1 Model Checking of of Timed Systems Rajeev Alur University of Pennsylvania
Jan 22, 2016
1
Model Checking ofof Timed Systems
Rajeev Alur
University of Pennsylvania
2
Model Checker
AdvantagesAutomated formal verification, Effective debugging tool
Traditional: Finite-state systems (Boolean vars)Enumerative search with reduction heuristics: Spin, MurphiSymbolic search using BDDs: SMV, Cospan, VIS, Mocha
Hybrid and Real-Time SystemsContinuous variables make state-space infiniteTimed automata: Decidability results, Efficient symbolic data
structures
model
temporalproperty
yes
error-trace
3
Talk Outline
Timed Automata: Syntax and Semantics Specification Logic: Timed CTL Decidability: Region-based partitioning Efficient Implementation: Zones and DBMs
UPPAAL (www.docs.uu.se/docs/rtmv/uppaal)Talk draft: Thanks to Kim Larsen and Paul
Pettersson
4
UPPAAL
5
Off Light Brightpress? Press?
press?
Press?
WANT: if press is issued twice quickly then the light will get brighter; otherwise the light is turned off.
Timed AutomataIntelligent Light Control
6
Timed AutomataIntelligent Light Control
Off Light Bright
Solution: Add real-valued clock x
X:=0X<=3
X>3
press? Press?
press?
Press?
7
Timed Automata
n
m
a
(Alur & Dill 1990)
Clocks: x, y
x<=5 & y>3
x := 0
Guard Boolean combination of comparisons withinteger bounds
ResetAction performed on clocks
( n , x=2.4 , y=3.1415 ) ( n , x=3.5 , y=4.2415 )
e(1.1)
Transitions
( n , x=2.4 , y=3.1415 ) ( m , x=0 , y=3.1415 )
a
State ( location , x=v , y=u ) where v,u are in R
Actionused
for synchronization
8
n
m
a
Clocks: x, y
x<=5 & y>3
x := 0
Transitions
( n , x=2.4 , y=3.1415 ) ( n , x=3.5 , y=4.2415 )
e(1.1)
( n , x=2.4 , y=3.1415 )
e(3.2)
x<=5
y<=10
LocationInvariants
g1g2 g3
g4
Invariants ensure progress!!
Timed Safety Automata Timed Automata + Invariants
(Henzinger et al, 1992)
9
Clock Constraints
What can you express: Constant lower and upper bounds on delays
Why the restricted syntax: slight generalizations (e.g. allowingx=2y) lead to undecidable model checking problems
10
Timed (Safety) Automata
11
Light Switch
Switch may be turned on whenever at least 2 time units has elapsed since last “turn off”
Light automatically switches off after 9 time units.
push
pushclick
12
Semanticsclock valuations:state:Semantics of timed automata is a
labeled transition systemwhere
action transition
delay Transition
)(),( CVvandLlwherevl
})(|),({ LlandCVvvlS
0:)( RCvCV
),( S
0')')((
),(),(
RddwheneverdvlInv
iffdvlvl d
g a rl l’
)')('(][')(
)','(),(
vlInvandrvvandvg
iffvlvl a
13
Semantics: Example
...)9,0,()9),3(9,(
)3,3,(),0,(
),()0,(
)5.3,()0,(
)3(93
5.3
yxoffyxon
yxonyxon
yxonyxon
yxoffyxoff
click
push
push
push
pushclick
9y
14
Timed Automata in UPPAAL
Communicating Timed Safety Automata+ urgent actions+ urgent locations (i.e. zero-delay locations)+ committed locations (i.e. zero-delay and atomic locations)+ data-variables (integers with bounded domains)+ arrays of data-variables+ guards and assignments over data-variables and arrays...
Larsen et al, 1996
15
TCTL = CTL + Time
inz
clocksformulaDz
nspropositioautomicAPp
,,
,,
constraints over formula clocks and automata clocks
“freeze operator” introduces new formula clock z
E[ U ], A[ U ] - like in CTL
No EX
Alur, Courcoubetis, Dill, 1991
16
Derived Operators
Along any path holds continuously until within 7 time units
becomes valid.
=
=
The property becomes valid within 5 time units.
17
TCTL Semanticss - location
w - formula clock valuation
PM(s) - set of paths from s
Pos() - positions in ,i) - elapsed time
(i,d) <<(i’,d’) iff (i<j) or ((i=j) and (d<d’))
18
Timeliness Properties
receive(m) occurs within 5 time units after send(m)
receive(m) occurs exactly 11 time units after send(m)
putbox occurs periodically (exactly) every 25 time units
(note: other putbox’s may occur in between)
19
A1 B1 CS1V:=1 V=1
A2 B2 CS2V:=2 V=2
Init V=1
2´
VCriticial Section
Fischer’s ProtocolA simple MUTEX Algorithm
21 CSCS AG
20
A1 B1 CS1V:=1 V=1
A2 B2 CS2V:=2 V=2
Init V=1
2´
VCriticial Section
Fischer’s ProtocolA simple MUTEX Algorithm
Y<1
X:=0
Y:=0
X>1
Y>1
X<1
12
212
21
CS
CSCS
CSCS
EF
AF
AG
21
Infinite State Space?
22
RegionsFinite partitioning of state space
x
y ”Desired equivalence”
.properties
samesatisfy and
or
automata. timed
any of locationany for
iff
(l,w')(l,w)
l
w'lBehwl Behww ),(),('
1 2 3
1
2
'ww
23
RegionsFinite partitioning of state space
x
y Definition
max
'
n
nxxnx
w'www
jii
where
and
form the
of conditions same exact the
satisfy and iff
An equivalence class (i.e. a region)in fact there is only a finite number of regions!!
1 2 3
1
2
24
RegionsFinite partitioning of state space
x
y
An equivalence class (i.e. a region)
Successor regions, Succ(r)
r
1 2 3
1
2
Resetregions
{y}r
{x}r
25
Properties of Regions
The region equivalence relation is a time-abstract bisimulation: Action transitions: If w v and (l,w) -a-> (l’,w’)
for some w’, then v’ w’ s.t. (l,v) -a-> (l’,v’) Delay transitions: If w v then for all real
numbers d, there exists d’ s.t. w+d v+d’ If w v then (l,w) and (l,v) satisfy the
same TCTL formulas
26
Region graph of a simple timed automata
27
Fischers again A1 B1 CS1V:=1 V=1
A2 B2 CS2V:=2 V=2Y<1
X:=0
Y:=0
X>1
Y>1
X<1
21 CSCS AG
A1,A2,v=1
A1,B2,v=2
A1,CS2,v=2
B1,CS2,v=1
CS1,CS2,v=1
Untimed case
A1,A2,v=1x=y=0
A1,A2,v=10 <x=y <1
A1,A2,v=1x=y=1
A1,A2,v=11 <x,y
A1,B2,v=20 <x<1
y=0
A1,B2,v=20 <y < x<1
A1,B2,v=20 <y < x=1
y=0
A1,B2,v=20 <y<1
1 <x
A1,B2,v=21 <x,y
A1,B2,v=2y=11 <x
A1,CS2,v=21 <x,y
No further behaviour possible!!
Timed case
PartialRegion Graph
28
Roughly speaking....
Model checking a timed automata against a TCTL-formula amounts to
model checking its region graph against a CTL-formula
Model checking a timed automata against a TCTL-formula amounts to
model checking its region graph against a CTL-formula
29
Problem to be solved
Model Checking TCTL is PSPACE-complete
30
ZonesSymbolic computation
State(n, x=3.2, y=2.5 )
x
y
x
y
Symbolic state (set)(n, )
Zone:conjunction ofx-y<=n, x<=>n
3y4,1x1
31
Symbolic Transitions
n
m
x>3
y:=0
x
ydelays to
x
y
x
y conjuncts to
x
y
projects to
1<=x<=41<=y<=3
1<=x, 1<=y-2<=x-y<=3
3<x, 1<=y-2<=x-y<=3
3<x, y=0
Thus (n,1<=x<=4,1<=y<=3) =a => (m,3<x, y=0)
a
32
Forward Rechability
Passed
WaitingFinal
Init
INITIAL Passed := Ø; Waiting := {(n0,Z0)}
REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add
{ (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed
UNTIL Waiting = Ø or Final is in Waiting
Init -> Final ?
33
Forward Rechability
Passed
Waiting Final
Init
n,Z
INITIAL Passed := Ø; Waiting := {(n0,Z0)}
REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add
{ (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed
UNTIL Waiting = Ø or Final is in Waiting
n,Z’
Init -> Final ?
34
Forward Rechability
Passed
Waiting Final
Init
n,Z
INITIAL Passed := Ø; Waiting := {(n0,Z0)}
REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add
{ (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed
UNTIL Waiting = Ø or Final is in Waiting
n,Z’
m,U
Init -> Final ?
35
Forward Rechability
Passed
Waiting Final
Init
INITIAL Passed := Ø; Waiting := {(n0,Z0)}
REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add
{ (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed
UNTIL Waiting = Ø or Final is in Waiting
n,Z’
m,U
n,Z
Init -> Final ?
36
Bellman 1958, Dill 1989
x<=1y-x<=2z-y<=2z<=9
x<=1y-x<=2z-y<=2z<=9
x<=1y-x<=2y<=3z-y<=2z<=7
x<=1y-x<=2y<=3z-y<=2z<=7
D1
D2
When are two sets of constraints equivalent?
x x
0 y
z
1 2
29
ShortestPath
Closure
ShortestPath
Closure
0 y
z
1 2
25
0
x
y
z
1 2
27
0
x
y
z
1 2
25
3
3 3
Graph
Graph
Canonical Dastructures for ZonesDifference Bounded Matrices
37
Difference Bounds Matrices
Matrix representation of constraints (bounds on a single clock or difference betn 2 clocks)
Reduced form obtained by running all-pairs shortest path algorithm
Reduced DBM is canonical Operations such as reset, time-successor,
inclusion, intersection are efficientPopular choice in timed-automata-based
tools
38
Summary
Applications of Uppaal and KronosPhilips bounded retransmission protocolAsynchronous circuits (STARI communication)Timing analysis of Esterel+C code
Research theme 1: Efficient representation of Clock constraints + Boolean constraints
Research theme 2: Automatic abstractions of complex dynamics by timed automata