Lumping-based equivalences in Markovian automata: algorithms and applications to product-form analyses

Markovian process algebras and stochastic automata are rigorous formalisms with well deﬁned semantics that allow one to describe and verify both quantitative and qualitative properties of concurrent interacting systems. The analysis of such models is usually based on equivalence relations on the state space which are used to abstract from unwanted details and to identify those systems that exhibit the same behaviour for an external observer. In this paper we consider two relations over stochastic automata, named lumpable bisimulation and exact equivalence , that induce a strong and an exact lumping, respectively, on the underlying Markov chains. We show that an exact equivalence over the states of a non-synchronising automaton is indeed a lumpable bisimulation for the corresponding reversed automaton and then it induces a strong lumping on the time-reversed Markov chain underlying the model. This property allows us to prove that the class of quasi-reversible models is closed under exact equivalence. Quasi-reversibility is a pivotal property to study product-form models, i.e., models whose equilibrium distribution can be eﬃciently computed as the product of the equilibrium distribution of their sub-components opportunely parametrised. Hence, exact equivalence turns out to be a theoretical tool to prove the product-form of models by showing that they are exactly equivalent to models which are known to be quasi-reversible. Algorithms for computing both lumpable bisimulation and exact equivalence are introduced. A case study as well as performance tests are also presented.


Introduction
Stochastic models play a key role in reliability and performance analysis providing a sound framework for real improvements of software and hardware architectures, including telecommunication systems. Continuous Time Markov Chains (CTMCs) constitute the underlying semantics model of a plethora of modelling formalisms such as Stochastic Petri nets [24], Stochastic Automata Networks (SAN) [26], queueing networks [3] and a class of Markovian process algebras (MPAs), e.g., [15,13]. The aim of these formalisms is to provide a highlevel description language for complex real-time systems and automatic analysis techniques. Modularity in the model specification is an important feature of both MPAs and SANs that allows one to describe large systems in terms of interactions of simpler components. Nevertheless, one should notice that a modular specification does not lead to a modular analysis, in general. Thus, although the intrinsic compositional properties of such formalisms are extremely helpful in the specification of complex systems, in many cases carrying out an exact analysis for those models (e.g., those required by quantitative model checking) may be extremely expensive from a computational point of view.
The use of equivalence relations for quantitative models is an important formal approach that allows one to compare different systems as well as to improve the efficiency of some analysis [19,11,10]. To give an example, if we can prove that a model P is in some sense equivalent to Q and Q is much simpler than P , then we can carry out an analysis of the simplest component to derive the properties of the original one.
Bisimulation based relations on stochastic systems inducing the notions of ordinary (or strong) and exact lumpability for the underlying Markov chains have been studied in [6,2,15,9,28]. In this paper, we first recall the notions of lumpable bisimulation [16] and exact equivalence [8,9] which have been both proved to be a congruence for Markovian process algebras and stochastic automata whose synchronisation semantics is defined as the master/slave synchronisation of the Stochastic Automata Networks (SAN) and comply with the ordinary and exact, respectively, lumping for Markov processes.
Interestingly, we show that an exact equivalence over a non-synchronising stochastic automaton is indeed a lumpable bisimulation on the reversed automaton (see [22] for a similar result in the context of Markov chains instead of stochastic automata) and then it induces a strong lumping on the time-reversed Markov chain underlying the model. This important property, allows us to prove that the class of quasi-reversible [17] stochastic networks is closed under exact equivalence. Quasi-reversibility is one of the most important and widely used characterisations of product-form models, i.e., models whose equilibrium distribution can be expressed as the product of functions depending only on the local state of each component. Informally, we can say that product-forms project the modularity in the model definition to the model analysis, thus drastically reducing the computational costs of the derivation of the quantitative indices. Basically, a composition of quasi-reversible components whose underlying chain is ergodic has a product-form solution, meaning that one can check the quasi-reversibility modularly for each component, without generating the whole state space.
In this paper we provide a new methodology to prove or disprove that a stochastic automaton is quasi-reversible: it is sufficient to show that a model is exactly equivalent to another one which is known to be (or to be not) quasi-reversible. In practice, this approach is useful because proving the quasireversibility of a model may be a hard task since it requires one to reverse the underlying CTMC and check some conditions on the reverse process, see, e.g., [17,12]. Conversely, by using exact equivalence, one can prove or disprove the quasi-reversibility property by considering only the forward model, provided that it is exactly equivalent to another (simpler) quasi-reversible model known in the wide literature of product-forms. Moreover, while automatically proving quasi-reversibility is in general unfeasible, checking the exact equivalence between two automata can be done algoritmically by exploiting a partition refinement strategy, similar to that of Paige and Tarjan's algorithm for bisimulation [25].
We prove that both the notion of lumpable bisimulation and that of exact equivalence can be reduced to a labeled weighted compatibility problem and we generalize the algorithm for compatibility presented in [30] in order to deal with labels without increasing its computational complexity.
This paper is an extended version of the work published in [21]. We extended our previous work by presenting rigorous proofs for all the results stated in the paper and proposing an efficient algorithm for computing both lumpable bisimulations and exact equivalences. Moreover, we introduce a case study and show a set of performance tests for an implementation of the algorithms.
The paper is structured as follows. Section 2 introduces the notation and recalls the basic definitions on Markov chains. In Section 3 we give the definition of stochastic automata and specify their synchronisation semantics. Section 4 presents the definition of quasi-reversibility for stochastic automata. Lumpable bisimulation and exact equivalence are introduced in Section 5. In this section we prove that the class of quasi-reversible automata is closed under the exact equivalence relation. Algorithms for computing lumpable bisimulation and exact equivalence are presented in Section 6. In Section 7 we describe a case study and present some performance tests. Finally, Section 8 concludes the paper.

Markov chains, reversibility and lumpability
In this section we review the theoretical background on continuous-time Markov chains and the concepts of reversibility and lumpability.

Continuous-Time Markov Chains
A Continuous-Time Markov Chain (CTMC) is a stochastic process X(t) for t ∈ R + taking values into a descrete state space S such that (1) X(t) is stationary, i.e., (X(t 1 ), X(t 2 ), . . . , X(t n )) has the same distribution as (X(t 1 + τ ), X(t 2 +τ ), . . . , X(t n +τ )) for all t 1 , t 2 , . . . , t n , τ ∈ R + ; (2) X(t) has the Markov property, i.e., the conditional (on both past and present states) probability distribution of its future behaviour is independent of its past evolution until the present state: A CTMC X(t) is said to be time-homogeneous if the conditional probability Prob(X(t + τ ) = s | X(t) = s ) does not depend upon t, and is irreducible if every state in S can be reached from every other state. A state in a Markov process is called recurrent if the probability that the process will eventually return to the same state is one. A recurrent state is called positive-recurrent if the expected number of steps until the process returns to it is finite. A CTMC is ergodic if it is irreducible and all its states are positive-recurrent. In the case of finite Markov chains, irreducibility is sufficient for ergodicity.
An ergodic CTMC possesses an equilibrium (or steady-state) distribution, that is the unique collection of positive real numbers π(s) with s ∈ S such that lim t→∞ Prob(X(t) = s | X(0) = s ) = π(s) .
We denote by q(s, s ) the transition rate between two states s and s , with s = s . The infinitesimal generator matrix Q of a CTMC X(t) with state space S is the |S| × |S| matrix whose off-diagonal elements are the q(s, s )'s and whose diagonal elements are the negative sum of the extra diagonal elements of each row. Any non-trivial vector of real numbers µ satisfying the system of global balance equations (GBEs) is called invariant measure of the CTMC. For an irreducible CTMC X(t), if µ 1 and µ 2 are two invariant measures of X(t), then there exists a constant k > 0 such that µ 1 = kµ 2 . If the CTMC is ergodic, then there exists a unique invariant measure π whose components sum to unity, i.e., s∈S π(s) = 1 . In this case π is the equilibrium or steady-state distribution of the CTMC.

Reversibility
It is well-known that the solution of the system of global balance equations in (1) is often unfeasible when the CTMC underlying a real system model has a large number of states. However, the analysis of an ergodic CTMC in equilibrium can be greatly simplified if it satisfies the property that when the direction of time is reversed the stochastic behaviour of the process remains the same.
In the following we denote by X R (t) the reversed process of X(t). It can be shown that if X(t) is stationary then also X R (t) is stationary [17].
For a stationary Markov process there exists a necessary and sufficient condition for reversibility expressed in terms of the equilibrium distribution π and the transition rates (see [17]). Proposition 2.1. (Transition rates and probabilities of reversible processes) A stationary CTMC with state space S and infinitesimal generator Q is reversible if there exists a vector of positive real numbers π summing to unity, such that for all s, s ∈ S with s = s , π(s)q(s, s ) = π(s )q(s , s) .
In this case π is the equilibrium distribution of the CTMC.
The reversed process X R (t) of a Markov process X(t) can always be defined even when X(t) is not reversible. In [17,12] the authors show that X R (t) is a CTMC and its transition rates are defined according to the following proposition.
Proposition 2.2. (Transition rates of reversed processes) Given the stationary CTMC X(t) with state space S and infinitesimal generator Q, the transition rates of the reversed process X R (t), forming its infinitesimal generator Q R , are defined as follows: for all s, s ∈ S, where q R (s , s) denotes the transition rate from s to s in the reversed process and µ is an invariant measure of X(t).
The forward and the reversed processes share all the invariant measures and in particular they possess the same equilibrium distribution π. In the following, for a given CTMC with state space S and for any state s ∈ S we denote by q(s) (resp., q R (s)) the quantity s ∈S,s =s q(s, s ) (resp., s ∈S,s =s q R (s, s )).

Lumpability
The notion of lumpability allows one to generate an aggregated Markov process that is smaller than the original one and then easier to solve. The concept of lumpability can be formalized in terms of equivalence relations over the state space of the Markov chain. Any such equivalence induces a partition on the state space of the Markov chain and aggregation is achieved by clustering equivalent states into macro-states, thus reducing the overall state space. In general, when a CTMC is aggregated the resulting stochastic process will not have the Markov property. However, if the partition can be shown to satisfy the so called strong lumpability condition [18,1], then the Markov property is preserved and the equilibrium solution of the aggregated process may be used to derive an exact solution of the original one.
Definition 2.1. (Strong lumpability) Let X(t) be a CTMC with state space S and ∼ be an equivalence relation over S. We say that X(t) is strongly lumpable with respect to ∼ (resp., ∼ is a strong lumpability for X(t)) if ∼ induces a partition on the state space of X(t) such that for any equivalence class S i , S j ∈ S/ ∼ with i = j and s, s ∈ S i , s ∈Sj q(s, s ) = s ∈Sj q(s , s ) .
Thus, an equivalence relation over the state space of a Markov process is a strong lumpability if it induces a partition into equivalence classes such that for any two states within an equivalence class their aggregated transition rates to any other class are the same. Notice that every Markov process is strongly lumpable with respect to the identity relation, and also with respect to the trivial relation having only one equivalence class.
A probability distribution π is said to be equiprobable with respect to a partition of the state space S of an ergodic Markov process if for all the equivalence classes S i ∈ S/ ∼ and for all s, s ∈ S i , π(s) = π(s ).
In [27] the notion of exact lumpability is introduced as a sufficient condition for a distribution to be equiprobable with respect to a partition. Definition 2.2. (Exact lumpability) Let X(t) be a CTMC with state space S and ∼ be an equivalence relation over S. We say that X(t) is exactly lumpable with respect to ∼ (resp., ∼ is an exact lumpability for X(t)) if ∼ induces a partition on the state space of X(t) such that for any S i , S j ∈ S/ ∼ and s, s ∈ S i , s ∈Sj q(s , s) = s ∈Sj q(s , s ) .
An equivalence relation is an exact lumpability if it induces a partition on the state space such that for any two states within an equivalence class the aggregated transition rates into such states from any other class are the same. Proposition 2.3. Let X(t) be an ergodic CTMC with state space S and ∼ be an equivalence relation over S. If X(t) is exactly lumpable with respect to ∼ (resp., ∼ is an exact lumpability for X(t)) then for all s, s ∈ S such that s ∼ s , µ(s) = µ(s ), where µ is an invariant measure for X(t).

Stochastic Automata
Many high-level specification languages for stochastic discrete-event systems are based on Markovian process algebras [15,6,14] that are characterized by powerful composition operators and timed actions whose delay is governed by independent random variables with a continuous-time exponential distribution. The expressivity of such languages allows the specification of both qualitative and quantitative properties in a single framework. In this paper we consider stochastic concurrent automata with an underlying continuous time Markov chain as common denominator of a wide set of Markovian stochastic process algebra. Stochastic automata are equipped with a composition operation by which a complex automaton can be constructed from simpler components. Our model draws a distinction between active and passive action types, and in forming the composition of automata only active/passive synchronisations are permitted. An analogue semantics is proposed for Stochastic Automata Networks in [26].
Definition 3.1. (Stochastic Automaton (SA)) A stochastic automaton P is a tuple (S P , T P , ; P , q P ) where • S P is a denumerable set of states called state space of P , • T P is a denumerable set of action types, partitioned into disjoint sets A P of active types, P P of passive types and the set {τ } of the unknown or internal type, • ; P ⊆ (S P × S P × T P ) is a transition relation such that for all s ∈ S P , (s, s, τ ) / ∈; P , 1 • q P is a function from ; P to R + such that ∀s 1 ∈ S P and ∀a ∈ P P , s2:(s1,s2,a)∈; P q P (s 1 , s 2 , a) ≤ 1.
We denote by → P the relation containing all the tuples of the form (s 1 , s 2 , a, q) where (s 1 , s 2 , a) ∈; P and q = q P (s 1 , s 2 , a). For a ∈ A P ∪ {τ }, we say that q P (s, s , a) ∈ R + is the rate of the transition from state s to s with type a. Notice that this is indeed the apparent transition rate from s to s relative to a. If a is passive then q P (s, s , a) ∈ (0, 1] denotes the probability that the automaton synchronises on type a with a transition from s to s . In the following, we assume that q P (s, s , a) = 0 whenever there are no transitions with type a from s to s . If s ∈ S P , then for all a ∈ T P we write q P (s, a) = s ∈S q P (s, s , a). Moreover we denote by q P (s, s ) = a∈T P q P (s, s , a) and q P (s) = a∈T P q P (s, a). We say that P is closed if P P = ∅. We use the notation s 1 a ; P s 2 to denote the tuple (s 1 , s 2 , a) ∈; P ; we denote by s 1 (a,r) − −− → P s 2 (resp., s 1 (a,p) − −− → P s 2 ) the tuple (s 1 , s 2 , a, r) ∈→ P (resp., (s 1 , s 2 , a, p) ∈→ P ).
The CTMC underlying a closed stochastic automaton is defined as follows.
Definition 3.2. (CTMC underlying a closed SA) The CTMC underlying a closed stochastic automaton P , denoted X P (t), is defined as the CTMC with state space S P and infinitesimal generator matrix Q defined as: for all s 1 = s 2 ∈ S P , q(s 1 , s 2 ) = a,r:(s1,s2,a,r)∈→ P r .
1 Notice that τ self-loops do not affect the equilibrium distribution of the CTMC underlying the automaton. Moreover, the choice of excluding τ self-loops will simplify the definition of automata synchronisation.
For ergodic chains, we denote an invariant measure and the equilibrium distribution of the CTMC underlying P by µ P and π P , respectively.
We say that an automaton is irreducible if for each pair of states there exists a sequence of transitions connecting them. We say that a closed automaton P is ergodic if its underlying CTMC is ergodic.
The synchronisation operator between two stochastic automata P and Q is defined in the style of the master/slave synchronisation of SANs [26] based on the Kronecker's algebra and the active/passive cooperation used in Markovian process algebra such as PEPA [15].
We define the synchronisation operator ⊗ L that is an indexed family of operators, one for each possible set of action types L. Set L represents the action types on which the components must synchronise (the unknown action type, τ , may not appear in any cooperation set). We assume that each component proceeds independently with any transition whose type does not occur in L. However, any transition with action type in set L requires the simultaneous involvement of both components, one enabling the transition with active type and the other one enabling the same transition with passive type.  Table 1: indeed, the relation − → P ⊗ L Q contains all the tuples ((s p1 , s q1 ),(s p1 , s q2 ), a, q) such that ((s p1 , s q1 ),(s p1 , s q2 ), a) ∈; P ⊗ L Q and q = q P ⊗ L Q ((s p1 , s q1 ), (s p1 , s q2 ), a).
Given a closed stochastic automaton P we can define its reversed automaton P R in the style of [4], that is a stochastic automaton whose underlying CTMC Definition 3.4. (Reversed SA [4]) Let P be a closed stochastic automaton with an underlying irreducible CTMC and let µ P be an invariant measure. Then we define the stochastic automaton P R = (S P R , T P R , ; P R , q P R ) reversed of P as follows: It can be easily proved that for any invariant measure (including the equilibrium distribution) µ P for P there exists an invariant measure µ P R for P R such that for all s ∈ S P it holds µ P (s) = µ P R (s R ), and viceversa.

Quasi-Reversible Automata
In this section we review the definition of quasi-reversibility given by Kelly in [17] by using the notation of stochastic automata. We first introduce a closure operation over stochastic automata that allows us to assign to all the transitions with the same passive type the same rate λ. Definition 4.1. (SA closure) The closure of a stochastic automaton P with respect to a passive type a ∈ P P and a rate λ ∈ R + , written P c = P {a ← λ}, is the automaton defined as follows: • q P c is defined as: Notice that for a closure P c of a stochastic automaton P with respect to all its passive types in P P we can compute the equilibrium distribution, provided that the underlying CTMC is ergodic (see Definition 3.2).
The notion of quasi-reversibility can be formalized as follows [17,23].
(Quasi-reversible SA) An irreducible stochastic automaton P with P P = {a 1 , . . . , a n } and • for all a ∈ P P and for all s ∈ S P , s ∈S P q P (s, s , a) = 1, where µ P c denotes any non-trivial invariant measure of the CTMC underlying P c .
Notice that in the definition of quasi-reversibility we do not require the closure of P with respect to all its passive types to originate a stochastic automaton with an ergodic underlying CTMC because we assume µ P c to be an invariant measure, i.e., we do not require that s∈S P c µ P c (s) = 1. However, the irreducibility of the CTMC underlying the automaton ensures that all the invariant measures differ for a multiplicative constant, hence Equation (3) is independent of the choice of the invariant measure.
Theorem 4.1 states that a network of quasi-reversible stochastic automata exhibits a product-form invariant measure and, if the joint state space is ergodic, a product-form equilibrium distribution. For the sake of simplicity, we state the theorem for two synchronising stochastic automata although the result holds for any finite set of automata which synchronise pairwise [17,12,23]. In the theorem below we assume that the synchronisation set contains all the passive types of the enabled activities. This property ensures that the automaton obtained by the composition does not have passive types and hence it is closed and has an underlying CTMC.
Theorem 4.1. (Product-form solution based on quasi-reversibility) Let P and Q be two quasi-reversible automata and L be a set of action types such that P P ∪ P Q ⊆ L. Assume that P P ⊆ A Q , P Q ⊆ A P , and there exists a set of positive real numbers {k a : a ∈ A P ∪ A Q } such that if we define the following automata P c = P {a ← k a } for each a ∈ P P and Q c = Q{a ← k a } for each a ∈ P Q it holds: Then, given the invariant measures µ P c and µ Q c it holds that is an invariant measure for all the positive-recurrent states (s 1 , where s c 1 and s c 2 are the states in S P c and S Q c corresponding to s 1 ∈ S P and s 2 ∈ S Q according to Definition 4.1. In this case we say that P and Q have a quasi-reversibility based product-form. Example 4.1. (Product-form solution of Jackson networks) Jackson networks provide an example of models having a product-form solution. A network consists of a collection of exponential queues with state-independent probabilistic routing. Jobs arrive from the outside at each queuing station in the network according to a homogeneous Poisson process. It is well-known that the queues of Jackson networks are quasi-reversible and hence the product-form is a consequence of Theorem 4.1. Figure 1 shows the automaton underlying a Jackson's queue where a is an active type while b is a passive one. It is worth of notice that also the queues considered in [5,20] are quasi-reversible. 2

Lumpable Bisimulation and Exact Equivalence
In this section we introduce two coinductive definitions, named lumpable bisimulation and exact equivalence, over stochastic automata which provide a sufficient condition for strong and exact lumpability of the underlying CTMCs.
The definitions of lumpable bisimulation and exact equivalence as well as the algorithms presented in Section 6 refer to the entire class of stochastic automata, while the results we present in this section hold only for irreducible stochastic automata.
Lumpable bisimulation is developed in the style of Larsen and Skou's bisimulation [19] where transition rates are used analogously to probabilities in the probabilistic process algebra. We recall here the definition presented in [16].
Definition 5.1. (Lumpable bisimulation) Let P be a stochastic automaton. An equivalence relation R ⊆ S P × S P is a lumpable bisimulation if whenever (s, s ) ∈ R then for all a ∈ T P and for all C ∈ S P /R such that • or a = τ and s, s ∈ C, it holds s ∈C q(s, s , a) = s ∈C q(s , s , a) .
It is clear that the identity relation is a lumpable bisimulation. In [16] we proved that the transitive closure of a union of lumpable bisimulations is still a lumpable bisimulation. Hence, the maximal lumpable bisimulation, denoted ∼ s , is defined as the union of all the lumpable bisimulations and it is an equivalence relation. For any stochastic automaton P , ∼ s induces a partition on the state space of the underlying Markov process that is a strong lumping (see Definition 2.1).
In order to extend the lumpable bisimulations to pairs of stochastic automata we need to consider the following definition of union between two stochastic automata.
Definition 5.2. (Union Automaton) Let P and Q be two stochastic automata. The union of P and Q is the stochastic automaton P ∪ Q defined as follows: • S P ∪Q = S P S Q is the disjoint union of the state spaces, • A P ∪Q = A P ∪ A Q is the union of the active types, • P P ∪Q = P P ∪ P Q is the union of the passive types, Given two stochastic automata P and Q and two states s p ∈ S P and s q ∈ S Q with a slight abuse of notation we write s p ∼ s s q to denote that s p and s q are lumpable bisimilar in the union automaton P ∪ Q. Moreover, we say that P and Q are equivalent according to the lumpable bisimulation relation, denoted P ∼ s Q, if there exists s p ∈ S P and s q ∈ S Q such that s p ∼ s s q .
We now introduce the notion of exact equivalence for stochastic automata. This equivalence, mentioned as exact performance equivalence, has been introduced in [8] and studied in [9]. An equivalence relation over S P is an exact equivalence if for any action type a ∈ T P , the total conditional transition rates from two equivalence classes to two equivalent states, via activities of this type, are the same. Moreover, for any type a, equivalent states have the same apparent conditional exit rate. Definition 5.3. (Exact equivalence) Let P be a stochastic automaton. An equivalence relation R ⊆ S P × S P is an exact equivalence if whenever (s, s ) ∈ R then for all a ∈ T P and for all C ∈ S P /R it holds • q(s, a) = q(s , a), . The transitive closure of a union of exact equivalences is still an exact equivalence. Hence, the maximal exact equivalence, denoted ∼ e , is defined as the union of all exact equivalences and it is an equivalence relation.
Given two stochastic automata P and Q and two states s p ∈ S P and s q ∈ S Q with a slight abuse of notation we write s p ∼ e s q to denote that s p and s q are exactly equivalent in the union automaton P ∪ Q. Moreover, we say that P and Q are exactly equivalent, denoted P ∼ e Q, if there exists s p ∈ S P and s q ∈ S Q such that s p ∼ e s q .
Example 5.1. Let us consider a queueing model of a system with two identical processors, named κ 1 and κ 2 . Each job is assigned to one of the processors which are assumed not to work in parallel. At each service completion event of processor κ i , the next job is assigned to κ j , for i = j, with probability p, and is assigned to processor κ i with probability 1 − p. Automaton P underlying this model is depicted in Figure 2 where state nκ i , for n > 0 and i = 1, 2, denotes the state in which processor κ i is being used and there are n customers waiting to be served. State 0κ i denotes the empty queue. It is easy to prove that the equivalence relation ∼ obtained by the reflexive closure of {(nκ 1 , nκ 2 ), (nκ 2 , nκ 1 ) : n ∈ N} is an exact equivalence over the state space of P . Let us consider the automaton Q depicted in Figure 1, then it holds that the equivalence relation given by the symmetric and reflexive closure of ∼ =∼ ∪{(nκ 1 , n), (n, nκ 2 ) : n ∈ N}, where each n denotes a state of Q, is still an exact equivalence. 2 In [9] the author prove that, for any stochastic automaton P , ∼ e induces an exactly lumpable partition on the state space of the Markov process underlying P .
Proposition 5.1. (Exact lumpability) Let P be a closed, irreducible, stochastic automaton with state space S P and X P (t) its underlying Markov chain with infinitesimal generator matrix Q. Then for any equivalence class S i , S j ∈ S P / ∼ e and s, s i.e., ∼ e is an exact lumpability for X P (t).
The next theorem plays an important role in studying the product-form of exactly equivalent automata. Informally, it states that the exact equivalence preserves the invariant measure of equivalent states. The proof follows from the results presented in [9].
Theorem 5.1. Let P and Q be two closed, irreducible, stochastic automata and µ P and µ Q be two invariant measures of P and Q, respectively. Then, there exists a positive constant K such that for each s 1 ∈ S P and s 2 ∈ S Q with s 1 ∼ e s 2 it holds that µ P (s 1 )/µ Q (s 2 ) = K.
Corollary 5.1. Let P and Q be two closed, irreducible, stochastic automata and π P and π Q be the stationary distributions of P and Q, respectively. Then, for all s 1 , s 2 ∈ S P and s 1 , s 2 ∈ S Q such that s i ∼ e s i for i = 1, 2, it holds that π P (s 1 )/π P (s 2 ) = π Q (s 1 )/π Q (s 2 ).
Finally, the next proposition states that both lumpable bisimulation and exact equivalence are congruences for SA synchronisation. • If P ∼ s P and Q ∼ s Q then P ⊗ L Q ∼ s P ⊗ L Q for any set of action types L.
• If P ∼ e P and Q ∼ e Q then P ⊗ L Q ∼ e P ⊗ L Q for any set of action types L.
Proof. The proof that ∼ s is a congruence for SA synchronization is similar to the one in [15,16].
The proof that ∼ e is a congruence for SA synchronization can be derived from the results presented in [9]. 2 The next theorem provides a crucial result for our contributions. It states that any exact equivalence between two stochastic automata induces a lumpabale bisimulation between the corresponding reversed automata.
Theorem 5.2. (Exact equivalence and lumpable bisimulation) Let P and Q be two closed, irreducible, stochastic automata, P R and Q R be the corresponding reversed automata defined according to Definition 3.4 and ∼ be an exact equivalence over P ∪Q.
Proof. Let ∼⊆ (S P S Q ) × (S P S Q ) be an exact equivalence, s 1 ∈ S P and s 2 ∈ S Q such that s 1 ∼ s 2 . We prove that We prove that for all a ∈ T P ∪ T Q and for all C R ∈ (S P R S Q R )/ ∼ , By Definition 3.4, s 1 , a).
From the fact that for all s 1 , s 2 ∈ C, µ P (s 1 ) = µ P (s 2 ) we have Finally, from the fact that ∼ is an exact equivalence and s 1 ∼ s 2 we have s∈C q P (s, s 1 , a) = s∈C q P (s, s 2 , a). Hence,

2
As a consequence any exact equivalence over the state space of a stochastic automaton P induces a lumpable bisimulation over the state space of the reversed automaton P R .
Corollary 5.2. Let P be a closed, irreducible, stochastic automaton and ∼⊆ S P × S P be an exact equivalence. Then the relation The following lemma provides a characterization of quasi-reversibility in terms of lumpable bisimulation. Informally, it states that an automaton is quasi-reversible if and only if for each closure its reversed is lumpable bisimilar to an automaton with a single state. Lemma 5.3. (Quasi-reversibility and lumpable bisimulation) An irreducible stochastic automaton P is quasi-reversible if and only if the following properties hold for every closure P c of P with reversed automaton P cR : • if s R ∈ S P cR , then [s R ] ∼s = S P cR , • if a ∈ P P then q P (s, a) = 1 for all s ∈ S P .
Proof. (⇒) Let P be quasi-reversible, P P = {a 1 , . . . , a n } and A P = {b 1 , . . . b m }. Then for all a ∈ P P and for all s ∈ S P , s ∈S P q P (s, s , a) = q P (s, a) = 1. Moreover, for each closure P c = P {a 1 ← λ 1 } . . . {a n ← λ n } with λ 1 , . . . , λ n ∈ R + there exists a set of positive real numbers {k 1 , . . . , k m } such that for each s ∈ S P c and 1 ≤ i ≤ m where µ P c denotes any non-trivial invariant measure of the CTMC underlying P c . Now observe that for all s ∈ S P c and 1 ≤ i ≤ m, where s R is the state of S P cR corresponding to s according to Definition 3.4, i.e., for all s R ∈ S P cR , [s R ] ∼s = S P cR .
(⇐) Assume that for every closure P c of P and for every s R ∈ S P cR it holds [s R ] ∼s = S P cR . Then for every type a = τ there exists a constant k a such that where µ P c denotes any non-trivial invariant measure of the CTMC underlying P c and s R is the state of S P cR corresponding to s according to Definition 3.4.
In particular the property holds for every type b i ∈ A P . 2 The following proposition states that both lumpable bisimulations and exact equivalences are invariant with respect to the closure of automata where any closure P c of P is defined according to Definition 4.1.
Proposition 5.3. Let P and Q be two irreducible stochastic automata with A P = A Q , P P = P Q = {a 1 , . . . , a n } and ∼ be an exact equivalence (resp., a lumpable bisimulation) over P ∪ Q. Then for every closure ∈∼} is an exact equivalence (resp., a lumpable bisimulation) over P c ∪ Q c .
Proof. Let P and Q be two stochastic automata with A P = A Q , P P = P Q = {a 1 , . . . , a n } and ∼⊆ (S P S Q )×(S P S Q ) be a lumpable bisimulation. Then for every closure . Indeed for all a ∈ T P ∪ T Q , (s 1 , s 2 ) ∈∼ and for all C ∈ (S P S Q )/ ∼ such that either a = τ or a = τ and s 1 , s 2 ∈ C, it holds s∈C q(s 1 , s, a) = s∈C q(s 2 , s, a) .
If a ∈ A P = A Q is an active type then, by Definition 4.1, q P (s 1 , s 2 , a) = q P c (s c 1 , s c 2 , a) for all s 1 , s 2 ∈ S P and q Q (s 1 , s 2 , a) = q Q c (s c 1 , s c 2 , a) for all s 1 , s 2 ∈ S Q . Hence for all a = τ , a ∈ T P ∪T Q , (s c 1 , s c 2 ) ∈∼ and for all C c ∈ (S P S Q )/ ∼ it holds
Let us now assume that ∼⊆ (S P S Q )×(S P S Q ) is a exact equivalence. Hence for all a ∈ T P ∪ T Q , (s 1 , s 2 ) ∈∼ and for all C ∈ (S P S Q )/ ∼ we have Moreover, for P P = P Q = {a 1 , . . . , a n }, it holds: q(s 2 , s, a i )λ i ) + q(s 2 , s, τ )) We are now in position to prove that the class of quasi-reversible stochastic automata is closed under exact equivalence.
Theorem 5.4. Let P and Q be two irreducible stochastic automata such that P ∼ e Q. If Q is quasi-reversible then also P is quasi-reversible.
Proof. We have to prove that: 1. The outgoing transitions for each passive type a ∈ P P sums to unity. 2. For each closure P c = P {a 1 ← λ 1 } . . . {a n ← λ n } of P with λ 1 , . . . , λ n ∈ R + there exists a set of positive real numbers {k 1 , . . . , k m } such that for each s ∈ S P c and 1 ≤ i ≤ m, Equation (3) is satisfied.
The first claim follows immediately from the first item of Definition 5.3. Now observe that, by Definition 5.3, if P ∼ e Q then P P = P Q and A P = A Q . Let P P = P Q = {a 1 , . . . , a n } and A P = A Q = {b 1 , . . . , b m }. By Proposition 5.3, for any ∈∼ and (s 1 , s 2 ) ∈ (S P S Q ) × (S P S Q )} is an exact equivalence. By Theorem 5.2, the relation ∼ = {(s cR 1 , s cR 2 ) ∈ (S P cR S Q cR ) × (S P cR S Q cR )| (s 1 , s 2 ) ∈∼ } is a lumpable bisimulation. By Lemma 5.3 since Q is quasi-reversible then for all s R ∈ S Q cR it holds [s R ] ∼s = S Q cR , i.e., there exists a set of positive real numbers {k b1 , . . . , k bm } such that for each s R ∈ S Q cR and 1 ≤ i ≤ m which can be written as By Proposition 5.1, ∼ e induces an exact lumping on the CTMC underlying Q c and, by Proposition 2.3, for all s and s in the same equivalence class µ Q c (s) = µ Q c (s ). Hence we can write where µ Q c (C) denotes µ Q c (s) for an arbitrary state s ∈ C. Now from the fact that P c ∼ e Q c , we have that for each class C ∈ S Q c / ∼ e there exists a class C ∈ S P c / ∼ e such that all the states s ∈ C are equivalent to the states in C . Moreover, by Definition 5.3, we have s ∈C q Q c (s , s 1 , b i ) = s ∈C q P c (s , s 2 , b i ) for every state s 1 ∼ e s 2 with s 1 ∈ Q c and s 2 ∈ P c . Therefore, we can write: where K is the positive constant given by Theorem 5.1. Summing up, since every closure Q c of Q corresponds to a closure P c for P and Q c satisfies Equation (3) for all states s and active types b i , then the set of positive rates {k bi } defined for Q c are the same that satisfy Equation (3) for P c . Therefore, P is also quasi-reversible. 2 Example 5.2. Let us consider the automata Q and P depicted in Figure 1 and Figure 2, respectively. We already observed in Example 5.1 that there exists an exact equivalence ∼ such that n, nκ 1 and nκ 2 belong to the same equivalence class, where n is a state of Q and nκ i belongs to the state space of P . Then, since Q is well-known to be quasi-reversible, by Theorem 5.1 also P is quasi-reversible. As a consquence, the queueing station modelled by P can be embdded in quasi-reversible product-form queueing networks maintining the property that the equilibrium distribution is separable. 2 The next example shows that, differently from exact equivalence, lumpable bisimulation does not preserve quasi-reversibility.
Example 5.3. Consider the automaton R depicted in Figure 3. It is easy to prove that R is lumpable bisimilar to Jackson's queue Q depicted in Figure 1. However, R is not quasi-reversible, i.e., the corresponding reversed automaton is not lumpable bisimilar to a single-state automaton. More precisely, one can observe that in the reversed automaton there is one type a transition exiting from state 0 R but there is no type a transition from state 1 R . This is sufficient to claim that states 0 R and 1 R cannot belong to the same equivalence class. 2 The following result is an immediate consequence of Theorems 4.1 and 5.4.
Corollary 5.3. Let P , P , Q, Q be irreducible stochastic automata such that P ∼ e P and Q ∼ e Q . If P and Q have a quasi-reversibility based product-form then also P and Q are in product-form.

Algorithms for Lumpable Bisimulation and Exact Equivalence
In [30], Valmari and Franceschinis proposed an algorithm for computing a lumpability over directed weighted graphs. In particular, the algorithm exploits a partition refinement strategy, similar to that of Paige-Tarjan's algorithm for bisimulation [25], enriched with a sorting of classes. In this section we exploit Valmari and Franceschinis' algorithm to design procedures for computing lumpable bisimulations and exact equivalences.

Compatible Relations over Labeled Weighted Graphs
We start by considering a generalization of the compatibility problem considered in [30].
We recall some basic definitions over graphs. A labeled graph G = (S, T, E) consists of a finite set of nodes S, a finite set of labels T and a finite set of edges E ⊆ S ×T ×S. A weighted graph G = (S, E, W ) is a graph (S, E) together with a weighting function W : E → R that associates to each edge a real number. A labeled weighted graph G = (S, T, E, W ) is a labeled graph, i.e., E ⊆ S × T × S, together with a weighting function W . Given S ⊆ S, we denote by W (s, t, S ) the sum of the weights of the edges from s to S having label t. Notice that given a labeled weighted graph G = (S, T, E, W ) and a label t ∈ T it is possible to consider the weighted graph G t = (S, E t, W t), where only the edges with label t together with their weights are considered. We use the notation (E t) −1 (s) to denote the set of nodes that reach s in G t (i.e., the pre-image of s in G t).
The following definition of compatibility extends that of [30] to weighted labeled graphs. Definition 6.1. (Compatibility) Let G = (S, T, E, W ) be a labeled weighted graph and R ⊆ V × V be an equivalence relation. R is said to be compatible with G if for each t ∈ T , for each C, C ∈ S/R, and for each s, s ∈ C it holds that W (s, t, C ) = W (s , t, C ). Lemma 6.1. Let G be a labeled weighted graph and R ⊆ S × S be an equivalence relation. There exists a unique largest equivalence relation included in R and compatible with G.

Proof. The identity relation is always compatible and it is included in R, hence there exists at least one compatible relation included in R.
It is easy to prove that if R 1 , R 2 ⊆ R are two equivalence relations included in R and compatible with G, then R 1 R 2 , the smallest equivalence relation such that R 1 , R 2 ⊆ R 1 R 2 , is included in R and compatible with G.
2 As a consequence of the above lemma, if we consider the total relation R = S × S, we get that there exists a unique largest equivalence relation compatible with G.
Notice that a relation is compatible with a labeled weighted graph G if and only if for each t in T it is compatible with the weighted graph G t with respect to the definition in [30].
Let G = (S, T, E, W ) be a labeled weighted graph and R ⊆ S × S be an equivalence relation the labeled weighted compatibility problem requires to compute the largest equivalence relation included in R compatible with G.
In Section 6.4 we will present an algorithm to efficiently solve the labeled weighted compatibility problem. Before presenting the algorithm, in Section 6.2 (Section 6.3) we will see how the problem of computing the lumpable bisimulation (exact equivalence, respectively) can be reduced to the labeled weighted compatibility problem.

Lumpable Bisimulation as Labeled Weighted Compatibility
Given a stochastic automaton P , in the following we denote by q[s, S, a] the term s ∈S q(s, s , a), with S ⊆ S P . Definition 6.2. (Lumping Graph) Let P be a stochastic automaton. The lumping graph of P is the labelled weighted graph L P = (S P , ; P , W L P ), where W L P is the function which associates to each tuple in ; P the following value: The following result shows how to reduce the problem of computing the lumpable bisimulation ∼ s over a stochastic automaton P to a labeled weighted compatibility problem. Theorem 6.2. (Lumpable bisimulation as compatibility) Let P be a stochastic automaton and L P be its lumping graph. The largest relation compatible with L P is ∼ s .
Proof. Let R be the largest relation compatible with L P we prove that R =∼ s by proving that R ⊆∼ s and ∼ s ⊆ R.
In order to prove that R ⊆∼ s it is sufficient to prove that R is a lumpable bisimulation. Let (s 1 , s 2 ) ∈ R and C ∈ S P /R. If a = τ , then s ∈C q(s 1 , s , a) = q[s 1 , C, a] = W L P (s 1 , a, C) = W L P (s 2 , a, C) = q[s 2 , C, a] = s ∈C q (s 1 , s , a). Similarly, if a = τ and s 1 , s 2 ∈ C we get the thesis, since s i ∈ C implies q[s i , C, τ ] = W L P (s i , τ, C), for i = 1, 2.
In order to prove that ∼ s ⊆ R it is sufficient to prove that ∼ s is compatible. Let s 1 ∼ s s 2 , and C ∈ S P / ∼ s , we have to prove that W L P (s 1 , a, C) = W L P (s 2 , a, C), for each a ∈ T P . The only interesting case is the case a = τ and s 1 , s 2 ∈ C. In this case W L P (s 1 , τ, τ, C ). Since, neither s 1 nor s 2 belongs to any of the classes C involved in this last sum, from the other cases we get − C =C W L P (s 1 , τ, C ) = − C =C W L P (s 2 , τ, C ) and now reasoning on s 2 this last is W L P (s 2 , τ, C). and W I P is the function which associates to each tuple in ; P the following value: W I P (s 1 , a, s 2 ) = q(s 2 , s 1 , a) Definition 6.4. (Initial Equivalence) Let P be a stochastic automaton. The initial equivalence of P is the equivalence relation IE P ⊆ S P × S P defined as follows: (s 1 , s 2 ) ∈ IE P iff q(s 1 , a) = q(s 2 , a) for each a ∈ T P The following result shows how to reduce the problem of computing the exact equivalence ∼ e over a stochastic automaton P to a labeled weighted compatibility problem. Theorem 6.3. (Exact equivalence as compatibility) Let P be a stochastic automaton, I P be its inverse graph, and IE P be its initial equivalence. The largest relation included in IE P compatible with I P is ∼ e .
Proof. Let R be the largest relation included in IE P compatible with I P . We prove that R =∼ e by proving that R ⊆∼ e and ∼ e ⊆ R.
In order to prove that R ⊆∼ e it is sufficient to prove that R is an exact equivalence. Let (s 1 , s 2 ) ∈ R and C ∈ S P /R. Since R ⊆ IE P we have that q(s 1 , a) = q(s 2 , a), for each a ∈ T P . Moreover, s ∈C q(s , s 1 , a) = W I P (s 1 , a, C) = W I P (s 2 , a, C) = s ∈C q (s , s 1 , a).
In order to prove that ∼ e ⊆ R it is sufficient to prove that ∼ e is included in IE P and compatible. Let s 1 ∼ e s 2 . It holds that for each a ∈ T P q(s 1 , a) = q(s 2 , a), hence (s 1 , s 2 ) ∈ IE P .
Moreover, let C ∈ S P / ∼ e , we prove that W I P (s 1 , a, C) = W I P (s 2 , a, C), for each a ∈ T P . Indeed W I P (s 1 , a, C) = s ∈C q(s , s 1 , a) = s ∈C q(s , s 2 , a) = W I P (s 1 , a, C). 2

Efficient Labeled Weighted Compatibility Algorithm
As it is common in bisimulation and lumpability algorithms, instead of working with equivalence relations, we work on the corresponding partitions over S, i.e., R is the initial partition and we are looking for the coarsest refinement of R compatible with G.
Our algorithm works exactly as the one in [30] except that we need to deal with labels on edges. The basic idea in Algorithm 1 is that we start with an initial partition P and each iteration of the main while loop at line 7 refines P by splitting blocks. At the end of the computation P is the desired partition. UB stands for Unused Blocks and contains the blocks of P which have not yet been used as splitters. TB stands for Touched Blocks and contains the blocks of P that could be split in the current iteration. The array w records for each s ∈ S the total weight of the t-edges from s to the current splitter block C. TS stands for Touched States and contains the states of S that reach through t-edges the splitter C. Hence, at line 19 w[s] has a numerical value if and only if s is in TS. For each s in the splitter C, the for loop at lines 10-11 stores in E[s, t] the pre-image of s with respect to t-edges. This is necessary since we process many labels. The splitter itself could get split with respect to a label t. In this case we need to ensure that for all the labels processed after t we still refer to the entire pre-image of C. This pre-computation will guarantee the correctness of the "exclude-the-largest" policy at line 36. The for loop at lines 12-37 takes care of using C as splitter with respect to each label. The operations performed inside this loop coincide with that of the algorithm in [30]. In particular, the splits are performed inside the while loop at lines 23-36. The key ingredient for obtaining a time performant algorithm is line 36: if block B, which has just been split, has already been used as splitter, then the largest of the sub-blocks of B is not included in the list UB of future splitters. The notation [B, ] ? means that B is considered only if it is different from B 1 . The commented instructions at lines 3 and 9 take care of storing a partition S which is always coarser than P. The block S C of S is the one that includes the block C of P. Intuitively, this is the partition of super-blocks. At each iteration the partition P will be "stable" with respect to S in the following sense: ∀t ∈ T ∀B ∈ P ∀C ∈ S ∀s 1 , s 2 ∈ B (W (s 1 , t, C) = W (s 2 , t, C)) It is quite easy to prove that Algorithm 1 always terminates. Proof. We only have to prove that the while loop at line 7 terminates. Let UB i (P i ) be the value of UB (P, respectively) at the i-th iteration of the while loop. We have that for each i it holds that |UB i | is always finite and |P i | ≤ |S|.
We prove that if |UB i+1 | ≥ |UB i |, then |P i+1 | > |P i |. We extract one block from UB at line 8, hence to get |UB i+1 | ≥ |UB i | we should insert at least one block in it. This implies that at least one split has been performed, i.e., |P i+1 | > |P i |.
Hence, since for each i it holds that |P i | ≤ |S|, there exists j such that for each k > j we have |P k+1 | = |P k |. So by contraposition, we get that for each k > j it holds that |UB k+1 | < |UB k |. As a consequence the while loop terminates. 2 We claim that Algorithm 1 solves the labeled weighted compatibility problem. Our proof of correctness extends to the labeled case the one in [30].
First we prove that we can safely modify the input without substantially changing the result. In particular, we move from G = (S, T, E, W ) to G = (S , T, E , W ), where • W (s, t, s ) = W (s, t, s ) for each s ∈ S, while W (s, t, s ⊥ ) = −W (s, t, S).
Hence, for each label t we have W (s, t, S ) = 0. Given a partition X over S we denote by X the partition X ∪ {{s ⊥ }} over S . It is immediate to prove that P is a refinement of R compatible with G if and only if P is a refinement of R compatible with G .
Moreover, we can safely uncomment line 3 and line 9 without changing the behaviour of the algorithm, i.e., the common variables have the same values at each step. We denote by LWC ( , ) the variant of LWC( , ) with the skips replaced by the comments. Hence, we get the following result. Hence, by Lemma 6.6 and Lemma 6.5 it is sufficient for us to prove that LWC (G , R ) is correct. To avoid confusion in LWC (G , R ) we replace the variable P with P .
We first prove that the output of the algorithm is coarser than the coarsest refinement of R compatible with G . Notice that at this stage we do not prove that the output is compatible with G . Lemma 6.7. (Necessity of spits) Let P be the output of LWC (G , R ). If s 1 and s 2 belongs to different blocks in P , then in each compatible refinement of R the elements s 1 and s 2 belongs to different blocks.
Proof. It is equivalent to prove that s 1 and s 2 belongs to different blocks in Q the coarsest refinement of R compatible with G . Let P i be the partition computed by LWC (G , R ) before the i + 1-th repetition of the main while loop (line 7). We prove by induction on i that Q is always a refinement of P i .
Base: i = 0. We have P 0 = R hence the thesis hold since Q is by definition a refinement of R .
Inductive step: we assume that the thesis holds for i < j and we prove that Q is a refinement of P j . By inductive hypothesis Q is a refinement of P j−1 . Let s 1 and s 2 be such that s 1 ∈ B j 1 ∈ P j and s 2 ∈ B j 2 ∈ P j with B j 1 = B j 2 , while s 1 , s 2 ∈ B j−1 ∈ P j−1 . We have to prove that s 1 and s 2 belongs to different blocks also in Q . By the hypothesis we get that there exists t ∈ T and B ∈ P j−1 such that W (s 1 , t, B ) = W (s 2 , t, B ). Since B ∈ P j−1 and Q is a refinement of P j−1 we have that there exists Q 1 , . . . , Q k ∈ Q such that B = Q 1 ∪ · · · ∪ Q k . Hence This implies that there exists k such that W (s 1 , t, Q k1 ) = W (s 2 , t, Q k ). Hence, since Q is compatible with G , s 1 and s 2 cannot belong to the same block of Q . 2 It is immediate to see that the output of the algorithm is a refinement of R . Hence, it only remains to prove that the output of the algorithm is compatible with G . We now prove that at each iteration the current partition is "stable" with respect to the super-blocks partition. This is the only result in which we really exploit both the super-blocks partition and the new element s ⊥ . Lemma 6.8. (Stability invariant) During the execution of LWC (G , R ) it is always true that for each t ∈ T , for each B ∈ P , for each S ∈ S, for each s 1 , s 2 ∈ B it holds that W (s 1 , t, S) = W (s 2 , t, S).
Proof. We recall that in the algorithm S C is the block of S which includes the block C of P . It is immediate to see that S is always coarser than P . Hence S C is correctly defined.
Let P i be the partition computed by LWC (G , R ) before the i + 1-th repetition of the main while loop (line 7) and similarly S i be the partition computed by LWC (G , R ) before the i + 1-th repetition of the same loop. We prove the thesis by induction on i.
Base: i = 0. The thesis is true since for each t ∈ T it holds that W (s, t, S ∪ {s ⊥ }) = 0.
Inductive step: we assume that the thesis holds for i < j and we prove it for j. If we consider a block in S j that was also in S j−1 , then the thesis trivially holds by inductive hypothesis. Let C and S C \ C be the two new blocks in S j not in S j−1 . These have been added to S j during the j − 1th execution of the while loop. During this step all the blocks of P j−1 have been split with respect to C leading to P j . Hence, for each t ∈ T , for each B ∈ P j , and for each s 1 , s 2 ∈ B it holds that W (s 1 , t, C) = W (s 2 , t, C). Moreover, as far as S C \ C is concerned W (s 1 , t, S C \ C) = W (s 1 , t, S C ) − W (s 1 , t, C). This last by inductive hypothesis and since W (s 1 , t, C) = W (s 2 , t, C), is equal to W (s 2 , t, S C ) − W (s 2 , t, C) = W (s 2 , t, S C \ C). 2 Another invariant on super-blocks is useful to prove correctness.
Lemma 6.9. (Cardinality invariant) During the execution of LWC (G , R ) it is always true that for each S ∈ S, if S is the union of k blocks of P, then the list UB contains at least k − 1 of such blocks.
Proof. Let P i , S i , and UB i be the variables before the i + 1-th repetition of the main while loop (line 7). We prove the thesis by induction on i. Base: i = 0. We have that UB 0 contains all the blocks that are in S 0 . Inductive step: we assume that the thesis holds for i < j and we prove it for j. For all the blocks that are included in a block S of S j−1 and are in UB j−1 all their sub-blocks are added to UB j . For all the blocks that are included in a block S of S j−1 and are not in UB j−1 all their sub-blocks but one are added to UB j . Hence, the thesis holds. 2 We are now ready to prove the correctness of our algorithm. Proof. By Lemma 6.7 we have that LWC (G , R ) returns a partition which is coarser than any refinement of R compatible with G . By Lemma 6.9 we get that when LWC (G , R ) terminates, since UB j is empty it must be P = S. Hence, by Lemma 6.8 P is compatible with G . 2 As far as the complexity is concerned we can prove that our algorithm has the same time and space complexities of the one in [30]. Notice that in order to obtain this result which does not depend on |T | one should compute just before line 10 the set T C of labels involved in the preimage of C. This can be done again at a cost of Θ(Θ(|C| + |E −1 (C)|)). Then the for loops at lines 10 and 12 should range over T C instead of T .
Globally over all the executions of the main while loop a node s can belong to a splitter block C at most Θ(log|S|) times since once the block in which s originally belongs is removed from UB, the largest sub-block is never reinserted in UB. Hence, every time s belongs to a splitter the size of the splitter is at least half of the previous time that s was in a splitter. So, s is in a splitter O(log |S|) times, which gives us a complexity of O( s ∈S ((log |S|) ( In the general case, i.e., if G is not connected, we can split the complexity over its connected components obtaining a cost of O(|S| + |E| log |S|), where the additional O(|S|) takes into consideration all the initialization steps that are present even if |E| log |S| < |S|. Proof. The proof proceeds exactly as in [30]. 2 As a direct consequence of Lemma 6.11 and Lemma 6.12 we get the following result. Notice that the models considered in this paper generate strongly connected graphs with |S| = O(|E|), hence the time complexity of our algorithm can be simplified into O(|E| log |S|), while the space complexity becomes O(|E|).

Case Study and Performance Tests
The algorithms for lumpable bisimulation and exact equivalence described in Section 6 have been integrated in the PEPA Eclipse plug-in which is available at https://github.com/Bakuriu/PEPA-Eclipse-Plug-in.
As discussed in Section 3, the synchronisation semantics of stochastic automata can be seen as the active/passive synchronisation in PEPA. In particular, stochastic automata can be easily translated into PEPA components having the same semantics.
In this section we consider a case study, taken from [7], consisting of a web server cluster interacting with a set of clients. Specifically, the server cluster provides contents to users and allows content creators to add new contents on the servers. The system is meant to satisfy certain quality of service requirements regarding availability and response-time. In order to meet such requirements the system skews the prioritisation for fast reads over writes, so that writes are buffered and only processed at a time when there are only few reads. The consequence is that a reader may not be able to read the latest updates, although high availability is maintained.
Each server can fail, and be repaired, independently. If all the servers fail a special recovery mechanism is triggered which recovers the whole cluster.

The server model
Each server receives read requests, which, before being satisfied, cause a read lookup by the server. In order to successfully complete a write request it is necessary that no server is performing a read lookup (i.e., no server should be in the state ServerRead below), so that all servers can perform the write operation simultaneously.
The server can fail, and during the failure time no read request can be accepted. We assume that write actions occuring during the server failure time are ignored; when the server will be restarted it will be re-synchronised with the other servers in the cluster.
The SA representing a single server is depicted in Figure 4.

The server cluster model
The cluster of servers is able to witness the failures of the server and trigger their recovery. When all servers have failed the whole cluster is restarted, recovering all failures simultaneously.
The SA for the cluster of servers is represented in Figure 5. ...

The model for buffered writes
The write requests that the system receives are buffered and performed only when no server is reading its database. The read buffer can hold up to B buffered writes. Whenever all the servers are available to perform a write operation we assume that all of the buffered writes are performed.
The SA for the buffered write is represented in Figure 6. ...

The model for the users
The system has two different kind of users: authors, who publish content to the servers by triggering the write requests, and readers, who trigger the read requests from the servers. We assume that the number of readers is higher than the number of writers, and as such we have prioritized reads over writes.
We consider a fixed time period in which W writes and R read requests occur. At the end of this time period the writers and readers are reset and an other W write and R read requests occur. This assumption is reasonable for a stable system, for example an online newspaper which publishes everyday a specific number of articles and has a mostly constant number of views in a month.
The authors of content cannot trigger a server write operation, but can only write to the buffer as represented in Figure 7.  The Writers SA is the composition of W content authors of the system: The readers send read requests and wait for the lookup by the servers as illustrated in Figure 8.  Again the Readers SA is the synchronization of R readers of the system: Readers def = Reader ⊗ K Reader ⊗ K . . . ⊗ K Reader The system will always contain a component dedicated to triggering the reset of the readers and writers, as represented in Figure 9.

The complete system
We are finally able to define the SA that represents the whole system.

Performance tests
We considered the performance of our algorithms for different values of parameters S, B, R, W of the system. The tests were run on a Acer Aspire 5742G machine, which is equipped with a quad core Intel Core i5 M 480 2.67GHz, 4GB of RAM memory. Table 2 contains the results obtained without using any aggregation technique, and it shows that it is not possible to perform the steady-state analysis even for moderate values of the parameters due to memory errors. Table 3 shows the results obtained using contextual lumpability. In this case we were able to compute the steady-state distribution for the aggregated state space in all cases. Table 4 contains the results obtained using exact equivalence. In this case study, exact equivalence and contextual lumpability do not coincide, as it is easily verified comparing the aggregated state space sizes. The exact equivalence produces a finer aggregation, which is to be expected since it enforces that all states lumped together have the same steady-state probability. The reduction in the state space sizes is thus significantly worse than the contextual lumpability case, achieving a 13-fold reduction in the number of both states and transitions, and our machine failed to compute the steady-state distribution over the aggregated state space for the parameters 4, 3, 3, 4 and 3, 3, 3, 6. On the other hand, if one desires to derive the steady-state distribution of the non aggregated automaton given that of the aggregated, we have to consider that this is much more computationally efficient in the case of an aggregation based on exact equivalence with respect to an aggregation based on contextual lumpability.
An important aspect of this case study is that the aggregations we have achieved are not possible to achieve using only the aggregating arrays or other syntactical means, since the repeated components are not in a plain parallel composition, but cooperate over some action types.

Conclusion
In this paper we have studied the relations between exact equivalence [8,9] and the notion of lumpable bisimulation that has been introduced in [16]. We proved that any exact equivalence over a non-synchronising stochastic automaton is indeed a lumpable bisimulation on the corresponding reversed automaton Table 2: Profiling results for the derivation of the state space and the steady-state analysis for the web server model, without aggregation. The cells containing "N/A" could not be filled due to memory errors. and then it induces a strong lumping on the underlying time-reversed CTMC. We show that this fact has important implications not only from a theoretical point of view but also in reducing the computational complexity of the analysis of cooperating models in equilibrium. Indeed, the class of quasi-reversible automata, whose composition is known to be in product-form and hence analysable efficiently, is closed under the exact equivalence. This leads to a new approach for proving the quasi-reversibility of a stochastic component which does not require to study the time-reversed underlying CTMC but to find a model exactly equivalent to the considered one that is already known to be (or to be not) quasi-reversible, or whose quasi-reversibility can be decided easier.
We considered the labeled weighted compatibility problem and proved that both lumpable bisimulation and exact equivalence can be efficiently reduced to it. Then, we proposed an algorithm for the computation of the labeled weighted compatibility problem, that generalizes the one presented in [30] to the many labels case without increasing its time and space complexities. This immediately provides us algorithms for lumpable bisimulation and exact equivalence having the same complexities of the one in [30]. While the case of exact equivalence was not considered in [16], in the case of lumpable bisimulation the new algorithm improves the time complexity of the one in [16]. Table 3: Profiling results for the derivation of the state space and the steady-state analysis for the web server model, using the contextual-lumpability for aggregation. for t ∈ T for s ∈ C do 11: