ECDAR Composition of Real-Time Specifications — Revisited Kim Guldstrand Larsen Aalborg University, DENMARK

Observations Kim G Larsen 2 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan

Observational Equivalence – Revisited Kim G Larsen 3 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan CWB Temporal Logic of Actions TLC Calculus of Communicating Systems Need for sound compositional specification formalisms supporting step-wise development and design of concurrent real-time systems

Context Dependent Bisimulation Modal Transition Systems Probabilistic MTS Interval Markov Chains Timed MTS UPPAAL Parameterized MTS Weighted MTS Dual-Priced MTS Modal Contracts ECDAR 2011 Constraint Markov Chains 2010 APAC 2012 Bisimulation 4 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan CWBTAU

Context Dependent Bisimulation Modal Transition Systems Probabilistic MTS Interval Markov Chains Timed MTS UPPAAL Parameterized MTS Weighted MTS Dual-Priced MTS Modal Contracts ECDAR 2011 Constraint Markov Chains 2010 APAC 2012 Bisimulation 5 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan CWBTAU

Specification Theory Imp: set of implementations Labelled Transition Systems Spec: set of specifications

Operations on Specifications  Structural Composition:  Given S 1 and S 2 construct S 1 par S 2 such that | S 1 par S 2 | = |S 1 | par |S 2 |  · should be precongruence wrt par to allow for compositional analysis !  Logical Conjunction:  Given S 1 and S 2 construct S 1 Æ S 2 such that |S 1 Æ S 2 | = |S 1 | Å |S 2 |  Quotienting:  Given overall specification T and component specification S construct the quotient specification T\S such that S par X · T iff X · T\S 7 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan

Modal Transition Systems  MTS is an automata-based specification formalism  MTS allow to express that certain actions may or must happen in their implementation  MTS supports all the required operations on specifications (conjunction, parallel composition, quotienting).  Applications in component-based software development, interface theories, modal abstractions and program analysis. 8 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan [L. & Thomsen 88 Boudol & L. 90]

Example – Tea-Coffee Machines 9 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan cointeacoffeecointeacoffee cointeacoffee cointeacoin Specifications Refinement Implementations coin coffee tea

MTS Definition  An MTS is a triple (P,  ,  } ) where P is a set of states and   µ  } µ P £ Act £ P If    =  } then the MTS is an implementation.  R µ P £ P is a modal refinement iff whenever (S,T) 2 R then i) whenever S-a-> } S’ then T-a-> } T’ for some T’ with (S’,T’) 2 R ii) whenever T-a->  T’ then S-a->    S’ for some S’ with (S’,T’) 2 R We write S ≤ m T whenever (S,T) 2 R for some modal refinement R. 10 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan

Example – Tea-Coffee Machines 11 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan cointeacoffeecointeacoffee cointeacoffee cointea coin coffee tea coin Specifications Refinement Implementations ≤ ≤ ≤ ≤ tea

MTS Operators 12 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan s 1 || s 2 s 1 \ s 2 Synchronous Parallel Composition Quotienting Conjunction s 1 Æ s 2 Refinment & Consistency Checking are PTIME-complete

Context Dependent Bisimulation Modal Transition Systems Probabilistic MTS Interval Markov Chains Timed MTS UPPAAL Parameterized MTS Weighted MTS Dual-Priced MTS Modal Contracts ECDAR 2011 Constraint Markov Chains 2010 APAC 2012 Bisimulation 13 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan CWBTAU

Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan SEMANTICS: (A,x=0) – 3.14  (A,x=3.14) - a?  (B,x=3.14)  (A,x=0)  (A,x=5.23) - a?  (B,x=5.23)  (ERROR, x=5.23) Extended Kim G Larsen 14 Clocks Channels Networks Integer variables Structure variables, clocks, channels User defined types and functíons Timed Automata

Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan int UT (int X, int Y) { return (X+1)*Y; } const int N = 10; const int D = 30; const int d = 4; typedef int[0,N-1] id_t; broadcast chan rec[N]; broadcast chan w[N]; Extended Clocks Channels Networks Integer variables Structure variables, clocks, channels User defined types and functíons Kim G Larsen 15

S S Real-Time version of Milner’s Scheduler Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan N0N0 N0N0 N1N1 N1N1 N2N2 N2N2 NiNi NiNi N i+1 w0w0 w1w1 w2w2 wiwi w i+1 rec 1 rec 2 rec i rec i+1 rec 0 Kim G Larsen 16

Simulation & Verification Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan A[] not Env.ERROR A[] forall (i:id_t) forall (j:id_t) ( Node(i).Token and Node(j).Token imply i==j) Kim G Larsen 17

Compositional Verification Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan SubSpec 1 SubSpec 2 SubSpec 3 A[] not Env.ERROR A[] forall (i:id_t) forall (j:id_t) ( Node(i).Token and Node(j).Token imply i==j) Kim G Larsen 18

Context Dependent Bisimulation Modal Transition Systems Probabilistic MTS Interval Markov Chains Timed MTS UPPAAL Parameterized MTS Weighted MTS Dual-Priced MTS Modal Contracts ECDAR 2011 Constraint Markov Chains 2010 APAC 2012 Bisimulation 19 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan CWBTAU

Timed MTS, Refinements & Implementations 20 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan [CAV93] Karlis Cerans, Jens Chr. Godskesen, Kim Guldstrand Larsen: Timed Modal Specification - Theory and Tools. CAV 1993 [EMSOFT02] Luca de Alfaro, Thomas A. Henzinger, Mariëlle Stoelinga: Timed Interfaces. EMSOFT 2002 An Implementation Inconsistent

Timed Game Automata & Synthesis Problems to be considered: - Does there exist a winning strategy? - If yes, compute one (as simple as possible) controllable uncontrollable Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 21

Computing Winning States Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 22 Backwards Fixed-Point Computation

Reachability Games Backwards Fixed-Point Computation Theorem: The set of winning states is obtained as the least fixpoint of the function: X   (X) [ Goal cPred(X) = { q 2 Q | 9 q’ 2 X. q  c q’} uPred(X) = { q 2 Q | 9 q’ 2 X. q  u q’} Pred t (X,Y) = { q 2 Q | 9 t. q t 2 X and 8 s · t. q s 2 Y C }  (X) = Pred t [ X [ cPred(X), uPred(X C ) ] Definitions X Y Pred t (X,Y) Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 23

Decidability of Timed Games Theorem [AMPS98,HK999] Reachability and safety timed games are decidable and EXPTIME-complete. Futhermore memoryless and ”region-based” strategies are sufficient. Theorem [AM99,BHPR07,JT07] Optimal-time reachability timed games are decidable and EXPTIME-complete. Algorithm [CDFLL05,BCDFLL07] Efficient ”zone-based”, on-the-fly synthesis algorithm for (optimal-time) rechability and safety timed games. (UPPAAL Tiga) [AM99] Asarin, Maler: As soon as possible: time optimal control for timed automata. HSCC99. [BHPR07] Brihaye, Henziunger, Prabhu, Raskin: Minimum-time reachability in timed-games. ICALP07. [JT07] Jurdzinski, Trivedi: Rechability-time games on timed automata. ICALP07. [CDFLL05] Cassez, David, Fleury, Larsen, Lime: Efficient On-the-Fly Algorithms for the Analysis of Timed Games. CONCUR 2005 [BCDFLL07] Behrmann, Cougnard, David, Fleury, Larsen, Lime: UPPAAL-Tiga: Time for Playing Games! CAV 2007 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 24

Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Timed I/O Aut.: A Modern University coin pub tea cof MachineResearcher Administration grant patent UNIVERSITY Input: control. (required) Output: uncontrol. (allowed) Input: control. (required) Output: uncontrol. (allowed) Kim G Larsen 25

Overall Specification coinpub tea cof MachineResearcher Administration grant patent grantpatent ¸ ? Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 26

Timed I/O Transition Systems St touch? dim! 1.4 off! Implementations Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 27

Refinement = Timed Alternating Simulation Intuition: S leaves less choices than T for an implementation. Intuition: S leaves less choices than T for an implementation. Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 28

Refinement (example) T A (S) B (T) INC UNI Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 29

Timed Game Refinement as a Game A AiAi ClCl gigi hlhl a? o! … … B BjBj DmDm ujuj vmvm a? o! … … IAIA IBIB S T slsl riri tjtj pmpm not A · B iff AxB sat control: A<> Error not A · B iff AxB sat control: A<> Error Error I A : I B U U A,B ujuj a? tjtj hlhl o! slsl gigi a? riri vmvm o! pmpm : G : V A i,B j C l,D m … … … … FORMATS09 Optimized Refinement Algorithm Timed I/O Automata refuter verifier Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 30

Refinement in ECDAR Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 31

More Refinement.. In ECDAR coinpub tea cof MachineResearcher Administration grant patent grantpatent · ????? Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 32

Consistency S1S1 S3S3 S2S2 S4S4 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 33

Consistency  (X) = Err [ Pred t [ X [ iPred(X), oPred(X C ) ] Theorem A specificiation (state) s is inconsistent iff s 2 ¹ X. ¼ (X) Definitions Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Pruned Version S Kim G Larsen 34

Conjunction, S Æ T A AiAi ClCl gigi hlhl a? o! … … B BjBj DmDm ujuj vmvm a? o! … … IAIA IBIB A,B A i,B j g i Æ u j a? S T o! h l Æ v m C l,D m slsl riri tjtj pmpm r i [ tj IA Æ IBIA Æ IB sl [ pmsl [ pm Theorem S Æ T · S S Æ T · T (U · S) and (U · T) ) U · (S Æ T) Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 35

Conjunction, Ex. S T S Æ T Clearly Inconsistent ! Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 36

Composition, S|T Classical rules for Composition of I/O transition Systems Theorem If A 1 · B 1 and A 2 · B 2 then A 1 |A 2 · B 1 |B 2 Theorem If A 1 · B 1 and A 2 · B 2 then A 1 |A 2 · B 1 |B 2 coin?pub! tea cof MachineResearcher Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 37

Quotienting, T\S T S i? X oX!oX! oS!oS! A AiAi CiCi gigi hihi oS!oS! … … B BjBj DjDj ujuj vjvj oS!oS! … … IAIA IBIB T S sisi riri tjtj pjpj oX!oX!kiki qiqi … EiEi oX?oX?wjwj æjæj … FiFi Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 38

Quotienting, T\S T S i? X oX!oX! oS!oS! A AiAi CiCi gigi hihi oS!oS! … … B BjBj DjDj ujuj vjvj oS!oS! … … IAIA IBIB T S sisi riri tjtj pjpj oX!oX!kiki qiqi … EiEi oX?oX?wjwj æjæj … FiFi A\B IA Æ : IBIA Æ : IB § UNI IB Æ : IAIB Æ : IA i? INC h i,vj os?os? C i \ D j : H,vj os?os? INC : V os?os? UNI k i,wj ox!ox! q i,æ j E i \ F j g i,u j i? s i,p j r i,t j A i \ B j T\S Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 39

Quotienting, T\S T S i? X oX!oX! oS!oS! A AiAi CiCi gigi hihi oS!oS! … … B BjBj DjDj ujuj vjvj oS!oS! … … IAIA IBIB T S sisi riri tjtj pjpj oX!oX!kiki qiqi … EiEi oX?oX?wjwj æjæj … FiFi A\B IA Æ : IBIA Æ : IB § UNI IB Æ : IAIB Æ : IA i? INC h i,vj os?os? C i \ D j : H,vj os?os? INC : V os?os? UNI k i,wj ox!ox! q i,æ j E i \ F j g i,u j i? s i,p j r i,t j A i \ B j Theorem (S | X) · T iff X · (T\S) Theorem (S | X) · T iff X · (T\S) T\S Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 40

Quotienting, ”Application” coinpub tea cof MachineResearcher Administration grant patent grantpatent Specification · coinpub tea cof MachineResearcher Spec \ Adm · IFF Spec\Adm u · 20 Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 41

Compositional Refinement Checking … · C1C1 C2C2 CnCn C3C3 … C2C2 CnCn C3C3 S S \ C 1 · iff P( S \ C 1 ) iff … CnCn C3C3 · P( P(S C 1 ) \C 2 ) iff … … Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Andersen: Partial MC & Laroussinie, L.: CMC Tool Kim G Larsen 42

Assume-Guarantee Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan ButA ButB Good Bad GuaranteeAssumption A>>G = (A | G) \ A Kim G Larsen 43 Properties  (A | G) · ¸ (A | A>>G )  A>>G ¸ G  A · A’ ) A>>G ¸ A’>> G  G · G’ ) A>>G · A>>G’ Properties  (A | G) · ¸ (A | A>>G )  A>>G ¸ G  A · A’ ) A>>G ¸ A’>> G  G · G’ ) A>>G · A>>G’

Assume-Guarantee Reasoning Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan A, G A 1, G 1 A 2, G 2 Proof Rule: A>>G ¸ ( A 1 >>G 1 | A 2 >>G 2 ) Proof Rule: A>>G ¸ ( A 1 >>G 1 | A 2 >>G 2 ) Kim G Larsen 44 FASE’12: Moving from Specifications to Contracts in Component-Based Design

Milner’s Scheduler Compositionaly Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan S S N0N0 N0N0 N1N1 N1N1 N2N2 N2N2 NiNi NiNi N i+1 w0w0 w1w1 w i+1 rec 1 rec 2 rec i rec i+1 rec 0 w2w2 wiwi Find SS i and verify: 1. N 1 · SS 1 2. SS 1 | N 2 · SS 2 3. SS 2 | N 3 · SS 3 … … n. SS n-1 | N n · SS n n+1. SS n | N 0 · SPEC Find SS i and verify: 1. N 1 · SS 1 2. SS 1 | N 2 · SS 2 3. SS 2 | N 3 · SS 3 … … n. SS n-1 | N n · SS n n+1. SS n | N 0 · SPEC SPEC Kim G Larsen 45

Milner’s Scheduler Compositionaly Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan S S N0N0 N0N0 N1N1 N1N1 N2N2 N2N2 NiNi NiNi N i+1 w0w0 w1w1 w i+1 rec 1 rec 2 rec i rec i+1 rec 0 w2w2 wiwi Find SS i …… A1A1 G A2A2 No new rec[1]! until rec[i+1]? After rec[1]? then rec[i+1]! within [d*i,D*i] After rec[1]? then rec[i+1]! within [d*i,D*i] Kim G Larsen 46 rec[1]! occurs with > N*d time sep. rec[1]! occurs with > N*d time sep.

Milner’s Scheduler Compositionaly Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan S S N0N0 N0N0 N1N1 N1N1 N2N2 N2N2 NiNi NiNi N i+1 w0w0 w1w1 w i+1 rec 1 rec 2 rec i rec i+1 rec 0 w2w2 wiwi A1A1 G A2A2 Take SS i = (A 1 & A 2 )>>G Kim G Larsen 47

Milner’s Scheduler Compositionaly Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan S S N0N0 N0N0 N1N1 N1N1 N2N2 N2N2 NiNi NiNi N i+1 w0w0 w1w1 w i+1 rec 1 rec 2 rec i rec i+1 rec 0 w2w2 wiwi Take SS i = (A 1 & A 2 )>>G Kim G Larsen 48

Experiments Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan D=30 Kim G Larsen 49

References  LICS88: Kim Guldstrand Larsen, Bent Thomsen: A Modal Process Logic.  EMSOFT 2002: Luca de Alfaro, Thomas A. Henzinger, Mariëlle Stoelinga: Timed Interfaces.  FMCO’09: Methodologies for Specification of Real-Time Systems Using Timed I/O Automata  WADT’10: An Interface Theory for Timed Systems  ATVA’10: ECDAR: An Environment for Compositional Design and Analysis of Real Time Systems  HSCC’10:Timed I/O Automata: A Complete Specification Theory for Real- time Systems  STTT’12: Compositional verification of real-time systems using Ecdar  QEST’10: Compositional Design Methodology with Constraint Markov Chains  QEST’11: APAC: A Tool for Reasoning about Abstract Probabilistic Automata  FASE’12: Moving from Specifications to Contracts in Component-Based Design  FMSD’13:: Weighted modal transition systems.  Sci. Comput. Prg ‘14: A modal specification theory for components with data.    Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Kim G Larsen 50 Timed TLA  UPPAAL ECDAR ?

Context Dependent Bisimulation Probabilistic MTS Interval Markov Chains UPPAAL APAC Colloquium in Honor of Martin Abadi, June 25-26, 2015, Cachan Congratulation !!