Fig 2 - uploaded by Joost-Pieter Katoen
Content may be subject to copyright.
Source publication
. Markov chains are widely used in the context of the performance and reliability modeling of various systems. Model checking
of such chains with respect to a given (branching) temporal logic formula has been proposed for both discrete [34, 10] and
continuous time settings [7, 12]. In this paper, we describe a prototype model checker for discrete...
Contexts in source publication
Context 1
... this case, the expected value of X is . λ To illustrate the concept of a CTMC let us return to the telescope example. We make the following, not nec- essarily realistic, assumptions about the timing behavior of the telescope: each gyroscope has an average lifetime of 10 years, the average preparation time of a repair mission is two months, and to turn the telescope into sleep mode takes 1/100 year (about 3.5 days) on average. As- suming a base time scale of a single year, the real-time probabilistic behavior of the failure and repair of the gyroscopes is now modeled by the CTMC of Fig. 2. This model can be understood as follows. The mean residence time of a state is the reciprocal of the sum of its outgoing transition rates. In state 6, for instance, one out of 6 gyroscopes may fail. As these failures are stochastically independent and as each gyroscope fails with rate 1 , 10 this state has outgoing rate 6 . If less operational gyro- 10 scopes are available, these rates decrease proportionally, and state residence times become larger. Being in state 2 there are two possibilities: either one of the remaining two gyroscopes fails, or the telescope is turned into sleep mode. The mean residence time of this state is 10 . The 1002 DTMC of Fig. 1 can be obtained from the CTMC of Fig. 2 by multiplying the transition rates by the mean residence time of the state from which they emanate. On the applicability of CTMCs. Markov chains are widely used as simple, yet adequate models in diverse areas, ranging from mathematics and computer science to other disciplines such as operations research, industrial engin- eering, biology, and demographics. They can be used to estimate various performance characteristics; for instance, to quantify throughput of manufacturing systems, to locate bottlenecks in communication systems, or to estimate reliability in aerospace systems. Due to their modeling convenience and the presence of efficient analysis methods, the vast majority of applications of Markov chain modeling involve CTMCs as opposed to DTMCs. This might surprise the reader, as exponential distributions seem at first sight not to be of much practical value, despite their mathematical tractability. This is misleading. Exponential distributions are known to be an appropriate means to adequately model many phenomena with a stochastic nature, such as system lifetimes (failure rates), job arrival processes (inter-arrival times), and the like. Besides, if only the mean value of a random phenomenon is known – a situation that frequently occurs in practice – then the exponential distribution is the most indeterminate distribution, i.e., the distribution with the highest degree of randomness, that describes this phenomenon. Thus, it is the most appropriate distribution when just mean values are known. Technically speaking, the exponential distribution maximizes the entropy [60], a well-known notion from information theory. Due to the rapidly increasing size and complexity of systems, specifying and analyzing stochastic models at the level of states and transitions becomes more and more cumbersome and error-prone. In order to overcome this problem, CTMCs can be generated from higher-level specifications, such as queueing networks [24], stochastic Petri nets [1], stochastic process algebras [16, 40, 45], or from semi-formal software development techniques such as UML (The Unified Modeling Language) [58] or SDL (Specification and Description Language) [28]. The tool- development for these techniques and their success in several case studies of industrial importance during recent years has provided strong evidence that these solutions are indeed very promising. Model checking continuous-time Markov chains. Performance and dependability analysis of CTMCs most often boils down to the calculation of steady-state and transient state probabilities. Steady-state probabilities refer to the system behavior in the “long run”, while the transient probabilities consider the system at a fixed time instant t . High-level measures-of-interest are determined on the basis of these state-level probabilities. So far, the specification of the measure-of-interest for a given CTMC cannot always be done conveniently, nor can all possible measures-of-interest be expressed conveniently. In particular, measures for which a selection of paths matter are usually either “specified” informally, with all its negative implications, or require a manual tailoring of the CTMC so as to address the right subsets of states. With the use of an appropriate extension of temporal logic such measures can be specified in an unambiguous way. Let us illustrate this by means of the Hubble telescope example. In addition to the properties discussed for the DTMC model of the telescope, the presence of dura- tions in a CTMC allows us to specify and verify properties that refer to the time until a certain scenario happens. Under the assumption that a rare astronomical event, such as the appearance of an interesting comet in the cov- erage of the telescope, happens in, say, five years, it would be interesting to check whether “the telescope is operational in exactly 5 years from now with at least probability 99%” Another quantity of interest is the time span before the (fully operational) telescope has to be put into sleep mode for the first time. In reality, this happened within 2.7 years. One could check whether “with at most 10% chance the operational telescope turns into sleep mode within 2.7 years” As a last example property, since the Hubble space ...
Context 2
... this case, the expected value of X is . λ To illustrate the concept of a CTMC let us return to the telescope example. We make the following, not nec- essarily realistic, assumptions about the timing behavior of the telescope: each gyroscope has an average lifetime of 10 years, the average preparation time of a repair mission is two months, and to turn the telescope into sleep mode takes 1/100 year (about 3.5 days) on average. As- suming a base time scale of a single year, the real-time probabilistic behavior of the failure and repair of the gyroscopes is now modeled by the CTMC of Fig. 2. This model can be understood as follows. The mean residence time of a state is the reciprocal of the sum of its outgoing transition rates. In state 6, for instance, one out of 6 gyroscopes may fail. As these failures are stochastically independent and as each gyroscope fails with rate 1 , 10 this state has outgoing rate 6 . If less operational gyro- 10 scopes are available, these rates decrease proportionally, and state residence times become larger. Being in state 2 there are two possibilities: either one of the remaining two gyroscopes fails, or the telescope is turned into sleep mode. The mean residence time of this state is 10 . The 1002 DTMC of Fig. 1 can be obtained from the CTMC of Fig. 2 by multiplying the transition rates by the mean residence time of the state from which they emanate. On the applicability of CTMCs. Markov chains are widely used as simple, yet adequate models in diverse areas, ranging from mathematics and computer science to other disciplines such as operations research, industrial engin- eering, biology, and demographics. They can be used to estimate various performance characteristics; for instance, to quantify throughput of manufacturing systems, to locate bottlenecks in communication systems, or to estimate reliability in aerospace systems. Due to their modeling convenience and the presence of efficient analysis methods, the vast majority of applications of Markov chain modeling involve CTMCs as opposed to DTMCs. This might surprise the reader, as exponential distributions seem at first sight not to be of much practical value, despite their mathematical tractability. This is misleading. Exponential distributions are known to be an appropriate means to adequately model many phenomena with a stochastic nature, such as system lifetimes (failure rates), job arrival processes (inter-arrival times), and the like. Besides, if only the mean value of a random phenomenon is known – a situation that frequently occurs in practice – then the exponential distribution is the most indeterminate distribution, i.e., the distribution with the highest degree of randomness, that describes this phenomenon. Thus, it is the most appropriate distribution when just mean values are known. Technically speaking, the exponential distribution maximizes the entropy [60], a well-known notion from information theory. Due to the rapidly increasing size and complexity of systems, specifying and analyzing stochastic models at the level of states and transitions becomes more and more cumbersome and error-prone. In order to overcome this problem, CTMCs can be generated from higher-level specifications, such as queueing networks [24], stochastic Petri nets [1], stochastic process algebras [16, 40, 45], or from semi-formal software development techniques such as UML (The Unified Modeling Language) [58] or SDL (Specification and Description Language) [28]. The tool- development for these techniques and their success in several case studies of industrial importance during recent years has provided strong evidence that these solutions are indeed very promising. Model checking continuous-time Markov chains. Performance and dependability analysis of CTMCs most often boils down to the calculation of steady-state and transient state probabilities. Steady-state probabilities refer to the system behavior in the “long run”, while the transient probabilities consider the system at a fixed time instant t . High-level measures-of-interest are determined on the basis of these state-level probabilities. So far, the specification of the measure-of-interest for a given CTMC cannot always be done conveniently, nor can all possible measures-of-interest be expressed conveniently. In particular, measures for which a selection of paths matter are usually either “specified” informally, with all its negative implications, or require a manual tailoring of the CTMC so as to address the right subsets of states. With the use of an appropriate extension of temporal logic such measures can be specified in an unambiguous way. Let us illustrate this by means of the Hubble telescope example. In addition to the properties discussed for the DTMC model of the telescope, the presence of dura- tions in a CTMC allows us to specify and verify properties that refer to the time until a certain scenario happens. Under the assumption that a rare astronomical event, such as the appearance of an interesting comet in the cov- erage of the telescope, happens in, say, five years, it would be interesting to check whether “the telescope is operational in exactly 5 years from now with at least probability 99%” Another quantity of interest is the time span before the (fully operational) telescope has to be put into sleep mode for the first time. In reality, this happened within 2.7 years. One could check whether “with at most 10% chance the operational telescope turns into sleep mode within 2.7 years” As a last example property, since the Hubble space telescope is planned to stay in orbit through 2010, it is worth- while studying the likelihood of a crash before that year: “there is at most a 1% chance that the system will crash within the next 10 years” given that the system was reset to state 6 in late 1999. Contributions of this paper. Model checking of CTMCs has been discussed in [12], introducing a (branching) temporal logic called continuous-time stochastic logic (CSL) to express properties over CTMCs. This logic is an extension of the (equally named) logic by Aziz et al. [7, 8] with an operator to reason about steady-state probabilities. In this paper, we describe the Erlangen–Twente Markov Chain Checker (E MC 2 ), to our knowledge the first ...
Similar publications
Markov chains are widely used in the context of
performance and reliability evaluation of systems of various
nature. Model checking of such chains with respect to
a given (branching) temporal logic formula has been proposed
for both the discrete [8] and the continuous time setting
[1], [3]. In this short paper, we describe the prototype
model check...
Citations
... Известны публикации, посвящённые математическому моделированию процессов функционирования объектов с различными вариантами контроля состояния. В ряде работ исследованы процессы функционирования объектов при случайном времени между проверками (напр., [7,13]) или с постоянным временем между проверками (напр., [5,8,12,14]). Имеются работы, в которых учтена недостоверность системы контроля [2,3,6]. ...
... (4) Приведённые вероятности являются вероятностями прохождений [3,5]: pij -это условная вероятность непосредственного перехода из i-го состояния в j-е состояние при условии, что i-е состояние меняется. Вероятности прохождений описывают процесс в момент перемены состояния, поэтому pii = 0 для всех состояний. ...
... В основе приведённой модели лежат средние относительные частоты состояний подмножества. Матрица относительных частот подмножества U вычисляется по формуле [3,5]: ...
An analytic model of a long used item functioning with regular period of check-out operations and unreliable checking conditions is represented. The model is based on the theory of semimarkov processes using matrix methods for mathematical operations. Consideration of the model reveals the influence of the first and the second kind check-out errors on the reliability level.
... Discrete Time LMC) has been studied extensively. For instance, a tool was developed in [KNP11] for automatic verification and another tool was also developed in the context of reliability modeling of various systems [Her+03]. In practice, any kind of adequate formal verification technique like classical Model Checking, Probabilistic Model Checking or Statistical Model Checking can be used with these models without major constraints. ...
The main objective of this thesisis to combine the advantages of probabilisticgraphical model learning and formal verifica-tion in order to build a novel strategy for secu-rity assessments. The second objective is toassess the security of a given system by veri-fying whether it satisfies given properties and,if not, how far is it from satisfying them. Weare interested in performing formal verificationof this system based on event sequences col-lected from its execution. Consequently, wepropose a model-based approach where a Re-cursive Timescale Graphical Event Model (RT-GEM), learned from the event streams, is con-sidered to be representative of the underlyingsystem. This model is then used to check a se-curity property. If the property is not verified,we propose a search methodology to find an-other close model that satisfies it. We discussand justify the different techniques we use inour approach and we adapt a distance mea-sure between Graphical Event Models. Thedistance measure between the learned "fittest"model and the found proximal secure modelgives an insight on how far our real system isfrom verifying the given property. For the sakeof completeness, we propose series of exper-iments on synthetic data allowing to provideexperimental evidence that we can attain thedesired goals.
... PRISM (Kapus 2017), ETMCC (Hermanns et al. 2003), MRMC (Katoen et al. 2011), YMER (Younes 2005) and VESTA (Sen et al. 2005) are common tools for probabilistic model-checking. All of them support CTMC models, and most of them can construct a logical formula based on CSL. ...
Many conventional reliability analysis methods for multi-state systems assume independence among the various subsystems. To avoid this, we propose a probabilistic model checking-based approach for failure correlation analysis of multi-state systems. First, an improved Apriori algorithm is used to determine the effect of a subsystem failure on the associated subsystems. Next, a copula function is applied to establish the relationship between failures of the associated subsystems. Finally, probabilistic model-checking is used to analyze the reliability of the entire system and all its subsystems. The effectiveness of the proposed method is verified using an application involving offshore wind turbines. The results show that the proposed method can be used flexibly and effectively for multi-state system reliability analysis. Moreover, the proposed method lays the foundation for system maintenance strategy formulation and other engineering applications.
... The first prototype of P-CTL model checkers has been proposed in [65]. Then PRISM [66], ETMCC [67], MRMC [68] were birthed to fulfil the various needs of P-CTL model checking for multi models such as Markov chain,Markov decision processes, transition matrices, etc. LiQuor [69] is an alternative model checkers for Markov decision processes to verify quantitative properties in this context with SPIN [70] inside as the LTL model checker. ...
There is a wide range of new applications that stress the need for business process models that are able to handle imprecise data. This thesis studies the underlying modelling and analysis issues. It uses as formal model to describe process behaviours a labelled transitions system in which transitions are guarded by conditions defined over a probabilistic database. To tackle verification problems, we decompose this model to a set of traditional automata associated with probabilities named as world-partition automata. Next, this thesis presents an approach for testing probabilistic simulation preorder in this context. A complexity analysis reveals that the problem is in 2-exptime, and is exptime-hard, w.r.t. expression complexity while it matches probabilistic query evaluation w.r.t. data-complexity. Then P-LTL and P-CTL model checking methods are studied to verify this model. In this context, the complexity of P-LTL and P-CTL model checking is in exptime. Finally a prototype called ”PRODUS” which is a modeling and verification tool is introduced and we model a realistic scenario in the domain of GIS (graphical information system) by using our approach.
... Furthermore, disciplines such as model checking increase drastically the expressiveness of the properties that a system analyst can formulate on stochastic models (see for example [9,20,52,33]). Nevertheless, any analysis passes through at least one common step that is independent from the measures of interest: the choice between transient period and steady-state (known also as transient and limiting behaviour, respectively). ...
... Other tools for stochastic analysis of Markov chains, such as ETMCC [59], MRMC [67], APNNtoolbox [10], SHARPE [60], SPNP [61], and Möbius [18], are conceived for answering performance analysis questions and as PRISM, due to their exhaustive state space exploration can not be applied to infinite models. ...
... SABRE does not currently offer an implementation of the hybrid methods introduced in the second part of this thesis. We plan to add these methods to our tool in a future release.Numerical analysis tools for discrete-state Markov processes such as PRISM[72], INFAMY[47], ETMCC[59], MRMC[67], APNNtoolbox[10], SHARPE[60], SPNP[61], or Möbius[18] have been introduced (see Section 11.6). However, except for IN-FAMY, these tools do not accept models with possibly infinite state space. ...
In this thesis we investigate different ways of approximating the solution of the chemical master equation (CME). The CME is a system of differential equations that models the stochastic transient behaviour of biochemical reaction networks. It does so by describing the time evolution of probability distribution over the states of a Markov chain that represents a biological network, and thus its stochasticity is only implicit. The transient solution of a CME is the vector of probabilities over the states of the corresponding Markov chain at a certain time point t, and it has traditionally been obtained by applying methods that are general to continuous-time Markov chains: uniformization, Krylov subspace methods, and general ordinary differential equation (ODE) solvers such as the fourth order Runge-Kutta method. Even though biochemical reaction networks are the main application of our work, some of our results are presented in the more general framework of propagation models (PM), a computational formalism that we introduce in the first part of this thesis. Each propagation model N has two associated propagation processes, one in discrete-time and a second one in continuous-time. These propagation processes propagate a generic mass through a discrete state space. For example, in order to model a CME, N propagates probability mass. In the discrete-time case the propagation is done step-wise, while in the continuous-time case it is done in a continuous flow defined by a differential equation. Again, in the case of the chemical master equation, this differential equation is the equivalent of the chemical master equation itself where probability mass is propagated through a discrete state space. Discrete-time propagation processes can encode methods such as the uniformization method and the fourth order Runge-Kutta integration method that we have mentioned above, and thus by optimizing propagation algorithms we optimize both of these methods simultaneously. In the second part of our thesis, we define stochastic hybrid models that approximate the stochastic behaviour of biochemical reaction networks by treating some variables of the system deterministically. This deterministic approximation is done for species with large populations, for which stochasticity does not play an important role. We propose three such hybrid models, which we introduce from the coarsest to the most refined one: (i) the first one replaces some variables of the system with their overall expectations, (ii) the second one replaces some variables of the system with their expectations conditioned on the values of the stochastic variables, (iii) and finally, the third one, splits each variable into a stochastic part (for low valuations) and a deterministic part (for high valuations), while tracking the conditional expectation of the deterministic part. For each of these algorithms we give the corresponding propagation models that propagate not only probabilities but also the respective continuous approximations for the deterministic variables.
... Wireless Local Area Network Protocol [12] and IEEE 802.3 CSMA/CD Protocol [10], so we believe that it is appropriate tool to be used to verify AMQM and ISO 18000-7 protocols. Some of other model checkers like ETMCC [5] and its successor MRMC [7] as well as ProbVerus [3] and Murphi [14] could also be used, but we choose PRISM because of familiarity with this tool. ...
In this document we discuss and analyze three different Interrogator-Tag communication protocols. The first protocol is used in the AMQM (Automatic Mail Quality Measurement) system. The second protocol is based on the ISO 18000-7 standard, which specifies the protocol and parameters for active RFID (Radio Frequency IDentification) air interface communication at the 433MHz ISM (Industrial Scientific Medical) band. The third protocol is the AMQM protocol with some features of the ISO 18000-7 standard. Quantitative properties of the protocols are analyzed. The main goal of modelling is to analyze tag message collision probability and power consumption. The model is verified by PRISM - Probabilistic Model Check Software. We showed that by implementing principles of model checking, we could verify probability of reaching a particular state, calculate collision probability as quantitative property, and cost of reaching determined state. We also showed that model of the protocol could be used to estimate possible improvement in one protocol by implementing features from another protocol.
... Numerical analysis tools for discrete-state Markov processes such as PRISM [28], INFAMY [17], ETMCC [22], MRMC [26], APNNtoolbox [5], SHARPE [23], SPNP [24], or Möbius [8] have been introduced (see Section VII). However, except for INFAMY, these tools do not accept models with possibly infinite state space. ...
... Other tools for stochastic analysis of Markov chains, such as ETMCC [22], MRMC [26], APNNtoolbox [5], SHARPE [23], SPNP [24], and Möbius [8], are conceived for answering performance analysis questions and as PRISM, due to their exhaustive state space exploration can not be applied to infinite models. ...
The importance of stochasticity within biological systems has been shown repeatedly during the last years and has raised the need for efficient stochastic tools. We present SABRE, a tool for stochastic analysis of biochemical reaction networks. SABRE implements fast adaptive uniformization, a direct numerical approximation algorithm for computing transient solutions of biochemical reaction networks. In addition to the stochastic analysis, SABRE may also conduct deterministic analysis.
... Although there exist verification tools that handle respective functional and performance validity problems, however, the technique of verifying the combination of these problems remains to be researched. Moreover, current model checkers are mostly console-based, the user have to look up manual and enter tiles of commands to give correct orders to the system [1]. It is also difficult for these tools to conveniently practice model modification or formulae generation in pure text mode. ...
In consideration of public security and common wealth, functional correctness and immediacy measures of concurrent systems must be verified. Compared to functional verification, performance evaluation aims at obtaining quantitative measures of the system to test whether reliability-related properties are promised in all conditions. In this paper, concurrent systems are formalized and expressed in the form of IMC, a mixed model for describing both action or state based systems, and properties of these systems are converted into aCSL formulae. Equipped with an improved numerical algorithm and graphics user interface, the model checker GMC can be used for handling a variety of performance evaluation problems. The paper also analyzes the data structure and architecture of GMC in detail. The efficiency of GMC is discussed and some future improving methods are also given in this paper.
... Major performance evaluation approaches are measurement based and model based techniques [3]. In the latter technique an abstract model of the system is constructed with enough detail for further analyzing. ...
... Consider the example of the Hubble Telescope [3]. The steering unit of the telescope consists of six gyroscopes. ...
Besides traditional verification of system functions, performance evaluation in modern hardware and software systems has received extensive attention. Performance evaluation aims at obtaining quantitative measures of the system to test whether reliability-related properties are warranted. In this paper, model of the system is expressed in the form of IMC, a mixed model for describing both action-based and state-based systems. And by converting performance properties of the system into aCSL formulae, we can formally verify them by model checking. To accelerate the process of IMC performance evaluation, a modified version of ant colony algorithm is proposed in the paper. Compared with other numerical methods, the ant colony algorithm reduces unnecessary model elements and the execution efficiency is largely improved to tackle more complex system performance evaluation problems.
