Reachability and liveness in parametric timed automata

We study timed systems in which some timing features are unknown parameters. Parametric timed automata (PTAs) are a classical formalism for such systems but for which most interesting problems are undecidable. Notably, the parametric reachability emptiness problem, i.e., the emptiness of the parameter valuations set allowing to reach some given discrete state, is undecidable. Lower-bound/upper-bound parametric timed automata (L/U-PTAs) achieve decidability for reachability properties by enforcing a separation of parameters used as upper bounds in the automaton constraints, and those used as lower bounds. In this paper, we first study reachability. We exhibit a subclass of PTAs (namely integer-points PTAs) with bounded rational-valued parameters for which the parametric reachability emptiness problem is decidable. Using this class, we present further results improving the boundary between decidability and undecidability for PTAs and their subclasses such as L/U-PTAs. We then study liveness. We prove that: (1) deciding the existence of at least one parameter valuation for which there exists an infinite run in an L/U-PTA is PSpace-complete; (2) the existence of a parameter valuation such that the system has a deadlock is however undecidable; (3) the problem of the existence of a valuation for which a run remains in a given set of locations exhibits a very thin border between decidability and undecidability.


Introduction
Timed automata (TAs) [AD94] are a powerful formalism that extend finite-state automata with clocks (real-valued variables evolving linearly) that can be compared with integer constants in locations ("invariants") and along transitions ("guards"); additionally, some clocks can be reset to 0 along transitions. Many interesting problems for TAs (including the reachability of a location [AD94]) are decidable. However, the classical definition of TAs is not tailored to verify systems only partially specified, especially when the value of some timing constants is not yet known.
Logics and PTAs. In [Wan96], an approach is proposed for the verification of Parametric TCTL (PTCTL) formulas, where the problem is decidable.
In [BR07], parameters are allowed both in the model and in the property (a PTCTL formula), and model checking is decidable with one parametric clock over discrete time, provided no equality appears in the formula.
In [BDR08], the parametric model checking of a timed automaton against a parametric extension of TCTL is considered: the valuations set answering the parametric model checking problem is proved to be effectively computable, with some restrictions over the parametric TCTL syntax.
In [Qua14], it is shown that the MTL model checking problem is undecidable for PTAs even with a single clock.
1.1.2. Decision problems for L/U-PTAs. In [HRSV02], L/U-PTAs are introduced as a subclass of PTAs where each parameter is either always compared to a clock as a lower bound in guards and invariants, or always as an upper bound.
Decidability. The EF-emptiness problem is decidable for L/U-PTAs [HRSV02]. In [BLT09], further results are proved for L/U-PTAs with integer-valued parameters: emptiness, finiteness and universality of the set of parameter valuations for which there exists an infinite accepting run are decidable.
Undecidability. The first problems shown undecidable for L/U-PTAs are the constrained EF-emptiness problem and constrained EF-universality problem [BLT09]: here, "constrained" means that some parameters of the L/U-PTA can be constrained by an initial linear constraint, such as p 1 ≤ 2 × p 2 + p 3 .
In addition, the AF-emptiness problem is undecidable for L/U-PTAs [JLR15]. The untimed language preservation problem ("given a parameter valuation, does there exist another valuation with the same untimed language?") is undecidable for both PTAs and L/U-PTAs [ALM20].
Intractability of synthesis. It is shown in [JLR15] that the synthesis of the parameters reaching a given location in an L/U-PTA is intractable in practice, more specifically, it cannot be represented using a finite union of polyhedra.
L-PTAs and U-PTAs. Two further subclasses have been defined in [BLT09]: L-PTAs and U-PTAs, where all parameters are always lower bounds and always upper bounds respectively.
On the positive side, exact synthesis algorithms are proposed for reachability properties in L-PTAs and U-PTAs over integer-valued parameters in [BLT09]. On the negative side, it is shown in [ALR18] that the full TCTL-emptiness problem (i. e., the emptiness of the valuation set for which a particular TCTL formula is satisfied on the model) is undecidable even for U-PTAs. × [JLR15] open open Table 2. Decidability of liveness problems for PTAs (prior to our work) 1.1.3. Parameter synthesis in practice. Two main model checkers support parametric timed automata (or the similar formalism of parametric timed Petri nets, PTPNs [TLR09]): IMITATOR [And21] for PTAs, and Roméo [LRST09] for PTPNs. In the general case, they both perform synthesis independently of the decidability results, i. e., work in a "best effort", without any guarantee of termination.
1.1.4. The power of integer points (integer parameter valuations). In [JLR15], PTAs with bounded integer-valued parameters are considered. The problem of exhibiting parameter valuations such that a given location is reachable or unavoidable becomes decidable, and two algorithms are provided that compute the exact such sets of integer valuations in a symbolic manner, i. e., without performing an exhaustive enumeration. In [ALR15], it is shown that computing a parametric extrapolation of the integer hull of symbolic states allows one to synthesize (rational-valued) parameter valuations for bounded PTAs, guaranteeing the synthesis of at least all integer-valued valuations, but also sometimes most or even all rational-valued valuations.
1.1.5. Summary of (un)decidability. We give a summary of the known results prior to our contributions concerning EF-emptiness, EF-universality ("do all parameter valuations allow a given location to be reachable?") and AF-emptiness in Table 1. We give from left to right the (un)decidability for bounded L/U-PTAs, L/U-PTAs, bounded PTAs, and PTAs. Decidability is preceded by " √ " (in green), whereas undecidability is preceded by "×" (in red).
We give a second summary in Table 2, where EC-emptiness, ED-emptiness and EGemptiness denote the emptiness of the parameter valuations set for which there exists an infinite run, there exists a maximal finite run (i. e., deadlocked), and there exists a maximal (infinite or finite) run staying in a predefined set of locations, respectively. In addition, "bc" and "bo" denote "bounded with closed bounds" (i. e., of the form [a, b]) or "bounded with open bounds" (i. e., for which at least one of the intervals has an open bound). 1.2. Contribution. Following Lamport, properties of systems are often characterized as safety properties ("something bad will never happen") and liveness properties ("something good will eventually happen") [Lam77]. Safety generally reduces to reachability. In this paper, we contribute to the study of both reachability and liveness for PTAs and their subclasses.
1.2.1. Reachability. L/U-PTAs is the only non-trivial 2 subclass of PTAs for which the EFemptiness problem is decidable for an arbitrary number of clocks and parameters. However, other results are disappointing for L/U-PTAs: undecidability of AF-emptiness, intractability of reachability-synthesis [JLR15]. It is hence important to look for further subclasses of PTAs for which problems may be decidable.
Integer-point PTAs. It is shown in [JLR15,ALR15] that integer points play a key role in decidability. Hence, our first contribution here is to investigate integer-points PTAs (IP-PTAs), that are PTAs where each symbolic state contains at least one integer point (i. e., an integer valuation of the clocks and the parameters). We prove that the EF-emptiness problem is decidable for bounded IP-PTAs (i. e., with a bounded parameter domain), even when parameters are rational-valued. Although we show that it cannot be decided whether a bounded PTA is a (bounded) IP-PTA, we give two sufficient syntactic conditions: we show that bounded L/U-PTAs with non-strict inequalities are IP-PTAs and, more interestingly, we introduce a new subclass of "reset-PTAs", that are also IP-PTAs, and for which, when bounded, the EF-emptiness problem is hence decidable too. This class is only the second syntactic subclass of PTAs (after L/U-PTAs) for which this problem is decidable.
Decidability of PTAs. Our second main contribution to reachability is to study several open problems for PTAs and several known subclasses (as well as the new class of IP-PTAs): we study here the emptiness and universality of reachability (EF), as well as unavoidability emptiness (AF). Emptiness is of utmost importance as, without decidability of the emptiness, exact synthesis is practically ruled out. Universality checks whether all parameter valuations satisfy a property, which is important for applications where the designer has no power on some valuations; this is the case of networks, where some latencies (e. g., the transmission time of some packets) may be totally arbitrary. Among our results, we prove in particular that AF-emptiness is undecidable for both bounded IP-PTAs and bounded L/U-PTAs. Overall, we significantly enhance the knowledge we have of decidability problems for PTAs and subclasses.
1.2.2. Liveness. When a "good" behavior is not always eventually reached, it can be for two main reasons: either there is a deadlock (a state in which the system cannot evolve anymore), or there is a livelock (an infinite path never reaching the "good" behavior). Both situations are captured by the CTL operator "EG" [CES86].
With the notable exception of [JLR15,ALR18], and to some extent of [BLT09] which addresses the existence of cycles, all the works cited above focus on safety properties, through the basic problem of reachability. This is maybe not so surprising given that most results related to this simpler problem are already negative.
We nonetheless address here the problem of liveness in PTAs, and more precisely, with the negative result of [JLR15] on AF-emptiness in mind, we start from L/U-PTAs with rational-valued parameters and further refine both the model and the properties. We prove (for the class of L/U-PTAs) that: (1) deciding the existence of at least one parameter valuation for which there exists an infinite run (discrete cycle) in the automaton is PSpace-complete; (2) deciding the existence of a parameter valuation such that the system has a deadlock is however undecidable; (3) the problem of the existence of a valuation for which a run remains in a given set of locations exhibits a very thin border between decidability and undecidability: while this problem is decidable for L/U-PTAs with a bounded parameter domain with closed bounds, it becomes undecidable if either the assumption of boundedness or of closed bounds is lifted. This result confirms that L/U-PTAs stand at the border between decidability and undecidability. Differently from [BLT09], we use here no accepting locations. In addition, our parameters are not restricted to be integer-valued, and can be rational-valued.
1.3. About this manuscript. This manuscript is an extended version of [ALR16a,AL17]. In addition to merging notations and preliminary concepts, and adding all proofs missing in [ALR16a,AL17], we extended these manuscripts as follows: • we added more explanations on the technical parts; • we modified the proof of Theorem 4.1 (our former version used a "block" statement in the 2-counter machine, as in [AHV93], which some readers might find objectionable), impacting all subsequent proofs of Section 4; • we added the new Corollary 5.2; • we added several summaries of results (in tables and graphics).
1.4. Outline. We recall the necessary preliminaries in Section 2. We introduce integer-point PTAs (IP-PTAs) in Section 3 and study their relationship with existing results. We then study reachability problems in Section 4 and liveness problems in Section 5 for PTAs, L/U-PTAs and various other subclasses. We summarize our results in Section 6 and discuss perspectives in Section 7.

Preliminaries
2.1. Clocks, parameters and constraints. Let N, Z, Q + and R + denote the sets of nonnegative integers, integers, non-negative rational numbers and non-negative real numbers respectively. Let I(N) denote the set of non-necessarily closed intervals on N, i. e., the set of intervals of the form [a, b], (a, b], [a, b) or (a, b) where a, b ∈ N and a ≤ b.
Throughout this paper, we assume a set X = {x 1 , . . . , x H } of clocks, i. e., real-valued variables that evolve at the same rate. A clock valuation is a function w : X → R + . We identify a clock valuation w with the point (w(x 1 ), . . . , w(x H )) of R H + . We write 0 for the clock valuation that assigns 0 to all clocks. Given d ∈ R + , w + d denotes the valuation such that (w + d)(x) = w(x) + d, for all x ∈ X. Given R ⊆ X, we define the reset of a valuation w, denoted by [w] R , as follows: We assume a set P = {p 1 , . . . , p M } of parameters, i. e., unknown constants. A parameter valuation v is a function v : P → Q + . We identify a valuation v with the point (v(p 1 ), . . . , v(p M )) of Q M + . An integer parameter valuation is a valuation v such that ∀p ∈ P, v(p) ∈ N. For short, we also call integer points such integer parameter valuations, in reference to the classical geometrical interpretation of sets of parameter valuations [JLR15].
In the following, we assume ∈ {<, ≤, ≥, >}. Throughout this paper, lt denotes a linear term over X ∪ P of the form 1≤i≤H α i x i + 1≤j≤M β j p j + d, with x i ∈ X, p j ∈ P , and α i , β j , d ∈ Z. A constraint C over X ∪ P is a conjunction of inequalities of the form lt 0. Given a parameter valuation v, v(C) denotes the constraint over X obtained by replacing each parameter p in C with v(p). Likewise, given a clock valuation w, w(v(C)) denotes the expression obtained by replacing each clock x in v(C) with w(x). We say that v satisfies C, denoted by v |= C, if the set of clock valuations satisfying v(C) is nonempty. Given a parameter valuation v and a clock valuation w, we denote by w|v the valuation over X ∪ P such that for all clocks x, w|v(x) = w(x) and for all parameters p, w|v(p) = v(p). We use the notation w|v |= C to indicate that w(v(C)) evaluates to true. We say that C is A (parametric) guard g is a constraint over X ∪ P defined by inequalities of the form x 1≤j≤M β j p j + d, with β j ∈ {0, 1} and d ∈ Z. Given an arbitrary order on X ∪P , valuations can be seen as points in the real coordinate space of dimension |X ∪ P |, using |A| to denote the cardinality of set A. Then the set of valuations satisfying constraint C can be seen as a convex polyhedron in that vector space. In the sequel, we will often make the small abuse of using constraint and polyhedron indifferently.
2.2.1. Syntax. Parametric timed automata (PTA) extend timed automata with parameters within guards and invariants in place of integer constants [AHV93].
Definition 2.1. A PTA A is a tuple A = (Σ, L, 0 , X, P, I, E), where: (1) Σ is a finite set of actions, (2) L is a finite set of locations, (3) 0 ∈ L is the initial location, (4) X is a finite set of clocks, (5) P is a finite set of parameters, (6) I is the invariant, assigning to every ∈ L a parametric guard I( ), (7) E is a finite set of edges e = ( , g, σ, R, ) where , ∈ L are the source and target locations, σ ∈ Σ, R ⊆ X is a set of clocks to be reset, and g (the transition guard) is a parametric guard.
Given a parameter valuation v, we denote by v(A) the non-parametric timed automaton where all occurrences of a parameter p i have been replaced by v(p i ). In the following, we may denote as a timed automaton any structure v(A), by assuming a rescaling of the constants: by multiplying all constants in v(A) by their least common denominator, we obtain an equivalent timed automaton (with integer constants, as in [AD94] Definition 2.2 (Concrete semantics of a TA). Given a PTA A = (Σ, L, 0 , X, P, I, E), and a parameter valuation v, the concrete semantics of v(A) is given by the timed transition system (S, s 0 , →), with • → consists of the discrete and (continuous) delay transition relations: → · · · e m−1 → s m em → · · · , such that e i ∈ E and (s i , e i , s i+1 ) ∈ → for all i = 0, 1, . . . . Given a state s = ( , w), we say that s is reachable (or that v(A) reaches s) if s belongs to a run of v(A). By extension, we say that is reachable in v(A), if there exists a state (l, w) that is reachable. For any run ρ, we note Locs the set of locations reached by ρ. A maximal run is a run that is either infinite (i. e., contains an infinite number of discrete transitions), or that cannot be extended by a discrete transition. A maximal run is deadlocked if it is finite, i. e., it contains a finite number of discrete transitions. By extension, we say that a TA is deadlocked if it contains at least one deadlocked run.
We first define the time elapsing of a constraint C, denoted by C , as the constraint over X and P obtained from C by delaying all clocks by an arbitrary amount of time. That is, Dually, we define the past of C, denoted by C , as the constraint over X and P obtained from C by letting time pass backward by an arbitrary amount of time. That is, Given R ⊆ X, we define the reset of C, denoted by [C] R , as the constraint obtained from C by resetting the clocks in R, and keeping the other clocks unchanged. We denote by C↓ P the projection of C onto P , i. e., obtained by existentially eliminating the clock variables (e. g., using Fourier-Motzkin algorithm [Sch86]): v |= C↓ P iff ∃w : w|v |= C. The (sets of clock valuations satisfying the) constraints generated by PTA can be represented by subsets of R |X| + with a special form called parametric zone [HRSV02]. A parametric zone is a convex polyhedron over X ∪ P in which all constraints on variables are of the form x plt (parametric rectangular constraints), or x i − x j plt (parametric diagonal constraints), where x i ∈ X, x j ∈ X and plt is a parametric linear term over P , i. e., a linear term without clocks (α i = 0 for all i). The intersection of two parametric zones, the future of parametric zone, its past, and its reset for any subset of clocks, are again parametric zones [HRSV02,JLR15]. Definition 2.3 (Symbolic state). A symbolic state is a pair s = ( , C) where ∈ L is a location, and C its associated parametric zone.
The initial symbolic state of A is s 0 = 0 , ({ 0} ∧ I( 0 )) ∧ I( 0 ) . From what precedes, and since { 0} and I( 0 ) are parametric zones, the constraint in this initial symbolic state is a parametric zone.
The symbolic semantics relies on the Succ operation. Given a symbolic state s = ( , C) and an edge e = ( , g, σ, R, ), Succ(s, e) = ( , C ), with C = [(C ∧ g)] R ∧ I( ) ∧ I( ). The Succ operation is effectively computable, using polyhedral operations: note that the successor of a parametric zone C is a parametric zone.
A symbolic run of a PTA is a possibly infinite alternating sequence of symbolic states and edges starting from the initial symbolic state, of the form s 0 e 0 ⇒ s 1 e 1 ⇒ · · · , such that for all i = 0, 1, . . . , we have e i ∈ E, and s i+1 = Succ(s i , e i ). In the following, we simply refer to symbolic states belonging to a run of A as symbolic states of A.
Finally, we say that a symbolic state is reachable if it belongs to a symbolic run.
2.3. Subclasses of PTAs. L/U-PTAs [HRSV02] constrain the use of parameters: parameters must be partitioned between lower-bound parameters (only compared to clocks in parametric guards as a lower bound) and upper-bound parameters. L/U-PTAs were notably studied in [HRSV02, BLT09, AL17, ALR18].
Definition 2.4 (L/U-PTA). An L/U-PTA is a PTA where the set of parameters is partitioned into lower-bound parameters and upper-bound parameters, where an upper-bound (resp. lower-bound) parameter p i is such that, for every guard or invariant constraint x 1≤j≤M β j p j + d, we have: β i = 1 implies ∈ {≤, <} (resp. ∈ {≥, >}).
Recall from our definition of guard that β i can only be 0 or 1. L/U-PTAs enjoy a well-known monotonicity property recalled in the following lemma (that corresponds to a reformulation of [HRSV02, Prop 4.2]), stating that increasing upperbound parameters or decreasing lower-bound parameters can only add behaviors.
Lemma 2.5. Let A be an L/U-PTA and v be a parameter valuation. Let v be a valuation such that for each upper-bound parameter p + , v (p + ) ≥ v(p + ) and for each lower-bound Example 2.6. The PTA (fragment) in Figure 5b page 24 is an L/U-PTA, with upper-bound parameter a + and lower-bound parameter a − .
In this paper, we will also consider bounded PTAs, i. e., PTAs with a bounded parameter domain that assigns to each parameter an infimum and a supremum, both integers.
Definition 2.7 (bounded PTA). A bounded PTA is A |bounds , where A is a PTA, and bounds : P → I(N) assigns to each parameter p an interval [inf, sup], (inf, sup], [inf, sup), or (inf, sup), with inf, sup ∈ N. We use inf(p, bounds) and sup(p, bounds) to denote the infimum and the supremum of p, respectively. Note that we rule out ∞ as a supremum.
We say that a bounded PTA is a closed bounded PTA if, for each parameter p, its ranging interval bounds(p) is of the form [inf, sup]; otherwise it is an open bounded PTA.
We define similarly bounded L/U-PTAs. Whereas bounded PTAs are naturally a subclass of PTAs, we showed in [ALR16b] that, for some equivalence relations, bounded L/U-PTAs are incomparable with L/U-PTAs. In particular, this can be the case when the equivalence relation refers to the equality of the sets of parameter valuations such that some reachability property is satisfied, because boundedness imposes constraints on parameters that cannot be expressed in an L/U-PTA (e. g., enforcing upper bounds on upper-bound parameters): a consequence is that undecidability results for bounded L/U-PTAs cannot be automatically extended to L/U-PTAs; conversely, decidability results for L/U-PTAs cannot be automatically extended to bounded L/U-PTAs.
2.4. Decision and synthesis problems. We also consider two variants of EG: Emptiness is the most basic parametric question: is the set of parameter valuations such that the property holds empty? Universality gives a robustness quality to the property and permits to effectively abstract an infinite number of verifications with concrete values.
Note that EF and AG are dual properties, and so are AF and EG. In our parametric setting this implies that, for instance, EF-emptiness and AG-universality are dual, and so are AF-emptiness and EG-universality.
Also note that ED-emptiness is equivalent to AC-universality, where AC-universality asks whether all parameter valuations are such that all maximal runs are infinite. Conversely, EC-emptiness is equivalent to AD-universality (for all valuations, all maximal runs are finite). 2.5. Undecidable problems for two-counter machines. Most of the undecidability proofs we use work by reduction of a 2-counter machine problem to our problems; we therefore briefly recall here how such a machine works, and the two problems we consider. A deterministic 2-counter machine [Min67] has two non-negative counters C 1 and C 2 , a finite number of states and a finite number of transitions, which can be of the form: • "when in state q i , increment C k and go to q j "; • "when in state q i , if C k = 0 then go to q k , otherwise decrement C k and go to q j ".
The machine starts in state q 0 with the counters set to 0. The halting problem consists in deciding whether some distinguished state called q halt can be reached or not. The boundedness problem asks whether the counters stay bounded or not along the execution of the machine. Both problems are known to be undecidable [Min67].

Integer-points parametric timed automata
In this section, we introduce integer-points parametric timed automata (IP-PTAs for short), i. e., a semantic subclass of PTAs in which any (reachable) symbolic state contains at least one integer point.
First, we compare in this section IP-PTAs with L/U-PTAs and show that the class of bounded IP-PTAs is strictly larger than bounded L/U-PTAs with non-strict inequalities. Then, our main result regarding this class will be to prove the decidability of the EFemptiness problem for bounded IP-PTAs (Section 4.3). We will also show that synthesis is intractable in practice, and that the same holds for bounded L/U-PTAs (Section 4.4). Finally, although we prove that the membership problem is undecidable for IP-PTAs, we will exhibit a syntactic sufficient condition, that provides a new subclass of PTAs for which the EF-emptiness problem is decidable (Section 4.5).
We give in Figure 1 a pictorial presentation of the subclasses (existing and introduced in this paper) and their relations-that will be proved in the remainder of this paper. A similar graphical representation, this time for decidability results of various problems, will be given in Figure 10 in Section 6.
Definition 3.1. A PTA A is said to be an integer points PTA (in short IP-PTA) if, in any reachable symbolic state ( , C) of A, C contains at least one integer point.
Let us now compare IP-PTAs and L/U-PTAs. We first need the following lemma, stating that any reachable symbolic state of an L/U-PTA contains an integer parameter valuation.
Lemma 3.2. Let ( , C) be a reachable symbolic state of an L/U-PTA. Then C↓ P contains at least one integer point.
Proof. Consider a (non-empty) reachable symbolic state ( , C) of an L/U-PTA. Let v |= C↓ P . From the well-known monotonicity property of L/U-PTAs (recalled in Lemma 2.5), any parameter valuation such that the lower-bound parameters p − i are lower or equal to v(p − i ) and upper-bound parameters p + j are greater than or equal to v(p + j ) also belong to C↓ P . In particular, this is the case of the integer parameter valuation assigning 0 to all lower-bound parameters, and assigning to upper-bound parameters p + j the smallest integer greater than or equal to v(p + j ). The previous lemma that ensures the presence of an integer parameter valuation in any symbolic state does not guarantee that an L/U-PTA is an IP-PTA, because clocks may have non-integer values. Proof. • Consider an L/U-PTA with a transition guarded by x > 0 and resetting no clock, followed by a second location with invariant x < 1; then, necessarily, the symbolic state associated with this second location contains no integer point (as x ∈ (0, 1) in that symbolic state). • It is easy to exhibit an IP-PTA that is not an L/U-PTA. This is for example the case of a simple PTA with only one location, one clock x and one parameter p with a self-loop with guard x = p and resetting x.
However, we can prove that any closed L/U-PTA, i. e., with only non-strict inequalities, is an IP-PTA. In order to show that the class of closed L/U-PTAs is included in the class of IP-PTAs, we need the following lemma.
Lemma 3.4. Let A be a PTA with only non-strict inequalities. Let s = ( , C) be a symbolic state of A. Then if C↓ P contains at least one integer parameter valuation, then C contains an integer point.
Proof. Since there is at least one integer parameter valuation v in C↓ P , then v(C) is not empty. Since v is an integer valuation, v(C) is a zone of a timed automaton with integer constants, so the vertices of v(C) are integer points. Finally, there is at least one vertex in v(C) because all clocks are nonnegative (and hence are bounded from below by 0), and this vertex does belong to v(C) because it is topologically closed due to the non-strict constraints. So C contains at least one integer point. Proposition 3.5. The class of IP-PTAs is strictly larger than the class of closed L/U-PTAs.
The previous result also holds for bounded PTAs: Corollary 3.6. The class of bounded IP-PTAs is strictly larger than the class of closed bounded L/U-PTAs.
Proof. Lemma 3.2 extends to bounded L/U-PTAs, since the bounds are integers (this would not hold otherwise). Then, the proof of Proposition 3.3 (⇐) holds with bounded IP-PTAs and closed bounded L/U-PTAs. Applying Lemma 3.4 concludes the proof. Proof. The proof of Proposition 3.3 can be applied with bounded PTAs on either side.

Reachability properties
In this section, we prove results for IP-PTAs. While we present one key decidability result for this subclass (decidability of EF-emptiness), the subsequent undecidability results can then be lifted to more general subclasses, including general PTAs.
Outline. We first provide a new proof for the undecidability of the EF-emptiness problem for general PTAs (Section 4.1). We then show that this proof can be modified to prove the undecidability of the EF-emptiness problem for closed bounded PTAs (Section 4.2). We then prove decidability of this problem for bounded IP-PTAs (Section 4.3). We then prove that EF-synthesis for IP-PTAs is intractable in practice (Section 4.4), and that the membership problem for IP-PTAs is undecidable (Section 4.5). We finally prove the undecidability of EF-universality for IP-PTAs (Section 4.6). We will give a summary of the results proved in this section in Table 3 (in Section 6).

4.1.
A new proof for the undecidability of EF-emptiness. Historically, the EFemptiness problem has been the most studied problem of those we have stated in Section 2.4. In the general setting of PTAs, several undecidability proofs are available, all based on reductions from the 2-counter machines halting problem [AHV93, Mil00, Doy07, BBLS15, ALM20]. We first propose yet another such construction that will be then modified to establish many of the results in this paper. Its main feature is that it works for a single rational parameter in [0, 1]. While [Mil00] already proposes a similar result, we found it harder to extend to our purposes.
Theorem 4.1. The EF-emptiness problem is undecidable for bounded PTAs.
Proof. We reduce from the halting problem of a 2-counter machine (2CM), which is undecidable [Min67].
Given a machine M, we encode it as a PTA A(M). Let us describe this encoding in details, as we will modify it in the subsequent proofs.
Each state q i of the machine is encoded as a location of the automaton, which we call q i . The counters are encoded using clocks x, y and z and one parameter a, with the following relations with the values c 1 and c 2 of counters C 1 and C 2 : when x = 0, we have y = 1 − ac (c) 0-test and decrement gadget (C 1 ) Figure 2. EF-emptiness: gadgets and z = 1 − ac 2 . All three clocks are parametric, i. e., are compared with a in some guard or invariant of the encoding. We will see that a is a rational-valued bounded parameter, typically in [0, 1] (although not bounding a has no impact on the proof). We initialize the clocks with the gadget in Figure 2a (that also blocks the case where a = 0). Note that, throughout the paper, we highlight in thick green style the locations of the PTA corresponding to a state of the 2CM (in contrast with other locations added in the encoding to maintain the matching between the clock values and the counter values). Since all clocks are initially 0, in Figure 2a clearly, when in q 0 with x = 0, we have y = z = 1, which indeed corresponds to counter values 0.
We now present the gadget encoding the increment instruction of C 1 in Figure 2b. The transition from q i to l i1 only serves to clearly indicate the entry in the increment gadget and is done in 0 time unit. Since every edge is guarded by one equality, there are really only two paths that go through the gadget: one going through l i2 and one through l i2 . Let us begin with the former. We start from some encoding configuration: x = 0, y = 1 − ac 1 and z = 1 − ac 2 in q i (and therefore the same in l i1 ). We can enter l i2 (after elapsing enough time) if 1 − ac 2 ≤ 1, i. e., ac 2 ≥ 0, which implies that a ≥ 0, and when entering l i2 we have x = ac 2 , y = 1 − ac 1 + ac 2 and z = 0. Then we can enter l i3 if 1 − ac 1 + ac 2 ≤ 1 + a, i. e., a(c 1 + 1) ≥ ac 2 . When entering l i3 , we then have x = a(c 1 + 1), y = 0 and z = a(c 1 + 1) − ac 2 . Finally, we can go to q j if a(c 1 + 1) ≤ 1 and when entering q j we have x = 0, y = 1 − a(c 1 + 1) and z = 1 − ac 2 , as expected. We now examine the second path. We can enter l i2 if 1 − ac 1 ≤ a + 1, i. e., a(c 1 + 1) ≥ 0, and when entering l i2 we have x = a(c 1 + 1), y = 0 and z = 1 − ac 2 + a(c 1 + 1). Then we can go to l i3 if 1 − ac 2 + a(c 1 + 1) ≤ 1 + a, i. e., a(c 1 + 1) ≤ ac 2 . When entering l i3 , we then have x = ac 2 , y = ac 2 − a(c 1 + 1) and z = 0. Finally, we can go to q j if ac 2 ≤ 1 and when entering q j we have x = 0, y = 1 − a(c 1 + 1) and z = 1 − ac 2 , as expected.
Remark that exactly one path can be taken depending on the respective order of c 1 + 1 and c 2 , except when both are equal or a = 0, in which cases both paths lead to the same configuration anyway (and the case a = 0 is excluded by Figure 2a anyway).
Decrement is done similarly by replacing guards y = a + 1 with y = 1, and guards x = 1 and z = 1 with x = a + 1 and z = a + 1, respectively, as shown in Figure 2c. In addition, the 0-test is obtained by simply adding a transition from q i to q k with guard y = 1 ∧ x = 0, which ensures that C 1 = 0. Similarly, the guard from q i to l i1 ensures that decrement is done only when the counter is not null.
All those gadgets also work for C 2 by swapping y and z.
The actions associated with the transitions do not matter; we can assume a single action σ on all transitions (omitted in all figures).
We now prove that the machine halts iff there exists a parameter valuation v such that v(A) reaches location q halt . First note that if a = 0 the initial gadget cannot be passed, and so the machine does not halt. Assume a > 0. Consider two cases: (1) either the value of the counters is not bounded. Then, for any parameter valuation, at some point during an increment of, say, C 1 we will have a(c 1 + 1) > 1 when taking the transition from l i2 to l i3 and the PTA will be blocked. Therefore, there exists no parameter valuation for which the PTA can reach q halt . (2) or the value of the counters remains bounded. Let c be their maximal value. Let us consider two subcases: (a) either the machine reaches q halt : in that case, if c = 0 and 0 < a ≤ 1 or c > 0 and ca < 1, then the PTA valuated with such parameter valuations correctly simulates the machine, yielding a (unique) run reaching location q halt . The set of such valuations for a is certainly non-empty: a = 1 2 belongs to it if c = 0 and a = 1 c does otherwise. (b) or the machine does not halt. Then again, for a sufficiently small parameter valuation (i. e., a < 1 if c = 0 and a ≤ 1 c otherwise), the machine is properly simulated, and since the machine does not halt, then the PTA never reaches q halt . For other values of a, the machine will block at some point in an increment gadget, because a is not small enough and the guard to q j cannot be satisfied.
Hence the machine halts iff there exists a parameter valuation v such that v(A) reaches q halt .
Remark 4.2. In this paper, we allow guards and invariants of the form x 1≤j≤M β j p j +d, which is more restrictive than [BLT09] (that allows parametric coefficients different from 0 and 1, as well as diagonal constraints), but more permissive than [AHV93], that only allows a syntax x p. In fact, most papers in the literature define their own syntax (see [And19] for a survey). We can adapt our proof to fit in the most restrictive syntax (x p) as follows: transitions with "y = a + 1" guards and "y := 0" reset can be equivalently replaced by one transition with a "y = 1" guard and a reset of some additional clock w, followed by a transition with a "w = a" guard and the "y := 0" reset (and similarly for x and z in the decrement gadget). This also allows the proof to work without complex parametric expressions in guards, using three additional clocks (we conjecture that a smarter encoding can be exhibited to factor these additional clocks, so as to use a single additional clock). A similar modification can be applied to all subsequent undecidability proofs. 4.2. Undecidability for closed bounded PTAs. Now, by reusing the previous proof, we can show that the EF-emptiness problem is undecidable for closed bounded PTAs. This is an original result, as all existing results with bounded PTAs (e. g., [Mil00, Doy07, ALM20]) require (at least some) strict inequalities. This result can also be seen as a complement to [Doy07], that proves the same result by using only strict inequalities. (1) the initial gadget ( Figure 2a) requires a strict inequality to ensure a > 0; (2) the 0-test and decrement gadget (Figure 2c) uses an inequality y < 1 to ensure the counter is not 0. We will remove these strict inequalities as follows: (1) we remove the guard between 0 and 1 in the initial gadget (Figure 2a), that is we allow (so far) the valuation a = 0 that does not correctly simulate the machine; (2) we remove the strict inequality y < 1 in the decrement gadget (Figure 2c) as follows.
Instead of testing y < 1 when x = 0, it is equivalent to test x > 0 when y = 1 on the subsequent transitions. And testing x > 0 is equivalent to testing x ≥ a provided a > 0 (we will take care of this later on). The new gadget is given in Figure 3a and, provided a > 0, it is equivalent to the former gadget in Figure 2c. Now, with these new gadgets, the behavior of the encoding is the same as in the proof of Theorem 4.1, provided a > 0. Removing a = 0 is necessary, as this valuation does not correctly encode the machine. We will therefore forbid a = 0 in a new final gadget, given in Figure 3b, with a transition from q halt to a new location q halt (via an intermediate location). This gadget allows us to ensure a > 0, without using strict inequalities; we believe this is the cornerstone of this proof of Theorem 4.3.
Clearly, if a = 0, taking the self-loop on q 1 halt will not allow time to elapse; and then there will be no way to leave q 1 halt with x = 0 and y ≥ 1; hence q halt is not reachable for a = 0. In contrast, if 0 < a ≤ 1, since a is a rational number, then by taking an appropriate number of times the self-loop on q 1 halt , we will eventually have x = 0, just after the last loop, and y ≥ 1; hence q halt will eventually be reached. To summarize: • if a = 0, the machine is not correctly encoded, but there is no way to reach q halt ; • if 0 < a ≤ 1, the machine is correctly encoded, and from Theorem 4.1 we know that q halt is reachable iff the machine halts. Since q halt is reachable from q halt , then q halt is reachable iff the machine halts. Hence there exists a parameter valuation such that q halt is reachable iff the machine halts. Finally, note that all our gadgets use non-strict inequalities, and therefore the built PTA is a closed bounded PTA.   Proof. We first need to recall two lemmas relating symbolic and concrete runs (proved in [HRSV02,ACEF09]). Given a concrete (respectively symbolic) run ( 0 , 0)   C contains at least one integer point. Hence there exists an integer parameter valuation v |= C↓ P ; so from Lemma 4.5, there exists a concrete run of v (A) reaching . This gives that EF-emptiness is false for A iff there exists an integer valuation v such that a run of v (A) reaches a location in T .
As a consequence, deciding whether some valuation permits to reach reduces to deciding whether some integer valuation permits to do so, which, for bounded PTAs, is PSpace-complete [JLR15].
Since bounded IP-PTAs are incomparable with L/U-PTAs (for which the EF-emptiness problem is known to be decidable), and since L/U-PTAs are the only non-trivial subclass of PTAs for which this problem is known to be decidable, then Theorem 4.4 strictly extends the subclass of PTAs for which this problem is decidable.
In practice, [JLR15] proposes efficient symbolic algorithms to synthesize all the integer parameter valuations that permit to reach some given location, and thus to solve EFemptiness for IP-PTAs.
4.4. Intractability of the synthesis. Although the EF-emptiness problem is decidable for L/U-PTAs [HRSV02], the synthesis seems to pose practical problems: it was shown in [JLR15] that the solution to the EF-synthesis problem for L/U-automata, if it can be computed, cannot be represented using any formalism for which emptiness of the intersection with equality constraints is decidable. In particular, this rules out the possibility of computing the solution set as a finite union of polyhedra.
We reuse the intuition of this result and extend it to closed bounded L/U-PTAs.
Theorem 4.7. If it can be computed, the solution to the EF-synthesis problem for closed bounded L/U-automata cannot be represented using any formalism for which emptiness of the intersection with equality constraints is decidable.
Proof. We reuse the idea of [BLT09] used for proving that constrained emptiness for infinite runs acceptance properties is undecidable, and reused in [JLR15, Theorem 2]. Suppose that the solution to the EF-synthesis problem for closed bounded L/U-PTAs can be represented using a formalism for which emptiness of the intersection with equality constraints is decidable. Assume a closed bounded PTA A; for each parameter p i of A that is used both as an upper bound and a lower bound, replace its occurrences as upper bounds by a fresh parameter p u i and its occurrences as lower bounds by a fresh parameter p l i . We therefore obtain a closed bounded L/U-PTA. Assume we can derive a solution to the EF-synthesis problem for this closed bounded L/U-PTA, and let K be that solution. Then, by hypothesis, we can decide whether K ∧ i p l i = p u i is empty or not; hence, we can solve the EF-emptiness for A, which contradicts the undecidability of EF-emptiness for closed bounded PTAs (from Theorem 4.3).
Corollary 4.8. If it can be computed, the solution to the EF-synthesis problem for IP-PTAs cannot be represented using any formalism for which emptiness of the intersection with equality constraints is decidable.
Proof. From the fact that a closed bounded L/U-PTA is an IP-PTA (Proposition 3.6).  is not an IP-PTA. As a consequence, this PTA is an IP-PTA iff the 2-counter machine does not halt. Finally, note that this PTA can be bounded by imposing 0 ≤ a ≤ 1, without any change in the reasoning above.
Nevertheless, Proposition 3.5 provides a sufficient syntactic membership condition, since any closed L/U-PTA is an IP-PTA. In addition, we now define another new non-trivial set of restrictions leading to IP-PTAs: This kind of restriction is somewhat reminiscent of those enforced by initialized hybrid automata [HKPV98] to obtain decidability. We now prove that reset-PTAs are IP-PTAs, which in turn means that the EF-emptiness problem is decidable for bounded reset-PTAs. It is worth noting that, to the best our knowledge, bounded reset-PTAs and L/U-PTAs are the only non-trivial sets of syntactic restrictions of PTAs making the reachability emptiness problem decidable.
Theorem 4.11. Any reset-PTA is an IP-PTA.
Proof. We prove by induction that the symbolic states generated by reset-PTAs are zones with only non-strict constraints over the set of variables defined by the union of clocks and parameters. To simplify the proof a bit we omit invariants but including them would raise no theoretical difficulty. We then additionally prove as part of the induction that there is no inequality involving two variables x and y in which x and y would not be of the same type (clock or parameter).
The property clearly holds for the initial symbolic state: parameters are unconstrained, all clocks are equal and their common value is greater than or equal to 0. Now suppose this holds for some symbolic state and consider the successor of that symbolic state by some transition. Recall from the Succ definition in Section 2.2.3 that this successor is computed by the following operations: intersection with the guard of the Due to the restriction on constraints, all guards are themselves zones, and it is wellknown that the intersection of two zones is again a zone. Similarly, the reset operation on some of the variables of a zone again leads to a zone. The time elapsing of a proper subset of the variables in a zone however is not a zone in general (the same situation arises, e. g., in stopwatch automata [CL00]). We therefore need to examine more closely the zone on which the time elapsing operates. Two cases arise: (1) the guard did not involve any parameter. Then, with the induction hypothesis, we still do not have any constraint between clocks and parameters after the intersection with the guard. A fortiori, we do not have any after the resets either. The time elapsing operation can be carried out by introducing a fresh non-negative variable t, performing variable substitutions x ← x + t for each clock x, and finally eliminating t. This elimination can be done with the Fourier-Motzkin procedure (see e. g., [Sch86]) which produces all the constraints not involving t plus those obtained by writing all the combinations of a minorant of t less or equal to a majorant of t. After the variable substitutions, t does not appear in constraints between parameters, nor in diagonal clock constraints (x − y ≤ k gives (x + t) − (y + t) ≤ k, i. e., again x − y ≤ k). Since there is no constraint between clocks and parameters, t only appears in rectangular constraints that become of the form y + t ≤ k 1 or x + t ≥ k 2 . Through the elimination procedure, this gives constraints of the form y − x ≤ k 1 − k 2 , and the expected result holds.
(2) the guard involves some parameters. Then before the reset we do have constraints between clocks and parameters. But then, from the definition of reset-PTAs, all clocks are reset along this transition, so these constraints are removed (as part of the elimination of clock variables) and replaced by constraints restricting the reintroduced clock variables to zero. Then, after the reset we do not have constraints between clocks and parameters anymore and the previous reasoning is again valid.
We conclude the proof by noting that in any non-empty zone with integer coefficients all vertices are integer (see the discussion in [JLR15]). And following the proof of Lemma 3.4, since all variables are non-negative, there is at least one such vertex, which does belong to the zone because all constraints are non-strict. This zone therefore contains at least an integer point.
Recall that the synthesis is intractable for bounded IP-PTAs (from Corollary 4.8) and for bounded L/U-PTAs. In contrast, and although studying reset-PTAs in detail goes beyond the scope of this work, we showed in [ALR21] that exact synthesis can be computed for bounded reset-PTAs as defined here, even when resets are done to (rational-valued) parameters. 4.6. Undecidability of EF-Universality. We show below that, unlike L/U-PTAs, the EF-universality problem is undecidable for IP-PTAs even bounded. This result differentiates the classes of (bounded) L/U-PTAs and bounded IP-PTAs, and helps to understand better the boundary between decidability and undecidability for subclasses of PTAs.
Theorem 4.12. The EF-universality problem is undecidable for bounded IP-PTAs with at least 3 parametric clocks and 2 rational-valued parameters. Proof. We start from the encoding in our proofs of Theorems 4.1 and 4.3. The main idea is, for all valuations of the parameter a that are not small enough to properly encode the counters (i. e., for some value c of a counter, 1 − ac < 0), to allow the PTA to directly go to a q error location. In order for our encoding to be an IP-PTA (in particular the symbolic states with location q error ), we add a new parameter b, the value of which can be typically in [0, 1]. We then reduce the problem of knowing whether the counters of the machine grow unbounded along its execution, which is undecidable [Min67], to the universality of the set of parameters that allow the encoding PTA to reach q error .
Let us summarize our construction before going into details. (1) We reuse the increment gadget from Theorems 4.1 and 4.3 (Figure 2b) and extend it with a new location q error (details will follow); (2) We reuse the 0-test and decrement gadget from Theorem 4.3 (Figure 3a) as it is; (3) We do not use the final gadget from q halt to q halt (Figure 3b), i. e., the last location is q halt . (Recall that our target location is q error anyway.) Let us now go into details. First, we add a fresh location q error to our PTA encoding, and we add two transitions from l 0 (the initial location of the PTA) to the q error location: • one with guard x = 0 ∧ x = a, that can only be taken when a = 0 and serves to "eliminate" this special case that does not correctly encode the counters. • and one with guard 0 ≤ x < 1 ∧ x = b, that can only be taken when b ∈ [0, 1). 3 So, whenever a = 0 and b ∈ [0, 1), the system can eventually reach q error . Hence, in the following, we only need to focus on the case where a ∈ (0, 1] and b = 1. Let us now change the increment gadget of Figure 2b (when decrementing, there is no upper bound constraint on a). More specifically, remark that, when incrementing C 1 , the constraint that implies a ≤ 1 c 1 +1 comes from the last transition in the path going through l i2 . In the other path, c 2 is already greater than or equal to c 1 + 1 and therefore a is already small enough to properly encode c 1 + 1 since it is small enough to encode c 2 . Our modified increment gadget is given in Figure 4.
In the transition from l i2 to l i3 , if a is not small enough then x = a(c 1 + 1) will be greater than one and the final transition to q j cannot be taken. We therefore add a direct transition from l i2 to q error when x ≥ b. Recall that we only care about the case where b = 1, hence this transition can be understood as x ≥ 1; now the case where x = 1 is problematic, as the value of a is just small enough to encode the counters, and we still can reach q error , and the 2-counter machine is not properly encoded. However, since we are interested in universality, it suffices to take a valuation of a slightly smaller to properly encode the machine, as we explain more precisely below.
We now prove that the counters of the machine grow unbounded along its execution iff for all values of a and b, the encoding PTA can reach q error . First recall that for a = 0 or b ∈ [0, 1), it is always possible to reach q error (from the initial state). When a > 0 and b = 1, we have two cases: • either the counters grow unbounded (say C 1 does), then whatever the value of a > 0, at some point we have ac 1 > 1. More specifically, there is an increment of C 1 such that ac 1 ≤ 1 and a(c 1 + 1) > 1, which also implies a(c 1 + 1) ≥ b (since b = 1). Then, when executing the corresponding increment gadget, q error can be reached from l i2 ; • or the counters stay bounded. Let c be the maximal value of the counters. Recall that when entering l i2 we have x = ac 2 , y = 1 − ac 1 + ac 2 and z = 0. Then, when y = a + 1, we have x = a(c 1 + 1). If c 1 + 1 = c, then x = ca is the largest value that x can have in l i2 when y = a + 1. Observe that, due to the non-strict inequality x ≥ b in the guard from l i2 to q error , one might still reach q error for a valuation of a such that ca = 1. Consequently, consider the parameter valuation a = 1 c+1 and b = 1. Then ca < 1 = b and since x is in l i2 always at most equal to ca when y = a + 1, the guard to q error is never true and the of valuations for which the automaton can reach q error is not universal.
It remains to show that the constructed PTA is an IP-PTA. With the exception of q error , the result is clear: a = 0 and b = 0 belongs to every reachable symbolic state, hence each symbolic state contains an integer parameter valuation, and hence from Lemma 3.4, all symbolic states (except those with location q error ) contain at least one integer point. In addition, the two symbolic states taken by taking the two special transitions from the initial state to q error to handle a = 0 or b ∈ [0, 1) also contain the integer point x = y = a = b = 0. Now, let us consider the other symbolic states with location q error (and reachable from some location l i2 due to an increment). The projection onto the parameters of the associated  Proof. From Theorem 4.12 and from the fact that a bounded IP-PTA is an IP-PTA, is a bounded PTA, and is a PTA.
We now show that, in contrast to bounded IP-PTAs, the EF-emptiness problem is undecidable for (unbounded) IP-PTAs. This result emphasizes the fact that the boundedness of IP-PTAs is crucial to ensure decidability. Theorem 4.14. The EF-emptiness problem is undecidable for IP-PTAs.
Proof. The proof of the undecidability of the EF-emptiness problem for general PTAs in [AHV93] can be interpreted over integer parameter valuations. Any symbolic state contains at least one integer parameter valuation (the one that is large enough to correctly encode the value of the two counters), as well as all larger parameter valuations. Furthermore, since the proof only uses non-strict inequalities (in fact only equalities), from Lemma 3.4, all symbolic states contain at least one integer point. Hence the PTA used in [AHV93] to encode the 2-counter machine is an IP-PTA.
Finally, we show below (without surprise) that the EF-emptiness problem (shown to be decidable for L/U-PTAs [HRSV02]) and the EF-universality problem (shown to be decidable for integer-valued L/U-PTAs [BLT09]) are also decidable for bounded L/U-PTAs.
Theorem 4.15. The EF-emptiness and EF-universality problems are decidable for bounded L/U-PTAs.
Proof. In [HRSV02,BLT09], it is shown that decreasing a lower-bound parameter p − i or increasing an upper-bound parameter p + j in an L/U-PTA A can only add behaviors. Hence, deciding EF-emptiness can be done by testing the reachability of the location in the TA obtained from A by instantiating all p − i s with 0 and all p + j s with ∞. (Recall that testing the reachability of a location in a TA is decidable [AD94].) For a bounded L/U-PTA, this can be done in a similar manner, by testing the reachability of the location in the TA obtained from A by instantiating all p − i s with their minimal value and all p + j s with their maximal value in the (closed) bounded parameter domain.
EF-universality can be solved similarly, except that p − i s are replaced with their upper bound and p + j s are replaced with their lower bound.

Liveness properties
In this section, we consider liveness properties. More specifically, we consider the problems of the emptiness of the parameter valuations set for which all concrete runs eventually reach a given location (Section 5.1), for which there exists an infinite concrete run (Section 5.2), for which there exists a deadlock (Section 5.3), and for which a concrete run remains in a given set of locations (Section 5.4).

Undecidability of AF-emptiness.
It is known that AF-emptiness is undecidable for L/U-PTAs [JLR15]; reusing the encoding of the 2-counter machine proposed in our proof of Theorem 4.1, we now show that this result holds even for bounded L/U-PTAs.
Theorem 5.1. The AF-emptiness problem is undecidable for (closed) bounded L/U-PTAs with at least 3 clocks and 2 rational-valued parameters.
Proof. Let us consider the PTA A(M) encoding the 2-counter machine M proposed in our proof of Theorem 4.3. The PTA A(M) has only one parameter a which is used both as an upper bound and a lower bound. In our modified encoding, we replace a with two fresh parameters a − and a + . Then, in both the increment gadget ( Figure 2b) and the 0-test and decrement gadget (Figure 3a), we replace the guard y = 1 + a by a guard 1 + a − ≤ y and  Figure 5. AF-emptiness for bounded L/U-PTAs an invariant y ≤ 1 + a + ; we do the same for the guard z = 1 + a. We give the modified increment gadget in Figure 5b. We initialize the parameters a − and a + with the gadget in Figure 5a (adapted from [JLR15]) leading to the location q 0 . Clearly, starting from l 0 , we have AF(q 0 ) if and only if a − = a + > 0, because (1) if a − = 0 then it is possible to reach sink and therefore we do not have AF(q 0 ), and (2) any run that reaches l 1 before y is equal to a + can be extended by delaying a non-null amount of time into a run that will be blocked by the invariant of q 0 . So all runs should enter l 1 with y = a + , which is the case if and only if a − = a + . We therefore obtain an L/U-automaton with a − = a + and a + > 0.
Let us now go back to the increment gadget of Figure 5b. As in the proof of Theorem 4.3, when a − = a + > 0, exactly one path can be taken depending on the respective order of c 1 + 1 and c 2 . The invariants allow to avoid infinite delays in locations and since a − = a + , no run can be blocked inside the gadget. The same reasoning can be made for the decrement and zero-testing gadgets. Moreover we can bound the PTA by a − , a + ∈ [0, 1] without loss of behavior.
Hence we reduce the halting problem of 2-counter machine to the AF-emptiness problem for bounded L/U-PTAs: the machine halts iff there exists a value of a − = a + > 0, such that the location q halt is unavoidable in our bounded L/U-automaton.  Figure 6. Examples of PTA (a) and L/U-PTAs (b-d) Corollary 5.2. The AF-emptiness problem is undecidable for (closed) bounded L/U-PTAs with at least 3 clocks and 2 rational-valued parameters.
Proof. The proof of Theorem 5.1 works the same if we bound the PTA by setting a − , a + ∈ (0, 1].
Corollary 5.3. The AF-emptiness problem is undecidable for bounded IP-PTAs, for IP-PTAs and for bounded PTAs.
Proof. The AF-emptiness problem is undecidable for bounded L/U-PTAs (Theorem 5.1), which immediately gives the undecidability for bounded PTAs. Furthermore, the PTA used in the proof of Theorem 5.1 only uses non-strict inequalities; furthermore, a − = 0 and a + = 1 is a parameter valuation solution of any symbolic state. Hence, from Lemma 3.4, this PTA is a bounded IP-PTA, which gives the result for bounded IP-PTAs. As a consequence, the result also holds for general IP-PTAs.
Proof. Recall that, thanks to the monotonicity property of L/U-PTAs (recalled in Lemma 2.5), any run possible for a valuation v of the parameters is also possible for any valuation of the parameters for which the upper-bound (resp. lower-bound) parameters are larger (resp. smaller) than or equal to that of v.
Let A |bounds be a closed bounded L/U-PTA. Let v inf/sup be the valuation such that, for each lower-bound parameter p − , v inf/sup (p − ) = inf(p − , bounds) and, for each upper-bound parameter p + , v inf/sup (p + ) = sup(p + , bounds).
(1) If v inf/sup (A) contains an infinite run (which can be checked in PSpace [AD94], and can be performed efficiently in practice using, e. g., the zone graph [BY03]), then since A |bounds is closed, v inf/sup belongs to bounds, and hence the set of parameter valuations that yield an infinite run is not empty.
(2) On the contrary, if v inf/sup (A) contains no infinite run, then from the monotonicity property of L/U-PTAs (Lemma 2.5), no other valuation in bounds gives a TA with an infinite run, as such a TA could only contain less runs. Hence the set of parameter valuations that yield an infinite run is empty.
consider the L/U-PTA in Figure 6b. This L/U-PTA has an infinite run for p = ∞, but for any parameter valuation (i. e., different from ∞), the number of self-loops in 0 is bounded by p, and hence finite. However, extending to rational-valued parameters a result from [BLT09], we can still prove decidability.
Lemma 5.5. Given an L/U-PTA A and a subset of its locations T , the problem of the existence of at least one parameter valuation v such that v(A) has a run passing infinitely often through T is PSpace-complete.
Proof. Let us prove that there exists a rational-valued valuation satisfying the property iff there exists an integer-valued valuation doing so.
⇐ Considering an integer valuation is also a rational-valued valuation, the result trivially holds. ⇒ Assume there exists a rational-valued parameter valuation v for which v(A) contains an infinite run passing infinitely often through locations of T . Let v be the integer parameter valuation obtained from v as follows: Observe that this is not true for general PTAs: in Figure 6a, there is an infinite run passing infinitely often through 0 iff 0 < p < 1; therefore, there exist rational-valued valuations satisfying the property, but no integer-valued valuation. Now, in [BLT09, Theorem 8], it is proved that the problem of the emptiness of the set of integer parameter valuations for which there exists an infinite run passing infinitely often through T is PSpace-complete. This concludes the proof.
Theorem 5.6. The cycle-existence-emptiness problem is decidable and PSpace-complete for L/U-PTAs.
Proof. Let A be an L/U-PTA. The set of parameter valuations for which A has an infinite run is empty iff the set of parameter valuations for which A has an infinite run passing infinitely often through L (where L denotes all locations of A) is empty. Hence we can directly apply our intermediate Lemma 5.5 to conclude that this problem is decidable and PSpace-complete.
Without surprise (with the rule of thumb that any non-trivial problem for PTAs is undecidable), this problem becomes undecidable for general PTAs, even when bounded.
Theorem 5.7. The cycle-existence-emptiness problem is undecidable for (bounded) PTAs with at least 3 clocks and 1 parameter.
Proof. We reduce from the boundedness problem of a 2-counter machine, which is undecidable [Min67].
We start from the construction in the proof of Theorem 4.1 and add a self-loop (with no guard) on the location q halt (encoding the machine state q halt ), ensuring that whenever q halt is reachable then there exists an infinite run in the PTA. Then by examining exactly the same cases as before we see that the value of the counters remains bounded iff there exists a parameter valuation v such that v(A) yields an infinite run. Indeed the only two cases for which we do not have an infinite run correspond to (1) a = 0 (blocked by the initial gadget of Figure 2a), or (2) a > 0 and the counters of the machine are unbounded. In the latter case, the PTA will block in the increment gadget when taking the transition from l i2 to l i3 .
Finally note that the EC-emptiness problem for the class of open bounded L/U-PTAs (that does not fit in Theorems 5.4 and 5.6) remains an open problem. We conjecture that this is decidable using techniques derived from the robustness results of [San11] but the adaptation appears to require rather lengthy developments, with techniques quite different from those presented here, and is thus left to future work.

Deadlock-Existence-Emptiness.
Theorem 5.8. The deadlock-existence-emptiness problem is undecidable for closed bounded L/U-PTAs, with at least 3 clocks and 2 parameters.
Proof. We will use a reduction from the halting problem of a 2-counter machine. Let us consider the encoding used in the proof of Theorem 5.7, that we transform into an L/U-PTA by replacing any comparison of a clock with a (say x = a) into x ≤ a + ∧ x ≥ a − , where a − (resp. a + ) is a lower-bound (resp. upper-bound) parameter. The crux of the proof is in the original enforcement of constraints in the encoding (in particular with location q halt ) such that the deadlock property ensures that a − = a + .
We give the modified increment gadget in Figure 7c (the decrement gadget is modified in a similar fashion). We replace the initial gadget (Figure 2a) with the new one in Figure 7a. Before initializing the values of the counters, this gadget first ensures that a − ≤ a + .
We also add a new location q halt reachable from q halt as shown in the final gadget in Figure 7b. Finally, we add an unguarded transition (i. e., a transition the guard of which is true) from any location of the encoding (including that of the initial gadget, but excluding q halt ) to location q halt . That is, it is always possible to reach q halt from any location without condition, except from q halt . From that particular location, q halt is reachable if and only if a − < a + or a − = 0.
We assume the following bounds for the parameters: a − , a + ∈ [0, 1]. Let us show that there exists a parameter valuation for which the system contains at least one deadlock iff the 2-counter machine halts, which is undecidable [Min67]. Let us reason by cases on the valuations of a − and a + .
(1) If a − > a + , the initial gadget cannot be passed, but thanks to the unguarded transitions to q halt , all runs eventually end in q halt , from which the absence of deadlock is guaranteed by the unguarded self-loop.
(2) If a − < a + , the machine may not be properly simulated because some transitions do not occur at the right time and some run could reach q halt while the machine does not halt. Let us consider a run in the TA obtained with such a parameter valuation.
(a) either this run is infinite and remains in the machine (e. g., it loops infinitely through the increment, decrement and 0-test gadgets of our encoding). Then there is no deadlock.
Hence if the machine does not halt, the system is deadlock-free for all parameter valuations. (b) Or the machine halts. In this case, if c is the maximum value of both C 1 and C 2 over the (necessarily finite) halting execution of the machine, and if c > 0, then for valuations such that a − = a + ≤ 1 c , then there exists one run that correctly simulates the machine (beside plenty of runs that will go to q halt due to the unguarded transitions from all locations except q halt ); this run that correctly simulates the machine eventually reaches q halt . From q halt , for such valuations, the system is deadlocked: indeed, the transitions from q halt to q halt can only be taken if a − < a + or a − = 0. And there is no unguarded transition from q halt to q halt , which is crucial for the correctness of our encoding. The set of such valuations for which there exists a run that correctly simulates the machine is certainly non-empty: a − = a + = 1 c belongs to it (if c = 0 then we choose, e. g., a − = a + = 1 2 ). Hence, if the 2-counter machine halts, there exist parameter valuations for which a run has no discrete successor, and hence the system is not deadlock-free. Hence the 2-counter machine halts iff the set of valuations for which the automaton has at least one deadlock is not empty.
Corollary 5.9. The deadlock-existence-emptiness problem is undecidable for open bounded L/U-PTAs, for L/U-PTAs, for bounded PTAs and for PTAs, with at least 3 clocks and 2 parameters.
Proof. Let us consider each formalism: open bounded L/U-PTAs: In the above construction, we can assume, e. g., a − ∈ (0, 1], which does not impact the proof. L/U-PTAs: The bounds on the parameters are not required in the above construction: for valuations larger than 1 (that necessarily do not simulate correctly the machine), a gadget may block, therefore leading to q halt , from which the system is deadlock-free, hence without impacting the spirit of the proof. bounded PTAs: From the fact that a bounded L/U-PTA is a bounded PTA. PTAs: From the fact that an L/U-PTA is a PTA. Observe that the number of parameters can be reduced to 1 for (possibly bounded) PTAs by merging a − and a + into a single parameter a.

EG-Emptiness.
We finally prove in the following that the EG-emptiness problem is decidable for closed bounded L/U-PTAs (Theorem 5.10), and that lifting either closedness or boundedness leads to undecidability (Theorems 5.11 and 5.13).
Theorem 5.10. The EG-emptiness problem is decidable for closed bounded L/U-PTAs.
We will use Lemma 2.5 to deal with infinite paths but it is of no use for deadlocks: by decreasing lower-bounds or increasing upper-bounds, some deadlocks can actually be removed.
Proof. Let A |bounds be a closed bounded L/U-PTA and T be a subset of its locations. Since and upper-bound parameters p + by m + (p), includes all the runs that could be produced with other parameter valuations. Consequently, if there is an infinite path for some valuation, there is one for v inf/sup (note that, as emphasized above, this is not true for deadlocks).
In v inf/sup (A), it is decidable to find an infinite path staying in T , or conclude that none exists: this can be encoded into the CTL formula EG(T ∧ XG), to be verified on the (finite) region graph of v inf/sup (A) [AD94]. Since the region equivalence is a time-abstract bisimulation [TY01], this means for v inf/sup (A) "there exists a path that remains in T and in which every state has a discrete successor (possibly after letting some time elapse) in T ". That path therefore has an infinite number of discrete actions. If we do find such a path, we can then terminate by answering yes to the EG-emptiness problem. If we do not, then in v inf/sup (A), all paths staying in T are finite. If we keep only discrete actions and locations, which are in finite number, the resulting paths therefore form a finite tree. Let us recall again that, thanks to Lemma 2.5, all the discrete paths that stay in T and can be obtained with any parameter valuation, belong to that tree.
We can now explicitly compute the symbolic states (following the symbolic semantics recalled in Section 2.2.3) for all the paths in the finite tree (not only those that are maximal). Recall that each symbolic state s is a pair ( , C), where is a location and C a convex polyhedron representing all parameter valuations and clock valuations that can be reached by the given discrete path. In each of these polyhedra, we can explicitly check for the existence of a deadlock, in the line of [And16]: (1) remove all parts that are in the past of the guard of an outgoing transition in A (using operation C ), and that would satisfy the target location invariant; (2) test for emptiness.
If the result is not empty then there exists a point in the tested set which can be decomposed into a parameter valuation and clock valuation such that, by any time elapsing from the clock valuation, none of the guards can become true. We therefore have a deadlock. If the result is empty, by the same reasoning, we can take a transition (possibly by first letting some time elapse) from all states of C, so none of them are deadlocked. Note that both operations can be performed using classical polyhedral operations.
If we find a deadlock, then we can terminate and answer yes to the EG-emptiness problem. Otherwise, we can terminate and answer no, because we have checked all the potential discrete paths staying in T for any parameter valuation.
Note that this proof fails when the L/U-PTA is not bounded or closed. In particular, the closedness plays a key role in the sense that we are able to test the valuation v inf/sup . Consider first the L/U-PTA in Figure 6c made of a single location and a single loop with guard x = 1 ∧ y ≤ p and a reset of x, where x, y are clocks and p a parameter. This is clearly an L/U-PTA. As p grows, there are more and more discrete behaviors, but there is no cycle for any parameter valuation. In [BLT09], the authors provide a finite upper bound N A for the upper-bound parameters such that if there exists a valuation such that the valuated L/U-PTA has an accepting run, then the valuation giving 0 to lower bound parameters and N A to upper-bound parameters also ensures the existence of an accepting run. That bound used in this example would indeed prove the non-existence of a cycle for any parameter value, but it does not in turn allow us to derive a finite tree containing all the discrete behaviors, for any possible parameter value (a larger bound would still give more runs).
Similarly, now consider the L/U-PTA in Figure 6d. If 0 is excluded from the domain of p, we have a behavior similar to the previous example: as p gets closer and closer to 0, we have more and more discrete behaviors. And even if we could derive a lower boundà la [BLT09] ensuring the non-existence of a cycle here, it would not give a finite tree of all the possible discrete behaviors, for any parameter value. We can actually exhibit a very thin border between decidability and undecidability of L/U-PTAs by proving that, given a bounded L/U-PTA A |bounds with a single open bound in bounds or an unbounded L/U-PTA, the EG-emptiness problem becomes undecidable.
Theorem 5.11. The EG-emptiness problem is undecidable for open bounded L/U-PTAs, with at least 4 clocks and 4 parameters.
Proof. We will use a reduction from the halting problem of a 2-counter machine.
Let us consider the encoding used in the proof of Theorem 5.8, to which we will perform several modifications.
First, we force the 2-counter machine to execute in a constant 1-time unit duration as follows: (1) We replace any occurrence of "1" in the encoding with a parameter, either b − or b + (depending on whether the occurrence of 1 occurs as a lower-bound or an upper-bound); hence the duration of an increment or decrement gadget is now at least b − and at most b + . We give the increment gadget in Figure 8c. The encoding of a counter is as follows: when x = 0, then y = b − ac 1 and z = b − ac 2 , where a = a − = a + and b = b − = b + (for other parameter valuations, the machine is not properly simulated).
Typically, b will need to be sufficiently small compared to 1 to encode the required number of steps of the machine, and a will need to be sufficiently small compared to b to encode the maximum value of the counters. The decrement part of the "test and decrement" instruction is modified similarly.
(2) We modify the zero-test part of the "test and decrement" instruction so that its duration is within [b − , b + ], as in Figure 8d: only the first transition from q i to i4 encodes the zero-test, the two other transitions from i4 to i5 and from i5 to q k forcing [b − , b + ] time units to elapse while keeping the values of the clocks unchanged, assuming a − = a + and b − = b + (we will see later that other valuations do not matter). Let a = a − = a + and b = b − = b + . The zero-test requires here that b = y ∧ x = 0; in addition, z encodes c 2 as follows: z = b − ac 2 . After reaching l i4 and waiting enough time to take the transition to l i5 (i. e., a duration in ac 2 ) we have: z = b and x = y = ac 2 . After reaching l i5 and waiting enough time to take the transition to q k (i. e., a duration in b − ac 2 ) we have: z = b − ac 2 and x = y = b. Resetting x gives x = 0, y = b and z = b − ac 2 , which was the value when performing the 0-test. So the value of the clocks remains unchanged when b − = b + , and [b − , b + ] time units have elapsed in any case. (3) We add to any location in the entire system an invariant w ≤ 1, where w is a fresh clock that is never reset in the increment/decrement/zero-test gadgets. (These invariants are omitted in Figure 8.) Hence, the duration of any gadget is at least b − and therefore for any valuation b − > 0 the number of operations the machine can perform is finite due to the global invariant w ≤ 1.
Then, before starting the 2-counter machine encoding, we add an initial gadget given in Figure 8a. This gadget constrains a − ≤ a + , b − ≤ b + , and is such that when leaving the gadget then y, z ∈ [b − ≤ b + ] while x, w are 0. When b − = b + , this correctly encodes that the value of both counters is 0.
Then, we add a new q halt location (without any invariant, i. e., not requiring w ≤ 1), with two transitions from q halt as depicted in Figure 8b. We then add a transition (with no Proof. We will again use a reduction from the halting problem of a 2-counter machine. Our proof essentially relies on a mechanism similar to the proof of Theorem 5.11; however, we must use a different PTA encoding (the encoding used in the proof of Theorem 5.11 does not work for unbounded L/U-PTAs, as it strongly relies on the fact that b − be strictly positive), which prevents us to factor the proof as much as we would have wished.
We propose here an encoding inspired by that of a 2-counter machine proposed in [BBLS15] to prove the undecidability of the EF-emptiness problem for PTAs with a single integer-valued parameter used to encode the maximum value of the two counters (although not considered in [BBLS15], the proof also works identically with a rational-valued parameter). Starting from the initial configuration (q 0 , C 1 = 0, C 2 = 0) the machine either reaches q halt and halts, or loops forever. Knowing whether the machine halts is undecidable [Min67].
The encoding uses a single parameter a. Two clocks x and y are used to encode the value of the counters, while a third clock z is used as an auxiliary clock. Whenever z = 0, then x = c 1 and y = c 2 .
We modify this encoding by splitting the single parameter a into a lower-bound parameter a − and an upper-bound parameter a + , in the spirit of previous undecidability results for L/U-PTAs in this paper (Theorems 5.8 and 5.11).
In addition, we request that the entire execution takes a time less than b + , where b + is a fresh upper-bound parameter; this is achieved by adding an invariant w ≤ b + to all locations (with w a fresh clock never reset after the initial gadget).
We give the modified increment gadget for the first counter in Figure 9c (invariants are omitted). Note that, if z = 0 when entering q i then the time to pass this gadget is in [a − + 1, a + + 1].
The test and decrement gadget is similar, and given in Figure 9d. We performed a slight modification to the zero-test of [BBLS15], that was executed in 0-time; we require in our construction that each gadget takes at least one time unit. Hence, we rewrote it in Figure 9d so as to force at least one time unit to elapse after the clocks are tested, and so that the final value of the clock is not changed, when a − = a + (in the spirit of the same operation in the proof of Theorem 5.11): when performing the zero-test, we have x = z = 0 and y = c 2 . Then after a − c 2 + 1 time units (with a = a + = a − ), we have x = z = a + 1 − c 2 and y = a + 1, and we can take the transition to l i2 , resetting y. Then after c 2 time units, we have x = z = a + 1 and y = c 2 and we can take the transition to l i2 , resetting x and z. This gives finally x = z = 0 and y = c 2 and the time spent in the gadget is in [a − + 1, a + + 1], and therefore is more than one time unit. Gadgets for the second counter are symmetric.
We add before the first instruction the initial gadget given in Figure 9a, constraining a − ≤ a + and b + > 0, and resetting all clocks.
In addition, just as in Theorem 5.11, we add unguarded transitions from any location (including that of the initial gadget, but excluding q halt ) to a new location q halt . We finally add a transition from q halt to q halt as shown in the final gadget in Figure 9b.
Let us show that the 2-counter machine halts iff the set of valuations for which EG(L \ {q halt }) holds is not empty. We reason on the parameter valuations.  Table 3. Decidability of reachability (and AF) problems for PTAs and some subclasses of the unguarded transitions from any location to q halt . Hence if a − < a + and b + > 0, EG(L \ {q halt }) does not hold. (3) Now, assume a − = a + and b + > 0.

Class bL/U-PTAs bIP-PTAs L/U-PTAs
(a) Either the machine does not halt: in this case, after a maximum number of steps (typically at most b + ), a gadget will be blocked due to the invariant z ≤ b + , and the run will end in q halt because of the unguarded transitions from any location to q halt . Hence if the 2-counter machine does not halt, EG(L \ {q halt }) does not hold. (b) Or the machine halts: in this case, if c is the maximum value of both C 1 and C 2 over the (necessarily finite) halting execution of the machine, and if m is the length of this execution, and if c > 0, then for valuations such that a − = a + ≤ c and sufficiently large valuations of b + (typically b + ≥ m × (a + + 1) as a gadget can take up to a + + 1 time units), then there exists one run that correctly simulates the machine; this run eventually reaches q halt . From q halt , for such values, the system is deadlocked. Hence, if the 2-counter machine halts, there exist parameter valuations for which a run does not reach q halt , i. e., for which EG(L \ {q halt }) holds. Hence the 2-counter machine halts iff the set of valuations for which EG(L \ {q halt }) holds is not empty.
Remark 5.14. The above construction works also for integer-valued parameters, so this gives an undecidability result for integer-valued parameters too. The proof also works over discrete time (with integer-valued parameters).
Finally, using a single parameter a instead of both a − and a + in the above proof, we obtain a PTA (not L/U) with two parameters. Hence: Corollary 5.15. The EG-emptiness problem is undecidable for PTAs with at least 4 clocks and 2 parameters.

Summary
We give a summary of our results concerning EF-emptiness, EF-universality and AFemptiness in Table 3. We give from left to right the (un)decidability for bounded L/U-PTAs, bounded IP-PTAs, L/U-PTAs, IP-PTAs, bounded PTAs, and PTAs. Decidability is given in bold green preceded with " √ ", whereas undecidability is given in italic red preceded with "×". Our contributions are depicted using a plain background, whereas existing results are depicted using a light background.
We give another summary in Figure 10. Note that bounded L/U-PTAs and L/U-PTAs are in fact incomparable of terms of expressiveness [ALR16b]; they are therefore not included into each other in the figures. Decidability (resp. undecidability) is depicted in plain green  ×Cor. 5.9 × Th. 5.8 ×Cor. 5.9 EG-emptiness ×Cor. 5.15 × Th. 5.13 × Th. 5.11 √ Th. 5.10 AF-emptiness × [JLR15] × [JLR15] ×Cor. 5.2 × Th. 5.1  We then review our results concerning EG-emptiness, ED-emptiness, EC-emptiness and AF-emptiness in Table 4, where "bo L/U-PTAs" and "bc L/U-PTAs" denote bounded open and bounded closed L/U-PTAs respectively. Again, bold green preceded with " √ " denotes decidability while red preceded with "×" denotes undecidability. Note that, with the exception of AF-emptiness for L/U-PTAs (and PTAs), all these contributions are new, i. e., all these problems were open prior to our work.
Finally, we review EF-synthesis, i. e., for which subclasses of PTAs can the exact solution to the EF-synthesis problem be computed? We review in Table 5 from left to right the following subclasses: L-PTAs with integer-valued parameters, L-PTAs with rationalvalued parameters, bounded L/U-PTAs, bounded IP-PTAs, L/U-PTAs, IP-PTAs, bounded PTAs, bounded reset-PTAs, bounded PTAs with integer-valued parameters, and PTAs. Results for U-PTAs (resp. U-PTAs with integer-valued parameters) are identical to L-PTAs (resp. L-PTAs with integer-valued parameters)-and therefore not part of Table 5. Clearly, beyond the obvious case of bounded PTAs with integer-valued parameters [JLR15], only two subclasses allow for exact synthesis: integer-valued L-PTAs [BLT09] and bounded-reset PTAs [ALR21]. The case of L-PTAs or U-PTAs over non-necessarily integer parameters remains open.

Conclusion
Despite the vast number of undecidability results linked to the formalism of parametric timed automata, and to which we also contribute in this paper, we exhibited a new subclass of PTAs (namely bounded IP-PTAs) for which the EF-emptiness problem is decidable. By showing that bounded IP-PTAs are incomparable with L/U-PTAs, we strictly extend the set of PTAs for which this problem is decidable. Although we showed that it cannot be decided whether a PTA is an IP-PTA, we introduced a new syntactic subclass of IP-PTAs, namely reset-PTAs, for which, when bounded, the EF-emptiness problem is decidable. It is worth noting that, to the best our knowledge, there is no other non-trivial set of syntactic restrictions making the reachability emptiness problem decidable for PTAs (aside from L/U-PTAs, of course).
We also considered several decision problems, and contributed in solving several open problems for PTAs and subclasses: this was achieved thanks to the results proved for IP-PTAs, and to (variations of) an original proof for the undecidability of the EF-emptiness problem for general PTAs with a single bounded rational-valued parameter and only non-strict constraints.
We also have achieved some decidability for the existential parametric problem on the EG liveness property. This could be done by imposing original constraints to the classical subclass of L/U-PTAs, pertaining to the topology of the domain of the parameter values. This domain should be a closed and bounded hyperrectangle of the rational space. The subclass together with the EG property really lies on the boundary of decidability: on the one hand, we have proved that considering unbounded, or bounded but open domains leads again to undecidability for EG. On the other hand, if we consider-instead of the EG property which asks for the existence of a maximal finite or infinite path staying in some locations-only infinite maximal paths (existence of discrete cycles), then we have proved that the problem becomes decidable (for either closed bounded domains, or unbounded domains-the case of open bounded domains remains open). And finally, if we consider only finite maximal paths (existence of deadlocks), then we have proved that the problem becomes consistently undecidable.
Future works. Future work includes (1) studying the decidability of EC-emptiness for open bounded L/U-PTAs (possibly adapting techniques developed in [San11]), (2) extending the EG decidability result to shapes other than hyperrectangles, and (3) studying actual synthesis, and implementing efficient algorithms. In addition, the decidability of problems we proved undecidable for L/U-PTAs should be studied for two subclasses of L/U-PTAs, where all parameters are upper bounds (U-PTAs) or all lower bounds (L-PTAs).