Optimal Counterexamples for Discrete-Time Markov Models - PowerPoint PPT Presentation

Optimal Counterexamples for Discrete-Time Markov Models Albert-Ludwigs-Universität Freiburg Ralf Wimmer Albert-Ludwigs-Universität Freiburg, Germany Joint work with Nils Jansen, Erika Ábrahám, Joost Pieter Katoen, Bernd Becker

Outline Overview on Probabilistic Model Checking Counterexamples Path-based Counterexamples Minimal Critical Subsystems Minimal critical command sets Conclusion and Future Work Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 2 / 23

Probabilistic Model Checking Model Description Model Property Model Checker Satisfied Violated Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Probabilistic Model Checking Model Description: Model Guarded command language Description x,y: [0..5] init 0 module M1 Model Property [ α ] ( x + y ≤ 2 ) → 0 . 4 : x ′ = 4 + 0 . 6 : x ′ = y + 1 endmodule Model Checker module M2 [ α ] ( x − y = 3 ) → 0 . 1 : y ′ = x + 0 . 9 : y ′ = 2 x Satisfied Violated endmodule Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Probabilistic Model Checking Model Models: Description α α 0 . 3 Model Property α β β 0 . 7 α Model DTMC MDP PA Checker Satisfied Violated Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Probabilistic Model Checking Probabilistic temporal logics Model Description Reachability: P ≤ λ ( F ¬ safe ) Model Property LTL/ ω -regular: P ≤ λ ( F G ¬ safe ) Model Checker PCTL: Satisfied Violated P ≤ λ ( F ( P ≥ κ ( G ¬ safe ))) Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Probabilistic Model Checking Model Checking (DTMCs): Model matrix-vector multiplication Description (linear) equation systems Model Property E. g.: Unbounded reachability of states T : Model Checker  1 , for s ∈ T ,    0 , if T unreachable from s , p s = P ( s , s ′ ) · p s ′ , otherwise . ∑  Satisfied Violated   s ′ ∈ S Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Probabilistic Model Checking Model Property violation: Description ◮ Compute counterexample Support for debugging Abstraction refinement Model Property Model Checker E Satisfied Violated Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 3 / 23

Counterexamples on Different Levels module M1 Minimal critical Description [ α ] g → p 1 : f 1 + · · · command sets endmodule Minimal critical State space subsystems Minimal critical Executions path sets Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 4 / 23

Counterexamples on Different Levels module M1 Minimal critical Description [ α ] g → p 1 : f 1 + · · · command sets endmodule Minimal critical State space subsystems Minimal critical Executions path sets Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 4 / 23

Path-based Counterexamples (1) Digital systems: Safety property: AG safe Violation: EF ¬ safe Counterexample: Path from the initial state to a ¬ safe state Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 5 / 23

Path-based Counterexamples (1) Digital systems: Safety property: AG safe Violation: EF ¬ safe Counterexample: Path from the initial state to a ¬ safe state Probabilistic systems: Safety property: P ≥ λ ( G safe ) Violation: P > 1 − λ ( F ¬ safe ) Counterexample Set C of finite paths from the initial state to a ¬ safe state with Prob ( C ) > 1 − λ Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 5 / 23

Path-based Counterexamples (2) Han, Katoen, Damman (Trans. Softw. Engin., 2009) Smallest, most indicative counterexamples smallest number of paths highest probability among all smallest counterexamples Computation: k shortest paths DTMC M → weighted graph G = ( S , E , w ) with: S = states of the DTMC ( s , s ′ ) ∈ S × S | P ( s , s ′ ) > 0 } � E = w ( s , s ′ ) = − log P ( s , s ′ ) Shortest path in G = most probable path in M Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 6 / 23

Path-based Counterexamples (3) Problem The number of required paths can be extremely large—much larger than the number of states! . . . ... 0.8 0.1 1 0.5 1 0.5 1 0.5 1 E start 0.1 1 0.5 1 0.5 1 0.5 1 ... Total probability to reach bad state: 0 . 2 Probability of a single path: 0 . 1 · 0 . 5 n − 1 Number of paths: 2 n Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 7 / 23

Counterexamples on Different Levels module M1 Minimal critical Description [ α ] g → p 1 : f 1 + · · · command sets endmodule Minimal critical State space subsystems Minimal critical Executions path sets Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 8 / 23

Critical Subsystems [Aljazzar/Leue, 2009; Jansen et al., 2011] Critical subsystem Subset S ′ of the states such that the probability of reaching a ¬ safe -state visiting only states from S ′ is already beyond 1 − λ . Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 9 / 23

Critical subsystems: Example P ≤ 0 . 25 ( F ¬ safe ) s 3 0.5 1 E ¬ safe 0.5 s 1 s 6 s 8 1 0.8 0.4 0.4 0.5 start s 0 0.1 s 4 0.3 0.6 0.2 0.5 0.1 s 2 s 7 s 9 0.5 0.2 0.9 0.8 s 5 0.7 Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 10 / 23

Critical subsystems: Example P ≤ 0 . 25 ( F ¬ safe ) s 3 0.5 1 E ¬ safe 0.5 s 1 s 6 s 8 1 0.8 0.4 0.4 0.5 start s 0 0.1 s 4 0.3 0.6 0.2 0.5 0.1 s 2 s 7 s 9 0.5 0.2 0.9 0.8 s 5 0.7 Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 10 / 23

Minimal critical subsystems Goal Compute a critical subsystem with a minimum number of states. Possible approaches: SAT-modulo-theories solving Mixed integer linear programming ◮ Wimmer et al., TACAS 2012 Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 11 / 23

MILP Formulation (DTMCs) Variables x s ∈ { 0 , 1 } – decision variable p s ∈ [ 0 , 1 ] reachability probability within the subsystem Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 12 / 23

MILP Formulation (DTMCs) Constraints minimize ∑ x s s ∈ S such that p s init > 1 − λ target states s : p s = x s non-target states s : p s ≤ x s p s ≤ ∑ P ( s , s ′ ) · p s ′ non-target states s : s ′ ∈ S Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 12 / 23

Improvements Speed-up by redundant constraints: Each state (except s init ) has a predecessor state ∑ x s ≤ x s ′ s ′ ∈ succ ( s ) Each state (except targets) has a successor state ∑ x s ≤ x s ′ s ′ ∈ pred ( s ) From each state a target state can be reached ∀ s ∈ S \ T ∀ s ′ ∈ succ ( s ) : t s , s ′ ≤ x s ∧ t s , s ′ ≤ x s ′ ∑ ∀ s ∈ S \ T : t s , s ′ = x s s ′ ∈ succ ( s ) ∀ s ∈ S \ T ∀ s ′ ∈ succ ( s ) : r s < r s ′ +( 1 − x s ) Each state can be reached from s init ... Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 13 / 23

Supported Properties and Systems Reachability ω -regular PCTL DTMCs � � � MDPs × � � PAs � � × Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 14 / 23

Experiments Model States Subsystem Time (s) Memory λ crowds5-8 68740 0.1 83 343 < 1 GB sleader4-8 12302 0.5 6150 22 < 1 GB consensus2-2 272 0.1 15 733 < 1 GB csma-2-6 66718 0.1 415 2364 < 1 GB Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 15 / 23

Counterexamples on Different Levels module M1 Minimal critical Description [ α ] g → p 1 : f 1 + · · · command sets endmodule Minimal critical State space subsystems Minimal critical Executions path sets Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 16 / 23

Counterexamples for PRISM programs Wimmer et al., QEST 2013 Minimal critical command sets Minimal subset of the commands such that their induced DTMC/MDP/PA is already buggy! Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 17 / 23

Counterexamples for PRISM programs Wimmer et al., QEST 2013 Minimal critical command sets Minimal subset of the commands such that their induced DTMC/MDP/PA is already buggy! 1 Assign a unique label to each command. 2 Construct the state space, labeling each transition with the commands it is created from (synchronization!) 3 Use an MILP formulation to minimize the number of commands. Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 17 / 23

Minimal critical command sets (DTMCs) Variables x c ∈ { 0 , 1 } indicates whether command c is selected p s ∈ [ 0 , 1 ] reachability probability starting in s Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 18 / 23

Minimal critical command sets (DTMCs) Constraints minimize ∑ x c c ∈ C such that p s init > 1 − λ p s = 1 s ∈ T : p s ≤ ∑ P ( s , s ′ ) · p s ′ s ∈ S \ T : s ′ ∈ S s ∈ S \ T , c ∈ L ( s ) : p s ≤ x c Sept. 2013 Ralf Wimmer – Optimal Counterexamples for Markov Models 18 / 23