Instructor: Rajeev Alur

Slides:



Advertisements
Similar presentations
Lecture 7. Network Flows We consider a network with directed edges. Every edge has a capacity. If there is an edge from i to j, there is an edge from.
Advertisements

Representing Boolean Functions for Symbolic Model Checking Supratik Chakraborty IIT Bombay.
CS 267: Automated Verification Lecture 8: Automata Theoretic Model Checking Instructor: Tevfik Bultan.
Lecture 24 MAS 714 Hartmut Klauck
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
1 Finite Constraint Domains. 2 u Constraint satisfaction problems (CSP) u A backtracking solver u Node and arc consistency u Bounds consistency u Generalized.
Hybrid Systems Presented by: Arnab De Anand S. An Intuitive Introduction to Hybrid Systems Discrete program with an analog environment. What does it mean?
Timed Automata.
The Theory of NP-Completeness
Rigorous Software Development CSCI-GA Instructor: Thomas Wies Spring 2012 Lecture 13.
Compatibility between shared variable valuations in timed automaton network model- checking Zhao Jianhua, Zhou Xiuyi, Li Xuandong, Zheng Guoliang Presented.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
Penn ESE 535 Spring DeHon 1 ESE535: Electronic Design Automation Day 22: April 23, 2008 FSM Equivalence Checking.
Shortest Path Problems Directed weighted graph. Path length is sum of weights of edges on path. The vertex at which the path begins is the source vertex.
1 Completeness and Complexity of Bounded Model Checking.
Lecture 11. Matching A set of edges which do not share a vertex is a matching. Application: Wireless Networks may consist of nodes with single radios,
Penn ESE535 Spring DeHon 1 ESE535: Electronic Design Automation Day 8: February 13, 2008 Retiming.
Applied Discrete Mathematics Week 10: Equivalence Relations
Decision Procedures An Algorithmic Point of View
1 The Theory of NP-Completeness 2012/11/6 P: the class of problems which can be solved by a deterministic polynomial algorithm. NP : the class of decision.
Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
The Complexity of Optimization Problems. Summary -Complexity of algorithms and problems -Complexity classes: P and NP -Reducibility -Karp reducibility.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
Lecture 81 Regional Automaton CS 5270 Lecture 8. Lecture 82 What We Need to Do Problem: –We need to analyze the timed behavior of a TTS. –The timed behavior.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
The all-pairs shortest path problem (APSP) input: a directed graph G = (V, E) with edge weights goal: find a minimum weight (shortest) path between every.
1 Outline:  Optimization of Timed Systems  TA-Modeling of Scheduling Tasks  Transformation of TA into Mixed-Integer Programs  Tree Search for TA using.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
Two Discrete Optimization Problems Problem: The Transportation Problem.
1 Model Checking of of Timed Systems Rajeev Alur University of Pennsylvania.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
Chapter 13 Backtracking Introduction The 3-coloring problem
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
Variants of LTL Query Checking Hana ChocklerArie Gurfinkel Ofer Strichman IBM Research SEI Technion Technion - Israel Institute of Technology.
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
CIS 540 Principles of Embedded Computation Spring Instructor: Rajeev Alur
The Time-abstracting Bisimulation Equivalence  on TA states: Preserve discrete state changes. Abstract exact time delays. s1s2 s3  a s4  a 11 s1s2.
Lecture 3: Uninformed Search
SS 2017 Software Verification Timed Automata
Spring 2016 Program Analysis and Verification
Computability and Complexity
Modeling Arithmetic, Computation, and Languages
Haim Kaplan and Uri Zwick
Mathematical Structures for Computer Science Chapter 6
Arithmetic Constraints and Automata
Autonomous Cyber-Physical Systems: Dynamical Systems
ESE535: Electronic Design Automation
Timed Automata Formal Systems Pallab Dasgupta Professor,
Complexity 6-1 The Class P Complexity Andrei Bulatov.
Chap 3. The simplex method
Instructor: Shengyu Zhang
ESE535: Electronic Design Automation
CSEP590 – Model Checking and Automated Verification
ESE535: Electronic Design Automation
ESE535: Electronic Design Automation
Algorithms (2IL15) – Lecture 7
Instructor: Aaron Roth
Instructor: Aaron Roth
Instructor: Aaron Roth
Instructor: Aaron Roth
Instructor: Aaron Roth
Course: CS60030 FORMAL SYSTEMS
Presentation transcript:

Instructor: Rajeev Alur alur@cis.upenn.edu CIS 540 Principles of Embedded Computation Spring 2016 http://www.seas.upenn.edu/~cis540/ Instructor: Rajeev Alur alur@cis.upenn.edu

CIS 540 Spring 2016; Lecture April 25 Timed Automata Motivation: When is exact analysis of timing constraints possible? A timed process TP is a timed automaton if for every clock variable x Assignments to x in the description of TP are of the form x:=0 An atomic expression involving x in the description of TP (in clock-invariants or in guards) must of the form “x~ k”, where k is a constant and ~ is a comparison operation (=, <=, >, <, >=) In such a model, one can express constant lower and upper bounds on timing delays Closed under parallel composition: If TP1 and TP2 are timed automata then TP1 | TP2 is also a timed automaton Finite-state timed automaton: A timed automaton where all variables other than clock variables have finite types (e.g. Boolean, enumerated) State-space is still infinite due to clock variables, but verification is solvable exactly CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example D (y >= 6)? x,y:=0 x>=3  y:=0 (y >= 2)? A x<=5 B x<=7 C x<=8 (x <= 4)? E (x = 7)? F Which of the modes D, E, F are reachable ? Requires propagation of the reachable combinations of x and y symbolically CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example Clock-zone R0 0 <= x1 <= 0 0 <= x2 <= 0 0 <= x1-x2 <= 0 x1, x2:=0 A Initial set of clock-valuations: x1 = 0 & x2 = 0 Clock-zone: Uniform representation of constraints that arise during analysis Constraints of two types: 1. Lower/upper bound on value of a clock variable 2. Lower/upper bound on difference of two clock variables CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example Clock-zone R0 0 <= x1 <= 0 0 <= x2 <= 0 0 <= x1-x2 <= 0 Clock-zone R’0 0 <= x1 <= Infty 0 <= x2 <= Infty 0 <= x1 – x2 <= 0 A x1 <= 5 Starting from a state in R0, as time elapses, which clock-valuations are reachable ? During a timed transition, values of all clocks increase. How are the constraints impacted? What’s the effect of clock-invariant ? Step 1: Compute effect of timed transitions ignoring clock-invariants Constraints on individual clocks: Change upper bound to Infty Constraints on differences between clock values: unchanged (why?) CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example Clock-zone R’0 0 <= x1 <= Infty 0 <= x2 <= Infty 0 <= x1-x2 <= 0 Clock-zone R”0 0 <= x1 <= 5 0 <= x2 <= Infty 0 <= x1-x2 <= 0 Clock-zone R1 0 <= x1 <= 5 0 <= x2 <= 5 0 <= x1-x2 <= 0 A x1 <= 5 Desired clock-zone R1: Set of clock-valuations reachable while in mode A Intersection of constraints in R’0 and the clock-invariant Canonicalization: Tighten all bounds to reflect implied constraints Each lower bound should be as high as possible Each upper bound should be as low as possible CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example Clock-zone R1 0 <= x1 <= 5 0 <= x2 <= 5 0 <= x1-x2 <= 0 Clock-zone R2 3 <= x1 <= 5 0 <= x2 <= 0 3 <= x1-x2 <= 5 3 <= x1 <= 5 0 <= x2 <= 5 0 <= x1-x2 <= 0 3 <= x1 <= 5 3 <= x2 <= 5 0 <= x1-x2 <= 0 A x1 <= 5 x1>=3  x2:=0 B Desired clock-zone R2: What are set of clock-valuations upon entry to B ? Step 1: Intersect guard 3 <= x1 with the clock-zone R1 Step 2: Canonicalize by tightening constraints Step 3: Capture the effect of assignment x2 := 0 Bounds on x2 change, and so do bounds on x1-x2 Step 4: Canonicalize. In this case, constraints are already as tight as possible CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example Clock-zone R2 3 <= x1 <= 5 0 <= x2 <= 0 3 <= x1-x2 <= 5 Clock-zone R3 3 <= x1 <= 7 0 <= x2 <= 4 3 <= x1-x2 <= 5 3 <= x1 <= Infty 0 <= x2 <= Infty 3 <= x1-x2 <= 5 3 <= x1 <= 7 0 <= x2 <= Infty 3 <= x1-x2 <= 5 B x1 <= 7 Starting from a state in R0, as time elapses, which clock-valuations are reachable ? Step 1: Set upper bounds on individual clock values to Infty Step 2: Intersect with the clock-invariant x1 <= 7 Step 3: Canonicalize by tightening all the bounds What is a good data structure to represent clock-zones? What are algorithms for operations such as intersection, canonicalization? CIS 540 Spring 2016; Lecture April 25

DBM Representation of Constraints 3 <= x1 <= 7 0 <= x2 <= Infty 3 <= x1 - x2 <= 5 3 <= x1 - x0 <= 7 0 <= x2 - x0 <= Infty 3 <= x1 - x2 <= 5 x1 - x0 <= 7 x0 - x1 <= -3 x2 - x0 <= Infty x0 - x2 <= 0 x1 - x2 <= 5 x2 - x1 <= -3 X0 X1 X2 -3 7 5 Infty CIS 540 Spring 2016; Lecture April 25

Difference Bounds Matrix Data structure for representing constraints, where each constraint expresses a bound on difference of values of two variables Suppose clocks are named x1, x2 , … xm Let us introduce a dummy clock x0 that is always 0. Then instead of the constraint L <= xi <= U, we have L <= xi – x0 <= U Lower bound constraint L <= xi – xj can be rewritten as upper bound constraint xj – xi <= -L DBM R is (m+1) x (m+1) matrix representing for 0 <= i <= m, for 0 <= j <= m, xi – xj <= R[i,j] Diagonal entries should be 0: xi – xj <= 0 There is a one-to-one correspondence between DBMs and clock-zones Entries of DBM: Integers plus a special symbol Infty (to represent absence of a bound) CIS 540 Spring 2016; Lecture April 25

CIS 540 Spring 2016; Lecture April 25 DBM Canonicalization X0 X1 X2 -3 7 5 Infty X0 X1 X2 -3 7 5 4 Clock-zone R3 3 <= x1 <= 7 0 <= x2 <= 4 3 <= x1 – x2 <= 5 We know: x2 – x1 <= -3 and x1 – x0 <= 7, so we can conclude x2 – x0 <= 4 But current R[2,0] entry is Infty, to reflect tighter implied constraint, change it to 4 General canonicalization step: If R[i,k] > R[i,j] + R[j,k] then R[i,k] = R[i,j] + R[j,k] Canonicalization: repeatedly apply above rule. A matrix is called canonical if all i, j, k, R[i,k] <= R[i,j] + R[j,k] CIS 540 Spring 2016; Lecture April 25

CIS 540 Spring 2016; Lecture April 25 Canonical DBMs Every canonicalization step does not change the set of clock-valuations that the DBM represents Canonical DBM represents the “tightest” possible constraints If R is canonical, for every i and j, R[i,j] is the least upper bound on the difference xi – xj for clock-valuations satisfying constraints in R Alternative interpretation Consider a graph with m+1 vertices corresponding to x0, x1, … xm Entry R[i,j] = Cost labeling the edge from vertex xi to xj Canonicalization: Compute costs of shortest paths in this graph R is canonical if R[i,j] is the cost of shortest path from xi to xj CIS 540 Spring 2016; Lecture April 25

Graph-based representation Given: 1 <= x1 <= 3; x2 >= 0; 0 <= x3 <= 3; x2 – x3 = 1; x2 – x1 >= 2 X0 X1 X2 X3 -1 3 -2 Infty 1 -1 X0 X1 3 -2 3 -1 X0 X1 X2 X3 -1 -3 -2 2 4 3 1 X3 X2 1 CIS 540 Spring 2016; Lecture April 25

What if constraints are unsatisfiable ? X0 X1 X2 5 10 Infty -6 X0 X1 X2 -6 5 10 Infty X0 X1 X2 -6 5 -1 10 Infty Suppose we know: 0 <= x1 <= 5; 0 <= x2 <= Infty; 6 <= x1 – x2 <= 10 Canonicalization step 1: Compare R[0,1] to R[0,2] + R[2,1], and change to -6 Canonicalization step 2: Compare R[1,1] to R[1,0] + R[0,1], and change to -1 R[1,1] entry says x1 – x1 <= -1, not possible! Means original constraints unsatisfiable! CIS 540 Spring 2016; Lecture April 25

Canonicalization Algorithm Problem same as computing shortest paths among all pairs of vertices in a directed graph Need to account for detection of negative cycles (that is, unsatisfiable constraints) Classical algorithm with time complexity cubic in the number of vertices/clocks CIS 540 Spring 2016; Lecture April 25

Canonicalization Algorithm Input: (m+1) x (m+1) DBM R Output: Check if constraints represented by R are satisfiable, and if so, return “canonical” version of R for l = 0 to m { /* R[i,j] reflects shortest path going through vertices < l */ for i = 0 to m { for j = 0 to m { /*Check if visiting vertex l improves ij path */ R[i, j] = min ( R[i,j], R[i,l] + R[l,j] ) }; if R[i, i] < 0 then return “Unsatisfiable”; return R CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example -3 7 5 4 X0 X1 X2 Infty -2 X0 X1 X2 -3 -2 7 5 4 B x1 <= 7 x2 >= 2 c X0 X1 X2 -5 -2 7 5 4 -3 Goal: Compute set of clock-valuations upon entry to C Step 1: Represent guard condition x2 >= 2 as a canonical DBM Step 2: Intersect the two DBMs [i,j] entry of the result = Minimum of [i,j] entries of the given DBMs Step 3: Canonicalize. CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example -5 -2 7 5 4 -3 X0 X1 X2 -5 -2 Infty 5 -3 X0 X1 X2 -5 -2 8 5 Infty -3 X0 X1 X2 -5 -2 8 5 -3 c x1<=8 Goal: Compute set of clock-valuations reachable due to timed transitions in mode C Step 1: Set upper bounds on all clocks, that is, first column, other than X0, to Infty Step 2: Represent clock-invariant of C as a DBM, and take intersection Step 3: Canonicalize. CIS 540 Spring 2016; Lecture April 25

Timing Analysis Example -5 -2 8 5 -3 D x2 >= 6 x1, x2:=0 x1>=3  x2:=0 x2 >= 2 A x1<=5 B x1<=7 C x1<=8 x1 <= 4 E x1 = 7 DBM R5 = Reachable states (x1, x2,mode=C) F Intersection of R5 and x2>=6 unsatisfiable; means mode D not reachable Intersection of R5 and x1 <= 4 unsatisfiable; means mode E not reachable Intersection of R5 and x1=7 satisfiable; means mode F is reachable CIS 540 Spring 2016; Lecture April 25

Symbolic BFS Algorithm Given region Init over S, region Trans over S U S’, and region j over S, if j is reachable in T then return 1, else return 0 reg Reach := Init; /* States found reachable */ reg New := Init; /* States not yet explored for outgoing transitions */ while IsEmpty(New) = 0 { /* while there are states to be explored */ if IsEmpty(Conj(New,j)) =0 /* Property j found reachable */ then return 1 (and stop); New := Diff(Post(New,Trans),Reach); /*These are states in post-image of New, but not previously found reachable, so to be explored */ Reach := Disj(Reach, New); /* Update Reach by newly found states*/ }; return 0; /* All states explored without encountering j */ CIS 540 Spring 2016; Lecture April 25

Symbolic Search Using DBMs State of a timed automaton = (Discrete state, clock valuation) Discrete state assigns values to all variables other than clocks Symbolic representation = (Discrete state s, DBM R) Operations on DBMs used to implement symbolic search When do (s, R) and (s’, R’) represent same set of states? s = s’ and R = R’ (assuming they are canonical) Image computation corresponding to timed transitions: already studied Image computation corresponding to mode-switches Intersect with guard, and reset clocks as needed What’s the algorithm to compute, given DBM R, DBM for R[ xi := 0] Cannot implement “Union” operation directly on DBMs Union of DBMs R and R’ need not be a DBM, as each DBM represents a convex set of valuations CIS 540 Spring 2016; Lecture April 25

Symbolic Search Using DBMs Data structure: discrete state and a list of DBMs ( s, R1, R2, …) Search is partly enumerative and partly symbolic Multiple paths ending up at same discrete state s would cause the list of DBMs associated with s to grow Efficient implementation needs a way to keep this list compact If number of reachable discrete states is finite, then search algorithm is guaranteed to terminate Alternative algorithm for analyzing timed automata Region equivalence: Finite partitioning of the set of all possible clock-valuations such that valuations belonging to the same partition behave similarly See Section 7.3.2 for details CIS 540 Spring 2016; Lecture April 25