Model Checking in Systems Biology s Brim and Milan ska and David - PowerPoint PPT Presentation

Model Semantics Spectrum – Detailed s l d e i d s o c m r e t e c − i t d s t i i a f m P f h e D e c s r s e o M m d l n e t e s e c , t C d t e e s e o M r y e m m m s q T i a u i t D n e n − t a o v a i e t s i i t m i t t i o t e a s i o n n c r t t s c i a l u m s a r a t i u discrete values continuous values o d − e q d e t e t i a n l t i s f s time qualitatively abstracted s time quantitatively modeled c r l o e e n d a t o l i − n t m i t m u i m o e c u d e i t s s a m i − n u o t t i i o m m d C m e r e T l e a s s t E M t a e t A C o d D c , e h C m , E a M i s D t E t − i O c s u m o o u d n e i t l n s o c SFM 2013 33/150

Biological Hypotheses as Temporal Properties wet-lab measurements ⇒ time-series data low resolution – e.g., microarray data, series of western blots high resolution – fluorescence measurements (e.g., gene reporters) most typically population-level measurements (average behaviour) literature provides other constraints on system dynamics e.g., multiple steady states, species concentration correlation, . . . all can be formally captured by means of temporal logics SFM 2013 34/150

Experimental Measurements of Regulatory Dynamics systems measurements of transcriptome (mRNA concentration) very imprecise! SFM 2013 35/150

Experimental Measurements of Regulatory Dynamics western blots measurements of protein binding (presence of certain proteins) SFM 2013 36/150

Experimental Measurements of Regulatory Dynamics 1 Model is built on first-principles ⇒ purely qualitative (network topology) 2 To build the model we need to find all possible constraints that can be formulated. ⇒ static and dynamic constraints (properties) 3 Fitting is not enough, some data are too imprecise to be fittable. SFM 2013 37/150

Qualitative vs. quantitative temporal properties qualitative properties (LTL, CTL) modalities (possibilities/necessities in future behaviour) reachability of particular (sets of) states temporal ordering of events, monotonicity temporal correlations of model variables stability (attractors, basins of attraction) quantitative properties deterministic (MTL, MITL, STL) enhance modalities with (dense) time information exact timing of events, time-bounds stochastic (PLTL, PCTL, CSL) probability of property satisfaction stochasticity combined with time SFM 2013 38/150

Qualitative vs. quantitative temporal properties qualitative properties (LTL, CTL) modalities (possibilities/necessities in future behaviour) reachability of particular (sets of) states temporal ordering of events, monotonicity – time-series temporal correlations of model variables – time-series stability (attractors, basins of attraction) quantitative properties deterministic (MTL, MITL, STL) enhance modalities with (dense) time information exact timing of events, time-bounds stochastic (PLTL, PCTL, CSL) probability of property satisfaction stochasticity combined with time SFM 2013 38/150

Temporal Property Examples Qualitative properties enzyme E is never permanently exhausted GF ( E > 0) all molecules of the substrate S are finally transfered to the product P provided that the final state is stable S == 5 ⇒ FG ( P == 5 ∧ S == 0) enzyme E is used and finally returned back ( E ≥ 2) U [(0 < E < 2) U ( E ≥ 2)] SFM 2013 39/150

Temporal Property Examples Quantitative properties in the first 10 time units, enzyme E cannot permanently exhausted G [0 , 10] F ( E > 0) all molecules of the substrate S are transfered to the product P minimally in 2 and maximally in 5 time units provided that the final state is stable S == 5 ⇒ F [2 , 5] G ( P == 5 ∧ S == 0) enzyme E is used and finally returned back within the given time intervals ( E ≥ 2) U [1 , 2] [(0 < E < 2) U [1 , 2] ( E ≥ 2)] SFM 2013 40/150

Temporal Property Examples oscillation LTL: ( G [( A ≤ 3) ⇒ F ( A > 3)]) ∧ ( G [( A > 3) ⇒ F ( A ≤ 3)]) bistability CTL: EFAG ( A ≤ 5) ∧ EFAG ( A > 5) probabilistic modality PCTL: P ≥ 0 . 9 [ F ≤ 5 ( A = 3)] probabilistic modality with time CSL: P ≥ 0 . 9 [ F [1 , 2] ( A = 3)] SFM 2013 41/150

System Construction and Formal Methods required system properties specification verification construction specified model properties SFM 2013 42/150

Knowledge Discovery and Formal Methods system hypothesis validation reconstruction identification prediction inferred model properties SFM 2013 43/150

Outline Introduction 1 LTL Model Checking 2 Parallel LTL Model Checking 3 Discrete Abstraction of ODE Models 4 Case Studies 5 Model Checking of E. Coli Ammonium Transport Parameter Synthesis by Model Checking Parameter Synthesis and Classification for Boolean Networks SFM 2013 44/150

Kripke Structure Definition Let AP be the set of atomic propositions (logical expressions over model variables, typical inequalities). Kripke structure is the quadruple K = � S , S 0 , T , L � where: S is the finite set of states S 0 ⊆ S is the set of inititial states T ⊆ S × S such that ∀ s ∈ S , ∃ s ′ ∈ S : � s , s ′ � ∈ T L is the labeling L : S → 2 AP SFM 2013 45/150

Kripke structure – properties for a state s ∈ S , L ( s ) represents the set of all atomic propositions satisfied in s unfolding of the Kripke structure from any initial state is always an infinite-depth tree maximal paths in the unfolding represent individual (infinite) executions of the Kripke structure SFM 2013 46/150

Linear-time Temporal Logic – syntax Let AP be the set of atomic propositions. Formula ϕ is linear temporal logic (LTL) formula iff the following holds: ϕ = p for any p ∈ AP If ϕ 1 and ϕ 2 LTL formulae then: ¬ ϕ 1 , ϕ 1 ∧ ϕ 2 and ϕ 1 ∨ ϕ 2 are LTL formulae X ϕ 1 , F ϕ 1 a G ϕ 1 are LTL formulae ϕ 1 U ϕ 2 a ϕ 1 R ϕ 2 are LTL formulae SFM 2013 47/150

Linear Temporal Logic – semantics Let π = s 0 , s 1 , ..., s i , ... be an infinite sequence of states (a path) in a Kripke structure K . For j > 0 we denote π j the suffix s j , s j +1 , ..., s i , ... . Satisfiability relation | = is defined by induction: π | = p iff p ∈ L ( s 0 ) π | = ¬ ϕ iff π �| = ϕ π | = ϕ 1 ∧ ϕ 2 iff π | = ϕ 1 and π | = ϕ 2 π | = ϕ 1 ∨ ϕ 2 iff π | = ϕ 1 or π | = ϕ 2 = X ϕ iff π 1 | π | = ϕ = F ϕ iff ∃ i ≥ 0 . π i | π | = ϕ = G ϕ iff ∀ i ≥ 0 . π i | π | = ϕ = ϕ 1 U ϕ 2 iff ∃ j ≥ 0 . π j | = ϕ 2 and ∀ i < j . π i | π | = ϕ 1 = ϕ 1 R ϕ 2 iff ∀ j ≥ 0 , ∀ 0 ≤ i < j . π i �| = ϕ 1 ⇒ π j | π | = ϕ 2 . SFM 2013 48/150

Linear Temporal Logic – semantics X a ��� ��� a a b b ��� ��� ��� ��� F a ���� ���� b a b b ���� ���� ���� ���� G b ��� ��� ��� ��� ���� ���� ��� ��� b b b b ��� ��� ��� ��� ���� ���� ��� ��� ��� ��� ��� ��� ���� ���� ��� ��� a U b ��� ��� ��� ��� ���� ���� a a a b ��� ��� ��� ��� ���� ���� ��� ��� ��� ��� ���� ���� SFM 2013 49/150

Linear Temporal Logic – semantics For any formulae ϕ 1 , ϕ 2 the following holds: ¬ F ϕ ≡ G ¬ ϕ ¬ ( ϕ 1 U ϕ 2 ) ≡ ¬ ϕ 1 R ¬ ϕ 2 The full expressiveness is achieved by using just the operators ¬ , ∧ , X , U . SFM 2013 50/150

Linear Temporal Logic – semantics For any formulae ϕ 1 , ϕ 2 the following holds: ¬ F ϕ ≡ G ¬ ϕ ¬ ( ϕ 1 U ϕ 2 ) ≡ ¬ ϕ 1 R ¬ ϕ 2 The full expressiveness is achieved by using just the operators ¬ , ∧ , X , U . LTL formulae are most typically interpreted universally over Kripke structure paths: SFM 2013 50/150

Linear Temporal Logic – semantics For any formulae ϕ 1 , ϕ 2 the following holds: ¬ F ϕ ≡ G ¬ ϕ ¬ ( ϕ 1 U ϕ 2 ) ≡ ¬ ϕ 1 R ¬ ϕ 2 The full expressiveness is achieved by using just the operators ¬ , ∧ , X , U . LTL formulae are most typically interpreted universally over Kripke structure paths: Kripke structure as a model for a formula Let K be a Kripke structure. A formula ϕ is satisfied by K , K | = ϕ iff for each execution π = s 0 , ... such that s 0 ∈ S 0 it holds π | = ϕ . SFM 2013 50/150

Model checking Model Checking Problem Model checking problem is to deside for a given Kripke structure K and a temporal property Φ the problem K | = Φ. If the result is negative, a path π such that π �| = Φ is returned (a so-called counterexample ). SFM 2013 51/150

Model-Checking Overview Requirements System Error Formalization Formalization Property System Model Simulation Specification Invalid Model Checking Counterexample Valid SFM 2013 52/150

B¨ uchi Automaton Definition B¨ uchi automaton is the tuple A = ( S , Σ , S 0 , δ, F ) where Σ is the finite set of symbols, S is the finite set of states, S 0 ⊆ S is the set of initial states, δ : S × Σ → 2 S is the transition relation, F ⊆ S is the set of final (accepting) states. SFM 2013 53/150

B¨ uchi Automaton Language accepted by a B¨ uchi automaton (infinite) run of an automaton A over an infinite word w = a 1 a 2 ... is the sequence of states ρ = s 0 , s 1 , ... such that ∀ i : s i ∈ δ ( s i − 1 , a i ) inf ( ρ ) – the set of states that occur infinitely often in ρ , a run ρ is accepting iff inf ( ρ ) ∩ F � = ∅ L ( A ) denotes the so-called ω -regular language accepted by A , the set of all (infinite) words for which there exist a corresponding accepting run of A , ω -regular languages are closed under complementation. SFM 2013 54/150

B¨ uchi automata examples true x a > θ 1 x a > θ 1 a a SFM 2013 55/150

LTL Model Checking LTL Model Checking Specification formalized as LTL formula Automata-based approach to LTL model checking Employs B¨ uchi automata to express all paths of the Kripke structure under consideration all paths violating the specification Model satisfies the specification if the intersection of the sets is empty, i.e., if the synchronized B¨ uchi automaton accepts empty language. LTL model checking problem is reduced to the detection of accepting cycles in the graph of a B¨ uchi automaton. SFM 2013 56/150

Model Checking as a language inclusion problem Interpretation of a path π = s 0 , s 1 , ... in a Kripke structure K is a sequence of sets of APs: L ( π ) = L ( s 0 ) , L ( s 1 ) , ... Problem For a given Kripke structure K = ( S , S 0 , T , L ) and a given LTL formula ϕ decide K | = ϕ . Reformulation Let Σ = 2 AP . Consider two languages of infinite words: 1 L K = { L ( π ) | π is a path in K } 2 L ϕ = { L ( π ) | π | = ϕ } Then K | = ϕ iff L K ⊆ L ϕ . SFM 2013 57/150

Kripke structure as a B¨ uchi automaton Claim For each Kripke structure K = ( S , S 0 , T , L ) we can construct a B¨ uchi automaton A K such that L K = L ( A K ): A K = ( S , 2 AP , S 0 , δ, S ) where q ∈ δ ( p , a ) ⇔ ( p , q ) ∈ T ∧ L ( p ) = a . Observation Note that F = S (the set of final states coincides with the state space). SFM 2013 58/150

LTL formula as a B¨ uchi automaton Theorem [Vardi, Wolper 1986] For each LTL formula ϕ there exists (and can be effectively constructed) a B¨ uchi automaton A ϕ such that L ϕ = L ( A ϕ ). Construction goes through a generalized BA (extended in the acceptance condition – a system of accepting states sets, requirement to infinitely often visit all accepting sets). Complexity is 2 O ( n ) where n is the size of the formula. There exist many algorithms – check, e.g., http://spot.lip6.fr/wiki/ . Note LTL is less expressive then BAs. SFM 2013 59/150

Synchronous Product Claim Let A = ( S A , Σ , S 0 A , δ A , S A ), B = ( S B , Σ , S 0 B , δ B , F B ) be B¨ uchi automata, and F A = S A . Then a B¨ uchi automaton A × B that accepts the language L ( A × B ) = L ( A ) ∩ L ( B ) can be constructed in the following way: A × B = ( S A × S B , Σ , S 0 A × S 0 B , δ A × B , S A × F B ), ( p ′ , q ′ ) ∈ δ A × B (( p , q ) , a ) for all p ′ ∈ δ A ( p , a ) and q ′ ∈ δ B ( q , a ). SFM 2013 60/150

Model Checking reduced to language emptyness problem Claim For each LTL formula ϕ it holds that co - L ( A ϕ ) = L ( A ¬ ϕ ). K | = ϕ ⇔ L K ⊆ L ϕ K | = ϕ ⇔ L ( A K ) ⊆ L ( A ϕ ) K | = ϕ ⇔ L ( A K ) ∩ co - L ( A ϕ ) = ∅ K | = ϕ ⇔ L ( A K ) ∩ L ( A ¬ ϕ ) = ∅ K | = ϕ ⇔ ( L ( A K ) × L ( A ¬ ϕ )) = ∅ SFM 2013 61/150

Model Checking as an accepting cycle detection problem Claim A B¨ uchi automaton A = ( S , Σ , S 0 , δ, F ) accepts a nonempty language iff there exist states s ∈ F , s 0 ∈ S 0 , and the words w 1 , w 2 ∈ Σ ∗ such that s ∈ ˆ δ ( s 0 , w 1 ) and s ∈ ˆ δ ( s , w 2 ). In other words, the graph of the automaton contains a reachable accepting cycle. Model Checking Procedure 1 construct ( A K × A ¬ ϕ ) 2 detect if there is any accepting cycle 3 If accepting cycle found then K �| = ϕ . 4 If accepting cycle not found then K | = ϕ . SFM 2013 62/150

Accepting cycle detection Input Product automaton represented by three functions: init () – returns the initial states succs ( s ) – returns the direct successors of s ∈ S accept ( s ) – decides whether s ∈ S is accepting Output The answer YES/NO. A counterexample if the answer is NO. π = π 1 · ( π 2 ) ω where π 1 = s 0 , s 1 , ..., s k π 2 = s k +1 , s k +2 , ..., s k + n where s k ≡ s k + n ⇒ a so-called lasso shape. SFM 2013 63/150

Accepting cycle detection Nested DFS algorithm Performs two depth-first searches on the graph: 1st identifies reachable accepting states, 2nd test each accepting state for self-reachability. Search procedures must interleave in a particular way. 2nd (nested) procedure is started from an accepting state, when the 1st procedure backtracks from it (DFS postorder). SFM 2013 64/150

Outline Introduction 1 LTL Model Checking 2 Parallel LTL Model Checking 3 Discrete Abstraction of ODE Models 4 Case Studies 5 Model Checking of E. Coli Ammonium Transport Parameter Synthesis by Model Checking Parameter Synthesis and Classification for Boolean Networks SFM 2013 65/150

Parallel Model Checking Observation The complexity of biological models is continuously growing with the grand challenge of systems biology to integrate the partial models. A solution is to employ all the power of suitable contemporary HW platforms — parallelization. Problem Computing DFS-postorder is inherently sequential problem. Optimal parallel and scalable algorithm for computing DFS-postorder is unknown (and unlikely to exist). Nested DFS cannot efficiently use parallel hardware. SFM 2013 66/150

New Algorithms for LTL Model Checking Nested DFS algorithm Optimal, but unusable for parallel HW architectures. Other optimal algorithms Variants of Tarjan’s SCC decomposition Suffer from the same DFS-postorder problem. Desired algorithms Must be independent of DFS-postorder exploration. Must outperform DFS-postorder algorithms on new HW. But need not exhibit optimal complexity in general. SFM 2013 67/150

Algorithm OWCTY Idea Remove states that cannot lie on an accepting cycle. A state cannot be part of an accepting cycle if it is unreachable from an accepting state, it has no immediate predecessor. Realization Parallel removal procedures Reachability Elimination Repeated application of removal procedures until no state can be removed (fix-point). Non-empty graph indicates presence of accepting cycle. SFM 2013 68/150

OWCTY Demonstration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 1st iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration 2nd iteration SFM 2013 69/150

OWCTY Demonstration SFM 2013 69/150

Algorithm MAP Idea Eliminate accepting states that are outside an accepting cycle. An accepting state does not lie on a cycle if it is not a predecessor of itself. Realization Assume an ordering on accepting states. Propagate maximal accepting states. If a state is propagated into itself, accepting cycle is found. Remove maximal accepting states that are outside a cycle, and repeat until there are some accepting states left. Propagation of accepting states can be done in parallel. SFM 2013 70/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 A B 4 3 4 > 2 > Two workers A and B. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 A B 4 3 4 > 2 > Each worker processes its own states. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 A B 4 3 4 > 2 > Each worker processes its own states. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 A B 4 3 4 > 2 > Non local states are sent over. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 2 A B 4 3 4 > 2 > 2 States are processed in parallel. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 2 2 A B 4 3 4 > 2 > 2 2 States are processed in parallel. SFM 2013 71/150

Computing maximal accepting predecessors (MAPs) 1 5 6 2 2 2 A B 4 3 4 > 2 > 4 2 States are processed in parallel. SFM 2013 71/150