is, for all whenever there is no output action such that .
In a similar way to , it is possible to show that is indeed a NLMP, i.e. that maps into measurable sets in , and that is a measurable function for every .
4 Parallel Composition
In this section, we define parallel composition of IOSAs. Since outputs are intended to be autonomous (or locally controlled), we do not allow synchronization between them. Besides, we need to avoid name clashes on the clocks, so that the intended behavior of each component is preserved and moreover, to ensure that the resulting composed automaton is indeed an IOSA. Furthermore, synchronizing IOSAs should agree on urgent actions in order to ensure their immediate occurrence. Thus we require to compose only compatible IOSAs.
Two IOSAs and are compatible if they do not share synchronizable output actions nor clocks, i.e. and and, moreover, they agree on urgent actions, i.e. .
Given two compatible IOSAs and , the parallel composition is a new IOSA where (i) (ii) (iii) (iv) (v) and is defined by rules in Table 1 where we write instead of .
Let and be two compatible IOSAs. Then is indeed an IOSA.
Larsen and Skou’s probabilistic bisimulation  has been extended to NLMPs in . It can be shown that the bisimulation equivalence is a congruence for parallel composition of IOSA. In fact, this has already been shown for IOSA without urgency in  and since the characteristics of urgency do not play any role in the proof over there, the result immediately extends to our setting. So we report the theorem and invite the reader to read the proof in .
Confluence, as studied by Milner , is related to a form of weak determinism: two silent transitions taking place on an interleaving manner do not alter the behaviour of the process regardless of which happens first. In particular, we will eventually assume that urgent actions in a closed IOSA are silent as they do not delay the execution. Thus we focus on confluence of urgent actions only. The notion of confluence is depicted in Fig. 4 and formally defined as follows.
An IOSA is confluent with respect to actions if, for every state and transitions and , there exists a state such that and . is confluent if it is confluent with respect to every pair of urgent actions.
Note that we are asking that the two actions converge in a single state, which is stronger than Milner’s strong confluence, where convergence takes place on bisimilar but potentially different states.
Confluence is preserved by parallel composition:
If both and are confluent w.r.t. actions , then so is . Therefore, if and are confluent, is also confluent.
However, parallel composition may turn non-confluent components into a confluent composed system.
By looking at the IOSA in Fig. 5, one can notice that the non-determinism introduced by confluent urgent output actions is spurious in the sense that it does not change the stochastic behaviour of the model after the output urgent actions have been abstracted. Indeed, since time does not progress, it is the same to sample first clock and then clock passing through state , or first and then passing through , or even sampling both clocks simultaneously through a transition . In any of the cases, the stochastic resolution of the execution of or in the stable state is the same. This could be generalized to any number of confluent transitions.
Thus, it will be convenient to use term rewriting techniques to collect all clocks that are active in the convergent stable state and have been activated through a path of urgent actions. Therefore, we recall some basic notions of rewriting systems. An abstract reduction system  is a pair , where the reduction is a binary relation over the set , i.e. . We write for . We also write to denote that there is a path with , and . An element is in normal form if there is no such that . We say that is a normal form of if and is in normal form. A reduction system is confluent if for all implies for some . This notion of confluence is implied by the following statement: for all , implies that either for some , or . A reduction system is normalizing if every element has a normal form, and it is terminating if there is no infinite chain . A terminating reduction system is also normalizing. In a confluent reduction system every element has at most one normal form. If in addition it is also normalizing, then the normal form is unique.
We now define the abstract reduction system introduced by the urgent transitions of an IOSA.
Given an IOSA , define the abstract reduction system as where if and only if there exists such that .
An IOSA is non-Zeno if there is no loop of urgent actions. The following result can be straightforwardly proven.
Let the IOSA be closed and confluent. Then is confluent, and hence every element has at most one normal form. Moreover, an element is in normal form iff is stable in . If in addition is non-Zeno, is also terminating and hence every element has a unique normal form.
6 Weak determinism
As already shown in Fig. 5, the non-determinism introduced by confluence is spurious. In this section, we show that closed confluent IOSAs behave deterministically in the sense that the stochastic behaviour of the model is the same, regardless the way in which non-determinism is resolved. Thus, we say that a closed IOSA is weakly deterministic if (i) almost surely at most one discrete non-urgent transition is enabled at every time point, (ii) the election over enabled urgent transitions does not affect the non urgent-behavior of the model, and (iii) no non-urgent output and urgent output are enabled simultaneously. To avoid referring explicitly to time in (i), we say instead that a closed IOSA is weakly deterministic if it almost never reaches a state in which two different non-urgent discrete transitions are enabled. Moreover, to ensure (ii), we define the following weak transition.
For this definition and the rest of the section we will assume that the IOSA is closed and all its urgent actions have been abstracted, that is, all actions in have been renamed to .
For a non stable state , and , we define inductively by the following rules:
where is defined as in Def. 2 and , with , if , and otherwise. We define the weak transition if for some and .
As given above, there is no guarantee that is well defined. In particular, there is no guarantee that is a well defined measurable function. We postpone this to Lemma 1 below.
With this definition, we can introduce the concept of weak determinism:
A closed IOSA is weakly deterministic if is well defined in and, in , any state that satisfies one of the following conditions is almost never reached from any : (a) is stable and contains at least two different probability measures, (b) is not stable, , and , or (c) is not stable and for some .
By “almost never” we mean that the measure of the set of all paths leading to any measurable set in containing only states satisfying (a), (b), or (c) is zero. Thus, Def. 8 states that, in a weakly deterministic IOSA, a situation in which a non urgent output action is enabled with another output action, being it urgent (case (c)) or non urgent (case (a)), or in which sequences of urgent transitions lead to different stable situations (case (b)), is almost never reached.
For the previous definition to make sense we need that satisfies time additivity, time determinism, and maximal progress . This is stated in the following theorem whose proof follows as in [13, Theorem 16].
Let be an IOSA . Its semantics satisfies, for all , and , (i) (maximal progress), (ii) (time determinism), and (iii) (time additivity).
The next lemma states that, under the hypothesis that the IOSA is closed and confluent, is well defined. Simultaneously, we prove that is deterministic.
Let be a closed and confluent IOSA. Then, for all , the following holds:
If then there is a stable state such that (i) , (ii) for all and , and (iii) if then and moreover, if , also ; and
is a measurable function.
The proof of the preceding lemma uses induction on to prove item 1 and 2 simultaneously. It makes use of the previous results on rewriting systems in conjunction with measure theoretical tools such as Fubini’s theorem to deal with Lebesgue integrals on product spaces. All these tools make the proof that confluence preserves weak determinism radically different from those of Milner  and Crouzen .
The following corollary follows by items 1.(ii) and 1.(iii) of Lemma 1.
Let be a closed and confluent IOSA. Then, for all , if and , .
This corollary already shows that closed and confluent IOSAs satisfy part (b) of Def. 8. In general, we can state:
Every closed confluent IOSA is weakly deterministic.
The rest of the section is devoted to discuss the proof of this theorem. From now on, we work with the closed confluent IOSA , with , and its semantics .
The idea of the proof of Theorem 6.2 is to show that the property that all active clocks have non-negative values and they are different from each other is almost surely an invariant of , and that at most one non-urgent transition is enabled in every state satisfying such invariant. Furthermore, we want to show that, for unstable states, active clocks have strictly positive values, which implies that non-urgent transitions are never enabled in these states. Formally, the invariant is the set
with as in Def. 1. Note that its complement is:
It is not difficult to show that is measurable and, in consequence, so is . The following lemma states that is almost never reached in one step from a state satisfying the invariant.
If , , and , then .
From this lemma we have the following corollary
The set is almost never reachable in .
The proof of the corollary requires the definitions related to schedulers and measures on paths in NLMPs (see [26, Chap. 7] for a formal definition of scheduler and probability measures on paths in NLMPs.) We omit the proof of the corollary since it eventually boils down to an inductive application of Lemma 2.
The next lemma states that any stable state in the invariant has at most one discrete transition enabled. Its proof is the same as that of [13, Lemma 20].
For all with stable or , the set is either a singleton set or the empty set.
The next lemma states that any unstable state in the invariant can only produce urgent actions.
For every state , if and , then .
First recall that is closed; hence . If and then for all . Therefore, by Def. 2, if . Furthermore, for any , since is not stable and hence for some . ∎
7 Sufficient conditions for weak determinism
Fig. 3 shows an example in which the composed IOSA is weakly deterministic despite that some of its components are not confluent. The potential non-determinism introduced in state is never reached since urgent actions at states and prevent the execution of non urgent actions leading to such state. We say that state is not potentially reachable. The concept of potentially reachable can be defined as follows.
Given an IOSA , a state is potentially reachable if there is a path from the initial state, with , such that for all , if for some then . In such case we call the path plausible.
Notice that none of the paths leading to in Fig. 3 are plausible. Also, notice that an IOSA is bisimilar to the same IOSA when its set of states is restricted to only potentially reachable states.
Let be a closed IOSA with set of states and let be the same IOSA as restricted to the set of states . Then .
Although we have not formally introduced bisimulation, it should be clear that both semantics are bisimilar through the identity relation since a transition with unstable does not introduce any concrete transition. (Recall the IOSA is closed so there is no input action on .)
For a state in a composed IOSA to be potentially reachable, necessarily each of the component states has to be potentially reachable in its respective component IOSA.
If a state is potentially reachable in then is potentially reachable in for all .
By Theorem 6.2, it suffices to check whether a closed IOSA is confluent to ensure that it is weakly deterministic. In this section, and following ideas introduced in , we build on a theory that allows us to ensure that a closed composed IOSA is confluent in a compositional manner, even when its components may not be confluent. Theorem