Results 1 - 10
of
10
Model Checking the Time to Reach Agreement
- FORMATS
"... The timed automaton framework of Alur and Dill is a natural choice for the specification of partially synchronous distributed systems. The past has shown, however, that verification of these systems by model checking usually is very difficult. Therefore, model checking techniques have thus far not r ..."
Abstract
-
Cited by 14 (1 self)
- Add to MetaCart
(Show Context)
The timed automaton framework of Alur and Dill is a natural choice for the specification of partially synchronous distributed systems. The past has shown, however, that verification of these systems by model checking usually is very difficult. Therefore, model checking techniques have thus far not really been used for their design, even though these techniques are widely used in other areas, e.g., hardware verification. The present paper demonstrates that the revolutionary development of both the usability and the efficiency of model checking tools may change this. It is shown that a complex partially synchronous distributed algorithm can easily be modeled with the Uppaal model checker, and that it is possible to analyze some interesting and non-trivial instances with reasonable computational resources. Clearly, such analysis results can greatly support the design of these systems: model checking tools may provide valuable early feedback on subtle design errors and hint at system invariants that can subsequently be used in the general correctness proof.
Checking Timed Büchi Automata Emptiness on Simulation Graphs
, 2006
"... This paper completes the work of [5,13] on checking language emptiness of timed Büchi automata efficiently. In [5,13] we showed how to check emptiness on the region-closed simulation graph. However, the latter is not used in practice, since its nodes are non-convex, thus, not easily representable. U ..."
Abstract
-
Cited by 7 (1 self)
- Add to MetaCart
This paper completes the work of [5,13] on checking language emptiness of timed Büchi automata efficiently. In [5,13] we showed how to check emptiness on the region-closed simulation graph. However, the latter is not used in practice, since its nodes are non-convex, thus, not easily representable. Using recent results of Bouyer [6] on simulation-graph over-approximations that preserve convexity, we show that the main result of [5,13] carries over to the zone-closed simulation graph. The nodes of the latter are convex and can be efficiently represented. The zone-closed simulation graph is used in the tools Kronos and Uppaal for checking reachability. Our result shows that these tools can be also used to check emptiness of timed Büchi automata with small modifications.
Multi-core emptiness checking of timed Buchi automata using inclusion abstraction
- In: Proceedings of the 25th International Conference on Computer Aided Verification (CAV
, 2013
"... Abstract. This paper contributes to the multi-core model checking of timed automata (TA) with respect to liveness properties, by investi-gating checking of TA Büchi emptiness under the very coarse inclusion abstraction or zone subsumption, an open problem in this field. We show that in general Büc ..."
Abstract
-
Cited by 5 (1 self)
- Add to MetaCart
(Show Context)
Abstract. This paper contributes to the multi-core model checking of timed automata (TA) with respect to liveness properties, by investi-gating checking of TA Büchi emptiness under the very coarse inclusion abstraction or zone subsumption, an open problem in this field. We show that in general Büchi emptiness is not preserved under this abstraction, but some other structural properties are preserved. Based on those, we propose a variation of the classical nested depth-first search (ndfs) algorithm that exploits subsumption. In addition, we extend the multi-core cndfs algorithm with subsumption, providing the first paral-lel LTL model checking algorithm for timed automata. The algorithms are implemented in LTSmin, and experimental evalua-tions show the effectiveness and scalability of both contributions: sub-sumption halves the number of states in the real-world FDDI case study, and the multi-core algorithm yields speedups of up to 40 using 48 cores. 1
Relaxed Clock Difference Diagrams for Timed Automata Model Checking
"... Clock Difference Diagrams (CDDs), a BDD-like data structure for model checking of timed automata, were presented in 1999. After the original article the work on them seems to have stopped, although there are still important open questions. The proposed algorithm relied on the traditionally used da ..."
Abstract
-
Cited by 1 (1 self)
- Add to MetaCart
Clock Difference Diagrams (CDDs), a BDD-like data structure for model checking of timed automata, were presented in 1999. After the original article the work on them seems to have stopped, although there are still important open questions. The proposed algorithm relied on the traditionally used data structure (DBMs) for most operations. CDDs definition required that repeated subtrees were aliased, but no clear algorithm was presented for producing such compact representation, which seems costly to achieve. Also, since then, case studies have increased in size. In this article we revisit CDDs by introducing RCDDs, a variation that does not require maximum aliasing. We present the complete set of operations required to perform forward reachability analysis with no need for DBMs. By employing a fully RCDD-based algorithm our experiments show a consistent reduction of time requirements in case studies from the current literature, sometimes up to more than 40%.
Detecting quasi-equal clocks in timed automata
- In FORMATS
"... Abstract. A recent optimizations technique for timed model checking starts with a given specification of quasi-equal clocks. In principle, the zone graph can used to detect which clocks are quasi-equal; the construc-tion of the zone graph would, however, defeat its very purpose (which is the optimiz ..."
Abstract
-
Cited by 1 (1 self)
- Add to MetaCart
(Show Context)
Abstract. A recent optimizations technique for timed model checking starts with a given specification of quasi-equal clocks. In principle, the zone graph can used to detect which clocks are quasi-equal; the construc-tion of the zone graph would, however, defeat its very purpose (which is the optimization of this construction). In this paper, we present an abstraction that is effective for the goal of the optimization based on quasi-equal clocks: it is coarse enough to yield a drastic reduction of the size of the zone graph. Still, it is precise enough to identify a large class of quasi-equal clocks. The abstraction is motivated by an intuition about the way quasi-equalities can be tracked. We have implemented the corresponding reasoning method in the Jahob framework using an SMT solver. Our experiments indicate that our intuition may lead to a useful abstraction. 1
Verification of real-time systems: . . .
, 2006
"... We address a number of limitations of Timed Automata and real-time model-checkers, which undermine the reliability of formal verification. In particular, we focus on the model-checker Uppaal as a representative of this technology. Timelocks and Zeno runs represent anomalous behaviours in a timed aut ..."
Abstract
- Add to MetaCart
We address a number of limitations of Timed Automata and real-time model-checkers, which undermine the reliability of formal verification. In particular, we focus on the model-checker Uppaal as a representative of this technology. Timelocks and Zeno runs represent anomalous behaviours in a timed automaton, and may invalidate the verification of safety and liveness properties. Currently, model-checkers do not offer adequate support to prevent or detect such behaviours. In response, we develop new meth-ods to guarantee timelock-freedom and absence of Zeno runs, which improve and complement the existent support. We implement these methods in a tool to check Uppaal specifications. The requirements language of model-checkers is not well suited to express sequence and iteration of events, or past computations. As a result, validation problems may arise during verification (i.e., the property that we verify may not accurately reflect the intended requirement). We study the logic PITL, a rich propositional subset of Interval Temporal Logic, where these requirements can be more intuitively expressed than in model-checkers. However, PITL has a decision procedure with a worst-case non-elementary complexity, which has hampered the
Czech Republic On-the-fly State Space Reductions £
, 2005
"... Reproduction of all or part of this work is permitted for educational or research use on condition that this copyright notice is included in any copy. Publications in the FI MU Report Series are in general accessible via WWW: �ØØÔ � ÛÛÛ � � ÑÙÒ � Þ Ú�� � Ö�ÔÓÖØ× Further information can obtained by c ..."
Abstract
- Add to MetaCart
(Show Context)
Reproduction of all or part of this work is permitted for educational or research use on condition that this copyright notice is included in any copy. Publications in the FI MU Report Series are in general accessible via WWW: �ØØÔ � ÛÛÛ � � ÑÙÒ � Þ Ú�� � Ö�ÔÓÖØ× Further information can obtained by contacting:
Hypervolume Approximation in Timed Automata Model Checking
"... Abstract. Di erence Bound Matrices (DBMs) are the most commonly used data structure for model checking timed automata. Since long they are being used in successful tools like Kronos or UPPAAL. As DBMs represent convex polyhedra in an n-dimensional space, this paper explores the idea of using its hyp ..."
Abstract
- Add to MetaCart
(Show Context)
Abstract. Di erence Bound Matrices (DBMs) are the most commonly used data structure for model checking timed automata. Since long they are being used in successful tools like Kronos or UPPAAL. As DBMs represent convex polyhedra in an n-dimensional space, this paper explores the idea of using its hypervolume as the basis for two optimization techniques. One of them is very simple to implement. The other, an improvement over the rst, requires more involved programming. Each of them saves veri cation time (up to 19 % in our case studies), with a modest increase of memory requirements. Their impact di ers among the di erent case studies but, as they can be combined, there is no need to choose a priori. 1
Lazy Approximation for Dense Real-Time Systems (Extended Abstract)
, 2004
"... We propose an effective and complete method for verifying safety and liveness properties of timed systems, which is based on predicate abstraction for computing finite abstractions of timed automata and TCTL formulas, finite-state CTL model checking, and successive refinement of finite-state ab ..."
Abstract
- Add to MetaCart
We propose an effective and complete method for verifying safety and liveness properties of timed systems, which is based on predicate abstraction for computing finite abstractions of timed automata and TCTL formulas, finite-state CTL model checking, and successive refinement of finite-state abstractions. Starting with
Framework
"... We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL∗) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative tim ..."
Abstract
- Add to MetaCart
(Show Context)
We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL∗) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative timed properties but are not suitable for effective verification of properties of real-life systems. In this paper, we consider subscript TCTL for TPN (TPN-TCTL) for which temporal operators are extended with a time interval, specifying a time constraint on the firing sequences. We prove the decidability of TPN-TCTL on bounded TPN and give its theoretical complexity. We propose a zone based state space abstraction that preserves marking reachability and traces of the TPN. As for Timed Automata (TA), the abstraction may use an over-approximation operator on zones to enforce the termination. A coarser (and efficient) abstraction is then provided and proved exact w.r.t. marking reachability and traces (LTL properties). Finally, we consider a subset of TPN-TCTL properties (TPN-TCTLS) for which it is possible to propose efficient on-the-fly model-checking algorithms. Our approach consists in computing and exploring the zone based state space abstraction. On a practical point of view, the method is integrated in ROMEO [23], a tool for Time Petri Nets edition and analysis. In addition to the old features it is now possible to effectively verify a subset of TCTL directly on
