Timed Automata: Semantics, Algorithms and Tools

Johan Bengtsson and Wang Yi

Uppsala University
Email: {johanb,yi}@it.uu.se

Abstract. This chapter is to provide a tutorial and pointers to results and related
work on timed automata with a focus on semantical and algorithmic aspects of
verification tools. We present the concrete and abstract semantics of timed au-
tomata (based on transition rules, regions and zones), decision problems, and
algorithms for verification. A detailed description on DBM (Difference Bound
Matrices) is included, which is the central data structure behind several verifica-
tion tools for timed systems. As an example, we give a brief introduction to the
tool U PPAAL.

1 Introduction

Timed automata is a theory for modeling and verification of real time systems. Exam-
ples of other formalisms with the same purpose, are timed Petri Nets, timed process
algebras, and real time logics [BD91,RR88,Yi91,NS94,AH94,Cha99]. Following the
work of Alur and Dill [AD90,AD94], several model checkers have been developed with
timed automata being the core of their input languages e.g. [Yov97,LPY97]. It is fair
to say that they have been the driving force for the application and development of the
theory. The goal of this chapter is to provide a tutorial on timed automata with a focus
on the semantics and algorithms based on which these tools are developed.
In the original theory of timed automata [AD90,AD94], a timed automaton is a finite-
state Büchi automaton extended with a set of real-valued variables modeling clocks.
Constraints on the clock variables are used to restrict the behavior of an automaton, and
Büchi accepting conditions are used to enforce progress properties. A simplified ver-
sion, namely Timed Safety Automata is introduced in [HNSY94] to specify progress
properties using local invariant conditions. Due to its simplicity, Timed Safety Au-
tomata has been adopted in several verification tools for timed automata e.g. U PPAAL
[LPY97] and Kronos [Yov97]. In this presentation, we shall focus on Timed Safety Au-
tomata, and following the literature, refer them as Timed Automata or simply automata
when it is understood from the context.
The rest of the chapter is organized as follows: In the next section, we describe the syn-
tax and operational semantics of timed automata. The section also addresses decision
problems relevant to automatic verification. In the literature, the decidability and unde-
cidability of such problems are often considered to be the fundamental properties of a
computation model. Section 3 presents the abstract version of the operational semantics
based on regions and zones. Section 4 describes the data structure DBM (Difference
Bound Matrices) for the efficient representation and manipulation of zones, and opera-
tions on zones, needed for symbolic verification. Section 5 gives a brief introduction to
the verification tool U PPAAL. Finally, as an appendix, we list the pseudo-code for the
presented DBM algorithms.

2 Timed Automata

A timed automaton is essentially a finite automaton (that is a graph containing a finite

set of nodes or locations and a finite set of labeled edges) extended with real-valued
variables. Such an automaton may be considered as an abstract model of a timed sys-
tem. The variables model the logical clocks in the system, that are initialized with zero
when the system is started, and then increase synchronously with the same rate. Clock
constraints i.e. guards on edges are used to restrict the behavior of the automaton. A
transition represented by an edge can be taken when the clocks values satisfy the guard
labeled on the edge. Clocks may be reset to zero when a transition is taken.

The first example Fig. 1(a) is an example timed automaton. The timing behavior of
the automaton is controlled by two clocks and . The clock is used to control the
self-loop in the location loop. The single transition of the loop may occur when .
Clock controls the execution of the entire automaton. The automaton may leave start
at any time point when is in the interval between 10 and 20; it can go from loop to
end when is between 40 and 50, etc.

start start
y<=20
10<=y
10<=y<=20 enter
enter x:=0, y:=0
x:=0, y:=0
x==1 loop x==1 loop
10<=y<=20 10<=y
work work y<=50
y:=0 y:=0
x:=0 x:=0
40<=y
40<=y<=50 leave
leave y:=0
y:=0 end
end y<=20

(a) (b)

Fig. 1. Timed Automata and Location Invariants

Timed Büchi Automata A guard on an edge of an automaton is only an enabling con-

dition of the transition represented by the edge; but it can not force the transition to
be taken. For instance, the example automaton may stay forever in any location, just
idling. In the initial work by Alur and Dill [AD90], the problem is solved by introduc-
ing Büchi-acceptance conditions; a subset of the locations in the automaton are marked
as accepting, and only those executions passing through an accepting location infinitely
often are considered valid behaviors of the automaton. As an example, consider again
the automaton in Fig. 1(a) and assume that end is marked as accepting. This implies
that all executions of the automaton must visit end infinitely many times. This imposes
implicit conditions on start and loop. The location start must be left when the value
of is at most 20, otherwise the automaton will get stuck in start and never be able to
enter end. Likewise, the automaton must leave loop when is at most 50 to be able to
enter end.

Timed Safety Automata A more intuitive notion of progress is introduced in timed safety
automata [HNSY94]. Instead of accepting conditions, in timed safety automata, loca-
tions may be put local timing constraints called location invariants. An automaton may
remain in a location as long as the clocks values satisfy the invariant condition of the
location. For example, consider the timed safety automaton in Fig. 1(b), which corre-
sponds to the Büchi automaton in Fig. 1(a) with end marked as an accepting location.
The invariant specifies a local condition that start and end must be left when is at
most 20 and loop must be left when is at most 50. This gives a local view of the
timing behavior of the automaton in each location.
In the rest of this chapter, we shall focus on timed safety automata and refer such au-
tomata as Timed Automata or simply automata without confusion.

2.1 Formal Syntax

Assume a finite set of real-valued variables ranged over by etc.standing for clocks
and a finite alphabet ranged over by etc.standing for actions.

Clock Constraints A clock constraint is a conjunctive formula of atomic constraints of

the form or for and . Clock
constraints will be used as guards for timed automata. We use to denote the set of
clock constraints, ranged over by and also by later.
Definition 1 (Timed Automaton) A timed automaton is a tuple where
– is a finite set of locations (or nodes),
– is the initial location,
– is the set of edges and
– assigns invariants to locations

We shall write when .

As in verification tools e.g. U PPAAL [LPY97], we restrict location invariants to con-
straints that are downwards closed, in the form: or where is a natural
number.

Concurrency and Communication To model concurrent systems, timed automata

can be extended with parallel composition. In process algebras, various parallel com-
position operators have been proposed to model different aspects of concurrency (see
e.g. CCS and CSP [Mil89,Hoa78]). These algebraic operators can be adopted in timed
automata. In the U PPAAL modeling language [LPY97], the CCS parallel composition
operator [Mil89] is used, which allows interleaving of actions as well as hand-shake
synchronization. The precise definition of this operator is given in Section 5.
Essentially the parallel composition of a set of automata is the product of the automata.
Building the product automaton is an entirely syntactical but computationally expensive
operation. In U PPAAL, the product automaton is computed on-the-fly during verifica-
tion.

2.2 Operational Semantics

The semantics of a timed automaton is defined as a transition system where a state or

configuration consists of the current location and the current values of clocks. There are
two types of transitions between states. The automaton may either delay for some time
(a delay transition), or follow an enabled edge (an action transition).
To keep track of the changes of clock values, we use functions known as clock assign-
ments mapping to the non-negative reals . Let denote such functions, and use
to mean that the clock values denoted by satisfy the guard . For , let
denote the clock assignment that maps all to , and for , let
denote the clock assignment that maps all clocks in to 0 and agree with
for the other clocks in .
Definition 2 (Operational Semantics) The semantics of a timed automaton is a tran-
sition system (also known as a timed transition system) where states are pairs ,
and transitions are defined by the rules:

– if and for a non-negative real

– if and

2.3 Verification Problems

The operational semantics is the basis for verification of timed automata. In the follow-
ing, we formalize decision problems in timed automata based on transition systems.
Language Inclusion A timed action is a pair , where is an action taken by
an automaton after time units since has been started. The absolute time
is called a time-stamp of the action . A timed trace is a (possibly infinite) sequence of
timed actions where for all .
Definition 3 A run of a timed automaton with initial state
over a timed trace is a sequence of transitions:

satisfying the condition for all .

The timed language is the set of all timed traces for which there exists a run of
over .

Undecidability The negative result on timed automata as a computation model is that

the language inclusion checking problem i.e. to check is undecidable
[AD94,ACH94]. Unlike finite state automata, timed automata is not determinizable in
general. Timed automata can not be complemented either, that is, the complement of
the timed language of a timed automaton may not be described as a timed automaton.
The inclusion checking problem will be decidable if in checking is
restricted to the deterministic class of timed automata. Research effort has been made
to characterize interesting classes of determinizable timed systems e.g. event-clock au-
tomata [AFH99] and timed communicating sequential processes [YJ94]. Essentially,
the undecidability of language inclusion problem is due to the arbitrary clock reset. If
all the edges labeled with the same action symbol in a timed automaton, are also labeled
with the same set of clocks to reset, the automaton will be determinizable. This covers
the class of event-clock automata [AFH99].
We may abstract away from the time-stamps appearing in timed traces and define the
untimed language as the set of all traces in the form for which
there exists a timed trace in the timed language of .
The inclusion checking problem for untimed languages is decidable. This is one of the
classic results for timed automata [AD94].

Bisimulation Another classic result on timed systems is the decidability of timed

bisimulation [Cer92]. Timed bisimulation is introduced for timed process algebras [Yi91].
However, it can be easily extended to timed automata.
Definition 4 A bisimulation over the states of timed transition systems and the al-
phabet , is a symmetrical binary relation satisfying the following condition:
for all , if for some and , then and
for some .
Two automata are timed bisimilar iff there is a bisimulation containing the initial states
of the automata.
Intuitively, two automata are timed bisimilar iff they perform the same action transition
at the same time and reach bisimilar states. In [Cer92], it is shown that timed bisimula-
tion is decidable.
We may abstract away from timing information to establish bisimulation between au-
tomata based actions performed only. This is captured by the notion of untimed bisim-
ulation. We define if for some real number . Untimed bisimulation is
defined by by replacing the alphabet with in Definition 4. As timed bisimula-
tion, untimed bisimulation is decidable [LW97].

Reachability Analysis Perhaps, the most useful question to ask about a timed automa-
ton is the reachability of a given final state or a set of final states. Such final states may
be used to characterize safety properties of a system.
Definition 5 We shall write if for some .
For an automaton with initial state , , is reachable iff .
More generally, given a constraint we say that the configuration is
reachable if is reachable for some satisfying .
The notion of reachability is more expressive than it appears to be. We may specify
invariant properties using the negation of reachability properties, and bounded liveness
properties using clock constraints in combination with local properties on locations
[LPY01] (see Section 5 for an example).
The reachability problem is decidable. In fact, one of the major advances in verification
of timed systems is the symbolic technique [Dil89,YL93,HNSY94,YPD94,LPY95], de-
veloped in connection with verification tools. It adopts the idea from symbolic model
checking for untimed systems, which uses boolean formulas to represent sets of states
and operations on formulas to represent sets of state transitions. It is proven that the
infinite state-space of timed automata can be finitely partitioned into symbolic states
using clock constraints known as zones [Bel57,Dil89]. A detailed description on this is
given in Section 3 and 4.

3 Symbolic Semantics and Verification

As clocks are real-valued, the transition system of a timed automaton is infinite, which
is not an adequate model for automated verification.

3.1 Regions, Zones and Symbolic Semantics

The foundation for the decidability results in timed automata is based on the notion of
region equivalence over clock assignments [AD94,ACD93].
Definition 6 (Region Equivalence) Let be a function, called a clock ceiling, map-
ping each clock to a natural number (i.e. the ceiling of ). For a real
number , let denote the fractional part of , and denote its integer part. Two
clock assignments are region-equivalent, denoted , iff
1. for all , either or both and ,
2. for all , if then iff and
3. for all if and then iff

Note that the region equivalence is indexed with a clock ceiling . When the clock ceil-
ing is given by the maximal clock constants of a timed automaton under consideration,
we shall omit the index and write instead. An equivalence class induced by is
called a region, where denotes the set of clock assignments region-equivalent to .
The basis for a finite partitioning of the state-space of a timed automaton is the follow-
ing facts. First, for a fixed number of clocks each of which has a maximal constant, the
number of regions is finite. Second, implies and are bisimilar w.r.t.
the untimed bisimulation for any locaton of a timed automaton. We use the equivalence
classes induced by the untimed bisimulation as symbolic (or abstract) states to construct
a finite-state model called the region graph or region automaton of the original timed
automaton. The transition relation between symbolic states is defined as follows:

Fig. 2. Regions for a System with Two Clocks

– if for a positive real number and

– if for an action .
Note that the transition relation is finite. Thus the region graph for a timed automaton
is finite. Several verification problems such as reachability analysis, untimed language
inclusion, language emptiness [AD94] as well as timed bisimulation [Cer92] can be
solved by techniques based on the region construction.
However, the problem with region graphs is the potential explosion in the number of re-
gions. In fact, it is exponential in the number of clocks as well as the maximal constants
appearing in the guards of an automaton. As an example, consider Fig. 2. The figure
shows the possible regions in each location of an automaton with two clocks and .
The largest number compared to is 3, and the largest number compared to is 2. In
the figure, all corner points (intersections), line segments, and open areas are regions.
Thus, the number of possible regions in each location of this example is 60.
A more efficient representation of the state-space for timed automata is based on the
notion of zone and zone-graphs [Dil89,HNSY92,YL93,YPD94,HNSY94]. In a zone
graph, instead of regions, zones are used to denote symbolic states. This in practice
gives a coarser and thus more compact representation of the state-space. The basic
operations and algorithms for zones to construct zone-graphs are described in Section 4.
As an example, a timed automaton and the corresponding zone graph (or reachability
graph) is shown in Fig. 3. We note that for this automaton the zone graph has only 8
states. The region-graph for the same example has over 50 states.

off

off
off
x>10
press?
press? dim
x:=0

dim press?
bright dim
x<=10
press? off bright

bright
bright

Fig. 3. A Timed Automaton and its Zone Graph

A zone is a clock constraint. Strictly speaking, a zone is the solution set of a clock
constraint, that is the maximal set of clock assignments satisfying the constraint. It
is well-known that such sets can be efficiently represented and stored in memory as
DBMs (Difference Bound Matrices) [Bel57]. For a clock constraint , let denote
the maximal set of clock assignments satisfying . In the following, to save notation,
we shall use to stand for without confusion. Then denotes the set of zones.
A symbolic state of a timed automaton is a pair representing a set of states of the
automaton, where is a location and is a zone. A symbolic transition describes all
the possible concrete transitions from the set of states.
Definition 7 Let be a zone and a set of clocks. We define
and . Let denote the symbolic transition relation
over symbolic states defined by the following rules:
–
 – if
We shall study these operations in details in Section 4 where is written as up
and as reset . It will be shown that the set of zones is closed un-
der these operations, in the sense that the result of the operations is also a zone. Another
important property of zones is that a zone has a canonical form. A zone is closed un-
der entailment or just closed for short, if no constraint in can be strengthened without
reducing the solution set. The canonicity of zones means that for each zone ,
there is a unique zone such that and have exactly the same solution set
and is closed under entailment. Section 4 describes how to compute and represent
the canonical form of a zone. It is the key structure for the efficient implementation of
state-space exploration using the symbolic semantics.
The symbolic semantics corresponds closely to the operational semantics in the sense
that implies for all , for some . More
generally, the symbolic semantics is a correct and full characterization of the operational
semantics given in Definition 2.
Theorem 1 Assume a timed automaton with initial state .
1. (soundness) implies for all .
2. (Completeness) implies for some
such that
The soundness means that if the initial symbolic state may lead to a set of
final states according to , all the final states should be reachable according to
the concrete operational semantics. The completeness means that if a state is reachable
according to the concrete operational semantics, it should be possible to conclude this
using the symbolic transition relation.
Unfortunately, the relation is infinite, and thus the zone-graph of a timed automaton
may be infinite, which can be a problem to guarantee termination in a verification pro-
cedure. As an example, consider the automaton in Fig. 4. The value of clock drifts
away unboundedly, inducing an infinite zone-graph.
The solution is to transform (i.e. normalize) zones that may contain arbitrarily large
constants to their representatives in a class of zones whose constants are bounded by
fixed constants e.g. the maximal clock constants appearing in the automaton, using an
abstraction technique similar to the widening operation [Hal93]. The intuition is that
once the value of a clock is larger than the maximal constant in the automaton, it is no
longer important to know the precise value of the clock, but only the fact that it is above
the constant.

3.2 Zone-Normalization for Automata without Difference Constraints

In the original theory of timed automata [AD94], difference constraints are not allowed
to appear in the guards. Such automata (whose guards contain only atomic constraints in
 start

start
loop
x:=0,
y:=0
loop

loop x==10
x<=10 x:=0 loop

y>=20 loop
x:=0,
y:=0 .
.
end . end

Fig. 4. A Timed Automaton with an Infinite Zone-Graph

the form ) are known as diagonal-free automata in the literature in [BDGP98]. For
diagonal-free automata, a well-studied zone-normalization procedure is the so-called
-normalization operation on zones [Rok93,Pet99]. It is implemented in several verifi-
cation tools for timed automata e.g. U PPAAL to guarantee termination.
Definition 8 ( -Normalization) Let be a zone and a clock ceiling. The semantics
of the -normalization operation on zones is defined as follows:

norm

Note that the normalization operation is indexed by a clock ceiling . According to

[Rok93,Pet99], norm can be computed from the canonical representation of by
1. removing all constraints of the form , , and
where ,
2. replacing all constraints of the form , , and
where with and respectively.
Let denote the resulted zone by the above transformation. This is exactly the nor-
malized zone as defined in Definition 8, that is,
As an example, the normalized zone-graph of the automaton in Fig. 4 is shown in
Fig. 5 where the clock ceiling is given by the maximal clock constants appearing in the
automaton.
Note that for a fixed number of clocks with a clock ceiling , there can be only finitely
many normalized zones. The intuition is that if the constants allowed to use are bounded,
one can write down only finitely many clock constraints. This gives rise to a finite char-
acterization for .
Definition 9 norm if .
 start

loop

loop

loop

loop

end

Fig. 5. Normalized Zone Graph for the Automaton in Fig. 4

For the class of diagonal-free timed automata is sound, complete and finite in the
following sense.

Theorem 2 Assume a timed automaton with initial state , whose maximal clock
constants are bounded by a clock ceiling . Assume that the automaton has no guards
containing difference constraints in the form of .

1. (soundness) implies for all

such that for all .

2. (Completeness) with for all , implies

for some such that

3. (Finiteness) The transition relation is finite.

Unfortunately the soundness will not hold for timed automata whose guards contain
difference constraints. We demonstrate this by an example. Consider the automaton
shown in Fig. 6. The final location of the automaton is not reachable according to the
operational semantics. This is because in location , the clock zone is ( and
) and the guard on the outgoing edge is which is equivalent
to . Obviously the zone at can never enable the
guard, and thus the last transition will never be possible. However, because the maximal
constants for clock is (and for ), the zone in location : will
be normalized to by the maximal constant for , which enables
the guard and thus the symbolic reachability analysis based on
the above normalization algorithm would incorrectly conclude that the last location is
reachable.

The zones in canonical forms, generated in exploring the state-space of the counter
example are given in Fig. 7. The implicit constraints that all clocks are non-negative
are not shown.
 S0 S1 y>2 S2 S3

z:=0 y:=0
x<z+1, z<y+1

Fig. 6. A counter example

(a) Zones without normalization (b) Zones normalized with -normalization

Fig. 7. Zones for the counter example in Fig. 6

Note that at and , the normalized and un-normalized zones are identical. The
problem is at where the intersection of the guard (on the only outgoing edge) with
the un-normalized zone is empty and non-empty with the normalized zone.

3.3 Zone-Normalization for Automata with Difference Constraints

Our definition of timed automata (Definition 1) allows any clock constraint to appear in
a guard, which may be a difference constraint in the form of . Such automata
are indeed needed in many applications e.g. to model scheduling problems [FPY02].
It is shown that an automaton containing difference constraints can be transformed to
an equivalent diagonal-free automaton [BDGP98]. However, the transformation is not
applicable since it is based on the region construction. Besides, it is impractical to im-
plement such an approach in a tool. Since the transformation modifies the model before
analysis, it is difficult to trace debugging information provided by the tool back to the
original model.
In [Ben02,BY03], a refined normalization algorithm is presented for automata that may
have guards containing difference constraints. The algorithm transforms DBMs accord-
ing to not only the maximal constants of clocks but also difference constraints appearing
in the automaton under consideration. Note that the difference constraints correspond to
the diagonal lines which split the entire space of clock assignments. A finer partitioning
is needed.
We present the semantical characterization for the refined normalization operation based
on a refined version of the region equivalence from Definition 6.
Definition 10 (Normalization Using Difference Constraints) Let stand for a finite
set of difference constraints of the form for , and
, and for a clock ceiling. Two clock assignments are equivalent, denoted
if the following holds:
– and
– for all , iff .
The semantics of the refined -normalization operation on zones is defined as follows:

norm

Note that the refined region equivalence is indexed by both a clock ceiling and a finite
set of difference constraints , and so is the normalization operation.
Since the number of regions induced by is finite and there are only finitely many
constraints in , induces finitely many equivalence classes. Thus for any given
zone , norm is well-defined in the sense that it contains only a finite set of
equivalence classes though the set may not be a convex zone, and it can be computed
effectively according to the refined regions. In general, norm is a non-convex
zone, which can be implemented as the union of a finite list of convex zones. The next
section will show how to compute this efficiently.
The refined zone-normalization gives rise to a finite characterization for .
Definition 11 norm if .
The following states the correctness and finiteness of .
Theorem 3 Assume a timed automaton with initial state , whose maximal clock
constants are bounded by a clock ceiling , and whose guards contain only a finite set
of difference constraints denoted .
1. (soundness) implies for all
such that for all .
2. (Completeness) with for all implies
for some such that
3. (Finiteness) The transition relation is finite.
3.4 Symbolic Reachability Analysis

Model-checking concerns two types of properties liveness and safety. The essential
algorithm of checking liveness properties is loop detection, which is computationally
expensive. The main effort on verification of timed systems has been put on safety
properties that can be checked using reachability analysis by traversing the state-space
of timed automata.

Algorithm 1 Reachability analysis

PASSED WAIT
while WAIT do
take from WAIT
if then return “YES”
if for all PASSED then
add to PASSED
for all such that do
add to WAIT
end for
end if
end while
return “NO”

Reachability analysis can be used to check properties on states. It consists of two basic
steps, computing the state-space of an automaton under consideration, and searching for
states that satisfy or contradict given properties. The first step can either be performed
prior to the search, or done on-the-fly during the search process. Computing the state-
space on-the-fly has an obvious advantage over pre-computing, in that only the part of
the state-space needed to prove the property is generated. It should be noted though, that
even on-the-fly methods will generate the entire state-space to prove certain properties,
e.g. invariant properties.

Several model-checkers for timed systems are designed and optimized for reachability
analysis based on the symbolic semantics and the zone-representation (see Section 4).
As an example, we present the core of the verification engine of U PPAAL (see Algo-
rithm 1).

Assume a timed automaton with a set of initial states and a set of final states (e.g.
the bad states) characterized as and respectively. Assume that is the
clock ceiling defined by the maximal constants appearing in and , and denotes
the set of difference constraints appearing in and . Algorithm 1 can be used to
check if the initial states may evolve to any state whose location is and whose clock
assignment satisfies . It computes the normalized zone-graph of the automaton on-
the-fly, in search for symbolic states containing location and zones intersecting with
.
The algorithm computes the transitive closure of step by step, and at each step,
checks if the reached zones intersect with . From Theorem 2, it follows that the algo-
rithm will return with a correct answer. It is also guaranteed to terminate because
is finite. As mentioned earlier, for a given timed automaton with a fixed set of clocks
whose maximal constants are bounded by a clock ceiling , and a fixed set of diago-
nal constraints contained in the guards, the number of all possible normalized zones is
bounded because a normalized zone can not contain arbitrarily large or arbitrarily small
constants. In fact the smallest possible zones are the refined regions. Thus the whole
state-space of a timed automaton can only be partitioned into finitely many symbolic
states and the worst case is the size of the region graph of the automaton, induced by
the refined region equivalence. Therefore, the algorithm is working on a finite structure
and it will terminate.
Algorithm 1 also highlights some of the issues in developing a model-checker for timed
automata. Firstly, the representation and manipulation of states, primarily zones, is cru-
cial to the performance of a model-checker. Note that in addition to the operations to
compute the successors of a zone according to , the algorithm uses two more op-
erations to check the emptiness of a zone as well as the inclusion between two zones.
Thus, designing efficient algorithms and data-structures for zones is a major issue in
developing a verification tool for timed automata, which is addressed in Section 4. Sec-
ondly, PASSED holds all encountered states and its size puts a limit on the size of sys-
tems we can verify. This raises the research challenges e.g. state compression [Ben02],
state-space reduction [BJLY98] and approximate techniques [Bal96].

4 DBM: Algorithms and Data Structures

The preceding section presents the key elements needed in symbolic reachability anal-
ysis. Recall that the operations on zones are all defined in terms of sets of clock assign-
ments. It is not clear how to compute the result of such an operation. In this section, we
describe how to represent zones, compute the operations and check properties on zones.
Pseudo code for the operations is given in the appendix.

4.1 DBM basics

Recall that a clock constraint over is a conjunction of atomic constraints of the form
and where , and . A zone
denoted by a clock constraint is the maximal set of clock assignments satisfying .
The most important property of zones is that they can can be represented as matrices
i.e. DBMs (Difference Bound Matrices) [Bel57,Dil89], which have a canonical repre-
sentation. In the following, we describe the basic structure and properties of DBMs.
To have a unified form for clock constraints we introduce a reference clock with the
constant value 0. Let . Then any zone can be rewritten as a
conjunction of constraints of the form for , and .
Naturally, if the rewritten zone has two constraints on the same pair of variables only the
intersection of the two is significant. Thus, a zone can be represented using at most
atomic constraints of the form such that each pair of clocks is mentioned
only once. We can then store zones using matrices where each element in
the matrix corresponds to an atomic constraint. Since each element in such a matrix
represents a bound on the difference between two clocks, they are named Difference
Bound Matrices (DBMs). In the following presentation, we use to denote element
in the DBM representing the zone .
To construct the DBM representation for a zone , we start by numbering all clocks
in as and the index for is 0. Let each clock be denoted by one row in the
matrix. The row is used for storing lower bounds on the difference between the clock
and all other clocks, and thus the corresponding column is used for upper bounds. The
elements in the matrix are then computed in three steps.
– For each constraint of , let .
– For each clock difference that is unbounded in , let . Where
is a special value denoting that no bound is present.
– Finally add the implicit constraints that all clocks are positive, i.e. , and
that the difference between a clock and itself is always 0, i.e. .
As an example, consider the zone
. To construct the matrix representation of , we number the clocks
in the order . The resulting matrix representation is shown below:

To manipulate DBMs efficiently we need two operations on bounds: comparison and

addition. We define that , if and
. Further we define addition as , and
.

Canonical DBMs Usually there are an infinite number of zones sharing the same solu-
tion set. However, for each family of zones with the same solution set there is a unique
constraint where no atomic constraint can be strengthened without losing solutions.
To compute the canonical form of a given zone we need to derive the tightest constraint
on each clock difference. To solve this problem, we use a graph-interpretation of zones.
A zone may be transformed to a weighted graph where the clocks in are nodes
and the atomic constraints are edges labeled with bounds. A constraint in the form of
will be converted to an edge from node to node labeled with ,
namely the distance from to is bounded by .
 (a) (b)

Fig. 8. Graph interpretation of the example zone and its closed form

As an example, consider the zone

. By combining the atomic constraints and we derive
that , i.e. the bound on can be strengthened. Consider the graph
interpretation of this zone, presented in Fig. 8(a). The tighter bound on can be
derived from the graph, using the path , giving the graph in Fig. 8(b). Thus,
deriving the tightest constraint on a pair of clocks in a zone is equivalent to finding the
shortest path between their nodes in the graph interpretation of the zone. The conclusion
is that a canonical, i.e. closed, version of a zone can be computed using a shortest path
algorithm. Floyd-Warshall algorithm [Flo62] (Algorithm 2) is often used to transform
zones to canonical form. However, since this algorithm is quite expensive (cubic in the
number of clocks), it is desirable to make all frequently used operations preserve the
canonical form, i.e. the result of performing an operation on a canonical zone should
also be canonical.

Minimal Constraint Systems A zone may contain redundant constraints. For example,
a zone contains constraints and . The constraint
is obviously redundant because it may be derived from the first two. It is desirable to
remove such constraints to store only the minimal number of constraints. Consider, for
instance, the zone . This
is a zone in a minimal form containing only five constraints. The closed form of this
zone contains more than 12 constraints. It is known, e.g. from [LLPY97], that for each
zone there is a minimal constraint system with the same solution set. By computing this
minimal form for all zones and storing them in memory using a sparse representation
we might reduce the memory consumption for state-space exploration. This problem
has been thoroughly investigated in [LLPY97,Pet99,Lar00].

The following is a summary of the published work on the minimal representation of

zones. We present an algorithm that computes the minimal form of a closed DBM.
Closing a DBM corresponds to computing the shortest path between all clocks. Our
goal is to compute the minimal set of bounds for a given shortest path closure. For
clarity, the algorithm is presented in terms of directed weighted graphs. However, the
results are directly applicable to the graph interpretation of DBMs.
First we introduce some notation: we say that a cycle in a graph is a zero cycle if the
sum of weights along the cycle is 0, and an edge is redundant if there is
another path between and where the sum of weights is no larger than .

In graphs without zero cycles we can remove all redundant edges without affecting the
shortest path closure [LLPY97]. Further, if the input graph is in shortest path form (as
for closed DBMs) all redundant edges can be located by considering alternative paths
of length two.

As an example, consider Fig. 9. The figure shows the shortest path closure for a zero-
cycle free graph (a) and its minimal form (b). In the graph we find that is
made redundant by the path and can thus be removed. Further, the edge
is redundant due to . Note that we consider edges marked
as redundant when searching for new redundant edges. The reason is that we let the
redundant edges represent the path making them redundant, thus allowing all redundant
edges to be located using only alternative paths of length two. This procedure is repeated
until no more redundant edges can be found.

5 5
15

7
12
8
6

2
13
7

13

1 1

(a) (b)

Fig. 9. A zero cycle free graph and its minimal form

This gives the procedure for removing redundant edges presented in Algo-
rithm 3. The algorithm can be directly applied to zero-cycle free DBMs to compute
the minimal number of constraints needed to represent a given zone.

However, this algorithm will not work if there are zero-cycles in the graph. The reason
is that the set of redundant edges in a graph with zero-cycles is not unique. As an
example, consider the graph in Fig. 10(a). Applying the above reasoning on this graph
would remove based on the path . It would also remove the
edge based on the path . But if both these edges are removed
it is no longer possible to construct paths leading into . In this example there is a
dependence between the edges and such that only one of them can
be considered redundant.
 -2 -2

2 2

3
3

3
5

(a) (b)

Fig. 10. A graph with a zero-cycle and its minimal form

The solution to this problem is to partition the nodes according to zero-cycles and build
a super-graph where each node is a partition. The graph from Fig. 10(a) has two parti-
tions, one containing and and the other containing . To compute the edges in
the super-graph we pick one representative for each partition and let the edges between
the partitions inherit the weights from edges between the representatives. In our exam-
ple, we choose and as representatives for their equivalence classes. The edges in
the graph are then and . The super-graph is clearly
zero-cycle free and can be reduced using Algorithm 3. This small graph can not be
reduced further. The relation between the nodes within a partition is uniquely defined
by the zero-cycle and all other edges may be removed. In our example all edges within
each equivalence class are part of the zero-cycle and thus none of them can be removed.
Finally the reduced super-graph is connected to the reduced partitions. In our example
we end up with the graph in Fig. 10(b). Pseudo-code for the reduction-procedure is
shown in Algorithm 4.

Now we have an algorithm for computing the minimal number of edges to represent
a given shortest path closure that can be used to compute the minimal number of con-
straints needed to represent a given zone.

4.2 Basic Operations on DBMs

This subsection presents all the basic operations on DBMs except the ones for zone-
normalization, needed in symbolic state space exploration of timed automata, both for
forwards and backwards analysis. The two operations for zone-normalization are pre-
sented in the next subsection.

First note that even if a verification tool only explores the state space in one direction
all operations are still useful for other purposes, e.g. for generating diagnostic traces.
The operations are illustrated graphically in Fig. 11.

To simplify the presentation we assume that the input zones are consistent and in canon-
ical form. The basic operations on DBMs can be divided into two classes:
 up( ) down( )

free( ) reset( ) copy( )

and( ) norm shift

Fig. 11. DBM operations applied to the same zone where for norm , is defined by
and
 1. Property-Checking: This class includes operations to check the consistency of a
DBM, the inclusion between zones, and whether a zone satisfies a given atomic
constraint.

2. Transformation: This class includes operations to compute the strongest postcon-

dition and weakest precondition of a zone according to conjunction with guards,
time delay and clock reset.

Property-Checking

consistent( ) The most basic operation on a DBM is to check if it is consistent,

i.e. if the solution set is non-empty. In state-space exploration this operation is used to
remove inconsistent states from the exploration.

For a zone to be inconsistent there must be at least one pair of clocks where the up-
per bound on their difference is smaller than the lower bound. For DBMs this can be
checked by searching for negative cycles in the graph interpretation. However, the most
efficient way to implement a consistency check is to detect when an upper bound is set
to lower value than the corresponding lower bound and mark the zone as inconsistent by
setting to a negative value. For a zone in canonical form this test can be performed
locally. To check if a zone is inconsistent it will then be enough to check whether
is negative.

relation( ) Another key operation in state space exploration is inclusion check-

ing for the solution sets of two zones. For DBMs in canonical form, the condition that
for all clocks is necessary and sufficient to conclude that .
Naturally the opposite condition applies to checking if . This allows for the
combined inclusion check described in Algorithm 5.

satisfied( ) Sometimes it is desirable to non-destructively check

if a zone satisfies a constraint, i.e. to check if the zone is consistent
without altering . From the definition of the consistent-operation we know that
a zone is consistent if it has no negative cycles. Thus, checking if
is non-empty can be done by checking if adding the guard to the zone would introduce
a negative cycle. For a DBM on canonical form this test can be performed locally by
checking if is negative.

Transformations
up( ) The up operation computes the strongest postcondition of a zone with respect
to delay, i.e. up( ) contains the clock assignments that can be reached from by
delay. Formally, this operation is defined as up .
Algorithmically, up is computed by removing the upper bounds on all individual clocks
(In a DBM all elements are set to ). This is the same as saying that any clock
assignment in a given zone may delay an arbitrary amount of time. The property that
all clocks proceed at the same speed is ensured by the fact that constraints on the dif-
ferences between clocks are not altered by the operation.
This operation preserves the canonical form, i.e. applying up to a canonical DBM will
result in a new canonical DBM. The up operation is also presented in Algorithm 6.

down( ) This operation computes the weakest precondition of with respect to

delay. Formally down , i.e. the set of clock assignments
that can reach by some delay . Algorithmically, down is computed by setting the
lower bound on all individual clocks to . However due to constraints on clock
differences this algorithm may produce non-canonical DBMs. As an example, consider
the zone in Fig. 12(a). When down is applied to this zone (Fig. 12(b)), the lower bound
on is and not , due to constraints on clock differences. Thus, to obtain an algorithm
that produce canonical DBMs the difference constraints have to be taken into account
when computing the new lower bounds.

(a) (b)

Fig. 12. Applying down to a zone.

To compute the lower bound for a clock , start by assuming that all other clocks have
the value 0. Then examine all difference constraints and compute a new lower
bound for under this assumption. The new bound on will be the minimum bound
on found in the DBM. Pseudo-code for down is presented in Algorithm 7.

and( ) The most used operation in state-space exploration is conjunc-

tion, i.e. adding a constraint to a zone. The basic step of the and operation is to check
if and in this case set the bound to . If the bound has been
altered, i.e. if adding the guard affected the solution set, the DBM has to be put back on
canonical form. One way to do this would be to use the generic shortest path algorithm,
however for this particular case it is possible to derive a specialization of the algorithm
allowing re-canonicalization in instead of .
The specialized algorithm takes the advantage that is the only bound that has been
changed. Since the Floyd-Warshall algorithm is insensitive to how the nodes in the
graph are ordered, we may decide to treat and last. The outer loop of Algorithm 2
will then only affect the DBM twice, for and . This allows the canonical-
isation algorithm to be reduced to checking, for all pairs of clocks in the DBM, if the
path via either or is shorter than the direct connection. The pseudo code for this
is presented in Algorithm 8.

free( ) The free operation removes all constraints on a given clock, i.e. the
clock may take any positive value. Formally this is expressed as free
. In state-space exploration this operation is used in combination
with conjunction, to implement reset operations on clocks. It can be used in both for-
wards and backwards exploration, but since forwards exploration allows other more
efficient implementations of reset, free is only used when exploring the state-space
backwards.
A simple algorithm for this operation is to remove all bounds on in the DBM and
set . However, the result may not be on canonical form. To obtain an
algorithm preserving the canonical form, we change how new difference constraints
regarding are derived. We note that the constraint can be combined with
constraints of the form to compute new bounds for . For instance,
if we can derive that . To obtain a DBM on canonical form we
derive bounds for based on instead of setting .In Algorithm 9 this
is presented as pseudo code.

reset( ) In forwards exploration this operation is used to set clocks to

specific values, i.e. reset . Without the require-
ment that output should be on canonical form, reset can be implemented by setting
, and remove all other bounds on . However, if we
instead of removing the difference constraints compute new values using constraints on
the other clocks, like in the implementation of free, we obtain an implementation that
preserve the canonical form. Such an implementation is presented in Algorithm 10.

copy( ) This is another operation used in forwards state-space exploration.

It copies the value of one clock to another. Formally, we define copy as
. As reset, copy can be implemented by assigning
, , removing all other bounds on and re-canonicalize the zone.
However, a more efficient implementation is obtained by assigning ,
and then copy the rest of the bounds on from . For pseudo code, see
Algorithm 11
shift( ) The last reset operation is shifting a clock, i.e. adding or
subtracting a clock with an integer value, i.e. shift
. The definition gives a hint on how to implement the operation. We can
view the shift operation as a substitution of for in the zone. With this reasoning
is added to the upper and lower bounds of . However, since lower bounds on
are represented by constraints on , is subtracted from all those bounds. This
operation is presented in pseudo-code in Algorithm 12

4.3 Zone-Normalization

The operations for zone-normalization are to transform zones which may contain arbi-
trarily large constants to zones containing only bounded constants in order to obtain a
finite zone-graph.

norm For a timed automaton and a safety property to be checked, that contain
no difference constraints, the -normalization norm is needed, and it can be com-
puted based on the canonical form of (see Section 3). It is to remove all upper bounds
higher than the maximal constants and lower all lower bounds higher than the maximal
constants down to the maximal constants. The result of norm is illustrated graph-
ically in Fig. 11.
In the canonical DBM representation of a zone, the operation consists of two steps:
first, remove all bounds such that and second, set all
bounds such that to . Pseudo-code for
-normalization is given in Algorithm 13 where denotes .
The -normalization will not preserve the canonical form of a DBM, and the best way
to put the result back on canonical form is to use Algorithm 2.

norm For automata containing difference constraints in the guards, it is more

complicated and expensive to compute the normalized zones. Assume an automataon
containing the set of difference constraints and the maximal clock constants bounded
by a clock ceiling . Assume a zone of to be normalized. According to the se-
mantical characterization for norm in Definition 10 we know that if a difference
constraint is not satisfied by any assignment in the zone , it should not be satisfied by
any assignment in the normalized one, norm , and if all assignments in satisfy
a difference constraint then so should all assignments in norm . This leads to a
core normalization algorithm consisting of three steps.
1. Collect all difference constraints used as guards in such that
(a) is empty. This is the case when is outside of .
(b) is empty. That is the case when contains completely.
Let
 2. Compute norm , that is, to run the -normalization without considering the
difference constraints.
3. Subtract (or cut) the -normalized zone of by all difference constraints in ,
that is to compute norm .
The last step is to make sure that none of the collected difference constraints are satisfied
after the -normalization. In Algorithm 14, the core normalization is given as pseudo
code. The set used in the algorithm is the set of difference constraints appearing
in the automaton under consideration with the maximal clock constants bounded by a
given clock ceiling as input.
It appears to be the case that norm is the normalized zone we are looking
for. Unfortunately this is not. The core normalization does not handle the third case
when a difference constraint splits the zone to be normalized. That is, there is a
guard such that and . In this case, we need to split by
using Algorithm 15, and then apply the core normalization algorithm to the parts of
separately, which are the sub-zones of resulted from the splitting. Each of the sub-
zone should satisfy either or for all . The union of
the normalized sub-zones using the above core normalization algorithm is what we are
looking for, that is norm .
The complete normalization procedure is presented in Algorithm 16. The splitting, de-
noted by split in the description, is used as a preprocessing step and then the core nor-
malization algorithm (i.e. Algorithm 14) is applied to all the resulted sub-zones resulted
from the splitting.
Finally, the symbolic transition relation can be computed as follows: If
, for all used in Algorithm 16, i.e. the algorithm
for norm .
To demonstrate the normalization procedure we apply it to the zone for location in
our counter example. The difference constraints in the example are
and . The zone contains both clock assignments satisfying and
assignments satisfying its negation, and thus we have to split the zone with respect to
this constraint prior to normalization, giving the zones below.

(a) satisfying (b) satisfying

Zone (a) above does not contain any clock assignments satisfying and thus it will not
be split further. Zone (b) however needs to be split into two parts satisfying and .
This gives us the following zones to normalize by the core normalization procedure.
 (a) and (b) and (c) and

The sets of difference constraints not satisfied by the zones (a), (b) and (c) shown above
are: respectively. We
apply -normalization to each of them, giving:

(A) and (B) and (C) and

Since the -normalized zones (A), (B) and (C) shown above do not enable any con-
straint in , we need not to subtract the corresponding difference constraints from
the zones. Finally, we note that, as the un-normalized zones (a), (b) and (c), none of the
normalized zones (A), (B) and (C) intersects with ; the transition from to
is not enabled by the normalization procedure.

4.4 Zones in Memory

This section describes a number of techniques for storing zones in computer memory.
The section starts by describing how to map DBM elements on machine words. It con-
tinues by discussing how to place two-dimensional DBMs in linear memory and ends
by describing how to store zones using a sparse representation.

Storing DBM Elements To store a DBM element in memory we need to keep track
of the integer limit and whether it is strict or not. The range of the integer limit is
typically much lower than the maximum value of a machine word and the strictness can
be stored using just one bit. Thus, it is possible to store both the limit and the strictness in
different parts of the same machine word. Since comparing and adding DBM elements
are frequently used operations it is crucial for the performance of a DBM package that
they can be efficiently implemented for the chosen encoding. Fortunately, it is possible
to construct an encoding of bounds in machine words, where checking if is less than
can be performed by checking if the encoded is smaller than the encoded .
The encoding we propose is to use the least significant bit (LSB) of the machine word
to store whether the bound is strict or not. Since strict bounds are smaller than non-
strict we let a set (1) bit denote that the bound is non-strict while an unset (0) bit denote
that the bound is strict. The rest of the bits in the machine word are used to store the
integer bound. To encode we use the largest positive number that fit in a machine
word (denoted MAX_INT).
For good performance we also need an efficient implementation of addition of bounds.
For the proposed encoding Algorithm 17 adds two encoded bounds and . The sym-
bols and in the algorithm are used to denote bitwise-and and bitwise-or, respectively.

Placing DBMs in Memory Another issue is how to store two-dimensional DBMs

in linear memory. In this section we present two different techniques and give a brief
comparison between them. The natural way to put matrices in linear memory is to store
the elements by row (or by column), i.e. each row of the matrix is stored consequently
in memory. This layout has one big advantage, its good performance. This advantage is
mainly due to the simple function for computing the location of a given element in the
matrix: . This function can (on most computers) be computed
in only two instructions. This is important since all accesses to DBM elements use this
function. How the different DBM elements are place in memory with this layout if
presented in Fig. 13(a).
The second way to store a DBM in linear memory is based on a layered model where
each layer consists of the bounds between a clock and the clocks with lower index in the
DBM. In this representation it is cheap to implement local clocks, since all information
about the local clocks are localised at the end of the DBM. The drawback with this
layout is the more complicated function from DBM indices to memory locations. For
this layout we have:

if
otherwise

This adds at least two instructions (one comparison and one conditional jump) to the
transformation. This may not seem such a huge overhead, but it is clearly noticeable.
The cache performance is also worse when using this layout than when storing the
DBMs row-wise. This layout is illustrated in Fig. 13(b).
The conclusion is that unless the tool under construction supports adding and removing
clocks dynamically the row-wise mapping should be used. On the other hand, if the tool
supports local clocks the layered mapping may be preferable since no reordering of the
DBM is needed when entering or leaving a clock scope.

Storing Sparse Zones In most verification tools, the majority of the zones are kept
in the set of states already visited during verification. They are used as a reference to
ensure termination by preventing states from being explored more than once. For the
 (a) Row wise (b) Layered

Fig. 13. Different layouts of DBMs in memory

states in this set we may benefit from storing only the minimal number of constraints
using a sparse representation.

A straight forward implementation is to store a sparse zone as a vector of constraints

of the form . We may save additional memory by omitting implicit constraints,
such as . A downside with using sparse zones is that each constraint require
twice the amount of memory needed for a constraint in a full DBM, since the sparse
representation must store clock indices explicitly. Thus, unless half of the constraints in
a DBM are redundant we do not gain from using sparse zones.

A nice feature of the sparse representation is that checking whether a zone repre-
sented as a full DBM is included in a sparse zone may be implemented without
computing the full DBM for . It suffices to check for all constraints in that the
corresponding bound in is tighter. However, to check if we have to com-
pute the full DBM for .

5 U PPAAL

In the last decade, there have been a number of tools developed based on timed automata
to model and verify real time systems, notably Kronos [Yov97] and U PPAAL [LPY97].
As an example, we give a brief introduction to the U PPAAL tool (www.uppaal.com).

U PPAAL is a tool box for modeling, simulation and verification of timed automata,
based on the algorithms and data-structures presented in previous sections. The tool was
released for the first time in 1995, and since then it has been developed and maintained
in collaboration between Uppsala University and Aalborg University.

5.1 Modeling with U PPAAL

The core of the U PPAAL modeling language is networks of timed automata. In addition,
the language has been further extended with features to ease the modeling task and to
guide the verifier in state space exploration. The most important of these are shared
integer variables, urgent channels and committed locations.
Networks of Timed Automata A network of timed automata is the parallel compo-
sition of a set of timed automata , called processes, combined
into a single system by the CCS parallel composition operator with all external actions
hidden. Synchronous communication between the processes is by hand-shake synchro-
nization using input and output actions; asynchronous communication is by shared vari-
ables as described later. To model hand-shake synchronization, the action alphabet is
assumed to consist of symbols for input actions denoted , output actions denoted ,
and internal actions represented by the distinct symbol .
An example system composed of two timed automata is shown in Fig. 14. The network
models a time-dependent light-switch (to the left) and its user (to the right). The user
and the switch communicate using the label press. The user can press the switch (press!)
and the switch waits to be pressed (press?). The product automaton, i.e. the automaton
describing the combined system is shown in Fig. 15.

t press! study
off
y<5

x>10
press? press! press!
press?
x:=0 y:=0
idle
dim press?

x<=10
press!
press? y>10
y:=0
press!
bright relax

Fig. 14. Network of Timed Automata

The semantics of networks is given as for single timed automata in terms of transition
systems. A state of a network is a pair where denotes a vector of current locations
of the network, one for each process, and is as usual a clock assignment remembering
the current values of the clocks in the system. A network may perform two types of
transitions, delay transitions and discrete transitions. The rule for delay transitions is
similar to the case of single timed automata where the invariant of a location vector
is the conjunction of the location invariants of the processes. There are two rules for
discrete transitions defining local actions where one of the processes makes a move on
its own, and synchronizing actions where two processes synchronize on a channel and
move simultaneously.
Let stand for the th element of a location vector and for the vector with
being substituted with . The transition rules are as follows:

– if and , where

– if ,
 bright, study
off,idle dim,relax
x:=0, y:=0
x<=10,y>10
x<=10
dim,t x>10, y>10

x:=0, y:=0
y<5 x>10
x>10
x>10

off,study bright,relax dim,study

x:=0 x<10 x<=10

y:=0
bright,t off,t bright, idle
dim,idle
x<=10 y:=0 x>10 y:=0 y:=0
y<5 y<5
x>10 y>10
y:=0 x:=0
off,relax
y:=0

Fig. 15. Product Automaton for the Network in Fig. 14

– if there exist such that

1. , and , and
2. and .
Note that a network is a closed system which may not perform any external action. In
fact, the CCS hiding operator is embedded in the above rules.

Shared Integer Variables Clocks may be considered as typed variables with type
clock. In U PPAAL, one may also use integer variables and arrays of integers, each with
a bounded domain and an initial value. Predicates over the integer variables can be
used as guards on the edges of an automaton process and the integer variables may
be updated using resets on the edges. In the current version of U PPAAL, the syntax
related to integer variables resembles the standard C syntax. Both integer guards and
integer resets are standard C expressions with the restriction that guards can not have
side-effects.
The semantics of networks can be defined accordingly. The clock assignment in the
state configuration can be extended to store the values of integer variables in ad-
dition to clocks. Since delay does not affect the integer variables, the delay transitions
are the same as for networks without integer variables. The action transitions are ex-
tended in the natural way, i.e. for an action transition to be enabled the extended clock
assignment must also satisfy all integer guards on the corresponding edges and when a
transition is taken the assignment is updated according to the integer and clock resets.
There is a problem with variable updating in a synchronizing transition where one of the
processes participating in the transition updates a variable used by the other. In U PPAAL,
for a synchronization transition, the resets on the edge with an output-label is performed
before the resets on the edge with an input-label. This destroys the symmetry of input
and output actions. But it gives a natural and clear semantics for variable updating. The
transition rule for synchronization is modified accordingly:
– if there exist such that

1. , and , and
2. and

Urgent Channels To model urgent synchronizing transitions, which should be taken

as soon as they are enabled, U PPAAL supports a notion of urgent channels. An urgent
channel works much like an ordinary channel, but with the exception that if a syn-
chronization on an urgent channel is possible the system may not delay. Interleaving
with other enabled action transitions, however, is still allowed. In order to keep clock
constraints representable using convex zones, clock guards are not allowed on edges
synchronizing on urgent channels.
To illustrate why this restriction is necessary, consider the network shown in Fig. 16.
Both processes may independently go from their first state to their second state. In the
second state, the first process must delay for at least 10 time units before it is allowed to
synchronize on the urgent channel . In the second state, the other process must delay
for at least 5 time units before it is allowed to synchronize on the urgent channel . As
soon as both processes have spent the minimal time periods required in their second
state, they should synchronize and move to their third state. The problem is in S2,T2
where the zone may be for example which is a
non-convex zone.

S0 x:=0 S1 x>=10 S2

u!

T0 y:=0 T1 y>=5 T2

u?

Fig. 16. An example of a network with non convex timing regions.

For this example, the problem can be solved by splitting the non-convex zone into two
convex ones. But in general, the splitting is a computationally expensive operation. In
U PPAAL, we decided to avoid such operations for the sake of efficiency. So only integer
guards are allowed on edges involving synchronizations on urgent channels.
Committed Locations To model atomic sequences of actions, e.g. atomic broadcast or
multicast, U PPAAL supports a notion of committed locations. A committed location is
a location where no delay is allowed. In a network, if any process is in a committed lo-
cation then only action transitions starting from such a committed location are allowed.
Thus, processes in committed locations may be interleaved only with processes in a
committed location.
Syntactically, each process in a network may have a subset of loca-
tions marked as committed locations. Let denote the set of locations in , that are
committed. For the same reason as in the case of urgent channels, as a syntactical re-
striction, no clock constraints but predicates over integer variables are allowed to appear
in a guard on an outgoing edge from a committed location.
The transition rules are given in the following, where denotes the transition relation
for a network with committed locations and denotes the transition relation for the
same network without considering the committed locations.

– if and

– if

1. , and
2. Either or
– if

1. , and
2. Either , or

5.2 Verifying with U PPAAL

The model checking engine of U PPAAL is designed to check a subset of TCTL formula
[ACD90] for networks of timed automata. The formulas should be one of the following
forms:
– A[] — Invariantly .
– E<> — Possibly .
– A<> — Always Eventually .
– E[] — Potentially Always .
– - -> — always leads to . This is the shorthand for A[] ( A<> .
where are local properties that can be checked locally on a state, i.e. boolean ex-
pressions over predicates on locations and integer variables, and clock constraints in
.
 (a) A[] (b) E<>

(c) A<> (c) E[]

Fig. 17. (T)CTL-formulae

The transition system of a network may be unfolded into an infinite tree containing
states and transitions. The semantics of the formulas are defined over such a tree. The
letters A and E are used to quantify over paths. A is used to denote that the given prop-
erty should hold for all paths of the tree while E denotes that there should be at least
one path of the tree where the property holds. The symbols [] and <> are used to quan-
tify over states within a path. [] denotes that all states on the path should satisfy the
property, while <> denotes that at least one state in the execution satisfies the property.
In Fig. 17 the four basic property types are illustrated using execution trees, where the
dashed arrows are used to denote repetitions in the trees. The states satisfying are
denoted by filled nodes and edges corresponding to the paths are highlighted using bold
arrows.
The two types of properties most commonly used in verification of timed systems are
E<> and A[] . They are dual in the sense that E<> is satisfied if and only if A[]
is not satisfied. This type of properties are often classified as safety properties, i.e. mean-
ing that the system is safe in the sense that a specified hazard can not occur. It is also
possible to transform so called bounded liveness properties, i.e. properties stating that
some desired state will be reached within a given time, into safety properties using ob-
server automata [ABL98] or by annotating the model [LPY98]. For example, to check
if an automaton will surely reach a location within 10 time units, we use one clock
(set to initially) and introduce a boolean variable (set to false initially). For each
incoming edge to in the automaton, set to true. Then if the automaton satisfies the
invariant property " ", it will surely reach within 10 time units provided that
the automaton contains no zeno loops which stop time to progress.
The other three types of properties are commonly classified as unbounded liveness prop-
erties, i.e. they are used to express and check for global progress. These properties are
not commonly used in U PPAAL case-studies. It seems to be the case that bounded live-
ness properties are more important for timed systems.

5.3 The U PPAAL Architecture

Fig. 18. Schematic view of the reachability pipeline in U PPAAL.

To provide a system that is both efficient, easy to use and portable, U PPAAL is split into
two components, a graphical user interface written in Java and a verification engine
written in C++. The engine and the GUI communicate using a protocol, allowing the
verification to be performed either on the local workstation or on a powerful server in a
network.
To implement the reachability analysis algorithm 1, the U PPAAL verification engine is
organized as a pipeline that incarnates the natural data flow in the algorithm. A sketch
of this pipeline is shown in Fig. 18. This architecture simplifies both activating and
deactivating optimizations at runtime by inserting and removing stages dynamically,
and introducing new optimizations and features in the tool by implementing new or
changing existing stages.
In addition to the zone-manipulation algorithms described in Section 4 and the pipeline
architecture, in U PPAAL a number of optimizations have been implemented:
– Minimal constraint systems [LLPY97] and CDDs [LPWY99,BLP 99], to reduce
memory consumption by removing redundant information in zones before storing
them.
– Selective storing of states in PASSED [LLPY97], where static analysis is used to
detect states that can be omitted safely from PASSED without losing termination.
 – Compression [Ben01] and sharing [BDLY03,DBLY03] of state data, to reduce the
memory consumption of PASSED and WAIT.
– Active clock reduction [DY96], that use live-range analysis to determine when the
value of a clock is irrelevant. This does not only reduce the size of individual states
but also the perceived state-space.
– Supertrace [Hol91] and Hash Compaction [WL93,SD95] where already visited
states are stored only as hash signatures, and Convex-hull approximation [Bal96]
where convex hulls are used to approximate unions of zones, for reducing memory
consumption at a risk of inconclusive results.

Acknowledgements:

We would like to thank Pavel Krcal for pointing out an error in an early version of this
document.

Appendix: Pseudo-Code for Operations on DBMs

Algorithm 2 close( ): Floyds algorithm for computing shortest path

for to do
for to do
for to do

end for
end for
end for

Algorithm 3 Reduction of Zero-Cycle Free Graph with nodes

for to do
for to do
for to do
if then
Mark edge as redundant
end if
end for
end for
end for
Remove all edges marked as redundant.
Algorithm 4 Reduction of negative-cycle free graph with nodes

for to do
if Node is not in a partition then

for to do
if then
Node
end if
end for
end if
end for
Let be a graph without nodes.
for each do
Pick one representative Node
Add Node to
Connect Node to all nodes in using weights from .
end for
Reduce
for each do
Add one zero cycle containing all nodes in to
end for

Algorithm 5 relation( )

tt
tt
for to do
for to do

end for
end for
return

Algorithm 6 up( )

for to do

end for
Algorithm 7 down( )

for to do

for to do
if then

end if
end for
end for

Algorithm 8 and( )

if then

else if then

for to do
for to do
if then

end if
if then

end if
end for
end for
end if

Algorithm 9 free( )

for to do
if then

end if
end for
Algorithm 10 reset(

for to do

end for

Algorithm 11 copy( )

for to do
if then

end if
end for

Algorithm 12 shift( )

for to do
if then

end if
end for

Algorithm 13 norm )

for to do
for to do
if and then

else if and then

end if
end for
end for
close( )
Algorithm 14 Core normalization: Core-Norm

for all do
if then

end if
if then

end if
end for
norm
for all do

end for
return

Algorithm 15 Zone splitting: split

for all do
for all do
if and then

else

end if
end for

end for
return

Algorithm 16 Normalization: norm

for all split do

Core-Norm
end for
return

Algorithm 17 Algorithm for adding encoded bounds

if MAX_INT or MAX_INT then
return MAX_INT
else
return
end if
References
[ABL98] Luca Aceto, Augusto Bergueno, and Kim G. Larsen. Model checking via reacha-
bility testing for timed automata. In Proceedings, Fourth Workshop on Tools and
Algorithms for the Construction and Analysis of Systems, volume 1384 of Lecture
Notes in Computer Science. Springer-Verlag, 1998.
[ACD90] Rajeev Alur, Costas Courcoubetis, and David L. Dill. Model-checking for real-time
systems. In Proceedings, Seventh Annual IEEE Symposium on Logic in Computer
Science, pages 414–425. IEEE Computer Society Press, 1990.
[ACD93] Rajeev Alur, Costas Courcoubetis, and David L. Dill. Model-checking in dense real-
time. Journal of Information and Computation, 104(1):2–34, 1993.
[ACH94] Rajeev Alur, Costas Courcoubetis, and Thomas A. Henzinger. The observational
power of clocks. In International Conference on Concurrency Theory, pages 162–
177, 1994.
[AD90] Rajeev Alur and David L. Dill. Automata for modeling real-time systems. In Proceed-
ings, Seventeenth International Colloquium on Automata, Languages and Program-
ming, volume 443 of Lecture Notes in Computer Science, pages 322–335. Springer-
Verlag, 1990.
[AD94] Rajeev Alur and David L. Dill. A theory of timed automata. Journal of Theoretical
Computer Science, 126(2):183–235, 1994.
[AFH99] Rajeev Alur, Limor Fix, and Thomas A. Henzinger. Event-clock automata: a deter-
minizable class of timed automata. Theoretical Computer Science, 211(1–2):253–
273, 1999.
[AH94] Rajeev Alur and Thomas A. Henzinger. A really temporal logic. Journal of the ACM,
41(1):181–204, 1994.
[Bal96] Felice Balarin. Approximate reachability analysis of timed automata. In Proceedings,
17th IEEE Real-Time Systems Symposium. IEEE Computer Society Press, 1996.
[BD91] Bernard Berthomieu and Michel Diaz. Modeling and verification of timed depen-
dent systems using timed petri nets. IEEE Transactions on Software Engineering,
17(3):259–273, 1991.
[BDGP98] Beatrice Bérard, Volker Diekert, Paul Gastin, and Antoine Petit. Characterization of
the expressive power of silent transitions in timed automata. Fundamenta Informati-
cae, 36:145–182, 1998.
[BDLY03] Gerd Behrmann, Alexandre David, Kim G. Larsen, and Wang Yi. Unification & shar-
ing in timed automata verification. In Proceedings, Tenth International SPIN Work-
shop, volume 2648 of Lecture Notes in Computer Science. Springer-Verlag, 2003.
[Bel57] Richard Bellman. Dynamic Programming. Princeton University Press, 1957.
[Ben01] Johan Bengtsson. Reducing memory usage in symbolic state-space exploration for
timed systems. Technical Report 2001-009, Department of Information Technology,
Uppsala University, 2001.
[Ben02] Johan Bengtsson. Clocks, dbms and states in timed systems. Ph.D. Thesis, ACTA
Universitatis Upsaliensis 39, Uppsala University, 2002.
[BJLY98] Johan Bengtsson, Bengt Jonsson, Johan Lilius, and Wang Yi. Partial order reduc-
tions for timed systems. In Proceedings, Ninth International Conference on Concur-
rency Theory, volume 1466 of Lecture Notes in Computer Science, pages 485–500.
Springer-Verlag, 1998.
[BLP 99] Gerd Behrmann, Kim G. Larsen, Justin Pearson, Carsten Weise, and Wang Yi. Ef-
ficient timed reachability analysis using clock difference diagrams. In Proceedings,
Eleventh International Conference on Computer Aided Verification, volume 1633 of
Lecture Notes in Computer Science, pages 341–353. Springer-Verlag, 1999.
[BY03] Johan Bentsson and Wang Yi. On clock difference constraints and termination in
reachability analysis of timed automata. In Formal Methods and Software Engineer-
ing, 5th International Conference on Formal Engineering Methods, ICFEM 2003,
Singapore, November 5-7, 2003, Proceedings, volume 2885 of Lecture Notes in Com-
puter Science. Springer, 2003.
[Cer92] Karlis Cerans. Decidability of bisimulation equivalences for parallel timer processes.
In Computer Aided Verification, volume 663 of LNCS. Springer, 1992.
[Cha99] Zhou Chaochen. Duration calculus, a logical approach to real-time systems. Lecture
Notes in Computer Science, 1548:1–7, 1999.
[DBLY03] Alexandre David, Gerd Behrmann, Kim G. Larsen, and Wang Yi. A tool architec-
ture for the next genreation of U PPAAL. Technical Report 2003-011, Department of
Information Technology, Uppsala University, 2003.
[Dil89] David L. Dill. Timing assumptions and verification of finite-state concurrent systems.
In Proceedings, Automatic Verification Methods for Finite State Systems, volume 407
of Lecture Notes in Computer Science, pages 197–212. Springer-Verlag, 1989.
[DY96] Conrado Daws and Sergio Yovine. Reducing the number of clock variables of timed
automata. In Proceedings, 17th IEEE Real-Time Systems Symposium. IEEE Computer
Society Press, 1996.
[Flo62] Robert W. Floyd. Acm algorithm 97: Shortest path. Communications of the ACM,
5(6):345, June 1962.
[FPY02] Elena Fersman, Paul Pettersson, and Wang Yi. Timed automata with asynchronous
processes: Schedulability and decidability. In J.-P. Katoen and P. Stevens, editors,
Proc. of the 8th International Conference on Tools and Algorithms for the Construc-
tion and Analysis of Systems, number 2280 in Lecture Notes in Computer Science,
pages 67–82. Springer–Verlag, 2002.
[Hal93] N. Halbwachs. Delay analysis in synchronous programs. In Fifth Conference on
Computer-Aided Verification, Elounda (Greece), July 1993. LNCS 697, Springer Ver-
lag.
[HNSY92] Thomas A. Henzinger, Xavier Nicollin, Joseph Sifakis, and Sergio Yovine. Sym-
bolic model checking for real-time systems. In Proceedings, Seventh Annual IEEE
Symposium on Logic in Computer Science, pages 394–406, 1992.
[HNSY94] Thomas A. Henzinger, Xavier Nicollin, Joseph Sifakis, and Sergio Yovine. Symbolic
model checking for real-time systems. Journal of Information and Computation,
111(2):193–244, 1994.
[Hoa78] C.A.R. Hoare. Communicating sequential processes. Communications of the ACM,
21(8):666–676, August 1978.
[Hol91] Gerard J. Holzmann. Design and Validation of Computer Protocols. Prentice-Hall,
1991.
[Lar00] Fredrik Larsson. Efficient implementation of model-checkers for networks of timed
automata. Licentiate Thesis 2000-003, Department of Information Technology, Upp-
sala University, 2000.
[LLPY97] Kim G. Larsen, Fredrik Larsson, Paul Pettersson, and Wang Yi. Efficient verifica-
tion of real-time systems: Compact data structure and state space reduction. In Pro-
ceedings, 18th IEEE Real-Time Systems Symposium, pages 14–24. IEEE Computer
Society Press, 1997.
[LPWY99] Kim G. Larsen, Justin Pearson, Carsten Weise, and Wang Yi. Clock difference dia-
grams. Nordic Journal of Computing, 1999.
[LPY95] Kim G. Larsen, Paul Pettersson, and Wang Yi. Compositional and Symbolic Model-
Checking of Real-Time Systems. In Proc. of the 16th IEEE Real-Time Systems Sym-
posium, pages 76–87. IEEE Computer Society Press, December 1995.
[LPY97] Kim G. Larsen, Paul Petterson, and Wang Yi. U PPAAL in a nutshell. Journal on
Software Tools for Technology Transfer, 1997.
[LPY98] Magnus Lindahl, Paul Pettersson, and Wang Yi. Formal Design and Analysis of a
Gear-Box Controller. In Proceedings, Fourth Workshop on Tools and Algorithms for
the Construction and Analysis of Systems, number 1384 in Lecture Notes in Computer
Science, pages 281–297. Springer-Verlag, 1998.
[LPY01] Magnus Lindahl, Paul Pettersson, and Wang Yi. Formal Design and Analysis of a
Gearbox Controller. Springer International Journal of Software Tools for Technology
Transfer (STTT), 3(3):353–368, 2001.
[LW97] Kim Guldstrand Larsen and Yi Wang. Time-abstracted bisimulation: Implicit speci-
fications and decidability. Information and Computation, 134(2):75–101, 1997.
[Mil89] Robin Milner. Communication and Concurrency. Prentice Hall, 1989.
[NS94] Xavier Nicollin and Joseph Sifakis. The algebra of timed processes, ATP: Theory and
application. Journal of Information and Computation, 114(1):131–178, 1994.
[Pet99] Paul Pettersson. Modelling and Verification of Real-Time Systems Using Timed Au-
tomata: Theory and Practice. PhD thesis, Uppsala University, 1999.
[Rok93] Tomas Gerhard Rokicki. Representing and Modeling Digital Circuits. PhD thesis,
Stanford University, 1993.
[RR88] G. M. Reed and A. W. Roscoe. A timed model for communicating sequential pro-
cesses. Theoretical Computer Science, 58(1-3):249–261, 1988.
[SD95] Ulrich Stern and David L. Dill. Improved probabilistic verification by hash com-
paction. In Correct Hardware Design and Verification Methods: IFIP WG10.5 Ad-
vanced Research Working Conference Proceedings, 1995.
[WL93] Pierre Wolper and Dennis Leroy. Reliable hashing without collision detection. In
Proceedings, Fifth International Conference on Computer Aided Verification, volume
697 of Lecture Notes in Computer Science, pages 59–70. Springer-Verlag, 1993.
[Yi91] Wang Yi. CCS + time = an interleaving model for real time systems. In Proceed-
ings, Eighteenth International Colloquium on Automata, Languages and Program-
ming, volume 510 of Lecture Notes in Computer Science. Springer-Verlag, 1991.
[YJ94] Wang Yi and B. Jonsson. Decidability of timed language-inclusion for networks of
real-time communicating sequen tial processes. In Proc. Conf. on Foundations
of Software Technology and Theoretical Computer Science, volume 880 of Lecture
Notes in Computer Science. Springer-Verlag, 1994.
[YL93] Mihalis Yannakakis and David Lee. An efficient algorithm for minimizing real-time
transition systems. In Proceedings, Fifth International Conference on Computer
Aided Verification, volume 697 of Lecture Notes in Computer Science, pages 210–
224. Springer-Verlag, 1993.
[Yov97] Sergio Yovine. Kronos: a verification tool for real-time systems. Journal on Software
Tools for Technology Transfer, 1, October 1997.
[YPD94] Wang Yi, Paul Petterson, and Mats Daniels. Automatic verification of real-time com-
municating systems by constraint-solving. In Proceedings, Seventh International
Conference on Formal Description Techniques, pages 223–238, 1994.