A Timed CTL Model Checker for Real-Time Maude

A Timed CTL Model Checker for Real-Time Maude Daniela Lepri 1, Erika Ábrahám 2, and Peter Csaba Ölveczky 1 1 University of Oslo and 2 RWTH Aachen

Real-Time Maude Extends Maude to real-time systems Object-oriented modeling of distributed real-time systems Expressiveness and generality properties in general undecidable!

Real-Time Maude (II) Static parts: algebraic equational specification Instantaneous change: rewrite rules crl [l] : t => t if cond. Time elapse modeled by tick rewrite rules crl [tick] : {t} => {t } in time τ if cond. Formal analysis: simulation time-bounded reachability analysis explicit-state untimed LTL model checking

Some Real-Time Maude Applications (I) Large and complex distributed real-time systems 50-page active networks multicast protocol IETF multicast protocol wireless sensor network algorithms scheduling algorithms avionics systems airplane turning algorithms cloud data stores (Megastore,...)... Formalizing complexity-reducing patterns (Multirate) PALS safe operation of medical devices

Some Real-Time Maude Applications (II) Semantic framework and formal analysis tool for modeling languages AADL avionics modeling standard Synchronous AADL Ptolemy II DE models DoCoMo Labs handset programming language Real-Time MOMENT-2 Eclipse model transformation framework e-motions visual model transformations Timed Rebeca actor language Timed Creol Orc... Intuitive domain-specific modeling + automated formal analysis

Ptolemy II Example: Fault-Tolerant Traffic Light System HierarchicalTrafficLight Decision TrafficLight TrafficLight Normal Error

Integration into Ptolemy II

RTM Verification of Synchronous AADL in OSATE

Dealing with Dense Time var T : Time. crl [tick] : {t} => {timeeffect(t, T)} in time T if T <= mte(t).

Dealing with Dense Time var T : Time. crl [tick] : {t} => {timeeffect(t, T)} in time T if T <= mte(t). can visit all dense time values not executable Real-Time Maude approach: time sampling strategies advance time by value fixed advance time maximally

Timed Temporal Logic So far: untimed LTL model checking the airbag must eventually deploy after crash detected the ventilator machine must eventually be turned on after having been turned off BO eventually closes G Timed temporal logics the airbag must deploy within 10ms after crash the ventilator machine cannot be continuously stopped for more than 3 seconds BO closes G within one year after inauguration

Timed CTL TCTL: temporal operators with time intervals: φ U [r1,r 2 ] φ (crash = 10ms airbagdeployed) ((inauguration(bo) open(g)) = one year closed(g)) (ventoff = 3sec ( 10min venton))

Two Main Issues (I): Intended Semantics Intended semantics? {f (X )} {f (X + Y )} in time Y if Y 3 X does F [1,2] True hold from {f (0)}?

Two Main Issues (I): Intended Semantics Intended semantics? {f (X )} {f (X + Y )} in time Y if Y 3 X does F [1,2] True hold from {f (0)}? Pointwise semantics - only visited states into account - F [1,2] True does not hold from {f (0)} Continuous semantics - tick rule interpreted as representing continuous process - F [1,2] True holds from {f (0)}

Two Main Issues (II): Soundness and Completeness Soundness/completeness for untimed TL properties do not hold for timed CTL! Maximal time sampling analysis does not satisfy F [1,2] True Dense time: γ is the gcd of non-zero time values in TCTL formula non-zero maximal tick amounts Continuous semantics: advance time by γ/2 in each tick step Pointwise semantics: advance time by any multiple of γ/2 Soundness and completeness for time-robust systems: R, L P, t = c ϕ R gcd(t 0,r,ϕ)/2, L P, t = p ϕ,

Real-Time Maude s TCTL Model Checker Explicit-state TCTL model checker (mc-tctl t = ϕ.) (mc-tctl-gcd t = ϕ.)

Real-Time Maude s TCTL Model Checker Explicit-state TCTL model checker (mc-tctl t = ϕ.) (mc-tctl-gcd t = ϕ.) Implemented in Maude Adapts explicit-state CTL model checking algorithm by Laroussinie, Markey, and Schnoebelen No counterexample provided!

Example: Hierarchical Traffic Light System in Ptolemy II Only yellow light will show within one time unit of failure: Maude> (mc-tctl {init} = AG (( HierarchicalTrafficLight. Decision (port Error is present)) implies AF[<= than 1] ( HierarchicalTrafficLight ( Cyel = # 1, Cgrn = # 0, Cred = # 0)))).)

Example (cont.)

Benchmarking: Crossing the Bridge

Crossing the Bridge Initial state and property eq init(n) = person(5 * N,false) person(20 * N,false) lamp(false). person(10 * N,false) person(25 * N,false) op safe : -> Prop. eq {person(t:time, false) S:System} = safe = false. eq {S:System} = safe = true [owise]. Model checking: Maude> (mc-tctl {init(1)} = AG EF[<= than 85] safe.)

Benchmarking Initial state TSMV Real-Time Maude RED 7.0 (pointwise) (continuous) init(1) 0.074 0.149 1.266 0.429 init(10) 0.148 0.168 0.999 0.408 init(100) 1.443 0.168 1.012 0.404 init(1000) 57.426 0.327 1.014 0.426 init+(2) 0.191 0.746 6.864 1.044 init+(4) 0.280 1.772 17.752 2.153 init+(8) 0.759 5.227 57.580 16.912 init+(12) 1.080 11.198 129.957 79.319 init+(16) 1.515 19.620 233.414 241.098 Table: Execution times (in seconds).

Concluding Remarks Timed CTL model checking for Real-Time Maude and other modeling languages! Sound/complete for time-robust models

Concluding Remarks Timed CTL model checking for Real-Time Maude and other modeling languages! Sound/complete for time-robust models Future work: C++ implementation informative analysis results