MARCIE – Model Checking and Reachability Analysis Done Efficiently

A vertex centric parallel algorithm for linear temporal logic model checking in Pregel

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal-logic formula that specifies the behavior. The model-checking problem for the branching-time temporal logic CTL can be solved in linear running time, and model-checking tools for CTL are used successfully in industrial applications. The development of programs that must meet rigid real-time constraints has brought with it a need for real-time temporal logics that enable quantitative reference to time. Early research on real-time temporal logics uses the discrete domain of the integers to model time. Present research on real-time temporal logics focuses on continuous time and uses the dense domain of the reals to model time. There, model checking becomes significantly more complicated. For example, the model-checking problem for TCTL, a continuous-time extension of the logic CTL, is PSPACE-complete.In this paper we suggest a reduction from TCTL model checking to CTL model checking. The contribution of such a reduction is twofold. Theoretically, while it has long been known that model-checking methods for untimed temporal logics can be extended quite easily to handle discrete time, it was not clear whether and how untimed methods can handle the reset quantifier of TCTL, which resets a realvalued clock. Practically, our reduction enables anyone who has a tool for CTL model checking to use it for TCTL model checking. The TCTL model-checking algorithm that follows from our reduction is in PSPACE, matching the known bound for this problem. In addition, it enjoys the wide distribution of CTL model-checking tools and the extensive and fruitful research efforts and heuristics that have been put into these tools.KeywordsModel CheckTemporal LogicAtomic PropositionKripke StructureTemporal ReasoningThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal-logic formula that specifies the behavior. The main practical limitation of model checking is caused by the size of the state space of the program, which grows exponentially with the number of concurrent components. This problem, known as the state-explosion problem, becomes more difficult when we consider real-time model checking, where the program and the specification involve quantitative references to time. In particular, when use timed automata to describe real-time programs and we specify timed behaviors in the logic TCTL, a real-time extension of the temporal logic CTL with clock variables, then the state space under consideration grows exponentially not only with the number of concurrent components, but also with the number of clocks and the length of the clock constraints used in the program and the specification. Two powerful methods for coping with the state-explosion problem are on-the-fly and space-efficient model checking. In on-the-fly model checking, we explore only the portion of the state space of the program whose exploration is essential for determining the satisfaction of the specification. In space-efficient model checking, we store in memory the minimal information required, preferring to spend time on reconstructing information rather than spend space on storing it. In this work we develop an automata-theoretic approach to TCTL model checking that combines both methods. We suggest, for the first time, a PSPACE on-the-fly model-checking algorithm for TCTL.KeywordsModel CheckTemporal LogicLinear Temporal LogicRegion PositionTree AutomatonThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper presents an Interval Decision Diagram based approach to symbolic CSL model checking of Continuous Time Markov Chains which are derived from stochastic Petri nets. Matrix-vector and vector-matrix multiplication are the major tasks of exact analysis. We introduce a simple, but powerful algorithm which uses explicitly the Petri net structure and allows for parallelisation. We present results demonstrating the efficiency of our first prototype implementation when applied to biochemical network models, specifically with increasing token numbers. Our tool currently supports CSL model checking of time-bounded operators and the Next operator for ordinary stochastic Petri nets.KeywordsModel CheckRate MatrixCache DataContinuous Time Markov ChainBiochemical NetworkThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In the last years, the model checking (MC) problem for interval temporal logic (ITL) has received an increasing attention as a viable alternative to the traditional (point-based) temporal logic MC, which can be recovered as a special case. Most results have been obtained by imposing suitable restrictions on interval labeling. In this paper, we overcome such limitations by using regular expressions to define the behavior of proposition letters over intervals in terms of the component states. We first prove that MC for Halpern and Shoham’s ITL (HS), extended with regular expressions, is decidable. Then, we show that formulas of a large class of HS fragments, namely, all fragments featuring (a subset of) HS modalities for Allen’s relations meets, met-by, starts, and started-by, can be model checked in polynomial working space (MC for all these fragments turns out to be PSPACE-complete).

Dataflow languages are widely used for programming real-time embedded systems. They offer high level abstraction above hardware, and are amenable to program analysis and optimisation. This paper addresses the challenge of verifying parallel program transformations in the context of dynamic dataflow models, where the scheduling behaviour and the amount of data each actor computes may depend on values only known at runtime. We present a Linear Temporal Logic (LTL) model checking approach to verify a dataflow program transformation, using three LTL properties to identify cyclostatic actors in dynamic dataflow programs. The workflow abstracts dataflow actor code to Fiacre specifications to search for counterexamples of the LTL properties using the Tina model checker. We also present a new refactoring tool for the Orcc dataflow programming environment, which applies the parallelising transformation to cyclostatic actors. Parallel refactoring using verified transformations speedily improves FPGA performance, e.g.15.4 × speedup with 16 actors.

Different definitions of vacuity in temporal logic model checking have been suggested along the years. Examining them closely, however, reveals an interesting phenomenon. On the one hand, some of the definitions require high-complexity vacuity detection algorithms. On the other hand, studies in the literature report that not all vacuities detected in practical applications are considered a problem by the system verifier. This brings vacuity detection into an undesirable situation where the user of the model checking tool may find herself waiting a long time for results that are of no interest for her. In this paper we restrict our attention to practical usage of vacuity detection. We define Temporal Antecedent Failure, an extension of antecedent failure to temporal logic, which refines the notion of vacuity. According to our experience, this type of vacuity always indicates a problem in the model, environment or property. We show how vacuity information can be derived from the automaton built for the original property, and we introduce the notion of vacuity explanation. Our experiments demonstrate that this type of vacuity as well as its reasons can be computed with a negligible increase in the overall runtime.

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behaviour by checking whether a structure that models the program satisfies a temporal logic formula that specifies this s behaviour. One of the ways to overcome the expressiveness limitation of temporal logics is to augment them with quantification over atomic propositions. In this paper we consider the extension of branching temporal logics with existential quantification over atomic propositions. Once we add existential quantification to a branching temporal logic, it becomes sensitive to unwinding. That is, unwinding a structure into an infinite tree does not preserve the set of formulas it satisfies. Accordingly, we distinguish between two semantics, two practices as specification languages, and two versions of the model-checking problem for such a logic. One semantics refers to the structure that models the program, and the second semantics refers to the infinite computation tree that the program induces. We examine the complexity of the model-checking problem in the two semantics for the logics CTL and CTL* augmented with existential quantification over atomic propositions. Following the cheerless results that we get, we examine also the program complexity of model checking; i.e. the complexity of this problem in terms of the program, assuming the formula is fixed. We show that while fixing the formula dramatically reduces model-checking complexity in the tree semantics its influence on the structure semantics is poor.

Stochastic model checking is a technique to check if a Markov chain satisfies a path property. This typically requires the computation of the probability of the set of paths of the continuous Time Markov chain (CTMC) that satisfy a given set of requirements that are given in terms of visited states, events occurrence and time constraints at which the events occur. In particular we shall address the stochastic logic CSLTA [12], in which the properties to be satisfied are specified as one-clock timed automaton [1]. CSLTA is strictly more expressive than the well known stochastic logic CSL [8]. It has been proved in [12] that the computation of the set of states that satisfy a CSLTA property requires the solution, in steady-state, of a Markov Regenerative Process (MRgP) of a size that is of the order of the size of the CTMC multiplied by the size of the timed automata state space: space and time can be a severe impairment for the efficacy of stochastic model checking.

Model checking as an approach to the automatic verification of finite state systems has focussed predominantly on system specifications expressed in temporal logic. In the distributed systems community, logics of knowledge (epistemic logics) have been advocated for expressing desirable properties of protocols and systems. A range of logics combining temporal and epistemic components have been developed for this purpose. However, the model checking problem for temporal logics of knowledge has received (comparatively) little attention. In this paper, we address ourselves to this problem. Following a brief survey of the relevant issues and literature, we introduce a temporal logic of knowledge (Halpern and Vardi’s logic CKL n). We then develop an approach to CKL n model checking that combines ideas from the interpreted systems semantics for knowledge with the logic of local propositions developed by Engelhardt et al. With our approach, local propositions provide a means to reduce CKL n model checking to linear temporal logic model checking. After introducing and exploring the ideas underpinning our approach, we present a case study (the bit transmission problem) in which spin was used to establish temporal epistemic properties of a system implemented in PROMELA.

Model checking (Baier and Katoen in Principles of model checking, MIT Press, Cambridge, 2008; Clarke et al. in Model checking, MIT Press, Cambridge, 2001) is an automatic technique to formally verify that a given specification of a concurrent system meets given functional properties. Its use has been demonstrated many times over the years. Key characteristics that make the method so appealing are its level of automaticity, its ability to determine the absence of errors in the system (contrary to testing techniques) and the fact that it produces counter-examples when errors are detected, that clearly demonstrate not only that an error is present, but also how the error can be produced. The main drawback of model checking is its limited scalability, and for this reason, research on reducing the computational effort has received much attention over the last decades. Besides the verification of qualitative functional properties, the model checking technique can also be applied for other types of analyses, such as planning and the verification of quantitative properties. We briefly discuss several contributions in the model checking field that address both its scalability and its applicability to perform planning and quantitative analysis. In particular, we introduce six papers selected from the 23rd International SPIN Symposium on Model Checking Software (SPIN 2016).

지금까지 제시된 정형 검증 기법들 중에서 모델 체킹이 가장 효과적이라는 평가를 받고 있지만, 모델 체킹이 실제 활용되기 위해서는 상태 폭발 문제를 극복해야 한다. 본 논문에서는 상태 폭발 문제를 방지하기 위해서, 원래 모델 M으로 부터 추상화 모델 M'을 얻는 방법을 제안하였다. 주어진 논리식의 모델 체킹에 필요한 변수만을 추출한 후. 모델의 상태 공간을 이들 변수들에 투영함으로서 추상화 모델 M'을 얻었다. M'은 M보다 크기가 작을 뿐만 아니라 더 적은 행위를 갖고 있기 때문에(M'<TEX>$\leq$</TEX>M), 추상화 모델 M'을 이용해서 수행한 도달성 분석 결과는 M 에서도 그대로 유효하다. 따라서 M을 모델 체킹할 때 상태 폭발이 발생하면, 축소된 모델 M'을 이용하여 모델 체킹할 수 있다. 제안된 추상화 기법을 푸쉬 푸쉬 게임 풀이에 적용했고, 모델 체커로는 Cadence SMV와 NuSMV를 사용하였다. 그 결과 상태 폭발 문제로 인해서 풀 수 없었던 게임을 추상화를 이용해서 해결하였다. 그리고 추상화를 적용하기 이전에 비해서 시간 절감 및 메모리 절감 효과가 있었다. Cadence SMV의 경우 평균 87%의 시간 절감 및 79%의 메모리 절감이 있었으며, NuSMV의 경우 83%의 시간 절감 및 56%의 메모리 절감이 있었다. Although model checking has gained its popularity as one of the most effective approaches to the formal verification, it has to deal with the state explosion problem to be widely used in industry. In order to mitigate the problem, this paper proposes an ion technique to obtain a reduced model M' from a given original model M. Our technique Identifies the set of necessary variables for model checking and projects the state space onto them. The model M' is smaller in both size and behavior than the original model M, written M'<TEX>$\leq$</TEX>M. Since the result of reachability analysis with M' is preserved in M, we can do reachability analysis with model checking using M' instead of M. The abstraction technique is applied to Push Push games, and two model checkers - Cadence SMV and NuSMV - are used to solve the games. As a result, most of unsolved games with the usual model checking are solved with the ion technique. In addition, ion shows that there is much of time and space improvement. With Cadence SMV, there is 87% time improvement and 79% space one. And there is 83% time improvement and 56% space one with NuSMV.

Model checking epistemic–probabilistic logic using probabilistic interpreted systems

Modelling and analysis of kanban-controlled (just-in-time) production systems under realistic assumptions presents a number of challenges, including the ability to conduct both qualitative and quantitative analysis, and the ability to model control policies. These challenges are due, in part, to station interdependence, blocking and starvation due to limited buffer spaces, and the necessity of modelling both material and kanban flows. Petri nets (PNs) have recently emerged as a promising approach for modelling manufacturing systems. PNs are a graphical and mathematical technique useful for modelling concurrent, asynchronous, distributed, parallel, non-deterministic and stochastic systems. PN models can be analysed to determine both their qualitative and quantitative properties. In this paper, we develop stochastic, coloured PN (SCPN) models of a JIT system utilizing two different kanban control policies: a traditional kanban system (TKS) policy and a flexible kanban system (FKS) policy. The resulting models can be used to represent JIT systems of arbitrary size, producing single or multiple types of products, with fixed order points 1. The models are shown to be live and bounded, and can be simulated to produce quantitative results. Sample simulation results are presented to illustrate the models' capabilities.

This paper deals with the verification of logic control system designs by signal interpreted Petri net (SIPN), which is a special extension of an ordinary Petri net (PN) by input and output signals. Such extensions provide more power for a specification. However, due to the extensions the basic Petri net analysis method is not strong enough to determine the properties. A model checking approach has been applied to the verification of an SIPN design. The requirements to be verified are expressed in temporal logic (TL). Via a model checking algorithm the validity of such requirements can be checked automatically in every possible input sequences. In an error case a sequence of states is calculated, which indicates a trace leading to the violation of the requirements. A case study has shown that this approach can effectively locate errors in the design process.