Abstract Verification is traditionally done by determining the truth of a temporal formula (the specification) with respect to a timed transition system such as a timed automaton (the abstract model). The concrete model is then proved to be bisimilar to the specification. The temporal logics usually have the property that two bisimilar states satisfy the same formula, and thus we finally get that the implementation model satisfies the formal specification. We look at a quantitative verification methodology where each formula has a numerical value in the interval [0,1] instead of just boolean values. We also look at quantitative notions of bisimilarity which group states according to how close they are to each other in terms of behaviour. November 18, 2004 Quantitative Verification For Real Time Systems Prof Thomas Henzinger Rupak Majumdar Vinayak Prabhu Example: Train Gate Controller Approach x:=0 T1 T2 x· 5 T3 x· 5 T2 x· 5 x>2, In Out Exit Train Lower y:=0 G1 G2 y· 1 G3 G4 y· 2 Down Raise Exit Gate y:=0 C2 z· 1 C3 z· 1 C1 Exit, z:=0 Raise Approach, z:=0 z=1, Lower Controller x,y,z are clocks which increase at rate 1 inside locations. “Approach, Lower” etc are synchronization signals. A specification might be that the gates be closed when the Train enters the crossing. CTL expresses this as 8  ((T3 Ç T4) ! G3) We may be also interested in response properties: How soon do we get to a “desired” state? Eg. Whenever a request is made, it is granted (perhaps after some time) In the train-gate example: We can always get to a state where the gate is raised (non- blocking requirement) CTL: 8  9} G1 9} P True at state s if from s we can get to a state s’ where P is satisfied. We may also want to know just how quickly we reach P (the sooner the better) – give a quantitative value to the formula. Also Discount : a P now is better than a P later. 8  P : we want P to hold forever (safety specification). Quantitatively: How long does P hold? Standard Notion of Bisimilarity MA: an abstract model of a controller MI: Concrete implementation – more details - perhaps related to the implementation platform, or details left out by the designer. Does MI do what the control designer specified? Formally: A trace is the observable behavior of a system (internal variables and details are hidden). Is the trace language of MI = trace language of MA ? Undecidable for timed automata (there cannot exist any algorithm which answers the question in full generality). Sufficient conditions? Bisimilarity States s1, s2 are bisimilar if If s1 can take a “p” transition then so can s2, such that the next states are again bisimilar. If s2  If s1,s2 are bisimilar then they generate the same behaviors. Utilizes the fact that closely related states generate similar behaviors Two notions of Bisimilarity for Timed Systems: Time abstract bisimilarity does not take time into account. A transition taken by one state at time 3 can be matched by the other state at any time. Timed Bisimilarity requires that a transition at time 3 must be matched by a transition at time 3. Timed Bisimilarity is strictly finer than time abstract bisimilarity. Quantitative Extension What if we allow a non-zero (but finite) slack in the matching of transitions? In between time abstract and timed bisimilarity. Open question whether this problem is decidable for timed automata. We believe it is. It quantifies just how close a system MI is to system MA. Generally we are satisfied if a system is “close enough” to the specification. In practice this degree of “closeness” is determined by testing. We hope formal verification methods can be extended to this area. Results We can compute quantitative bisimilarity on weighted graphs (graphs with each edge labelled with a union of real intervals with rational endpoints). We can also compute the values of quantitative formulae on the graphs. We have also shown that the formalism makes sense: if two states are epsilon bisimilar then the quantitative values of the formulae are again close (continuity theorem) Moreover, if s1 is epsilon bisimilar to s2, and if s1 satisfies a formula  (in the standard sense) then s2 satisfies a delta relaxed version of  (delta depending on epsilon) Future work: Instead of getting exact values, getting upper bounds may simplify the problem. Extension to more general timed and hybrid models.