Model checking for probabilistic real-time systems Marta - - PowerPoint PPT Presentation

Model checking for probabilistic real-time systems

Marta Kwiatkowska School of Computer Science www.cs.bham.ac.uk/~mzk ETR 2005, Nancy

Overview

• Motivation
• Probabilistic model checking

– The models – Specification languages – What does it involve? – The PRISM model checker

• Case studies

– IPv4 Zeroconf dynamic configuration protocol – Bluetooth device discovery

• Challenges for future

For more information…

www.cs.bham.ac.uk/~dxp/prism/

• Case studies, statistics, group publications
• Download, version 2.1 (2500 downloads)
• Unix/Linux, Windows, Apple platforms
• Publications by others and courses that

feature PRISM…

• J. Rutten, M. Kwiatkowska, G. Norman and
• D. Parker

Mathem atical Techniques for Analyzing Concurrent and Probabilistic System s

• P. Panangaden and F. van Breugel (editors),

CRM Monograph Series, vol. 23, AMS March 2004

The future: ubiquitous computing

Mobile, wearable, wireless devices (WiFi, Bluetooth) Ad hoc, dynamic, ubiquitous computing environment Security, privacy, anonymity protection on the Internet Self-configurable - no need for men/women in white coats! Fast, responsive, power efficient, …

The Internet

Correct design a challenge for formal methods?

Motivation

• In distributed environment, probability helps

– As a symmetry breaker – In gossip-based routing and multicasting

• In distributed environment, clocks and real-time used

– To measure delays and time-outs

• Distributed computation implies non-determinism

– Probabilistic timed automata combine

• Probability (discrete or continuous – here discrete only)
• Real-time (dense)
• Non-determinism
• Need model checking methods capable of dealing with

– Quantitative probability, timing and non-determinism

Real-world protocol examples

• Protocols featuring (discrete) probability, real-time and

nondeterminism

– Randomised back-off schemes

• Ethernet
• IEEE 802.11 (WiFi) Wireless LAN MAC protocol

– Random choice of waiting time

• CSMA/CD (Carrier Sensing Multiple Access – Collision Detection)
• Bluetooth, device discovery phase

– Random choice of a timing delay

• Root contention in IEEE 1394 FireWire

– Random choice over a set of possible addresses

• IPv4 dynamic configuration (link-local addressing)
• Continuous probability distribution needed to model network

traffic, random delays…

www.cs.bham.ac.uk/~dxp/prism

Probability elsewhere

• In performance modelling

– Pioneered by Erlang, in telecommunications, ca 1910 – Models: typically continuous time Markov chains – Emphasis on steady-state and transient probabilities

• In stochastic planning

– Cf Bellman equations, ca 1950s – Models: Markov decision processes – Emphasis on finding optimum policies

• Our focus, probabilistic model checking

– Distinctive, on automated verification for probabilistic systems – Temporal logic specifications, automata-theoretic techniques – Shared models – Exchanging techniques with the other two areas

Verification via model checking…

The model

Model Checker

Temporal logic specification send → ◊deliver

• r

Error trace

Line 5: … Line 21: … Line 15: … … Line 27: … Line 45: ...

• r falsification?

Probabilistic model checking…

Probabilistic Model Checker

Probabilistic temporal logic specification send → P¸ 0.9(◊deliver)

• r

The probability

State 5: 0.6789 State 6: 0.9789 State 7: 1.0 … State 12: 0 State 13: 0.1245

• r

in a nutshell

Probabilistic model

0.4 0.3

• Characteristics:

– Discrete probability, nondeterminism – No real-time

• Formally, (S,s0,Steps,L,Act,c):

– S finite set of states – s0 initial state – Steps maps states s to sets of probability distributions μ over S – Act labelling of steps with actions – L: S ! 2AP atomic propositions – c: S x Act ! R¸0 cost function

• Unfold into infinite paths s0a0μ0s1a1 μ1s2… s.t. μi(si,si+1) > 0, all i
• Probability space induced on Paths by adversary (policy) A

mapping finite path s0a0μ0s1a1μ1…sn to a distribution from sn

Markov Decision Processes (MDPs)

s2 s0 s3 s1

1 1 1 0.02 0.98 1 init try fail succ

a b c d e

• Intuitively, for a fixed adversary A 2 Adv:

– Sample space = infinite paths PathA

s from s

– Event = set of paths – Basic event = cone

• Formally, probability space (PathA

s, Ω, PrA)

– Assign probability P(.) to finite paths ω = s0a0μ0s1a1μ1s2a2…sn – Define PrA (C(ω)) = P(ω), for cones C(ω): C(ω) = { π 2 PathA

s | ω is prefix of π}

• Then cost for a finite path ω and target set F µ S

cost(F)(ω) =

Probability and cost

s0 … sk

Σi=0

min{i : ω(i) 2 F} c(a) if 9 i. ω(i) 2 F,

(a,μ) 2 Steps(ω(i-1)) 1 otherwise

The logic PCTL: syntax

• Probabilistic Computation Tree Logic [HJ94,BdA95,BK98]

– Based on CTL, for DTMCs/MDPs – Add probabilistic operator, e.g. send → P¸ 0.9(◊deliver) – and expected cost operator, e.g. E > 1(heads)

• The syntax of state and path formulas of PCTL is:

φ ::= true | a | φ Æ φ | :φ | P» p(α) | E» c(φ) α ::= X φ | φ U φ where p 2 [0,1] is a probability threshold, c 2 R¸0 is a cost bound and » 2 { <, >, … }

• Semantics is parameterised by a class of adversaries Adv

– “under any scheduling, the probability/cost is … at state s” – reasoning about worst-case/best-case scenario

• The probabilistic operator:

s ²Adv P» p(α) , PrA

s { π 2 PathA s j π ²Adv α } » p

for all A 2 Adv

• The expectation operator:

s ²Adv E» c(φ) , EA

s (cost{ s’ 2 S j s’ ²Adv φ }) » c

wrt PrA

s, for all A 2 Adv

• Semantics of remaining formulas standard

The logic PCTL: semantics

• Reduces to minimum/maximum probability computation

– pmax

s (α), pmin s (α), defined sup/inf over all adversaries

• Obtain linear optimisation problems solvable iteratively, e.g.

Sat( P¸ p(φ1 U φ2) ) , {s 2 S | xs ¸ p} Maximise ∑s 2 S? xs subject to the constraints: xs · ∑s’ 2 S? μ(s’) ¢ xs’ + ∑s’ 2 Syes μ(s’) for all s 2 S?, (a, μ) 2 Steps(s)

• Note

– Syes, Sno , S? = Sn(Sno [ Syes) can be precomputed by graph traversal (BDD fixed point) [dA97,dAKNP00] – Combine graph-theoretic traversal and simplified value iteration

PCTL Until model checking for MDPs

• Reduces to minimum/maximum expected cost computation

– emax

s (φ), emin s (φ), defined sup/inf over all adversaries

• The linear equation generalises to linear optimisation

problems solvable iteratively, e.g.

Sat(E ¸ c(φ)) , {s 2 S | xs ¸ p} Maximise ∑s 2 S? xs subject to the constraints: xs · c(a) + ∑s’ 2 Syes μ(s’) ¢ xs’ for all s 2 S?, (a, μ) 2 Steps(s)

• Note

– Syes, Sno , S? = Sn(Sno [ Syes) can be precomputed as before – Unique solution, cost possibly 1 – Algorithm of [dAlf’97]

Expected cost model checking

Continuous Time Markov Chains (CTMCs)

• Features:

– Discrete states and real time – Exponentially distributed random delays

• Formally:

– Set of states S plus rates R(s,s’) > 0 of moving from s to s’ – Probability of moving from s to s’ by time t > 0 is 1 - e-R(s,s’)¢ t – Transition rate matrix S £ S ! R¸0

• Unfold into infinite paths s0t0s1t1s2t2s3…

– probs (s’), probability of being in s’ in the long-run, starting in s – probs (s’,t), probability of being in s’ at time instant t

• But: no nondeterminism

empty full 1 3 3 4 4 4 3 2 3

The logic CSL: syntax

• Continuous Stochastic Logic [ASSB96,BKH99]

– For CTMCs, based on PCTL, for example

• P< 0.85(}<15 full), probability operator

“the probability of queue becoming full within 15 secs is < 0.85”

• S< 0.01(down), steady-state operator

“in the long run, the probability the system is down is less than 1%”

• The syntax of state and path formulas of CSL is:

φ ::= true | a | φ Æ φ | :φ | S» p(φ) | P» p(α) α ::= X φ | φ U· t φ | φ U φ where p 2 [0,1] is a probability bound, t 2 R¸0 and » 2 { <, >, … }

• Extension with time intervals for until, cost/rewards and

expectation operator E» c(φ)

• Semantics of bounded until:

π ² φ1 U· t φ2 , iff φ2 satisfied at time instant t along π = s0L and φ1 satisfied at all preceding time instants

• The added operators:

s ² S» p(φ) , Σs’ ² φ probs (s’) » p where probs (s’) is prob. of being in s’ in the long-run, having started in s s ² P» p(α) , Pr { π 2 Paths j π ² α } » p where Pr is probability measure on paths as for PCTL

• Semantics of remaining formulas as for PCTL

CSL semantics

• By induction on structure of formula, as for PCTL except for

–

S» p(φ) and P» p(φ1 U· t φ2)

• The steady-state operator

– Requires computation of steady-state probabilities – Reduces to graph traversal and (iterative) solution of linear equation system

• The time-bounded until

– Reduces to transient analysis – Transform CTMC by removing all outgoing transitions from states satisfying φ2 or :φ1

– Then Pr { π 2 Paths j π ² φ U· t φ } = Σs’ ² φ2 probs (s’,t)

– Computed by using uniformisation – More efficient and stable, iterative computation

The logic CSL: model checking

Time, clocks and zones

• Dense real-time, t 2 R¸0
• Clocks take values from time domain R¸0

– Increase at the same rate as real time – Assume finite set X of clocks, maximum const kmax – If n clocks, v,v’ 2 Rn

¸0 are clock valuations

– v+t is time increment, v[X:=0] clock reset of all clocks in X 2 X

• Zones of X, for x,y 2 X, c 2 N

ζ ::= x ~ c j x-y ~ c j ζ Æ ζ j ζ Ç ζ j : ζ – Consider only in canonical form – Closed, diagonal-free if do not feature x < c, x > c, x-y ~ c – Convex, or non-convex (cf [Tripakis98])

Probabilistic Timed Automata: syntax

• Features:

– Clocks, x, real-valued – Can be reset, e.g. {x:=0} – Invariants, e.g. x·8 – Probabilistic transitions, guarded e.g. x¸4, x=8

• Formally, (Loc,s0,Inv,prob,Act,L):

– Loc finite set of locations – s0 initial location – Inv maps locations s to invariant clock constraints – prob probabilistic edge relation that yields the probability of moving from s to s’ if enabled at s, resetting specified clocks – Act action labelling of transitions μ (probability distribution) – L: S ! 2AP atomic propositions

0.01 0.99 send wait fail {x:=0} x=8 x¸4

true x≤8 true

1

waited transmit

PTAs: semantics

• Assume n clocks,

– t,t’ 2 R¸0, v,v’ 2 Rn

¸0

• Markov decision process:

– (S,s0,Steps,L,Act[R¸0) – S, states (s,v), where

• s location, v clock valuation, v ² Inv(s)

– Label discrete steps by t = 0, and t > 0 for time elapse – Steps, distributions μ time points t: time elapse (s,v) ! t, μ (s,v+t), μ point distribution

if Inv(s) satisfied by v+t and v+t’ for all 0 · t’ · t

discrete transition (s,v) ! t, μ (s’,v’)

if t=0 and 9 μ 2 prob enabled at (s,v) and probability of moving to (s’,v’) resetting clocks in X is induced from prob

– s0,L, initial state and state labelling induced from PTA

0.01 0.99 send wait fail {x:=0} x=8 x¸4

true x≤8 true

1

waited transmit

Paths and Adversaries

• Unfold into finite/infinite paths s0 t0 μ0 s1 t1 μ1 s2 t2 μ2 s3…

– divergent if for any t 2 R¸0 9 j 2 N s.t. D(j) > t where D(j) is duration up to j-th state

• Adversary A is a function from finite paths to time-

distribution pairs

– s.t. time divergent, i.e. for each state s, the probability of divergent paths under A is 1

• Probability measure PrA

s on paths π 2 PathA s generalises to

this case

Require non-zenoness, i.e. there must exist a divergent adversary

The logic PTCTL

• Probabilistic Timed CTL for PTAs

– Based on TCTL [AD94] – Add probabilistic operator P » p(¢) of PCTL

• Syntax

φ ::= a | ζ | φ Ç φ | :φ | z.[φ] | P» p(φ U φ) where z ranges over formula clocks, ζ are clock constraints over formula and system clocks

• Example: z.[ P¸ 0.98 (} delivered Æ z < 5)]

“under any scheduling, with probability ¸ 0.85 the message is correctly delivered within 5 ms”

• Semantics derived from PCTL and TCTL

• Let s 2 S, E be a formula clock valuation
• The probabilistic operator is from PCTL

– “ under any scheduling, the probability bound is true at s,E ” s,E ² P» p(φ1 U φ2) , PrA { π 2 PathA

s j π,E ² φ1 U φ2 } » p

for all A 2 Adv

• Semantics of remaining formulas is standard:

s,E ² a , a 2 L(s) s,E ² :φ , s,E 3 φ s,E ² φ1 Ç φ2 , s,E ² φ1 or s,E ² φ2 π,E ² φ1 U φ2 , π = s0L and 9 i 2 N, t · D(i+1)-D(i) s.t. π(i)+t,E+D(i)+t ² φ2 if t’<t, then π(i)+t’,E+D(i)+t’ ² φ1 Ç φ2 if j<i and t’<D(i+1)-D(i),then π(j)+t’,E+D(j)+t’ ² φ1 Ç φ2

PTCTL semantics

Model checking for PTAs

• Apply appropriate quotient, derive time-abstract MDP

– Use standard TA constructs: regions, digitisation, zones – Model check the resulting MDP using standard methods

• This is possible since

{s,E j s,E ²P» p(φ1 U φ2)} = where for any PTCTL formula α, fixed s,E:

pmax(α) = supA 2 Adv PrA { π 2 PathA

s j π,E ² α }

pmin(α) = infA 2 Adv PrA { π 2 PathA

s j π,E ² α }

• Thus sufficient to compute maximum/minimum probability

{s,E j s,E ² pmax(φ1 U φ2)~p} if ~ 2 {·, <} {s,E j s,E ² pmin(φ1 U φ2 )~p} if ~ 2 {¸, >}

Model checking for PTAs: regions

• Region equivalence

– finite partition of TA state space – e.g. x=y=0, x=0 Æ 0<y<1 – time abstract region graph

• Quotient preserves

satisfaction

– clock constraints – TCTL formulas

(kmax,kmax) (0,0) x y

• Idea: Generalise region automaton to MDP over regions

Model checking: regions

• Main result [KNSS99,’02]

– Can adapt the region graph construction [ACD93] to PTAs – Obtain time-abstract, finite-state MDP over regions – Full PTCTL is preserved via region quotient – Can translate PTCTL to PCTL, map H(.), extending PCTL with reset formulas such that φ satisfied in PTA iff H(φ) in the induced MDP over regions – Can model check the MDP using standard methods

• Problem: prohibitive complexity, exponential in number of

clocks and size of largest constant

• Not implemented

Model checking for PTAs: digital clocks

• ε-digitisation [HMP92]

– restrict to closed, diagonal-free TAs – Time domain N, with integer-valued clocks – Define time increment by min{v(x)+t, kmax +1) – Integer-valued time elapse

(kmax,kmax) (0,0) y x

• Finiteness of state space immediate
• Preserves a subset of properties, cf reachability

Model checking: digital clocks

• Main result [KN’02,’03]: digitisation preserves

– minimum/maximum reachability probability – minimum/maximum expected cost reachability

• Digitally-clocked PTAs (and variables representing cost) can

be represented as MDPs, and so can apply model checking directly on MDPs

• Restriction to closed, diagonal-free not important for many

case studies

• Subset of PTCTL only, but expected costs possible
• Problem: inefficiency for some models, as large constants

give rise to very large state spaces

Model checking for PTAs: symbolic

• Zones

– usually convex conjunctions of atomic constraints, – e.g. 0<x<2 Æ 0<y<1 – algebra of operations on zones: conjunctions, pre, post – time abstract zone graph

(kmax,kmax) (0,0) y x

• Explore the zones, constructing the graph

– Forwards, using post (UPPAAL) – on the fly – Backwards, using pre (KRONOS)

Model checking: forwards

• Main result [KNSS99,’02][DKN02]

– Can adapt the forwards zone graph construction to PTAs – Obtain time-abstract, finite-state MDP over zones – (Upper bounds) on reachability properties via quotient – Subset of PTCTL only – Maximum probabilities only – Can model check the MDP using standard methods – Loss of on-the fly, must construct MDP first

• Implemented as pre-processor into PRISM input language

using KRONOS

• Problem: only obtain upper bounds on probability

Model checking: backwards

• Main result [KNS01, KNSW04]

– Can adapt the backwards zone graph construction to PTAs – Can calculate both minimum and maximum probabilities – Must compute conjunctions of zones to preserve probabilistic branching – Obtain time-abstract, finite-state MDP over zones – Full PTCTL is preserved via quotient – Can model check the MDP using standard methods – Loss of on-the fly, must construct MDP first

• Experimental implementation (in Java using DBMs) into

PRISM input language using KRONOS

• Problem: need to consider non-convex zones (unions of

zones, i.e. lists of DBMs)

Continuous PTAs

• Allow clock reset according

to cont. probability distribution

• Region graph no longer works

[Alur]

– Set x to random[0,1], y to 0 – When x < 1, reset y to random[0,1] – Consider transitions x=1, y=1 – If y < 0.5, x = 1 first, else don’t know (error)

(Rmax,Rmax) (0,0)

• Can approximately model check by subdividing region graph
• Problem: prohibitive complexity!!!

x y 1 1

Probabilistic model checking in practice

• Model construction: probability matrices

– Enumerative

• Manipulation of individual states
• Size of state space main limitation

– Symbolic

• Manipulation of sets of states
• Compact representation possible in case of regularity
• Temporal logic model checking: currently limited to

– discrete probability/space models – CTMCs – Simulation admits more general distributions

• Probabilistic Symbolic Model Checker PRISM

The PRISM tool: overview

• Functionality

– Direct support for models: DTMCs, MDPs and CTMCs – Extension with costs/rewards, expectation operator – PTAs with digital clocks by manual translation – Connection from KRONOS to PRISM for PTAs – Experimental implementation using DBMs/DDDs for PTAs

• Input languages

– System description

• probabilistic extension of reactive modules [Alur and Henzinger]

– Probabilistic temporal logics: PCTL and CSL

• Implementation

– Symbolic model construction (MTBDDs), uses CUDD [Somenzi] – Three numerical computation engines – Written in Java and C++

The PRISM tool: implementation

• Numerical engines

– Symbolic, MTBDD based

• Fast construction, reachability analysis
• Very large models if regularity

– Enumerative, sparse-matrix based

• Generally fast numerical computation
• Model size up to millions

– Hybrid

• Speed comparable to sparse matrices for numerical calculations
• Limited by size of vector
• Experimental results

– Several large scale examples: 1010 - 1030 states – No engine wins overall – See www.cs.bham.ac.uk/~dxp/prism

PRISM real-world case studies

• MDPs/DTMCs

– Bluetooth device discovery [ISOLA’04, STTT] – Crowds anonymity protocol (by Shmatikov) [JSC 2003] – Randomised consensus [CAV’01,FORTE’02] – NAND multipl. for nanotech. (with Shukla) [VLSI’04,IEEE CAD ‘05] – Self-stabilising protocols

• CTMCs

– Dynamic power management (with Shukla and Gupta) [HLDVT’02] – Dependability of embedded controller [INCOM’04] – thinkTeam groupware (by ter Beek, Massink & Latella) [DSVIS’05]

• PTAs

– IPv4 Zeroconf dynamic configuration [FORMATS’03] – Root contention in IEEE 1394 FireWire [FAC 2003, STTT 2004] – IEEE 802.11 (WiFi) Wireless LAN MAC protocol [PROBMIV’02]

Case study: IPv4 Zeroconf protocol

• IPv4 ZeroConf protocol [Cheshire,Adoba,Guttman’02]

– New IETF standard for dynamic network self-configuration – Link-local (no routers within the interface) – No need for an active DHCP server – Aimed at home networks, wireless ad-hoc networks, hand-held devices – “Plug and play”

• Self-configuration

– Performs assignment of IP addresses – Symmetric, distributed protocol – Uses random choice and timing delays

IPv4 Zeroconf Standard

The Internet

• Select an IP address out of 65024 at random
• Send a probe querying if address in use, and listen for 2 seconds

– If positive reply received, restart – Otherwise, continue sending probes and listening (2 seconds)

• If K probes sent with no reply, start using the IP number

– Send 2 packets, at 2 second intervals, asserting IP address is being used – If a conflicting assertion received, either:

• defend (send another asserting packet)
• defer (stop using the IP address and restart)

57064? 57064?

Will it work?

• Possible problem…

– IP number chosen may be already in use, but:

• Probes or replies may get lost or delayed (host too busy)
• Issues:

– Self-configuration delays may become unacceptable

• Would you wait 8 seconds to self-configure your PDA?

– No justification for parameters

• for example K=4 in the standard
• Case studies:

– DTMC and Markov reward models, analytical [BvdSHV03,AK03] – TA model using UPPAAL [ZV02] – PTA model with digital clocks using PRISM [KNS03]

The IPv4 Zeroconf protocol model

• Modelled using Probabilistic Timed Automata (with digital

clocks)

• Parallel composition of two PTAs:

–

• ne (joining) host, modelled in detail

– environment (communication medium + other hosts)

• Variables:

– K (number of probes sent before the IP address is used) – the probability of message loss – the number of other hosts already in the network

Modelling the host

Modelling the environment

Expected costs

• Compute minimum/maximum expected cost accumulated

before obtaining a valid IP address?

• Costs:

– Time should be costly: the host should obtain a valid IP address as soon as possible – Using an IP address that is already in use should be very costly: minimise probability of error

• Cost pair: (r,e)

– r=1 (t time units elapsing corresponds to a cost of t) – e=1012 for the event corresponding to using an address which is already in use – e=0 for all other events

Results for IPv4 Zeroconf

• Sending a high number of probes increases the cost

– increases delay before a fresh IP address can be used

• Sending a low number of probes increases the cost

– increases probability of using an IP address already in use

• Similar results to the simpler model of [BvdSHV03]
• Prob. of

message loss = 0.001

• Prob. of

message loss = 0.01

Case Study: Bluetooth Device Discovery

• Short-range low-power wireless protocol

– Personal Area Networks (PANs) – Open standard, versions 1.1 and 1.2 – Widely available in phones, PDAs, laptops, …

• Uses frequency hopping scheme

– To avoid interference (uses unregulated 2.4GHz band) – Pseudo-random frequency selection over 32 of 79 frequencies – Inquirer hops faster – Must synchronise hopping frequencies

• Network formation

– Piconets (1 master, up to 7 slaves) – Self-configuring: devices discover themselves – Master-slave roles

States of a Bluetooth device

• Master looks for device, slave listens for master
• Standby: default operational state
• Inquiry: device discovery
• Page: establishes connection
• Connected: device ready to communicate in a piconet

Frequency hopping

• Clock CLK, 28 bit free-running, ticks every 312.5μs
• Inquiring device (master) broadcasts inquiry packets on two

consecutive frequencies, then listens on the same two (plus margin)

• Potential slaves want to be discovered, scan for messages
• Frequency sequence determined by formula, dependent on

bits of clock CLK (k defined on next slide):

freq = [CLK16-12+k+ (CLK4-2,0-CLK16-12) mod 16] mod 32

Frequency hopping sequence

freq = [CLK16-12+k+ (CLK4-2,0- CLK16-12) mod 16] mod 32

• Two trains (=lines)
• k is offset that

determines which train

• Swaps between trains

every 2.56 sec

• Each line repeated 128

times

Sending and receiving in Bluetooth

• Sender: broadcasts inquiry packets, sending according to the

frequency hopping sequence, then listens, and repeats

• Receiver: follows the frequency hopping sequence, own clock
• Listens continuously on one frequency
• If hears message sent by the sender, then replies on the

same frequency

• Random wait to avoid collision if two receivers hear on same

frequency

Bluetooth modelling

• Very complex interaction

– Genuine randomness, probabilistic modelling essential – Devices make contact only if listen on the right frequency at the right time! – Sleep/scan periods unbreakable, much longer than listening – Cannot scale constants (approximate results) – Cannot omit subactivities, otherwise oversimplification

• Huge model, even for one sender and one receiver!

– Initial configurations dependent on 28 bit clock – Cannot fix start state of receiver, clock value could be arbitrary – 17,179,869,184 possible initial states

• But is a realistic future ubiquitous computing scenario!

More about this Bluetooth model…

• Other approaches

– network simulation tools (BlueHoc), obtain averaged results – analytical approaches, require simplifications to the model – easy to make incorrect probabilistic assumptions…

• Must optimise/reduce model

– Assume negligible clock drift – Discrete time, obtain a DTMC – Divide into 32 separate cases

• Observations

– Work with realistic constants, as in the standard – Analyse v1.2 and 1.1, confirm 1.1 slower – Show best/worst case values, can pinpoint scenarios which give rise to them – Also obtain power consumption analysis

Time to hear 1 reply

• Max time to hear is 2.5716sec, in 921,600 possible initial

states, (Min 635μs)

• Cumulative: assume uniform distribution on states when

receiver first starts to listen

Time to hear 2 replies

Huge probabilistic model, 17,179,869,184 possible initial states. Max time is 5.177sec (16,565 slots), in 444 initial states. Unlike simulation, model checking is exhaustive. The exact curve is obtained by model checking. Derived plot incorrectly assumes independence of events.

What we have learnt from practice

• Probabilistic model checking

– Is capable of finding ‘corner cases’ and ‘unusual trends’ – Good for worst-case scenarios, for all initial states – Benefits from quantitative-style analysis for a range of parameters – Is limited by state space size – Useful for real-world protocol analysis, power management, performance, biological processes, …

• Simulation and sampling-based techniques

– Limited by accuracy of the results, not state-space explosion – May need to rerun experiments for each possible start state, not always feasible – Statistical methods in conjunction with sampling help – Nested formulas may be difficult

Challenges for future

• Exploiting structure

– Abstraction, data/equivalence quotient, (de)compositionality… – Parametric probabilistic verification?

• Proof assistant for probabilistic verification?
• Approximation methods?
• Efficient methods for continuous models

– Continuous PTAs? Continuous time MDPs? LMPs?

• More expressive specifications

– Probabilistic LTL/PCTL*/mu-calculus?

• Real software, not models!
• More applications

– Quantum cryptographic protocols – Mobile ad hoc network protocols

PRISM collaborators worldwide