[PPT] - IMITATOR II A Tool for Solving the Good Parameters Problem in PowerPoint Presentation

SLIDE 1

INFINITY ’2010 Singapore 21st September 2010

IMITATOR II A Tool for Solving the Good Parameters Problem in Timed Automata

´ Etienne Andr´ e

Laboratoire Sp´ ecification et V´ erification LSV, ENS de Cachan & CNRS, France

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 1 / 23

SLIDE 2

Introduction Context

The Good Parameters Problem

Context: Verification of timed systems

◮ Use of timing parameters (unknown constants) ◮ Model of Parametric Timed Automata (PTA) ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 2 / 23

SLIDE 3

Introduction Context

The Good Parameters Problem

Context: Verification of timed systems

◮ Use of timing parameters (unknown constants) ◮ Model of Parametric Timed Automata (PTA)

The good parameters problem: [Frehse et al., 2008]

◮ “Given a bounded parameter domain V0, find a dense set of points

(timing parameters) of good behavior in V0 (ideally the largest one)”

V0

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 2 / 23

SLIDE 4

Introduction Context

The Good Parameters Problem

Context: Verification of timed systems

◮ Use of timing parameters (unknown constants) ◮ Model of Parametric Timed Automata (PTA)

The good parameters problem: [Frehse et al., 2008]

◮ “Given a bounded parameter domain V0, find a dense set of points

(timing parameters) of good behavior in V0 (ideally the largest one)”

K0

V0

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 2 / 23

SLIDE 5

Introduction Context

Classical approaches

Verification of the property on a set of discrete points

◮ Drawback: would need an infinite number of verifications to obtain a

dense set of points

Computation of all the reachable states of a PTA, and intersection with the set of bad states [Alur et al., 1995]

◮ Drawback: too costly in practice

Approach based on CEGAR [Clarke et al., 2000, Frehse et al., 2008]

◮ Drawback: underapproximation ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 3 / 23

SLIDE 6

Introduction Context

Classical approaches

Verification of the property on a set of discrete points

◮ Drawback: would need an infinite number of verifications to obtain a

dense set of points

Computation of all the reachable states of a PTA, and intersection with the set of bad states [Alur et al., 1995]

◮ Drawback: too costly in practice

Approach based on CEGAR [Clarke et al., 2000, Frehse et al., 2008]

◮ Drawback: underapproximation

New approach implemented in Imitator II

◮ Method of behavioral cartography ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 3 / 23

SLIDE 7

Introduction Preliminaries

Good and Bad Traces

Trace over a PTA: finite alternating sequence of locations and actions (time-abstract run) A trace is said to be good if it verifies a given property

◮ Example of property φ: “b always occurs before c” ◮ Example of good trace w.r.t. φ

a e d a b f c

◮ Example of bad trace w.r.t. φ

a e d a f c b

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 4 / 23

SLIDE 8

Outline

1

The Inverse Method Algorithm

2

The Behavioral Cartography Algorithm

3

Implementation and Case Studies

4

Final Remarks

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 5 / 23

SLIDE 9

The Inverse Method Algorithm

Outline

1

The Inverse Method Algorithm

2

The Behavioral Cartography Algorithm

3

Implementation and Case Studies

4

Final Remarks

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 6 / 23

SLIDE 10

The Inverse Method Algorithm

The Inverse Method (1/2)

Imitator II Inverse Method

PTA A Reference point π0 Constraint K0 on the parameters

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 7 / 23

SLIDE 11

The Inverse Method Algorithm

The Inverse Method (2/2)

Input

◮ A PTA A ◮ A reference valuation π0 of all the parameters of A

· π0

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 8 / 23

SLIDE 12

The Inverse Method Algorithm

The Inverse Method (2/2)

Input

◮ A PTA A ◮ A reference valuation π0 of all the parameters of A

Output: tile K0

◮ Convex constraint on the parameters such that ⋆ π0 |

= K0

⋆ For all point π |

= K0, A under π has the same trace set as for π0 [Andr´ e et al., 2009]

K0·

π0

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 8 / 23

SLIDE 13

The Inverse Method Algorithm

Application to the Root Contention Protocol

· π0

delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

Root contention protocol of the IEEE 1394 (“FireWire”) High Performance Serial Bus [Hune et al., 2002] Input: IEEE reference valuation

rc slow min = 159ns delay = 30ns

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 9 / 23

SLIDE 14

The Inverse Method Algorithm

Application to the Root Contention Protocol K0

· π0

delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

Root contention protocol of the IEEE 1394 (“FireWire”) High Performance Serial Bus [Hune et al., 2002] Input: IEEE reference valuation

rc slow min = 159ns delay = 30ns

Output: K0 : 2delay < 76 ∧ 2delay + 85 < rc slow min

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 9 / 23

SLIDE 15

The Inverse Method Algorithm

Application to the Root Contention Protocol K0

· π0

delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

Root contention protocol of the IEEE 1394 (“FireWire”) High Performance Serial Bus [Hune et al., 2002] Input: IEEE reference valuation

rc slow min = 159ns delay = 30ns

Output: K0 : 2delay < 76 ∧ 2delay + 85 < rc slow min Prop3: The minimum probability that a leader is elected after three rounds

r less is greater or equal to 0.75

◮ For all π |

= K0, Prop3 is satisfied

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 9 / 23

SLIDE 16

The Behavioral Cartography Algorithm

Outline

1

The Inverse Method Algorithm

2

The Behavioral Cartography Algorithm

3

Implementation and Case Studies

4

Final Remarks

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 10 / 23

SLIDE 17

The Behavioral Cartography Algorithm

Goal: Find the maximal set of points corresponding to a good behavior

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 11 / 23

SLIDE 18

The Behavioral Cartography Algorithm

Goal: Find the maximal set of points corresponding to a good behavior Method: Iterate the inverse method for all the integer points of a given rectangle V0

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 11 / 23

SLIDE 19

The Behavioral Cartography Algorithm

Goal: Find the maximal set of points corresponding to a good behavior Method: Iterate the inverse method for all the integer points of a given rectangle V0 Output: set of tiles for all the integer points of V0

◮ behavioral cartography of the parameter space

[Andr´ e and Fribourg, 2010]

Cartography Algorithm

PTA A Rectangle V0 Cover

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 11 / 23

SLIDE 20

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 21

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 22

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 23

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 24

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 25

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 26

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 27

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 7 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 28

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 7 8 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 29

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 7 9 8 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 30

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 7 9 8 10 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50]

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 31

The Behavioral Cartography Algorithm

The Root Contention Protocol: Cartography

1 2 3 4 5 6 7 9 11 12 8 10 13 14 15 16 17 18 19 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

We consider the following V0 : rc slow min ∈ [140; 200] and delay ∈ [1; 50] Remarks

◮ Tiles 1 and 6 are infinite towards

ne dimension

◮ The cartography does not cover the

whole real-valued space within V0 (holes in the lower right corner

f V0)

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 12 / 23

SLIDE 32

The Behavioral Cartography Algorithm

Partition into Good and Bad Tiles

A tile is said to be good if all its corresponding traces are good According to the nature of the trace sets, we can partition the tiles into good and bad ones

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 13 / 23

SLIDE 33

The Behavioral Cartography Algorithm

The Root Contention Protocol: Partition (1/2)

1 2 3 4 5 6 7 9 11 12 8 10 13 14 15 16 17 18 19 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

Prop3: “The minimum probability that a leader is elected after three rounds

r less is greater or equal to 0.75”

◮ Good tile: 1 ◮ Bad tiles: 2 to 19 ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 14 / 23

SLIDE 34

The Behavioral Cartography Algorithm

The Root Contention Protocol: Partition (2/2)

1 2 3 4 5 6 7 9 11 12 8 10 13 14 15 16 17 18 19 delay rc slow min 00 10 20 30 40 50 60 70 80 90 100 80 90 100 110 120 130 140 150 160 170 180 190 200 210 220

Prop5: “The minimum probability that a leader is elected after five rounds or less is greater or equal to 0.75”

◮ Good tiles: 1, 2, 3 ◮ Bad tiles: 4 to 19 ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 15 / 23

SLIDE 35

Implementation and Case Studies

Outline

1

The Inverse Method Algorithm

2

The Behavioral Cartography Algorithm

3

Implementation and Case Studies

4

Final Remarks

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 16 / 23

SLIDE 36

Implementation and Case Studies

Implementation

In short

◮ Imitator II: new improved version of Imitator ◮ “Inverse Method for Inferring Time AbstracT BehaviOR” ◮ 8000 lines of code ◮ Program written in OCaml ◮ Makes use of the PPL library for handling polyhedra

[Bagnara et al., 2008]

Some features

◮ List of tiles with their corresponding trace set under a graphical form ◮ Cartography under a graphical form (for 2 parameter dimensions)

Imitator II is available on its Web page

◮ http://www.lsv.ens-cachan.fr/~andre/IMITATOR2 ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 17 / 23

SLIDE 37

Implementation and Case Studies

Case Studies

Application to various case studies

◮ Asynchronous circuits ◮ Communication protocols

Computation time for the cartography algorithm

◮ Experiments conducted on an Intel Core2 Duo 2.4 GHz with 2 Gb

Example PTAs loc./PTA |X| |P| |V0| tiles states trans. Time (s) SR-latch 3 [3, 8] 3 3 1331 6 5 4 0.3 Flip-flop 5 [4, 16] 5 2 644 8 15 14 3 Latch circuit 7 [2, 5] 8 4 73062 5 21 20 96.3 And–Or 3 [4, 8] 4 6 75600 4 64 72 118 CSMA/CD 3 [3, 8] 3 3 2000 140 349 545 269 SPSMALL 10 [3, 8] 10 2 3149 259 60 61 1194 RCP 5 [6, 11] 6 3 186050 19 5688 9312 7018

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 18 / 23

SLIDE 38

Final Remarks

Outline

1

The Inverse Method Algorithm

2

The Behavioral Cartography Algorithm

3

Implementation and Case Studies

4

Final Remarks

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 19 / 23

SLIDE 39

Final Remarks

Summary

Implementation of the Inverse Method

◮ Modeling of a system with parametric timed automata ◮ Starting with a valuation π0 of the system, we synthesize a

constraint K0 with the same trace set as π0

◮ Gives a criterion of robustness by guaranteeing the same behavior

around π0

Implementation of the Behavioral cartography

◮ Solves the good parameters problem: synthesizes the largest set of

points within a rectangle V0 corresponding to a given good behavior

◮ Independent from the property: only the partition does ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 20 / 23

SLIDE 40

Final Remarks

Future Work

Automatize the partition into good and bad tiles

◮ Make use of the Uppaal model checker [Larsen et al., 1997]

Extend the behavioral cartography to hybrid automata

◮ Allow to consider different clock rates

Consider a dynamic cartography

◮ Refine the scale in order to fill the whole real-valued V0

Consider a weaker property than equality of trace sets

◮ Reference trace with partial orders ´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 21 / 23

SLIDE 41

Bibliography

References I

Alur, R., Courcoubetis, C., Halbwachs, N., Henzinger, T., Ho, P.-H., Nicollin, X., Olivero, A., Sifakis, J., and Yovine, S. (1995). The algorithmic analysis of hybrid systems. Theoretical Computer Science, 138:3–34. Andr´ e, ´ E., Chatain, T., Encrenaz, E., and Fribourg, L. (2009). An inverse method for parametric timed automata. International Journal of Foundations of Computer Science, 20(5):819–836. Andr´ e, ´

E. and Fribourg, L. (2010).

Behavioral cartography of timed automata. In RP’10, volume 6227 of LNCS, pages 76–90. Springer. Bagnara, R., Hill, P. M., and Zaffanella, E. (2008). The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems. Science of Computer Programming, 72(1–2):3–21. Clarke, E. M., Grumberg, O., Jha, S., Lu, Y., and Veith, H. (2000). Counterexample-guided abstraction refinement. In CAV ’00, pages 154–169. Springer-Verlag.

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 22 / 23

SLIDE 42

Bibliography

References II

Frehse, G., Jha, S., and Krogh, B. (2008). A counterexample-guided approach to parameter synthesis for linear hybrid automata. In HSCC ’08, volume 4981 of LNCS, pages 187–200. Springer. Hune, T., Romijn, J., Stoelinga, M., and Vaandrager, F. (2002). Linear parametric model checking of timed automata. Journal of Logic and Algebraic Programming. Larsen, K. G., Pettersson, P., and Yi, W. (1997). Uppaal in a nutshell. International Journal on Software Tools for Technology Transfer, 1(1-2):134–152.

´ Etienne ANDR´ E (LSV) IMITATOR II 21st September 2010 23 / 23