Decidability Decidability and Symbolic Symbolic Verification - - PowerPoint PPT Presentation

▶
decidability decidability and symbolic symbolic
SMART_READER_LITE
LIVE PREVIEW

Decidability Decidability and Symbolic Symbolic Verification - - PowerPoint PPT Presentation

Dec 24, 2023 215 likes •685 views

Decidability Decidability and Symbolic Symbolic Verification Symbolic Symbolic Verification Verification Verification Kim G. Larsen Kim G. Larsen Aalborg Aalborg University Aalborg Aalborg University University DENMARK University, ,

slide-1
SLIDE 1

Decidability Decidability and Symbolic Symbolic Verification Verification Symbolic Symbolic Verification Verification

Kim G. Larsen Kim G. Larsen Aalborg Aalborg University University DENMARK DENMARK Aalborg Aalborg University University, , DENMARK DENMARK

slide-2
SLIDE 2

Reachability Reachability ?

a b

OBSTACLE:

c

Uncountably infinite state space

c

Reachable from initial state (L0 x 0 y 0) ?

locations clock-valuations

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Lars Kim Larsen [2] en [2]

Reachable from initial state (L0,x= 0,y= 0) ?

slide-3
SLIDE 3

The Region Abstraction The Region Abstraction

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Lars Kim Larsen [3] en [3]

slide-4
SLIDE 4

Regions – Regions – From Infinite to Finite

S S S Reset region

THM [AD90]

+ Successor Regions Successor Regions Successor regions

Reachability is decidable (and PSPACE-complete) for timed automata THM [CY90] Time-optimal reachability is decidable (and PSPACE-complete) for timed automata

A region

timed automata

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Lars Kim Larsen [4] en [4]

g

slide-5
SLIDE 5

Fundamental Results Fundamental Results

  • Reachability

 y

  • Model-checking
  • TCTL 

; MTL  ; MITL  TCTL  ; MTL  ; MITL 

  • Bisimulation, Simulation

Ti d  U ti d 

  • Timed 

; Untimed 

  • Trace-inclusion
  • Timed 

; Untimed 

Kim Lars Kim Larsen [5] en [5] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-6
SLIDE 6

Symbolic Symbolic Verification Verification

The UPPAAL Verification Engine Verification Engine

slide-7
SLIDE 7

Regions – Regions – From Infinite to Finite

+

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Lars Kim Larsen [7] en [7]

slide-8
SLIDE 8

Zones – Zones – From Finite to Efficiency

From Finite to Efficiency

A zone Z: 1≤ x ≤ 2 Æ 0≤ y ≤ 2 Æ x - y ≥ 0

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Lars Kim Larsen [8] en [8]

slide-9
SLIDE 9

Zones - Zones - Operations Operations

y y y

(n, 2≤x≤4 Æ 1≤y≤3 Æ y-x≤0 ) (n, 2≤x Æ 1≤y Æ -3≤ y-x≤0 ) (n, 2≤x Æ 1≤y≤3 Æ y-x≤0 )

x x x

Delay Delay (stopwatch)

y y y

(n, x= 0 Æ 1≤y≤3 ) (n, 2≤x≤4Æ 1≤y )

2

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

x x x

Reset Extrapolation Convex Hull

Kim Lars Kim Larsen [9] en [9]

slide-10
SLIDE 10

Symbolic Transitions Symbolic Transitions

y

1< = x< = 4 1< = y< = 3

y

1< = x, 1< = y

  • 2< = x-y< = 3

delays to x y x x> 3 conjuncts to y

3< x, 1< = y

  • 2< = x-y< = 3

y

a

y:= 0 j t t x

3< x, y= 0

x

a

y: projects to

, y

Kim Larsen [10] Kim Larsen [10] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-11
SLIDE 11

Datastructures for Zones Datastructures for Zones

  • Difference Bounded

Matrices (DBMs)

  • 4

( )

  • Minimal Constraint

x1 x2

4 2 2 3 3

  • 2
  • 2

Form

[RTSS97]

x3 x0

2 5 1

  • Clock Difference

Diagrams

[CAV99]

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [11] Kim Larsen [11]

slide-12
SLIDE 12

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

12 12 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-13
SLIDE 13

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

13 13 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-14
SLIDE 14

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final? INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW Final? REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

14 14 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-15
SLIDE 15

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

15 15 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-16
SLIDE 16

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

16 16 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-17
SLIDE 17

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

17 17 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-18
SLIDE 18

Forward Reachability Forward Reachability

Init -> Final ?

Waiting Final INITIAL Passed := Ø; Waiting := { (n0,Z0)} REPEAT PW REPEAT pick (n,Z) in Waiting if (n,Z) = Final return true for all (n,Z)(n’,Z’): ( , ) ( , ) if for some (n’,Z’’) Z’ Z’’ continue else add (n’,Z’) to Waiting move (n,Z) to Passed Passed Init UNTIL Waiting = Ø return false

18 18 Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-19
SLIDE 19

Symbolic Exploration Symbolic Exploration

y x Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [19] Kim Larsen [19]

slide-20
SLIDE 20

Symbolic Exploration Symbolic Exploration

y x Delay Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [20] Kim Larsen [20]

slide-21
SLIDE 21

Symbolic Exploration Symbolic Exploration

y x Left Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [21] Kim Larsen [21]

slide-22
SLIDE 22

Symbolic Exploration Symbolic Exploration

y x Left Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [22] Kim Larsen [22]

slide-23
SLIDE 23

Symbolic Exploration Symbolic Exploration

y x Delay Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [23] Kim Larsen [23]

slide-24
SLIDE 24

Symbolic Exploration Symbolic Exploration

y x Left Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [24] Kim Larsen [24]

slide-25
SLIDE 25

Symbolic Exploration Symbolic Exploration

y x Left Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [25] Kim Larsen [25]

slide-26
SLIDE 26

Symbolic Exploration Symbolic Exploration

y x Delay Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [26] Kim Larsen [26]

slide-27
SLIDE 27

Symbolic Exploration Symbolic Exploration

y x Down Reachable? Reachable?

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [27] Kim Larsen [27]

slide-28
SLIDE 28

Verification Verification Options Options

slide-29
SLIDE 29

Verification Options Verification Options

Search Order Depth First Breadth First St t S R d ti State Space Reduction None Conservative Aggressive St t S R t ti State Space Representation DBM Compact Form Under Approximation O A i ti Over Approximation Diagnostic Trace Some Shortest F t t Fastest Extrapolation Hash Table size Reuse

Kim Larsen [29] Kim Larsen [29] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-30
SLIDE 30

State Space Reduction State Space Reduction

Cycles: Only symbolic states involving loop-entry points involving loop entry points need to be saved on Passed list

Kim Larsen [30] Kim Larsen [30] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-31
SLIDE 31

To Store or Not To Store To Store or Not To Store

Behrmann Larsen Behrmann, Larsen, Pelanek 2003 117 states 117 statestotal

→

81 statesentrypoint

→

9 states 9 states Time OH less than 10% Audio Protocol less than 10% Audio Protocol

Kim Larsen [31] Kim Larsen [31] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-32
SLIDE 32

Over Over/Under Under Approximation Approximation

Question:

G ∈ R ? O R

G I

U How to use: G ∈ O ? G ∈ O ? G ∈ U ?

Declared State Space

G∈ U ⇒ G∈ R ¬(G∈ O) ⇒ ¬(G∈ R)

Kim Larsen [32] Kim Larsen [32] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-33
SLIDE 33

Over-approximation Over-approximation

Convex Hull Convex Hull

y

3 5

x

1 3 5 1

Convex Hull

TACAS04: An EXACT method performing as well as Convex Hull has been

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 33 33

as well as Convex Hull has been developed based on abstractions taking max constants into account distinguishing between clocks, locations and ≤ & ≥

slide-34
SLIDE 34

Under-approximation Under-approximation

Bitstat Bitstate Hashing Hashing

Waiting

Final m,U n,Z

Passed

Init n,Z’

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [34] Kim Larsen [34]

slide-35
SLIDE 35

Under-approximation Under-approximation

Bitstat Bitstate Hashing Hashing

Waiting

Final m,U

Passed= Bitarray 1

n,Z

1 UPPAAL 4 - 512 Mbits 4 512 Mbits Hashfunction F Passed

Init n,Z’

1

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [35] Kim Larsen [35]

slide-36
SLIDE 36

Extrapolation Extrapolation

Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012 Kim Larsen [36] Kim Larsen [36]

slide-37
SLIDE 37

Forward Symbolic Exploration Forward Symbolic Exploration

TERMINATION TERMINATION TERMINATION not garanteed TERMINATION not garanteed Need for Need for Need for Finite Abstractions Need for Finite Abstractions

Kim Larsen [37] Kim Larsen [37] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-38
SLIDE 38

Abstractions Abstractions

We want ⇒a to be:

  • sound & complete wrt reachability
  • finite
  • easy to compute

ibl

  • as coarse as possible

Kim Larsen [38] Kim Larsen [38] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-39
SLIDE 39

Abstraction by Extrapolation Abstraction by Extrapolation

[Daws,Tripakis 98]

Let k be the largest constant appearing in the TA

* *

x1 x2

> k < -k

* * *

x1 x2

∞

  • k

* * * *

x3 x0

< k

* * * * *

x3 x0

k

* * * * *

Sound & Complete Ensures Termination

Kim Larsen [39] Kim Larsen [39] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-40
SLIDE 40

Location Dependency Location Dependency

[Behrmann, Bouyer, Fleury, Larsen 03]

kx = 5 ky = 106 kx = 5 ky = 106 Will generate all symbolic states of the form

(l2 x∈ [0 14]

y∈ [5 14n] y-x∈ [5 14n-14]) Will generate all symbolic states of the form

(l2 x∈ [0 14]

y∈ [5 14n] y-x∈ [5 14n-14])

(l2, x∈ [0,14] , y∈ [5,14n] , y x∈ [5,14n 14])

for n ≤106/14 !!

(l2, x∈ [0,14] , y∈ [5,14n] , y x∈ [5,14n 14])

for n ≤106/14 !! But y≥106 is not RELEVANT in l2

Kim Larsen [40] Kim Larsen [40] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-41
SLIDE 41

Location Dependent Location Dependent Constants Constants

kx = 5 ky = 106 kx = 5 ky = 106 kx

i

= 14 for i∈{1,2,3,4} kx

i

= 14 for i∈{1,2,3,4} kj

i may be found as solution to

simple linear constraints! ky

i

= 5 for i∈{1,2,3} ky

4

= 106 ky

i

= 5 for i∈{1,2,3} ky

4

= 106 p Active Clock Reduction: kj

i = -∞

Kim Larsen [41] Kim Larsen [41] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-42
SLIDE 42

Experiments Experiments

Kim Larsen [42] Kim Larsen [42] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-43
SLIDE 43

Lower and Upper Bounds Lower and Upper Bounds

[Behrmann, Bouyer, Larsen, Pelanek 04]

kx

l = 106

kx

l = 106 x

Given that x≤106 is an upper bound implies that Given that x≤106 is an upper bound implies that (l,vx,vy) simulates (l,v’x,vy) whenever v’x≥ vx≥ 10. (l,vx,vy) simulates (l,v’x,vy) whenever v’x≥ vx≥ 10.

Kim Larsen [43] Kim Larsen [43] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

For reachability downward closure wrt simulation suffices!

slide-44
SLIDE 44

Advanced Extrapolations Advanced Extrapolations

Classical

  • Loc. dep. Max
  • Loc. dep. LU

Convex Hull cher Fisc D CSMA/CD

Kim Larsen [44] Kim Larsen [44] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-45
SLIDE 45

Additional “secrets” Additional “secrets”

  • Sharing among symbolic states

l i / di l /

  • location vector / discrete values / zones
  • Distributed implementation of UPPAAL

S R d i

  • Symmetry Reduction
  • Sweep Line Method

d l

  • Guiding wrt Heuristic Value
  • User-supplied / Auto-generated

Sli i “C” C d

  • Slicing wrt “C” Code

Kim Larsen [45] Kim Larsen [45] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012

slide-46
SLIDE 46

Open Problems Open Problems

  • Fully symbolic exploration of TA (both

discrete and continuous part) ? discrete and continuous part) ?

  • Recent work on fully symbolic engine for TA:

Georges Morbe, Florian Pigorsch and Christoph Scholl: Fully Symbolic Model Checking for Timed Automata. Fully Symbolic Model Checking for Timed Automata. CAV 2011.

  • Canonical form for CDD’s ?

P i l O d R d i ?

  • Partial Order Reduction ?
  • Compositional Backwards Reachability ?
  • Bounded Model Checking for TA ?
  • Exploitation of multi-core processors ?
  • …

Kim Larsen [46] Kim Larsen [46] Summer School on Summer School on Informatics RIO Informatics RIO 2012 2012