Stochastic, Hybrid and Real-Time Systems: From Foundations To Applications with Modest

Transcription

1 LCCC WORKSHOP 2013, LUND Stochastic, Hybrid and Real-Time Systems: From Foundations To Applications with Modest, Arnd Hartmanns Saarland University, Germany based on joint work with Jonathan Bogdoll, Henrik Bohnenkamp, Pedro R. D Argenio, Alexandre David, Ernst Moritz Hahn, and Joost-Pieter Katoen

2 Systems, Models and Requirements All models are wrong, but some models are useful. Model model checking Requirements (George E. P. Box) System under study / implementation / p correctness safety ft performance costs (slide inspired by Jan Tretmans, Embedded Systems Institute, Eindhoven)

3 Systems, Models and Requirements All models are wrong, but some models are useful. (George E. P. Box) What are useful models? Wireless Sensor Networks: concurrency message loss transmission dl delays randomised algorithms limited battery ypower

4 Systems, Models and Requirements All models are wrong, but some models are useful. (George E. P. Box) What are useful models? ETCS Level 3: measurement errors concurrency continuous dynamics transmission delays message loss

5 Systems, Models and Requirements Quantitative models are useful. 1% probability of message loss 20 mw needed in send mode Expected time for transmission 8s? Fraction of time in send mode 02? 0.2 Prob(crash within15 years) 10-5?

6 Systems, Models and Requirements Quantitative models are useful. Quantities in models time probabilities costs continuous dynamics Quantities in requirements/properties? Quantified safety Prob(crash within 15 years) 10-5? Performance Expected time for transmission 8 s? Dependability, Performability, Survivability, + qualitative ti requirements in a quantitative setting

7 Modelling and Verification The automata-based approach next get_ repor data rep ort_ fail suc cess while(true) n = 2 n = 0 next: get_data(buf); snd_ n = 2; data time while(n>0) e = snd_data(buf); n=2 n=1 n=1 if(e == SUCCESS) report_success(); goto next; if(e == TIMEOUT) n = n - 1; report_failure(); tim meout snd d_data a

8 Modelling and Verification The automata-based approach Properties of interest Absence of deadlocks Safety Liveness LTL or CTL formulas e.g. success A E next get_ repor data rep ort_ fail suc cess n = 2 n = 0 snd_ data n=2 n=1 n=1 tim meout snd d_data time

9 Quantitative Models A quantitative i automata family Labelled Transition Systems nondeterminism snd τ LTS

10 Quantitative Models A quantitative i automata family Labelled Transition Systems Discrete-Time Markov Chains LTS nondeterminism DTMC discrete probabilities

11 Quantitative Models A quantitative i automata family Labelled Transition Systems Discrete-Time Markov Chains Markov Decision ii Processes Probabilistic Timed Automata PA/MDP snd τ rcv LTS nondeterminism DTMC discrete probabilities

12 Quantitative Models A quantitative i automata family Labelled Transition Systems Discrete-Time Markov Chains Markov Decision ii Processes Probabilistic Timed Automata / TA PA/MDP time/ TA clocks LTS nondeterminism DTMC discrete probabilities

13 Quantitative Models continuous d A quantitative i automata family SHA dynamics Labelled Transition Systems Discrete-Time Markov Chains Markov Decision ii Processes Probabilistic Timed Automata Stochastic Timed / Hybrid Automata time/ clocks TA STA arbitrary distributions PTA PA/MDP LTS nondeterminism DTMC discrete probabilities

14 A Stochastic Hybrid Automaton (Network)

15 Quantitative Models continuous d A quantitative i automata family SHA dynamics Nondeterminism structural or temporal Probabilistic choices discrete or continuous over next state or delay Time discrete or continuous nondeterministic or random delays time/ TA clocks LTS nondeterminism STA arbitrary distributions PTA PA/MDP DTMC discrete probabilities

16 Quantitative Models Automata modelling formalisms SHA and model checking tools Modest STA The Modest Toolset PTA Guarded commands PRISM, PASS, UPPAAL TA UPPAAL TA PA/MDP Promela etc SPIN etc LTS DTMC

17 Models for Simulation Modest: A Modelling and Description i Language for Stochastic Timed Systems Language features: bool, int, arrays Variables and assignments Processes and recursion Clocks Exception handling Deadlines & invariants Random variable sampling Bohnenkamp, D Argenio, Hermanns, Katoen:nn MoDeST: A Compositional Modeling Formalismn for Hard and Softly Timed Systems (IEEE TSE 2006) Rewards/costs Probabilistic bili branching

18 Example: Lossy channel with transmission delay process Channel() { clock c; snd? palt { : 2: {==} // msg lost :98: {= c = 0, x = Uni(0, TD) =}; invariant(c <= x) when(c >= x) rcv! }; Channel() } snd? rcv!

19 Modest the language high-level language focus on readability, expressivity and conciseness process Sender() { bool bit; int(0..max) rc; new_file {= i =0, rc = 0 =}; try { do { :: when(i < N) {= i = i + 1 =}; do { :: put_k {= ff =(i == 1), lf =(i == N), ab = bit =} alt { :: get_l {= bit =!bit, rc = 0 =}; break :: when(rc == MAX && i < N) s_nok {= rc = 0 =}; throw(error)...

20 The Modest Toolset semantics mctau mcpta prohver modes mime mosta four analysis tools GUI

21 The Modest Toolset mctau mcpta prohver modes mime mosta mctau Model-checking for TA using UPPAAL Export from Modest to UPPAAL with layout Overapproximation of probabilistic choices Bogdoll, David, H., H.: mctau: Bridgingn the Gap between Modest and UPPAAL (SPIN 2012)

22 The Modest Toolset mctau mcpta prohver modes mime mosta mctau mcpta Model-checking for TA using UPPAAL Export from Modest to UPPAAL with layout Overapproximation of probabilistic choices Model-checking for PTA using PRISM Export from Modest to Guarded Commands H., H.: A Modest Approach ton Checking Probabilistic Timed Automata (QEST 2009)

23 The Modest Toolset mctau mcpta prohver modes mime mosta mctau mcpta modes Model-checking for TA using UPPAAL Export from Modest to UPPAAL with layout Overapproximation of probabilistic choices Model-checking for PTA using PRISM Export from Modest to Guarded Commands Simulation & Statistical Model Checking for STA with spurious nondeterminism Bogdoll, Ferrer Fioriti, H., H.:nn Partial Order Methods for Statistical Modeln dl Checking and Simulation (FMOODS/FORTE 2011)

24 The Modest Toolset mctau mcpta prohver modes mime mosta mctau mcpta Model-checking for TA using UPPAAL Export from Modest to UPPAAL with layout Overapproximation of probabilistic choices Model-checking for PTA using PRISM Export from Modest to Guarded Commands modes Simulation & Statistical Model Checking for STA with spurious nondeterminism prohver Safety Verification for SHA Using (modified) HA Solver Phaver Hahn, H., H., Katoen: A Compositional Modelling and Analysis Framework For Stochastic Hybrid Systems (FMSD 13)

25 The Modest Toolset Modest mime PRISM Guarded Commands UPPAAL.xml Networks of Stochastic Hybrid Automata SHA STA PTA MDPs prohver modes mcpta mctau modified PHAVer Results PRISM 4.0 UPPAAL 4.1

26 prohver Safety verification process for SHA in prohver SHA Ch overapproximation of continuous distributions PHA decomposition HA + probs PHAVer LTS reconstruction MDP value iteration Results

27 Case Study - ETCS level 3 SHA model : two trains leader and follower andcomm+rbc Continuous aspects acceleration, deceleration, speed acceleration of leader nondeterministic (within train limits) Stochastic aspects position measurements scattered with normal distribution message loss probability during communication

28 Case Study - ETCS level

29 Case Study - ETCS level 3

30 Case Study - Power Grid Control Strategies All over Germany, masses of photovoltaic microgenerators are rolled out: 2009: 10 GW 2011: 25 GW 2020:?? GW Current state t of control: EN 50438:2007, in force since 2007: Switch off when frequency > 50.2Hz VDE-AR-N 4105, required today: Output linear function of frequency in [50.2, 51.5]Hz 5] Emergency switchoff above 51.5 Hz Switch on again when < 50.05Hz for 1 minute

31 Stability of Grids and Controllers Simulation i of synthetic background load scenarios

32 Availability vs. Goodput 0.08 Goodput Availability 1 On-off Frequency + Backoff AIMD 64

33 Fairness of Controllers Max/min/average / output per generator:

34 Modest Applications channel K Sender Receiver Communication protocols channel L Wireless sensor networks Dependability evaluation Industrial production scheduling Renewable electric power generation

35 Modest - Summary continuous d Modest and SHA language and model SHA dynamics for quantitative i systems with quantitative requirements STA arbitrary {= x = Uni(0, 3) =} E max [ time to finish] PTA var v, a; invariant(der(v) == a) par { :: Sender() :: P() } invariant(c <= TD_MAX) distributions d lt { time/ TA PA/MDP snd palt { :99: rcv : 1: tau } single-formalism, multiple-solution l l approach clocks LTS nondeterminism DTMC discrete probabilities

36 The Modest Toolset - Summary modelling language: Modest + PRISM guarded commands + UPPAAL xml prohver for SHA - using Phaver mcpta for PTA/MDP - using PRISM mctau for TA - using UPPAAL modes for simulation despite nondeterminsm Demo at demo session on Friday! Installation assistance anytime!

37