Verification of Parameterized Timed Systems Parosh Aziz Abdulla

Verification of Parameterized Timed Systems Parosh Aziz Abdulla Uppsala University Johann Deneux Pritha Mahata Aletta Nylen

Outline • Parameterized Timed Systems • with one clock • with several clocks • discrete time domain • Syntactic and Semantic Variants Safety Properties

Parameterized System of Timed Processes – (Timed Networks) Timed Process: Parameterized System: x: =0 x<5

Single Clock Timed Networks - TN(1) Timed Process: (single clock) Parameterized System: x: =0 x<5

Fischer’s Protocol Timed Process: critical section x=0 x<1 x: =0 x>1 Parameterized Network: arbitrary size Challenge: arbitrary rather than fixed size

Single Clock Timed Networks - TN(1) Timed Process: (single clock) x: =0 x<5 Parameterized System: State = Configuration 2. 3 1. 4 5. 2 3. 7 1. 0 8. 1

Single Clock Timed Networks - TN(1) x: =0 Timed Process: (single clock) x<5 Parameterized System: Initial Configurations 0 00 0000

Timed Transitions 2. 3 1. 4 5. 2 3. 7 0. 0 8. 1 0. 5 2. 8 1. 9 5. 7 4. 2 0. 5 8. 6

Discrete Transitions x<5 x: =0 2. 3 1. 4 5. 2 3. 7 1. 0 8. 1 2. 3 1. 4 0. 0 3. 7 1. 0 8. 1

TN(1) : • Unbounded number of clocks • Cannot be modeled as timed automata

TN(1) : • Unbounded number of clocks • Cannot be modeled as timed automata How to check Safety Properties ?

Equivalence on Configurations configurations equivalent if they agree (up to cmax) on: § colours § integral parts of clock values § ordering on fractional parts 3. 1 4. 8 1. 5 6. 2 5. 6 3. 2 4. 8 1. 6 6. 4 5. 7

Equivalence on Configurations configurations equivalent if they agree (up to cmax) on: § colours § integral parts of clock values § ordering on fractional parts 3. 1 4. 8 1. 5 6. 2 5. 6 3. 2 4. 8 1. 6 6. 4 5. 7 3. 3 1. 7 4. 8

Equivalence on Configurations configurations equivalent if they agree (up to cmax) on: § colours § integral parts of clock values § ordering on fractional parts 3. 1 4. 8 1. 5 6. 2 5. 6 3. 3 1. 7 4. 8 3. 2 4. 8 1. 6 6. 4 5. 7 3. 1 1. 8 4. 9

Ordering on Configurations c 1 c 2 § c 1 § c 3 iff c 3 : c 3 < c 2 4. 9 6. 4 5. 7 3. 1 4. 8 1. 5 6. 2 5. 6

Ordering on Configurations c 1 c 2 § c 1 § c 3 iff c 3 : c 3 < c 2 4. 9 6. 4 5. 7 4. 8 6. 2 5. 6 3. 1 4. 8 1. 5 6. 2 5. 6

Safety Properties x=0 3. 4 section critical x<1 x: =0 x>1 8. 1 • mutual exclusion: Bad States : # processes in critical section > 1

Safety Properties critical section x=0 3. 4 8. 1 3. 3 x<1 x: =0 x>1 8. 2 2. 3 1. 4 5. 2 3. 7 • mutual exclusion: Bad States : # processes in critical section > 1 Ideal = Upward closed set of configurations

Safety Properties critical section x=0 3. 4 8. 1 3. 3 x<1 x: =0 x>1 8. 2 2. 3 1. 4 5. 2 3. 7 • mutual exclusion: Bad States : # processes in critical section > 1 Ideal = Upward closed set of configurations Safety = reachability of ideals

Checking Safety Properties: Backward Reachability Analysis initial states bad states

Checking Safety Properties: Backward Reachability Analysis Pre initial states bad states

Checking Safety Properties: Backward Reachability Analysis Pre initial states Pre Pre bad states

Properties of c 1 c 2 -- Monotonicity c 3

Properties of -- Monotonicity c 3 c 1 c 4 c 2

Properties of -- Monotonicity c 3 c 1 c 4 c 2 c 5

Properties of -- Monotonicity c 3 c 1 c 4 c 2 c 5 c 6

Monotonicity ideals closed under computing Pre

Monotonicity ideals closed under computing Pre I

Monotonicity ideals closed under computing Pre(I) I

Checking Safety Properties: Backward Reachability Analysis Pre initial states Pre bad states Ideals

Existential Zones x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3

Existential Zones x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3 3. 1 7. 2 4. 6

Existential Zones 3. 1 3. 5 7. 2 0. 5 4. 6 x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3 minimal requirement 3. 1 7. 2 4. 6

Existential Zones 3. 1 3. 5 7. 2 0. 5 4. 6 x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3 3. 1 7. 2 4. 6 minimal requirement Existential Zone Ideal

Existential Zones – Computing Pre x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3

Existential Zones – Computing Pre x 1 x 2 x 3 1 x 2 - x 1 2 x 2 - x 3 x 1 x 2 x 4 x 5 1 x 2 - x 1 4 x 4 2 x 5 4 x 2 x

Checking Safety Properties: Backward Reachability Analysis Pre Pre initial states Pre bad states Existential Zones

Termination Existential Zones BQO (and therefore WQO)

Termination Existential Zones BQO (and therefore WQO) Theorem: Safety properties can be decided for TN(1)

Multi-Clock Timed Networks – TN(K) Timed Process: (two clocks) x: =0 x<5 Parameterized Network: Configuration x 2. 3 1. 4 5. 2 3. 7 1. 0 8. 1 y 1. 4 5. 6 0. 2 9. 2 2. 8 0. 1 y>3

Timed Transitions x 2. 3 1. 4 5. 2 3. 7 1. 0 8. 1 y 1. 4 5. 6 0. 2 9. 2 2. 8 0. 1 0. 5 x 2. 8 1. 9 5. 7 4. 2 1. 5 8. 6 y 1. 9 6. 1 0. 7 9. 7 3. 3 0. 6

Discrete Transitions y<5 x: =0 x 2. 3 1. 4 5. 2 3. 7 1. 0 8. 1 y 1. 4 5. 6 0. 2 9. 2 2. 8 0. 1 x 2. 3 0. 0 5. 2 3. 7 1. 0 8. 1 y 1. 4 5. 6 0. 2 9. 2 2. 8 0. 1 x>4

x 1 y 1 x 2 y 2 1 y 2 - x 1 2 x 2 - y 1 xi and yi belong to the same process

Checking Safety Properties: Backward Reachability Analysis Pre Pre initial states Pre bad states Existential Zones

Termination no longer guaranteed !! x 1 y 1 x 2 y 2 x 3 y 3 x 4 y 4 x 1 < x 2 < x 3< x 4 y 1 = x 2 y 2 = x 3 y 3 = x 4 y 4 = x 1 y 1 x 2 y 2 x 3 y 3

Termination no longer guaranteed !! x 1 y 1 x 2 y 2 x 1 < x 2 y 1 = x 2 y 2 = x 1 y 1 x 2 y 2

Termination no longer guaranteed !! x 1 y 1 x 2 y 2 x 1 < x 2 y 1 = x 2 y 2 = x 1 y 1 x 2 y 2 x 3 y 3 x 1 < x 2 < x 3 y 1 = x 2 y 2 = x 3 y 3 = x 1 y 1 x 2 y 2 x 3 y 3

Termination no longer guaranteed !! x 1 y 1 x 2 y 2 x 3 y 3 x 1 < x 2 < x 3 y 1 = x 2 y 2 = x 3 y 3 = x 1 y 1 x 2 y 2 x 3 y 3 x 1 y 1 x 2 y 2 x 3 y 3 x 4 y 4 x 1 < x 2 < x 3< x 4 y 1 = x 2 y 2 = x 3 y 3 = x 4 y 4 = x 1 y 1

Termination no longer guaranteed !!

Simulation of 2 -counter machine by TN(2) c 1++ M: c 2 -- c 2=0? Encoding of configurations in M: Timed processes: • One models control state • Some model c 1 • Some model c 2 • The rest are idle

Simulation of 2 -counter machine c 1++ M: c 2 -- c 2=0? Encoding of c 1 : 0. 1 0. 3 left end 0. 3 0. 5 0. 7 # c 1=3 0. 7 0. 9 0. 1 right end

Simulating a Decrement q 1 c 1 -- q 2 q 1 0<x x: =0 x=1 q 2 y=1 y: =0 idle 0. 1 0. 3 0. 5 0. 7 0. 9 0. 1

Simulating a Decrement q 1 c 1 -- q 2 q 1 0<x x: =0 x=1 q 2 y=1 y: =0 idle 0. 1 0. 3 0. 5 0. 7 0. 9 0. 1 0. 2 0. 4 0. 6 0. 8 1. 0 0. 2

Simulating a Decrement q 1 c 1 -- q 2 q 1 0<x x: =0 x=1 q 2 y=1 y: =0 idle 0. 2 0. 4 0. 6 0. 8 1. 0 0. 2

Simulating a Decrement q 1 c 1 -- q 2 q 1 0<x x: =0 x=1 q 2 idle 0. 2 0. 4 0. 6 0. 8 1. 0 0 0. 4 0. 6 0. 8 1. 0 y=1 y: =0

Simulating a Decrement q 1 c 1 -- q 2 q 1 0<x x: =0 x=1 q 2 idle 0 0. 4 0. 6 0. 8 1. 0 0 0. 4 0. 6 0. 8 0 y=1 y: =0

Simulating Zero Testing q 1 x>0 y: =0 y=1 x: =0 q 1 c 1=0? q 2 0. 5 0 0. 2 0. 7 0. 2 0. 5 1. 0 0. 5 0. 3 q 2

Theorem: Checking Safety properties undecidable for TN(2)

Discrete Timed Networks - DTN(K) Clocks interpreted over the discrete time domain State = Configuration 2 1 5 3 1 8 Timed Transitions 2 1 5 3 1 8 2 4 3 7 5 3 10

Exact Abstraction cmax = 1 # processes having: § same state § clock value (up to cmax) 0 4 1 2 2* 3 0 3 1 0 2* 6 0 5 1 0 2* 8

Discrete Transitions x=1 x: =0 0 4 0 5 1 2 1 1 2* 3 0 3 0 4 1 0 2* 6 0 5 0 4 1 0 2* 8 x=0

Timed Transitions 0 4 0 0 1 2 1 4 2* 3 2* 5 0 3 0 0 1 3 2* 6 0 5 0 0 1 5 2* 8 1

Symbolic Representation 0 4 1 2 2* 3 0 3 1 0 2* 6 0 5 1 0 2* 8 minimal element

Checking Safety Properties: Backward Reachability Analysis Pre Pre initial states Pre bad states Minimal elements

Theorem: Checking Safety properties decidable for DTN(K)

Implementation

TPN - Parameterized Fischer 2 seconds

Lynch-Shavit’s Protocol

Lynch-Shavit’s Protocol Parameterized Network: arbitrary size

TPN- Parameterized Lynch-Shavit 25 minutes

Syntactic Variants § Open timed networks: strict clock constraints undecidable § Closed timed networks: non-strict clock constraints decidable Semantic Variants § Robust timed networks: semantically strict clock constraints undecidable

Summary • TN(1) : decidable • TN(2) : undecidable • DTN(K) : decidable • TN(2) open : undecidable • TN(K) closed : decidable • TN(2) robust : undecidable

Future work § Acceleration and Widening § Forward Analysis § Price Timed Networks § Stochastic Variants