Table1.Complexityresultsformodelcheckingprobabilistictimedautomata ... - PDF document

Table1.Complexityresultsformodelcheckingprobabilistictimedautomata Oneclock Twoclocks Reachability,PCTL P-complete EXPTIME-complete PTCTL0=1[;] P-complete EXPTIME-complete PTCTL0=1 EXPTIME-complete EXPTIME-complete PTCTL[;] P-hard,inEXPTIME EXPTIME-complete PTCTL EXPTIME-complete EXPTIME-complete timedautomatahavebeenusedtomodelsystemssuchastheIEEE1394rootcontentionprotocol,thebackoffprocedureintheIEEE802.11WirelessLANs,andtheIPv4linklocaladdressresolutionprotocol[14].Thetemporallogicthatweusetodescribeprop-ertiesofprobabilistictimedautomataisPTCTL(ProbabilisticTimedComputationTreeLogic)[15].ThelogicPTCTLincludesoperatorsthatcanrefertoboundsonexacttimeandontheprobabilityoftheoccurrenceofevents.Forexample,theproperty“arequestisfollowedbyaresponsewithin5timeunitswithprobability0.99orgreater”canbeexpressedbythePTCTLpropertyrequest)P0:99(F5response).ThelogicPTCTLextendstheprobabilistictemporallogicPCTL[12,7],andthereal-timetemporallogicTCTL[3].Inthenon-probabilisticsetting,timedautomatawithoneclockhaverecentlybeenstudiedextensively[17,21,1].Inthispaperweconsiderthesubclassesofprobabilistictimedautomatawithoneortwoclocks.Whileprobabilistictimedautomatawithare-strictednumberofclocksarelessexpressivethantheircounterpartswithanarbitrarynumberofclocks,theycanbeusedtomodelsystemswithsimpletimingconstraints,suchasprobabilisticsystemsinwhichthetimeofatransitiondependsonlyonthetimeelapsedsincethelasttransition.Conversely,oneclockprobabilistictimedautomataaremorenaturalandexpressivethanMarkovdecisionprocessesinwhichdurationsareas-sociatedwithtransitions(forexample,in[11,19]).WenotethattheIEEE802.11Wire-lessLANcasestudyhastwoclocks[14],andthatanabstractmodeloftheIEEE1394rootcontentionprotocolcanbeobtainedwithoneclock[23].AfterintroducingprobabilistictimedautomataandPTCTLinSection2andSec-tion3,respectively,inSection4weshowthatmodel-checkingpropertiesofPCTL,suchasthepropertyP0:99(Ftarget)(“asetoftargetstatesisreachedwithprobabilityatleast0.99regardlessofhownondeterminismisresolved”),isPTIME-completeforoneclockprobabilistictimedautomata,whichisthesameasforprobabilisticreachabilitypropertieson(untimed)Markovdecisionprocesses[22].Wealsoshowthat,ingeneral,modelcheckingofPTCTLononeclockprobabilistictimedautomataisEXPTIME-complete.However,inspiredbytheefcientalgorithmsobtainedfornon-probabilisticoneclocktimedautomata[17],wealsoshowthat,restrictingthesyntaxofPTCTLtothesub-logicinwhich(1)punctualtimingboundsand(2)comparisonswithprobabilityboundsotherthan0or1,aredisallowed,resultsinaPTIME-completemodel-checkingproblem.InSection5,weshowthatreachabilitypropertieswithprobabilityboundsof0or1areEXPTIME-completeforprobabilistictimedautomatawithtwoormore ofdistributionsofA,and,forastates2S,letPathAful(s)=PathAful\Pathful(s).ThenwecandenetheprobabilitymeasureProbAsoverPathAful(s)(fordetails,see,forexample,[15]).Notethat,bydeningadversariesasfunctionsfromnitepaths,wepermitadversariestobedependentonthehistoryofthesystem.Hence,thechoicemadebyanadversaryatacertainpointinsystemexecutioncandependonthesequenceofstatesvisited,thenondeterministicchoicestaken,andthetimeelapsedfromeachstate,uptothatpoint.WedistinguishthetwoclassesofTMDP.DiscreteTMDPsareTMDPsinwhich(1)thestatespaceSisnite,and(2)thetransitionrelation!isniteandoftheform!SNDist(S).IndiscreteTMDPs,thedelaysareinterpretedasdiscretejumps,withnonotionofacontinuouslychangingstateastimeelapses.ThesizejTjofadiscreteTMDPTisjSj+j!j,wherej!jincludesthesizeoftheencodingofthetimingconstantsandprobabilitiesusedin!:thetimingconstantsarewritteninbinary,and,foranys;s02Sand(s;d;),theprobability(s0)isexpressedasaratiobetweentwonaturalnumbers,eachwritteninbinary.WeletTubetheuntimedMarkovdecisionprocess(MDP)correspondingtothediscreteTMDPT,inwhicheachtransition(s;d;)2!isrepresentedbyatransition(s;).WedenetheaccumulateddurationDiscDur(!;i)alongtheinnitepath!=s0d0;0���!s1d1;1���!


ofTuntilthe(i+1)-thstatetobethesumP0kdk.AdiscreteTMDPisstructurallynon-Zenowhenanynitepathoftheforms0d0;0���!s1


dn;n����!sn+1,suchthatsn+1=s0,satisesP0indi&#xi]TJ;&#x/F11;&#x 9.9;c T; 15;&#x.607;&#x 2.9;‰ T; [00;0.ContinuousTMDPsareinnite-stateTMDPsinwhichanytransitionsd;��!s0describesthecontinuouspassageoftime,andthusapath!=s0d0;0���!s1d1;1���!


describesimplicitlyaninnitesetofvisitedstates.Inthesequel,weusecontinuousTMDPstogivethesemanticsofprobabilistictimedautomata.Syntaxofprobabilistictimedautomata.LetXbeanitesetofreal-valuedvariablescalledclocks,thevaluesofwhichincreaseatthesamerateasreal-time.Theset XofclockconstraintsoverXisdenedasthesetofconjunctionsoveratomicformulaeoftheformxc,wherex;y2X,2f;&#x;]TJ;&#x/F14;&#x 9.9;c T; 12;&#x.177;&#x 0 T; [00;;;=g,andc2N.Denition2.Aprobabilistictimedautomaton(PTA)P=(L;l;X;inv;prob;L)isatupleconsistingofanitesetLoflocationswiththeinitiallocationl2L;anitesetXofclocks;afunctioninv:L! Xassociatinganinvariantconditionwitheachlocation;anitesetprobL XDist(2XL)ofprobabilisticedgessuchthat,foreachl2L,thereexistsatleastone(l; ; )2prob;andalabellingfunctionL:L!2AP.Aprobabilisticedge(l;g;p)2probisatriplecontaining(1)asourcelocationl,(2)aclockconstraintg,calledaguard,and(3)aprobabilitydistributionpwhichassignsprobabilitytopairsoftheform(X;l0)forsomeclocksetXandtargetlocationl0.Thebehaviourofaprobabilistictimedautomatontakesasimilarformtothatofatimedautomaton[4]:inanylocationtimecanadvanceaslongastheinvariantholds,andaprobabilisticedgecanbetakenifitsguardissatisedbythecurrentvaluesoftheclocks.However,probabilistictimedautomatageneralizetimedautomatainthesense 3ProbabilistictimedtemporallogicWenowproceedtodescribeaprobabilistic,timedtemporallogicwhichcanbeusedtospecifypropertiesofprobabilistictimedautomata[15].Denition4.TheformulaeofPTCTL(ProbabilisticTimedComputationTreeLogic)aregivenbythefollowinggrammar:::=aj^j:jP./(Uc)wherea2APisanatomicproposition,./2f;;&#x;]TJ;&#x/F14;&#x 9.9;c T; 12;&#x.176;&#x 0 T; [00;g,2f;=;g,2[0;1]isaprobability,andc2Nisanaturalnumber.Weusestandardabbreviationssuchastrue,false,1_2,1)2,andP./(Fc)(forP./(trueUc)).Formulaewith“always”temporaloperatorsGccanalsobewritten;forexampleP(Gc)canbeexpressedbyP1�(Fc:)).ThemodalitiesU,FandGwithoutsubscriptsabbreviateU0,F0andG0,respec-tively.WerefertoPTCTLpropertiesoftheformP./(Fa)or:P./(Fa)as(untimed)reachabilityproperties.When2f0;1g,thesepropertiesarereferredtoasqualitativereachabilityproperties.WedenePTCTL[;]asthesub-logicofPTCTLinwhichsubscriptsoftheform=carenotallowedinmodalitiesUc;Fc;Gc.WedenePTCTL0=1[;]andPTCTL0=1asthequalitativerestrictionsinwhichprobabilitythresholdsbelongtof0;1g.FurthermorePCTListhesub-logicinwhichthereisnotimingsubscriptcassociatedwiththemodalitiesU;F;G.Thesizejjofisdenedinthestandardwayasthenumberofsymbolsin,witheachoccurrenceofthesamesubformulaofasasinglesymbol.WenowdenethesatisfactionrelationofPTCTLfordiscreteandcontinuousTMDPs.Denition5.GivenadiscreteTMDPT=(S;sinit;!;lab)andaPTCTLformula,wedenethesatisfactionrelationj=TofPTCTLasfollows:sj=Taiffa2lab(s)sj=T1^2iffsj=T1andsj=T2sj=T:iffs6j=Tsj=TP./(')iffProbAsf!2PathAful(s)j!j=T'g./;8A2Adv!j=T1Uc2iff9i2Ns.t.!(i)j=T2;DiscDur(!;i)c;and!(j)j=T1;8ji:Denition6.GivenacontinuousTMDPT=(S;sinit;!;lab)andaPTCTLformula,wedenethesatisfactionrelationj=TofPTCTLasinDenition5,exceptforthefollowingrulefor1Uc2:!j=T1Uc2iff9position(i;)of!s.t.!(i;)j=T2;CtsDur(!;i;)c;and!(j;0)j=T1;8positions(j;0)of!s.t.(j;0)!(i;):Whenclearfromthecontext,weomittheTsubscriptfromj=T.WesaythattheTMDPT=(S;sinit;!;lab)satisesthePTCTLformula,denotedbyTj=, strategyofeachplayer,andwinningwithrespectto(untimed)pathformulaeoftheform1U2,aredenedasusualfor2-playergames.Forthefourremainingformulae,namelyP./(1Uc2)for./2f�0;1g,and2f;g,weconsiderthefunctions;; ;:S!N,forrepresentingmin-imalandmaximaldurationsofinterest.Intuitively,forastates2S,thevalue(s)(resp. (s))istheminimal(resp.maximal)durationthatplayerPpcanensure,regard-lessofthecounter-strategyofPn,alongapathprexfromssatisfying1U2(resp.1U(P&#x]TJ/;ø 9;&#x.963;&#x Tf ;.1;I 0;&#x Td[;0(1U2))).Similarly,thevalue(s)(resp.(s))istheminimal(resp.maxi-mal)durationthatplayerPncanensure,regardlessofthecounter-strategyofPp,alongapathprexfromssatisfying1U2(resp.1U(:P1(1U2))).1UsingthefactthattheTMDPisstructurallynon-Zeno,foranystates2S,wecanobtainthefollowingequivalences:sj=P&#x]TJ/;÷ 6;&#x.974;&#x Tf ;.22; 0 ;&#xTd[0;0(1Uc2)ifandonlyif(s)c;sj=P1(1Uc2)ifandonlyif(s)&#x]TJ/;÷ 6;&#x.974;&#x Tf ;.22; 0 ;&#xTd[0;c;sj=P&#x]TJ/;÷ 6;&#x.974;&#x Tf ;.22; 0 ;&#xTd[0;0(1Uc2)ifandonlyif (s)c;sj=P1(1Uc2)ifandonlyif(s)c.Thefunctions;; ;canbecomputedonthe2-playergamebyapplyingtheresultsof[16]ontimedconcurrentgamestructures:foreachtemporaloperatorP./(1Uc2),thiscomputationrunsintimeO(jSj
j!j).utWeuseProposition2toobtainanefcientmodel-checkingalgorithmfor1C-PTA.Theorem1.LetP=(L;l;X;inv;prob;L)bea1C-PTAandbeaPTCTL0=1[;]formula.DecidingwhetherPj=canbedoneinpolynomialtime.Proof(sketch).Ouraimistolabeleverystate(l;v)ofT[P]withthesetofsubformulaeofwhichitsatises(asjXj=1,recallthatvisasinglerealvalue).Foreachlocationl2Landsubformula of,weconstructasetSat[l; ]R0ofintervalssuchthatv2Sat[l; ]ifandonlyif(l;v)j= .WewriteSat[l; ]=Sj=1;:::;khcj;c0jiwithh2f[;(gandi2f];)g.Weconsiderintervalswhichconformtothefollowingrules:for1jk,wehavecjc0jandcj;c0j2N[f1g,andfor1jk,wehavec0jcj+1.WewillseethatjSat[l; ]j–i.e.thenumberofintervalscorrespondingtoaparticularlocation–isboundedbyj j
2
jprobj.ThecasesofobtainingthesetsSat[l; ]forbooleanoperatorsandatomicpropo-sitionsarestraightforward,andthereforeweconcentrateonthevericationofsubfor-mulae oftheformP./(1Uc2).AssumethatwehavealreadycomputedthesetsSat[ ; ]for1and2.OuraimistocomputeSat[l; ]foreachlocationl2L.Thereareseveralcasesdependingontheconstraint“./”.TheequivalenceP0(1Uc2):E1Uc2canbeusedtoreducethe“0”casetotheappropriatepolynomial-timelabelingprocedurefor:E1Uc2ononeclocktimedautomata[17].Inthe“1”case,theequivalenceP1(1Uc2)A1Uc(P1(1U2))reliesonrstcomputingthestatesetsatisfyingP1(1U2),whichcanbehandledusingaqualitativePCTLmodel-checkingalgorithm,appliedtoadiscreteTMDPbuiltfromP, 1IfthereisnostrategyforplayerPp(resp.playerPn)toguaranteethesatisfactionof1U2alongapathprexfroms,thenwelet(s)=1(resp.(s)=1).Similarly,ifthereisnostrategyforplayerPp(resp.playerPn)toguaranteethesatisfactionof1U(P�0(1U2))(resp.1U(:P1(1U2)))alongapathprexfroms,thenwelet (s)=�1(resp.(s)=�1). Finally,todenelabr,forastate(l;bi),weletaj2labr(l;bi)ifandonlyifbi2Sat[l;j],forj2f1;2g.Thestates(l;b+i)and(l;b�i+1)arelabeleddependingonthetruthvalueofthej'sintheinterval(bi;bi+1):if(bi;bi+1)Sat[l;j],thenaj2labr(l;b+i)andaj2labr(l;b�i+1).Notethatgiventhe“closedintervals”assumptionmadeonSat[l;j],wehavelabr(l;b+i)labr(l;bi)andlabr(l;b�i+1)labr(l;bi).NotethatthefactthatPisstructurallynon-ZenomeansthatTrisstructurallynon-Zeno.ThesizeofTrisinO(jPj2
j j).NowwecanapplythealgorithmsdenedintheproofofProposition2andob-tainthevalueofthecoefcients,, orforthestatesofTr.Ournexttaskistodenefunctions ; ; ; :S!R0,whereSisthesetofstatesofT[P],whichareanaloguesof,, ordenedonT[P].Ourintuitionisthatwearenowcon-sideringaninnite-state2-playergame,withplayersPnandPp,asintheproofofProposition2,overthestatespaceofT[P].Considerlocationl2L.Forb2B,wehave (l;b)=(l;b), (l;b)=(l;b), (l;b)= (l;b)and (l;b)=(l;b).Forintervalsoftheform(bi;bi+1),thefunctions and willbedecreasing(withslope-1)throughouttheinterval,because,forallstatesoftheinterval,theoptimalchoiceofplayerPnistodelayasmuchaspossibleinsideanyinterval.Hence,thevalue (l;v)forv2(bi;bi+1)isdenedentirelyby(l;b�i+1)as (l;v)=(l;b�i+1)�bi+1+bi+v.Similarly, (l;v)=(l;b�i+1)�bi+1+bi+v.Nextweconsiderthevaluesof and overintervals(bi;bi+1).Inthiscase,thefunctionswillbeconstantoveraportionoftheinterval(possiblyanemptyportion,orpossiblytheentireinterval),thendecreasingwithslope-1.Theconstantpartcor-respondstothosestatesinwhichtheoptimalchoiceofplayerPnistotakeaprob-abilisticedge,whereasthedecreasingpartcorrespondstothosestatesinwhichitisoptimalforplayerPntodelayuntiltheendoftheinterval.Thevalue (l;v)forv2(bi;bi+1)isdenedbothby(l;b+i)and(l;b�i+1)as (l;v)=(l;b+i)ifbivbi+1�((l;b+i)�(l;�i+1)),andas (l;v)=(l;�i+1)�(v�(l;b+i))otherwise.Ananalogousdenitionholdsalsofor .Fromthefunctions , , and denedabove,itbecomespossibletodeneSat[l; ]bykeepinginthissetofintervalsonlythepartssatisfyingthethresholdsc,�c,candc,respectively,asintheproofofProposition2.WecanshowthatthenumberofintervalsinSat[l; ]isboundedby2
j j
jprobj.Forthecaseinwhichafunction , , or isdecreasingthroughoutaninterval,thenanintervalinSat[l;1]whichcorrespondstoseveralconsecutiveintervalsinTrcanprovideatmostone(sub)intervalinSat[l; ],becausethethresholdcancrossatmostoncethefunctioninatmostoneinterval.Forthecaseinwhichafunction or combinesaconstantpartandapartwithslope-1withinaninterval,thethresholdcancrossthefunctioninseveralintervals(bi;bi+1)containedinacommonintervalofSat[l;1].However,suchacutisduetoaguardxkofagiventransition,andthusthenumberofcutsinboundedbyjprobj.Moreoveraguardxkmayalsoaddaninterval.ThusthenumberofnewintervalsinSat[q; ]isboundedby2
jprobj.Inadditiontothesecuts,anyintervalinSat[l;2]mayprovideanintervalinSat[l; ].Thisgivesthe2
j j
jprobjboundforthesizeofSat[l; ].utCorollary1.ThePTCTL0=1[;]model-checkingproblemfor1C-PTAisP-complete. Leti2N,0in,beatapecellposition,andleta2[Q.WedeneacountdowngameChecki;a,suchthatforeverycongurationu=b0


bn�1ofM,player1hasawinningstrategyfromtheconguration(si;a0;N(u))ofthegameChecki;aifandonlyifbi=a.ThegameChecki;ahasstatesS=fsi;a0;:::;si;ang,andforeveryk,0kn,wehaveatransition(si;ak;d;si;ak+1)2T,if:d=(hai
Bkifk=i;hbi
Bkifk6=iandb2[S:Therearenotransitionsfromthestatesi;an.Observethatifbi=athenthewinningstrategyforplayer1ingameChecki;afromN(u)istochoosethetransitions(si;ak;bk
Bk;si;ak+1),forallk,0kn.If,however,bi6=athenthereisnowayforplayer1tocountdownfromN(u)to0inthegameChecki;a.NowwedeneacountdowngameCM,suchthatMacceptsw=01:::n�1ifandonlyifplayer1hasawinningstrategyinCMfromconguration(q0;N(u)),whereu=(q0;0)1:::n�1istheinitialcongurationofMwithinputw.ThemainpartofthecountdowngameCMisagadgetthatallowsthegametosimulateonestepofM.NotethatonestepofaTuringmachinemakesonlylocalchangestothecongurationofthemachine:ifthecongurationisoftheformu=a0:::an�1=0:::i�1(q;i)i+1:::n�1,thenperformingonestepofMcanonlychangeentriesinpositionsi�1,i,ori+1ofthetape.Foreverytapepositioni,0in,foreverytriple=(i�1;(q;i);i+1)2(Q),andforeverytransitiont=(q;;q0;0;D)2
ofmachineM,wenowdenethenumberdi;t,suchthatifi=andperformingtransitiontatpositioniofcongurationuyieldscongurationu0=b0:::bn�1,thenN(u)�di;t=N(u0).Forexample,assumethati&#x-440;0andthatD=L;wehavethatbk=ak=k,forallk62fi�1;i;i+1gandbi+1=ai+1=i+1.Moreoverwehavethatbi�1=(q0;i�1),andbi=0.Wedenedi;tasfollows:di;t=(hbi�1i�hai�1i)
Bi�1+(hbii�haii)
Bi=(h(q0;i�1)i�hi�1i)
Bi�1+(h0i�h(q;i)i)
Bi:ThegadgetforsimulatingonetransitionofMfromastateq2Qnfqaccghasthreelayers.Intherstlayer,fromastateq2Qnfqaccg,player1choosesapair(i;),wherei,0in,isthepositionofthetapehead,and=(a;b;c)2(Q)ishisguessforthecontentsoftapecellsi�1,i,andi+1.Inthiswaythestate(q;i;)ofthegadgetisreached,wherethedurationofthistransitionis0.Intuitively,intherstlayerplayer1hastodeclarethatheknowsthepositionioftheheadinthecurrentcongurationaswellasthecontents=(a;b;c)ofthethreetapecellsinpositionsi�1,i,andi+1.Inthesecondlayer,inastate(q;i;)player2choosesbetweenfoursuccessorstates:thestate(q;i;;)andthethreesubgamesChecki�1;a,Checki;b,andChecki+1;c.Thefourtransitionsareofduration0.Intuitively,inthesecondlayerplayer2veriesthatplayer1declaredcorrectlythecontentsofthethreetapecellsinpositionsi�1,i,andi+1.Finally,inthethirdlayer,ifq2Q9(resp.,q2Q8),thenfromastate(q;i;;)player1(resp.,player2)choosesatransition s2Sgfori2f1;2g.Letl=l1 s.Foreverytransition(s;d;)2!ofTC;( s;c),wehavetheprobabilisticedges(l1s;x=0;p1);(l2s;x=d;p2)2prob,wherep1(fxg;l2s)=1,andp2(fxg;l1s0)=(s0)foreachlocations0.Foreachstates2S,letinv(l1s)=(x0)andinv(l2s)=(xd).Thatis,thePTAP1CC;( s;c)movesfromthelocationl1stol2sinstantaneously.LocationsinL1arelabelledbytheatomicpropositiona,whereaslocationsinL2arelabelledby;.ThenwecanobservethatP1CC;( s;c)j=:P1(F=ca)ifandonlyifTC;( s;c)j=:P1(F=ctrue).AsthelatterproblemhasbeenshowntobeEXPTIME-hardintheproofofProposition3,weconcludethatmodelcheckingPTCTL0=1on1C-PTAisalsoEXPTIME-hard.ut5ModelCheckingTwoClocksProbabilisticTimedAutomataWenowshowEXPTIME-completenessofthesimplestproblemsthatweconsideron2C-PTA.Theorem4.Qualitativeprobabilisticreachabilityproblemsfor2C-PTAareEXPTIME-complete.Proof.EXPTIMEalgorithmsexistforprobabilisticreachabilityproblemsonPTA,andthereforeitsufcestoshowEXPTIME-hardness.Weproceedbyreductionfromcount-downgames.LetCbeacountdowngamewithinitialconguration( s;c),andletP1CC;( s;c)=(L;l;fxg;inv;prob;L)bethe1C-PTAconstructedintheproofofTheo-rem3.Wedenethe2C-PTAP2CC;( s;c)=(L[fl?g;l;fx;yg;inv0;prob0;L0)inthefollowingway.Thesetofprobabilisticedgesprob0isobtainedbyaddingtoprobthefollowing:foreachlocationl2L,weextendthesetofoutgoingprobabilisticedgesoflwith(l;y=c;pl?),wherepl?(;;l?)=1;tomakeprob0total,wealsoadd(l?;true;pl?).Foreachl2L,letinv0(l)=inv(l),andletinv0(l?)=true.Fi-nally,weletL0(l?)=a,andL(l)=;foralll2L.ThenP2CC;( s;c)j=:P1(Fa)ifandonlyifP1CC;( s;c)j=:P1(F=ca).TheEXPTIME-hardnessofthelatterproblemhasbeenshownintheproofofTheorem3,andhencecheckingqualitativeprobabilisticreachabilitypropertiessuchas:P1(Fa)on2C-PTAisEXPTIME-hard.utCorollary2.ThePCTL,PTCTL0=1[;],PTCTL0=1,PTCTL[;]andPTCTLmodel-checkingproblemsfor2C-PTAareEXPTIME-complete.References1.P.A.Abdulla,J.Deneux,J.Ouaknine,andJ.Worrell.Decidabilityandcomplexityresultsfortimedautomataviachannelmachines.InProc.ofthe32ndInt.Coll.onAut.,Lang.andProgr.(ICALP'05),volume3580ofLNCS,pages1089–1101.Springer,2005.2.R.Alur,C.Courcoubetis,andD.L.Dill.Model-checkingforprobabilisticreal-timesystems.InProc.ofthe18thInt.Coll.onAut.,Lang.andProgr.(ICALP'91),volume510ofLNCS,pages115–136.Springer,1991.3.R.Alur,C.Courcoubetis,andD.L.Dill.Model-checkingindensereal-time.Inf.andComp.,104(1):2–34,1993.