Parameter Synthesis Problems for one parametric clock Timed Automata

In this paper, we study the parameter synthesis problem for a class of parametric timed automata. The problem asks to construct the set of valuations of the parameters in the parametric timed automa- ton, referred to as the feasible region, under which the resulting timed automaton satisfies certain properties. We show that the parameter syn- thesis problem of parametric timed automata with only one parametric clock (unlimited concretely constrained clock) and arbitrarily many pa- rameters is solvable when all the expressions are linear expressions. And it is moreover the synthesis problem is solvable when the form of con- straints are parameter polynomial inequality not just simple constraint and parameter domain is nonnegative real number.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

02/08/2019

Minimal-Time Synthesis for Parametric Timed Automata

Parametric timed automata (PTA) extend timed automata by allowing parame...
09/06/2021

Constrained Synchronization for Commutative Automata and Automata with Simple Idempotents

For general input automata, there exist regular constraint languages suc...
07/18/2018

Language Preservation Problems in Parametric Timed Automata

Parametric timed automata (PTA) are a powerful formalism to model and re...
06/07/2020

Probabilistic Timed Automata with One Clock and Initialised Clock-Dependent Probabilities

Clock-dependent probabilistic timed automata extend classical timed auto...
07/03/2019

What's decidable about parametric timed automata?

Parametric timed automata (PTAs) are a powerful formalism to reason, sim...
06/27/2019

Repairing Timed Automata Clock Guards through Abstraction and Testing

Timed automata (TAs) are a widely used formalism to specify systems havi...
07/27/2021

Logics Meet 2-Way 1-Clock Alternating Timed Automata

In this paper, we study the extension of 1-clock Alternating Timed Autom...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Real-time applications are increasing importance, so are their complexity and requirements for trustworthiness, in the era of Internet of Things (IoT), especially in the areas of industrial control and smart homes. Consider, for example, the control system of a boiler used in house. Such a system is required to switch on the gas within a certain bounded period of time when the water gets too cold. Indeed, the design and implementation of the system not only have to guarantee the correctness of system functionalities, but also need to assure that the application is in compliance with the non-functional requirements, that are timing constraints in this case.

Timed automata (TAs) [4, 5] are widely used for modeling and verification of real-time systems. However, one disadvantage of the TA-based approach is that it can only be used to verify concrete properties, i.e., properties with concrete values of all timing parameters occurring in the system. Typical examples of such parameters are upper and lower bounds of computation time, message delay and time-out. This makes the traditional TA-based approach not ideal for the design of real-time applications because in the design phase concrete values are often not available. This problem is usually dealt with extensive trial-and-error and prototyping activities to find out what concrete values of the parameters are suitable. This approach of design is costly, laborious, and error-prone, for at least two reasons: (1) many trials with different parameter configurations suffer from unaffordable costs, without enough assurance of a safety standard because a sufficient coverage of configurations is difficult to achieve; (2) little or no feedback information is provided to the developers to help improve the design when a system malfunction is detected.

1.1 Decidable parametric timed automata

To mitigate the limitations of the TA-based approach, parametric timed automata (PTAs) are proposed [7, 11, 12, 26], which allow more general constraints on invariants of notes (or states) and guards of edges (or transitions) of an automaton. Informally, a clock of a PTA is called a parametrically constrained clock if and some parameters both occur in a constraint of . Obviously, given any valuation of the parameters in a PTA, we obtain a concrete TA. One of the most important questions of PTAs is the parameter synthesis problem, that is, for a given property to compute the entire set of valuations of the parameters for a PTA such that when the parameters are instantiated by these valuations, the resulting TAs all satisfy the property. The synthesis problem for general PTAs is known to be undecidable. There are, however, several proposals to restrict the general PTAs from different perspectives to gain decidability. Two kinds of restrictions that are being widely investigated are (1) on the number of clocks/parameters in the PTA; and (2) on the way in which parameters are bounded, such as the L/U PTAs [26].

There are many works about parametric timed automata. An algorithm based on backward to solve nontrivial class of parametric verification problems is presented in [7]. The authors have proved that a large class of parametric verification problems are undecidable; they have also showed that the remaining (intermediate) class of parametric verification problems for which then have neither decision procedures nor undecidability results are closely related to various hard and open problems of logic and automata theory. A semi-algorithm approach based on (1) expressive symbolic representation structures is called parametric DBP’s, and (2) accurate extrapolation techniques allow to speed up the reachability analysis and help its termination is proposed in [11]. An algorithm and the tools for reachability analysis of hybrid systems is presented in [3]. They combine the notion of predicate abstraction with resent techniques for approximating the set of reachable states of linear systems using polyhedron. The main diffcult of this method is how to find the enough predicates. In [27]

, the authors give a method without an explicit enumeration to synthesize all the values of parameters and give symbolic algorithms for reachability and unavoidability properties. An adaptation of counterexample guided abstraction refinement (CEGAR) with which one can obtain an under approximation of the set of good parameters using linear programming is proposed in

[22]. An inverse method which synthesizes the constraint of parameters for an existing trace such that it can guarantee its executes of parametric timed automata under this constraint with same previous trace is provided in [9]. In [27], the authors provide a subclass of parametric timed automata which they can actually and efficiently analyze. The author of [8] makes a survey of decision and computation problems progress based on the recent 25 years’ researches on these problems.

The constraints in above works are simple constraint which means that in the form of constraint as (), () or logical combination of above forms where are clocks, is a constant and is parameter. In this paper, we will extended the form to () where are parameters and is a polynomial in .

There are many works related to solving polynomial constraints problems e.g. [31, 18].

As one would expect, Tarski’s procedure consequently has been much im- proved. Most notably, Collins [18] gave the first relatively effective method of quantifier elimination by cylindrical algebraic decomposition (CAD). The CAD procedure itself has gone through many revisions [19, 25, 29, 30, 15, 20, 23]. The CAD algorithm works by decomposing into connected components such that, in each cell, all of the polynomials from the problem are sign-invariant. To be able to perform such a particular decomposition, CAD first performs a projection of the polynomials from the initial problem. This projection includes many new polynomials, derived from the initial ones, and these polynomials carry enough information to ensure that the decomposition is indeed possible. Unfortunately, the size of these projections sets grows exponentially in the number of variables, causing the projection phase to be a key hurdle to CAD scalability.

1.1.1 Contribution

In this paper, we study the parameter synthesis problem of a class of parametric time automata. We show that the parameter synthesis problem of parametric timed automata with only one parametric clock (unlimited concretely constrained clock) and arbitrarily many parameters is solvable when all the expressions are linear expressions. And it is moreover the synthesis problem is solvable when the form of constraints are parameter polynomial inequality and parameter domain is nonnegative real number.

Constraints P-clocks NP-clocks Params emptiness synthesis
Polynomial constraints 1 0 any solvable
Simple constraints 1 any any solvable
  • ” to denote the domain of clock.

  • ” to denote the domain of parameter.

  • “Constraints” is form of constraint in PTA include constraints occurring in property.

  • “P-clocks” is the number of parametric clock.

  • “NP-clocks” is the number of concretely constrained clock.

  • “Params” is the number of parameters occurring in PTA.

  • “emptiness” denote the whether decidable of emptiness problem.

  • “synthesis” denote the whether decidable of synthesis problem.

Table 1: Our PTA results

1.1.2 Related work

Besides the above mentioned works, there are several other results that related to ours. The idea of limiting the number of parameters used such that upper and lower bounds cannot share a same parameter is also presented in [6] where the authors studied the logic LTL augmented with parameters. And our topic parametric timed automata is different from theirs. An extension of the model checker UPPAAL presented in [26] is capable of synthesizing linear parameter constraints for the correctness of parametric timed automata and it also identifies a subclass of parametric timed automata (L/U automata) for which the emptiness problem is decidable. Decidability results for L/U automata have been further investigated in [14] where the constrained versions of emptiness and universality of the set of parameter valuations for which there is a corresponding infinite accepting run of the automaton is studied and decidability if parameters of different types (lower and upper bound parameters) are not compared in the linear constraint is obtained. They show how to compute the explicit representation of the set of parameters when all the parameters are of the same type (L-automata and U-automata). Compared with [14] which considers liveness problems of the system, our results are related to synthesis parameter which satisfies a given property. In [16], the authors show that the model-checking problem is decidable and the parameter synthesis problem is solvable, in discrete time, over a PTA with one parametric clock, if equality is not allowed in the formula. Compared with it, we do not have equality restriction. In [10], the authors proved that the language-preservation problem is decidable for deterministic for the parametric timed automata with all lower bound parameters or all upper bound parameters and one parameter. However, the limitations we consider for obtaining decidability is orthogonal to those presented in [10]. In [17], the authors prove that the emptiness problem of parametric timed automata with two parameter clocks and one parameter is decidable.

1.1.3 Organization

After the introduction, the definition of parametric timed automata is presented in Section 2. In Section 3 some theoretical results about parameter synthesis problem are given. Based on result of CAD we prove that with only one parametric clock and arbitrarily many parameters is solvable. And it is moreover the form of constraints are parameter polynomial inequality. In Section 4, We show that the parameter synthesis problem of parametric timed automata with only one parametric clock (unlimited concretely constrained clock) and arbitrarily many parameters is solvable when all the expressions are linear expressions.

2 Parametric Timed Automata

We introduce the basis of PTAs and set up terminology for our discussion. We first define some preliminary notations before we introduce PTAs. We will use a model of labeled transition systems (LTS) to define semantic behavior of PTAs.

2.1 Preliminaries

We use , , and to denote the sets of integers, natural numbers, real numbers and non-negative real numbers, respectively. Although each PTA involves only a finite number of clocks and a finite number parameters, we need an infinite set of clock variables (also simply called clocks), denoted by and an infinite set of parameters, denoted by , both are enumerable. We use and to denote (finite) sets of clocks and parameters and and , with subscripts if necessary, to denote clocks and parameters, respectively. We use to denote the domain of clocks. We are mostly interested in the case that or of nonnegative reals. Unless explicitly specified, our results are applicable in either case. We use to denote the domain of clocks. We are mostly interested in the case that or .

We mainly consider dense time, and thus we define a clock valuation as a function of the type . For a finite set of clocks, an evaluation restricted on can be represented by a -dimensional point , and it is called an parameter valuation of and simply denoted as when there is no confusion. Given a constant , we use to denote the evaluation that assigns any clock with the value , and . When , we directly use as the value of clock . Similarly, a parameter valuation is an assignment of values to the parameters, that is . For a finite set of parameters, a parameter valuation restricted on corresponds to a -dimensional point

, and we use this vector to denote the valuation

of when there is no confusion. When , we directly use as the value of .

Definition 1 (Expression)

A linear expression is either an expression of the form where , or . We use to denote the coefficient of in linear expression . A polynomial expression is an expression of the form where .

We also write polynomial as form

where , and the coefficients are in with .

We use and to denote the set of linear expressions and polynomial expression, respectively. We use to denote set . For an , we use the constant , and the coefficient of in , i.e. if is for , and , otherwise. For the convenience of discussion, we also say the infinity is a expression. We call expression a parametric expression if it contains some parameter, a concrete expression, otherwise (i.e., is parameter free).

A PTA only allows parametric constraints of the form , where and are clocks, is an expression, and the ordering relation . A constraint is called a parameter-free (or concrete) constraint if the expression in it is concrete. For an expression , a parameter valuation , a clock valuation and a constraint , let

  • be the (concretized) expression obtained from by substituting the value for in , i.e. when is a linear expression , then ,

  • be the predicate obtained from constraint by substituting the value for in , and

  • holds if holds.

A pair of parameter valuation and clock valuation gives an evaluation to any parametric constraint . We use to denote the truth value of obtained by substituting each parameter and each clock by their values and , respectively. We say the pair of valuations satisfies constraint , denoted by , if is evaluated to true. For a given parameter valuation , we define to be the set of clock valuations which together with satisfy .

A clock is reset by an update which is an expression of the form , where . Any reset will change a clock valuation to a clock valuation such that and for any other clock . Given a clock valuation and a set of updates, called an update set, which contains at most one reset for one clock, we use to denote the clock valuation after applying all the clock resets in to . We use to denote the constraint which is used to assert the relation of the parameters with the clocks values after the clock resets of . Formally, for every clock valuation .

It is easy to see that the general constraints can be expressed in terms of atomic constraints of the form , where and . To be explicit, an atomic constraint is in one of the following three forms , , or . We can write as . and as , where . However, in this paper we mainly consider simple constraints that are finite conjunctions of atomic constraints.

2.2 Parametric timed automata

We assume the knowledge of timed automata (TAs), e.g., [2, 13]. A clock constraint of a TA either a invariant property when the TA is in a state (or location) or a guard condition to enable the changes of states (or a state transition). Such a constraint is in general a Boolean expression of parametric free atomic constraints. However, we can assume that the guards and invariants of TA are simple concrete constraints, i.e. conjunctions of concrete atomic constraints. This is because we can always transform a TA with disjunctive guards and invariants to an equivalent TA with guards and invariants which are simple constraints only.

In what follows, we define PTAs which extend TAs to allow the use of parametric simple constraints as guards and invariants (see [7]).

Definition 2 (Pta)

Given a finite set of clocks and a finite set of parameters , a PTA is a 5-tuple , where

  • is a finite set of actions.

  • is a finite set of locations and is called the initial location,

  • is the invariant, assigning to every a simple constraint over the clocks and parameters , and

  • is a discrete transition relation whose elements are of the form , where , is an update set, and is a simple constraint.

Given a PTA , a tuple is also denoted by , and it is called a transition step (by the guarded action ). In this step, is the action that triggers the transition. The constraint in the transition step is called the guard of the transition step, and only when holds in a location can the transition take place. By this transition step, the system modeled by the automaton changes from location to location , and the clocks are reset by the updates in

. However, the meaning of the guards and clock resets and acceptable runs of a PTA will be defined by a labeled transition system (LTS) later on. At this moment, we define a

syntactic run of a PTA as a sequence of consecutive transitions step starting from the initial location

We call a syntactic run is a simple syntactic run if has no location variants and clock resets.

Given a PTA , a clock is said to be a parametrically constrained clock in if there is a parametric constraint containing . Otherwise, is a concretely constrained clock. We can follow the procedures in [7] and [17] to eliminate from all the concretely constrained clocks. Thus, the rest of this paper only considers the PTAs in which all clocks are parametrically constrained. We use and to denote the set of all expressions and parameters in a PTA , respectively.

Figure 1: An ATM modeled using a PTA.

Example 1

The PTA in Fig. 1 models an ATM. It has 5 locations, 3 clocks and 3 parameters . This PTA is deterministic and all the clocks are parametric. To understand the behavior of state transitions, for examples, the machine can initially idle for an arbitrarily long time. Then, the user can start the system by, say, pressing a button and the PTA enters location “Start” and resets the three clocks. The machine can remain in “Start” location as long as the invariant holds, and during this time the user can drive the system (by pressing a corresponding button) to login their account and the automaton enters location “Login” and resets clock . A time-out action occurs and it goes back to “Idle” if the machine stays at “Start” for too long and the invariant becomes false. Similarly, the machine can remain in location “Login” as long as the invariant holds and during this time the user can decide either to “Check” (her balance) or to “Withdraw” (money), say by pressing corresponding buttons. However, if the user does not take any of these actions time units after the machine enter location “Login”, the machine will back to “Start” location.

2.3 Semantics of PTA via labeled transition systems

We use a standard model of labeled transition systems (LTS) for describing and analyzing the behavioral properties of PTA.

Definition 3 (Lts)

A labeled transition system (LTS) over a set of (action) symbols is a triple , where

  • is a set of states with a subset of states called the initial states.

  • is a relation, called the transition relation.

We write for a triple and it is called a transition step by action .

A run of is a finite alternating sequence of states in and actions , , such that and for . A run can be written in the form of . The length of a run is its number of transitions steps and it is denoted as , and a state is called reachable in if is the last state a run of , e.g. of .

Definition 4 (LTS semantics of PTA)

For a PTA and a parameter valuation , the concrete semantics of PTA under , denoted by , is the LTS over , where

  • a state in is a location of augmented with the clock valuations which together with the parameter valuation satisfy the invariant of the location, that is

  • any transition step in the transition of the LTS is either an instantaneous transition step by an action in defined by or by a time advance, that are specified by the following rules, respectively

    • instantaneous transition: for any , if there are simple constraint and an update set such that , and ; and

    • time advance transition if and .

A concrete run of a PTA for a given valuation is a sequence of consecutive state transition steps of the LTS , which we also call a run of the LTS . A state of is a reachable state of if there exists some run of such that .

Without the loss of generality, we merge any two consecutive time advance transitions respectively labelled by into a single time advance transition labels by . We can further merger a consecutive pair of a timed advance transition by and an instantaneous transition by an action in a run into a single observable transition step . If we do this repeatedly until all time advance steps are eliminated, we obtain an untimed run of the PTA (and the LTS), and the sequence of actions in an untimed run is called a trace.

We call an untimed run a simple run if for , where . It is easy to see that is a simple untimed run if each transition by does not have any clock reset in .

Definition 5 (LTS of trace)

For a PTA and a syntactic run

we define the PTA , where

  • ,

  • and ,

  • for , and

  • .

Give a parameter valuation , the concrete semantics of under is defined to be the LTS .

For a syntactic run

We use to denote the set of states of such that the following is an untimed run of

We also call is a run of syntactic run under . We use to denote the entire set of parameter valuation which makes .

2.4 Two decision problems for PTA

We first present the properties of PTAs which we consider in this paper.

Definition 6 (Properties)

A state property and a system property for a PTA are specified by a state predicate and a temporal formula defined by the following syntax, respectively: for , and and is a location.

Let be a parameter valuation and be a state formula. We say satisfies , denoted by , if there is a reachable state of such that holds in state . Similarly, satisfies , denoted by , if holds in all reachable states of . We can see that if , there is an syntactic run such that there is a state in satisfies . In this case, we also say that the syntactic run satisfies under the parameter valuation . We denote it by .

We are now ready to present the formal statement of the parameter synthesis problem and the emptiness problem of PTA.

Problem 1 (The parameter synthesis problem)

Given a PTA and a system property , compute the entire set of parameter valuations such that for each .

Solutions to the problems are important in system plan and optimization design. Notice that when there are no parameters in , the problem is decidable in PSPACE [5]. This implies that if there are parameters in , the satisfaction problem is decidable in PSPACE for any given parameter valuation .

A special case of the synthesis problem is the emptiness problem, which is by itself very important and formulated below.

Problem 2 (Emptiness problem)

Given a PTA and a system property , is there a parameter valuation so that ?

This is equivalent to the problem of checking if the set of feasible parameter valuations is empty.

Many safety verification problems can be reduced to the emptiness problem. We say that Problem 2 is a special case of Problem 1 because solving the latter for a PTA and a property solves Problem 2.

It is known that the emptiness problem is decidable for a PTA with only one clock [7]. However, the problem becomes undecidable for PTAs with more than two clocks [7]. Significant progress could only be made in 2002 when the subclass of L/U PTA were proposed in [26] and the emptiness problem was proved to be decidable for these automata. In the following, we will extend these results and define some classes of PTAs for which we propose solutions to the parameter synthesis problem and the emptiness problem.

3 Parametric timed automata with one parametric clock

In this section we consider parameter synthesis problem of PTA with one parametric clock and arbitrarily many parameters. The time values and parameter values . We first provide some result of CAD, then prove the synthesis problem of PTA with one parametric clock is solvable.

3.1 Cylindrical Algebraic Decomposition

Delineability plays a crucial role in the theory of CAD. Following the terminology used in CAD, we say a connected subset of is a region. Given a region , the cylinder over is . A -section of is a set of points , where is in and is continuous function from to . A -sector of is the set of points , where is in and for continuous functions from to . Sections and sectors are also regions. Given a subset of of , a decomposition of is a finite collection of disjoint regions such than . Given a region , and a set of continuous functions from to , we can decompose the cylinder into the following regions:

  • the -sections, for , and

  • -sections, for ,

where, with sight abuse of notation, we define as the constant function that return and the constant function that return . A set of polynomials , is said to be delineable in a region if the following conditions hold:

  1. For every , the total number of complex roots of remains invariant for any .

  2. For every , the number of distinct complex roots of remains invariant for any in .

  3. For every , the number of common complex roots of and remains invariant for any in .

A sign assignment for a set of polynomials is a mapping , from polynomials in to . Given a set of polynomials , we say a sign assignmemnt is realizable with respect to some in , if there exists a such that every takes the sign corresponding to its sign assignment, i.e., sgn. The function sgn maps a real number to its sign . We use to denote the set of realizable sign assignments of with respect to .

Theorem 3.1 (Lemma 1 of [28])

If a set of polynomials is delineable over a region , then is invariant over .

Theorem 3.2 (Main algorithm of [18])

is a set of polynomials in , there is a algorithm which computes decomposition such that is delineable over for .

Lemma 1

For a polynomials formula where each polynomial of in , there is a decomposition of such that is true or false for each point of for . Moreover, CAD provides a sample point where for .

3.2 Parametric timed automata with one parametric clock

The establishment and proof of this theorem involve a sequence of techniques to reduce the problem to computing the set of reachable states of an LTS. The major steps of reduction include

  1. Reduce the problem of satisfaction of a system property , say in the form of , by a run to a reachability problem. This is done by encoding the state property in as a conjunction of the invariant of a state.

  2. Then we move the state invariants in a run out of the states and conjoin them to the guards of the corresponding transitions.

  3. Construct feasible runs for a given syntactic run in order to reach a given location. This requires to define the notions of lower and upper bounds of guards of transitions, through which an lower bound of feasible parameter valuation is defined.

3.3 Reduce satisfaction of system to reachability problem

We note that is either of the form or the dual form , where is a state property. Therefore, we only need to consider the problem of computing the set for the case when is a formula of the form , i.e., there is a syntactic run such that for every . Our idea is to reduce the problem of deciding to a reachability problem of an LTS by encoding the state property in into the guards of the transitions of .

Definition 7 (Encoding state property)

Let be a state formula and be a location. We definite as follows, where is used to denote syntactic equality between formulas:

  • if , or , where and are clocks and is an expression.

  • when is a location , if is and otherwise.

  • preserves all Boolean connectives, that is , , and .

We can easily prove the following lemma.

Lemma 2

Given a PTA , , and a syntactic run of

we overload the function notation and define the encoded run to be

Then satisfies under parameter valuation if and only if .

Notice the term guard is slightly abused in the lemma as may have disjunctions, and thus it may not be a simple constraint.

3.4 Moving state invariants to guards of transitions

It is easy to see that both the invariant in the pre-state of the transition and the guard in a transition step are both enabling conditions for the transition to take place. Furthermore, the invariant in the post-state of a transition needs to be guaranteed by the set of clock resets . Thus we can also understand this constraint as a guard condition for the transition to take place (the transition is not allowed to take place if the invariant of the post-state is false.

For a PTA and a syntactic run

Let . We define as

Lemma 3

For a PTA , parameter valuation and a syntactic run

we have and if and only if .

Proof

Assume and . There is run of which is an alternating sequence of instantaneous and time advance transition steps

such that and for . Hence, by the definition of , is also a run of under , and thus .

For the “if” direction, assume there is as defined above which is a run of for the parameter valuation . Then by the definition of the concrete semantics, we have , and for . In other words, for . Therefore, and is a run of under , i.e., . ∎

Since there is one parametric clock , we can divide the conjuncts of simple constraint into two parts and where and every conjunct of with form , every conjunct of with form .

Definition 8

For a concrete constraint we use to denote the infimum nonnegative value which satisfies , if there is no value which makes satisfy then . And we use to denote the supremum nonnegative value which satisfies , if there is no value which makes satisfy then .

Definition 9

For a syntactic run

with one clock in PTA where and a parameter valuation , we use denote formula

Lemma 4

For a syntactic run

with one clock in PTA where , under parameter valuation if and only if formula is satisable for .

Proof

The “if” side is easy to check. For prove “only if” side, let

We claim that

is a run of where for . Since is satisable, if . Hence for . Since

and . So, .

Hence, for proving the claim we only need to prove that makes constraint satisable for . As when ,

(1)

and