State Space Explosion Research Articles

Coupled queues with customer impatience

Motivated by assembly processes, we consider a Markovian queueing system with multiple coupled queues and customer impatience. Coupling means that departures from all constituent queues are synchronised and that service is interrupted whenever any of the queues is empty and only resumes when all queues are non-empty again. Even under Markovian assumptions, the state–space grows exponentially with the number of queues involved. To cope with this inherent state–space explosion problem, we investigate performance by means of two numerical approximation techniques based on series expansions, as well as by deriving the fluid limit. In addition, we provide closed-form expressions for the first terms in the series expansion of the mean queue content for the symmetric coupled queueing system. By an extensive set of numerical experiments, we show that the approximation methods complement each other, each one being accurate in a particular subset of the parameter space.

Localization of Linearizability Faults on the Coarse-Grained Level

Linearizability is an important correctness criterion that guarantees the safety of concurrent data structures. Due to the nondeterminism of concurrent executions, reproduction and localization of a linearizability fault still remain challenging. The existing works mainly focus on model checking the thread schedule space of a concurrent program on a fine-grained (state) level, and hence suffer from the severe problem of state space explosion. This paper presents a tool called CGVT to build a small test case that is sufficient enough for reproducing a linearizability fault. Given a possibly long history that has been detected nonlinearizable, CGVT first locates the operations causing a linearizability violation and then synthesizes a minimum test case for further investigation. Moreover, we present several optimization techniques to improve the effectiveness and efficiency of CGVT. We have applied CGVT to 10 concurrent objects, while the linearizability of some of the objects is unknown yet. The experiments show that CGVT is powerful and efficient enough to build the test cases more adaptable for fine-grained fault localization.

Soundness Analytics of Composed Logical Workflow Nets

Cooperative systems with passing value indeterminacy and batch processing can be well modeled by composed logical workflow nets. Soundness guarantees no deadlock and livelock and each activity has potential to be executed. The soundness of composed logical workflow nets can be judged by reachability graphs. But reachability graphs can cause state space explosion. Path nets, single line nets, composed path nets and composed single line nets are proposed in the paper. They are used to determine soundness of logical workflow nets and composed logical workflow nets based on net structures and logical expressions avoiding reachability graphs. The presented concepts and techniques are applied to judge soundness of e-commerce transaction processes modeled by composed logical workflow nets, and they are illustrated by an example.

Policy learning in continuous-time Markov decision processes using Gaussian Processes

Continuous-time Markov decision processes provide a very powerful mathematical framework to solve policy-making problems in a wide range of applications, ranging from the control of populations to cyber–physical systems. The key problem to solve for these models is to efficiently compute an optimal policy to control the system in order to maximise the probability of satisfying a set of temporal logic specifications. Here we introduce a novel method based on statistical model checking and an unbiased estimation of a functional gradient in the space of possible policies. Our approach presents several advantages over the classical methods based on discretisation techniques, as it does not assume the a-priori knowledge of a model that can be replaced by a black-box, and does not suffer from state-space explosion. The use of a stochastic moment-based gradient ascent algorithm to guide our search considerably improves the efficiency of learning policies and accelerates the convergence using the momentum term. We demonstrate the strong performance of our approach on two examples of non-linear population models: an epidemiology model with no permanent recovery and a queuing system with non-deterministic choice.

Reduction of Qualitative Models of Biological Networks for Transient Dynamics Analysis.

Qualitative models of dynamics of signalling pathways and gene regulatory networks allow for the capturing of temporal properties of biological networks while requiring few parameters. However, these discrete models typically suffer from the so-called state space explosion problem which makes the formal assessment of their potential behaviors very challenging. In this paper, we describe a method to reduce a qualitative model for enhancing the tractability of analysis of transient reachability properties. The reduction does not change the dimension of the model, but instead limits its degree of freedom, therefore reducing the set of states and transitions to consider. We rely on a transition-centered specification of qualitative models by the mean of automata networks. Our framework encompasses the usual asynchronous Boolean and multi-valued network, as well as 1-bounded Petri nets. Applied to different large-scale biological networks from the litterature, we show that the reduction can lead to a drastic improvement for the scalability of verification methods.

Formal verification of probabilistic SystemC models with statistical model checking

AbstractTransaction‐level modeling with SystemC has been very successful in describing the behavior of embedded systems by providing high‐level executable models, in which many of them have inherent probabilistic behaviors, eg, random data and unreliable components. It is thus crucial to have both quantitative and qualitative analysis of the probabilities of system properties.Such analysis can be conducted by constructing a formal model of the system under verification and using Probabilistic Model Checking. However, this method is infeasible for large systems, due to the state space explosion. In this article, we demonstrate the successful use of statistical model checking to conduct such analysis directly from large SystemC models and allow designers to express a wide range of useful properties.The first contribution of this work is a framework to verify properties expressed in Bounded Linear Temporal Logic for SystemC models with both timed and probabilistic characteristics.Second, the framework allows users to expose a rich set of user code primitives as atomic propositions in Bounded Linear Temporal Logic. Moreover, users can define their own fine‐grained time resolution rather than the boundary of clock cycles in the SystemC simulation.The third contribution is an implementation of a statistical model checker. It contains an automatic monitor generation for producing execution traces of the model‐under‐verification, the mechanism for automatically instrumenting the model‐under‐verification, and the interaction with statistical model checking algorithms.

Multi-core symbolic bisimulation minimisation

We introduce parallel symbolic algorithms for bisimulation minimisation, to combat the combinatorial state space explosion along three different paths. Bisimulation minimisation reduces a transition system to the smallest system with equivalent behaviour. We consider strong and branching bisimilarity for interactive Markov chains, which combine labelled transition systems and continuous-time Markov chains. Large state spaces can be represented concisely by symbolic techniques, based on binary decision diagrams. We present specialised BDD operations to compute the maximal bisimulation using signature-based partition refinement. We also study the symbolic representation of the quotient system and suggest an encoding based on representative states, rather than block numbers. Our implementation extends the parallel, shared memory, BDD library Sylvan, to obtain a significant speedup on multi-core machines. We propose the usage of partial signatures and of disjunctively partitioned transition relations, to increase the parallelisation opportunities. Also our new parallel data structure for block assignments increases scalability. We provide SigrefMC, a versatile tool that can be customised for bisimulation minimisation in various contexts. In particular, it supports models generated by the high-performance model checker LTSmin, providing access to specifications in multiple formalisms, including process algebra. The extensive experimental evaluation is based on various benchmarks from the literature. We demonstrate a speedup up to 95times for computing the maximal bisimulation on one processor. In addition, we find parallel speedups on a 48-core machine of another 17times for partition refinement and 24times for quotient computation. Our new encoding of the reduced state space leads to smaller BDD representations, with up to a 5162-fold reduction.

Protocol Verification by Simultaneous Reachability Graph

Non-executable transitions, deadlock states, and livelock cycles are typical errors in communication protocols. Reachability analysis is a direct method to detect these errors, while the state-space explosion is the most severe limitation to such a method. In this letter, a relief strategy is proposed by using the simultaneous reachability graph—a simple graph generated by the simultaneous execution of transitions that are executable on a global state. It is found out that both the correctness and types of errors of a protocol can be detected from the structure of such a graph. An algorithm for plotting the simultaneous reachability graph is developed and its complexity is considered. A numerical example about the handshake protocol is used to illustrate how the method works in practical applications.

Global and Local Deadlock Freedom in BIP

We present a criterion for checking local and global deadlock freedom of finite state systems expressed in BIP: a component-based framework for constructing complex distributed systems. Our criterion is evaluated by model-checking a set of subsystems of the overall large system. If satisfied in small subsystems, it implies deadlock-freedom of the overall system. If not satisfied, then we re-evaluate over larger subsystems, which improves the accuracy of the check. When the subsystem being checked becomes the entire system, our criterion becomes complete for deadlock-freedom. Hence our criterion only fails to decide deadlock freedom because of computational limitations: state-space explosion sets in when the subsystems become too large. Our method thus combines the possibility of fast response together with theoretical completeness. Other criteria for deadlock freedom, in contrast, are incomplete in principle, and so may fail to decide deadlock freedom even if unlimited computational resources are available. Also, our criterion certifies freedom from local deadlock, in which a subsystem is deadlocked while the rest of the system executes. Other criteria only certify freedom from global deadlock. We present experimental results for dining philosophers and for a multi-token-based resource allocation system, which subsumes several data arbiters and schedulers, including Milner’s token-based scheduler.

Using plant model features to generate reduced test cases for programmable controllers

Complete conformance testing is a model-based test technique for programmable controllers. It checks whether an implementation conforms to its specifications with regard to all possible combinations of input signals, which is useful for small scale and safety critical systems. However, the state space explosion issue limits its application to large scale systems. This paper presents a method for reducing state space in generation of test cases by utilizing not only specification models but also features extracted from plant models. The application on a benchmark case study shows that the number of test cases is reduced significantly.

Efficient verification of railway infrastructure designs against standard regulations

In designing safety-critical infrastructures s.a. railway systems, engineers often have to deal with complex and large-scale designs. Formal methods can play an important role in helping automate various tasks. For railway designs formal methods have mainly been used to verify the safety of so-called interlockings through model checking, which deals with state change and rather complex properties, usually incurring considerable computational burden (e.g., the state-space explosion problem). In contrast, we focus on static infrastructure models, and are interested in checking requirements coming from design guidelines and regulations, as usually given by railway authorities or safety certification bodies. Our goal is to automate the tedious manual work that railway engineers do when ensuring compliance with regulations, through using software that is fast enough to do verification on-the-fly, thus being able to be included in the railway design tools, much like a compiler in an IDE. In consequence, this paper describes the integration into the railway design process of formal methods for automatically extracting railway models from the CAD railway designs and for describing relevant technical regulations and expert knowledge as properties to be checked on the models. We employ a variant of Datalog and use the standardized “railway markup language” railML as basis and exchange format for the formalization. We developed a prototype tool and integrated it in industrial railway CAD software, developed under the name RailCOMPLETE®. This on-the-fly verification tool is a help for the engineer while doing the designs, and is not a replacement to other more heavy-weight software like for doing interlocking verification or capacity analysis. Our tool, through the export into railML, can be easily integrated with these other tools. We apply our tool chain in a Norwegian railway project, the upgrade of the Arna railway station.

Deadlock detection in complex software systems specified through graph transformation using Bayesian optimization algorithm

Abstract While developing concurrent systems, one of the important properties to be checked is deadlock freedom. Model checking is an accurate technique to detect errors, such as deadlocks. However, the problem of model checking in complex software systems is state space explosion in which all reachable states cannot be generated due to exponential memory usage. When a state space is too large to be explored exhaustively, using meta-heuristic and evolutionary approaches seems a proper solution to address this problem. Recently, a few methods using genetic algorithm, particle swarm optimization and similar approaches have been proposed to handle this problem. Even though the results of recent approaches are promising, the accuracy and convergence speed may still be a problem. In this paper, a novel method is proposed using Bayesian Optimization Algorithm (BOA) to detect deadlocks in systems specified formally through graph transformations. BOA is an Estimation of Distribution Algorithm in which a Bayesian network (as a probabilistic model) is learned from the population and then sampled to generate new solutions. Three different structures are considered for the Bayesian network to investigate deadlocks in the benchmark problems. To evaluate the efficiency of the proposed approach, it is implemented in GROOVE, an open source toolset for designing and model checking graph transformation systems. Experimental results show that the proposed approach is faster and more accurate than existing algorithms in discovering deadlock states in the most of case studies with large state spaces.

Using CSTPNs to model traffic control CPS

Transportation cyber-physical system (T-CPS) is a spatiotemporal discrete-continuous hybrid system. However, the hybrid T-CPSs have some analysis and modelling problems, especially the problems related to the spatiotemporal characteristics. Existing coloured Petri net approaches of traffic control cannot effectively analyse dynamic changes of cyber systems and physical entities in space and time. Moreover, some problems, related to the state space explosion and the large complex T-CPSs, have not been well solved. This study develops the innovative methods for T-CPS design and modelling via the development and application of coloured spatiotemporal Petri nets (CSTPNs). The proposed research ideas involve the CSTPN theory creation, the development of traffic intersection coordination control system using CSTPNs, the traffic simulation analysis and the implementation of T-CPS-based CSTPNs. The experimental results show that the new spatiotemporal theories and approaches of the traffic coordination control based on CSTPNs have excellent potentials to address the issues related to the spatiotemporal discrete-continuous characteristics of T-CPS. Moreover, these innovative methods with a good validity can be easily applied into practise for the development of T-CPS.

Statistical model checking of stochastic component-based systems

ABSTRACTBehaviour-interaction-priority (BIP) is a component-based framework that supports the rigorous design of embedded systems. This paper discusses stochastic BIP (SBIP) component systems, which involve semantics-based Markov chain models. We develop a method to translate the systems from SBIP into the models specified in the PRISM language. A bisimulation minimization approach is proposed to overcome the problem of state-space explosion of model checking. Finally, to illustrate the effectiveness of the proposed methods, we discuss a case study involving clock synchronization protocols for statistical and probabilistic model checking.

Order-reduction abstractions for safety verification of high-dimensional linear systems

Order-reduction is a standard automated approximation technique for computer-aided design, analysis, and simulation of many classes of systems, from circuits to buildings. To be used as a sound abstraction for formal verification, a measure of the similarity of behavior must be formalized and computed, which we develop in a computational way for a class of asymptotic stable linear systems as the main contributions of this paper. We have implemented the order-reduction as a sound abstraction process through a source-to-source model transformation in the HyST tool and use SpaceEx to compute sets of reachable states to verify properties of the full-order system through analysis of the reduced-order system. Our experimental results suggest systems with thousand of state variables can be reduced to systems with tens of state variables such that the order-reduction overapproximation error is small enough to prove or disprove safety properties of interest using current reachability analysis tools. Our results illustrate this approach is effective in tackling the state-space explosion problem for verification of high-dimensional linear systems.

Controller synthesis for dynamic hierarchical real-time plants using timed automata

We use timed I/O automata based timed games to synthesize task-level reconfiguration services for cost-effective fault tolerance in a case study. The case study shows that state-space explosion is a severe problem for timed games. By applying suitable abstractions, we dramatically improve the scalability. However, timed I/O automata do not facilitate algorithmic abstraction generation techniques. The case study motivates the development of timed process automata to improve modeling and analysis for controller synthesis of time-critical plants which can be hierarchical and dynamic. The model offers two essential features for industrial systems: (i) compositional modeling with reusable designs for different contexts, and (ii) state-space reduction technique. Timed process automata model dynamic networks of continuous-time communicating plant processes which can activate other plant processes. We show how to establish safety and reachability properties of timed process automata by reduction to solving timed games. To mitigate the state-space explosion problem, an algorithmic state-space reduction technique using compositional reasoning and aggressive abstractions is also proposed. In this article, we demonstrate the theoretical framework of timed process automata and the effectiveness of the proposed state-space reduction technique by extending the case study.

Survivability analysis of a two-tier infrastructure-based wireless network

Network design and operation of a mobile network infrastructure, especially its base stations, need to consider survivability as a fundamental requirement. Quantifiable approaches to survivability analysis of such infrastructures are crucial. The objective of this paper is to propose a model for quantification of the survivability of a two-tier infrastructure-based wireless network subject to massive failures, caused by e.g. natural disasters, common mode hardware and software failures, and security attacks. We use a Markov modelling approach to analyze the transient behavior of the recovery phases of a two-tier infrastructure-based wireless network. In order to take location information of base stations into consideration, the spatial average network performance is estimated by means of a stochastic geometry based approach. In order to avoid state space explosion while addressing large networks, an approximate product-form analysis approach is also presented, where the two base stations tiers are decoupled such that their survivability analysis can be studied independently. The assumptions used in the proposed models, including Poisson point process and product-form decomposition, are validated on real data. Numerical experiments are also performed to investigate the approximation accuracy and computational efficiency of the product-form analysis approach, as well as to examine the effects of different parameters on the network’s survivability. The results show that the approximate product-form approach has reasonably good accuracy and is suitable for analysis of large size networks.

Verifying integrity of exception handling in service-oriented software

In service-oriented software environments, that exceptions may not be fully handled is one of the main causes for system breakdown. Therefore, we need to verify integrity of software exception handling. At present verifying integrity of software exception handling mainly depends upon experiences of developer. Most of automatic formal verification mechanisms can only support some general features, such as equivalence, boundedness, security, etc. and easily cause state space explosion. This paper proposes an integrity verification method of exception handling in service-oriented software. We construct state spaces associated with exception handling and convert the issue of integrity verification into a model of boundedness analysis based on CPN, and reduce the size of state spaces by extending Stubborn Set and Transition Dependency Graph. An example and experimental results based on extended CPN tools confirm that our method has good generalisation abilities.

Verifying integrity of exception handling in service-oriented software

In service-oriented software environments, that exceptions may not be fully handled is one of the main causes for system breakdown. Therefore, we need to verify integrity of software exception handling. At present verifying integrity of software exception handling mainly depends upon experiences of developer. Most of automatic formal verification mechanisms can only support some general features, such as equivalence, boundedness, security, etc. and easily cause state space explosion. This paper proposes an integrity verification method of exception handling in service-oriented software. We construct state spaces associated with exception handling and convert the issue of integrity verification into a model of boundedness analysis based on CPN, and reduce the size of state spaces by extending Stubborn Set and Transition Dependency Graph. An example and experimental results based on extended CPN tools confirm that our method has good generalisation abilities.

A Taylor Series Approach for Service-Coupled Queueing Systems with Intermediate Load

This paper investigates the performance of a queueing model with multiple finite queues and a single server. Departures from the queues are synchronised or coupled which means that a service completion leads to a departure in every queue and that service is temporarily interrupted whenever any of the queues is empty. We focus on the numerical analysis of this queueing model in a Markovian setting: the arrivals in the different queues constitute Poisson processes and the service times are exponentially distributed. Taking into account the state space explosion problem associated with multidimensional Markov processes, we calculate the terms in the series expansion in the service rate of the stationary distribution of the Markov chain as well as various performance measures when the system is (i) overloaded and (ii) under intermediate load. Our numerical results reveal that, by calculating the series expansions of performance measures around a few service rates, we get accurate estimates of various performance measures once the load is above 40% to 50%.