Quantitative Modeling, Verification, and Synthesis Tom Henzinger IST Austria With Roderick Bloem, Pavol Cerny, Krishnendu Chatterjee, Laurent Doyen, Karin Greimel, Barbara Jobstmann, Arjun Radhakrishna, and Rohit Singh.

Mathematical Modeling: A Tale of Two Cultures Engineering Differential Equations Linear Algebra Probability Theory Computer Science Logic Automata Theory Combinatorics

Uptime: 127 years

What went wrong? Engineering Computer Science Theories of estimation. Theories of correctness.

What went wrong? Engineering Computer Science Theories of estimation. Goal: build reliable and robust systems. Computer Science Theories of correctness. Temptation: programs are mathematical objects; hence we want to prove them correct.

Qualitative Systems Theories Property Verification Yes/No

Qualitative Systems Theories Property Verification Yes/No -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

Logical Systems Theories Property Structure Formula Satisfaction Relation Yes/No -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

Logical Systems Theories -Regular Automaton System Property  (p ) } q) Verification Yes/No -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

Logical Systems Theories Quantitative System Quantitative Property Timed Automaton  (p ) }· 5 q) Verification Yes/No -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

Logical Systems Theories Quantitative System Quantitative Property Markov Process 8 (p ) Pr(}q) ¸ 0.5) Verification Yes/No -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

Logical Systems Theories Quantitative System Quantitative Property Markov Process 8 (p ) Pr(}q) ¸ 0.5) Verification B -perhaps a proof -perhaps some counterexamples -perhaps even a proposed fix

A Quantitative Systems Theory Quantitative Property Analysis R -measure of “fit” between system and property -could involve cost, quality, performance, etc.

A Quantitative Systems Theory Quantitative Property  (p ) } q) Analysis The less time between p and q, the better. R -measure of “fit” between system and property -could involve cost, quality, performance, etc.

A Quantitative Systems Theory Quantitative Property  (p ) } q) Analysis The fewer “unnecessary” q, the better. R -measure of “fit” between system and property -could involve cost, quality, performance, etc.

A Quantitative Systems Theory Q1 Assigning values to behaviors Boolean case: correct vs. incorrect behaviors Q2 Assigning values to systems/properties Boolean case: sets of behaviors (nondeterminism) Q3 Assigning values to pairs of systems/properties Boolean case: preorders (refinement)

A Quantitative Systems Theory Q1 Assigning values to behaviors Boolean case: correct vs. incorrect behaviors Q2 Assigning values to systems/properties Boolean case: sets of behaviors (nondeterminism) Q3 Assigning values to pairs of systems/properties Boolean case: preorders (refinement)

Boolean Systems Theories P1 P2 P3 S1 S’1 S2 S’2 S’’2

Boolean Systems Theories P1 P2 P3 S1 S’1 S2 S’2 S’’2

Boolean Systems Theories P1 P2 P3 S1 S’1 S2 S’2 S’’2

A Quantitative Systems Theory P1 P2 P3 0.9 0.8 S1 S’1 S2 S’2 S’’2

A Quantitative Systems Theory P1 P2 P3 0.9 0.5 0.8 0.7 S1 S’1 S2 S’2 S’’2

A Quantitative Systems Theory P1 P2 P3 0.9 0.5 0.8 0.7 S1 S’1 S2 S’2 S’’2 0.2

Q1 Assigning Values To Behaviors a. Probabilities

Q1 Assigning Values To Behaviors a. Probabilities b. Resource use -worst case vs. average case (e.g. deadlines, QoS) -peak vs. accumulative (e.g. power consumption)

Q1 Assigning Values To Behaviors a. Probabilities b. Resource use -worst case vs. average case (e.g. deadlines, QoS) -peak vs. accumulative (e.g. power consumption) c. Quality measures -discounting vs. long-run averaging

Q1 Assigning Values To Behaviors: Reliability a: ok b: fail Discounted value (0 < d < 1):  a aaaaaaaaaa... 1 aaaaaaaab... 1 - d8 aaab... 1 - d3 b... 0

Q1 Assigning Values To Behaviors: Reliability a: ok b: fail Discounted value (0 < d < 1):  a aaaaaaaaaa... 1 aaaaaaaab... 1 - d8 aaab... 1 - d3 b... 0 Long-run average value: limavg a aaaaaaaaaa... 1 abaabaaab... 1 aaabaaabaaab... 3/4 babbabbba... 0 aaaaaabbb... 0

Q2, Q3 Assigning Values To Systems x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } worst case

Q2, Q3 Assigning Values To Systems x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } worst case B(w) = expx { val(x) : obs(x) = w } avg case

Q2, Q3 Assigning Values To Systems x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } worst case B(w) = expx { val(x) : obs(x) = w } avg case relative to input distribution

Q3 Assigning Distances To Systems x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w } diff(A,B) = supw { |A(w) – B(w)| } exp

Q3 Assigning Distances To Systems x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w } diff(A,B) = supw { |A(w) – B(w)| } Boolean compositionality: if A · A’ then A||B · A’||B Quantitative compositionality: diff(A||B,A’||B) · fB(diff(A,A’))

Is there a Quantitative Systems Theory with -an appealing mathematical formulation, -useful expressive power, and -good algorithmic properties? (Like the boolean theory of -regularity.)

Quantitative Language Inclusion x: behaviors w: observations (infinite words) A,B: systems A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w } 8 w : A(w) · B(w) For interesting cases (e.g. nondeterministic sup limavg), open or undecidable.

BUT ... We know how to solve games with quantitative objectives (e.g. limavg = mean payoff).

BUT ... We know how to solve games with quantitative objectives (e.g. limavg = mean payoff). There is a natural game-theoretic “satisfaction relation”: simulation

Simulation Preorder a b b a a 1 a b

Simulation Game Player System: chooses a transition of the system Player Property: matches the letter by choosing a transition of the property Player System wins if Player Property cannot match: System incorrect w.r.t. Property

Quantitative Simulation Game for Incorrect Systems Player System: chooses a transition of the system Player Property: matches the letter by choosing a transition of the property (weight 0), or chooses an illegal transition (weight 1) Player System tries to make Player Property choose as many illegal transitions as possible: maximize limavg of weights The more illegal transitions of the Property are needed to simulate the System, the greater the distance.

Quantitative Simulation Distance b b a a 1/3 1/4 b b b b a

Quantitative Simulation Game for Correct Systems Player System: chooses a transition of the system (weight 0), or chooses an illegal transition (weight 1) Player Property: matches the letter by choosing a transition of the property Player Property tries to make Player System choose as many illegal transitions as possible: maximize limavg of weights The more illegal transitions of the System can be tolerated without violating the Property, the greater the robustness.

Quantitative Robustness Distance 2/3 1/3 a a b a

Qualitative Systems Theories Property Analysis Yes/No

Qualitative Systems Theories Property Synthesis Correct System

Qualitative Systems Theories -Regular Automaton Graph Game with -Regular Objective Correct System = Winning Strategy

Quantitative Systems Theories Quantitative Property Synthesis Optimal System

Quantitative Systems Theories Weighted Automaton Graph Game with Quantitative Objective Optimal System = Optimal Strategy

Buchi Automaton pq pq pq pq pq pq pq pq  (p ) } q)

Weighted Limavg Automaton 1 pq: 0 pq: 0 pq: 0 pq: 1 pq: 1 pq: 1 pq: 0 pq: 0 Following p, all steps until the next q are penalized.

Weighted Limavg Automaton 2 pq: 0 pq: 0 pq: 1 pq: 0 pq: 0 pq: 0 pq: 0 pq: 0 All “unnecessary” q are penalized.

Conclusions -We need to move from boolean correctness criteria to quantitative system preference metrics. -“Quantitative” is more than “timed” and “probabilistic.” -Games with quantitative objectives offer algorithmic solutions. -Weighted automata offer a natural quantitative specification language, but what is the corresponding temporal logic?