Trace Diagnostics using Temporal Implicants

Transcription

1 Trace Diagnostics using Temporal Implicants ATVA 15 Thomas Ferrère 1 Dejan Nickovic 2 Oded Maler 1 1 VERIMAG, University of Grenoble / CNRS 2 Austrian Institute of Technology October 14, 2015

2 Motivation Practical question: understand why a simulation / formal verification violates MTL / LTL property. Problem: long simulation / counter-example trace with large (product) alphabet. Solution: isolate segments of the trace sufficient to cause violation. Example Diagnostics of (p [1,2] q) violation on sample trace p q Implicant: p[1] t [2,3] q[t].

3 Outline Problem Formulation Dense-time Issues MTL Diagnostics

4 Outline Problem Formulation Dense-time Issues MTL Diagnostics

5 Diagnostics Problem (Diagnostics) Given specification ϕ and behavior w with w = ϕ, find small implicant θ of ϕ with w = θ. Applications Monitoring: find small subset of a finite variability, bounded counter-example of some MTL property. Model-checking: find small subset of an ultimately-periodic counter-example of some LTL property.

6 Implicants Propositional case Example ϕ = (p q) (p q) r, w = {p 1, q 1, r 0} Formula θ = p is a minimal diagnostic of ϕ relative to w. Semantically: any valuation that contains p 1 satisfies ϕ. Proposition For every ϕ, w such that w = ϕ there exists a minimal diagnostic: a prime implicant θ such that w = θ. Temporal case syntactic representation of implicants? infinite valuation domain: are there prime temporal implicants?

7 Temporal Logic Signals A function w : (T P) {0, 1} with T = [0, d] time domain and P finite set of propositions. Projection w p : T {0, 1} of signal w onto variable p, and also satisfaction signal w ϕ : T {0, 1} for any formula ϕ. Metric Temporal Logic syntax: semantics: ϕ := p ϕ ϕ 1 ϕ 1 I ϕ ϕ 1 U ϕ 2 (w, t) = I ϕ iff t t I, (w, t ) = ϕ (w, t) = ϕ U ψ iff t > t, (w, t ) = ψ and t < t < t, (w, t ) = ϕ derived operators: I ϕ I ϕ, models: w = ϕ iff (w, 0) = ϕ ϕrψ ( ϕ U ψ)

8 Partial signals and refinements Definition sub-signal: partial function from T P to {0, 1} refinement relation: sub-signals u v iff u 1 v 1 and u p [t] = v p [t] where u is defined. Proposition Relation defines a semi-lattice. Meet operation such that (u v) 1 u 1 v 1, and minimal element : {0, 1}.

9 Diagnostics (semantic reformulation) Definition Sub-signal u is sub-model of ϕ iff w = ϕ for all signals w v. Reformulation prime implicants of ϕ minimal sub-models of ϕ diagnostics of ϕ resp. w sub-model v of ϕ s.t. v w

10 Outline Problem Formulation Dense-time Issues MTL Diagnostics

11 Unbounded variability sub-models Example ϕ := (p q) has minimal sub-models I {p} 1, J {q} 1 for arbitrary I, J partition of T. w: p q v 1 : p v 2 : p q q v 3 : p q

12 No minimal sub-model Example ϕ = p U has sub-models (0, t) {p} 1 for arbitrary t > 0. w: p v 1 : p v 2 : p. v 3 : p

13 Temporal terms Syntax: θ := p[t] p[t] θ 1 θ 2 Θ[t] T subset of time domain, Θ function from time to terms. Semantics: w = Θ[t] t T, w = Θ[t] t T t T Example Temporal term t [0,1] p[t] represents sub-signal [0, 1] {p} 0.

14 Solving dense-time issues Bounded variability Definition normal form terms: m literals. i=1 t T i l i [t] with T i intervals and l i Bounded variability terms can be put in normal form. Minimality introduce non-standard reals t +, t for all t in the time domain with t < t < t + terms over the extended time domain.

15 Existence of prime implicants Theorem Any satisfiable property ϕ admits prime implicants. Proof. Zorn s Lemma: show that any chain of implicants θ 0 θ 1 θ 2... of ϕ has a maximum. Take θ i 0 θ i and show that θ ϕ. Given w = θ there exists n such that w = θ n. if not there exists l and (t i ) such that θ i l[t i ] and w l [t i ] = 0 Bolzano Weierstrass: we may assume (t i ) monotonic and converging to t for arbitrary δ > 0 there exists i such that ti is δ-close to t wl [t ] = 1 and by finite variability j, w l [t j ] = 1. Contradiction

16 Outline Problem Formulation Dense-time Issues MTL Diagnostics

17 MTL semantics (non-standard extension) Definition (w, t + ) = ϕ iff lim t t + w ϕ[t ] = 1 Arithmetic on non-standard reals t t iff t < t or t = t / R. t + I = closure t I in the non-standard reals. Proposition (w, t) = I ϕ iff t t + I, (w, t ) = ϕ (w, t) = ϕ U ψ iff t t, (w, t ) = ψ and t t t, (w, t ) = ϕ

18 Selection functions Used to select a witnesses of a formula. A function ξ labeled by a formula, such that ξ ϕ ψ [t] {ϕ, ψ}, ξ I ψ[t] t + I, and ξ ϕ U ψ [t] t. A correct selection function ξ when (w, t) = ϕ verifies disjunction: (w, t) = ξ[t] eventually: (w, ξ[t]) = ψ until: (w, ξ[t]) = ψ and t t ξ[t], (w, t ) = ϕ Bounded variability: ξ piecewise constant / linear with slope 1.

19 Generating implicants The diagnostics of a formula ϕ: { E(ϕ)[0] if (w, 0) = ϕ D(ϕ) = F (ϕ)[0] otherwise Dual explanation and falsification operators: E(p)[t] = p[t] F (p)[t] =... E( ϕ)[t] = F (ϕ)[t] F ( ϕ)[t] =... E(ϕ ψ)[t] = E(ξ ϕ ψ [t])[t] F (ϕ ψ)[t] = F (ϕ)[t] F (ψ)[t] E( I ϕ)[t] = E(ϕ)[ξ I ϕ[t]] F ( I ϕ)[t] = F (ϕ)[t ] t t+i E(ϕ U ψ)[t] = E(ψ)[ξ ϕ U ψ [t]]... F (ϕ U ψ)[t] = E(ϕ R ψ)[t]

20 Selection of eventually witnesses t + I ϕ s I ϕ Old cover t R T Algorithm pick the latest witness s of ϕ in t + I with t start of domain to cover witness accounts for I ϕ throughout s I remove s I from the domain to cover

21 Selection of until witnesses W (ϕ, ψ, t) s ϕ ψ ϕ U ψ Old cover t R T Algorithm pick the latest witness s of ψ such that ϕ holds throughout [t, s) with t start of domain to cover witness accounts for ϕ U ψ throughout [t, s) remove [t, s) from the domain to cover

22 Example solution Between 1 to 2 time units from now, always if p holds then q does not hold until r p q r (q U r) p ( (q U r)) (p (q U r)) [1,2] (p (q U r))

23 Results Correctness term D(ϕ) is solution to the diagnostics of ϕ and w; small implicant, not necessarily a prime implicant. Complexity Proposition The computation of D(ϕ) takes time in O( ϕ 2 w ). Minimal diagnostics: EXPSPACE-hard in ϕ + w.

24 Perspectives Advantages of minimal versus inductive diagnostic: minimal diagnostic localize fault in the execution inductive diagnostic localize fault in the specification Same technique applies to analysis of LTL model-checking counter-examples for ultimately-periodic signals Theory of implicants: possible extension from trace diagnostics to system diagnostics

25 Thank you.

26 Normalization of terms Inductive procedure yields normal form terms. Reductions: elimination of symbolic terms Example (explanation of disjunction) m n E(ξ[t])[t] E(ϕ)[t] E(ψ)[t] t T i=1 t T i i=1 t T i elimination of nesting Example (falsification of eventually) F (ϕ)[t ] F (ϕ)[t ] t T t t+i t T +I

27 MTL semantics Definition For signal w : (T P) {0, 1} and time t T: (w, t) = p w p [t] = 1 (w, t) = ϕ (w, t) = ϕ (w, t) = ϕ ψ (w, t) = ϕ 1 or (w, t) = ϕ 2 (w, t) = I ϕ t t I, (w, t ) = ϕ (w, t) = ϕ U ψ t > t, (w, t ) = ψ and t (t, t ), (w, t ) = ϕ Model of a formula w = ϕ if and only if (w, 0) = ϕ