UCb Symbolic Reachability and Beyound or how UPPAAL really works Kim Guldstrand Larsen

DTU March 7, 2002.Kim G. Larsen UCb 2 Timed Automata n m a Alur & Dill 1990 Clocks: x, y x 3 x := 0 Guard Boolean combination of integer bounds on clocks and clock-differences. Reset Action perfomed on clocks Transitions ( n, x=2.4, y= ) ( n, x=3.5, y= ) e(1.1) ( n, x=2.4, y= ) ( m, x=0, y= ) a State ( location, x=v, y=u ) where v,u are in R Action used for synchronization

DTU March 7, 2002.Kim G. Larsen UCb 3 n m a Clocks: x, y x 3 x := 0 Transitions ( n, x=2.4, y= ) ( n, x=3.5, y= ) e(1.1) ( n, x=2.4, y= ) e(3.2) x<=5 y<=10 Location Invariants g1 g2 g3 g4 Timed Automata Invariants Invariants ensure progress!!

DTU March 7, 2002.Kim G. Larsen UCb 4 A1 B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Init V=1 2 ´´ V Criticial Section Fischer’s Protocol analysis using zones Y<10 X:=0 Y:=0 X>10 Y>10 X<10

UCb THE UPPAAL ENGINE Symbolic Reachability Checking

DTU March 7, 2002.Kim G. Larsen UCb 6 Zones From infinite to finite State (n, x=3.2, y=2.5 ) x y x y Symbolic state (set ) (n, ) Zone: conjunction of x-y n

DTU March 7, 2002.Kim G. Larsen UCb 7 Symbolic Transitions n m x>3 y:=0 delays to conjuncts to projects to x y 1<=x<=4 1<=y<=3 x y 1<=x, 1<=y -2<=x-y<=3 x y 3<x, 1<=y -2<=x-y<=3 3<x, y=0 x y Thus (n,1 (m,3<x, y=0) a

DTU March 7, 2002.Kim G. Larsen UCb 8 A1 B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Init V=1 2 ´´ V Criticial Section Fischer’s Protocol analysis using zones Y<10 X:=0 Y:=0 X>10 Y>10 X<10

DTU March 7, 2002.Kim G. Larsen UCb 9 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case A1

DTU March 7, 2002.Kim G. Larsen UCb 10 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account X Y A1

DTU March 7, 2002.Kim G. Larsen UCb 11 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account X Y A1 10 X Y

DTU March 7, 2002.Kim G. Larsen UCb 12 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y

DTU March 7, 2002.Kim G. Larsen UCb 13 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y X Y

DTU March 7, 2002.Kim G. Larsen UCb 14 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y X Y

DTU March 7, 2002.Kim G. Larsen UCb 15 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 16 Forward Rechability Passed Waiting Final Init n,Z INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 17 Forward Rechability Passed Waiting Final Init n,Z INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 18 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 19 Canonical Dastructures for Zones Difference Bounded Matrices Bellman 1958, Dill 1989 x<=1 y-x<=2 z-y<=2 z<=9 x<=1 y-x<=2 z-y<=2 z<=9 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 D1 D2 Inclusion 0 x y z x y z ? ? Graph

DTU March 7, 2002.Kim G. Larsen UCb 20 Bellman 1958, Dill 1989 x<=1 y-x<=2 z-y<=2 z<=9 x<=1 y-x<=2 z-y<=2 z<=9 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 D1 D2 Inclusion 0 x y z Shortest Path Closure Shortest Path Closure 0 x y z x y z x y z Graph ? ? Canonical Dastructures for Zones Difference Bounded Matrices Canonical Form

DTU March 7, 2002.Kim G. Larsen UCb 21 Bellman 1958, Dill 1989 x<=1 y>=5 y-x<=3 x<=1 y>=5 y-x<=3 D Emptyness 0 y x Negative Cycle iff empty solution set Graph Canonical Dastructures for Zones Difference Bounded Matrices

DTU March 7, 2002.Kim G. Larsen UCb 22 1<= x <=4 1<= y <=3 1<= x <=4 1<= y <=3 D Future x y x y Future D 0 y x 4 3 Shortest Path Closure Remove upper bounds on clocks 1<=x, 1<=y -2<=x-y<=3 1<=x, 1<=y -2<=x-y<=3 y x y x Canonical Dastructures for Zones Difference Bounded Matrices

DTU March 7, 2002.Kim G. Larsen UCb 23 Canonical Dastructures for Zones Difference Bounded Matrices x y D 1<=x, 1<=y -2<=x-y<=3 1<=x, 1<=y -2<=x-y<=3 y x Remove all bounds involving y and set y to 0 x y {y}D y=0, 1<=x Reset y x 0 0 0

DTU March 7, 2002.Kim G. Larsen UCb 24 Improved Datastructures Compact Datastructure for Zones x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1x2 x3x x1x2 x3x x1x2 x3x Shortest Path Closure O(n^3) Shortest Path Reduction O(n^3) 3 Canonical wrt = Space worst O(n^2) practice O(n) RTSS’97

DTU March 7, 2002.Kim G. Larsen UCb 25

DTU March 7, 2002.Kim G. Larsen UCb 26

DTU March 7, 2002.Kim G. Larsen UCb 27 v and w are both redundant Removal of one depends on presence of other. v and w are both redundant Removal of one depends on presence of other. Shortest Path Reduction 1st attempt Idea Problem w <=w An edge is REDUNDANT if there exists an alternative path of no greater weight THUS Remove all redundant edges! An edge is REDUNDANT if there exists an alternative path of no greater weight THUS Remove all redundant edges! w v Observation: If no zero- or negative cycles then SAFE to remove all redundancies. Observation: If no zero- or negative cycles then SAFE to remove all redundancies.

DTU March 7, 2002.Kim G. Larsen UCb 28 Shortest Path Reduction Solution G: weighted graph

DTU March 7, 2002.Kim G. Larsen UCb 29 Shortest Path Reduction Solution G: weighted graph 1. Equivalence classes based on 0-cycles. 2. Graph based on representatives. Safe to remove redundant edges

DTU March 7, 2002.Kim G. Larsen UCb 30 Shortest Path Reduction Solution G: weighted graph 1. Equivalence classes based on 0-cycles. 2. Graph based on representatives. Safe to remove redundant edges 3. Shortest Path Reduction = One cycle pr. class + Removal of redundant edges between classes

DTU March 7, 2002.Kim G. Larsen UCb 31 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 32 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

DTU March 7, 2002.Kim G. Larsen UCb 33 INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Earlier Termination Passed Waiting Final Init n,Z k m,U n,Z Init -> Final ? n,Z 1 n,Z 2

DTU March 7, 2002.Kim G. Larsen UCb 34 Clock Difference Diagrams = Binary Decision Diagrams + Difference Bounded Matrices CDD-representations CAV99 zNodes labeled with differences zMaximal sharing of substructures (also across different CDDs) zMaximal intervals zLinear-time algorithms for set-theoretic operations. zNDD’s Maler et. al zDDD’s Møller, Lichtenberg

DTU March 7, 2002.Kim G. Larsen UCb 35

DTU March 7, 2002.Kim G. Larsen UCb 36

UCb Beyond Reachability - Bounded Liveness - (Bi) simulations

DTU March 7, 2002.Kim G. Larsen UCb 38 Logical Formulas Safety Properties: F ::=A[ ] P | E <> P Always P P ::= Proc.l | x = n | v = n | x<=n | x<n | P and P | not P | P or P | P imply P Possibly P where atomic properties Process Proc at location l clock comparison boolean combinations

DTU March 7, 2002.Kim G. Larsen UCb 39 Train Crossing River Crossing Gate Stopable Area [10,20] [7,15] Queue [3,5] appr, stop leave go empty nonempty hd, add,rem el Communication via channels and shared variable.

DTU March 7, 2002.Kim G. Larsen UCb 40 Beyound Safety Decoration TACAS98a l n Leadsto: Whenever l is reached then n is reached with t l n Decoration new clock X boolean B X:=0 B:=tt B:=ff A[] (B implies x<=t)

DTU March 7, 2002.Kim G. Larsen UCb 41 Beyond Safety Test automata TACAS98b l n l n a! b! a? x:=0 x<=t x==tb? b urgent! A[] (not T.BAD) BAD T S S

DTU March 7, 2002.Kim G. Larsen UCb 42 Timed Bisimulation Wang’91

DTU March 7, 2002.Kim G. Larsen UCb 43 Timed Simulation

DTU March 7, 2002.Kim G. Larsen UCb 44 Examples

DTU March 7, 2002.Kim G. Larsen UCb 45 Abstraction & Compositionality dealing w stateexplosion a cb a cb a cb a cb a cb a cb a cb a cb Concrete Abstract simulation

DTU March 7, 2002.Kim G. Larsen UCb 46 Abstraction Example a1a2a3a4a5 a b

DTU March 7, 2002.Kim G. Larsen UCb 47 Example Continued abstracted by

DTU March 7, 2002.Kim G. Larsen UCb 48 Proving abstractions using reachability A[] not TestAbstPoP1.BAD Recognizes all the BAD computations of PoP1

UCb