Limit-Deterministic Bchi Automata for Probabilistic Model Checking - PowerPoint PPT Presentation

Limit-Deterministic Büchi Automata for Probabilistic Model Checking Jan Křetínský Javier Esparza Salomon Sickert Stefan Jaax Technische Universität München

PROBABILISTIC MODEL CHECKING • Markov Decision Process (MDP) . At each state, a scheduler chooses a probability distribution, and then the next state is chosen stochastically according to the distribution. • For a fixed scheduler: MDP → Markov chain

PROBABILISTIC MODEL CHECKING • Qualitative Model Checking: • Input: MDP, LTL formula • Does the formula hold for all schedulers with probability 1? • Quantitative Model Checking: • Input: MDP, LTL formula, threshold c • Does the formula hold for all schedulers with probability at least c?

PROBABILISTIC MODEL CHECKING • Qualitative Model Checking: • Input: MDP, LTL formula • Does the formula hold for all schedulers with probability 1? • Quantitative Model Checking: • Input: MDP, LTL formula, threshold c • Does the formula hold for all schedulers with probability at least c?

LIMIT-DETERMINISTIC BÜCHI AUTOMATA Initial Accepting Component Component “Jumps” deterministic (possibly) non-deterministic

AUTOMATA-BASED MODEL CHECKING Kripke struct. LTL Vardi , Wolper middle 80s Nondet. Büchi Product Emptiness check Yes/No

QUALITATIVE PROB. MODEL CHECKING MDP LTL Nondet. Büchi Vardi and Wolper Courcoubetis, and Yannakakis [95] Product Limit-det. Büchi Vardi and Wolper Courcoubetis, and Prob=1? Yannakakis [95] Yes/No

QUALITATIVE PROB. MODEL CHECKING MDP LTL • Double exponential complexity in the formula, optimal. Nondet. Büchi • At the time: not applicable to the Vardi and Wolper quantitative case. Courcoubetis, and Yannakakis [95] Product Limit-det. Büchi Vardi and Wolper Courcoubetis, and Prob=1? Yannakakis [95] Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL Nondet. Büchi Safra [89] Product Det. Rabin P ≥0,7? Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL • Also double exponential complexity in the formula. • Solves both the qualitative and quantitative case. Nondet. Büchi Safra [89] Product Det. Rabin P ≥0,7? Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL • Also double exponential complexity in the formula. • Solves both the qualitative and quantitative case. Nondet. Büchi Safra [89] • In practice large automata Product Det. Rabin • Hard to implement efficiently • Rise of “safraless” approaches: • Acacia, ltl3dra, Rabinizer, … P ≥0,7? Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL Our Construction Product Limit-det. Büchi P ≥0.7? Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL • Optimal: 2 2O(n) • Simpler construction Our • Smaller automata Construction • Same MC algorithm as for det. automata Product Limit-det. Büchi P ≥0.7? Yes/No

QUANTITATIVE PROB. MODEL CHECKING MDP LTL • Optimal: 2 2O(n) • Simpler construction Our • Smaller automata Construction • Same MC algorithm as for det. automata Product Limit-det. Büchi P ≥0.7? Yes/No

LIMIT-DETERMINISM Initial Accepting Component Component “Jumps” non-deterministic deterministic

LIMIT-DETERMINISM In our construction: Initial Accepting Component Component “Jumps” non-deterministic deterministic deterministic Every runs „uses“ nondeterminism at most once

PRELIMINARIES • Linear Temporal Logic in Negation Normal Form

PRELIMINARIES • Linear Temporal Logic in Negation Normal Form • Monotonicity of NNF: � satisfies � if � � satisfies all the subformulas of � satisfied by � , and perhaps more then � � satisfies �

PRELIMINARIES • Linear Temporal Logic in Negation Normal Form Only liveness operator. • Monotonicity of NNF: � satisfies � if � � satisfies all the subformulas of � satisfied by � , and perhaps more then � � satisfies �

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON tt

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON � � ff � tt

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON � � , � � �� ff � tt

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON � � , � � �� ff � � � �� tt

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON � � , � � �� ff � � � � �� ∧ �� ∧ �� tt ��� �� �

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON The formula �� ( � , � ) (“ � after � ”) is defined by: � � �� ( � , � )

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON The automaton „tracks“ the • property that must hold now for the original property to hold at the beginning � � , � Formulas with � , � , � : ✔ • � �� ff Formulas with � : not good • � � � enough. � �� ∧ �� ∧ �� tt ��� �� �

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON The automaton „tracks“ the • property that must hold now for the original property to hold at the beginning � � , � Formulas with � , � , � : ✔ • � �� ff Formulas with � : not good • � � � enough. � �� ∧ �� ∧ �� tt ��� �� �

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON The automaton „tracks“ the • property that must hold now for the original property to hold at the beginning � � , � Formulas with � , � , � : ✔ • � �� ff Formulas with � : not good • � � � enough. � �� ∧ �� ∧ �� tt ��� �� �

FIRST STEP: A DETERMINISTIC „TRACKING“ AUTOMATON � , � The automaton „tracks“ the • property that must hold now for ��� the original property to hold at the beginning � � , � Formulas with � , � , � : ✔ • � �� ff Formulas with � : not good • � � � enough. � �� ∧ �� ∧ �� tt ��� �� �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � .

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . … a c c c b b a b �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . �� … a c c c b b a b �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . �� … �� �� �� �� �� �� … a c c c b b a b �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . �ρ �� … �� �� �� �� �� �� … a c c c b b a b �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . �ρ … �ρ �ρ �ρ �ρ �� … �� �� �� �� �� �� … a c c c b b a b �

� -SUBFORMULAS Fix a formula � and a word � . • Let �� be a � -subformula of � . �ρ … �ρ �ρ �ρ �ρ �� … �� �� �� �� �� �� … a c c c b b a b � Informally: while reading the word � , the set of • � -subformulas that hold cannot decrease, and eventually stabilizes to a set True � s( � , � ).

SECOND STEP: JUMPING We modify the tracking automaton so that at any moment it • can nondeterministically jump to the accepting component. From each state � we add a jump for every set � of • � -subformulas of � . „Meaning“ of a � -jump at state � : The automaton „guesses“ • that the rest of the word satisfies � (every formula of � ), and 1. � ⇒ � 2. even if no other � -subformula of � ever becomes true. After the jump, the task of the accepting component is to • „check that the guess is correct“, i.e., accept iff the guess is correct.

SECOND STEP: JUMPING We modify the tracking automaton so that at any moment it • can nondeterministically jump to the accepting component. From each state � we add a jump for every set � of • � -subformulas of � . „Meaning“ of a � -jump at state � : The automaton „guesses“ • that the rest of the word satisfies � (every formula of � ), and 1. � ⇒ � 2. even if no other � -subformula of � ever becomes true. After the jump, the task of the accepting component is to • „check that the guess is correct“, i.e., accept iff the guess is correct.

SECOND STEP: JUMPING We modify the tracking automaton so that at any moment it • can nondeterministically jump to the accepting component. From each state � we add a jump for every set � of • � -subformulas of � . „Meaning“ of a � -jump at state � : The automaton „guesses“ • that the rest of the word satisfies � (every formula of � ), and 1. � ⇒ � 2. even if no other � -subformula of � ever becomes true. After the jump, the task of the accepting component is to • „check that the guess is correct“, i.e., accept iff the guess is correct.