Timed Automata – lllllllllll Decidability Resultsbeckert/teaching/... · Timed Automata –...

Timed Automata – lllllllllllDecidability Results

eknolo

Decidability ?

Reachable?

OBSTACLE:Uncountably infinite

state space

eknolo

Stable Quotient

Reachable?

Partitioning

eknolo

Stable Quotient

Reachable?

Partitioning

eknolo

Stable Quotient

Reachable?

Partitioning

eknolo

Stable Quotient

Reachable?

Partitioning

eknolo

Stable Quotient

Reachable?

Partitioning

eknolo

Stable Quotient

Reachable?

Partitioning

0 ε 1 a 2 ε 3 a 4 ε 5 c 6

eknolo

RegionsFinite Partitioning of State Space

An equivalence class (i.e. a region)in fact there is only a finite number of regions!!

eknolo

RegionsSuccessor Operation (wrt delay)

An equivalence class (i.e. a region)

Successor regions, Succ(r)

eknolo

RegionsReset Operation

An equivalence class (i.e. a region) r

Resetregions

eknolo

An Example Region Graph

eknolo

Modified light switch

)AFAG()AFAG(

offonoffon

9≤⇒⇒

eknolo

)AFAG()AFAG(

offonoffon

9≤⇒⇒

Reachable partof region graph

Properties

eknolo

Fundamental Results

Reachability ☺ Alur, Dill

Trace-inclusion Alur, Dill

Timed ; Untimed ☺

BisimulationTimed ☺ Cerans ; Untimed ☺

Model-checking ☺TCTL, Tmu, Lnu,...

PSPACE-c

PSPACE-c / EXPTIME-c

eknolo

Updatable Timed Automata

Patricia Bouyer, Catherine Dufourd,Emmanuel Fleury, Antoine Petit

W Diagonals

TCTL:Timed Computational Tree

eknolo

TCTL = CTL + Time

−−

∈∈

clocksformulaDznspropositioautomicAPp

“freeze operator” introduces new formula clock z

E[ φ U φ ], A[ φ U φ ] - like in CTLNo EX φ

constraints over formula clocks and automata clocks

eknolo

Derived Operators

Along any path φ holds continuously until within 7 time units ψ becomes valid.

The property φ becomes valid within 5 time units.

eknolo

Example:

pushclick

...)9,0,()9),3(9,()3,3,(),0,(

),()0,()5.3,()0,(

==⎯⎯→⎯=+−=

⎯⎯⎯ →⎯+==⎯→⎯==

⎯⎯→⎯==⎯→⎯==

yxoffyxonyxonyxon

yxonyxonyxoffyxoff

eknolo

Elapsed time in path

...)9,0,()9),3(9,()3,3,(),0,(

),()0,()5.3,()0,(

==⎯⎯→⎯=+−=

⎯⎯⎯ →⎯+==⎯→⎯==

⎯⎯→⎯==⎯→⎯==

yxoffyxonyxonyxon

yxonyxonyxoffyxoff

Example:

Δ(σ,1)=3.5, Δ(σ,6)=3.5+9=12.5

eknolo

TCTL Semantics

s - locationw - formula clock valuationPM(s) - set of paths from sPos(σ) - positions in σΔ(σ,i) - elapsed time

(i,d) <<(i’,d’) iff (i<j) or ((i=j) and (d<d’))

eknolo

Timeliness Properties

receive(m) occurs within 5 time units after send(m)

receive(m) occurs exactly 11 time units after send(m)

putbox occurs periodically (exactly) every 25 time units(note: other putbox’s may occur in between)

The UPPAALVerification Engine

eknolo

Overview

Zones and DBMsMinimal Constraint FormClock Difference Diagrams

Distributed UPPAAL [CAV2000, STTT2004]

Unification & Sharing [FTRTFT2002, SPIN2003]

Acceleration [FORMATS2002]

Static Guard Analysis [TACAS2003,TACAS2004]

Storage-Strategies [CAV2003]

eknolo

ZonesFrom infinite to finite

State(n, x=3.2, y=2.5 )

Symbolic state (set)

Zone:conjunction ofx-y<=n, x<=>n

(n, 1·x·4, 1·y· 3)

eknolo

Symbolic Transitions

delays to

conjuncts to

projects to

y1<=x<=41<=y<=3

y1<=x, 1<=y-2<=x-y<=3

y 3<x, 1<=y-2<=x-y<=3

3<x, y=0

Thus (n,1<=x<=4,1<=y<=3) =a => (m,3<x, y=0)Thus (n,1<=x<=4,1<=y<=3) =a => (m,3<x, y=0)

eknolo

Zones = Conjuctive Constraints

A zone Z is a conjunctive formula:

g1 & g2 & ... & gn

where gi is a clock constraint xi ~ bi or xi-xj~bij

Use a zero-clock x0 (constant 0)

A zone can be re-written as a set:{xi-xj ~ bij | ~ is < or ≤, i,j≤n}

This can be represented as a matrix, DBM (Difference Bound Matrices)

eknolo

Operations on ZonesFuture delay Z↑:

[Z↑] = {u+d| d ∈ R, u∈[Z]}

Past delay Z↓:[Z↓] = {u| u+d∈[Z] for some d∈R}

Reset: {x}Z or Z(x:=0)[{x}Z] = {u[0/x] | u ∈[Z]}

Conjunction[Z&g]= [Z]∩[g]

eknolo

THEOREM

The set of zones is closed under all constraint operations.

That is, the result of the operations on a zone is a zone.

That is, there will be a zone (a finite object i.e a zone/constraints) to representthe sets: [Z↑], [Z↓], [{x}Z], [Z&g].

eknolo

Symbolic Exploration

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

Reachable?

eknolo

A1 B1 CS1V:=1 V=1

A2 B2 CS2V:=2 V=2

InitV=1

VCriticial Section

Fischer’s Protocolanalysis using zones

eknolo

Fischers cont. B1 CS1V:=1 V=1

A2 B2 CS2V:=2 V=2Y<10

A1,A2,v=1 A1,B2,v=2 A1,CS2,v=2 B1,CS2,v=1 CS1,CS2,v=1

Untimed case

eknolo

A2 B2 CS2V:=2 V=2Y<10

Untimed case

Taking time into account

eknolo

A2 B2 CS2V:=2 V=2Y<10

Untimed case

eknolo

A2 B2 CS2V:=2 V=2Y<10

Untimed case

eknolo

A2 B2 CS2V:=2 V=2Y<10

Untimed case

eknolo

A2 B2 CS2V:=2 V=2Y<10

Untimed case

eknolo

Forward Rechability

Passed

WaitingFinal

INITIAL Passed := Ø;Waiting := {(n0,Z0)}

REPEAT- pick (n,Z) in Waiting- if for some Z’ Z

(n,Z’) in Passed then STOP- else (explore) add

{ (m,U) : (n,Z) => (m,U) }to Waiting;Add (n,Z) to Passed

UNTIL Waiting = ØorFinal is in Waiting

Init -> Final ?

eknolo

Forward Rechability

Passed

Waiting Final

(n,Z’) in Passed then STOP- else (explore) add

n,Z’

Init -> Final ?

eknolo

Forward Rechability

Passed

Waiting Final

(n,Z’) in Passed then STOP- else /explore/ add

n,Z’

Init -> Final ?

eknolo

Forward Rechability

Passed

Waiting Final

n,Z’

Init -> Final ?

eknolo

Bellman 1958, Dill 1989

x<=1y-x<=2z-y<=2z<=9

x<=2y-x<=3y<=3z-y<=3z<=7

Inclusion

Canonical Datastructures for ZonesDifference Bounded Matrices

eknolo

x<=1y-x<=2z-y<=2z<=9

x<=2y-x<=3y<=3z-y<=3z<=7

Inclusion

ShortestPath

Closure

ShortestPath

Closure

? ? ⊆

eknolo

x<=1y>=5y-x<=3

Emptiness

Negative Cycleiffempty solution set

Compact

eknolo

1<= x <=41<= y <=3

Future

Future D

ShortestPath

Closure

Removeupper

boundson clocks

1<=x, 1<=y-2<=x-y<=3

eknolo

D1<=x, 1<=y-2<=x-y<=3

1<=x, 1<=y-2<=x-y<=3

Remove allbounds

involving yand set y to 0

y=0, 1<=xy=0, 1<=x

eknolo

x1-x2<=4x2-x1<=10x3-x1<=2x2-x3<=2x0-x1<=3x3-x0<=5

3 3 -2 -2

ShortestPath

ClosureO(n^3)

eknolo

x1-x2<=4x2-x1<=10x3-x1<=2x2-x3<=2x0-x1<=3x3-x0<=5

3 -2 -2

ShortestPath

ClosureO(n^3)

ShortestPath

ReductionO(n^3) 3

Space worst O(n^2)practice O(n)

RTSS 1997

Canonical Datastructures for ZonesMinimal Constraint Form

eknolo

SPACE PERFORMANCE

00,10,20,30,40,50,60,70,80,9

B&OBox

erM. P

Fische

r 2Fisc

Fische

r 4Fisc

Train Cros

cent Minimal Constraint

Global ReductionCombination

eknolo

TIME PERFORMANCE

B&OBox

erM. P

Fische

r 2Fisc

Fische

r 4Fisc

Train Cros

ent Minimal Constraint

Global ReductionCombination

eknolo

v and w are both redundantRemoval of one depends on presence of other.

Shortest Path Reduction1st attempt

Problem

<=wAn edge is REDUNDANT if there existsan alternative path of no greater weight

THUS Remove all redundant edges!

An edge is REDUNDANT if there existsan alternative path of no greater weight

THUS Remove all redundant edges!

Observation: If no zero- or negativecycles then SAFE to remove all redundancies.

eknolo

Shortest Path ReductionSolution

G: weighted graph

eknolo

1. Equivalence classes basedon 0-cycles.

G: weighted graph

eknolo

2. Graph based onrepresentatives. Safe to remove redundant edges

G: weighted graph

eknolo

2. Graph based onrepresentatives.Safe to remove redundant edges

3. Shortest Path Reduction=

One cycle pr. class+

Removal of redundant edgesbetween classes

G: weighted graph

Canonical given order of clocks

eknolo

Earlier Termination

Passed

Waiting Final

n,Z’

Init -> Final ?

eknolo

Earlier Termination

Passed

Waiting Final

n,Z’

Init -> Final ?

ZZ'⊇

eknolo

REPEAT- pick (n,Z) in Waiting- if for some (n,Z’) in Passed then STOP

- else /explore/ add{ (m,U) : (n,Z) => (m,U) }to Waiting;Add (n,Z) to Passed

Earlier Termination

Passed

Waiting Final

Init -> Final ?

n,Z2 ZZii⊇U

ZZ'⊇

eknolo

Clock Difference Diagrams= Binary Decision Diagrams + Difference Bounded Matrices

CDD-representationsCDD-representations

Nodes labeled with differencesMaximal sharing of substructures (also across different CDDs)Maximal intervalsLinear-time algorithms for set-theoretic operations.

NDD’s Maler et. al

DDD’s Møller, Lichtenberg

eknolo

SPACE PERFORMANCE

Philips

Philps

BRPPow

erDown1

PowerD

own2Daca

Fische

r4Fisc

cent CDD

Reduced CDDCDD+BDD

eknolo

TIME PERFORMANCE

Philips

Philps

B&OBRP

PowerD

own1Pow

erDown2

Dacapo

oxFisc

Fische

cent CDD

Reduced CDDCDD+BDD

eknolo

UPPAAL 1995 - 2001

Dec’96 Sep’98

Every 9 month10 times better performance!

Liveness Checking

eknolo

Liveness Properties

F ::= E P |

A♦ P |

Possibly always P

Eventually Pis equivalent to (¬ E ¬ P)

P leads to Qis equivalent to

A ( P ⇒ A♦ Q)

in UPPAAL

Bouajjani, Tripakis, Yovine’97On-the-fly symbolic model checking of TCTL

eknolo

in UPPAAL

LivenessE[]φ (A♦¬φ)

eknolo

in UPPAALLivenessE[]φ (A♦¬φ)

(A♦¬φ)

Passed

Unexplored

eknolo

in UPPAALLivenessE φ (A♦¬φ)

(A♦¬φ)

Passed

Unexplored

eknolo

(A♦¬φ)

Passed

Unexplored

eknolo

(A♦¬φ)

Passed

Unexplored

eknolo

(A♦¬φ)

Passed

Unexplored

eknolo

(A♦¬φ)

Passed

Unexplored

eknolo

(A♦¬φ)

Passed

Unexplored

[FORMATS05]Extensions allowing for automatic synthesis of

smallest bound t such that A♦· tφ holds

Verification Options

eknolo

Verification OptionsSearch Order

Depth FirstBreadth First

State Space ReductionNoneConservativeAggressive

State Space RepresentationDBMCompact FormUnder ApproximationOver Approximation

Diagnostic TraceSomeShortestFastest

ExtrapolationHash Table sizeReuse

eknolo

UCbNo Cycles: Passed list not needed for termination

However,Passed list useful forefficiency

State Space Reduction

eknolo

Cycles:Only symbolic statesinvolving loop-entry points need to be saved on Passed list

State Space Reduction

eknolo

To Store or Not To Store

Audio Protocol

117 statestotal→

81 statesentrypoint→

9 states

Behrmann, Larsen, Pelanek 2003

Time OHless than 10%

eknolo

To Store or Not to StoreBehrmann, Larsen,

Pelanek 2003

eknolo

Over-approximationConvex Hull

Convex Hull

TACAS04: An EXACT method performingas well as Convex Hull has been developed based on abstractions taking max constants into account

distinguishing between clocks, locations and · & ≥

eknolo

Under-approximationBitstate Hashing

Passed

Waiting Final

n,Z’

eknolo

Passed

Waiting Final

n,Z’

Passed=Bitarray

UPPAAL8 Mbits

HashfunctionF

Under-approximationBitstate Hashing

ModellingPatterns

eknolo

Variable Reduction

Reduce size of state space by explicitelyresetting variables when they are not used!

Automatically performed for clock variables (active clock reduction)

eknolo

x is only active in location S1

x>3x<5

S x is inactive at S if on all path fromS, x is always reset before beingtested.

Definitionx<7

Clock Reduction

eknolo

Synchronous Value Passing

eknolo

Atomicity

To allow encoding of control structure (for-or while-loops, conditionals, etc.) without erroneous interleaving

To allow encoding of multicasting.

Heavy use of committed locations.

eknolo

Bounded Liveness

Intent: Check for properties that are guaranteed to hold eventually within some upper (time) bound.

− Provide additional information (with a valid bound).

− More efficient verification.− φ leadsto≤t ψ reduced to A□(b⇒z ≤ t)

with bool b set to true and clock z reset when φ starts to hold. When ψ starts to hold, set bto false.

eknolo

Bounded Liveness

The truth value of b indicates whether or not ψ should hold in the future.

b=truez=0

b=false

b true, check z ≤ t

b=false

A[] (b imply z≤t)b --> not b (for non zenoness)E<> b (for meaningful check)

eknolo

Timers

Parametric timer:(re-)start(value)start! var=value

expired?active (bool)active go?(bool+urgent chan)time-out eventtimeout?

Declare ‘to’ with a tight range.

eknolo

Zenoness

Problem: UPPAAL does not check for zenonessdirectly.

− A model has “zeno” behavior if it can take an infinite amount of actions in finite time.

− That is usually not a desirable behavior in practice.− Zeno models may wrongly conclude that some

properties hold though they logically should not.− Rarely taken into account.

Solution: Add an observer automata and check for non-zenoness, i.e., that time will always pass.

eknolo

Zenoness

x≤1 x≤1x=0

ZenoOK Detect by•adding theobserver:

Constant (10) can be anything(>0), but choose it well w.r.t.your model for efficiency.Clocks ‘x’ are local.

•and check the propertyZenoCheck.A --> ZenoCheck.B

x ≥ 1x==1

Compositionality &Abstraction

eknolo

The State Explosion Problem

ϕ sat

Model-checking is either EXPTIME-complete or PSPACE-complete (for TA’s this is true even for a single TA)

eknolo

Abstraction

satSys AbsSys satAbs ≤

ϕ sat

43ϕ sat

AbsREDUCE TO Preserving safety

properties

eknolo

Compositionality

AbsSysAbsAbs |Abs Abs Sys AbsSys

≤≤

Sys1 Sys2

Abs1 Abs2

Abs |AbsSys |Sys Abs Sys AbsSys

≤≤

eknolo

Abstraction & Compositionality

dealing w stateexplosion

2211AACC

Concrete Abstract

”trace” inclusion

eknolo

Abstraction Example

a1 a2 a3 a4 a5

eknolo

Example Continued

abstractedby

eknolo

Proving abstractionsusing reachability

A[] not TestAbstPoP1.BAD

Recognizesall the BADcomputationsof PoP1

Henrik Ejersbo Jensen PhD Thesis 1999

Applied to

IEEE 1394a Root contention protocol(Simons, Stoelinga)

B&O Power Down Protocol(Ejersbo, Larsen, Skou, FTRTFT2k)

Further Optimizations

eknolo

3 3 -2 -2

Datastructures for Zones

Difference Bounded Matrices (DBMs)

Minimal Constraint Form

[RTSS97]

Clock Difference Diagrams

[CAV99]

PW List [SPIN03]

eknolo

3 3 -2 -2

Datastructures for Zones

Difference Bounded Matrices (DBMs)

Minimal Constraint Form

[RTSS97]

Clock Difference Diagrams

[CAV99]

PW List [SPIN03]

Elegant RUBY bindings for easy implementations

Alexandre David

eknolo

Zone Abstractions

Abstraction taking maximum constantinto account necessary for termination

Utilization of distinction between lower and upper bounds

Utilization of location-dependency

[TACAS03,TACAS04]

eknolo

LU Abstraction

THEOREMFor any state in the LU- abstraction there is a state

in the original set simulating it

LU abstraction is exact wrt reachability

[TACAS04]

eknolo

Zone abstractions

Classical Loc. dep. Max Loc. dep. LU Convex Hull

eknolo

Symmetry Reduction

Exploitation of full symmetry may give factorial reduction

Many timed systems are inherently symmetric

Computation of canonical state representative using swaps.

[Formats 2003]

eknolo

Symmetry Reduction

SWAP: 1 2 ; 3 4

Exploitation of full symmetry may give factorial reduction

Many timed systems are inherently symmetric

Computation of canonical state representative using swaps.

[Formats 2003]

eknolo

Symmetry Reduction

[Formats 2003]

eknolo

Symmetry Reduction

[Formats 2003]

10Gerd Behrmann

UPPAAL 3.6

Iterators for (i: int[0,4]) { }

Quantifiers forall (i: int[0,4]) a[i]==0

Selection select i: int[0,4]; guard...

Template sets process P[4](...) { }

Scalar set based symmetry reductionCompact state-space representationsPriorities

Martijn Henriks, Nijmegen U

eknolo

D-UPPAALGerd Behrmann

Distributed implementation of UPPAAL on PC-cluster [CAV'00, PDMC'02, STTT'03].WWW frontend availableApplications

− Synthesis of Dynamic Voltage Scaling strategies (CISS).

− Ad-hoc mobile real-time protocol (Leslie Lamport) - 25GB in 3 min!

Running on NorduGrid.Local cluster: 50 CPUs and 50GB of RAMTo be used as inspiration for verification GRID platform within ARTIST2 NoE.

eknolo

D-UPPAALGerd Behrman

Distributed implementation of UPPAAL on PC-cluster [CAV'00, PDMC'02, STTT'03].WWW frontend available.Applications

eknolo

D-UPPAALGerd Behrman

Distributed implementation of UPPAAL on PC-cluster [CAV'00, PDMC'02, STTT'03].Applications

Timed Automata – lllllllllll Decidability Resultsbeckert/teaching/... · Timed Automata –...

Documents

H ocom · rrrrrrrrrr rrrrrrrrr lllllllllllÉ illlllllllll lllllllllll lllllllllll lllllllllll lllllllllll lllllllllll jlllllllllll kg-372 23 . kg-379 • kg-378 24 kg-380 . 25 kg-383

Washington, D.C. 206+8 ill lllllllllll ll

Simple permutations: decidability and unavoidable

Turing Machines: Limits of Decidability

Decidability Results for Choreography Realization

ACT 10 Digital Keypad Operating & Installation Instructionsmanuals.easygates.co.uk/PDF/act/ACT10-Keypad-Instructions.pdf · 4 0 Toggled 1 Timed 2 Timed 3 Timed Timed 4 Timed 5 Timed

La pelota de Maite es roja y negra. · El pato y la rana están en el lago. 1. Completa: Lllllllllll) Lllllllllll) Lllllllllll) 2. Escribe Verdadero o Falso

Decidability and Symbolic Verificationpeople.cs.aau.dk/~kgl/SSFT2015/NewSlides/L2DecidabilityEngine.pdf · Decidability and Symbolic Verification Kim G. Larsen Aalborg University,

Decidability and Undecidability Proofs

LLLLLL FRQVXPDWRUH · lllllllllll q ˙ ˘ ˆ lll lllllllllllll lllllllllllll llllllllllll llllllllllllllll llll llllllllllll lllllllllllll lllllllllll lllllllllllll lllllllllllll

LC.MA2 LC - comune.cuneo.it · lllll lllll lllll lllll lllllllllll lllllllllll lllllllllll lllllllllll lllllllllll lllllllllll lllllllllll llllllllllll llllllllllll llllllllllll llllllllllll

CS21 Decidability and Tractability

LLLLLLLLLLL LLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLL...LLLLLLLLLLL LLLLLLLLLLL LLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLL ffffffffffffffffffffffffff XXXXX XX XXXXX XX Title 82A882E082C42E656335> Author

La pelota de Maite es roja y negra. · La pelota de Maite es roja y negra. 1. Completa: Lllllllllll) Lllllllllll) Lllllllllll) 2. ¿Cómo se llama la niña? 4. Dibuja y pinta la pelota

lllllllllll fa - amper.ped.muni.czamper.ped.muni.cz/jenik/brno/zast/28/100.pdf · lllllllllll MMB2017000000710 Rada města Brna ZM7/ Z7/28. zasedání Zastupitelstva města Brna konané

Lecture 3: Decidability

Putnam. Decidability and Essential Undecidability

Computability Decidability

Timed Automata – lllllllllll Decidability Results · Informationsteknologi UCb Regions Finite Partitioning of State Space x y An equivalenceclass(i.e. a region) in factthereis onlya

Decidability and the Halting Problem