Second Lecture: Basics of model-checking for finite and timed systems

Transcription

1 Second Lecture: Bsics of model-checking for finite nd timed systems Jen-Frnçois Rskin Université Lire de Bruxelles Belgium Artist2 Asin Summer School - Shnghi - July 28

2 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

3 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

4 Leled trnsition systems A leled trnsition system, LTS for short, is tuple (S,S,Σ,T,C,λ) where: S is (finite or infinite) set of sttes S S is the suset of initil sttes Σ is n event or ction set (finite or infinite) C is (finite or infinite) set of colors λ : S C is leling function tht lels ech stte with color.

5 A lelled trnsition system: c d c d c c

6 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

7 Rechility Rechility verifiction prolem Instnce: LTS (S,S,Σ,T,C,λ), set Gol S. Question: is there n execution of the LTS tht strts in S nd reches Gol? More formlly, is there sequence sσs1σ1s2σ2...σn-1sn such tht (1) s S, (2) i i<n T(si,σi,si+1), nd (3) sn Gol? The set of rechle sttes of LTS (S,S,Σ,T,C,λ) is the set of sttes s S such tht there is sequence sσs1σ1s2σ2...σn-1sn nd (1) s S, (2) i i<n T(si,σi,si+1), (3) sn=s. Let Rech(S) denote the set of rechle sttes. Clerly, there is pth tht strts in S nd reches G iff Rech(S) Gol.

8 S Rechility

9 Rechility Gol S

10 Rechility Gol Rech(S) S

11 Rechility Gol Rech(S) Negtive instnce S

12 Rechility Gol Rech(S) S

13 Rechility Gol Rech(S) S Positive instnce

14 Sfety Sfety verifiction prolem Instnce: LTS (S,S,Σ,T,C,λ), set of sttes Sfe S. Question: re ll pths tht strts in S stying within Sfe. More formlly, for ll sequences sσs1σ1s2σ2...σn-1sn such tht (1) s S, (2) i i<n T(si,σi,si+1), is it the cse tht (3) i i n si Sfe? Clerly ll pths tht strt in S re stying within Sfe iff Rech(S) (S\Sfe)=. So, the sfety nd rechility prolems re dul prolems.

15 S Sfety

16 Sfety Sfe Bd S

17 Sfety Sfe Bd Rech(S) S

18 Sfety Sfe Bd Rech(S) S Positive instnce

19 Sfety Sfe Bd Rech(S) S

20 Sfety Sfe Bd Rech(S) Negtive instnce S

21 Büchi condition Büchi verifiction prolem Instnce: LTS (S,S,Σ,T,C,λ), set Gol S. Question: is there one execution of the LTS tht strts in S nd psses infinitely often y the set Gol S? More formlly, is there n execution sσs1σ1s2σ2...σn-1sn... such tht (1) s S, (2) i i T(si,σi,si+1), (3) i j i such tht sj Gol?

22 Büchi condition Gol Init

23 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

24 Post, Pre nd Apre opertors We will design verifiction lgorithms for the rechility, sfety nd Büchi properties. Our lgorithms will mnipulte sets of sttes. Besides set opertions, we will need to compute the set of sttes tht re successors (Post), or predecessors (Pre nd Apre) of set of sttes.

25 The Post : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of successors of X y σ Post(X,σ)={ y X x X T(x,σ,y) }

26 The Post : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of successors of X y σ Post(X,σ)={ y X x X T(x,σ,y) } c c c

27 The Post : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of successors of X y σ Post(X,σ)={ y X x X T(x,σ,y) } Post(X,)= c c c

28 The Post : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of successors of X y σ Post(X,σ)={ y X x X T(x,σ,y) } Post(X,)= c c c

29 The Post : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of successors of X y σ Post(X,σ)={ y X x X T(x,σ,y) } Post(X,)=Y c c c

30 The Pre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of predecessors of X y σ Pre(X,σ)={ y S x X T(y,σ,x) }

31 The Pre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of predecessors of X y σ Pre(X,σ)={ y S x X T(y,σ,x) } c c c

32 The Pre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of predecessors of X y σ Pre(X,σ)={ y S x X T(y,σ,x) } Pre(X,)= c c c

33 The Pre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of predecessors of X y σ Pre(X,σ)={ y S x X T(y,σ,x) } Pre(X,)= c c c

34 The Pre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of predecessors of X y σ Pre(X,σ)={ y S x X T(y,σ,x) } Pre(X,)=Y c c c

35 The Apre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of sttes tht hve ll their successors y σ in X Apre(X,σ)={ x S y S T(x,σ,y) y X }

36 The Apre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of sttes tht hve ll their successors y σ in X Apre(X,σ)={ x S y S T(x,σ,y) y X } c c c

37 The Apre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of sttes tht hve ll their successors y σ in X Apre(X,σ)={ x S y S T(x,σ,y) y X } Apre(X,) c c c

38 The Apre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of sttes tht hve ll their successors y σ in X Apre(X,σ)={ x S y S T(x,σ,y) y X } Apre(X,) c c c

39 The Apre : 2 S Σ 2 S tkes (1) set of sttes X (2) n ction σ nd returns the set of sttes tht hve ll their successors y σ in X Apre(X,σ)={ x S y S T(x,σ,y) y X } Apre(X,)=Y c c c

40 PRE-POST-APRE From the Pre : 2 S Σ 2 S, the Post : 2 S Σ 2 S, nd the Apre : 2 S Σ 2 S, we cn define their generliztions over the entire lphet of ctions: The POST : 2 S 2 S tkes set of sttes X nd returns the set of sttes Y tht re rechle in one step from X, i.e. : POST(X)={ y S x X σ Σ T(x,σ,y) } The PRE : 2 S 2 S tkes set of sttes X nd returns the set of sttes Y tht cn rech X in one step, i.e. : PRE(X)={ y S x X σ Σ T(y,σ,x) } The APRE: 2 S 2 S tkes set of sttes X nd returns the set of sttes Y tht hve ll their one step successors in X, i.e. : APRE(X)={ y S x S σ Σ T(y,σ,x) x X } Exercise : proof tht APRE(X)=S\PRE(S\X).

41 POST(X)= c c c

42 POST(X)= c c c

43 POST(X)=Y c c c

44 PRE(X)= c c c

45 PRE(X)= c c c

46 PRE(X)=Y c c c

47 APRE(X)= c c c

48 APRE(X)= c c c

49 APRE(X)=Y c c c

50 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes? c d c d c c

51 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor! c d c d c c

52 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor! step c d c d c c

53 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor! or1 step c d c d c c

54 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2 steps c d c d c c

55 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2, 3 steps c d c d c c

56 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2, 3, 4 steps c d c d c c

57 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2, 3, 4, 5 steps c d c d c c

58 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2, 3, 4, 5, 6 steps c d c d c c

59 How cn we use the POST opertor to solve the following rechility question: Cn we rech the lue sttes from initil sttes?... By iterting the POST opertor!,1, 2, 3, 4, 5, 6, steps - we hve reched fixed point c d c d c c

60 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

61 Prtil orders Let S e set. A prtil order over S is reltion S S such tht the following properties hold: (i) reflexivity: s S: s s, (ii) trnsitivity: s1,s2,s3 S: s1 s2 s2 s3 s1 s3, (iii) ntisymmetry: s1,s2 S: s1 s2 s2 s1 s1=s2. A pir (S, ) such tht is prtil order over S is clled prtilly ordered set. Let T e set, we note P(T) for the set of susets of T. Exmple: if T={t1,t2,t3} then P(T)={{},{t1},{t2},{t3},{t1,t2},{t2,t3},{t1,t3},{t1,t2,t3}}. Clerly, for ny set T, (P(T), ) is prtilly ordered set.

62 Grphicl representtion of P(T) (P(T), ) is prtilly ordered set: is reflexive: {} {}, {t1} {t1},..., {t1,t2} {t1,t2},... is trnsitive: {t1} {t1,t2} {t1,t2} {t1,t2,t3} {t1} {t1,t2,t3} nd clerly, is ntisymmetric.

63 Lower nd upper ounds Let (S, ) e prtilly ordered set. Let s S nd S S, s is lower-ound of S iff s S s s. s is upper-ound of S iff s S s s. Let s e lower-ound for S, we sy tht s is the gretest loweround (gl) for S iff for ll lower-ound s for S, we hve s s. We note gl(s ) the gl of S it it exists. Let s e upper-ound for S, we sy tht s is the lest upper-ound (lu) for S iff for ll upper-ound s for S, we hve s s. We note lu(s ) the lu of S it it exists.

64 r1= r2= R= r3= r1 nd r2 re upper ounds of R. r2 is the lest upper ound of R. r3 is the only lower-ound of R nd so it is the gretest lower ound of R.

65 R= The lu of set of sets Ri is equl to i Ri ex: lu R = {t1,t2,t3} The gl of set of sets Ri is equl to i Ri ex: gl R = {t3}

66 A set of elements S S is chin iff s,s S s s s s i.e. ll pirs of elements re ordered y (incresing sequence of elements). R={{},{t1},{t1,t2}} is chin in P(T). R ={{},{t1,t3}} is chin in P(T). R = {{},{t1,t3},{t2,t3}} is not chin in P(T).

67 A prtilly ordered set (S, ) is complete prtil order if every chin in S hs lu in S. A complete prtil order (S, ) is complete lttice if every suset S of S hs lu in (S, ). Note tht gl S = lu{s S s S: s s }, so every suset S in complete lttice hs lso gl. Exmple: (P(T), ) is complete lttice. Indeed, rememer tht the lu of set of sets Ri is equl to i Ri nd the gl of set of sets Ri is equl to i Ri.

68 The mximl element of P(T), i.e. the lest upper-ound of P(T), noted Mx(P(T)). The miniml element of P(T), i.e. the gretest lower-ound of P(T), noted Min(P(T)). Min nd Mx elements in complete lttice

69 Let (S, ) e prtilly ordered set. A function f:s S is monotone (order preserving) iff s,s S s s f(s) f(s ). Let (S, ) e complete prtilly ordered set. A function f:s S is continuous iff f is monotone nd for ll non-empty chin S in S: f(lu(s ))=lu(f(s )). Remrk. In ny finite complete prtilly ordered set S, if f is monotone then f is continuous. s S is fixed point of f:s S if f(s)=s. The set of fixed points of f is noted Fx(f). Theorem (Trski) Any monotone function on complete lttice hs : (i) lest fixed point, lfp(f), equl to gl(fx(f)) (ii) gretest fixed point, gfp(f), equl to lu(fx(f))

70 Let us consider f s depicted y red rrows Clerly, f is monotone (nd so continuous). Fx(f)={{t1,t3},{t1,t2,t3}}. lfp(f)={t1,t3}=gl(fx(f)). gfp(f)={t1,t2,t3}=lu(fx(f)).

71 S lu(fx(f)) =gfp(f) Fx(f) gl(fx(f)) =lfp(f)

72 Let f i e defined inductively s - for i=: f =f - for ll i>: f i =f(f i-1 ). Theorem (Kleene-Trski) Let (S, ) e complete lttice, let f:s S e continuous: lfp(f)=gl { f i (Min(S)) i } nd gfp(f)=lu { f i (Mx(S)) i }. This gives us n itertive schem to compute the lfp(f) (gfp(f)) of continuous function f: iterte the function from the Min (Mx) of the set until stiliztion.

73 S Mx(S) lu(fx(f)) =gfp(f)... Fx(f)... gl(fx(f)) =lfp(f) Min(S)

74 Computtion of lfp(f) f ({})={t1,t2} f 1 ({})=f({t1,t2})={t1,t2}=lfp(f)

75 Computtion of gfp(f) R=f ({t1,t2,t3})={t1,t2,t3}=gfp(f)

76 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

77 Symolic model-checking The rechility, sfety, nd Büchi ojectives cn e solved using fixed point equtions. Solving those equtions will e done y itertion of functions uilt from the Pre, Apre or Post opertors on sets of sttes. Those lgorithms re clled symolic ecuse they mnipulte sets of sttes directly insted of mnipulting individul sttes s it is done in soclled explicit model-checking lgorithms.

78 Fixed points for rechility Let us consider n instnce of the rechility prolem given y the LTS L=(S,S,Σ,T,C,λ), nd set of sttes Gol S; Gol is rechle in the LTS iff lfp (λx. S POST(X)) Gol this is forwrd lgorithm iff lfp (λx. Gol PRE(X)) S this is ckwrd lgorithm

79 Rechility - Forwrd lgorithm lfp (λx. S POST(X)) Gol c d c d c c

80 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

81 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

82 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

83 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

84 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

85 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

86 Itertive evlution of lfp (λx. S POST(X)) c d c d c c

87 Itertive evlution of lfp (λx. S POST(X)) Fixed point! c d c d c c

88 Itertive evlution of lfp (λx. S POST(X)) Fixed point! It intersects Gol! Positive instnce. c d c d c c

89 Rechility - Bckwrd lgorithm lfp (λx. Gol PRE(X)) S c d c d c c

90 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

91 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

92 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

93 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

94 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

95 c d c d c c

96 Itertive evlution of lfp (λx. Gol PRE(X)) S c d c d c c

97 Itertive evlution of lfp (λx. Gol PRE(X)) S Fixed point! It intersects S! Positive instnce. c d c d c c

98 Sfety - Bckwrd lgorithm S gfp (λx. Sfe APRE(X)) c d c d c c

99 Itertive evlution of gfp (λx. Sfe APRE(X)) c d c d c c

100 Itertive evlution of gfp (λx. Sfe APRE(X)) c d c d c c

101 Itertive evlution of gfp (λx. Sfe APRE(X)) c d c d c c

102 Itertive evlution of gfp (λx. Sfe APRE(X)) Fixed point! Negtive instnce s S gfp (λx. Sfe APRE(X)). c d c d c c

103 Fixed points for Büchi ojectives Let consider n instnce of the Büchi verifiction prolem given y the LTS L=(S,S,Σ,T,C,λ), set of sttes Gol S; Gol is rechle infinitely often from n initil sttes in L iff gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) S this is ckwrd lgorithm

104 Fixed points for Büchi ojectives

105 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte

106 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 5

107 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} 5

108 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} lfp(λx. PRE(X) ( Gol PRE(Y))) = lfp(λx. PRE(X) ( Gol )) ={1,2,3}=Y1 5

109 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} lfp(λx. PRE(X) ( Gol PRE(Y))) = lfp(λx. PRE(X) ( Gol )) ={1,2,3}=Y1 5 Y1={1,2,3}

110 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} lfp(λx. PRE(X) ( Gol PRE(Y))) = lfp(λx. PRE(X) ( Gol )) ={1,2,3}=Y1 5 Y1={1,2,3} lfp(λx. PRE(X) ( Gol PRE(Y1))) = lfp(λx. PRE(X) ( Gol {1,2,3} )) ={1,2,3}=Y2=Y1

111 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} lfp(λx. PRE(X) ( Gol PRE(Y))) = lfp(λx. PRE(X) ( Gol )) ={1,2,3}=Y1 5 Y1={1,2,3} lfp(λx. PRE(X) ( Gol PRE(Y1))) = lfp(λx. PRE(X) ( Gol {1,2,3} )) ={1,2,3}=Y2=Y1 Fixed point!

112 Fixed points for Büchi ojectives 1 2 We wnt to check if {3} cn e reched infinitely often from the initil stte. For tht we evlute the fixed point expression gfp(λy. lfp(λx. PRE(X) ( Gol PRE(Y)))) 4 3 Y={1,2,3,4,5} lfp(λx. PRE(X) ( Gol PRE(Y))) = lfp(λx. PRE(X) ( Gol )) ={1,2,3}=Y1 5 Y1={1,2,3} lfp(λx. PRE(X) ( Gol PRE(Y1))) = lfp(λx. PRE(X) ( Gol {1,2,3} )) ={1,2,3}=Y2=Y1 Fixed point! As S Y2, the Büchi property is verified y the LTS L

113 Trce pre-orders, Trce equivlence, Simultions, Bisimultions nd quotients

114 Trces of LTS Let (S,S,Σ,T,C,λ) e LTS. Let sσs1σ1s2σ2...σn-1sn... e such tht (1) s S, (2) i i T(si,σi,si+1), the sequence λ(s)σ λ(s1)σ1λ(s2)σ2...σn-1λ(sn)... is clled trce of the LTS. Note tht two different pths in the LTS my generte the sme trce. The color of stte is ment to model the importnt properties of tht stte. So the notion of trce llows us to concentrte on the importnt properties of the system.

115 Trces of LTS We note Trces(L) the set of trces generted y the LTS L. Two LTS L1 nd L2 re trce equivlent if Trces(L1)=Trces(L2) Trce equivlence nd verifiction. If we hve two LTS L1 nd L2 such tht Trces(L1)=Trces(L2), nd L2 is (much) smller thn L1, it my e very dvntgeous to do verifiction on L2 insted on L1. As we will see L1 my e infinite while L2 is finite. We will illustrte tht with TA. Unfortuntely, minimizing system using the notion of trce equivlence is costly computtionlly. We will introduce now stronger notions of equivlence thn re esier to compute.

116 Simultion reltions

117 Simultion reltions Given LTS (S,S,Σ,T,C,λ), simultion reltion is reltion R S S such tht for ll (s1,s2) R : (1) s1 S iff s2 S (2) λ(s1)=λ(s2) (3) σ Σ s3 S: T(s1,σ,s3) s4 S T(s2,σ,s4) (s3,s4) R

118 Simultion reltions Given LTS (S,S,Σ,T,C,λ), simultion reltion is reltion R S S such tht for ll (s1,s2) R : (1) s1 S iff s2 S (2) λ(s1)=λ(s2) (3) σ Σ s3 S: T(s1,σ,s3) s4 S T(s2,σ,s4) (s3,s4) R When (s1,s2) R, we sy tht s1 is simulted y s2.

119 Simultion reltions

120 Simultion reltions Who cn simulte who?

121 Simultion reltions This is simultion reltion

122 Simultion reltions Is this the lrgest one?

123 Simultion reltions Is this the lrgest one? NO.

124 Simultion reltions nd isimultions

125 Simultion reltions nd isimultions Given LTS (S,S,Σ,T,C,λ), there exists unique lrgest simultion reltion R S S;

126 Simultion reltions nd isimultions Given LTS (S,S,Σ,T,C,λ), there exists unique lrgest simultion reltion R S S; A reltion R S S is symmetric iff for ll s1,s2 such tht R(s1,s2) we hve lso R(s2,s1);

127 Simultion reltions nd isimultions Given LTS (S,S,Σ,T,C,λ), there exists unique lrgest simultion reltion R S S; A reltion R S S is symmetric iff for ll s1,s2 such tht R(s1,s2) we hve lso R(s2,s1); A simultion reltion R which is symmetric is clled isimultion.

128 Simultion reltions nd isimultions Given LTS (S,S,Σ,T,C,λ), there exists unique lrgest simultion reltion R S S; A reltion R S S is symmetric iff for ll s1,s2 such tht R(s1,s2) we hve lso R(s2,s1); A simultion reltion R which is symmetric is clled isimultion. Given isimultion reltion R nd two sttes s1,s2 such tht R(s1,s2) (note tht we hve lso R(s2,s1) y definition), we sy tht s1 nd s2 re isimilr, this is noted s1 R s2 (or s1 s2 if R is cler from the context). The reltion R is n equivlence reltion.

129 Bisimultion

130 Bisimultion This is isimultion

131 Quotient of LTS using isimultion Let L=(S,S,Σ,T,C,λ) e LTS, R S S e isimultion reltion over the stte spce of L, nd let R e the ssocited equivlence reltion. The quotient y R of L is the LTS L =(S,S,Σ,T,C,λ ): S re the equivlence clsses for R ; S re the equivlence clsses s for R such tht for ll s s, s S ; T is such tht T (s1,σ,s2) iff s1 s1, s2 s2:t(s1,σ,s2) ; λ is such tht λ (s)=λ(s) for ny s s. Theorem: Let L e LTS nd R isimultion over the stte spce of L, let L e the quotient of L y R, then Trces(L)=Trces(L ).

132 Quotient of LTS using isimultion The LTS

133 Quotient of LTS using isimultion The LTS

134 Quotient of LTS using isimultion The LTS The quotient y

135 Quotient of LTS using isimultion The LTS The quotient y

136 Quotient of LTS using isimultion The LTS The quotient y

137 Quotient of LTS using isimultion The LTS The quotient y

138 Bisimultion is not complete for trce equivlence Clerly, the two initil sttes re trce equivlent ut they re not isimilr. The LTS

139 Pln of the tlk Lelled trnsition systems Properties of leled trnsition systems: Rechility - Sfety - Büchi properties Pre-Post opertors Prtil orders - Fixed points Symolic model-checking Appliction to TA: region equivlence, region utomt, zones

140 Algorithmic verifiction of timed utomt We will show now how to pply the concepts tht we hve introduced so fr to otin lgorithms to verify properties of timed utomt; We will show how to use the pre-post opertors to uild fixed points lgorithms; We will show tht those lgorithms re terminting y showing tht they operte over finite stte time-strct isimultion quotients.

141 A timed utomton Question: Cn L3 e reched?

142 A timed utomton Question: Cn L3 e reched? This question cn e reduced to rechility verifiction prolem over the leled trnsition system of the TA.

143 Leled trnsition system of TA The LTS=(S,S,Σ,T,C,λ) of TA A=(Q,Q,Σ,P,Cl,E,L,F,Inv), is s follows: - S is the set of pirs (q,v) where q Q is loction of A nd v : Cl R such tht v Inv(q); - S={(q,<,,...,>) q Q }; - T S x (Σ R ) x S defined y two types of trnsitions: Discrete trnsitions: (q1,v1) (q2,v2) T iff there exists (q1,,φ,δ,q2) E, v1 Φ, nd v2:=v1[δ:=]. Continuous trnsitions: (q1,v1) δ(q2,v2) T iff q1=q2, δ R, v2=v1+δ, nd δ, δ δ, v1+δ Inv(q1). - C=2 P, λ((q,v))=l(q), for ny (q,v) Q. Clerly, this trnsition system hs (continuous) infinite numer of sttes. How do we hndle it?

144 Time strct-leled trnsition system The LTS=(S,S,Σ,T,C,λ) of TA A=(Q,Q,Σ,P,Cl,E,L,F,Inv), is s follows: - S is the set of pirs (q,v) where q Q is loction of A nd v : Cl R such tht v Inv(q); - S={(q,<,,...,>) q Q }; - T S x (Σ {Dely}) x S defined y two types of trnsitions: Discrete trnsitions: (q1,v1) (q2,v2) T iff there exists (q1,,φ,δ,q2) E, v1 Φ, nd v2:=v1[δ:=]. Continuous trnsitions: (q1,v1) Dely(q2,v2) T iff q1=q2, δ R, v2=v1+δ, nd δ, δ δ, v1+δ Inv(q1). - C=2 P, λ((q,v))=l(q), for ny (q,v) Q. Clerly, this trnsition system hs (continuous) infinite numer of sttes. How do we hndle it?

145 Continuous stte spce y x

146 Continuous stte spce y 3 2 Are there vlutions of clocks tht ehves in similr wy? x

147 Continuous stte spce y 3 First, let us note tht clocks re compred to constnts (tht re nturl numers) x

148 Continuous stte spce y 3 First, let us note tht clocks re compred to constnts (tht re nturl numers). Mx. vlue over which y is compred x Mx. vlue over which x is compred

149 Continuous stte spce y 3 It is importnt to know if x or y rech the next nturl numer first. Mx. vlue over which y is compred x Mx. vlue over which x is compred

150 Continuous stte spce y This prtition is fine enough 3 Mx. vlue over which y is compred x Mx. vlue over which x is compred

151 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred ech tringle is region x Mx. vlue over which x is compred

152 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred ech segment is region x Mx. vlue over which x is compred

153 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred ech segment is region x Mx. vlue over which x is compred

154 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred ech segment is region x Mx. vlue over which x is compred

155 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred ech of those points is region x Mx. vlue over which x is compred

156 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred Time pssing x Mx. vlue over which x is compred

157 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred Time pssing x Mx. vlue over which x is compred

158 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred Reseting of y x Mx. vlue over which x is compred

159 Continuous stte spce y This prtition is fine enough Mx. vlue over which y is compred Reseting of y x Mx. vlue over which x is compred

160 Continuous stte spce This prtition is fine enough 2 discrete trnsition from L1 to L x 1 2 x L1 L2

161 Continuous stte spce This prtition is fine enough 2 discrete trnsition from L1 to L x 1 2 x L1 L2

162 Continuous stte spce This prtition is fine enough 2 discrete trnsition from L1 to L2 with reset of y x 1 2 x L1 L2

163 Continuous stte spce This prtition is fine enough 2 discrete trnsition from L1 to L2 with reset of y x 1 2 x L1 L2

164 Region equivlence: forml definition For ech vrile x Cl, let cx e the lrgest constnt with which x is compred in the TA. Two vlutions v1,v2:cl R re region equivlent, noted v1 v2 iff sme integer prts: for ll x Cl, int(v1(x))=int(v2(x)), or v1(x)>cx nd v2(x)>cx. sme frctionl ordering: for ll x,y Cl with v1(x) cx nd v1(y) cy, frc(v1(x)) frc(v1(y)) iff frc(v2(x)) frc(v2(y)) sme null frctionl prts: for ll x,y Cl with v1(x) cx nd v1(y) cy, frc(v1(x))= iff frc(v2(x))= Theorem: Region is set of vlutions tht re time strct isimilr.

165 Region equivlence quotient of the time-strct LTS The following theorem is the foundtion for the utomtic verifiction of timed utomt. Theorem. Let A e timed utomton, let L e its time-strct leled trnsition system, let L e its quotient y the region equivlence, then L is finite nd L is trce equivlent to L.

166 Post opertions in the time strct LTS To construct region sed isimultion quotient of the timestrct LTS of TA (or to compute on it), we must e le to compute the trnsition reltion etween regions. We consider the two types of trnsitions tht we find in the time-strct LTS of TA: Discrete trnsitions tht re ssocited to trnsition edges in the timed utomton. Let (q1,,φ,δ,q2) E: (1) Note tht given region r nd gurd Φ, ll vlutions v1,v2 r is such tht v1 Φ iff v2 Φ. (2) The effect of resetting clock on region r gives region r. Dely trnsitions. Given region r, we cn compute the set of regions r tht contins v+t for some v r nd some t R.

167 Continuous stte spce y The trnsitions of the time-strct trnsition system cn e rephrsed on the regions 3 Mx. vlue over which y is compred x Mx. vlue over which x is compred

168 Continuous stte spce y The trnsitions of the time-strct trnsition system cn e rephrsed on the regions Mx. vlue over which y is compred Reseting of y x Mx. vlue over which x is compred

169 Continuous stte spce y The trnsitions of the time-strct trnsition system cn e rephrsed on the regions Mx. vlue over which y is compred Reseting of y x Mx. vlue over which x is compred

170 Continuous stte spce y The trnsitions of the time-strct trnsition system cn e rephrsed on the regions Mx. vlue over which y is compred Time pssing x Mx. vlue over which x is compred

171 Continuous stte spce y The trnsitions of the time-strct trnsition system cn e rephrsed on the regions Mx. vlue over which y is compred Time pssing x Mx. vlue over which x is compred

172 TA nd the ckwrd pproch The region isimultion is stle lso for the opertions tht explore the stte spce in ckwrd fshion (Pre, Apre)... nd so, we cn lso use ckwrd lgorithms to verify TA.

173 On the use of the region equivlence to verify rechility properties of TA Forwrd rechility nlysis on simple exmple

174 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

175 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

176 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

177 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

178 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

179 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

180 Question: Cn L3 e reched? L L1 L2 y 2 1 y 2 1 y x 1 2 x 1 2 x

181 Question: Cn L3 e reched? L L1 L2 y y y x 1 2 x 1 2 x

182 Question: Cn L3 e reched? L L1 L2 y y y x 1 2 x 1 2 x Tking the trnsition from L1 to L2 does not dd ny new sttes, so we hve reched fixed point.

183 Zones The region equivlence gives rise to finite quotient nd gurnties tht our fixed point lgorithms re terminting. Nevertheless, the numer of region is exponentil in the numer of clocks s well s in the inry encoding of constnts. To mitigte this stte explosion phenomenon, we cn use efficient dt-structure to represent convex unions of regions. Zones re such dt-structure. Note tht the rechility prolem for timed utomt is complete for PSpce, so it is elieved tht the stte explosion is unvoidle in the worst cse.

184 Zones y x x 1 x 3 y 3 y 1 x-y -2 y-x 1

185 Zones Let C e finite set of clocks, zone is defined y set of constrints of the form: (1) x-y c where x,y C nd c Z. (2) x c where x C nd c Z. nd {,<,=,>, }. Zones re closed under the reseting opertion, the forwrd nd ckwrd time pssing opertions, nd intersection. Unfortuntely, zones re not closed under union nor complementtion. So implementtions need to mintin lists of zones. Zones cn e cnoniclly represented y DBM (=Difference Bound Mtrices).

186 Zones y x x 1 x 3 y 3 y 1 x-y -2 y-x 1

187 Zones y x Reseting of y: x 1 x 3 y=

188 Zones y x Conjunction with the gurd: x 2 y 3

189 Zones y x Conjunction with the gurd: x 2 y 3

190 Zones y x Conjunction with the gurd: x 2 y 3

191 Zones y x Conjunction with the gurd: x 2 y 3

192 Zones y x x 1 x 2 y 1 y 3 x-y -1

193 Decidility results for TA

194 Decidility results As direct consequence of our previous developments, we hve tht: The rechility verifiction prolem for TA w.r.t. set Gol which is defined s union of regions is decidle. The sfety verifiction prolem for TA w.r.t. set Sfe which is defined s union of regions is decidle. The Büchi verifiction prolem for TA w.r.t. set Gol which is defined s union of regions is decidle.

195 Decidility results As the rechility verifiction prolem for TA is decidle then the timed lnguge emptiness prolem (finite word cse) is decidle for TA. As the Büchi verifiction prolem for TA is decidle then the timed lnguge emptiness prolem (infinite word cse) is decidle for TA. Hint to estlish the result: construct set Gol tht ensures non-zenoness nd the Büchi cceptnce condition of the TA. Show tht this set is finite union of regions. As n intermediry step you will need generlized Büchi condition.

196 Undecidility results for TA

197 Undecidility results for TA The timed universlity prolem, i.e. does TA ccepts ll possile timed words on lphet, is undecidle. The lnguge inclusion prolem etween timed utomt is undecidle. (direct consequence of the previous undecidility result).