Symbolic Model Checking of Stochastic Systems: Theory and Implementation

Continuous-time Markov chains (CTMCs) have been largely applied with combination of high-level model specification techniques as performance evaluation and dependability, reliability analysis models for computer and communication systems. These models can be complemented by probabilistic model checking formalisms based on temporal logic to specify the guarantees on the measures of interest. We consider in this paper Continuous Stochastic Logic (CSL) which lets to express real-time probabilistic properties on CTMCs. It has been shown that the CSL operators can be checked by means of transient or steady-state analysis of the underlying CTMC. Since models are checked to see if the considered measures are guaranteed or not, bounding techniques are useful in probabilistic model checking. We propose to apply Stochastic Comparison technique to construct bounding models having a special structure which provides closed-form solutions to compute both transient and steady-state distributions. We present an algorithm to provide rapid model checking by means of these closed-form bounding distributions. Obviously, bounding distributions may not let to decide if the underlying model meets the probability thresholds or not. However in the case where the model can be checked by the proposed method, we gain significantly in time and memory complexity.

The state explosion problem is the central challenge in automatic verification using model checking. In many cases, representing the state space of a system as a lattice is an effective way of representing very large state spaces. The partial order of the lattice represents an information ordering between states, which can be used as an abstraction mechanism to reduce the computational cost of model checking. The 'traditional' logical framework for model checking finite state systems has serious deficiencies when applied to information-ordered state spaces. Interpreting the truth of a proposition about a state or a sequence of states in a four-valved truth domain is better from a modelling point of view, allowing us to reason about partial and contradictory information. Moreover, it overcomes a serious technical difficulty encountered when using a two-valued truth domain. The paper defines the syntax and semantics of a four-valued temporal logic that can be used for specifying properties of a computer system. This framework has particular relevance to hardware verification. It could be used by several model checking algorithms. Symbolic trajectory evaluation (STE) [33] is a model checking algorithm that has had success in model checking using information orderings to reduce computational cost. Previous work used a two-valued logic though, which limited the expressiveness of the logic. Using the framework presented here, the STE algorithm can be generalised, and then applied in practice to a richer logic. Some examples are shown in this paper. Keywords:Symbolic trajectory evaluation, quarternary logic, model checking, temporal logic, bilattices.

We present a thorough study of propositional dynamic logic over a variation of labeled transition systems, called accelerated labelled transition systems, which are transition systems labeled with regular expressions over action labels. We study the model checking and satisfiability decision problems. Through a notion of regular expression rewriting, we reduce these two problems to the corresponding ones of PDL in the traditional semantics (w.r.t. LTS). As for the complexity, both of problems are proved to be ExPSPACE-complete. Moreover, the program complexity of model checking problem turns out to be NLOGSPACE-complete. Furthermore, we provide an axiomatization for PDL which involves Kleene Algebra as an Oracle. The soundness and completeness are shown.

Modelling concurrent objects running on the TSO and ARMv8 memory models

Stochastic model checking is a technique to check if a Markov chain satisfies a path property. This typically requires the computation of the probability of the set of paths of the continuous Time Markov chain (CTMC) that satisfy a given set of requirements that are given in terms of visited states, events occurrence and time constraints at which the events occur. In particular we shall address the stochastic logic CSLTA [12], in which the properties to be satisfied are specified as one-clock timed automaton [1]. CSLTA is strictly more expressive than the well known stochastic logic CSL [8]. It has been proved in [12] that the computation of the set of states that satisfy a CSLTA property requires the solution, in steady-state, of a Markov Regenerative Process (MRgP) of a size that is of the order of the size of the CTMC multiplied by the size of the timed automata state space: space and time can be a severe impairment for the efficacy of stochastic model checking.

In formal design verification, successful model checking is typically preceded by a laborious manual process of constructing design abstractions. We present a methodology for partially—and in some cases, fully—bypassing the abstraction process. For this purpose, we provide to the designer abstraction operators which, if used judiciously in the description of a design, structure the corresponding state space hierarchically. This structure can then be exploited by verification tools, and makes possible the automatic and exhaustive exploration of state spaces that would otherwise be out of scope for existing model checkers.Specifically, we present the following contributions: - A temporal abstraction operator that aggregates transitions and hides intermediate steps. Mathematically, our abstraction operator is a function that maps a flat transition system into a two-level hierarchy where each atomic upper-level transition expands into an entire lower-level transition system. For example, an arithmetic operation may expand into a sequence of bit operations. - A BDD-based algorithm for the symbolic exploration of multi-level hierarchies of transition systems. The algorithm traverses a level-n transition by expanding the corresponding level-(n − 1) transition system on-the-fly. The level-n successors of a state are determined by computing a level-(n − 1) reach set, which is then immediately released from memory. In this fashion, we can exhaustively explore hierarchically structured state spaces whose flat counterparts cause memory overflows. - We experimentally demonstrate the efficiency of our method with three examples—a multiplier, a cache coherence protocol, and a multiprocessor system. In the first two examples, we obtain significant improvements in run times and peak BDD sizes over traditional state-space search. The third example cannot be model checked at all using conventional methods (without manual abstractions), but can be analyzed fully automatically using transition hierarchies. KeywordsModel CheckTransition RelationParallel CompositionReactive ModuleReachability AnalysisThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The predominant technique for computing the transient distribution of a Continuous Time Markov Chain (CTMC) exploits uniformization, which is known to be stable and efficient for non-stiff to mildly-stiff CTMCs. On stiff CTMCs however, uniformization suffers from severe performance degradation. In this paper, we report on our observations and analysis of an alternative technique using Krylov subspaces. We implemented a Krylov-based extension to MRMC (Markov Reward Model Checker) and conducted extensive experiments on five case studies from different application domains. The results reveal that the Krylov-based technique is an order of magnitude faster on stiff CTMCs.

In this paper, we investigate the model checking (MC) problem for Halpern and Shoham's interval temporal logic HS. In the last years, interval temporal logic MC has received an increasing attention as a viable alternative to the traditional (point-based) temporal logic MC, which can be recovered as a special case. Most results have been obtained under the homogeneity assumption, that constrains a proposition letter to hold over an interval if and only if it holds over each component state. Recently, Lomuscio and Michaliszyn proposed a way to relax such an assumption by exploiting regular expressions to define the behaviour of proposition letters over intervals in terms of their component states. When homogeneity is assumed, the exact complexity of MC is a difficult open question for full HS and for its two syntactically maximal fragments AA'BB'E' and AA'EB'E'. In this paper, we provide an asymptotically optimal bound to the complexity of these two fragments under the more expressive semantic variant based on regular expressions by showing that their MC problem is AEXP_pol-complete, where AEXP_pol denotes the complexity class of problems decided by exponential-time bounded alternating Turing Machines making a polynomially bounded number of alternations.

CSLTA is a stochastic temporal logic for continuous-time Markov chains (CTMC), that can verify the probability of following paths specified by a Deterministic Timed Automaton (DTA). A DTA expresses both logic and time constraints over a CTMC path, yielding to a very flexible way of describing performance and dependability properties. This paper explores a model checking algorithm for CSLTA based on the translation into a Deterministic and Stochastic Petri Net (DSPN). The algorithm has been implemented in a simple Model Checker prototype, that relies on existing DSPN solvers to do the actual numerical computations.

This tutorial presents an overview of model checking for both discrete and continuous-time Markov chains (DTMCs and CTMCs). Model checking algorithms are given for verifying DTMCs and CTMCs against specifications written in probabilistic extensions of temporal logic, including quantitative properties with rewards. Example properties include the probability that a fault occurs and the expected number of faults in a given time period. We also describe the practical application of stochastic model checking with the probabilistic model checker PRISM by outlining the main features supported by PRISM and three real-world case studies: a probabilistic security protocol, dynamic power management and a biological pathway.

Business processes usually have to consider certain constraints like domain specific and quality requirements. The automated formal verification of these constraints is desirable, but requires the user to provide an unambiguous formal specification. In particular since the notations for business process modeling are usually visual flow-oriented languages, the notational gap to the languages usually employed for the formal specification of constraints, e.g., temporal logic, is significant and hard to bridge. Thus, our approach relies on UML Activities as a single language for the specification of both business processes and the corresponding constraints. For the expression of such constraints, we have provided a process pattern definition language based on specialized Activities. In this paper, we describe how model checking can be employed for formal verification of business processes against such patterns. For this, we present an automated transformation of the business process and the corresponding patterns into a transition system and temporal logic, respectively.

Model checkers use automated state exploration in order to prove various properties such as reachability, non-reachability, and bisimulation over state transition systems. While model checkers have proved valuable for locating errors in computer models and specifications, they can also be used to prove properties that might be consumed by other computational logic systems, such as theorem provers. In such a situation, a prover must be able to trust that the model checker is correct. Instead of attempting to prove the correctness of a model checker, we ask that it outputs its "proof evidence" as a formally defined document--a proof certificate--and that this document is checked by a trusted proof checker. We describe a framework for defining and checking proof certificates for a range of model checking problems. The core of this framework is a (focused) proof system that is augmented with premises that involve "clerk and expert" predicates. This framework is designed so that soundness can be guaranteed independently of any concerns for the correctness of the clerk and expert specifications. To illustrate the flexibility of this framework, we define and formally check proof certificates for reachability and non-reachability in graphs, as well as bisimulation and non-bisimulation for labeled transition systems. Finally, we describe briefly a reference checker that we have implemented for this framework.

Alternating-time temporal logic (atl) is a logic for reasoning about open computational systems and multi-agent systems. It is well known that atl model checking is linear in the size of the model. We point out, however, that the size of an atl model is usually exponential in the number of agents. When the size of models is defined in terms of states and agents rather than transitions, it turns out that the problem is (1) Δ3P-complete for concurrent game structures, and (2) Δ2P-complete for alternating transition systems. Moreover, for “Positive atl” that allows for negation only on the level of propositions, model checking is (1) Σ2P-complete for concurrent game structures, and (2) NP-complete for alternating transition systems. We show a nondeterministic polynomial reduction from checking arbitrary alternating transition systems to checking turn-based transition systems, We also discuss the determinism assumption in alternating transition systems, and show that it can be easily removed. In the second part of the paper, we study the model checking complexity for formulae of atlwith imperfect information (atlir). We show that the problem is Δ2P-complete in the number of transitions and the length of the formula (thereby closing a gap in previous work of Schobbens in Electron. Notes Theor. Comput. Sci. 85(2), 2004). Then, we take a closer look and use the same fine structure complexity measure as we did for atl with perfect information. We get the surprising result that checking formulae of atlir is also Δ3P-complete in the general case, and Σ2P-complete for “Positive atlir”. Thus, model checking agents’ abilities for both perfect and imperfect information systems belongs to the same complexity class when a finer-grained analysis is used.

In the last years, the model checking (MC) problem for interval temporal logic (ITL) has received an increasing attention as a viable alternative to the traditional (point-based) temporal logic MC, which can be recovered as a special case. Most results have been obtained by imposing suitable restrictions on interval labeling. In this paper, we overcome such limitations by using regular expressions to define the behavior of proposition letters over intervals in terms of the component states. We first prove that MC for Halpern and Shoham’s ITL (HS), extended with regular expressions, is decidable. Then, we show that formulas of a large class of HS fragments, namely, all fragments featuring (a subset of) HS modalities for Allen’s relations meets, met-by, starts, and started-by, can be model checked in polynomial working space (MC for all these fragments turns out to be PSPACE-complete).

Finite transition systems play a central role as formal models for reactive and concurrent systems. A promising technique for automatically verifying transition systems is model checking. In the model-theoretic approach one mechanically determines whether a system ts meets a specification f (expressed as a formula of some temporal logic) by checking whether ts is a model for f. The authors present a kernel specification formalism BTL. They discuss efficient (linear-time) global and local model checking algorithms for BTL. The global algorithm will compute all states that satisfy a given formula whereas the local algorithm will only check a formula for one state (typically the initial system state). Both algorithms run in time linear in the size of the transition system and the length of the formula. >