Model Checking Parameterized Timed Systems

Lecture Notes in Computer Science

Time dependant models have been intensively studied for many reasons, among others because of their applications in software verification and due to the development of embedded platforms where reliability and safety depend to a large extent on the time features. Many of the time dependant models were suggested as real-time extensions of several well-known untimed models. The most studied formalisms include Networks of Timed Automata which extend the model of communicating finite-state machines with a finite number of real-valued clocks, and timed extensions of Petri nets where the added time constructs include e.g. time intervals that are assigned to the transitions (Time Petri Nets) or to the arcs (Timed-Arc Petri Nets). In this paper, we shall semiformally introduce these models, discuss their strengths and weaknesses, and provide an overview of the known results about the relationships among the models.

ArXiv, 2014

In this work we extend the Emerson and Kahlon's cutoff theorems for process skeletons with conjunctive guards to Parameterized Networks of Timed Automata, i.e. systems obtained by an \emph{apriori} unknown number of Timed Automata instantiated from a finite set $U_1, \dots, U_n$ of Timed Automata templates. In this way we aim at giving a tool to universally verify software systems where an unknown number of software components (i.e. processes) interact with continuous time temporal constraints. It is often the case, indeed, that distributed algorithms show an heterogeneous nature, combining dynamic aspects with real-time aspects. In the paper we will also show how to model check a protocol that uses special variables storing identifiers of the participating processes (i.e. PIDs) in Timed Automata with conjunctive guards. This is non-trivial, since solutions to the parameterized verification problem often relies on the processes to be symmetric, i.e. indistinguishable. On the other side, many popular distributed algorithms make use of PIDs and thus cannot directly apply those solutions.

In this work we extend the Emerson and Kahlon's cutoff theorems for process skeletons with conjunctive guards to Parameterized Networks of Timed Automata, i.e. systems obtained by an apriori unknown number of Timed Automata instantiated from a finite set U1, . . . , Un of Timed Automata templates. In this way we aim at giving a tool to universally verify software systems where an unknown number of software components (i.e. processes) interact with continuous time temporal constraints. It is often the case, indeed, that distributed algorithms show an heterogeneous nature, combining dynamic aspects with real-time aspects. In the paper we will also show how to model check a protocol that uses special variables storing identifiers of the participating processes (i.e. PIDs) in Timed Automata with conjunctive guards. This is non-trivial, since solutions to the parameterized verification problem often relies on the processes to be symmetric, i.e. indistinguishable. On the other side, many popular distributed algorithms make use of PIDs and thus cannot directly apply those solutions.

Fundamenta Informaticae, 2010

Bounded Model Checking (BMC) is an efficient technique applicable to verification of temporal properties of (timed) distributed systems. In this paper we show for the first time how to apply BMC to parametric verification of time Petri nets with discrete-time semantics. The properties are expressed by formulas of the logic PRTECTL -a parametric extension of the existential fragment of Computation Tree Logic (CTL).

Lecture Notes in Computer Science, 2005

In this paper we consider the model of Time Petri Nets (TPN) where time is associated with transitions. We also consider Timed Automata (TA) as defined by Alur & Dill, and compare the expressiveness of the two models w.r.t. timed language acceptance and (weak) timed bisimilarity. We first prove that there exists a TA A s.t. there is no TPN (even unbounded) that is (weakly) timed bisimilar to A. We then propose a structural translation from TA to (1-safe) TPNs preserving timed language acceptance. Further on, we prove that the previous (slightly extended) translation also preserves weak timed bisimilarity for a syntactical subclass T Asyn(≤, ≥) of TA. For the theory of TPNs, the consequences are: 1) TA, bounded TPNs and 1-safe TPNs are equally expressive w.r.t. timed language acceptance; 2) TA are strictly more expressive than bounded TPNs w.r.t. timed bisimilarity; 3) The subclass T Asyn(≤, ≥), bounded and 1-safe TPNs "à la Merlin" are equally expressive w.r.t. timed bisimilarity.

Petri Net, Theory and Applications, 2008

This paper considers time Petri nets (TPN model) for model checking. The main challenge in model checking techniques is to construct, with lesser resources (time and space), a much coarser abstraction preserving properties of interest. These properties can be verified using standard model checking techniques. In this paper, we review some techniques, proposed in the literature, to model check untimed and timed properties of the TPN.

Proc. of the Int. Workshop on Petri Nets and Software Engineering (PNSE’11)

Abstract. We consider two symbolic approaches to bounded model checking (BMC) of distributed time Petri nets (DTPNs). We focus on the properties expressed in Linear Temporal Logic without the neXt-time operator (LTL− X) and the existential fragment of Computation Tree Logic without the neXt-time operator (ECTL− X). We give a translation of BMC to SAT and describe a BDD-based BMC for both LTL− X and ECTL− X. The two translations have been implemented, tested, and compared with each other on two ...

IEEE Transactions on Industrial Informatics, 2000

Proc. of MEMICS, 2009

Timed-Arc Petri Nets (TAPN) is a well studied extension of the classical Petri net model where tokens are decorated with real numbers that represent their age. Unlike reachability, which is known to be undecidable for TAPN, boundedness and coverability remain decidable. The model is supported by a recent tool called TAPAAL which, among others, further extends TAPN with invariants on places in order to model urgency. The decidability of boundedness and coverability for this extended model has not yet been considered. We present a reduction from two-counter Minsky machines to TAPN with invariants to show that both the boundedness and coverability problems are undecidable.

IFAC Proceedings Volumes, 2004

This paper considers the Time Petri :-.let model (TPN model) and proposes a contraction of its generally infinite state space. This contraction preserves all CT L' properties of the model and produces finite graphs for bounded TPN models. When compared with other approaches «Yoneda et al., 1998) ; (Berthornieu et at., 2003». these graphs are smaller and much faster to compute. This paper shows also how to apply a fast computing bisimulation reduction rule to the obtained graphs so as to achieve or approach the optimal size with minor efforts.

Lecture Notes in Computer Science, 2004

Q -a set of all the concrete states of A P V -a set of propositional variables

Combinatorial Optimization and Theoretical Computer Science, 2008

In this paper we consider the model of Time Petri Nets (TPN) "à la Merlin" where a time interval is associated with the firing of a transition, but we extend it with open intervals. We also consider Timed Automata (TA) as defined by Alur & Dill. We investigate some questions related to expressiveness for these models : we study the impact of slight variations of semantics for TPN and we compare the expressive power of TA and TPN, with respect to both time language acceptance and weak time bisimilarity. We prove that TA and bounded TPNs (enlarged with strict constraints) are equivalent w.r.t. timed language equivalence, providing an efficient construction of a TPN equivalent to a TA. We then exhibit a TA A such that no TPN (even unbounded) is weakly bisimilar to A. Because of this last result, it is natural to try and identify the (strict) subclass of TA that is equivalent to TPN w.r.t. weak timed bisimilarity. Thus we give some further results: 1) we characterize the subclass TA − of TA that is equivalent to the original model of TPN as defined by Merlin, i.e. restricted to closed intervals, 2) we show that the associated membership problem for TA − is P SP ACE-complete and 3) we prove that the reachability problem for TA − is also P SP ACE-complete.

Journal of Logic and Computation, 2009

We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL * ) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative timed properties but are not suitable for effective verification of properties of real-life systems.

Electronic Proceedings in Theoretical Computer Science, 2012

Timed-arc Petri nets (TAPN) are a well-known time extension of the Petri net model and several translations to networks of timed automata have been proposed for this model. We present a direct, DBM-based algorithm for forward reachability analysis of bounded TAPNs extended with transport arcs, inhibitor arcs and age invariants. We also give a complete proof of its correctness, including reduction techniques based on symmetries and extrapolation. Finally, we augment the algorithm with a novel state-space reduction technique introducing a monotonic ordering on markings and prove its soundness even in the presence of monotonicity-breaking features like age invariants and inhibitor arcs. We implement the algorithm within the model-checker TAPAAL and the experimental results document an encouraging performance compared to verification approaches that translate TAPN models to UPPAAL timed automata.