## A theory of timed automata (1999)

### Cached

### Download Links

- [www.cis.upenn.edu]
- [www.cs.auc.dk]
- [drona.csa.iisc.ernet.in]
- DBLP

### Other Repositories/Bibliography

Citations: | 2143 - 31 self |

### BibTeX

@MISC{Alur99atheory,

author = {Rajeev Alur},

title = {A theory of timed automata},

year = {1999}

}

### Years of Citing Articles

### OpenURL

### Abstract

Model checking is emerging as a practical tool for automated debugging of complex reactive systems such as embedded controllers and network protocols (see [23] for a survey). Traditional techniques for model checking do not admit an explicit modeling of time, and are thus, unsuitable for analysis of real-time systems whose correctness depends on relative magnitudes of different delays. Consequently, timed automata [7] were introduced as a formal notation to model the behavior of real-time systems. Its definition provides a simple way to annotate state-transition graphs with timing constraints using finitely many real-valued clock variables. Automated analysis of timed automata relies on the construction of a finite quotient of the infinite space of clock valuations. Over the years, the formalism has been extensively studied leading to many results establishing connections to circuits and logic, and much progress has been made in developing verification algorithms, heuristics, and tools. This paper provides a survey of the theory of timed automata, and their role in specification and verification of real-time systems.

### Citations

1647 |
Distributed Algorithms
- Lynch
- 1996
(Show Context)
Citation Context ...ich events are controlled by the system and which events are controlled by the environment. Such a compositional framework provides foundations to decompose the analysis problem into simpler problems =-=[44,11,43]-=-. Issues pertaining to the impact of timing on synchronization are studied in [19]. 2 Reachability Analysis A location s of the timed automaton A is said to be reachable if some state q with location ... |

1290 |
The temporal logic of programs
- Pnueli
- 1977
(Show Context)
Citation Context ...sh between two timed automata [6]. The impact of the precision of the observer’s clocks on the distinguishing ability is studied in [42]. Linear real-time temporal logics. Linear temporal logic (Ltl) =-=[46]-=- is a popular formalism for writing requirements regarding computations of reactive systems. A variety of real-time extensions of Ltl have been proposed for writing requirements of real-time systems [... |

844 |
Design and synthesis of synchronization skeletons using branchingtime temporal logic
- Clarke, Emerson
- 1982
(Show Context)
Citation Context ...lting logic are undecidable. See [31] for a recent survey of real-time temporal logics. Branching real-time temporal logics. Many tools for symbolic model checking employ the branching-time logic Ctl =-=[22,47]-=- as a specification language. The real-time logic Timed Computation Tree Logic (Tctl) [3] allows temporal connectives of Ctl to be subscripted with intervals. For instance, the bounded response proper... |

652 | The algorithmic analysis of hybrid systems
- Alur, Courcoubetis, et al.
- 1995
(Show Context)
Citation Context ...sible via language-preserving translation to timed automata [33], and for the subclass of linear hybrid automata, analysis is possible based on symbolic fixpoint computation using polyhedra [12]. See =-=[5]-=- for an introduction to the theory, to [32] for an introduction to the tool HyTech, and to [30] for a survey. Acknowledgements. My research on timed automata has been in collaboration with Costas Cour... |

617 |
An automata-theoretic approach to automatic program verification
- Vardi, Wolper
- 1986
(Show Context)
Citation Context ...onsider nonterminating, infinite, executions. Specification and verification of both safety and liveness properties can be formulated in a uniform and elegant way using an automata-theoretic approach =-=[52,39,7]-=-. In this approach, a timed automaton, possibly with acceptance conditions (e.g. Büchi), is viewed as a generator of a timed language – a set of sequences in which a real-valued time of occurrence is ... |

545 | UPPAAL in a nutshell
- KG, Pettersson, et al.
(Show Context)
Citation Context ... developed at VERIMAG, supports model checking of branching-time requirements [25]. The Uppaal toolkit is developed in collaboration between Aalborg University, Denmark and Uppsala University, Sweden =-=[40]-=- and allows checking of safety and bounded liveness properties. All these tools incorporate many additional heuristics for improving the performance. Applications. The methodology described in this pa... |

525 | The theory of hybrid automata
- Henzinger
- 1996
(Show Context)
Citation Context ...ar hybrid automata, analysis is possible based on symbolic fixpoint computation using polyhedra [12]. See [5] for an introduction to the theory, to [32] for an introduction to the tool HyTech, and to =-=[30]-=- for a survey. Acknowledgements. My research on timed automata has been in collaboration with Costas Courcoubetis, David Dill, Tom Henzinger, Bob Kurshan, and many others. Many thanks to them, and to ... |

507 | Symbolic Model Checking for Real-Time Systems
- Henzinger, Nicollin, et al.
- 1992
(Show Context)
Citation Context ...ting with innermost subformulas [3]. Alternatively, the symbolic model checking procedure computes the set of states satisfying each subformula by a fixpoint routine that manipulates zone constraints =-=[35]-=-. Probabilistic models. Probabilistic extensions of timed automata allow modeling constraints such as “the delay between the input event a and the output event b is distributed uniformly between 1 to ... |

435 |
Computer-Aided Verification of Coordinating Processes: The Automata-Theoretic Approach
- Kurshan
- 1994
(Show Context)
Citation Context ...onsider nonterminating, infinite, executions. Specification and verification of both safety and liveness properties can be formulated in a uniform and elegant way using an automata-theoretic approach =-=[52,39,7]-=-. In this approach, a timed automaton, possibly with acceptance conditions (e.g. Büchi), is viewed as a generator of a timed language – a set of sequences in which a real-valued time of occurrence is ... |

291 | What’s decidable about hybrid automata
- Henzinger, Kopke, et al.
- 1995
(Show Context)
Citation Context ...y changing environment. Verification of hybrid automata is undecidable in general. For the subclass of rectangular automata, analysis is possible via language-preserving translation to timed automata =-=[33]-=-, and for the subclass of linear hybrid automata, analysis is possible based on symbolic fixpoint computation using polyhedra [12]. See [5] for an introduction to the theory, to [32] for an introducti... |

284 | Automatic symbolic verification of embedded systems
- Alur, Henzinger, et al.
- 1996
(Show Context)
Citation Context ...sis is possible via language-preserving translation to timed automata [33], and for the subclass of linear hybrid automata, analysis is possible based on symbolic fixpoint computation using polyhedra =-=[12]-=-. See [5] for an introduction to the theory, to [32] for an introduction to the tool HyTech, and to [30] for a survey. Acknowledgements. My research on timed automata has been in collaboration with Co... |

270 | Model-checking in dense real-time
- Alur, Courcoubetis, et al.
- 1993
(Show Context)
Citation Context ...hing real-time temporal logics. Many tools for symbolic model checking employ the branching-time logic Ctl [22,47] as a specification language. The real-time logic Timed Computation Tree Logic (Tctl) =-=[3]-=- allows temporal connectives of Ctl to be subscripted with intervals. For instance, the bounded response property that “every request p must be followed by a response q within 3 time units” is express... |

256 | A really temporal logic
- Alur, Henzinger
- 1989
(Show Context)
Citation Context ...] is a popular formalism for writing requirements regarding computations of reactive systems. A variety of real-time extensions of Ltl have been proposed for writing requirements of real-time systems =-=[45,38,10,8]-=-. In particular, the real-time temporal logic Metric Interval Temporal Logic (Mitl) admits temporal connectives such as always, eventually, and until, subscripted with intervals. A typical bounded-res... |

254 | The tool KRONOS
- Daws, Olivero, et al.
- 1996
(Show Context)
Citation Context ...ool timed Cospan is is an automata-based modeling and analysis tool developed at Bell Labs (see [15,13]). The tool Kronos, developed at VERIMAG, supports model checking of branching-time requirements =-=[25]-=-. The Uppaal toolkit is developed in collaboration between Aalborg University, Denmark and Uppsala University, Sweden [40] and allows checking of safety and bounded liveness properties. All these tool... |

232 |
Timing assumptions and verification of finite-state concurrent systems
- Dill
- 1989
(Show Context)
Citation Context ...every switch e =(s, a, ψ, λ, s ′ )ofA and every clock zone ϕ, there is a transition ((s, ϕ),a,(s ′ , succ(ϕ, e))). Difference-bound matrices. Clock zones can be efficiently represented using matrices =-=[27]-=-. Suppose the timed automaton A has k clocks, x1,...xk. Then a clock zone is represented by a (k +1)×(k + 1) matrix D. For each i, the entry Di0 gives an upper bound on the clock xi, and the entry D0i... |

216 | The bene of relaxing punctuality
- Alur, Feder, et al.
- 1996
(Show Context)
Citation Context ...] is a popular formalism for writing requirements regarding computations of reactive systems. A variety of real-time extensions of Ltl have been proposed for writing requirements of real-time systems =-=[45,38,10,8]-=-. In particular, the real-time temporal logic Metric Interval Temporal Logic (Mitl) admits temporal connectives such as always, eventually, and until, subscripted with intervals. A typical bounded-res... |

213 | An old-fashioned recipe for real time
- Abadi, Lamport
- 1994
(Show Context)
Citation Context ...xample, the automaton should not enforce infinitely many events in a finite interval of time. Automata satisfying this operational requirement are called nonZeno. The interested reader is referred to =-=[1,29,11]-=-. Product construction. We proceed to define a product construction for timed automata so that a complex system can be defined as a product of component systems. Let A1 = 〈L1,L 0 1,Σ1,X1,I1,E1〉 and A2... |

207 |
Specifying real-time properties with metric temporal logic
- Koymans
- 1990
(Show Context)
Citation Context ...] is a popular formalism for writing requirements regarding computations of reactive systems. A variety of real-time extensions of Ltl have been proposed for writing requirements of real-time systems =-=[45,38,10,8]-=-. In particular, the real-time temporal logic Metric Interval Temporal Logic (Mitl) admits temporal connectives such as always, eventually, and until, subscripted with intervals. A typical bounded-res... |

126 |
Formal Verification of Probabilistic Systems
- Alfaro
- 1997
(Show Context)
Citation Context ...introduce explicit probabilities in the requirements (e.g. event a will happen within time 2 with probability at least 0.5), then model checking algorithms are known only for a discrete model of time =-=[26]-=-.20 R. Alur Hybrid systems. The model of timed automata has been extended so that continuous variables other than clocks, such as temperature and imperfect clocks, can be modeled. Hybrid automata are... |

125 | Quantitative temporal reasoning
- Emerson, Mok, et al.
- 1993
(Show Context)
Citation Context ...r scheduling applications, are inappropriate for modeling asynchronous applications such as asynchronous circuits. For verification of real-time systems using discrete-time models, see, for instance, =-=[28, 21]-=-. In [34], it is established that under certain restrictions the timed reachability problem has the same answer irrespective of choice between IN and IR. Remark 5 (Minimization). Suppose we wish to ex... |

119 | What good are digital clocks
- Henzinger, Manna, et al.
- 1992
(Show Context)
Citation Context ...applications, are inappropriate for modeling asynchronous applications such as asynchronous circuits. For verification of real-time systems using discrete-time models, see, for instance, [28, 21]. In =-=[34]-=-, it is established that under certain restrictions the timed reachability problem has the same answer irrespective of choice between IN and IR. Remark 5 (Minimization). Suppose we wish to explicitly ... |

112 | HyTech: the next generation
- Henzinger, Ho, et al.
- 1995
(Show Context)
Citation Context ...to timed automata [33], and for the subclass of linear hybrid automata, analysis is possible based on symbolic fixpoint computation using polyhedra [12]. See [5] for an introduction to the theory, to =-=[32]-=- for an introduction to the tool HyTech, and to [30] for a survey. Acknowledgements. My research on timed automata has been in collaboration with Costas Courcoubetis, David Dill, Tom Henzinger, Bob Ku... |

107 |
Temporal logic of real-time systems
- Ostroff
(Show Context)
Citation Context |

99 | Computer-aided verification - Clarke, Kurshan - 1996 |

95 | Event-clock automata: A determinizable class of timed automata
- Alur, Fix, et al.
- 1997
(Show Context)
Citation Context ...n [16]. Timed languages definable by timed automata are closed under union and intersection, but not under complementation. This has prompted identification of subclasses such as event-clock automata =-=[9]-=- with better closure properties. Equivalence and Refinement Relations. While timed language equivalence for timed automata is undecidable, stronger equivalences such as timed bisimulation and simulati... |

87 | D.: Model-checking for Probabilistic Real-time Systems
- Alur, Courcoubetis, et al.
(Show Context)
Citation Context ...models. Probabilistic extensions of timed automata allow modeling constraints such as “the delay between the input event a and the output event b is distributed uniformly between 1 to 2 seconds” (cf. =-=[2]-=-). With introduction of probabilities, the semantics of the verification question changes. Given a probabilistic timed automaton A and a specification automaton AS that accepts the undesirable behavio... |

87 | Liveness in timed and untimed systems
- Segala, Gawlick, et al.
- 1998
(Show Context)
Citation Context ...xample, the automaton should not enforce infinitely many events in a finite interval of time. Automata satisfying this operational requirement are called nonZeno. The interested reader is referred to =-=[1,29,11]-=-. Product construction. We proceed to define a product construction for timed automata so that a complex system can be defined as a product of component systems. Let A1 = 〈L1,L 0 1,Σ1,X1,I1,E1〉 and A2... |

85 | Time constrained automata
- Merritt, Modugno, et al.
- 1991
(Show Context)
Citation Context ...ich events are controlled by the system and which events are controlled by the environment. Such a compositional framework provides foundations to decompose the analysis problem into simpler problems =-=[44,11,43]-=-. Issues pertaining to the impact of timing on synchronization are studied in [19]. 2 Reachability Analysis A location s of the timed automaton A is said to be reachable if some state q with location ... |

80 | Minimization of timed transition systems
- Alur, Courcoubetis, et al.
- 1992
(Show Context)
Citation Context ...Then, instead of building the region or the zone automaton, we can employ a minimization algorithm that constructs the coarsest stable refinement of a given initial partition by refining it as needed =-=[4,54,37,50]-=-. Remark 6 (Alternative Symbolic Representations). There have been many attempts to combine Bdd-based representation of discrete locations with Dbmbased representation of zones. Sample approaches incl... |

72 | Modularity for timed and hybrid systems
- Alur, Henzinger
- 1997
(Show Context)
Citation Context ...xample, the automaton should not enforce infinitely many events in a finite interval of time. Automata satisfying this operational requirement are called nonZeno. The interested reader is referred to =-=[1,29,11]-=-. Product construction. We proceed to define a product construction for timed automata so that a complex system can be defined as a product of component systems. Let A1 = 〈L1,L 0 1,Σ1,X1,I1,E1〉 and A2... |

71 | Modeling urgency in timed systems
- Bornot, Sifakis, et al.
- 1998
(Show Context)
Citation Context ...nt. Such a compositional framework provides foundations to decompose the analysis problem into simpler problems [44,11,43]. Issues pertaining to the impact of timing on synchronization are studied in =-=[19]-=-. 2 Reachability Analysis A location s of the timed automaton A is said to be reachable if some state q with location component s is a reachable state of the transition system SA. The input to the rea... |

66 |
Minimum and maximum delay problems in real-time systems
- Courcoubetis, Yannakakis
- 1991
(Show Context)
Citation Context ...which is linear in the number of locations, exponential in the number of clocks, and exponential in the encoding of the constants. Technically, the reachability problem is Pspacecomplete. In fact, in =-=[24]-=-, it is established that both sources of complexity, the number of clocks and the magnitudes of the constants, render Pspace-hardness independently of each other. Remark 3 (Choice of timing constraint... |

65 | Decidability of bisimulation equivalences for parallel timer processes - Cerans - 1993 |

62 | Efficient timed reachability analysis using clock difference diagrams
- Behrmann, KG, et al.
- 1999
(Show Context)
Citation Context .... Sample approaches include encoding Dbms using Bdds with particular attention to bit patterns in the variable ordering [20], and variants of Bdds specifically designed to represent clock constraints =-=[18]-=-. 3 Discussion We have summarized the basic techniques for analysis of timed automata (see also [41] for an introduction). We conclude by briefly discussing tools, applications, and theoretical result... |

58 | A kleene theorem for timed automata
- Asarin, Caspi, et al.
- 1997
(Show Context)
Citation Context ...attempts have been made to develop a corresponding theory of timed languages. Timed languages defined by timed automata can be characterized using timed version of S1S [53], timed regular expressions =-=[17]-=-, and timed temporal logics [36]. The complexity of different types of membership problems for timed automata is studied in [16]. Timed languages definable by timed automata are closed under union and... |

50 | Some progress in the symbolic verification of timed automata
- Bozga, Maler, et al.
- 1997
(Show Context)
Citation Context ...based representation of discrete locations with Dbmbased representation of zones. Sample approaches include encoding Dbms using Bdds with particular attention to bit patterns in the variable ordering =-=[20]-=-, and variants of Bdds specifically designed to represent clock constraints [18]. 3 Discussion We have summarized the basic techniques for analysis of timed automata (see also [41] for an introduction... |

45 | It's about time: Real-time logics reviewed
- Henzinger
- 1998
(Show Context)
Citation Context ...ipts (e.g. formulas of the form ✷(p → ✸=1 q)) makes translation from Mitl to timed automata impossible, and the satisfiability and model checking problems for the resulting logic are undecidable. See =-=[31]-=- for a recent survey of real-time temporal logics. Branching real-time temporal logics. Many tools for symbolic model checking employ the branching-time logic Ctl [22,47] as a specification language. ... |

44 | Timing verification by successive approximation
- ALUR, ITAI, et al.
- 1995
(Show Context)
Citation Context ...time systems. We list three that are most closely related to the approach discussed in this paper. The tool timed Cospan is is an automata-based modeling and analysis tool developed at Bell Labs (see =-=[15,13]-=-). The tool Kronos, developed at VERIMAG, supports model checking of branching-time requirements [25]. The Uppaal toolkit is developed in collaboration between Aalborg University, Denmark and Uppsala ... |

43 | Timing analysis in COSPAN
- Alur, Kurshan
(Show Context)
Citation Context ...gion automaton R(‖iAi) orZ(‖iAi). The actual search can be performed by an on-the-fly enumerative engine or a Bdd-based symbolic engine. We briefly sketch implementation of the search in timed Cospan =-=[15]-=-. Suppose the input program P consists of a collection of coordinating timed automata Ai. For each Ai, let A ′ i be the automaton without any timing annotations. A preprocessor generates a new program... |

40 | Verifying abstractions of timed systems
- Tasiran, Alur, et al.
- 1996
(Show Context)
Citation Context ...ble [51] (the algorithm involves analysis of the region automaton of the product space Q(A) × Q(A)). The same proof technique is useful to obtain algorithms for checking existence of timed simulation =-=[48]-=- (timed simulation relations are useful for establishing refinement between descriptions at different levels of abstractions). The complexity of deciding timed (bi)simulation is Exptime. A hierarchy o... |

39 | The observational power of clocks
- Alur, Courcoubetis, et al.
- 1994
(Show Context)
Citation Context ... A hierarchy of approximations toTimed Automata 19 timed bisimulation relation can be defined on the basis of the number of clocks that an observer must use to distinguish between two timed automata =-=[6]-=-. The impact of the precision of the observer’s clocks on the distinguishing ability is studied in [42]. Linear real-time temporal logics. Linear temporal logic (Ltl) [46] is a popular formalism for w... |

39 | The regular real-time languages
- Henzinger, Raskin, et al.
- 1998
(Show Context)
Citation Context ...op a corresponding theory of timed languages. Timed languages defined by timed automata can be characterized using timed version of S1S [53], timed regular expressions [17], and timed temporal logics =-=[36]-=-. The complexity of different types of membership problems for timed automata is studied in [16]. Timed languages definable by timed automata are closed under union and intersection, but not under com... |

39 | Time-abstracted bisimulation: Implicit specications and decidability
- Larsen, Yi
- 1997
(Show Context)
Citation Context ...basis of the number of clocks that an observer must use to distinguish between two timed automata [6]. The impact of the precision of the observer’s clocks on the distinguishing ability is studied in =-=[42]-=-. Linear real-time temporal logics. Linear temporal logic (Ltl) [46] is a popular formalism for writing requirements regarding computations of reactive systems. A variety of real-time extensions of Lt... |

37 |
An efficient algorithm for minimizing real-time transition systems
- Yannakakis, Lee
- 1993
(Show Context)
Citation Context ...Then, instead of building the region or the zone automaton, we can employ a minimization algorithm that constructs the coarsest stable refinement of a given initial partition by refining it as needed =-=[4,54,37,50]-=-. Remark 6 (Alternative Symbolic Representations). There have been many attempts to combine Bdd-based representation of discrete locations with Dbmbased representation of zones. Sample approaches incl... |

34 | Real-Time Symbolic Model Checking for Discrete Time Models
- Campos, Clarke
- 1994
(Show Context)
Citation Context ...r scheduling applications, are inappropriate for modeling asynchronous applications such as asynchronous circuits. For verification of real-time systems using discrete-time models, see, for instance, =-=[28, 21]-=-. In [34], it is established that under certain restrictions the timed reachability problem has the same answer irrespective of choice between IN and IR. Remark 5 (Minimization). Suppose we wish to ex... |

29 |
Specification and Verification of Concurrent Programs in Cesar
- QUEILLE, SIFAKIS
- 1981
(Show Context)
Citation Context ...lting logic are undecidable. See [31] for a recent survey of real-time temporal logics. Branching real-time temporal logics. Many tools for symbolic model checking employ the branching-time logic Ctl =-=[22,47]-=- as a specification language. The real-time logic Timed Computation Tree Logic (Tctl) [3] allows temporal connectives of Ctl to be subscripted with intervals. For instance, the bounded response proper... |

27 | Analysis of timed systems based on time-abstracting bisimulations
- Tripakis, Yovine
- 1996
(Show Context)
Citation Context ...Then, instead of building the region or the zone automaton, we can employ a minimization algorithm that constructs the coarsest stable refinement of a given initial partition by refining it as needed =-=[4,54,37,50]-=-. Remark 6 (Alternative Symbolic Representations). There have been many attempts to combine Bdd-based representation of discrete locations with Dbmbased representation of zones. Sample approaches incl... |

18 | Von Olnhausen. Model-checking of real-time systems: a telecommunications application: experience report
- Alur, Jagadeesan, et al.
- 1997
(Show Context)
Citation Context ...or Uppaal). The application of Cospan to verification of the asynchronous communication on the STARI chip is reported in [49], and to a scheduling problem in telecommunication software is reported in =-=[14]-=-. Automata-theoretic Verification. Reachability analysis discussed in Section 2 is adequate to check safety properties of real-time systems. To verify liveness properties such as “if a request occurs ... |

15 | Stari: A case study in compositional and hierarchical timing verification
- Tasiran, Brayton
- 1997
(Show Context)
Citation Context ...n of these and other case studies can be obtained from the homepages of Kronos or Uppaal). The application of Cospan to verification of the asynchronous communication on the STARI chip is reported in =-=[49]-=-, and to a scheduling problem in telecommunication software is reported in [14]. Automata-theoretic Verification. Reachability analysis discussed in Section 2 is adequate to check safety properties of... |

12 | State Minimization for Concurrent System Analysis Based on State Space Exploration
- Kang, Lee
- 1994
(Show Context)
Citation Context |