Concrete State Space Research Articles

Data-Driven Abstractions With Probabilistic Guarantees for Linear PETC Systems

We employ the scenario approach to compute probably approximately correct (PAC) bounds on the average inter-sample time (AIST) generated by an unknown PETC system, based on a finite number of samples. We extend the scenario optimisation to multiclass SVM algorithms in order to construct a PAC map between the concrete state-space and the inter-sample times. We then build a traffic model applying an <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\ell $ </tex-math></inline-formula> -complete relation and find, in the underlying graph, the cycles of minimum and maximum average weight: these provide lower and upper bounds on the AIST. Numerical benchmarks show the practical applicability of our method, which is compared against model-based state-of-the-art tools.

Merge-and-Shrink Heuristics for Classical Planning: Efficient Implementation and Partial Abstractions

Merge-and-shrink heuristics are a successful class of abstraction heuristics used for optimal classical planning. With the recent addition of generalized label reduction, merge-and-shrink can be understood as an algorithm framework that repeatedly applies transformations to a factored representation of a given planning task to compute an abstraction. In this paper, we describe an efficient implementation of the framework and its transformations, comparing it to its previous implementation in Fast Downward. We further discuss partial merge-and-shrink abstractions that do not consider all aspects of the concrete state space. To compute such partial abstractions, we stop the merge-and-shrink computation early by imposing simple limits on the resource consumption of the algorithm. Our evaluation shows that the efficient implementation indeed improves over the previous one, and that partial merge-and-shrink abstractions further push the efficiency of merge-and-shrink planners.

Improving lazy abstraction for SCR specifications through constraint relaxation

SummaryFormal requirements specifications, eg, software cost reduction (SCR) specifications, are challenging to analyse using automated techniques such as model checking. Since such specifications are meant to capture requirements, they tend to refer to real‐world magnitudes often characterized through variables over large domains. At the same time, they feature a high degree of nondeterminism, as opposed to other analysis contexts such as (sequential) program verification. This makes model checking of SCR specifications difficult even for symbolic approaches. Moreover, automated abstraction refinement techniques such as counterexample guided abstraction refinement fail in many cases in this context, since the concrete state space is typically large, and reaching specific states of interest may require complex executions involving many different states, causing these approaches to perform many abstraction refinements, and making them ineffective in practice. In this paper, an approach to tackle the above situation, through a 2‐stage abstraction, is presented. The specification is first relaxed, by disregarding the constraints imposed in the specification by physical laws or by the environment, before being fed to a counterexample guided abstraction refinement procedure, tailored to SCR. By relaxing the original specification, shorter spurious counterexamples are produced, favouring the abstraction refinement through the introduction of fewer abstraction predicates. Then, when a counterexample is concretizable with respect to the relaxed (concrete) specification but it is spurious with respect to the original specification, an efficient though incomplete refinement step is applied to the constraints, to cause the removal of the spurious case. This approach is experimentally assessed, comparing it with related techniques in the verification of properties and in automated test case generation, using various SCR specifications drawn from the literature as case studies. The experiments show that this new approach runs faster and scales better to larger, more complex specifications than related techniques.

State Distribution Policy for Distributed Model Checking of Actor Models

Model checking temporal properties is often reduced to finding accepting cycles in Buchi automata. A key ingredient for an effective distributed model ¨ checking technique is a distribution policy that does not split the potential accepting cycles of the corresponding automaton among several nodes. In this paper, we introduce a distribution policy to reduce the number of split cycles. This policy is based on the call dependency graph, obtained from the message passing skeleton of the model. We prove theoretical results about the correspondence between the cycles of call dependency graph and the cycles of the concrete state space and provide empirical data obtained from applying our distribution policy in state space generation and reachability analysis. We take Rebeca, an imperative interpretation of actors, as our modeling language and implement the introduced policy in its distributed state space generator. Our technique can be applied to other message-driven actor-based models where concurrent objects or services are units of concurrency.

CSP-based counter abstraction for systems with node identifiers

The Parameterised Model Checking Problem asks whether an implementation Impl(t) satisfies a specification Spec(t) for all instantiations of parameter t. In general, t can determine numerous entities: the number of processes used in a network, the type of data, the capacities of buffers, etc. The main theme of this paper is automation of uniform verification of a subclass of PMCP with the parameter of the first kind, i.e. where it determines the number of processes used in a network. We use CSP as our formalism.Counter abstraction is a technique that replaces a concrete state space by an abstract one, where each abstract state is a tuple of integer counters (c1,…,ck) such that for each i, ci counts how many node processes are currently in the i-th state. Each counter ci is given a finite threshold zi and we interpret ci=zi as there being zior more processes in the i-th state.Standard counter abstraction techniques require all processes to be identical, which means that nodes cannot use node identifiers. In this paper we present how counter abstraction techniques can be extended to processes that make use of node identifiers in a symmetrical way. Our method creates a process Abstr that is independent of t and is refined by ϕ(Impl(T)) for all sufficiently large T, where ϕ maps all (sufficiently large) instantiations T of the parameter to some fixed type. By transitivity of refinement, testing if Abstr refines Spec(ϕ(t)) implies that Spec(ϕ(t)) is refined by ϕ(Impl(T)). Then, using the type reduction theory from Mazur and Lowe (2012) [29], we can deduce that Spec(T) is refined by Impl(T) for all sufficiently large T, thus obtaining a positive answer to the original verification problem.

Towards geometric control of max-plus linear systems with applications to queueing networks

The max-plus linear systems have been studied for almost three decades, however, a well-established system theory on such specific systems is still an on-going research. The geometric control theory in particular was proposed as the future direction for max-plus linear systems by Cohen et al. [Cohen, G., Gaubert, S. and Quadrat, J.P. (1999), ‘Max-plus Algebra and System Theory: Where we are and Where to Go Now’, Annual Reviews in Control, 23, 207--219]. This article generalises R.E. Kalman's abstract realisation theory for traditional linear systems over fields to max-plus linear systems. The new generalised version of Kalman's abstract realisation theory not only provides a more concrete state space representation other than just a ‘set-theoretic’ representation for the canonical realisation of a transfer function, but also leads to the computational methods for the controlled invariant semimodules in the kernel and the equivalence kernel of the output map. These controlled invariant semimodules play key roles in the standard geometric control problems, such as disturbance decoupling problem and block decoupling problem. A queueing network is used to illustrate the main results in this article.

Generalized Strong Preservation by Abstract Interpretation

Standard abstract model checking relies on abstract Kripke structures which approximate concrete models by gluing together indistinguishable states, namely by a partition of the concrete state space. Strong preservation for a specification language amounts to the equivalence of concrete and abstract model checking of formulas in ⁠. We show how abstract interpretation can be used to design generic abstract models that allow to view standard abstract Kripke structures as particular instances. Accordingly, strong preservation is generalized to abstract interpretation-based models and precisely related to the concept of completeness in abstract interpretation. The problem of minimally refining an abstract model in order to make it strongly preserving for some language can be formulated as a minimal domain refinement in abstract interpretation in order to get completeness w.r.t. the logical/temporal operators of ⁠. It turns out that this refined strongly preserving abstract model always exists and can be characterized as a greatest fixed point. As a consequence, some well-known behavioural equivalences, like bisimulation, simulation and stuttering, and their corresponding partition refinement algorithms can be elegantly characterized in abstract interpretation as completeness properties and refinements.

A Formal Framework for Verification of Embedded Custom Memories of the Motorola MPC7450 Microprocessor

In this presentation, we will deal with verification of custom designed embedded memories. Using our paradigm, one can abstract the behavior of a memory block by a couple of artifacts--one representing its contents, and another representing its interface. We make use of the well known behavioral model known as the Efficient Memory Model (EMM) [29, 30] to represent contents of memories. We provide a methodology using which the behavior of a switch (or equivalently, transistor) level device can be specified using parameterized regular expressions. These entities can be used to abstractly describe the behavior of a bunch of switches that represent the interface of a memory. An automaton that we construct out of an abstract memory interface definition represents an abstraction of the memory interface itself. We show that such an automaton also forms a transducer that is a simulation model in a symbolic simulation environment. An EMM representing a memory core in conjunction with a transducer representing its interface is used as an abstraction of a complete memory during our automatic verification process.We also present a language formalism using which we show that the outputs from the transducers that are generated from the abstract specifications are weaker than or equal to the outputs defined by the regular expressions, in a partially ordered output space. We show that although the regular expressions are defined over exact and legal input strings, the transducers computed from them can provide outputs even when provided with weak or illegal input strings. This is an absolute necessity in order to have the capability to produce outputs when treated as a reactive system embedded in a symbolic simulation environment. Thus, we show that the simulation model generated by our technique is an conservative approximation of the corresponding abstract specification.We present a simple theory of composition that can be used to compose different simulation models used in our technique. Memories consisting of several ports result into several user-provided abstract specifications, which in turn result into several transducers that can be composed into a single transducer. That transducer in turn can be composed to a simulation model of an EMM. Our simple theory of composition also enables one to compose the abstract state space a memory core along with its ports with the concrete state space of the circuitry surrounding the memory core. We have shown that the composite simulation model representing the complete circuit has a partially ordered state space that (a) forms a complete lattice, and (b) that has a monotonic state transition function, that makes it suitable for being used in a symbolic simulation environment making use of Symbolic Trajectory Evaluation (STE) [27].The verification paradigm used is STE. For Motorola high performance microprocessors, switch level models are hand designed assuming that corresponding RTLs are golden models. Therefore, checking of equivalence between the two models is of absolute necessity as the RTL needs to be predictive of silicon behavior. We have developed a tool based on the proposed technique and used it to check that RTL descriptions of custom memories have been correctly implemented by transistor level descriptions of the same, augmented with abstract specifications of their cores. Our example circuits were taken from the state of the art Motorola MPC7450 microprocessor, a Motorola PowerPC. Experimental evidence testify to the effectiveness of the technique in catching subtle bugs in data path circuitry.

Refining Model Checking by Abstract Interpretation

Formal methods combining abstract interpretation and model-checking have been considered for automated analysis of software. In abstract model-checking, the semantics of an infinite transition system is abstracted to get a finite approximation on which temporal-logic/μ-calculus model-checking can be directly applied. The paper proposes two improvements of abstract model-checking which can be applied to infinite abstract transition systems: iA new combination of forwards and backwards abstract fixed-point model-checking computations for universal safety. It computes a more precise result than that computed by conjunction of the forward and backward analyses alone, without needing to refine the abstractions When abstraction is unsound (as can happen in minimum/maximum path-length problems), it is proposed to use the partial results of a classical combination of forward and backward abstract interpretation analyses for universal safety in order to reduce, on-the-fly, the concrete state space to be searched by model-checking.