Equivalence and Minimization for Model Checking Labeled Markov Chains

Model checking of Markov chains using logics like CSL or asCSL proves whether a logical formula holds for a state of the Markov chain. It has been developed in the last decade to a widely used approach to express performance and dependability quantities for models from a wide range of application areas. In this paper, model checking is extended to prove formulas for distributions rather than single states. This is a very natural way to express certain performance or dependability measures that depend on the state of the system rather than on a specific state in the state space of the Markov chain. It is shown that the mentioned logics can be easily extended from states to distributions and model checking algorithms can also be easily adopted. Furthermore, new equivalences will be introduced that are weaker than bisimulation but still characterize the extended logics.


INTRODUCTION
Model checking is nowadays widely used in functional and also in quantitative system analysis.The general idea is that one defines a property that a system should observe or should not observe as a formula in a temporal logic and then proves for each state or some states of the system, whether the formula holds or does not hold.
The mentioned approach is natural in functional system analysis where model checking is applied to the states of a labeled transition system (LTS) or automaton and properties are defined in the temporal logic CTL [6].Model checking can be applied in a fully automated way after the LTS and the formula have been specified.The corresponding algorithms are efficient in terms of the size of the LTS which, however, may grow exponentially in terms of the system specification.The outcome of model checking is a clear decision which states fulfill the required property and which do not fulfill the property.
The situation is different if model checking is extended to quantitative systems analysis as done with logics like CSL [1,4,3].In this case, Markov chains with labeled states and possibly labeled transitions are considered.In contrast to functional properties two quantifications can be introduced.First, it can be required that a property has to hold within some time interval and it can be defined that a property holds at least or at most for a given probability.In this situation it is often not natural to prove whether the property or formula holds for a specific state since the state of a stochastic system is usually given as a probability distribution over the set of states.To give a simple abstract example, we consider some formula that should hold with a probability of at least p.If we know that the system is with probability q in state 1 where the formula will hold with probability p 1 < p and it is with probability (1 − q) in state 2 where the formula holds with probability p 2 > p, then the formula holds if and only if qp 1 + (1 − q)p 2 ≥ p.This result cannot be achieved with the known approaches where the outcome is that the formula holds in state 2 and does not hold in state 1.The use of distributions rather than states is natural in stochastic systems.Two typical examples are: • One wants to check whether a formula holds in a specific situation, for example in steady state or after a specific event like a component failure, which cannot be characterized by a single state but by a probability distribution.
• The states of the Markov chain do not correspond to system states since phase type distributions are integrated to model non-exponential timing.In this case the system state corresponds to a set of states in the Markov chain and if one knows the time since the phase type distributions has been initiated, a probability distribution over the set of phases can be computed and it can be decided whether a formula holds for the distribution which means that it holds for the corresponding abstract system state.
Surprisingly, model checking has, to the best of our knowledge, not been extended to distributions.Distributions contain the common viewpoint of states, because a distribution assigning probability 1 to a single state corresponds to the proof that the state fulfills the formula.However, it is in general not possible to prove formulas that are defined for distributions using state formulas.
In this paper we extend the established logics CSL and asCSL [3] to consider distributions rather than states.This can be done in a very natural way and allows one to easily adopt model checking algorithms.A side effect is that new equivalence relations can be defined that preserve logical formulas.It is known that for CSL over states stochastic bisimulation is the equivalence that characterizes the logic.However, if one considers CSL over distributions, a weaker relation can be defined which relates distributions and includes the case that a state is related to a distribution over several states.The corresponding equivalence will be defined and it will be outlined that equivalence is still decidable and a minimal, possibly non-Markovian, representation can be computed for a Markov chain.
The outline of the paper is as follows.In the next section we briefly review related work.Then we introduce the basic model class, labeled Markov chains in continuous time.In Section 4 equivalence relations are defined and Section 5 introduces the extended logics, presents basic steps for model checking and shows that equivalent Markov models are indistinguishable under the logical formulas.All proofs are given in the appendix.Some smaller examples are used as running examples and Section 6 contains results for medium sized examples.

RELATED WORK
In the past labeled Markov processes have been defined in various forms.These definitions include stochastic process algebras [17] whose underlying stochastic model can be interpreted as a Markov process, stochastic automata [24] and interactive Markov chains [16] to mention only a few examples.For those Markov processes model checking approaches have been defined as extensions to the classical model checking of labeled transition systems or automata [6].
Usually model checking means to prove for each state whether a formula holds or does not hold.For performance or dependability analysis where time-dependent properties have to be analyzed the model is extended by stochastic timing information resulting in CTMCs.Model checking CTMCs based on the logic CSL has been introduced in [1].CSL has been extended in several ways, one extension is asCSL [3] that supports transition labels, while CSL considers only state labels.Moreover, efficient algorithms have been developed to verify CSL formulas [4].For more results in this area we refer the interested reader to the overview papers [5,20].
To decrease the effort for the analysis of Markov chains in general and in particular for model checking often bisimulation is used to reduce the state space and to obtain a smaller but equivalent representation of the process.Bisimulation for untimed systems has been introduced in [23,22] and was later extended to discrete time Markov chains in [21] and continuous time Markov chains in [8,17].The relation between CSL and bisimulation is derived in [2] and [18] presents several case studies that studied the effect of bisimulation on model checking.While the approaches for bisimulation mentioned so far all work at the state level, [13] extended bisimulation to the trace distribution of labeled Markov processes and [14] considers bisimulations if the initial state is given by a distribution rather than a single state.A model checking approach that extends CSL to models with phase type distributions is given in [9].Finally, [12] presented transformations of Markovian and non-Markovian models that define general equivalence relations and allow for an efficient minimization of those models.

LABELED MARKOV PROCESSES
We consider Markov chains with labeled transitions and states in continuous time following similar models that have been proposed in the literature over more than two decades [8,13,15,16,17,21,24].Definition 1 (Labeled Markov chains).A continuous time labeled Markov chain (CTLMC) is defined by the tuple CM = S , ϕ, A, G e (e ∈ A), AP, L , where • S = {s 0 , . . ., s n−1 } is a finite set of states, • ϕ ∈ [0, 1] 1,n defines a probability distribution over S , • A is a finite alphabet of transition labels, ≥0 is for each e ∈ A an n × n transition rate matrix, • AP is a set of atomic propositions, and • L : S → 2 AP is the state labeling function.
We often identify states by their number, i.e., i means s i if the interpretation is clear from the context.Thus, G e (i, j) is the rate of a transition from s i to s j labeled with e.We assume that in every state transitions with label e are either enabled such that n j=1 G e (i, j) > 0 or disabled such that n j=1 G e (i, j) = 0.The model includes CTMCs with only state labels (i.e., A = ∅).In this case we write G rather than G e for the transition matrix.Observe that in contrast to most other definitions of labeled Markov models, the initial distribution is part of the definition.To define a unique initial state s i , vector ϕ = e i is used where e i is a row vector with 1 in position i and 0 elsewhere.CTLMCs can be completely described by vectors and matrices.Define for a ∈ AP r a ∈ {0, 1} n,1 with r a (i) = 1 if a ∈ L(s i ) and 0 if a L(s i ).Sometimes we use R a = diag(r a ) which is a n × n diagonal matrix with r a (i) in position (i, i).(ϕ, G e (e ∈ A), r a (a ∈ AP)) is a short hand notation for a CTLMC.Sometimes we skip the sets A and AP, if they are clear from the context or irrelevant.
Let Ḡe = diag(G e I 1) and Ḡ = e∈A Ḡe be the diagonal matrix of transition rates, then defines the value of the probability density for the path σ.Ω i is the set of all paths of length i and Ω is the set of all finite paths.
For the definition of equivalent behavior, events and/or state propositions are observed and not detailed states.Thus, a sequence ς = (a 0 , e 0 , t 0 ), . . ., (a |ς|−1 , e |ς|−1 , t |ς|−1 ), a |ς| where a h ∈ AP, e h ∈ A and t h ∈ R ≥0 is a finite observable behavior.If for a CTLMC A is empty, we simply skip the second component and if states are not labeled we skip the first component.We define Υ as the set of all finite observable behaviors.For a CTLMC and an observable behavior, the density is given by

Running Examples
The first example is a CTLMC (ϕ, G, r a (a ∈ AP = {a, b})) without transition labels where , states s 0 , . . ., s 2 are labeled with a and state s 3 is labeled with b.

EQUIVALENCE OF LABELED MARKOV CHAINS
We first define equivalence of CTLMCs as a natural adoption of trace equivalence for labeled Markov processes [13].
In the following we define different equivalences for CTLMCs based on the minimal non-Markovian representation of Markov models developed in [12] and extended to compositional models in [10].These general equivalence relations are extensions to bisimulation on distributions as defined in [14].
Let CM 1 = (ϕ, G e (e ∈ A), r a (a ∈ AP)) and CM 2 = (υ, H e (e ∈ A), s a (a ∈ AP)) be two CTLMCs with m and n < m states, respectively.Then the following relations are defined: The first relation is a natural extension of strong lumpability [19] and bisimulation for labeled Markov chains [8,16,17].For strong lumpability or bisimulation matrix V contains only elements from {0, 1} which implies that in each row of V exactly one element equals 1, the remaining elements are 0. Thus, strong lumpability and bisimulation describe a mapping where one state from the larger state space is mapped on exactly one element in the smaller state space.In the more general definition used here, a state in the larger state space is represented by a weighted sum of states from the smaller state space.In a similar way, the second equivalence can be related to weak lumpability of Markov chains [19].For details we refer to [11].
The following theorem shows that any of the above equations assures equivalence, a proof is given in the appendix.Theorem 1. Two CTLMCs CM 1 and CM 2 that are in one of the relations ∼, or are equivalent.
ζ, D e , r a ∼ ζ (1) , D (1)  e , r (1)   a ∼ η (2) , F (2)  e , s (2)   a η, F e , s a a η (1) , F (1)  e , s (1)   a Figure 1: Relation ≈ for CTLMCs From [12] it can be concluded that U is non-singular and that the matrices V and W have full rank, such that we can find a left-and right-inverse, respectively, i.e.V # V = I and WW # = I.Now, assume that two CTLMCs, (ζ, D e , r) with m states and (η, F e , s a ) with n states are given.Then the two processes are in relation ≈ if the diagram in Figure 1 commutes.For each step in the diagram, an efficient algorithm exists that computes a minimal equivalent representation according to the required relation.Computation of the matrices V and W and the corresponding minimal representations can be done with the staircase algorithm from [12] with an effort in O(|A| • m 4 ) for CTLMCs of order m.Matrix U can be computed with an effort in O(|A| • m 3 ) for processes of order m using algorithms for the solution of Sylvester equations [7].
The following corollary follows from Theorem 1.

Running Examples
For the first example assume that µ 0 µ 1 and let p = (µ 2 −µ 1 )/(µ 0 − µ 1 ).Then define matrices and the CTLMC (υ = ϕV, H, s a (a ∈ {a, b})).Assume that the last state is labeled with b and the first two states are labeled with a. Then (υ = ϕV, H, s a (a ∈ {a, b})) is in relation ∼ to (ϕ, G, r a ).Observe that the new process is a CTLMC if and only if p ∈ [0, 1].

MODEL CHECKING LABELED MARKOV CHAINS
Different logics have been defined for model checking Markov chains with state and transition labels.Usually model checking means to prove for each state whether a formula holds or does not hold.This viewpoint has been transferred from qualitative system analysis to quantitative system analysis using transition probabilities or rates.However, if the state is defined in terms of a distribution rather than a unique state, as it is the case here and in [13], then a formula should hold with respect to a distribution which does not necessarily mean that it has to hold for all states with non-zero probabilities as shown below.
We consider here the logics CSL [4] for CTLMCs with state labels and asCSL [3] for CTLMCs with state and transition labels.In all cases we extend the logics to check a formula for a CTLMC with a given initial distribution.By defining an initial distribution equal to e i , this includes the common case, where a formula is checked for state s i .We extend the two logics CSL and asCSL in the mentioned way resulting in logics dCSL and dasCSL, where the letter d stands for distribution.
We begin with dCSL which is defined over CTLMCs without transition labels such that CM = (µ, G, r a (a ∈ AP)).

Definition 3 (dCSL).
A dCSL formula is defined as where ∈ {≤, ≥}, p ∈ [0, 1], I ⊂ R ≥0 is some non-empty interval, Φ is a state formula and Ψ is a path formula The syntax and semantics of the state and path formulas is as in CSL [1,4].
For a state distribution formula Φ and state s ∈ S , s | = Φ or s | = Φ holds.Let r Φ be a vector with r Φ (i) = 1 if s i | = Φ and 0 otherwise.As before R Φ = diag(r φ ).Furthermore we define for some transition matrix of a CTLMC G and a state formula Φ a matrix G[Φ] as the matrix that results from G when all states where Φ does not hold are made absorbing.This means that G Then for some distribution µ, For µ = e i , = ≥ and p = 1, µ | = DS p (Φ) is equivalent to s i | = Φ which shows that for any CSL formula an equivalent dCSL formula exists.
To handle path formulas we define in accordance to [4] γ(σ, h) = t(h), the time spent between the h − 1th and hth transition at path σ and a@t = s(h) where h−1 j=1 t( j) ≤ t and h j=1 t( j) > t.The latter sum is, of course, only defined for paths of a length ≥ h.The following two sets are defined Under appropriate measurability conditions the probability of an arbitrary path from Ω i (•) is well defined (see [4]) and can be computed from the following equations Observe that for dCSL transitions are not labeled such that we can write G rather than G e .The vectors q Φ 1 U [t 1 ,t 2 ] Φ 2 and q Xt 1 Φ can be computed efficiently using uniformization as shown in [4]. 1 Observe that the definition of G[Φ] corresponds to G[¬Φ] in [4] such that the equations syntactically differ but have the same semantics.
Distribution µ observes the distributional path formulas, if the following equations hold.
Observe that the major effort to verify µ | = DP p (. ..) is required to compute the vectors q . in (2,3).After the vectors are available at most one inner product has to be computed.This means that the asymptotic effort to verify dCSL formulas is the same than the effort to verify CSL formulas.
The following theorem shows the relation between ≈ and dCSL formulas, the proof can be found in the appendix.Theorem 2. Let CM 1 = (ϕ, G, r a (a ∈ A)) and CM 2 = (υ, H, s a (a ∈ A)) be two CTLMCs with CM 1 ≈ CM 2 , then for any dCSL formula Γ: Finally, we consider the extension of asCSL to dasCSL which follows the same ideas used for the definition of dCSL.Definition 4 (dasCSL).A dasCSL formula is defined as where ∈ {≤, ≥}, p ∈ [0, 1], I ⊂ R ≥0 is some non-empty interval, Φ is a state formula and Ψ is a path formula Ψ ::= α I which is formally defined below.
For the definition of path formulas we follow [3].α is a program that specifies properties which have to hold for finite paths.Programs are specified by the following grammar where Φ is a dasCSL state formula and e ∈ A ∪ { √ }, √ is a symbol that does not belong to A. We define α 0 = ε and α i = α; α i−1 for i ≥ 1. Symbol ; denotes the concatenation of two programs and α * the Kleene star, the n-fold sequential composition for arbitrary n > 0.
The set of paths Ω(α) that fulfill the program α can be defined inductively from the following sets of finite paths A path σ belongs to the set Ω(α I ), if σ ∈ Ω(α) and |σ|−1 h=0 t(h) ∈ I. Since programs are regular expressions they can be equivalently characterized as the language of a finite acceptor.This acceptor can be transformed into a deterministic acceptor which means that for each path σ, there exists a unique run of the acceptor and the path is accepted if it ends in a final state.Details of the construction of the acceptor for a program α and a CTLMC CM can be found in [3].
For some program α and CTLMC CM let DA = (Z, B, δ, z 0 , F ) where • Z is a finite set of states, • B is an alphabet of transition labels of the form (Φ, e) where Φ is a state formula for CM and e ∈ A, • δ : Z × B → Z is the (deterministic) transition function, • z 0 ∈ Z is the unique initial state, • F ⊂ Z is the set of final states, be a deterministic automaton that accepts exactly the paths of CM that result in a successful run of program α. Observe that √ does not appear as transition inscription here.The generation of the deterministic automaton including the elimination of √ is described in [3].
To check µ | = DP p α I , we build the composed automaton DA × CM CM = S , ϕ, A, G a , AP, L without transition labels which can be interpreted as a CTLMC without transition labels.We build the automaton on the complete state space Z × S which might contain unreachable states and is not necessary for model checking but helps to prove the preservation of formulas by the previously proposed equivalence relations.The composed automaton is where Then model checking can be performed using standard methods for the new CTLMC.Let r f in be a vector with 1 in position i if s i = (s, z), z ∈ F and 0 otherwise.If I = [0, t], then vector is computed by a transient analysis and For I = [t 1 , t 2 ] with 0 < t 1 ≤ t 2 , vector q α I is computed in two steps which are explained in [3].We first compute the vector by a transient analysis.This corresponds to the second step described in [3].Then is computed and used in (5) to check the formula.Again the asymptotic effort to check a dasCSL formula for distribution µ is the same than the effort to check the same formula in asCSL for a single state because the evaluation of ( 6) and ( 7) requires much more time than the computation of the final result by an inner product (dasCSL) or by selecting a single element (asCSL).
Theorem 3. Let CM 1 = (ϕ, G, r a (a ∈ A)) and CM 2 = (υ, H, s a (a ∈ A)) be two CTLMCs with CM 1 ≈ CM 2 , then, for any dasCSL formula Γ: The proof can be found in the appendix.

EXAMPLES 6.1 An M/M/1 Queue
We consider a simple M/M/1 queue with capacity 5 as a running example to present dasCSL model checking.Arrivals occur with rate λ = 1, the service rate is µ = 2.The CTLMC corresponding to the system is shown in Fig. 2. We use two transition labels a and b. a is used for normal transitions where either a customer arrives or is served, b is used for customers that are lost due to a full queue.The atomic proposition empty is associated with state s 0 .The other states are labeled with busy.We analyze the system for two different scenarios regarding the initial distribution of the queue length.The distribution µ 1 = [0.4,0.3, 0.2, 0.1, 0, 0] models a normal load, while distribution µ 2 = [0.1,0.15, 0.2, 0.3, 0.15, 0.1] models a high load.
Then, dasCSL is used to investigate the probability that at most 2 customers are lost before the empty state is reached again within the next t time units.The deterministic automaton describing the  3.It accepts inputs that violate the property mentioned above, i.e. sequences with more than two blocked customers before the empty state is reached.The composed automaton has a 24 × 24 matrix F. The submatrices are given by F q 0 ,q 0 = G a , F q 0 ,q 1 = F q 1 ,q 2 = F q 2 ,q 3 = G b , F q 1 ,q 0 = F q 2 ,q 0 = R empty G a , F q 1 ,q 1 = F q 2 ,q 2 = R busy G a and F q 3 ,q 3 = G a + G b .All other submatrices are zero.With these matrices we evaluated Eq. 4 for different values for t between 0 to 600.The probabilities p for that µ i | = DP ≤p α [0,t] is fulfilled are shown in Fig. 4. As second example we consider a finite capacity queue with 2phase hyperexponential arrival and service time distributions.The inter-arrival time distribution function has an initial state vector (0.95227, 0.047733) and phase rates (1.5236, 0.076373) (i.e., a 2phase hyperexponential distribution with mean 1.25 and squared s 0 coefficient of variation 10).For the service time distribution we choose a 2-phase hyperexponential distribution with initial state vector (0.97559, 0.024405) and phase rates (1.99512, 0.04881) (i.e., a distribution with mean 1 and squared coefficient of variation of 20).The queue has a maximal capacity of 10 and we add an additional absorbing state that is entered, if a customer arrives to a fully occupied queue.States can be described by a triple (i, j, k) where i ∈ {−1, 0, . . ., 10}.i = −1 defines the absorbing state, and i = 0, . . ., 10 describes the number of customers in the queue.j indicates the phase of the hyperexponential distribution for the arrivals and becomes 0 for i = −1.Similarly, k indicates the phase of the hyperexponential distribution for the service and becomes 0 for i = −1 and i = 0. Thus, the state space consists of 43 states, 2 states where the queue is empty, 40 states with 1 through 10 customers in the queue and one absorbing state indicating an overflow.We assume that the two states describing the empty queue observe an atomic proposition empty and the absorbing state observes atomic proposition full.Transitions are not labeled.
t The goal is now to compute DP >p ¬ empty U [0,t] f ull which equals the probability that a customer is lost before the system becomes empty.We assume that the analysis begins immediately after the first customer arrived to an empty system.Thus, the system can be in one of four states (1, 1, 1), (1, 1, 2), (1, 2, 1) and (1, 2, 2).This implies that the initial distribution can be easily computed from the two initial vectors of the hyperexponential distributions.Naturally, this defines a distribution and not a single state.Table 1 shows the probabilities p for which the formula holds for different values of t, for the initial distribution and for the different states in which the system can be in for population 1. Obviously, p depends heavily on the state and model checking of the isolated states does not answer the question whether the formula holds for the system or does not hold.Whereas it holds with some probability between the extreme values for the states when the distribution is considered.Standard CSL cannot be used to express the required property.

The Workstation Cluster
The workstation cluster is a widely used benchmark in stochastic model checking [18].The model describes two clusters of workstations connected via a backbone net and each cluster itself is realized by a star topology with a central switch and N workstations.The system provides premium service as long as at least N connected workstations are available and minimum service if at least N/2 connected workstations are available.We assume that states are la-beled with min if they provide minimum but not premium service, they are labeled with prem if they provide premium service.As shown in [18] stochastic bisimulation can be applied to reduce the state space of the model by a factor of approximately two, a further reduction with the equivalence relation presented here is not possible.
A typical formula for the analysis of the workstation cluster is DS ≥p min U [0,t] prem which states that the system delivers minimum service and recovers within t units of time to a state where premium service is provided without reaching a state where the service level drops below minimum.Typically one would like to analyze the formula starting from the point where the service drops from premium to minimum.
The formula can be checked for CM = S , ϕ, ∅, G, {min, prem, none}, L where G − Ḡ is the generator matrix of the CTMC described by the workstation cluster.Let φ(G − Ḡ) = 0 be the stationary vector of the CTMC which is for the example unique since the CTMC is ergodic.Then the initial vector for the mentioned situation is computed as Then the until formula can be evaluated as described above.

CONCLUSIONS
We presented an extended approach for model checking Markov models with labeled transitions and states.In contrast to known approaches, distributions rather than single states are considered.It is shown that common logics can be easily extended to adopt this viewpoint and that the approach allows one to extend equivalence relations that preserve logical formulas beyond bisimulation.The use of distributions can be applied to prove properties of a system that hold after specific events that have been observed but do not necessarily imply that the system is in a specific state.Examples are arrivals or departures of customers, failure of components or even the steady state distribution conditioned on some subset of the state space.It is quite natural to ask whether a system fulfills a formula in such a situation which is possible with the extended logics proposed here but cannot be analyzed with standard approaches for model checking.Standard model checking algorithms can be easily adopted for the extended logics whereas the introduction of the new equivalence relations is a real extension of bisimulation at state level since bisimulation no longer characterizes the smallest system that is indistinguishable under a formula.The latter aspect will be investigated in the future.
It is, of course, possible to extend the approach to other logics that have been proposed in a Markovian setting and also to discrete time models.Furthermore, compositionality of the approach should be considered in the future.
Observe that Using Eq. 8 we have for an arbitrary observable behavior ς ∈ Υ that For the proofs of and the relations

Proof of Theorem 2
We have to prove the theorem for the 3 equivalences used in Fig. 1.
If each equivalence preserves the result of dCSL formulas, then the same holds for relation ≈.The detailed proof for relation ∼ will be presented, the proofs for and are very similar.
For the following proofs we consider CM 1 = (ϕ, G, r a ) of order m and CM 2 = (υ, H, s a ) of order n (< m) that are in relation ∼ which implies ϕV = υ, GV = VH and R a V = VS a .We first prove the theorem for state formulas Φ that do not contain an until or next operator.
If Φ = tt, then R Φ = R tt = I m and I m V = VI n .Observe that the first identity matrix is of order m and the second of order n.
Consequently, the relations between the matrices holds for all formulas built from the logical composition of atomic propositions.
We continue with the analysis of S p (Φ) and assume R Φ V = VS Φ which implies r Φ = Vs Φ .Then let φ = lim t→∞ ϕe t(G− Ḡ) and ῡ = lim t→∞ υe t(H− H) .Since GV = VH and ḠV = V H the relation can be easily shown in a similar way as Eq. 8. Therefore, also φV = ῡ holds.This implies We assume that R Φ i V = VS Φ i holds for i = 1, 2, i.e. formulas Φ 1 , Φ 2 have already been evaluated and equivalence has been proved.Since (G − Ḡ)V = V(H − H) we also have Finally, we analyze X I (Φ) and define A recursive application of the transformations implies that the identities hold for all state and path formulas.The proofs for the relations and are again similar.Since the equivalence between dCSL formulas holds for all transformations, it also holds along the diagram in Fig. 1.

Proof of Theorem 3
Again we show the proof for ∼, the proofs for the remaining relations are similar.We consider CM 1 = (ϕ, G, r a ) of order m and CM 2 = (υ, H, s a ) of order n (≤ m) with CM 1 ∼ CM 2 which implies the existence of a matrix V such that ϕV = υ, GV = VH and R a V = VS a .It is sufficient to show equivalent behavior on path formulas, as the rest follows from Theorem 2. We consider a dasCSL path formula α I .For the path formula first a non-deterministic program automata is generated which depends only on α.Then from the non-deterministic automaton and the CTLMC a deterministic automaton is generated.The construction depends only on the accepting paths of the CTLMC (see [3,Sect. 6.1]) which means that for automata in relation ≈ the same deterministic automaton is generated since the paths are identical due to the equivalence of the processes.Thus, we obtain a finite acceptor DA = (Z, B, δ, z 0 , F ).The satisfiability properties of α I in CM We want to show that it is equivalent to υ | = DP p α I .For this, we consider the matrix It is easy to see that F 1 V will be a matrix consisting of submatrices which have the form (Φ,a):δ(Φ,a)=z R Φ G a V for z, z ∈ Z.By assumption, we know that this is equal to (Φ,a):δ(Φ,a)=z R Φ VH a = V (Φ,a):δ(Φ,a)=z S Φ H a , so we get F 1 V = V F 2 .Also by assumption we get υ 1 V = V υ 2 .For label vectors t 1 a in CM 1 and t 2 a in CM 2 , it is also easy to see that they are products of Z and r a and respectively, Z and s a ; thus, we also have T 1 a V = V T 2 a .Thus, it follows that the product automata are bisimilar, and thus, ϕ | = DP p α I ⇐⇒ υ | = DP p α I .
e and ∀a ∈ AP : R a V = VS a .2. CM 1 CM 2 holds if and only if there exists a matrix W ∈ R n,m with W I 1 m = I 1 n , such that ϕ = Wυ, W Ḡ = HW, ∀e ∈ A : WG e = H e W and ∀a ∈ AP : WR a = S a W. If m = n a third relation is defined: 3. CM 1 CM 2 holds if and only if there exists a matrix U ∈ R n,n with U I 1 = I 1, such that ϕU = υ, ḠU = U H, ∀e ∈ A : G e U = UH e and ∀a ∈ AP : R a U = US a .

Corollary 1 .
If two CTLMCs are in relation ≈, then they are equivalent.

2 Figure 4 :
Figure 4: Results for the Queueing Example
We t Ḡ = e t HW and e t ḠU = Ue t H can be shown similarly to Eq. 8. Then the proofs follow immediately by observing WR a G e = S a WG e = S a H e W and R a G e U = R a UH e = US a H e .