Oplægget blev holdt ved et seminar i InfinIT-interessegruppen Softwaretest afholdt den 13. november 2012. Læs mere om interessegruppen her: http://infinit.dk/dk/interessegrupper/softwaretest/softwaretest.htm

1. UPPAAL SMC:
Statistical Model Checking
for Stochastic Hybrid Systems
Alexandre David
Dehui Du
Kim G. Larsen
Axel Legay
Marius Mikucionis
Danny Bøgsted Poulsen
Sean Sedwards
Arne Skou

2. Outline
• Overview of UPPAAL flavors
• Modeling language
• Model-checking technology
• Properties and results
• Some case studies
2

3. Engineering Processes
UPPAAL/SMC
Abstract Model Query
UPPAAL TIGA
UPPAAL ECDAR
Detailed Model UPPAAL/SMC Query
UPPAAL TRON
Does System satisfy property ?
Implementation
3

4. UPPAAL flavors
• “Classical” UPPAAL – model-checking:
– M ⊨ φ ⇒ true/false, counterexample trace
• UPPAAL SMC – statistical model-checking:
– M ⊨ Prt≤T φ ⇒ probability estimate, distribution
• UPPAAL TIGA – controller synthesis:
– S(P ∥ C) ⊨ φ ⇒ control strategy: state → action
• UPPAAL ECDAR – refinement checking:
– C ≤ A ⇒ true/false, counterexample trace
• UPPAAL TRON – conformance testing:
– T(IUT) ⊆ T(M) ⇒ pass/fail/inconc., diagnostics 4

5. UPPAAL-SMC – Architecture
Graphical Interface Stochastic Engine Server
Editor Hypothesis Probability
Testing Evaluation Execution
Engine
Simulator Data
processing Compiler
Verifier engine
Probability Simulation Virtual
Plot composer Comparison Engine Machine
5

6. Stochastic Semantics of UPPAAL TA
Uniform Distribution
6

7. Stochastic Semantics of UPPAAL TA
Exponential Distribution
Composition =
Input enabled Repeated races between components
broadcast channels
7

8. Statistical Model-Checking
1. Generate random runs
– According to a stochastic semantics
2. Monitor the runs accept/reject
– LTL/MITL formula, monitor
3. Use statistical methods to derive results
– Guaranteed with specified confidence
– Probabilities, distributions, hypothesis testing
8

9. Queries: Syntax
• Hypothesis testing
Pr[<=100](<> expr)>=0.1
x<=100 #<=50 [] expr <=0.5
• Evaluation
Pr[<=100](<> expr)
• Comparison
Pr[<=20](<> e1)>=Pr[<=20](<> e2)
• Expected value
E[<=10;1000](min: expr)
Explicit number of runs. Min or max.
• Simulations
simulate 10 [<=100]{expr1,expr2}
9

10. Queries: Syntax
• Hypothesis testing
Pr[<=100](<> expr)>=0.1
x<=100 #<=50 [] expr <=0.5
• Evaluation
Pr[<=100](<> expr)
• Comparison
Pr[<=20](<> e1)>=Pr[<=20](<> e2)
• Expected value
E[<=10;1000](min: expr)
Explicit number of runs. Min or max.
• Simulations
simulate 10 [<=100]{expr1,expr2}
10

11. Queries in UPPAAL SMC
Pr[ <= 200](<> Train(5).Cross)
++precision
11

12. Queries: Syntax
• Hypothesis testing
Pr[<=100](<> expr)>=0.1
x<=100 #<=50 [] expr <=0.5
• Evaluation
Pr[<=100](<> expr)
• Comparison
Pr[<=20](<> e1) >= Pr[<=20](<> e2)
• Expected value
E[<=10;1000](min: expr)
Explicit number of runs. Min or max.
• Simulations
simulate 10 [<=100]{expr1,expr2}
12

13. Distribution for Comparisons
13

14. Queries: Syntax
• Hypothesis testing
Pr[<=100](<> expr)>=0.1
x<=100 #<=50 [] expr <=0.5
• Evaluation
Pr[<=100](<> expr)
• Comparison
Pr[<=20](<> e1)>=Pr[<=20](<> e2)
• Expected value
E[<=10;1000](min: expr)
Explicit number of runs. Min or max.
• Simulations
simulate 10 [<=100]{expr1,expr2}
14

15. Queries in UPPAAL SMC
simulate 1 [<=100]{ Gate.len }
simulate 10 [<=100]{ Gate.len }
Pr[<=100](<> t > 5 && Gate.len < 3) [0.58,0.69]
Pr[<=100](<> t > 14 && Gate.len < 3) [0.08,0.19]
15

16. Invariants:
SMC in UPPAAL x’==0 && y’==function() &&
z’==2*x+cos(y)
• Stochastic hybrid automata
– Clocks may have different slopes in different locations,
integer/float or expressions involving clocks ODEs.
– Branching edges with discrete probabilities (weights).
– Beyond DTMC, beyond CTMC.
• All features of UPPAAL supported
– User defined functions and types
– Expressions in guards, invariants, clock-rates, delay-
rates (rationals), and weights.
• New GUI for plot-composing and exporting.
17

17. SMC in UPPAAL
• Stochastic hybrid automata
– Clocks may have different slopes in different locations,
integer/float or expressions involving clocks ODEs.
– Branching edges with discrete probabilities (weights).
– Beyond DTMC, beyond CTMC.
• All features of UPPAAL supported
– User defined functions and types
– Expressions in guards, invariants, clock-rates, delay-
rates (rationals), and weights.
• New GUI for plot-composing and exporting.
18

18. SMC in UPPAAL
• Stochastic hybrid automata
– Clocks may have different slopes in different locations,
integer/float or expressions involving clocks ODEs.
– Branching edges with discrete probabilities (weights).
– Beyond DTMC, beyond CTMC.
• All features of UPPAAL supported
– User defined functions and types
– Expressions in guards, invariants, clock-rates, delay-
rates (rationals), and weights.
• New GUI for plot-composing and exporting.
19

19. SMC in UPPAAL
• Stochastic hybrid automata
– Clocks may have different slopes in different locations,
integer/float or expressions involving clocks ODEs.
– Branching edges with discrete probabilities (weights).
– Beyond DTMC, beyond CTMC.
• All features of UPPAAL supported
– User defined functions and types
– Expressions in guards, invariants, clock-rates, delay-
rates (rationals), and weights.
• New GUI for plot-composing and exporting.
20

20. Estimating Energy Consumption
Monitor
Pr[energy1<=1000](<> time==100) energy1' ==
(sum(i:id_t) power1[i])
&&
energy2' ==
sum(i:id_t) power2[i]
21

21. A Biological Oscillator
• Circadian rhythm oscillator.
N. Barkai and S. Leibler. Biological rhythms: Circadian clocks
limited by noise. Nature, 403:267–268, 2000
• Two ways to model:
1. Stochastic model that follow the reactions.
2. Dynamical model solving the ODEs.
• Analysis:
– Evaluate time between peaks.
– The continuous model is the limit behavior of the
stochastic model.
– Use frequency analysis for comparison.
22

22. Stochastic Model
23

23. Continuous Model
24

24. Results of Simulations
25

25. Time Between Peaks
• MITL formula for peak:
true U[<=1000] (A>1100 & 1100
true U[<=5] A<=1000).
1000
• Generate monitors. 5
• Run SMC.
27

26. Energy Aware Buildings
• Rooms to be heated.
– Only one heater available.
– Matrix of coefficients for heat transfer between
rooms.
– Local and central controllers
– Environment temperature weather model.
– User profiles
28

27. Other Case Studies
FIREWIRE BLUETOOTH
LMAC for Wireless Sensor Networks Herschel-Planck Satellite
schedulability analysis
31

28. Conclusions
• Symbolic MC proves hard properties: true/false
• Statistical MC measures performance: Pr over time/cost
• SMC ingredients:
– Stochastic modeling extensions
– Compatible stochastic semantics
– Support for dynamical equations
– Statistical methods for confidence intervals
• Case-studies:
– Biology.
– Communication protocols.
– Temperature controllers.
– Disproving schedulability
Extend the application domains of MC/SMC.
32