Probabilistic Model Checking of Regenerative Concurrent Systems

Abstract

Abstract-We consider the problem of verifying quantitative reachability properties in stochastic models of concurrent activities with generally distributed durations. Models are specified as Stochastic Time Petri Nets (STPNs) and checked against Boolean combinations of interval until operators imposing bounds on the probability that the marking process will satisfy a goal condition at some time in the interval [α, β] after an execution that never violates a safety property. The proposed solution is based on the analysis of regeneration points in the model execution: a regeneration is encountered after a discrete event if the future evolution depends only on the current marking and not on its previous history, thus satisfying the Markov property. We analyze systems in which multiple generally distributed timers can be started or stopped independently, but regeneration points are always encountered with probability 1 after a bounded number of discrete events. Leveraging the properties of regeneration points in probability spaces of execution paths, we show that the problem can be reduced to a set of Volterra integral equations, and we provide algorithms to compute their parameters through the enumeration of finite sequences of stochastic state classes encoding the joint probability density function (PDF) of generally distributed timers after each discrete event. The computation of symbolic PDFs is limited to the first regeneration epoch, and the repetitive structure of the stochastic process is exploited also before the lower bound α, providing crucial benefits for large time bounds. A case study is presented through the probabilistic formulation of Fischer's mutual exclusion protocol, a well-known real-time verification benchmark.

The ORIS Tool: Quantitative Evaluation of Non-Markovian Systems

“…Stochastic duration of system activities and random choices are captured by probability distributions and weights associated with transitions, respectively. The characterization of these stochastic parameters identifies an STPN model that casts the set Ω of timed firing sequences determined by the underlying TPN into a probability space [55].…”

“…ORIS has been developed for several years and put to the test of practice in various application domains, addressing different modeling and evaluation challenges [55], [24], [14], [25], [13], [20], [11]. Overall, ORIS is now a well-engineered software tool, fully implemented in Java, designed so as to accommodate agile implementation of new features for Petri net models and new solution techniques for their underlying stochastic processes.…”

“…Specifically, in Sections 2 and 3, we illustrate how to construct STPN models and perform quantitative analysis of their underlying stochastic processes, respectively, using a running example from the literature on software rejuvenation to describe the typical modeling and evaluation workflow in ORIS (including derivation of distributions of GEN durations), the class of properties that can be analyzed, and the limits of the analysis methods. In Section 4, we review selected case studies where ORIS has been applied to the quantitative evaluation of models of real-time software [24], [55], railway signalling systems [13], repair procedures for gas and water distribution networks [14], [25], and activity recognition [20], [11]. Finally, conclusions are drawn in Section 5.…”

Automated compositional importance splitting

“…All methods are implemented in the modes tool of the Modest Toolset and in the Fig rare event simulator.state space explosion problem limits this approach to small models. For other models, in particular those involving events governed by general continuous probability distributions, model checking techniques only exist for specific subclasses with limited scalability [55] or merely compute probability bounds [31].Statistical model checking (SMC [38,72]), i.e. using Monte Carlo simulation with formal models, has become a popular alternative for large models, and for formalisms not amenable to (traditional) probabilistic model checking like stochastic (timed) automata [9,18].…”

“…state space explosion problem limits this approach to small models. For other models, in particular those involving events governed by general continuous probability distributions, model checking techniques only exist for specific subclasses with limited scalability [55] or merely compute probability bounds [31].…”