Modelling and Verification 2006 Lecture 13 Untimed bisimilarity - - PowerPoint PPT Presentation

▶
modelling and verification 2006
SMART_READER_LITE
LIVE PREVIEW

Modelling and Verification 2006 Lecture 13 Untimed bisimilarity - - PowerPoint PPT Presentation

Aug 24, 2022 309 likes •631 views

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Modelling and Verification 2006 Lecture 13 Untimed bisimilarity Region graph and the reachability problem Networks of timed automata Model checking of timed

slide-1
SLIDE 1

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata

Modelling and Verification 2006

Lecture 13 Untimed bisimilarity Region graph and the reachability problem Networks of timed automata Model checking of timed automata

Lecture 13 Modelling and Verification 2006

slide-2
SLIDE 2

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Untimed Bisimilarity

Example of Timed Non-Bisimilar Automata

  • A

a x≤1 x:=0

  • A’

a x≤2 x:=0

  • B

a x≤3

  • B’

a x≤3

  • C
  • C’

Lecture 13 Modelling and Verification 2006

slide-3
SLIDE 3

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Untimed Bisimilarity

Untimed Bisimilarity

Let A1 and A2 be timed automata. Let ǫ be a new (fresh) action. Untimed Bisimilarity We say that A1 and A2 are untimed bisimilar iff the transition systems T(A1) and T(A2) generated by A1 and A2 where every transition of the form

d

− → for d ∈ R≥0 is replaced with

ǫ

− → are strongly bisimilar. Remark:

a

− → for a ∈ N is treated as a visible transition, while

d

− → for d ∈ R≥0 are all labelled by a single visible action

ǫ

− →. Corollary Any two timed bisimilar automata are also untimed bisimilar.

Lecture 13 Modelling and Verification 2006

slide-4
SLIDE 4

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Untimed Bisimilarity

Untimed Bisimilarity

Let A1 and A2 be timed automata. Let ǫ be a new (fresh) action. Untimed Bisimilarity We say that A1 and A2 are untimed bisimilar iff the transition systems T(A1) and T(A2) generated by A1 and A2 where every transition of the form

d

− → for d ∈ R≥0 is replaced with

ǫ

− → are strongly bisimilar. Remark:

a

− → for a ∈ N is treated as a visible transition, while

d

− → for d ∈ R≥0 are all labelled by a single visible action

ǫ

− →. Corollary Any two timed bisimilar automata are also untimed bisimilar.

Lecture 13 Modelling and Verification 2006

slide-5
SLIDE 5

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Untimed Bisimilarity

Timed Non-Bisimilar but Untimed Bisimilar Automata

  • A

a x≤1 x:=0

  • A’

a x≤2 x:=0

  • B

a x≤3

  • B’

a x≤3

  • C
  • C’

Lecture 13 Modelling and Verification 2006

slide-6
SLIDE 6

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Automatic Verification of Timed Automata

Fact Even very simple timed automata generate timed transition systems with infinitely (even uncountably) many reachable states. Question Is any automatic verification approach (like bisimilarity checking, model checking or reachability analysis) possible at all? Answer Yes, using region graph techniques. Key idea: infinitely many clock valuations can be categorized into finitely many equivalence classes.

Lecture 13 Modelling and Verification 2006

slide-7
SLIDE 7

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Automatic Verification of Timed Automata

Fact Even very simple timed automata generate timed transition systems with infinitely (even uncountably) many reachable states. Question Is any automatic verification approach (like bisimilarity checking, model checking or reachability analysis) possible at all? Answer Yes, using region graph techniques. Key idea: infinitely many clock valuations can be categorized into finitely many equivalence classes.

Lecture 13 Modelling and Verification 2006

slide-8
SLIDE 8

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Automatic Verification of Timed Automata

Fact Even very simple timed automata generate timed transition systems with infinitely (even uncountably) many reachable states. Question Is any automatic verification approach (like bisimilarity checking, model checking or reachability analysis) possible at all? Answer Yes, using region graph techniques. Key idea: infinitely many clock valuations can be categorized into finitely many equivalence classes.

Lecture 13 Modelling and Verification 2006

slide-9
SLIDE 9

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Preliminaries

Let d ∈ R≥0. Then let ⌊d⌋ be the integer part of d, and let frac(d) be the fractional part of d. Any d ∈ R≥0 can be now written as d = ⌊d⌋ + frac(d). Example: ⌊2.345⌋ = 2 and frac(2.345) = 0.345. Let A be a timed automaton and x ∈ C be a clock. We define cx ∈ N as the largest constant with which the clock x is ever compared either in the guards or in the invariants present in A.

Lecture 13 Modelling and Verification 2006

slide-10
SLIDE 10

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Preliminaries

Let d ∈ R≥0. Then let ⌊d⌋ be the integer part of d, and let frac(d) be the fractional part of d. Any d ∈ R≥0 can be now written as d = ⌊d⌋ + frac(d). Example: ⌊2.345⌋ = 2 and frac(2.345) = 0.345. Let A be a timed automaton and x ∈ C be a clock. We define cx ∈ N as the largest constant with which the clock x is ever compared either in the guards or in the invariants present in A.

Lecture 13 Modelling and Verification 2006

slide-11
SLIDE 11

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Intuition

Let v, v′ : C → R≥0 be clock valuations. Let ∼ denote untimed bisimilarity of timed transition systems. Our Aim Define an equivalence relation ≡ over clock valuations such that

1 v ≡ v′ implies (ℓ, v) ∼ (ℓ, v′) for any location ℓ 2 ≡ has only finitely many equivalence classes. Lecture 13 Modelling and Verification 2006

slide-12
SLIDE 12

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Clock (Region) Equivalence

Equivalence Relation on Clock Valuations Clock valuations v and v′ are equivalent (v ≡ v′) iff

Lecture 13 Modelling and Verification 2006

slide-13
SLIDE 13

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Clock (Region) Equivalence

Equivalence Relation on Clock Valuations Clock valuations v and v′ are equivalent (v ≡ v′) iff

1 for all x ∈ C such that v(x) ≤ cx or v′(x) ≤ cx we have

⌊v(x)⌋ = ⌊v′(x)⌋

Lecture 13 Modelling and Verification 2006

slide-14
SLIDE 14

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Clock (Region) Equivalence

Equivalence Relation on Clock Valuations Clock valuations v and v′ are equivalent (v ≡ v′) iff

1 for all x ∈ C such that v(x) ≤ cx or v′(x) ≤ cx we have

⌊v(x)⌋ = ⌊v′(x)⌋

2 for all x ∈ C such that v(x) ≤ cx we have

frac(v(x)) = 0 iff frac(v′(x)) = 0

Lecture 13 Modelling and Verification 2006

slide-15
SLIDE 15

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Clock (Region) Equivalence

Equivalence Relation on Clock Valuations Clock valuations v and v′ are equivalent (v ≡ v′) iff

1 for all x ∈ C such that v(x) ≤ cx or v′(x) ≤ cx we have

⌊v(x)⌋ = ⌊v′(x)⌋

2 for all x ∈ C such that v(x) ≤ cx we have

frac(v(x)) = 0 iff frac(v′(x)) = 0

3 for all x, y ∈ C such that v(x) ≤ cx and v(y) ≤ cy we have

frac(v(x)) ≤ frac(v(y)) iff frac(v′(x)) ≤ frac(v′(y))

Lecture 13 Modelling and Verification 2006

slide-16
SLIDE 16

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Regions

Let v be a clock valuation. The ≡-equivalence class represented by v is denoted by [v] and defined by [v] = {v′ | v′ ≡ v}. Definition of a Region An ≡-equivalence class [v] represented by some clock valuation v is called a region. Theorem For every location ℓ and any two valuations v and v′ from the same region (v ≡ v′) it holds that (ℓ, v) ∼ (ℓ, v′) where ∼ stands for untimed bisimilarity.

Lecture 13 Modelling and Verification 2006

slide-17
SLIDE 17

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Motivation Intuition Clock Equivalence

Regions

Let v be a clock valuation. The ≡-equivalence class represented by v is denoted by [v] and defined by [v] = {v′ | v′ ≡ v}. Definition of a Region An ≡-equivalence class [v] represented by some clock valuation v is called a region. Theorem For every location ℓ and any two valuations v and v′ from the same region (v ≡ v′) it holds that (ℓ, v) ∼ (ℓ, v′) where ∼ stands for untimed bisimilarity.

Lecture 13 Modelling and Verification 2006

slide-18
SLIDE 18

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Symbolic States and Region Graph

state (ℓ, v)

  • symbolic state (ℓ, [v])

Note: v ≡ v′ implies that (ℓ, [v]) = (ℓ, [v′]). Region Graph Region graph of a timed automaton A is an unlabelled (and untimed) transition system where states are symbolic states = ⇒ on symbolic states is defined as follows: (ℓ, [v]) = ⇒ (ℓ′, [v′]) iff (ℓ, v)

a

− → (ℓ′, v′) for some label a (ℓ, [v]) = ⇒ (ℓ, [v′]) iff (ℓ, v)

d

− → (ℓ, v′) for some d ∈ R≥0 Fact A region graph of any timed automaton is finite.

Lecture 13 Modelling and Verification 2006

slide-19
SLIDE 19

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Symbolic States and Region Graph

state (ℓ, v)

  • symbolic state (ℓ, [v])

Note: v ≡ v′ implies that (ℓ, [v]) = (ℓ, [v′]). Region Graph Region graph of a timed automaton A is an unlabelled (and untimed) transition system where states are symbolic states = ⇒ on symbolic states is defined as follows: (ℓ, [v]) = ⇒ (ℓ′, [v′]) iff (ℓ, v)

a

− → (ℓ′, v′) for some label a (ℓ, [v]) = ⇒ (ℓ, [v′]) iff (ℓ, v)

d

− → (ℓ, v′) for some d ∈ R≥0 Fact A region graph of any timed automaton is finite.

Lecture 13 Modelling and Verification 2006

slide-20
SLIDE 20

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Application of Region Graphs to Reachability

We write (ℓ, v) − → (ℓ′, v′) whenever (ℓ, v)

a

− → (ℓ′, v′) for some label a, or (ℓ, v)

d

− → (ℓ′, v′) for some d ∈ R≥0. Reachability Problem for Timed Automata Instance (input): Automaton A = (L, ℓ0, E, I) and a state (ℓ, v). Question: Is it true that (ℓ0, v0) − →∗ (ℓ, v) ? (where v0(x) = 0 for all x ∈ C) Reduction of Timed Automata Reachability to Region Graphs Reachability for timed automata is decidable because (ℓ0, v0) − →∗ (ℓ, v) in a timed automaton if and only if (ℓ0, [v0]) = ⇒∗ (ℓ, [v]) in its (finite) region graph.

Lecture 13 Modelling and Verification 2006

slide-21
SLIDE 21

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Application of Region Graphs to Reachability

We write (ℓ, v) − → (ℓ′, v′) whenever (ℓ, v)

a

− → (ℓ′, v′) for some label a, or (ℓ, v)

d

− → (ℓ′, v′) for some d ∈ R≥0. Reachability Problem for Timed Automata Instance (input): Automaton A = (L, ℓ0, E, I) and a state (ℓ, v). Question: Is it true that (ℓ0, v0) − →∗ (ℓ, v) ? (where v0(x) = 0 for all x ∈ C) Reduction of Timed Automata Reachability to Region Graphs Reachability for timed automata is decidable because (ℓ0, v0) − →∗ (ℓ, v) in a timed automaton if and only if (ℓ0, [v0]) = ⇒∗ (ℓ, [v]) in its (finite) region graph.

Lecture 13 Modelling and Verification 2006

slide-22
SLIDE 22

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Applicability of Region Graphs

Pros Region graphs provide a natural abstraction which enables to prove decidability of e.g. reachability timed and untimed bisimilarity untimed language equivalence and language emptiness. Cons Region graphs have too large state spaces. State explosion is exponential in the number of clocks the maximal constants appearing in the guards.

Lecture 13 Modelling and Verification 2006

slide-23
SLIDE 23

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Applicability of Region Graphs

Pros Region graphs provide a natural abstraction which enables to prove decidability of e.g. reachability timed and untimed bisimilarity untimed language equivalence and language emptiness. Cons Region graphs have too large state spaces. State explosion is exponential in the number of clocks the maximal constants appearing in the guards.

Lecture 13 Modelling and Verification 2006

slide-24
SLIDE 24

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Applications

Decidability Results

Theorem [Alur, Dill’90] Reachability for timed automata is PSPACE-complete (PSPACE = collection of problems decidable using polynomial space). Theorem [Cerans’92] Timed bisimilarity for timed automata is decidable in EXPTIME (deterministic exponential time). Theorem [Larsen, Wang’93] Untimed bisimilarity for timed automata is decidable in EXPTIME (deterministic exponential time).

Lecture 13 Modelling and Verification 2006

slide-25
SLIDE 25

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Networks of Timed Automata

Timed Automata in Parallel

  • a!
  • a?
  • Intuition in CCS

(a.Nil | a.Nil) {a} Let C be a set of clocks and Chan a set of channels. We let Act = N ∪ R≥0 where N = {c! | c ∈ Chan} ∪ {c? | c ∈ Chan} ∪ {τ}. Let Ai = (Li, ℓi

0, Ei, Ii) be timed automata for 1 ≤ i ≤ n.

Networks of Timed Automata We call A = A1|A2| · · · |An a network of timed automata.

Lecture 13 Modelling and Verification 2006

slide-26
SLIDE 26

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Networks of Timed Automata

Timed Automata in Parallel

  • a!
  • a?
  • Intuition in CCS

(a.Nil | a.Nil) {a} Let C be a set of clocks and Chan a set of channels. We let Act = N ∪ R≥0 where N = {c! | c ∈ Chan} ∪ {c? | c ∈ Chan} ∪ {τ}. Let Ai = (Li, ℓi

0, Ei, Ii) be timed automata for 1 ≤ i ≤ n.

Networks of Timed Automata We call A = A1|A2| · · · |An a network of timed automata.

Lecture 13 Modelling and Verification 2006

slide-27
SLIDE 27

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Example: Hammer, Worker, Nail

H:

  • free

start? x:=0, y:=0

  • busy

done? y≥5

  • hit!

x≥1 x:=0

  • W:
  • rest

start! z:=0

  • work

done! z≥10

  • z ≤ 60

N:

  • up

hit?

  • half

hit?

  • down

τ

  • Lecture 13

Modelling and Verification 2006

slide-28
SLIDE 28

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Example: Hammer, Worker, Nail

H:

  • free

start? x:=0, y:=0

  • busy

done? y≥5

  • hit!

x≥1 x:=0

  • W:
  • rest

start! z:=0

  • work

done! z≥10

  • z ≤ 60

N:

  • up

hit?

  • half

hit?

  • down

τ

  • Lecture 13

Modelling and Verification 2006

slide-29
SLIDE 29

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Example: Hammer, Worker, Nail

H:

  • free

start? x:=0, y:=0

  • busy

done? y≥5

  • hit!

x≥1 x:=0

  • W:
  • rest

start! z:=0

  • work

done! z≥10

  • z ≤ 60

N:

  • up

hit?

  • half

hit?

  • down

τ

  • Lecture 13

Modelling and Verification 2006

slide-30
SLIDE 30

Equivalence Checking Problems Regions Region Graph Networks of Timed Automata Definition Example Logical Properties in UPPAAL

Logic for Timed Automata in UPPAAL

Let φ and ψ be local properties (checkable locally in a given state). Example: (H.busy ∧ W.rest ∧ 20 ≤ z ≤ 30) UPPAAL can check the following formulae (subset of TCTL) A[]φ — invariantly φ Eφ — possibly φ Aφ — always eventually φ E[]φ — potentially always φ φ –> ψ — φ always leads to ψ

  • same as A[](φ =

⇒ Aψ)

  • Legend:

A and E are so called path quantifiers, and [] and quantify over states of a selected path.

Lecture 13 Modelling and Verification 2006