How to stop time stopping

Abstract

Zeno-timelocks constitute a challenge for the formal verification of timed automata: they are difficult to detect, and the verification of most properties (e.g., safety) is only correct for timelock-free models. Some time ago, Tripakis proposed a syntactic check on the structure of timed automata: if a certain condition (called strong non-zenoness’ SNZ) is met by all the loops in a given automaton, then zeno-timelocks are guaranteed not to occur. Checking for SNZ is efficient, and compositional (if all components in a network of automata are strongly non-zeno, then the network is free from zeno-timelocks). Strong non-zenoness, however, is sufficient-only: There exist non-zeno specifications which are not strongly non-zeno. A TCTL formula is known that represents a sufficient-and-necessary condition for non-zenoness; unfortunately, this formula requires a demanding model-checking algorithm, and not all model-checkers are able to express it. In addition, this algorithm provides only limited diagnostic information. Here we propose a number of alternative solutions. First, we show that the compositional application of SNZ can be weakened: some networks can be guaranteed to be free from Zeno-timelocks, even if not every component is strongly non-zeno. Secondly, we present new syntactic, sufficient-only conditions that complement SNZ. Finally, we describe a sufficient-and-necessary condition that only requires a simple form of reachability analysis. Furthermore, our conditions identify the cause of zeno-timelocks directly on the model, in the form of unsafe loops. We also comment on a tool that we have developed, which implements the syntactic checks on Uppaal models. The tool is also able to derive, from those unsafe loops in a given automaton (in general, an Uppaal model representing a product automaton of a given network), the reachability formulas that characterise the occurrence of zeno-timelocks. A modified version of the carrier sense multiple access with collision detection protocol is used as a case-study.

The Power of Proofs: New Algorithms for Timed Automata Model Checking

“…The alternation-free restriction is not prohibitive because for any timelock-free nonzeno timed automaton (see [8]), we can express any TCTL formula into a L rel,af ν,µ MES [14].…”

Language Inclusion Checking of Timed Automata with Non-Zenoness

“…In [34], it has been shown that every run in a timed automaton is non-Zeno if for each structural loop of the timed automaton (i.e., a loop in the timed automaton itself, not the underlying transition system), there exists a clock c such that c is reset during the loop and c is bounded from below in a guard of a transition during the loop. A weaker condition is identified in [12] (e.g., instead of checking all structural loops, only some loops are checked). Given a network of timed automata, it implies that every run is non-Zeno if the product automaton satisfies the condition.…”

“…Given a network of timed automata, it implies that every run is non-Zeno if the product automaton satisfies the condition. Sufficient conditions which guarantee absence of Zeno runs in a network without constructing the product have been identified [12]. Effectively, the work in [12] weakens the requirements imposed in [34].…”

“…The analysis in [12] is able to assert absence of Zeno runs for a larger class of specifications, but it assumes a simple timed automaton model. In [18], the authors show that the analysis is not sound when UPPAAL extensions such as non-Zero clock assignments and broadcast channels are considered, and that synchronisation can be better exploited to improve precision.…”

Coarse Abstractions Make Zeno Behaviours Difficult to Detect

“…The problem of checking existence of Zeno runs was formulated as early as in [18]. A bulk of the literature for this problem also directs to [10,6,17]. All of these solutions provide a sufficient-only condition for the absence of Zeno runs.…”