Model-Checking and Simulation for Stochastic Timed Systems

Transcription

1 Model-Checking and Simulation for Stochastic Timed Systems QUASIMODO FMCO 2010, Graz Universität des Saarlandes

2 Outline 1. Stochastic Timed Automata STA Submodels Modest 2. Model-Checking mcpta PTA Case study 3. Simulation Spuriousness Nondeterminism modes Partial-order x 5

3 Stochastic Timed Automata The Modest Language Variables and assignments Processes and recursion Dynamic parallelism Probabilistic branching Random variable sampling Clocks Urgent transitions Exception handling action tick; exception excp; int j = 3; process P(int i) { clock c; urgent(c > i) tick palt { :3: par { :: P(i) :: P(j) } :5: throw(excp) } } {= j = Uniform(1, 4) =}; try { P(j) } catch excp { tau }

4 Stochastic Timed Automata Semantics: Stochastic Timed Automata (STA) clock c; real x; 48.0, { c := 0, x := Exp(1.2) }aya 2.0, Ø c 2, c 5, repair c x, a c x, failx 1.0, Ø 49.0, { c := 0 } Bohnenkamp/D Argenio/Hermanns/Katoen:nn MoDeST: A Compositional Modelingn Formalism for Hard and Softly Timed Systems

5 Stochastic Timed Automata Submodels of STA prob. distributions clocks/time nondeterminism STA GSMP PTA TA PA /MDP LTS MA/IMC CTMC DTMC arbitrary real yes arbitrary real no finite yes yes none yes yes finite no yes none no yes exp + finite exp yes exp + finite exp no finite no no simulate check

6 Analyzing STA STA/Modest Model mcpta modes Model-checking Discrete-Event Simulation for the PTA subset for the GSMP subset no infinite distributions ( no nondeterminism) PRISM Results!

7 Model-Checking mcpta: Model-check PTA specified in Modest use PRISM and digital clocks or game-based approach Modest semantics translation/ encoding Modest PTA PRISM process Receiver() { bool r_ff, r_lf, r_ab; bool bit; clock c; int rrep limit [0..4]; do { :: get_k {= c=0, bit=ab, r_ff=ff =}; do { :: urgent alt { :: when(r_ab!= bit) put_l :: when(r_ab == bit) alt { // report frame :: when(r_lf) r_ok {= rrep=3 =} :: when(!r_lf && r_ff) r_fst {= rrep=1 =} :: when(!r_lf &&!r_ff) r_inc {= rrep=2 =} }; urgent put_l {= bit=!bit =} }; alt { :: get_k {= c=0, r_ff=ff, r_lf=lf, r_ab=ab =} :: urgent(c >= TR) when(c == TR) alt { :: when(r_lf) break :: when(!r_lf) r_nok {= rrep=4 =}; break } } } } } module M n : [0..2]; [act] (n = 0) -> 0.3:(n'=1) + 0.7:(n'=2); endmodule

8 Model-Checking Case study: Bounded Retransmission Protocol channel K Sender Receiver channel L Transmit files in chunks (frames) over lossy channels alternating bit protocol with MAX retries per frame

9 Model-Checking Timed analysis with UPPAAL T Safe timeout values Probabilistic analysis with PRISM P Maximum probability for transmission failure module channelk k : [0..2]; [af] (k=0) -> 0.98:(k'=1) :(k'=2); [ag] (k=1) -> (k'=0); [TO_Msg] (k=2) -> (k'=0); endmodule

10 Model-Checking Probabilistic timed analysis with Modest Channel drops messages with a certain probability Transmission delays, sender and receiver timeouts process Channel_K() { clock c; do { :: put_k palt { :98: {= c=0 =}; invariant(c <= TD) get_k :2: {==} } }

11 Model-Checking Properties T Transfer succeeds or fails within at most 24 time units time 24 first_file_done P Worst-case probability that the sender reports failure Pmax(<> did(s_nok)) PT PT Worst-case probability of success within 64 time units Pmin(<> did(s_ok) && time 64) Worst-case expected time until transfer succeeds/fails Tmax(first_file_done)

12 Model-Checking mcpta: Fully automated, optimizing 75% reduction for WLAN case Flexible choice of analysis backend use games for time-bounded, digital clocks for expected-time properties (and use modes for very large models) Supports all Modest constructs {= backoff = DiscreteUniform(0, pow(2, bc + 4) - 1) =} instead of

13 Analyzing STA STA/Modest Model mcpta modes Model-checking Discrete-Event Simulation for the PTA subset for the GSMP subset no infinite distributions ( no nondeterminism) Results!

14 Simulation Nondeterminism denotes complete absence of information freedom of implementation Simulation explores concrete traces of the model scheduler needed to resolve nondeterminism Uniform First choice ASAP Deadline Last choice ALAP Effects on results?

15 Simulation A very simple model action a; clock c; Model-checking: T min = 3, T max = 30 Simulation: T ASAP = 6, T ALAP = 5 property tmin = Tmin(did(a)); property tmax = Tmax(did(a)); alt { :: when(c >= 5) urgent(c >= 5) τ; urgent a :: when(c <= 0) τ; when(c >= 6) urgent(c >= 6) a :: when(c == 3) τ; when(c <= 30) urgent(c >= 30) a } Uniform First choice ASAP Deadline Strict Last choice ALAP unpredictable effects

16 Simulation strict scheduler can be very restrictive + nondeterminism may be spurious try to detect spuriousness on-the-fly and ignore using methods derived from partial order reduction x := 2 y x := 3 x := 2 y x := 3 y x := 3 x := 2

17 Analyzing STA STA/Modest Model mcpta modes Model-checking Discrete-Event Simulation for the PTA subset for the GSMP subset no infinite distributions ( no nondeterminism) Results!

18 Analyzing STA mime

19 Summary Modest High-level modelling language based on STA mcpta modes mime Model-checker for PTA fully automated Simulation sound treatment of nondeterminism User-friendly integrated interface One model mcpta games digital clocks consistent results modes