Results 1  10
of
10
Model Checking the Time to Reach Agreement
 FORMATS
"... The timed automaton framework of Alur and Dill is a natural choice for the specification of partially synchronous distributed systems. The past has shown, however, that verification of these systems by model checking usually is very difficult. Therefore, model checking techniques have thus far not r ..."
Abstract

Cited by 14 (1 self)
 Add to MetaCart
(Show Context)
The timed automaton framework of Alur and Dill is a natural choice for the specification of partially synchronous distributed systems. The past has shown, however, that verification of these systems by model checking usually is very difficult. Therefore, model checking techniques have thus far not really been used for their design, even though these techniques are widely used in other areas, e.g., hardware verification. The present paper demonstrates that the revolutionary development of both the usability and the efficiency of model checking tools may change this. It is shown that a complex partially synchronous distributed algorithm can easily be modeled with the Uppaal model checker, and that it is possible to analyze some interesting and nontrivial instances with reasonable computational resources. Clearly, such analysis results can greatly support the design of these systems: model checking tools may provide valuable early feedback on subtle design errors and hint at system invariants that can subsequently be used in the general correctness proof.
Checking Timed Büchi Automata Emptiness on Simulation Graphs
, 2006
"... This paper completes the work of [5,13] on checking language emptiness of timed Büchi automata efficiently. In [5,13] we showed how to check emptiness on the regionclosed simulation graph. However, the latter is not used in practice, since its nodes are nonconvex, thus, not easily representable. U ..."
Abstract

Cited by 7 (1 self)
 Add to MetaCart
This paper completes the work of [5,13] on checking language emptiness of timed Büchi automata efficiently. In [5,13] we showed how to check emptiness on the regionclosed simulation graph. However, the latter is not used in practice, since its nodes are nonconvex, thus, not easily representable. Using recent results of Bouyer [6] on simulationgraph overapproximations that preserve convexity, we show that the main result of [5,13] carries over to the zoneclosed simulation graph. The nodes of the latter are convex and can be efficiently represented. The zoneclosed simulation graph is used in the tools Kronos and Uppaal for checking reachability. Our result shows that these tools can be also used to check emptiness of timed Büchi automata with small modifications.
Multicore emptiness checking of timed Buchi automata using inclusion abstraction
 In: Proceedings of the 25th International Conference on Computer Aided Verification (CAV
, 2013
"... Abstract. This paper contributes to the multicore model checking of timed automata (TA) with respect to liveness properties, by investigating checking of TA Büchi emptiness under the very coarse inclusion abstraction or zone subsumption, an open problem in this field. We show that in general Büc ..."
Abstract

Cited by 5 (1 self)
 Add to MetaCart
(Show Context)
Abstract. This paper contributes to the multicore model checking of timed automata (TA) with respect to liveness properties, by investigating checking of TA Büchi emptiness under the very coarse inclusion abstraction or zone subsumption, an open problem in this field. We show that in general Büchi emptiness is not preserved under this abstraction, but some other structural properties are preserved. Based on those, we propose a variation of the classical nested depthfirst search (ndfs) algorithm that exploits subsumption. In addition, we extend the multicore cndfs algorithm with subsumption, providing the first parallel LTL model checking algorithm for timed automata. The algorithms are implemented in LTSmin, and experimental evaluations show the effectiveness and scalability of both contributions: subsumption halves the number of states in the realworld FDDI case study, and the multicore algorithm yields speedups of up to 40 using 48 cores. 1
Relaxed Clock Difference Diagrams for Timed Automata Model Checking
"... Clock Difference Diagrams (CDDs), a BDDlike data structure for model checking of timed automata, were presented in 1999. After the original article the work on them seems to have stopped, although there are still important open questions. The proposed algorithm relied on the traditionally used da ..."
Abstract

Cited by 1 (1 self)
 Add to MetaCart
Clock Difference Diagrams (CDDs), a BDDlike data structure for model checking of timed automata, were presented in 1999. After the original article the work on them seems to have stopped, although there are still important open questions. The proposed algorithm relied on the traditionally used data structure (DBMs) for most operations. CDDs definition required that repeated subtrees were aliased, but no clear algorithm was presented for producing such compact representation, which seems costly to achieve. Also, since then, case studies have increased in size. In this article we revisit CDDs by introducing RCDDs, a variation that does not require maximum aliasing. We present the complete set of operations required to perform forward reachability analysis with no need for DBMs. By employing a fully RCDDbased algorithm our experiments show a consistent reduction of time requirements in case studies from the current literature, sometimes up to more than 40%.
Detecting quasiequal clocks in timed automata
 In FORMATS
"... Abstract. A recent optimizations technique for timed model checking starts with a given specification of quasiequal clocks. In principle, the zone graph can used to detect which clocks are quasiequal; the construction of the zone graph would, however, defeat its very purpose (which is the optimiz ..."
Abstract

Cited by 1 (1 self)
 Add to MetaCart
(Show Context)
Abstract. A recent optimizations technique for timed model checking starts with a given specification of quasiequal clocks. In principle, the zone graph can used to detect which clocks are quasiequal; the construction of the zone graph would, however, defeat its very purpose (which is the optimization of this construction). In this paper, we present an abstraction that is effective for the goal of the optimization based on quasiequal clocks: it is coarse enough to yield a drastic reduction of the size of the zone graph. Still, it is precise enough to identify a large class of quasiequal clocks. The abstraction is motivated by an intuition about the way quasiequalities can be tracked. We have implemented the corresponding reasoning method in the Jahob framework using an SMT solver. Our experiments indicate that our intuition may lead to a useful abstraction. 1
Verification of realtime systems: . . .
, 2006
"... We address a number of limitations of Timed Automata and realtime modelcheckers, which undermine the reliability of formal verification. In particular, we focus on the modelchecker Uppaal as a representative of this technology. Timelocks and Zeno runs represent anomalous behaviours in a timed aut ..."
Abstract
 Add to MetaCart
We address a number of limitations of Timed Automata and realtime modelcheckers, which undermine the reliability of formal verification. In particular, we focus on the modelchecker Uppaal as a representative of this technology. Timelocks and Zeno runs represent anomalous behaviours in a timed automaton, and may invalidate the verification of safety and liveness properties. Currently, modelcheckers do not offer adequate support to prevent or detect such behaviours. In response, we develop new methods to guarantee timelockfreedom and absence of Zeno runs, which improve and complement the existent support. We implement these methods in a tool to check Uppaal specifications. The requirements language of modelcheckers is not well suited to express sequence and iteration of events, or past computations. As a result, validation problems may arise during verification (i.e., the property that we verify may not accurately reflect the intended requirement). We study the logic PITL, a rich propositional subset of Interval Temporal Logic, where these requirements can be more intuitively expressed than in modelcheckers. However, PITL has a decision procedure with a worstcase nonelementary complexity, which has hampered the
Czech Republic Onthefly State Space Reductions £
, 2005
"... Reproduction of all or part of this work is permitted for educational or research use on condition that this copyright notice is included in any copy. Publications in the FI MU Report Series are in general accessible via WWW: �ØØÔ � ÛÛÛ � � ÑÙÒ � Þ Ú�� � Ö�ÔÓÖØ× Further information can obtained by c ..."
Abstract
 Add to MetaCart
(Show Context)
Reproduction of all or part of this work is permitted for educational or research use on condition that this copyright notice is included in any copy. Publications in the FI MU Report Series are in general accessible via WWW: �ØØÔ � ÛÛÛ � � ÑÙÒ � Þ Ú�� � Ö�ÔÓÖØ× Further information can obtained by contacting:
Hypervolume Approximation in Timed Automata Model Checking
"... Abstract. Di erence Bound Matrices (DBMs) are the most commonly used data structure for model checking timed automata. Since long they are being used in successful tools like Kronos or UPPAAL. As DBMs represent convex polyhedra in an ndimensional space, this paper explores the idea of using its hyp ..."
Abstract
 Add to MetaCart
(Show Context)
Abstract. Di erence Bound Matrices (DBMs) are the most commonly used data structure for model checking timed automata. Since long they are being used in successful tools like Kronos or UPPAAL. As DBMs represent convex polyhedra in an ndimensional space, this paper explores the idea of using its hypervolume as the basis for two optimization techniques. One of them is very simple to implement. The other, an improvement over the rst, requires more involved programming. Each of them saves veri cation time (up to 19 % in our case studies), with a modest increase of memory requirements. Their impact di ers among the di erent case studies but, as they can be combined, there is no need to choose a priori. 1
Lazy Approximation for Dense RealTime Systems (Extended Abstract)
, 2004
"... We propose an effective and complete method for verifying safety and liveness properties of timed systems, which is based on predicate abstraction for computing finite abstractions of timed automata and TCTL formulas, finitestate CTL model checking, and successive refinement of finitestate ab ..."
Abstract
 Add to MetaCart
We propose an effective and complete method for verifying safety and liveness properties of timed systems, which is based on predicate abstraction for computing finite abstractions of timed automata and TCTL formulas, finitestate CTL model checking, and successive refinement of finitestate abstractions. Starting with
Framework
"... We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL∗) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative tim ..."
Abstract
 Add to MetaCart
(Show Context)
We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL∗) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative timed properties but are not suitable for effective verification of properties of reallife systems. In this paper, we consider subscript TCTL for TPN (TPNTCTL) for which temporal operators are extended with a time interval, specifying a time constraint on the firing sequences. We prove the decidability of TPNTCTL on bounded TPN and give its theoretical complexity. We propose a zone based state space abstraction that preserves marking reachability and traces of the TPN. As for Timed Automata (TA), the abstraction may use an overapproximation operator on zones to enforce the termination. A coarser (and efficient) abstraction is then provided and proved exact w.r.t. marking reachability and traces (LTL properties). Finally, we consider a subset of TPNTCTL properties (TPNTCTLS) for which it is possible to propose efficient onthefly modelchecking algorithms. Our approach consists in computing and exploring the zone based state space abstraction. On a practical point of view, the method is integrated in ROMEO [23], a tool for Time Petri Nets edition and analysis. In addition to the old features it is now possible to effectively verify a subset of TCTL directly on