350 likes | 476 Views
Probabilistic Verification of Discrete Event Systems. H åkan L. S. Younes. The Problem. Given a model of a discrete event system, check if certain properties hold The model is a stochastic process (GSMP) Properties are expressed using a logic formalism (CSL). Probabilistic Verification.
E N D
Probabilistic Verification of Discrete Event Systems Håkan L. S. Younes
The Problem • Given a model of a discrete event system, check if certain properties hold • The model is a stochastic process (GSMP) • Properties are expressed using a logic formalism (CSL)
Probabilistic Verification • Verification of probabilistic properties • “The probability of reaching a failure state within 60 minutes is less than 0.1” • Probabilistic verification of properties • “The probability of property P holding is at least 0.95”
Discrete Event System (DES) • Event-driven system • Discrete state changes at the occurrence of events • Examples: • Manufacturing systems • Queueing systems • Communication protocols
Why Probabilistic Verification? • The dynamics of a DES is too complex for symbolic methods • Use simulation to generate sample paths • Use acceptance sampling to verify probabilistic properties
a set of states • a set of transitions (or events) S2 S1 S3 S4 Stochastic Processes • A stochastic process consists of
1.0 S2 0.2 0.4 S1 S3 0.8 0.6 1.0 S4 Markov Processes • The Markov assumption • There is enough information in the current state to determine the future behavior
Holding Times • The holding time is the time spent in a state before an event occurs • Holding times are positive random variables • Can be discrete or continuous
4 1.0 3 State S2 2 0.4 1 S1 1.0 S3 Time 0.6 S4 0.8 0.2 Continuous-timeMarkov Chain (CTMC) • Holding times are governed by exponential distributions
1.0 S2 0.4 S3 S1 1.0 0.6 S4 0.8 0.2 Semi-Markov Process • Holding times are governed by arbitrary (positive) distributions
4 E2 1.0 S2 3 State E3 2 0.4 1 E1 S3 S1 0.5 0.5 E2 Time E1 3.5 3.5 - - - 0.6 E1 S4 E2 5.0 5.0 1.5 1.5 - 1.0 0.7 0.3 E3 - - 2.0 2.0 - Generalized Semi-Markov Process (GSMP) • Holding times can depend on the history
Properties • Qualitative • “P will eventually hold on all future execution paths” • Quantitative • “P will hold before time t with probability at least on future execution paths”
[EMSS89]* *Discrete time Problem Space Properties Qualitative Quantitative [ASSB96],[BKH99] CTMC Model [ACD91] My Work GSMP
Continuous Stochastic Logic (CSL) • State formulas: a, ¬, 12, Pr() • Truth value is determined in a single state • Path formulas: X , 1Ut2 • Truth value is determined over an execution path
t0 t1 t2 S0,C0 S1,C1 S2,C2 Execution Paths • Current state + current clock settings = internal state • The internal state contains enough information to determine the future behavior • A sequence of internal states is an execution path
CSL Semantics(State Formulas) • Atomic proposition: a • Negation: ¬ • Holds iff does not hold in current state • Conjunction: 12 • Holds iff both 1 and 2 hold in current state
CSL Semantics(More State Formulas) • Probabilistic statement: Pr() • Holds iff is true over at most a proportion of execution paths starting in the current state
CSL Semantics(Path Formulas) • Next state: X • Holds iff holds in the next state along the current execution path • Until: 1Ut2 • Holds iff 2 becomes true in some state along the current execution path before time t, and 1 is true in all prior states
2 3 4 11 a,¬b a,¬b a,¬b b b 2 3 4 11 a,¬b ¬a,¬b a,¬b b b 2 3 4 11 a,¬b a,¬b a,¬b a,¬b b More on Until • Consider the formula aU17b
Verifying Probabilistic Statements • Verify Pr() • Generate sample execution paths using discrete event simulation • Verify over each sample path • If is true, then we have a positive sample • If is false, then we have a negative sample • Based on the proportion of positive samples, determine if Pr() holds
True, false,or anothersample? Sequential Hypothesis Testing • Hypothesis: Pr()
Error Bounds • Probability of false negative: • We say that Pr() is false when it is true • Probability of false positive: • We say that Pr() is true when it is false
False negatives False negatives Indifference region 1 – Probability of acceptingPr() as true False positives False positives – + Actual probability of holding Indifference Region
Reject Reject Number ofpositive samples Continue sampling Continue sampling Accept Accept Number of samples Graphical Representation of Statistical Test • We can find an acceptance line and a rejection line given , , , and
True, false,or anothersample? Verification of Nested Probabilistic Statements • Suppose , in Pr(), contains probabilistic statements
Indirect Sampling • Want samples from random variable X • Can only get samples from Y such that • Pr[Y=1|X=1] 1 – ’ • Pr[Y=0|X=1] ’ • Pr[Y=1|X=0] ’ • Pr[Y=0|X=0] 1 – ’
Reject Number ofpositive samples Continue sampling Accept Number of samples Modified Test • find an acceptance line and a rejection line given , , , , ’, and ’:
Verification of Compound State Formulas • To verify ¬ with error bounds and • Verify with error bounds and • To verify 12 … n with error bounds and • Verify 1 though n with error bounds /n and /n
Sequential Verification of Conjunction • To verify 12 … n with error bounds and • Verify each i with error bounds and ’ • Return false as soon as any i is verified to be false • If all i are verified to be true, verify each i again with error bounds and /n • Return true iff all i are verified to be true
Verification of Path Formulas • To verify X with error bounds and • Verify with error bounds and in the next state • To verify 1Ut2 with error bounds and • Convert to conjunction • 1Ut2 holds if 2 holds in the first state, or if 2 holds in the second state and 1holds in all prior state, …
More on Verifying Until • Given 1Ut2, let n be the index of the first state more than t time units away from the current state • Conjunction of n conjuncts c1 through cn, each of size i • Simplifies if 1 or 2, or both, do not contain any probabilistic statements
E5 S4 S1: Safe, at restS2: Under attack, at restS3: Under attack, jumpingS4: Safe, jumping 6 4 E4 2 E2 S1 S3 26.3----0.0 89.9----0.0 89.9----0.0 -124.544.3--26.3 -124.544.3--26.3 -155.848.3--89.9 -155.848.3--89.9 -107.5-61.0-138.2 -107.5-61.0-138.2 -80.2-95.2-70.6 -80.2-95.2-70.6 ----36.2199.2 ----36.2199.2 -----150.8 59.4----235.4 E1 20 40 60 80 100 E1: Stork attackingE2: Frog killed E3: Start jumpingE4: Stork retreatsE5: Stop jumping E1:E2: E3: E4: E5: t: E3 E2 S2 Example • Verify Pr0.05(true U200dead) in S1 26.3----0.0
Summary • Algorithm for probabilistic verification of discrete event systems • Sample execution paths generated using discrete event simulation • Probabilistic properties verified using acceptance sampling • Algorithm can be used in an anytime manner
Future Work • Apply to hybrid dynamic systems • Develop heuristics for formula ordering and parameter selection • Use verification to aid policy generation for real-time stochastic domains