In this work we extend the Emerson and Kahlon’s cutoff theorems for process skeletons with conjunctive guards to Parameterized Networks of Timed Automata, i.e. systems obtained by an unbounded number of Timed Automata instantiated from a finite set U_1 , ..., U_n of Timed Automata templates. In this way we aim at giving a first tool to universally verify software systems where an unknown number of software components (i.e. processes) interact with temporal constraints. It is often the case, indeed, that distributed algorithms show an heterogeneous nature, combining dynamic aspects with real-time aspects. In the paper we will also show how to model check a protocol that uses special variables storing identifiers of the participating processes (i.e. PIDs) in Timed Automata with conjunctive guards. This is non-trivial, since solutions to the parameterized verification problem often relies on the processes to be symmetric, i.e. indistinguishable. On the other side, many popular distributed algorithms make use of PIDs and thus cannot directly apply those solutions.

1. Parameterized Model-Checking for Timed Systems with
Conjunctive Guards
Luca Spalazzi, and Francesco Spegni
fspalazzi,spegnig@dii.univpm.it
DII @ UnivPM, Ancona, Italy
Veri

2. ed Software: Theories, Tools and Experiments
18th July 2014
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 1 / 31

3. Intro
You are here...
1 Intro
2 System Model
3 Speci

4. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 2 / 31

5. Intro
Parameterized Model-Checking Problem
De

6. nition
INPUT: process templates P1; : : : ; Pm, speci

7. cation
OUTPUT:
True: if 8(n1; : : : ; nk ) : P(n1)jj : : : jjP(nk ) j=
False: otherwise (+ counterexample)
Undecidable in general
see. (Apt and Kozen, '86), parameterized reachability
Relevance to Software Veri

8. cation
(Fault Tolerant) Distributed Algorithms
Security Protocols
. . .
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 3 / 31

9. Intro
Parameterized Model-Checking Problem
De

10. nition
INPUT: process templates P1; : : : ; Pm, speci

11. cation
OUTPUT:
True: if 8(n1; : : : ; nk ) : P(n1)jj : : : jjP(nk ) j=
False: otherwise (+ counterexample)
Undecidable in general
see. (Apt and Kozen, '86), parameterized reachability
Relevance to Software Veri

12. cation
(Fault Tolerant) Distributed Algorithms
Security Protocols
. . .
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 3 / 31

13. Intro
Parameterized Model-Checking Problem
De

14. nition
INPUT: process templates P1; : : : ; Pm, speci

15. cation
OUTPUT:
True: if 8(n1; : : : ; nk ) : P(n1)jj : : : jjP(nk ) j=
False: otherwise (+ counterexample)
Undecidable in general
see. (Apt and Kozen, '86), parameterized reachability
Relevance to Software Veri

16. cation
(Fault Tolerant) Distributed Algorithms
Security Protocols
. . .
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 3 / 31

17. Intro
Cuto
upper bound to the number of copies for each process template
Cuto Theorem for Untimed Systems with Conjunctive/Disjunctive
guards (Emerson and Kahlon, 2003)
plus: automatic, modular approach (reuse model checkers)
minus: complexity may be high (i.e. non optimal)
until now, no work on cuto for timed systems (that we know. . . )
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 4 / 31

18. Intro
Parameterized Veri

19. cation of Timed Systems
Several formalisms (Timed Automata, Hybrid Systems, . . . )
Some negative results on parameterized veri

20. cation . . .
. . . all these results require synchronous rendezvous
Let's try dierent synchronization (e.g. conjunctive guards . . . )
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 5 / 31

21. System Model
You are here...
1 Intro
2 System Model
3 Speci

22. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 6 / 31

23. System Model
Parameterized Networks of Timed Automata - 1
Timed Automaton:
P = (S; ^s; C; ; ; I )
S: set of states
^s 2 S: initial state
C: set of clock variables
: set of boolean expressions on S
S TCC 2C S: transition relation
I : S ! TCC : state invariant mapping
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 7 / 31

24. System Model
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 8 / 31

25. System Model
Parameterized Networks of Timed Automata - 2
Network of TA with Conjunctive Guards:
P(n1)
jj 1 : : : jjP(nm)
m
guards in l have the form:
^
mnl
m6=i
(^sm
l _ pm
l _ _ qm
l ) ^
^
hk
h6=l
(
^
jnh
(^sj
h _ pj
h _ _ qj
h))
l ; : : : ; qm
l 2 Sm
l , pj
where pm
h; : : : ; qj
h 2 Sj
h, and ^sm
l , ^sj
h are the initial
l and Uj
states of Um
h, respectively.
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 9 / 31

26. System Model
Parameterized Networks of Timed Automata - 2
Network of TA with Conjunctive Guards:
P(n1)
jj 1 : : : jjP(nm)
m
guards in l have the form:
^
mnl
m6=i
(^sm
l _ pm
l _ _ qm
l ) ^
^
hk
h6=l
(
^
jnh
(^sj
h _ pj
h _ _ qj
h))
l ; : : : ; qm
l 2 Sm
l , pj
where pm
h; : : : ; qj
h 2 Sj
h, and ^sm
l , ^sj
h are the initial
l and Uj
states of Um
h, respectively.
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 9 / 31

27. System Model
Network Semantics
Con

28. guration:
(hs1; u1i; : : : ; hsm; umi)
sl : [1::nl ] ! Sl maps an instance to its current state, and
ul : [1::nl ] ! (Cl ! R0), maps an instance to its clock function
Continuous time model
Steps
delay: clocks update, local states unchanged
local: local state changes instantaneously, guard must hold
State invariants: 8i 2 [1; nl ] : ul (i) j= I i
l (sl (i ))
Interleaving semantics
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 10 / 31

29. System Model
Network Semantics
Con

30. guration:
(hs1; u1i; : : : ; hsm; umi)
sl : [1::nl ] ! Sl maps an instance to its current state, and
ul : [1::nl ] ! (Cl ! R0), maps an instance to its clock function
Continuous time model
Steps
delay: clocks update, local states unchanged
local: local state changes instantaneously, guard must hold
State invariants: 8i 2 [1; nl ] : ul (i) j= I i
l (sl (i ))
Interleaving semantics
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 10 / 31

31. System Model
Network Semantics
Con

32. guration:
(hs1; u1i; : : : ; hsm; umi)
sl : [1::nl ] ! Sl maps an instance to its current state, and
ul : [1::nl ] ! (Cl ! R0), maps an instance to its clock function
Continuous time model
Steps
delay: clocks update, local states unchanged
local: local state changes instantaneously, guard must hold
State invariants: 8i 2 [1; nl ] : ul (i) j= I i
l (sl (i ))
Interleaving semantics
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 10 / 31

33. System Model
Network Semantics
Con

34. guration:
(hs1; u1i; : : : ; hsm; umi)
sl : [1::nl ] ! Sl maps an instance to its current state, and
ul : [1::nl ] ! (Cl ! R0), maps an instance to its clock function
Continuous time model
Steps
delay: clocks update, local states unchanged
local: local state changes instantaneously, guard must hold
State invariants: 8i 2 [1; nl ] : ul (i) j= I i
l (sl (i ))
Interleaving semantics
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 10 / 31

35. System Model
Network Semantics
Con

36. guration:
(hs1; u1i; : : : ; hsm; umi)
sl : [1::nl ] ! Sl maps an instance to its current state, and
ul : [1::nl ] ! (Cl ! R0), maps an instance to its clock function
Continuous time model
Steps
delay: clocks update, local states unchanged
local: local state changes instantaneously, guard must hold
State invariants: 8i 2 [1; nl ] : ul (i) j= I i
l (sl (i ))
Interleaving semantics
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 10 / 31

37. Speci

38. cation
You are here...
1 Intro
2 System Model
3 Speci

39. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 11 / 31

40. Speci

41. cation
ITCTL? - Syntax
Indexed-Timed CTL?
Syntax
::= j p(il ) j ^ j : j A j
V
il
::= j ^ j : j Uc
where 2 f;;;g
Example ^
i6=j
AG0!(CS mypid(i) ^ CS mypid(j))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 12 / 31

42. Speci

43. cation
ITCTL? - Syntax
Indexed-Timed CTL?
Syntax
::= j p(il ) j ^ j : j A j
V
il
::= j ^ j : j Uc
where 2 f;;;g
Example ^
i6=j
AG0!(CS mypid(i) ^ CS mypid(j))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 12 / 31

44. Speci

45. cation
ITCTL? - Semantics
Semantics
c j= V
p(il ) i p(il ) = state(c(l ; i))
c j=
il
(il ) i 8i 2 [1; nl ] : c j= (il )
c j= A i 8 2 paths(c) : j=
j= 1 Uc 2 i 9t0 c : bt0 j= 2 ^
8t 2 [0; t0) : bt j= 1
where
c is a con

46. guration
is a path; bt is a sux originating at time t
2 f;; ; ;=g
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 13 / 31

47. Cuto Theorems
You are here...
1 Intro
2 System Model
3 Speci

48. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 14 / 31

49. Cuto Theorems
Cuto Theorem for NTA with DG - 1
Monotonicity Lemma
(i) P(1)
1 jjP(n)
2 j= E(12) ) P(1)
1 jjP(n+1)
2 j= E(12)
(ii) P(1)
1 jjP(n)
2 j= E(11) ) P(1)
1 jjP(n+1)
2 j= E(11)
where is a MITL formula
Proof idea: in the big system, every instance behaves as in the
small one, except the (n + 1)-th that stutters in its initial state
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 15 / 31

50. Cuto Theorems
Cuto Theorem for NTA with DG - 1
Monotonicity Lemma
(i) P(1)
1 jjP(n)
2 j= E(12) ) P(1)
1 jjP(n+1)
2 j= E(12)
(ii) P(1)
1 jjP(n)
2 j= E(11) ) P(1)
1 jjP(n+1)
2 j= E(11)
where is a MITL formula
Proof idea: in the big system, every instance behaves as in the
small one, except the (n + 1)-th that stutters in its initial state
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 15 / 31

51. Cuto Theorems
Cuto Theorem for NTA with DG - 2
Bounding Lemma
(i ) 8n c2:P(1)
1 jjP(n)
2 j= E(12) i P(1)
1 jjP(c2)
2 j= E(12)
(ii) 8n c1:P(1)
1 jjP(n)
2 j= E(11) i P(1)
1 jjP(c1)
2 j= E(11)
where
is a MITL formula,
c1 = 2jP2j and c2 = 2jP2j + 1
Proof idea: given a path x in the big system,

52. nd a path y in the
small one, such that:
instances 11 and 12 are mimicked exactly
instance 22 is any instance with in

53. nite behavior
instances i2, for i 3 are for detecting deadlock
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 16 / 31

54. Cuto Theorems
Cuto Theorem for NTA with DG - 2
Bounding Lemma
(i ) 8n c2:P(1)
1 jjP(n)
2 j= E(12) i P(1)
1 jjP(c2)
2 j= E(12)
(ii) 8n c1:P(1)
1 jjP(n)
2 j= E(11) i P(1)
1 jjP(c1)
2 j= E(11)
where
is a MITL formula,
c1 = 2jP2j and c2 = 2jP2j + 1
Proof idea: given a path x in the big system,

55. nd a path y in the
small one, such that:
instances 11 and 12 are mimicked exactly
instance 22 is any instance with in

56. nite behavior
instances i2, for i 3 are for detecting deadlock
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 16 / 31

57. Cuto Theorems
Cuto Theorem for NTA with DG - 3
Cuto Theorem
8(n1; : : : ; nk ) : P(n1)
1 jj : : : jjP(nk )
k j= i
8(d1; : : : ; dk ) (c1; : : : ; ck ) : P(d1)
1 jj : : : jjP(dk )
k j=
Follows from Monotonicity Lemma, Bounding Lemma and duality of
E/A path quanti

58. ers
Trace equivalence of small and big systems (restricted to 1st
instance)
Smaller cutos:
c1 = 1; c2 = 2 for Einf=Ainf
c1 = 1; c2 = 1 for E

59. n=A

60. n
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 17 / 31

61. Cuto Theorems
Cuto Theorem for NTA with DG - 3
Cuto Theorem
8(n1; : : : ; nk ) : P(n1)
1 jj : : : jjP(nk )
k j= i
8(d1; : : : ; dk ) (c1; : : : ; ck ) : P(d1)
1 jj : : : jjP(dk )
k j=
Follows from Monotonicity Lemma, Bounding Lemma and duality of
E/A path quanti

62. ers
Trace equivalence of small and big systems (restricted to 1st
instance)
Smaller cutos:
c1 = 1; c2 = 2 for Einf=Ainf
c1 = 1; c2 = 1 for E

63. n=A

64. n
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 17 / 31

65. Cuto Theorems
Cuto Theorem for NTA with DG - 3
Cuto Theorem
8(n1; : : : ; nk ) : P(n1)
1 jj : : : jjP(nk )
k j= i
8(d1; : : : ; dk ) (c1; : : : ; ck ) : P(d1)
1 jj : : : jjP(dk )
k j=
Follows from Monotonicity Lemma, Bounding Lemma and duality of
E/A path quanti

66. ers
Trace equivalence of small and big systems (restricted to 1st
instance)
Smaller cutos:
c1 = 1; c2 = 2 for Einf=Ainf
c1 = 1; c2 = 1 for E

67. n=A

68. n
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 17 / 31

69. Cuto Theorems
Cuto Theorem for NTA with DG - 3
Cuto Theorem
8(n1; : : : ; nk ) : P(n1)
1 jj : : : jjP(nk )
k j= i
8(d1; : : : ; dk ) (c1; : : : ; ck ) : P(d1)
1 jj : : : jjP(dk )
k j=
Follows from Monotonicity Lemma, Bounding Lemma and duality of
E/A path quanti

70. ers
Trace equivalence of small and big systems (restricted to 1st
instance)
Smaller cutos:
c1 = 1; c2 = 2 for Einf=Ainf
c1 = 1; c2 = 1 for E

71. n=A

72. n
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 17 / 31

73. Cuto Theorems
Complexity of Parameterized Model Checking Problem
PMCP for Timed Systems with Conjunctive Guards is:
UNDECIDABLE for 2 ITCTL?
DECIDABLE and 2-EXPSPACE for 2 IMITL
DECIDABLE and EXPSPACE for 2 TCTL
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 18 / 31

74. An example
You are here...
1 Intro
2 System Model
3 Speci

75. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 19 / 31

76. An example
Example: Fischer's Protocol - 1
v = 0; c := 0 v := PID; c := 0 v = PID; c k
start init b1 b2 cs
v6= PID; c k
v := 0
Standard process de

77. nition in Fischer's protocol
c: local clock variable
k: timeout constant
v: shared integer variable
PID: integer constant, unique for every process
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 20 / 31

78. An example
Example: Fischer's Protocol - 2
Abstracting PID variable
v1
start v0
v2
Figure: V: a shared variable
start dipid mypid
Figure: W: a process-centric view of a
shared PID variable
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 21 / 31

79. An example
Example: Fischer's Protocol - 3
Resulting model: P00 = (P W) (with conjunctive guards)
P: standard process de

80. nition in Fischer's protocol
W: process abstraction of shared PID variable
conjunctive guards: obtained translating guards (v = PID, v6= PID)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 22 / 31

81. An example
Example: Fischer's Protocol - 4
Simpli

82. cation: removed states without incoming transition
Lower the required cuto (9 = 2 * 4 + 1)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 23 / 31

83. An example
Example: Fischer's Protocol - 5
Veri

84. cation results
FVormula Out Time (s) Mem (M)
Vi EF(CS mypid(i)) T 0.01 155.2
Vi6=j AG!(CS mypid(i ) ^ CS mypid(j)) T 30.1 155.2
i AF(CS mypid(i)) F 0.59 155.2
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 24 / 31

85. Final discussion
You are here...
1 Intro
2 System Model
3 Speci

86. cation
4 Cuto Theorems
5 An example
6 Final discussion
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 25 / 31

87. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

88. cation chains needs to be de

89. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

90. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

91. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

92. cation chains needs to be de

93. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

94. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

95. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

96. cation chains needs to be de

97. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

98. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

99. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

100. cation chains needs to be de

101. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

102. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

103. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

104. cation chains needs to be de

105. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

106. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

107. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

108. cation chains needs to be de

109. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

110. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

111. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

112. cation chains needs to be de

113. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

114. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

115. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

116. cation chains needs to be de

117. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

118. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

119. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

120. cation chains needs to be de

121. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

122. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

123. Final discussion
Some take-home messages
Cuto theorems are useful for verifying real-time systems in practice
May be non optimal :-/
Systems are too complex (i.e. infeasible)
Veri

124. cation chains needs to be de

125. ned (i.e. abstractions . . . )
Conjunctive guards can be used to abstract PID variables
For the future:
Extend cuto for timed systems with disjunctive guards
(pairwise rendezvous don't admit cuto!)
Explore systems mixing templates with CG/DG
(but not arbitrary boolean formula: PMCP is UNDECIDABLE!)
Compute cuto for speci

126. c process templates
Verify more complex benchmarks/real-world examples
(suggestions are welcome :-))
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 26 / 31

127. Final discussion
So long and thanks for all the

128. sh
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 27 / 31

129. Some approaches to PMCP
Abstraction (precise, CEGAR, . . . )
Proof theoretic
Inductive invariants
Satis

130. ability Modulo Theories
plus: semi-automatic
minus: semi-automatic
Cuto
upper bound to the number of copies for each process template
plus: automatic, modular approach (reuse model checkers)
minus: complexity may be high (i.e. non optimal)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 28 / 31

131. Parameterized Veri

132. cation of Timed Systems
Several formalisms (Timed Automata, Hybrid Systems, . . . )
Some results on parameterized veri

133. cation
Controller state reachability is undecidable in multi-clock dense timed
networks (Abdulla et al., 2004)
Controller state reachability is decidable in multi-clock discrete timed
networks (Abdulla et al., 2004)
Recurrent state problem is undecidable in timed networks (Abdulla and
Jonsson, 2003)
All these results require synchronous rendezvous . . .
No results on cutos for timed systems
No rendezvous (parameterized rendezvous systems don't have cuto)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 29 / 31

134. Parameterized Veri

135. cation of Timed Systems
Several formalisms (Timed Automata, Hybrid Systems, . . . )
Some results on parameterized veri

136. cation
Controller state reachability is undecidable in multi-clock dense timed
networks (Abdulla et al., 2004)
Controller state reachability is decidable in multi-clock discrete timed
networks (Abdulla et al., 2004)
Recurrent state problem is undecidable in timed networks (Abdulla and
Jonsson, 2003)
All these results require synchronous rendezvous . . .
No results on cutos for timed systems
No rendezvous (parameterized rendezvous systems don't have cuto)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 29 / 31

137. Parameterized Veri

138. cation of Timed Systems
Several formalisms (Timed Automata, Hybrid Systems, . . . )
Some results on parameterized veri

139. cation
Controller state reachability is undecidable in multi-clock dense timed
networks (Abdulla et al., 2004)
Controller state reachability is decidable in multi-clock discrete timed
networks (Abdulla et al., 2004)
Recurrent state problem is undecidable in timed networks (Abdulla and
Jonsson, 2003)
All these results require synchronous rendezvous . . .
No results on cutos for timed systems
No rendezvous (parameterized rendezvous systems don't have cuto)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 29 / 31

140. Parameterized Veri

141. cation of Timed Systems
Several formalisms (Timed Automata, Hybrid Systems, . . . )
Some results on parameterized veri

142. cation
Controller state reachability is undecidable in multi-clock dense timed
networks (Abdulla et al., 2004)
Controller state reachability is decidable in multi-clock discrete timed
networks (Abdulla et al., 2004)
Recurrent state problem is undecidable in timed networks (Abdulla and
Jonsson, 2003)
All these results require synchronous rendezvous . . .
No results on cutos for timed systems
No rendezvous (parameterized rendezvous systems don't have cuto)
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 29 / 31

143. Cuto for Timed Systems - Simple solution
reuse (untimed) cuto theorem
1 design timed process template
2 apply clock/zone abstraction
3 compute cuto on abstract states and instantiate
4 model check
plus: no need for theoretical results
minus: high cuto, cannot reuse model checkers for timed systems
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 30 / 31

144. Cuto for Timed Systems - Simple solution
reuse (untimed) cuto theorem
1 design timed process template
2 apply clock/zone abstraction
3 compute cuto on abstract states and instantiate
4 model check
plus: no need for theoretical results
minus: high cuto, cannot reuse model checkers for timed systems
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 30 / 31

145. Cuto for Timed Systems - Simple solution
reuse (untimed) cuto theorem
1 design timed process template
2 apply clock/zone abstraction
3 compute cuto on abstract states and instantiate
4 model check
plus: no need for theoretical results
minus: high cuto, cannot reuse model checkers for timed systems
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 30 / 31

146. Cuto for Timed Systems - Alternative solution
prove timed cuto theorems
1 design timed process template
2 compute cuto on original template and instantiate
3 model check
plus: the timed cuto theorems can be reused, can reuse existing
model checkers for timed systems, the cuto is smaller
minus: required some theoretical eort
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 31 / 31

147. Cuto for Timed Systems - Alternative solution
prove timed cuto theorems
1 design timed process template
2 compute cuto on original template and instantiate
3 model check
plus: the timed cuto theorems can be reused, can reuse existing
model checkers for timed systems, the cuto is smaller
minus: required some theoretical eort
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 31 / 31

148. Cuto for Timed Systems - Alternative solution
prove timed cuto theorems
1 design timed process template
2 compute cuto on original template and instantiate
3 model check
plus: the timed cuto theorems can be reused, can reuse existing
model checkers for timed systems, the cuto is smaller
minus: required some theoretical eort
L. Spalazzi, F. Spegni (UnivPM, Ancona) PMC for Timed Systems with Conj. Guards VSTTE 2014 31 / 31