Lazy abstractions for timed automata F. Herbreteau 1 , B. Srivathsan - - PowerPoint PPT Presentation

▶
lazy abstractions for timed automata
SMART_READER_LITE
LIVE PREVIEW

Lazy abstractions for timed automata F. Herbreteau 1 , B. Srivathsan - - PowerPoint PPT Presentation

Nov 19, 2023 9 likes •611 views

Lazy abstractions for timed automata F. Herbreteau 1 , B. Srivathsan 2 , I. Walukiewicz 1 LaBRI, Universit e Bordeaux 1 Software modeling and verification group, RWTH-Aachen MOVES Seminar, March 2013 Lazy abstractions for timed automata -

slide-1
SLIDE 1

Lazy abstractions for timed automata

  • F. Herbreteau1, B. Srivathsan2, I. Walukiewicz1

LaBRI, Universit´ e Bordeaux 1 Software modeling and verification group, RWTH-Aachen MOVES Seminar, March 2013

Lazy abstractions for timed automata - 1/26

slide-2
SLIDE 2

Timed Automata [AD94]

s0 s1 s3 s2

{y} (y = 1) (x < 1) (y < 1), {y} (x < 1) (x > 1)

Run: finite sequence of transitions

s0 s1 0.4 s3 0.9 0.5

0.4 0.5

x y

◮ accepting if ends in green state

Lazy abstractions for timed automata - 2/26

slide-3
SLIDE 3

The problem we are interested in ...

Given a TA, does there exist an accepting run?

Lazy abstractions for timed automata - 3/26

slide-4
SLIDE 4

The problem we are interested in ...

Given a TA, does there exist an accepting run? Theorem [AD94] This problem is PSPACE-complete

first solution based on Regions

Lazy abstractions for timed automata - 3/26

slide-5
SLIDE 5

Regions

Maximal bounds: M : X → N ∪ {−∞}

Lazy abstractions for timed automata - 4/26

slide-6
SLIDE 6

Regions

Maximal bounds: M : X → N ∪ {−∞}

M(x) = 3, M(y) = 2 x ⋖ 0, x ⋗ 0, x ⋖ 1, x ⋗ 1, . . . , x ⋖ 3, x ⋗ 3 y ⋖ 0, y ⋗ 0, . . . , y ⋖ 2, y ⋗ 2

Lazy abstractions for timed automata - 4/26

slide-7
SLIDE 7

Regions

Maximal bounds: M : X → N ∪ {−∞}

M(x) = 3, M(y) = 2 x ⋖ 0, x ⋗ 0, x ⋖ 1, x ⋗ 1, . . . , x ⋖ 3, x ⋗ 3 y ⋖ 0, y ⋗ 0, . . . , y ⋖ 2, y ⋗ 2

1 2 3 4 5 1 2 3 4

Lazy abstractions for timed automata - 4/26

slide-8
SLIDE 8

◮ Region: set of valuations

satisfying the same guards w.r.t. time

◮ Finiteness: Parametrized

by maximal constant Sound and complete [AD94] Region graph preserves state reachability

Lazy abstractions for timed automata - 5/26

slide-9
SLIDE 9

◮ Region: set of valuations

satisfying the same guards w.r.t. time

◮ Finiteness: Parametrized

by maximal constant O(|X|!.M|X|) many regions! Sound and complete [AD94] Region graph preserves state reachability

Lazy abstractions for timed automata - 5/26

slide-10
SLIDE 10

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-11
SLIDE 11

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-12
SLIDE 12

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-13
SLIDE 13

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-14
SLIDE 14

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-15
SLIDE 15

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-16
SLIDE 16

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3 (x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-17
SLIDE 17

A more efficient solution...

Key idea: Maintain all valuations reachable along a path

q0 q1 q2 q3

x = y ≥ 0 x = y ≥ 0 y − x ≥ 7 y − x ≥ 7

(x ≤ 5) (y ≥ 7) x := 0

Lazy abstractions for timed automata - 6/26

slide-18
SLIDE 18

Zones and zone graph

◮ Zone: set of valuations defined

by conjunctions of constraints:

◮ x ∼ c ◮ x − y ∼ c ◮ e.g. (x − y ≥ 1) ∧ y < 2

◮ Representation: by DBM

Sound and complete [DT98] Zone graph preserves state reachability

Lazy abstractions for timed automata - 7/26

slide-19
SLIDE 19

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

Lazy abstractions for timed automata - 8/26

slide-20
SLIDE 20

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

(q0, x − y = 0)

Lazy abstractions for timed automata - 8/26

slide-21
SLIDE 21

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

(q0, x − y = 0) (q1, x − y = 0)

Lazy abstractions for timed automata - 8/26

slide-22
SLIDE 22

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

(q0, x − y = 0) (q1, x − y = 0) (q1, x − y = 1)

Lazy abstractions for timed automata - 8/26

slide-23
SLIDE 23

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

(q0, x − y = 0) (q1, x − y = 0) (q1, x − y = 1) (q1, x − y = 2)

. . .

Lazy abstractions for timed automata - 8/26

slide-24
SLIDE 24

But the zone graph could be infinite ...

q0 q1 (y = 1), {y} {x, y}

(q0, x − y = 0) (q1, x − y = 0) (q1, x − y = 1) (q1, x − y = 2)

. . . Abstract zone to its region closure

Lazy abstractions for timed automata - 8/26

slide-25
SLIDE 25

q0 q1 (y = 1), {y} {x, y} M(x) = −∞ M(y) = 1

Lazy abstractions for timed automata - 9/26

slide-26
SLIDE 26

q0 q1 (y = 1), {y} {x, y} M(x) = −∞ M(y) = 1

Lazy abstractions for timed automata - 9/26

slide-27
SLIDE 27

q0 q1 (y = 1), {y} {x, y} M(x) = −∞ M(y) = 1

(q0, x − y = 0) (q1, x − y = 0) (q1, x − y = 1)

x − y = 1 ⊆ ClosureM(x − y = 0)

Lazy abstractions for timed automata - 9/26

slide-28
SLIDE 28

q0 q1 (y = 1), {y} {x, y} M(x) = −∞ M(y) = 1

(q0, x − y = 0) (q1, x − y = 0) (q1, x − y = 1)

x − y = 1 ⊆ ClosureM(x − y = 0) Using Closure

  • 1. Z ⊆ ClosureM(Z ′) can be done efficiently [HKSW11]
  • 2. Given M, ClosureM is optimal [HSW12]

Lazy abstractions for timed automata - 9/26

slide-29
SLIDE 29

Reachability algorithm:

◮ Compute zones ◮ Use ClosureM for termination ◮ Given M, ClosureM is optimal

Lazy abstractions for timed automata - 10/26

slide-30
SLIDE 30

Reachability algorithm:

◮ Compute zones ◮ Use ClosureM for termination ◮ Given M, ClosureM is optimal

Coming next: get better M bounds!

Lazy abstractions for timed automata - 10/26

slide-31
SLIDE 31

q0 q1 q2

(y = 1), {y} {x} x ≥ 106 x y M(x) = 106 M(y) = 1

. . .

Lazy abstractions for timed automata - 11/26

slide-32
SLIDE 32

q0 q1 q2

(y = 1), {y} {x} x ≥ 106 x y M(x) = 106 M(y) = 1

. . .

(q0, x − y = 0) (q0, x − y = 1) (q0, x − y = 2) (q0, x − y = 106 + 1) (q0, x − y = 106 + 2) (q1, 0 ≤ x ≤ y) (q2, 106 ≤ x ≤ y)

. . .

More than 106 nodes unnecessary

Lazy abstractions for timed automata - 11/26

slide-33
SLIDE 33

Static analysis [BBFL03]

Key idea: Bounds for every q of the automaton

q0 q1 q2

(y = 1), {y} {x} x ≥ 106 M0(x) = −∞ M0(y) = 1 M1(x) = 106 M1(y) = −∞

Lazy abstractions for timed automata - 12/26

slide-34
SLIDE 34

Static analysis [BBFL03]

Key idea: Bounds for every q of the automaton

q0 q1 q2

(y = 1), {y} {x} x ≥ 106 M0(x) = −∞ M0(y) = 1 M1(x) = 106 M1(y) = −∞

(q0, x − y = 0) (q0, x − y = 1) (q1, 0 ≤ x ≤ y) (q2, 106 ≤ x ≤ y) Lazy abstractions for timed automata - 12/26

slide-35
SLIDE 35

However...

q0 q1 q2

(y = 1), {y} x = 1 ∧ y = 2 x ≥ 106 M0(x) = 106 M0(y) = 2 M1(x) = 106 M1(y) = −∞

Static analysis gives more than 106 nodes in the zone graph

Lazy abstractions for timed automata - 13/26

slide-36
SLIDE 36

However...

q0 q1 q2

(y = 1), {y} x = 1 ∧ y = 2 x ≥ 106 M0(x) = 106 M0(y) = 2 M1(x) = 106 M1(y) = −∞

Static analysis gives more than 106 nodes in the zone graph Need to look at semantics

Lazy abstractions for timed automata - 13/26

slide-37
SLIDE 37

On-the-fly bounds [HKSW11]

Key idea: Bounds for every (q, Z) of the zone graph . . . . . . . . . constants at depend on subtree

Lazy abstractions for timed automata - 14/26

slide-38
SLIDE 38

q0 q1 q2

(y = 1), {y} x = 1 ∧ y = 2 x ≥ 106

(q0, x − y = 0) (q0, x − y = 1) (q0, x − y = 2) (q0, x − y = 3)

(x : 1, y : 2) (x : 1, y : 2) (x : 1, y : 2)

Lazy abstractions for timed automata - 15/26

slide-39
SLIDE 39

Two ways of getting bounds:

◮ Static analysis (bounds for every q) ◮ On-the-fly propagation (bounds for every (q, Z))

Lazy abstractions for timed automata - 16/26

slide-40
SLIDE 40

Two ways of getting bounds:

◮ Static analysis (bounds for every q) ◮ On-the-fly propagation (bounds for every (q, Z))

Coming next: Better bounds by exploiting more semantics

Lazy abstractions for timed automata - 16/26

slide-41
SLIDE 41

Observation 1: If all edges are enabled in the zone graph, then we don’t need bounds at all

Lazy abstractions for timed automata - 17/26

slide-42
SLIDE 42

q0 q1 q2

(y = 1), {y} x ≥ 106

(q0, x − y = 0) (q0, x − y = 1) (q1, x − y = 0) (q2, x − y = 0 ∧ x ≥ 106) Lazy abstractions for timed automata - 18/26

slide-43
SLIDE 43

q0 q1 q2

(y = 1), {y} x ≥ 106

(q0, x − y = 0) (q0, x − y = 1) (q1, x − y = 0) (q2, x − y = 0 ∧ x ≥ 106)

Otf-propagation would have given ∼ 106 nodes

Lazy abstractions for timed automata - 18/26

slide-44
SLIDE 44

q0 q1 q2

(y = 1), {y} x ≥ 106

(q0, x − y = 0) (q0, x − y = 1) (q1, x − y = 0) (q2, x − y = 0 ∧ x ≥ 106)

Otf-propagation would have given ∼ 106 nodes Trigger bounds propagation only when a disabled edge is seen

Lazy abstractions for timed automata - 18/26

slide-45
SLIDE 45

Observation 2: If some edge is disabled in the zone graph, it is enough to consider only the guards that were responsible for the edge to be disabled

Lazy abstractions for timed automata - 19/26

slide-46
SLIDE 46

q0 q1 q2 q3 q4

x ≥ 5 y ≥ 5 y > 100 w ≤ 2

(q0, x = y = w ≥ 0) (q1, x = y = w ≥ 5) (q2, x = y = w ≥ 5) (q3, x = y = w > 100)

w ≤ 2

Lazy abstractions for timed automata - 20/26

slide-47
SLIDE 47

q0 q1 q2 q3 q4

x ≥ 5 y ≥ 5 y > 100 w ≤ 2

(q0, x = y = w ≥ 0) (q1, x = y = w ≥ 5) (q2, x = y = w ≥ 5) (q3, x = y = w > 100)

w ≤ 2 x ≥ 5 is responsible

Lazy abstractions for timed automata - 20/26

slide-48
SLIDE 48

(q0, Z0 (q1, Z1) (qn−2, Zn−2) (qn−1, Zn−1) (qn, Zn)

g1 gn−1 gn gn+1

. . .

Lazy abstractions for timed automata - 21/26

slide-49
SLIDE 49

(q0, Z0 (q1, Z1) (qn−2, Zn−2) (qn−1, Zn−1) (qn, Zn)

g1 gn−1 gn gn+1

. . .

Mn φn := ClosureMn(Zn) gn+1 is disabled from φn

Lazy abstractions for timed automata - 21/26

slide-50
SLIDE 50

(q0, Z0 (q1, Z1) (qn−2, Zn−2) (qn−1, Zn−1) (qn, Zn)

g1 gn−1 gn gn+1

. . .

Mn φn := ClosureMn(Zn) gn+1 is disabled from φn Mn−1 φn−1 := ClosureMn−1(Zn−1) if Zn−1 ⊆ φn, don’t take gn

Lazy abstractions for timed automata - 21/26

slide-51
SLIDE 51

(q0, Z0 (q1, Z1) (qn−2, Zn−2) (qn−1, Zn−1) (qn, Zn)

g1 gn−1 gn gn+1

. . .

Mn φn := ClosureMn(Zn) gn+1 is disabled from φn Mn−1 φn−1 := ClosureMn−1(Zn−1) if Zn−1 ⊆ φn, don’t take gn Mn−2 φn−1 := ClosureMn−2(Zn−2) if Zn−2 ⊆ φn−1, don’t take gn−1 M1 φ1 := ClosureM1(Z1) if Z1 ⊆ φ2, don’t take g2 M0 φ1 := ClosureM0(Z0) if Z0 ⊆ φ1, don’t take g1

Lazy abstractions for timed automata - 21/26

slide-52
SLIDE 52

Lazy propagation A new efficient propagation algorithm based on relation between successor zones

Lazy abstractions for timed automata (CoRR abs/1301.3127)

Lazy abstractions for timed automata - 22/26

slide-53
SLIDE 53

Exponential gain

Lazy abstractions for timed automata - 23/26

slide-54
SLIDE 54

Exponential gain

◮ Lazy: gives constants only for some pair (xi, yi) in any path

(quadratic zone graph)

◮ Static: gives constants for all clocks (exponential) ◮ Otf: gives constants for k clocks depending on order of exploration

(exponential)

Lazy abstractions for timed automata - 23/26

slide-55
SLIDE 55

Experiments

Model

  • nb. of

UPPAAL (-C) static

  • tf

lazy clocks nodes sec. nodes sec. nodes sec. nodes sec. CSMA/CD 10 11 120845 1.9 CSMA/CD 11 12 311310 5.4 CSMA/CD 12 13 786447 14.8 FDDI 50 151 12605 52.9 FDDI 70 211 FDDI 140 421 Fischer 9 9 135485 2.4 Fischer 10 10 447598 10.1 Fischer 11 11 1464971 40.4 Stari 2 7 7870 0.1 Stari 3 10 136632 1.7 Stari 4 13 1323193 26.2

◮ UPPAAL (-C) shows results from UPPAAL tool which uses static bounds ◮ static is our implementation of UPPAAL’s algo ◮ Time out (150s), Memory out (1Gb)

Lazy abstractions for timed automata - 24/26

slide-56
SLIDE 56

Experiments

Model

  • nb. of

UPPAAL (-C) static

  • tf

lazy clocks nodes sec. nodes sec. nodes sec. nodes sec. CSMA/CD 10 11 120845 1.9 120844 6.3 CSMA/CD 11 12 311310 5.4 311309 16.8 CSMA/CD 12 13 786447 14.8 786446 44.0 FDDI 50 151 12605 52.9 12606 29.4 FDDI 70 211 FDDI 140 421 Fischer 9 9 135485 2.4 135485 8.9 Fischer 10 10 447598 10.1 447598 34.0 Fischer 11 11 1464971 40.4 1464971 126.8 Stari 2 7 7870 0.1 6993 0.4 Stari 3 10 136632 1.7 113958 9.4 Stari 4 13 1323193 26.2 983593 109.0

◮ UPPAAL (-C) shows results from UPPAAL tool which uses static bounds ◮ static is our implementation of UPPAAL’s algo ◮ Time out (150s), Memory out (1Gb)

Lazy abstractions for timed automata - 24/26

slide-57
SLIDE 57

Experiments

Model

  • nb. of

UPPAAL (-C) static

  • tf

lazy clocks nodes sec. nodes sec. nodes sec. nodes sec. CSMA/CD 10 11 120845 1.9 120844 6.3 CSMA/CD 11 12 311310 5.4 311309 16.8 CSMA/CD 12 13 786447 14.8 786446 44.0 FDDI 50 151 12605 52.9 12606 29.4 5448 14.7 401 0.8 FDDI 70 211 561 2.7 FDDI 140 421 1121 37.6 Fischer 9 9 135485 2.4 135485 8.9 Fischer 10 10 447598 10.1 447598 34.0 Fischer 11 11 1464971 40.4 1464971 126.8 Stari 2 7 7870 0.1 6993 0.4 5779 0.4 5113 0.5 Stari 3 10 136632 1.7 113958 9.4 82182 8.2 53178 7.8 Stari 4 13 1323193 26.2 983593 109.0 602762 84.9 342801 65.7

◮ UPPAAL (-C) shows results from UPPAAL tool which uses static bounds ◮ static is our implementation of UPPAAL’s algo ◮ Time out (150s), Memory out (1Gb)

Lazy abstractions for timed automata - 24/26

slide-58
SLIDE 58

Experiments

Model

  • nb. of

UPPAAL (-C) static

  • tf

lazy clocks nodes sec. nodes sec. nodes sec. nodes sec. CSMA/CD 10 11 120845 1.9 120844 6.3 78604 6.1 74324 6.1 CSMA/CD 11 12 311310 5.4 311309 16.8 198669 16.1 188315 15.9 CSMA/CD 12 13 786447 14.8 786446 44.0 493582 41.8 469027 40.9 FDDI 50 151 12605 52.9 12606 29.4 5448 14.7 401 0.8 FDDI 70 211 561 2.7 FDDI 140 421 1121 37.6 Fischer 9 9 135485 2.4 135485 8.9 135485 11.4 135485 24.7 Fischer 10 10 447598 10.1 447598 34.0 447598 42.8 447598 98.1 Fischer 11 11 1464971 40.4 1464971 126.8 Stari 2 7 7870 0.1 6993 0.4 5779 0.4 5113 0.5 Stari 3 10 136632 1.7 113958 9.4 82182 8.2 53178 7.8 Stari 4 13 1323193 26.2 983593 109.0 602762 84.9 342801 65.7

◮ UPPAAL (-C) shows results from UPPAAL tool which uses static bounds ◮ static is our implementation of UPPAAL’s algo ◮ Time out (150s), Memory out (1Gb)

Lazy abstractions for timed automata - 24/26

slide-59
SLIDE 59

Summary and future work

◮ A new algorithm for obtaining abstraction parameters

◮ works the same way for LU-bounds and aLU abstraction

◮ Theoretically, exponential gain possible ◮ Practical gains understood by experiments ◮ Better data-structures for zones ◮ Abstractions for discrete component ◮ Probabilistic systems, (rectangular) hybrid systems

Lazy abstractions for timed automata - 25/26

slide-60
SLIDE 60

References I

  • R. Alur and D.L. Dill.

A theory of timed automata. Theoretical Computer Science, 126(2):183–235, 1994.

  • G. Behrmann, P. Bouyer, E. Fleury, and K. G. Larsen.

Static guard analysis in timed automata verification. In TACAS’03, volume 2619 of LNCS, pages 254–270. Springer, 2003.

  • C. Daws and S. Tripakis.

Model checking of real-time reachability properties using abstractions. In TACAS’98, volume 1384 of LNCS, pages 313–329. Springer, 1998.

  • F. Herbreteau, D. Kini, B. Srivathsan, and I. Walukiewicz.

Using non-convex approximations for efficient analysis of timed automata. In Proceedings of FSTTCS, volume 13 of LIPIcs, pages 78–89. Schloss Dagstuhl - Leibniz-Zentrum fuer Informatik, 2011.

  • F. Herbreteau, B. Srivathsan, and I. Walukiewicz.

Better abstractions for timed automata. In LICS, 2012. Lazy abstractions for timed automata - 26/26