Formal verification of complex systems: model-based and data-driven methods. Alessandro Abate

Transcription

1 Formal verification of complex systems: model-based and data-driven methods Alessandro Abate Department of Computer Science, University of Oxford MEMOCODE - Sept 30, 2017 Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 1 /32

2 Automated formal verification: successes and frontiers automated, sound, formal Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 2 /32

3 Automated formal verification: successes and frontiers automated, sound, formal industrial impact in verification of protocols, hardware circuits, and software Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 2 /32

4 Automated formal verification: successes and frontiers automated, sound, formal industrial impact in verification of protocols, hardware circuits, and software asserts properties over given model of a system scalable and useful on unsophisticated models Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 2 /32

5 Automated formal verification: pushing the envelope 1 verification of physical systems (cyber-physical systems) bridging the gap between data and models principled integration of learning and verification 2 verification of complex models dynamical models with uncertainty, noise (for CPS) via formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 3 /32

6 Building automation systems: an exemplar of CPS cyber-physical systems: integration of physical/analogue with cyber/digital building automation systems as a CPS exemplar Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 4 /32

7 Building automation systems: an exemplar of CPS cyber-physical systems: integration of physical/analogue with cyber/digital building automation systems as a CPS exemplar smart energy initiatives at Oxford CS Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 4 /32

8 Building automation systems - a CPS exemplar Building automation system setup in rooms 478/9 at Oxford CS advanced modelling for smart buildings applications: certifiable energy management control of temperature, humidity, CO2 model-based predictive maintenance of devices fault-tolerant certified control demand-response over smart grids Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 5 /32

9 Building automation systems - a CPS exemplar Building automation system setup in rooms 478/9 at Oxford CS advanced modelling for smart buildings applications: certifiable energy management 1 control of temperature, humidity, CO 2 2 model-based predictive maintenance of devices 3 fault-tolerant certified control 4 demand-response over smart grids Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 5 /32

10 Building automation systems - a CPS exemplar Building automation system setup in rooms 478/9 at Oxford CS advanced modelling for smart buildings applications: certifiable energy management 1 control of temperature, humidity, CO 2 2 model-based predictive maintenance of devices 3 fault-tolerant certified control 4 demand-response over smart grids Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 5 /32

11 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full (F)/empty (E) 2 window: open (O)/closed (C) 3 air circulation: ON/OFF x k+1 = x k + V ( ) 1 ON mx k + µ {O,C} (C out x k ) + 1 F C occ (F,C) (E,C) (F,O) (E,O) x - zone CO 2 level - sampling time V - zone volume m - air inflow (when ON) µ O - air exchange with outside (when O) µ C - air leakage with outside (when C) C out - outside CO 2 level C occ - CO 2 by occupants (when F) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

12 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full (F)/empty (E) 2 window: open (O)/closed (C) 3 air circulation: ON/OFF x k+1 = x k + V ( ) 1 ON mx k + µ {O,C} (C out x k ) + 1 F C occ (F,C) (E,C) (F,O) (E,O) Parameter Value 15 min V 288 m 3 m 0.25 m 3 /min µ O m 3 /min µ C 0.01 m 3 /min C out 375 ppm 0.4 ppm/min C occ Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

13 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room empty E 2 window: closed C 3 air circulation: ON x k+1 = x k + V ( mx k + µ C (C out x k )) + 0 C occ (F,C) (F,O) CO 2 levels 1 Fan (on, off) (E,C) (E,O) Occupancy (occupied, empty) Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

14 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full F 2 window: closed C 3 air circulation: ON x k+1 = x k + V ( mx k + µ C (C out x k )) + C occ (F,C) (F,O) CO 2 levels 1 Fan (on, off) (E,C) (E,O) Occupancy (occupied, empty) Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

15 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full F 2 window: open O 3 air circulation: ON x k+1 = x k + V ( mx k + µ O (C out x k )) + C occ (F,C) (F,O) CO 2 levels 1 Fan (on, off) (E,C) (E,O) Occupancy (occupied, empty) Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

16 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room empty E 2 window: closed C 3 air circulation: ON x k+1 = x k + V ( mx k + µ O (C out x k )) (F,C) (F,O) CO 2 levels 1 Fan (on, off) (E,C) (E,O) Occupancy (occupied, empty) Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

17 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full (F)/empty (E) 2 window: open (O)/closed (C) 3 air circulation: ON model with hybrid dynamics (F,C) (F,O) CO 2 levels Fan (on, off) (E,C) (E,O) 1 Occupancy (occupied, empty) 1 Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

18 Building automation systems - problem setup model CO 2 dynamics, under the effect of 1 occupants: room full (F)/empty (E) 2 window: open (O)/closed (C) 3 air circulation: OFF model with hybrid dynamics 1,400 CO 2 levels 1 Fan (on, off) (F,C) (F,O) 1,200 1, (E,C) (E,O) 1 Occupancy (occupied, empty) 1 Windows (open, closed) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 6 /32

19 Outline 1 Verification of physical systems: Integration of learning and verification 2 Verification of complex models with formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 7 /32

20 Outline 1 Verification of physical systems: Integration of learning and verification 2 Verification of complex models with formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 7 /32

21 Learning and verification: state of art and objective noise noise data inputs system outputs data-driven analysis Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 8 /32

22 Learning and verification: state of art and objective noise noise data inputs system outputs model data-driven analysis model learning (with data), and model-based verification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 8 /32

23 Learning and verification: state of art and objective noise noise data inputs system outputs model disconnect between data-driven learning and model-based verification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 8 /32

24 Learning and verification: state of art and objective noise noise data inputs system outputs model disconnect between data-driven learning and model-based verification principled integration of learning and verification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 8 /32

25 Overview of method property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 9 /32

26 Parametric Markov chains property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 10 /32

27 Parametric Markov chains G = (Θ, S, T θ,, AP, L) S set of states T θ mapping S S [0, 1] expressed in terms of θ Θ Θ set of all possible valuations of θ, vector of parameters starting states θ θ 1 (F,C) 0.75 (F,O) 0.25 θ 2 θ 1 θ 2 θ 1 (E,C) (E,O) 1 θ 2 1 θ 2 Θ = [0, 0.25] [0, 1] Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 10 /32

28 Parametric Markov chains G = (Θ, S, T θ,, AP, L) S set of states T θ mapping S S [0, 1] expressed in terms of θ Θ Θ set of all possible valuations of θ, vector of parameters starting states L labelling function, mapping states into 2 AP, AP alphabet denote by M(θ) G a model parameterised by θ Θ Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 10 /32

29 property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 11 /32

30 property φ specified in PCTL, e.g. φ = P 0.99 ( 20 safe), φ = P >0.5 (safe U reach), safe, reach AP probabilistic model checking PCTL properties over Markov chains input: Markov chain (S, T), PCTL formula φ output: Sat(φ) = {z S : z = φ} tools: PRISM, STORM,... Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 11 /32

31 Parameter synthesis property φ specified in PCTL, e.g. φ = P 0.99 ( 20 safe), φ = P >0.5 (safe U reach), safe, reach AP classify models in Θ according to property of interest φ, that is synthesise parameters θ Θ s.t. M(θ) satisfies φ: Θ φ = {θ Θ : M(θ) = φ} Θ 1 set Θ φ 0 1 parameter set Θ Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 11 /32

32 property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 12 /32

33 Bayesian inference p(θ j D) = P(D θ j)p(θ j ) P(D) = s S T θ (s j, s ) Ds s j p(θ j ) P(D sj ) D overall data gathered (traces) D sj traces crossing state s j, where θ j = θ sj p(θ j ) prior distribution s S T θ (s j, s ) Ds s j likelihood, multinomial distribution at state s j Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 12 /32

34 Bayesian inference p(θ j D) = P(D θ j)p(θ j ) P(D) = s S T θ (s j, s ) Ds s j p(θ j ) P(D sj ) D overall data gathered (traces) D sj traces crossing state s j, where θ j = θ sj select as conjugate prior the Dirichlet distribution p(θ j ) = Dir(θ j α) θ α 1 1 j (1 θ j ) α 2 1 for pair (θ j, 1 θ j ), with α = (α 1, α 2 ) hyperparameters Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 12 /32

35 Bayesian inference p(θ j D) = P(D θ j)p(θ j ) P(D) = s S T θ (s j, s ) Ds s j p(θ j ) P(D sj ) D overall data gathered (traces) D sj traces crossing state s j, where θ j = θ sj under Dirichlet prior, posterior update is analytic p(θ j D) θ Ds 1 sj j (1 θ j ) D s 2 s j θ α 1 1 j (1 θ j ) α 2 1 and obtained updating hyperparameters of Dirichlet distribution, as p(θ j D) = Dir(θ j D sj + α) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 12 /32

36 property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 13 /32

37 Confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 13 /32

38 Confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 13 /32

39 Confidence computation compute confidence C on whether system S satisfies property φ as C = P(S = φ D) = p(θ D)dθ Θ φ x x x x x x x x x x x x x x x x x x x 0 1 Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 13 /32

40 Case study: setup goal: benchmark against statistical model checking (SMC) pmc model: θ θ 1 (F,C) 0.75 (F,O) 0.25 θ 2 θ 1 θ 2 θ 1 (E,C) (E,O) 1 θ 2 1 θ 2 specification: φ = P >0.3 ( 20 (E, O)) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 14 /32

41 Case study: setup goal: benchmark against statistical model checking (SMC) pmc model: θ θ 1 (F,C) 0.75 (F,O) θ 2 θ 1 θ 2 θ 1 θ (E,C) (E,O) θ1 1 θ 2 1 θ 2 specification: φ = P >0.3 ( 20 (E, O)) for selected pmc and property, synthesis yields Θ φ (yellow set) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 14 /32

42 Case study: experiments data: state trajectories of different length SMC this work attains confidence closer to true value than SMC extracts information from data more efficiently is more robust with limited data Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 14 /32

43 Parametric Markov decision processes G = (Θ, S, A, T θ,, AP, L) Θ, S,, L as before A set of actions T θ mapping S A S [0, 1] expressed in terms of θ Θ fon (F, C) 0.75 foff fon (F, O) foff ( θ1) θ1 ( θ1) θ1 θ2 (E, C) θ2 (E, O) 1 θ2 1 θ2 Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 15 /32

44 Dual role of actions in pmdp actions can be employed to shape set Θ φ shape set Θ φ actions can be chosen to affect confidence level C x x x x x x x x x x x x x x x x x x x 0 1 integral = confidence level Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 16 /32

45 Dual role of actions in pmdp actions can be employed to shape set Θ φ shape set Θ φ actions can be chosen to affect confidence level C x x x x x x x x x x x x x x x x x x x 0 1 integral = confidence level Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 16 /32

46 Dual role of actions in pmdp actions can be employed to shape set Θ φ shape set Θ φ actions can be chosen to affect confidence level C 0 1 integral confidence level Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 16 /32

47 Dual role of actions in pmdp actions can be employed to shape set Θ φ shape set Θ φ actions can be chosen to affect confidence level C 0 1 integral confidence level reminiscent of exploration/exploitation tradeoff in RL Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 16 /32

48 Overview of method property φ model pmc data from system S D parameter synthesis Θ φ p(θ D) Bayesian inference over parameters C = P(S = φ) confidence computation Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 17 /32

49 Overview of method property φ parameter synthesis model pmdp Θ φ strategy synthesis π generate data from system S p(θ D) D Bayesian inference over parameters C = P(S = φ) confidence computation p(θ D) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 17 /32

50 Strategy synthesis for experiment design design experiments to affect confidence calculation max {P(S = φ D), P(S = φ D)} Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 18 /32

51 Strategy synthesis for experiment design design experiments to affect confidence calculation max {P(S = φ D), P(S = φ D)} expected confidence gain at state-action (s, α) (and corresp. parameter) C s,α = Θ φ θ i θ p(θ i E s,α (D i ))dθ Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 18 /32

52 Strategy synthesis for experiment design design experiments to affect confidence calculation max {P(S = φ D), P(S = φ D)} expected confidence gain at state-action (s, α) (and corresp. parameter) C s,α = use C s,α as a reward for (s, α) Θ φ θ i θ p(θ i E s,α (D i ))dθ synthesise optimal strategy π for experiment design Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 18 /32

53 Case study: setup goal: compare optimally synthesised policies vs. random/deterministic ones pmdp model: fon 0.35 (F, C) 0.75 foff fon (F, O) foff ( θ1) θ1 ( θ1) θ1 θ2 (E, C) θ2 (E, O) 1 θ2 1 θ2 specification: φ = P >0.3 ( 20 (E, O)) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 19 /32

54 Case study: setup goal: compare optimally synthesised policies vs. random/deterministic ones pmdp model: fon (F, C) foff ( θ1 θ1) θ2 (E, C) fon (F, O) 0.75 foff ( θ1 θ1) θ2 (E, O) θ θ1 1 θ2 1 θ2 specification: φ = P >0.3 ( 20 (E, O)) for selected pmdp and given φ, Θ φ is shown in yellow Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 19 /32

55 Case study: experiments Confidence Confidence System Parameter System Parameter Synthesised strategy π Fully random strategy Confidence Confidence Number of Traces Number of Traces Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 19 /32

56 Case study: experiments Confidence Confidence System Parameter System Parameter Synthesised strategy π Deterministic strategy Confidence Confidence Number of Traces Number of Traces Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 19 /32

57 property φ parameter synthesis model plti Θ φ strategy synthesis π generate data from system S p(θ D) D Bayesian inference over parameters C = P(S = φ) confidence computation p(θ D) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 20 /32

58 Extensions to alternative model classes parametrised LTI model u(t) input y(t) system output ỹ(t) measured output e(t) measurement noise, e(t) N(0, σ 2 e ) model set G = {M(θ) θ Θ}, where M(θ) : { x(t + 1) = Ax(t) + Bu(t) y(t) = θ T x(t) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 20 /32

59 Outline 1 Verification of physical systems: Integration of learning and verification 2 Verification of complex models with formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 21 /32

60 Outline 1 Verification of physical systems: Integration of learning and verification 2 Verification of complex models with formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 21 /32

61 Building automation systems a complex model model CO 2 dynamics, coupled with temperature evolution x k+1 = x k + ( ) 1 V ON mx k + µ {O,C} (C out x k ) + 1 F C occ + σ x w k y k+1 = y k + ( ) 1 1 C ON m(t set y k ) + µ {O,C} R (T out y k ) + 1 F T occ,k + σ y w k where T occ,k = νx k + ζ x - zone CO 2 level y - zone temperature 0.15 (F,C) (F,O) T set - set temperature (air circulation) T out - outside temperature (window) T occ - generated heat (occupants) σ ( ) - variance of noise w k N(0, 1) (E,C) (E,O) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 22 /32

62 Building automation systems a complex model 600 CO 2 levels 22 Zone Temperature Occupancy (occupied, empty) 1 1 Windows (open, closed) Parameter Value C J/ o C 20 o C 24 o C ν ζ T set T out air circulation: ON Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 22 /32

63 Complex models: from finite to uncountable finite-space Markov chain uncountable-space Markov process (S, T) (S, T) S = (z 1, z 2, z 3, z 4 ) S = R 2 T = p 11 p 14 T(dx s) = e 1 2 (x m(s))t Σ 1 (s)(x m(s)) dx 2π Σ(s) 1/2 p 41 P(z 1, {z 2, z 3 }) = p 12 + p 13 P(s, A) = A T(dx s), A S (F,C) 0.75 (F,O) (E,C) (E,O) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 23 /32

64 Probabilistic model checking of complex models recall PCTL formulae simplest instance: probabilistic safety is the probability that the execution, started at s, stays in safe set A during the time horizon [0, N] P s (A) = P s (s k A, k [0, N]) select p [0, 1]; probabilistic safe set with safety level p is S(p) = {s S : P s (A) p} Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 24 /32

65 Probabilistic model checking of complex models recall PCTL formulae simplest instance: probabilistic safety is the probability that the execution, started at s, stays in safe set A during the time horizon [0, N] P s (A) = P s (s k A, k [0, N]) select p [0, 1]; probabilistic safe set with safety level p is S(p) = {s S : P s (A) p} issues with computation of P s (A) and of S(p) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 24 /32

66 Formal abstractions complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

67 Formal abstractions ξ-quantitative abstraction complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

68 Formal abstractions abstract model ξ-specification ξ-quantitative abstraction complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

69 Formal abstractions abstract model ξ-specification automatic verification ξ-quantitative abstraction complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

70 Formal abstractions abstract model ξ-specification model checking automatic verification ξ-quantitative abstraction complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

71 Formal abstractions model checking abstract model ξ-specification automatic verification ξ-spec holds, or ξ-spec does not hold ξ-quantitative abstraction complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

72 Formal abstractions model checking abstract model ξ-specification automatic verification ξ-spec holds, or ξ-spec does not hold ξ-quantitative abstraction refine back complex model specification Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

73 Formal abstractions model checking abstract model ξ-specification automatic verification ξ-spec holds, or ξ-spec does not hold ξ-quantitative abstraction refine back complex model specification spec holds, or spec does not hold Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

74 Formal abstractions model checking abstract model ξ-specification automatic verification ξ-spec holds, or ξ-spec does not hold ξ-quantitative abstraction refine back complex model specification if not, tune ξ spec holds, or spec does not hold Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 25 /32

75 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states T : S S [0, 1] transition probability matrix Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

76 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states T : S S [0, 1] transition probability matrix algorithm: input: stochastic process (S, T) output: MC (S, T) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

77 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states T : S S [0, 1] transition probability matrix algorithm: input: stochastic process (S, T) 1 select finite partition S = p i=1 S i output: MC (S, T) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

78 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states T : S S [0, 1] transition probability matrix algorithm: input: stochastic process (S, T) 1 select finite partition S = p i=1 S i 2 select representative points z i S i 3 define finite state space S := {z i, i = 1,..., p} output: MC (S, T) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

79 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states T : S S [0, 1] transition probability matrix algorithm: input: stochastic process (S, T) 1 select finite partition S = p i=1 S i 2 select representative points z i S i 3 define finite state space S := {z i, i = 1,..., p} 4 compute transition probability matrix: T(z i, z j ) = T(S j z i ) output: MC (S, T) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

80 Formal abstractions: algorithm approximate stochastic process (S, T) as MC (S, T), where S = {z 1, z 2,..., z p } finite set of abstract states algorithm: T : S S [0, 1] transition probability matrix input: stochastic process (S, T) 1 select finite partition S = p i=1 S i 2 select representative points z i S i 3 define finite state space S := {z i, i = 1,..., p} 4 compute transition probability matrix: T(z i, z j ) = T(S j z i ) output: MC (S, T) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 26 /32

81 Model checking probabilistic safety via formal abstractions safety set A S, time horizon N, safety level p Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 27 /32

82 Model checking probabilistic safety via formal abstractions safety set A S, time horizon N, safety level p δ-abstract (S, T) as MC (S, T), so that A A δ, quantify error ξ(δ, N) probabilistic safe set S(p) = {s S : P s (A) p} = {s S : (1 P s (A)) 1 p} Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 27 /32

83 Model checking probabilistic safety via formal abstractions safety set A S, time horizon N, safety level p δ-abstract (S, T) as MC (S, T), so that A A δ, quantify error ξ(δ, N) probabilistic safe set S(p) = {s S : P s (A) p} = {s S : (1 P s (A)) 1 p} can be computed via Z δ (p+ξ) =. )) Sat (P 1 p ξ (true U N A δ )} = {z S : z = P 1 p ξ (true U N A δ Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 27 /32

84 Formal abstractions: error ξ consider T(d s s) = t( s s)d s; assume t is Lipschitz continuous, namely 0 h s < : t( s s) t( s s ) h s s s, s, s, s S Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 28 /32

85 Formal abstractions: error ξ consider T(d s s) = t( s s)d s; assume t is Lipschitz continuous, namely 0 h s < : t( s s) t( s s ) h s s s, s, s, s S one-step error (related to approximate probabilistic bisimulation) ɛ = h s δl (A) δ max diameter of partition sets L (A) volume of set of interest N-step error (tuneable via δ) ξ(δ, N) = ɛn Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 28 /32

86 Formal abstractions: error ξ consider T(d s s) = t( s s)d s; assume t is Lipschitz continuous, namely 0 h s < : t( s s) t( s s ) h s s s, s, s, s S one-step error (related to approximate probabilistic bisimulation) ɛ = h s δl (A) δ max diameter of partition sets L (A) volume of set of interest N-step error (tuneable via δ) ξ(δ, N) = ɛn improved and generalised error Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 28 /32

87 FAUST 2 : software for formal abstractions Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

88 FAUST 2 : software for formal abstractions sequential, adaptive, anytime Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

89 FAUST 2 : software for formal abstractions sequential, adaptive, anytime Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

90 FAUST 2 : software for formal abstractions sequential, adaptive, anytime Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

91 FAUST 2 : software for formal abstractions sequential, adaptive, anytime Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

92 FAUST 2 : software for formal abstractions sequential, adaptive, anytime Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 29 /32

93 Building automation systems case study x k+1 = x k + ( ) 1 V ON mx k + µ {O,C} (C out x k ) + 1 F C occ + σ x w k y k+1 = y k + ( ) 1 1 C ON m(t set y k ) + µ {O,C} R (T out y k ) + 1 F T occ,k + σ y w k where T occ,k = νx k + ζ (F,C) (F,O) (E,C) (E,O) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 30 /32

94 Building automation systems case study safe set A = [ ]ppm [19 21] o C air circulation: closed-loop control policy at k + 1 OFF if (x k, y k ) A ON if (x k, y k ) A stay put else specification: ] P =? [ 20 (x, y) A 5 hours, 8:00-13:00 ( = 15 min, N=20), divided into 8:00-8:30 (N=2) - (E,C) 8:30-11:30 (N=12) - (F,C) 11:30-13:00 (N=6) - (F,O) (F,C) (E,C) (F,O) (E,O) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 30 /32

95 Building automation systems case study Probability N=20, σ = CO 2 level (ppm) Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 30 /32

96 Take away message verification of physical systems: Integration of learning and verification models properties data verification of complex models with formal abstractions abstract model ξ-specification ξ-quantitative abstraction model checking automatic verification ξ-spec holds, or ξ-spec does not hold refine back complex model specification if not, tune ξ spec holds, or spec does not hold Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 31 /32

97 Acknowledgments My students: V. Wijesurija, N. Cauchi, E. Polgreen, A. Peruffo, K. Lesser, M. Zamani, S. Haesaert, I. Tkachev, D. Adzkiya, S. Soudjani and collaborators Selected journal references E. Polgreen, V. Wijesuriya, S. Haesaert and A. Abate, Automated Experiment Design for Efficient Verification of Parametric Markov Decision Processes, QEST17, E. Polgreen, V. Wijesuriya, S. Haesert and A. Abate, Data-efficient Bayesian verification of parametric Markov chains, QEST16, LNCS 9826, pp , S. Haesaert, S.E.Z. Soudjani, and A. Abate, Verification of general Markov decision processes by approximate similarity relations and policy refinement, SIAM Journal on Control and Optimisation, vol. 55, nr. 4, pp , I. Tkachev, A. Mereacre, J.-P. Katoen, and A. Abate, Quantitative Model Checking of Controlled Discrete-Time Markov Processes, Information and Computation, vol. 253, nr. 1, pp. 1 35, S. Haesaert, at al., P.M.J. V.d. Hof, and A. Abate, Data-driven and Model-based Verification via Bayesian Identification and Reachability Analysis, Automatica, vol. 79, pp , S.E.Z. Soudjani and A. Abate, Aggregation and Control of Populations of Thermostatically Controlled Loads by Formal Abstractions, IEEE Transactions on Control Systems Technology. vol. 23, nr. 3, pp , S.E.Z. Soudjani and A. Abate, Quantitative Approximation of the Probability Distribution of a Markov Process by Formal Abstractions, Logical Methods in Computer Science, Vol. 11, nr. 3, Oct M. Zamani, P. Mohajerin Esfahani, R. Majumdar, A. Abate, and J. Lygeros, Symbolic control of stochastic systems via approximately bisimilar finite abstractions, IEEE Transactions on Automatic Control, vol. 59 nr. 12, pp , Dec I. Tkachev and A. Abate, Characterization and computation of infinite horizon specifications over Markov processes, Theoretical Computer Science, vol. 515, pp. 1-18, S. Soudjani and A. Abate, Adaptive and Sequential Gridding for Abstraction and Verification of Stochastic Processes, SIAM Journal on Applied Dynamical Systems, vol. 12, nr. 2, pp , A. Abate, et al., Approximate Model Checking of Stochastic Hybrid Systems, European Journal of Control, 16(6), , A. Abate, et al., Probabilistic Reachability and Safety Analysis of Controlled Discrete-Time Stochastic Hybrid Systems, Automatica, 44(11), , Nov Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 32 /32

98 Thank you for your attention For more info: Alessandro Abate, CS, Oxford Model-based and data-driven verification slide 32 /32