Monte Carlo Model Checking Scott Smolka SUNY at Stony Brook Joint work with Radu Grosu Main source of support: ARO – David Hislop

Model Checking ? Is system S a model of formula φ?

Automata-Theoretic Approach [Vardi & Wolper LICS’86] Büchi automaton is an automaton over infinite words. Acceptance condition: a final state must be visited infinitely often. Every LTL formula  can be translated to a Büchi automaton whose language is set of infinite words satisfying . State transition graph of S can also be viewed as a Büchi automaton.

LTL Model Checking Take product B S  B  of: –Büchi automaton for S ’s state transition graph, –Büchi automaton for LTL formula  . Check for emptiness: –L ( B S  B  )   iff L ( B S )  L ( B  )

Emptiness Checking Checking non-emptiness is equivalent to finding an accepting cycle reachable from initial state. Double Depth-First Search (DDFS) algorithm can be used to search for such cycles, and this can be done on-the-fly! s1s1 s2s2 s3s3 sksk s k-2 s k-1 s k+1 s k+2 s k+3 snsn DFS 2 DFS 1

Monte Carlo Approximation Problem: Compute the mean value μ Z of a random variable Z distributed in [0,1] when an exact computation of μ Z proves intractable. with error margin  and confidence ratio . Solution: Compute an ( ,  )-approximation of  Z : Has been used to: approximate permanent of 0-1 valued matrices, volume of convex bodies, and, now, probability that S ⊨  !

Original Solution [Karp, Luby & Madras: Journal of Algorithms 1989] Compute as the mean value of N independent random variables (samples) identically distributed according to Z : Compute N using the Zero-One estimator theorem: Problems: is unknown and can be large.

Optimal Approx Algorithm (OOA) [Dagum, Karp, Luby & Ross: SIAM J Comput 2000] Compute N using generalized Zero-One estimator: Apply sequential analysis (prediction/correction): 1. Assume  2 is small and compute with SRA( ) 2. Compute  using and 3. Use to correct N and. Expected number of samples is optimal to within a constant factor!

Monte Carlo Model Checking Input: Büchi automaton B=(Σ,Q,Q 0,δ,F) Sample Space: lasso-like reachable cycles: –Let U be the set of all lassos, –Let G be the set of all accepting lassos. Probability: p = |G|/|U| of an accepting lasso. Random variable Z having: –outcome 0 with probability p –outcome 1 with probability 1-p

Monte Carlo Model Checking Use OAA to produce an ( ε,δ )-approximation of μ Z If B = B S  B  then μ Z is expectation that S ⊨  ! Obtain sample by random walk through B, storing indices of states encountered in hash table. Accepting lasso is a counter-example => One-sided error! We call resulting algorithm MC 2.

Monte Carlo Model Checking Theorem: Given a Büchi automaton B, error margin ε, and confidence ratio δ, MC 2 computes an ( ε,δ )- approximation of probability that L(B) = Ø. Theorem: For the model-checking problem S ╞ φ, MC 2 runs in expected time O(N∙(| S | + |φ|)) and uses expected space O(| S | + |φ|). Cf. DDFS which runs in O(2 | S |+|φ| ) time and space.

Implementation Implemented DDFS and MC 2 in jMocha model checker for synchronous systems specified using Reactive Modules. Performance and scalability of MC 2 compares very favorably to DDFS. Observed in Dining Philosophers that probability of deadlock freedom increases linearly with number of philosophers.

Deadlock freedom: G~(pc1 = wait &…& pcn = wait) Experimental Results

Conclusions MC 2 is first randomized, Monte Carlo algorithm for the classical problem of temporal-logic model checking. Future Work: Use BDDs to improve run time. Also, take samples in parallel! Open Problem: Branching-Time Temporal Logic (e.g. CTL, modal mu-calculus).

Stopping Rule Algorithm (SRA) [Dagum, Karp, Luby & Ross: SIAM J Comput 2000] Innovation: computes correct N without using Theorem: E[ N ] ≤ 4 ln(2/  ) / μ Z  2 ;  = 4 ln(2/  ) /  2 ; for (N=0, S=0; S≤  ; N++) S=S+Z N ; = S/N; return ; Problem: is in most interesting cases too large.

Related Work Heimdahl et al.’s Lurch debugger. Mihail & Papidimitriou (and others) use random walks to sample system state space. Herault et al. use bounded model checking to compute an (ε,δ)-approximation for “positive LTL”. Probabilistic Model Checking of Markov Chains: ETMCC, PRISM, PIOAtool, and other.

Starvation freedom: G F (pc1 = eat) Experimental Results