Kim G. Larsen Peter Bulychev, Alexandre David, Dehui Du, Axel Legay, Guangyuan Li, Marius Mikucionis, Danny B. Poulsen, Amalie Stainer, Zheng Wang TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A AA A AA AA AA A A A Statistical Model Checking, Refinement Checking, Optimization,.. Stochastic Hybrid Systems Statistical Model Checking, Refinement Checking, Optimization,.. for Stochastic Hybrid Systems

IDEA 4 CPS Foundations for CPS FORMATS, Sep 2012 Kim Larsen [2] I D E A Inst. of Software Chinese Academy of Sciences, Beijing, China Technical University of Denmark, Lyngby, Denmark East China Normal University, Shanghai, China Aalborg University, Denmark

Cyber-Physical Systems  Complex systems that tightly integrate multiple, networked computing elements (hardware and software) with non- computing physical elements such as electrical or mechanical components. FORMATS, Sep 2012 Kim Larsen [3] Smart X Hybrid Systems

Trustworthiness  (TCPS).. by which we mean CPS on which reliance can justifiably be placed.  (wiki).. of a component is.. defined by how well it secures a set of functional and non-functional properties, deriving from its architecture, construction, and environment, and evaluated as appropriate. FORMATS, Sep 2012 Kim Larsen [4] Probabilities Confidence

Current State FORMATS, Sep 2012 Kim Larsen [5] Stochastic Hybrid Systems Probabilistic Temporal Logic Statistical Model Checking

Overview  Stochastic Hybrid Systems  Weighted Metric Interval Temporal Logic  UPPAAL SMC (Demo)  Energy Aware Buildings  SMC and Refinement Checking  SMC and Optimization  Conclusion FORMATS, Sep 2012 Kim Larsen [6]

Stochastic Hybrid Systems  A Bouncing Ball FORMATS, Sep 2012 Kim Larsen [7/52] Simulate 5 [<=20] {p} Pr[ (time >=12 && p >= 4))

Hybrid Automata H=(L, l 0, §, X,E,F,Inv) where  L set of locations  l 0 initial location  § = § i [ § o set of actions  X set of continuous variables valuation º : X ! R (=R X )  E set of edges (l,g,a, Á,l’) with g µ R X and Á µ R X £ R X and a 2 §  For each l a delay function F(l): R >0 £ R X ! R X  For each l an invariant Inv(l) µ R X FORMATS, Sep 2012 Kim Larsen [8]

Hybrid Automata FORMATS, Sep 2012 Kim Larsen [9] Semantics  States (l, º ) where º 2 R X  Transitions (l, º ) ! d (l, º ’) where º ’=F(l)(d)( º ) provided º ’ 2 Inv(l) (l, º ) ! a (l’, º ’) if there exists (l,g,a, Á,l’) 2 E with º 2 g and ( º, º ’) 2 Á and º ’ 2 Inv(l’)

Stochastic Hybrid Automata FORMATS, Sep 2012 Kim Larsen [10] * Dirac’s delta functions for deterministic delays / next state Stochastic Semantics For each state s=(l, º ) Delay density function * ¹ s : R >0 ! R Output Probability Function ° s : § o ! [0,1] Next-state density function * ´ a s : St ! R where a 2 §.

Stochastic Hybrid Automata FORMATS, Sep 2012 Kim Larsen [11] * Dirac’s delta functions for deterministic delays / next state Stochastic Semantics For each state s=(l, º ) Delay density function * ¹ s : R >0 ! R Output Probability Function ° s : § o ! [0,1] Next-state density function * ´ a s : St ! R where a 2 §. UPPAAL Uniform distributions (bounded delay) Exponential distributions (unbounded delay) Syntax for discrete probabilistic choice Distribution on next state by use of random Hybrid flow by use of ODEs Networks Repeated races between components for outputting

Pr[c T.T3) ? Stochastic Semantics NTAs Composition = Race between components for outputting Kim Larsen [12] FORMATS, Sep 2012 Pr[time T.T3) ?

Stochastic Semantics of NHAs Assumptions: Component SHAs are: Input enabled Deterministic Disjoint set of output actions ¼ ( s, a 1 a 2 …. a n ) : the set of maximal runs from s with a prefix t 1 a 1 t 2 a 2 … t n a k for some t 1,…, t n 2 R. Kim Larsen [13] FORMATS, Sep 2012

Metric Interval Temporal Logic  MITL ≤ syntax: ϕ ::=σ | ¬ϕ | ϕ 1 ∧ ϕ 2 | Oϕ | ϕ 1 U ≤d ϕ 2 where d ∈ ℕ is a natural number.  MITL ≤ semantics [ r=(a 1,t 1 )(a 2,t 2 )(a 3,t 3 ) … ]:  r ⊨σ if a 1 = σ  r ⊨¬ϕ if r ⊭ ϕ  r ⊨ ϕ 1 ∧ ϕ 2 if r ⊨ ϕ 1 and r ⊨ ϕ 2  r ⊨Oϕ if (a 2,t 2 )(a 3,t 3 )… ⊨ ϕ  r ⊨ ϕ 1 U ≤d ϕ 2 if 9 i. (a i,t i )(a i+1,t i+1 )… ⊨ ϕ 2 with t 1 +t 2 +…+t i ≤d and (a j,t j )(a j+1,t j+1 )… ⊨ ϕ 1 for j<i FORMATS, Sep 2012 Kim Larsen [14]

Logical Properties– WMITL FORMATS, Sep 2012 Kim Larsen [15] MODEL M Á = Pr M ( Á ) = ??

Statistical Model Checking FORMATS, Sep 2012 Kim Larsen [16] M Á µ, ² Generator Validator Core Algorithm Inconclusive Pr M ( Á ) 2 [a- ²,a+ ² ] with confidence µ p, ® Pr M ( Á ) ¸ p at significance level ® } < T p [FORMATS11, RV12]

Logical Properties– WMITL FORMATS, Sep 2012 Kim Larsen [17] 95% confidence interval: [0.215,0.225] MODEL M OBSERVER (det) Á =

Statistical Model Checking [LPAR2012] FORMATS, Sep 2012 Kim Larsen [18] M Á µ, ² Generator Validator Core Algorithm Inconclusive Pr M ( Á ) 2 [a- ²,a+ ² ] with confidence µ p, ® Pr M ( Á ) ¸ p at significance level ® CASAAL OÁOÁ UÁUÁ AÁAÁ } acc M | O Á M | U Á

Experiments FORMATS, Sep 2012 Kim Larsen [19] How exact is the O/U? 1000 random formulas 2, 3, 4 actions 15 connectives New exact method for full MITL [a,b] using rewriting [RV12]

Energy Aware Buildings Fehnker, Ivancic. Benchmarks for Hybrid Systems Verification. HSCC04 With Alexandre David, Dehui Du Marius Mikucionis Arne Skou

Stochastic Hybrid Systems FORMATS, Sep 2012 Kim Larsen [21] on/off Room 1 Room 2 Heater simulate 1 [<=100]{Temp(0).T, Temp(1).T} simulate 10 [<=100]{Temp(0).T, Temp(1).T} Pr[ Temp(0).T >= 10) Pr[ Temp(1).T 30) >= 0.2

Framework FORMATS, Sep 2012 Design Space Exploration Kim Larsen [22]

Rooms & Heaters – MODELS FORMATS, Sep 2012 Kim Larsen [23]

Control Strategies – MODELS FORMATS, Sep 2012 Temperature Threshold Strategies Kim Larsen [24]

Weather & User Profile – MODELS FORMATS, Sep 2012 Kim Larsen [25]

Results – Simulations FORMATS, Sep 2012 simulate 1 [<=2*day] { T[1], T[2], T[3], T[4], T[5] } simulate 1 [<=2*day] { Heater(1).r, Heater(2).r, Heater(3).r } Kim Larsen [26]

Results – Discomfort FORMATS, Sep 2012 Pr[ time>0 && Monitor.Discomfort) Kim Larsen [27]

Results – Comfort FORMATS, Sep 2012 Pr[comfort time>=2*day) Kim Larsen [28]

Results – Energy FORMATS, Sep 2012 Pr[Monitor.energy time>=2*day) Kim Larsen [29]

Result – User Profile FORMATS, Sep 2012 Pr[Monitor.energy time>=2*day) Kim Larsen [30]

Refinement FORMATS, Sep 2012 Kim Larsen [31]

const int Tenv=7; const int k=2; const int H=20; const int TB[4]= {12, 18, 25, 28}; Controller Synthesis FORMATS, Sep 2012 Kim Larsen [32] on/off ?? const int Tenv=7; const int k=2; const int H=20; const int TB[4]= {12, 18, 25, 28}; low normal high critical high critical low Room Heater

Unfolding FORMATS, Sep 2012 Kim Larsen [33] low normal high critical high critical low

Timing FORMATS, Sep 2012 Kim Larsen [34] low normal high critical high critical low

TA Abstraction FORMATS, Sep 2012 Kim Larsen [35] const int uL[3]={3,5,2}; const int uU[3]={4,6,3}; const int dL[3]={3,9,15}; const int dU[3]={4,10,16}

Validation by Simulation FORMATS, Sep 2012 Kim Larsen [36]

Validation by Simulation FORMATS, Sep 2012 Kim Larsen [37] const int uL[3]={3,8,2}; const int uU[3]={4,9,3}; const int dL[3]={3,9,15}; const int dU[3]={4,10,16}

Optimization FORMATS, Sep 2012 Kim Larsen [38]

Time Bounded L-problem [Qest12] WATA, Dresden, May 30, 2012 Kim Larsen [39] simulate 1 [time<=5] {C, x, y} Problem: Determine schedule that maximizes time until out of energy

Time Bounded L-problem [Qest12] WATA, Dresden, May 30, 2012 Kim Larsen [40] Pr[time C<0 )

TEST Time Bounded L-problem [Qest12] WATA, Dresden, May 30, 2012 Kim Larsen [41] simulate [time =7 && Test.GOOD Pr [time time>=7 && Test.GOOD Can we do better? Can we do better?

RESTART Method FORMATS, Sep 2012 Kim Larsen [42]

Meta Modeling FORMATS, Sep 2012 Kim Larsen [43] RESTART Approach

Meta Modeling FORMATS, Sep 2012 Kim Larsen [44] Direct Approach

Meta Analysis FORMATS, Sep 2012 Kim Larsen [45] Direct Approach RESTART Approach

Meta Analysis FORMATS, Sep 2012 Kim Larsen [46]

Meta Analysis FORMATS, Sep 2012 Kim Larsen [47]

Other Case Studies FIREWIRE BLUETOOTH 10 node LMAC ROBOT Kim Larsen [48] FORMATS, Sep 2012 Energy Aware Buildings Genetic Oscilator (HBS) Schedulability Analysis for Mix Cr Sys Passenger Seating in Aircraft

Contribution & More  Natural stochastic semantics of networks of stochastic hybrid systems.  Efficient implementation of SMC algorithms:  Estimation of  Sequential testing ¸ p  Sequential probability comparison ¸  Parameterized comparison  Distributed Implementation of SMC ! FORMATS, Sep 2012 Kim Larsen [49]

Thank You ! FORMATS, Sep 2012 Kim Larsen [50]