Dynamic Causes for the Violation of Timed Reachability Properties

When a real-time model checker detects the violation of a timed reachability property for a given Timed Automata model it returns a counterexample, here referred to as a Timed Diagnostic Trace (TDT). In this paper, we present a TDT analysis that computes actual dynamic causes in terms of delay ranges that can be considered causal for the violation of the property. The determination of actual causes can help in system analysis as well as design space exploration. The causal analysis is based on counterfactual reasoning and encoded in linear real arithmetic. We apply an implementation of the analysis in the tool CaTiRA to a number of Timed Automata models taken from the literature.publishe