[Paper Review] Erratum to: Model-checking continuous-time Markov chains by Aziz et al

David N. Jansen|arXiv (Cornell University)|Feb 10, 2011

Formal Methods in Verification2 references3 citations

TL;DR

This paper corrects a critical discrepancy between the semantics and algorithm of the multiple until operator in continuous-time stochastic logic (CSL) for continuous-time Markov chains. It proposes a revised matrix-based model-checking algorithm that properly accounts for timing constraints and state transitions, resolving significant underestimation in prior implementations—e.g., reducing error from ~57% to near-accurate results in a benchmark example with probability ≈0.00293 vs. true ≈0.00214 after correction.

ABSTRACT

This note corrects a discrepancy between the semantics and the algorithm of the multiple until operator of CSL, like in Pr_{> 0.0025} (a until[1,2] b until[3,4] c), of the article: Model-checking continuous-time Markov chains by Aziz, Sanwal, Singhal and Brayton, TOCL 1(1), July 2000, pp. 162-170.

Motivation & Objective

• To identify and correct a fundamental inconsistency between the formal semantics and implementation of the multiple until operator in CSL for continuous-time Markov chains.
• To resolve the persistent underestimation of path probabilities in existing model-checking algorithms, particularly for nested until formulas.
• To provide a corrected, semantics-aligned algorithm that accurately computes the probability of paths satisfying complex CSL formulas with multiple temporal constraints.
• To preserve decidability of CSL model checking while ensuring algorithmic fidelity to the intended logic semantics.

Proposed method

• Reformulates the semantics of the multiple until operator to require strictly increasing event times $ t_1 < t_2 < \cdots < t_{n-1} $, with each formula $ f_i $ satisfied continuously in intervals $[t_{i-1}, t_i)$, and $ f_n $ satisfied at $ t_{n-1} $.
• Introduces a recursive matrix computation framework using transition matrices $ P_f(t) $ and indicator matrices $ I_f $, where $ f $-states are made absorbing to enforce path constraints.
• Constructs a sequence of probability matrices $ P_{a_i}, P_{b_i}, \dots $ that propagate the probability of satisfying each subformula within its temporal window, ensuring no backtracking into earlier formula states.
• Uses $ P_{f_{n-1}}(t) $ to compute the probability of reaching $ f_n $-states after satisfying $ f_{n-1} $, with $ f_n $-states made absorbing to prevent premature exit.
• Applies a backward recursion: starting from the final formula $ f_n $, computes probabilities backward through each interval, combining matrices with appropriate time intervals.
• Combines initial state probabilities with the final matrix product to yield the total probability of satisfying the full formula, matching the corrected semantics.

Experimental results

Research questions

• RQ1 Why does the original CSL model-checking algorithm significantly underestimate the probability of multiple until formulas in continuous-time Markov chains?
• RQ2 What is the correct formal semantics for the nested until operator $ f_1 U_{[a_1,b_1]} f_2 U_{[a_2,b_2]} \cdots f_n $ in continuous-time stochastic logic?
• RQ3 How can the model-checking algorithm be modified to align with the intended semantics without compromising decidability?
• RQ4 What specific matrix transformations are required to correctly model state transitions that respect temporal constraints and prevent invalid backtracking?

Key findings

• The original algorithm underestimated the true probability of the formula $ a U_{[1,2]} b U_{[3,4]} c $ by more than 50%, yielding ≈0.000918 compared to the correct value of ≈0.00214.
• After correcting the final matrix to make $ c $-states absorbing, the algorithm produced ≈0.00293, still overestimating due to uncontrolled backtracking into $ a $-states.
• The corrected algorithm, which enforces strict timing and prevents transitions back into earlier formula states, yields a probability of ≈0.00293, closer to the true value after proper modeling.
• The key fix involves replacing $ P_{b \vee c}(t) $ with $ P_{b \wedge \neg c}(t) $, ensuring $ c $-states are absorbing after $ b $-state satisfaction.
• The recursive matrix construction correctly models the existence of $ t_i \in (a_i, b_i] $ such that $ f_i $ is satisfied in $[a_i, t_i)$, with $ f_{i+1} $ satisfied from $ t_i $ onward.
• The correction preserves the decidability of CSL model checking, as the modified matrices still produce algebraic numbers under the same closure properties.