JANI: Quantitative Model and Tool Interaction

Budde, Carlos E.; Dehnert, Christian; Hahn, Ernst Moritz; Hartmanns, Arnd; Junges, Sebastian; Turrini, Andrea

doi:10.1007/978-3-662-54580-5_9

Cited by 86 publications

(84 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, say we want to estimate the unreliability of the rft defined in Code 2 at T = 15.5. If the converter defined the variable count, internal to the iosa module corresponding to the Gate3 AND, then generateProperties() produces a pctl query as in The FIG tool was devised to study temporal logic queries of iosa models [10], described either in their native syntax or in the jani model exchange format [14]. Using res embedded in statistical model checking, FIG computes (arbitrary) cis that estimate the degree to which a model complies to a property specification.…”

Section: Converter: Rft → Iosamentioning

confidence: 99%

Rare Event Simulation for Non-Markovian Repairable Fault Trees

Budde

Biagi

Monti

et al. 2020

Tools and Algorithms for the Construction and Analysis of Systems

Self Cite

View full text Add to dashboard Cite

Dynamic fault trees (dft) are widely adopted in industry to assess the dependability of safety-critical equipment. Since many systems are too large to be studied numerically, dfts dependability is often analysed using Monte Carlo simulation. A bottleneck here is that many simulation samples are required in the case of rare events, e.g. in highly reliable systems where components fail seldomly. Rare event simulation (res) provides techniques to reduce the number of samples in the case of rare events. We present a res technique based on importance splitting, to study failures in highly reliable dfts. Whereas res usually requires meta-information from an expert, our method is fully automatic: By cleverly exploiting the fault tree structure we extract the so-called importance function. We handle dfts with Markovian and non-Markovian failure and repair distributions-for which no numerical methods existand show the efficiency of our approach on several case studies. Fault trees.A fault tree (ft) describes how component failures occur and propagate through the system, eventually leading to system failures. Technically, an ft is a directed acyclic graph whose leaves model component failures, and $ This work was partially funded by NWO, NS, and ProRail project 15474 (SE-whose other nodes (called gates) model failure propagation. Using fault trees one can compute dependability metrics to quantify how a system fares w.r.t. certain performance indicators. Two common metrics are system reliability-the probability that there are no system failures during a given mission time-and system availability-the average percentage of time that a system is operational.Static fault trees (aka standard fts) contain a few basic gates, like AND and OR gates. This makes them easy to design and analyse, but also limits their expressivity. Dynamic fault trees (dfts [21,52]) are a common and widely applied extension of standard fts, catering for more complex dependability patterns, like spare management and causal dependencies. To model these patterns, dfts come with additional gates, for instance SPARE, PAND, and FDEP.Such gates make dfts more difficult to analyse. In static fts it only matters whether or not a component has failed, so they can be analysed with Boolean methods, such as binary decision diagrams [32]. Dynamic fault trees, on the other hand, crucially depend on the failure order, so Boolean methods are insufficient. Moreover and on top of these two classes, repairable fault trees (rft [7]) permit components to be repaired after they have failed. This is crucial to model faulttolerant systems more realistically. Yet repairs make analyses even harder: it does not suffice to know which components failed, or in which order, but also if they are simultaneously failed. The general rule is that the more complex the formalism, the more realistic the model, and the harder the analyses. Fig. 2 is an rft with a top AND gate, a SPARE (Rcab), and three leaves.Fault tree analysis. The reliability/availability of a fault tree can be computed via...

show abstract

Section: Converter: Rft → Iosamentioning

confidence: 99%

Rare Event Simulation for Non-Markovian Repairable Fault Trees

Budde

Biagi

Monti

et al. 2020

Tools and Algorithms for the Construction and Analysis of Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…The current benchmarks in the QVBS were originally specified in the Galileo format [72] for fault trees, the GreatSPN format [1] for generalised stochastic Petri nets, the process algebra-based high-level modelling language Modest [36], the PGCL specification for probabilistic programs [32], PPDDL for probabilistic planning domains [77], and the lower-level guarded-command PRISM language [57]. For all benchmarks, the QVBS provides a translation to the tool-independent JSON-based Jani model exchange format [15]. The purpose of Jani is to establish a standard human-readable (though not easily humanwritable) format for quantitiative verification that simplifies the implementation of new tools and fosters model exchange and tool interoperability.…”

Section: Modelling Languagesmentioning

confidence: 99%

“…To this end, QComp is complemented by a new collection of benchmarks, the Quantitative Verification Benchmark Set (QVBS, [46]). All models in the QVBS are available in their original modelling language as well as the Jani model exchange format [15]. While Jani is intended as the standard format for QComp, not all tools implement support for it yet and were thus executed only on those benchmarks for which they support the original modelling language.…”

Section: Introductionmentioning

confidence: 99%

The 2019 Comparison of Tools for the Analysis of Quantitative Formal Models

Hahn

Hartmanns

Hensel

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Quantitative formal models capture probabilistic behaviour, real-time aspects, or general continuous dynamics. A number of tools support their automatic analysis with respect to dependability or performance properties. QComp 2019 is the first, friendly competition among such tools. It focuses on stochastic formalisms from Markov chains to probabilistic timed automata specified in the Jani model exchange format, and on probabilistic reachability, expected-reward, and steady-state properties. QComp draws its benchmarks from the new Quantitative Verification Benchmark Set. Participating tools, which include probabilistic model checkers and planners as well as simulation-based tools, are evaluated in terms of performance, versatility, and usability. In this paper, we report on the challenges in setting up a quantitative verification competition, present the results of QComp 2019, summarise the lessons learned, and provide an outlook on the features of the next edition of QComp.

show abstract

“…It uses the toolset's infrastructure to transform various input languages into an internal metamodel corresponding to a network of stochastic hybrid automata (SHA [30]) with discrete variables. The following input languages are currently supported: -Modest [30], a process algebra-based modelling language for stochastic timed systems featuring high-level constructs such as recursive process calls, loops, and exception handling; -xSADF [35], an extension of scenario-aware dataflow with continuous probability distributions and nondeterminism, a formalism particularly suited to the study of embedded streaming applications; and -Jani [14], a model exchange format designed to improve the interoperation of quantitative verification tools. Other tools provide converters to Jani from various Petri net formats or the Prism language [47].…”

Section: The Modes Toolmentioning

confidence: 99%

Automated compositional importance splitting

Budde¹,

D’Argenio²,

Hartmanns³

2019

Science of Computer Programming

Self Cite

View full text Add to dashboard Cite

In the formal verification of stochastic systems, statistical model checking uses simulation to overcome the state space explosion problem of probabilistic model checking. Yet its runtime explodes when faced with rare events, unless a rare event simulation method like importance splitting is used. The effectiveness of importance splitting hinges on nontrivial model-specific inputs: an importance function with matching splitting thresholds. This prevents its use by nonexperts for general classes of models. In this paper, we present an automated method to derive the importance function. It considers both the structure of the model and of the formula characterising the rare event. It is memory-efficient by exploiting the compositional nature of formal models. We experimentally evaluate it in various combinations with two approaches to threshold selection as well as different splitting techniques for steady-state and transient properties. We find that Restart splitting combined with thresholds determined via a new expected success method most reliably succeeds and performs very well for transient properties. It remains competitive in the steady-state case, which is however challenging to all combinations we consider. All methods are implemented in the modes tool of the Modest Toolset and in the Fig rare event simulator.state space explosion problem limits this approach to small models. For other models, in particular those involving events governed by general continuous probability distributions, model checking techniques only exist for specific subclasses with limited scalability [55] or merely compute probability bounds [31].Statistical model checking (SMC [38,72]), i.e. using Monte Carlo simulation with formal models, has become a popular alternative for large models, and for formalisms not amenable to (traditional) probabilistic model checking like stochastic (timed) automata [9,18]. SMC trades memory for runtime: memory usage is constant, but the number of simulation runs which are needed to converge to a result can easily explode with the desired precision. This is exacerbated in the presence of rare events. For instance, when the true probability of an event is 10 −15 , one may want that the error of an estimation is no larger than 10 −16 . Such tight requirements in the precision of estimations may render traditional Monte Carlo simulation approaches infeasible [24,65].Rare event simulation methods (RES [58]) have been developed to attack this problem. They increase the number of simulation runs that reach the rare event and adjust the statistical evaluation accordingly. Broadly speaking, the main RES methods are importance sampling and importance splitting. They complement each other in several application domains [57]. The former modifies the probability distributions which dictate the stochastic behaviour of the model, with the aim to make the event more likely to occur. The challenge lies in finding a "good" change of measure to modify probabilities in an effective way. Importance splitting instead does n...

show abstract

JANI: Quantitative Model and Tool Interaction

Cited by 86 publications

References 49 publications

Rare Event Simulation for Non-Markovian Repairable Fault Trees

Rare Event Simulation for Non-Markovian Repairable Fault Trees

The 2019 Comparison of Tools for the Analysis of Quantitative Formal Models

Automated compositional importance splitting

Contact Info

Product

Resources

About