Model Checking of of Timed Systems Rajeev Alur University of Pennsylvania

1. Model Checking ofof Timed SystemsRajeev AlurUniversity of Pennsylvania

2. Model Checker model yes temporal property error-trace Advantages Automated formal verification, Effective debugging tool Traditional: Finite-state systems (Boolean vars) Enumerative search with reduction heuristics: Spin, Murphi Symbolic search using BDDs: SMV, Cospan, VIS, Mocha Hybrid and Real-Time Systems Continuous variables make state-space infinite Timed automata: Decidability results, Efficient symbolic data structures

3. Talk Outline • Timed Automata: Syntax and Semantics • Specification Logic: Timed CTL • Decidability: Region-based partitioning • Efficient Implementation: Zones and DBMs UPPAAL (www.docs.uu.se/docs/rtmv/uppaal) Talk draft: Thanks to Kim Larsen and Paul Pettersson

4. UPPAAL

5. Timed AutomataIntelligent Light Control press? Off Light Bright press? Press? Press? WANT: if press is issued twice quickly then the light will get brighter; otherwise the light is turned off.

6. Timed AutomataIntelligent Light Control press? X<=3 Off Light Bright X:=0 press? Press? Press? X>3 Solution: Add real-valued clock x

7. Transitions a (n , x=2.4 , y=3.1415 ) (m , x=0 , y=3.1415 ) e(1.1) (n , x=2.4 , y=3.1415 ) (n , x=3.5 , y=4.2415 ) Timed Automata (Alur & Dill 1990) Clocks:x, y Guard Boolean combination of comparisons with integer bounds n Reset Action performed on clocks Action used for synchronization x<=5 & y>3 State (location , x=v , y=u ) where v,u are in R a x := 0 m

8. Timed Safety Automata Timed Automata + Invariants (Henzinger et al, 1992) n Clocks:x, y x<=5 Transitions x<=5 & y>3 e(3.2) Location Invariants (n , x=2.4 , y=3.1415 ) a e(1.1) (n , x=2.4 , y=3.1415 ) (n , x=3.5 , y=4.2415 ) x := 0 m y<=10 g4 g1 Invariants ensure progress!! g3 g2

9. Clock Constraints What can you express: Constant lower and upper bounds on delays Why the restricted syntax: slight generalizations (e.g. allowingx=2y) lead to undecidable model checking problems

10. Timed (Safety) Automata

11. Switch may be turned on whenever at least 2 time units has elapsed since last “turn off” Light automatically switches off after 9 time units. Light Switch push push click

12. Semantics • clock valuations: • state: • Semantics of timed automata is a labeledtransition systemwhere • action transition • delay Transition g a r l l’

13. Semantics: Example push push click

14. Larsen et al, 1996 Timed Automata in UPPAAL Communicating Timed Safety Automata+ urgent actions+ urgent locations (i.e. zero-delay locations)+ committed locations (i.e. zero-delay and atomic locations)+ data-variables (integers with bounded domains)+ arrays of data-variables+ guards and assignments over data-variables and arrays...

15. TCTL = CTL + Time Alur, Courcoubetis, Dill, 1991 constraints over formula clocks and automata clocks “freeze operator” introduces new formula clock z E[ f U f ], A[ f U f ] - like in CTL No EX f

16. Derived Operators = Along any path f holds continuously until within 7 time units y becomes valid. = The property f becomes valid within 5 time units.

17. TCTL Semantics s - location w - formula clock valuation PM(s) - set of paths from s Pos(s) - positions in s D(s,i) - elapsed time ¥ (i,d) <<(i’,d’) iff (i<j) or ((i=j) and (d<d’))

18. Timeliness Properties receive(m) occurs within 5 time units after send(m) receive(m) occurs exactly 11 time units after send(m) putbox occurs periodically (exactly) every 25 time units (note: other putbox’s may occur in between)

19. Fischer’s ProtocolA simple MUTEX Algorithm 2 • ´ V Criticial Section Init V=1 V:=1 V=1 A1 CS1 B1 V:=2 V=2 CS2 B2 A2

20. Fischer’s ProtocolA simple MUTEX Algorithm 2 • ´ V Criticial Section X<1 X:=0 X>1 Init V=1 V:=1 V=1 A1 CS1 B1 Y>1 Y<1 Y:=0 V:=2 V=2 CS2 B2 A2

21. Infinite State Space?

22. RegionsFinite partitioning of state space ”Desired equivalence” y 2 1 1 2 3 x

23. RegionsFinite partitioning of state space Definition y 2 1 1 2 3 x An equivalence class (i.e. a region) in fact there is only a finite number of regions!!

24. RegionsFinite partitioning of state space y 2 1 r {x}r {y}r Successor regions, Succ(r) 1 2 3 x Reset regions An equivalence class (i.e. a region)

25. Properties of Regions • The region equivalence relation @ is a time-abstract bisimulation: • Action transitions: If w @ v and (l,w) -a-> (l’,w’) for some w’, then $ v’ @ w’ s.t. (l,v) -a-> (l’,v’) • Delay transitions: If w @ v then for all real numbers d, there exists d’ s.t. w+d @ v+d’ • If w @ v then (l,w) and (l,v) satisfy the same TCTL formulas

26. Region graph of a simple timed automata

27. X<1 X:=0 X>1 V:=1 V=1 A1 CS1 B1 Y>1 Y<1 Y:=0 V:=2 V=2 CS2 B2 A2 Fischers again Untimed case Timed case Partial Region Graph A1,A2,v=1 A1,A2,v=1 x=y=0 A1,A2,v=1 0 <x=y <1 A1,A2,v=1 x=y=1 A1,A2,v=1 1 <x,y A1,B2,v=2 A1,B2,v=2 0 <x<1 y=0 A1,B2,v=2 0 <y < x<1 A1,B2,v=2 0 <y < x=1 y=0 A1,B2,v=2 0 <y<1 1 <x A1,CS2,v=2 A1,B2,v=2 1 <x,y A1,B2,v=2 y=1 1 <x B1,CS2,v=1 A1,CS2,v=2 1 <x,y CS1,CS2,v=1 No further behaviour possible!!

28. Roughly speaking.... Model checking a timed automata against a TCTL-formula amounts to model checking its region graph against a CTL-formula

29. Problem to be solved    Model Checking TCTL is PSPACE-complete

30. y y x x ZonesSymbolic computation Symbolic state (set) (n, ) State (n, x=3.2, y=2.5) Zone: conjunction of x-y<=n, x<=>n

31. Symbolic Transitions 1<=x<=4 1<=y<=3 1<=x, 1<=y -2<=x-y<=3 y y delays to n x x x>3 y y 3<x, 1<=y -2<=x-y<=3 conjuncts to a x x y:=0 3<x, y=0 projects to m Thus (n,1<=x<=4,1<=y<=3) =a => (m,3<x, y=0)

32. Forward Rechability Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Final Waiting Init Passed

33. Forward Rechability Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Final Waiting n,Z n,Z’ Init Passed

34. Forward Rechability Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U n,Z n,Z’ Init Passed

35. Forward Rechability Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U n,Z n,Z’ Init Passed

36. x x 1 2 1 2 Shortest Path Closure 3 Graph y 0 y 0 9 5 2 z 2 z x x 1 2 Shortest Path Closure 1 2 3 3 Graph y 0 y 0 5 2 7 2 z z Canonical Dastructures for ZonesDifference Bounded Matrices Bellman 1958, Dill 1989 When are two sets of constraints equivalent? x<=1 y-x<=2 z-y<=2 z<=9 D1 D2 x<=1 y-x<=2 y<=3 z-y<=2 z<=7

37. Difference Bounds Matrices • Matrix representation of constraints (bounds on a single clock or difference betn 2 clocks) • Reduced form obtained by running all-pairs shortest path algorithm • Reduced DBM is canonical • Operations such as reset, time-successor, inclusion, intersection are efficient • Popular choice in timed-automata-based tools

38. Summary • Applications of Uppaal and Kronos • Philips bounded retransmission protocol • Asynchronous circuits (STARI communication) • Timing analysis of Esterel+C code • Research theme 1: Efficient representation of Clock constraints + Boolean constraints • Research theme 2: Automatic abstractions of complex dynamics by timed automata