AbstractWe review the recently developed technique of Monte Carlo model checking and show how it can be applied to the implementation problem for I/O Automata. We then consider some open problems in applying Monte Carlo techniques to other process-algebraic problems, such as simulation and bisimulation

Grosu, Radu

Smolka, Scott A.

Elsevier - Publisher Connector 

Monte Carlo Methods for Process Algebra
Radu Grosu and Scott A. Smolka
Dept. of Computer Science, Stony Brook Univ., Stony Brook, NY, 11794, USA
E-mail: {grosu,smolka}@cs.sunysb.edu
Abstract
We review the recently developed technique of Monte Carlo model checking and show how it can be applied
to the implementation problem for I/O Automata. We then consider some open problems in applying Monte
Carlo techniques to other process-algebraic problems, such as simulation and bisimulation.
Keywords: Monte Carlo model checking, I/O automata, simulation, bisimulation
1 Introduction
Monte Carlo methods are often used in engineering and computer-science applica-
tions to compute an approximation of a solution whose exact computation proves in-
tractable. Example applications include belief updating in Bayesian networks,computing
the volume of convex bodies,and approximating the number of solutions of a DNF
formula.
Recently, model-checking researchers have turned to Monte Carlo methods in
order to cope with the problem of state explosion; see, for example, [3,6,8,1]. In
this paper, we review the Monte Carlo model-checking algorithm of [1] and show
how it can be applied to the implementation problem for I/O Automata [4]. We
then consider some open problems in applying Monte Carlo techniques to other
process-algebraic problems, such as simulation and bisimulation.
2 Monte Carlo Model Checking
Monte Carlo model checking, introduced in [1], is a novel technique that uses random
sampling of lassos in a discrete Bu¨chi automaton (BA) to realize a one-sided error,
randomized algorithm for LTL model checking. Our approach makes use of the
following idea from the automata-theoretic technique of Vardi and Wolper [7] for
LTL model checking: given a speciﬁcation S of a ﬁnite-state system and an LTL
Electronic Notes in Theoretical Computer Science 162 (2006) 203–207
1571-0661 © 2006 Elsevier B.V. 
www.elsevier.com/locate/entcs
doi:10.1016/j.entcs.2006.04.033
Open access under CC BY-NC-ND license.
formula ϕ, S |= ϕ (S models ϕ) if and only if the language of the Bu¨chi automaton
B = BS × B¬ϕ is empty. Here BS is the Bu¨chi automaton representing S’s state
transition graph, and B¬ϕ is the Bu¨chi automaton for the negation of ϕ. Call a
cycle reachable from an initial state of B a lasso, and say that a lasso is accepting
if the cycle portion of the lasso contains a ﬁnal state of B. The presence in B of
an accepting lasso means that S is not a model of ϕ. Moreover, such an accepting
lasso can be viewed as a counter-example to S |= ϕ.
The LTL model-checking problem is thus naturally deﬁned in terms of the BA
emptiness problem for B = BS×B¬ϕ, which reduces to ﬁnding accepting lassos in B.
Instead of searching the entire state space of B for accepting lassos, we successively
generate up to M lassos of B on the ﬂy, by performing uniform random walks in
B. If the currently generated lasso is accepting, we have found a counterexample
for emptiness, and we stop. The number M of lassos we need to generate depends
on to two parameters: the error margin  and the conﬁdence ratio δ.
To determine M for given  and δ we aim to answer, with conﬁdence 1−δ and
within error , to the following question: how many independent lassos do we need
to generate until one of them is accepting? The answer is based on a geometric
random variable X and statistical hypothesis testing. The geometric random variable
is parameterized by a Bernoulli random variable Z (deﬁned later in this section)
that takes value 1 with probability pZ and value 0 with probability qZ = 1 − pZ .
Intuitively, pZ is the probability that an arbitrary lasso of B is accepting.
The cumulative distribution function of X for N independent trials of Z is:
F (N) = P[X ≤ N ] = 1 − (1 − pZ)
N . Requiring that F (N) = 1 − δ yields:
N = ln(δ)/ ln(1 − pZ). Because pZ is what we want to determine, we assume for
the moment that pZ ≥ . Replacing pZ with  yields M = ln(δ)/ ln(1 − ) which is
greater than N and therefore P[X ≤ M ] ≥ P[X ≤ N ] = 1− δ. Summarizing:
pZ ≥  ⇒ P[X ≤ M ] ≥ 1− δ where M = ln(δ)/ ln(1− ) (1)
Inequation 1 gives us the minimal number of attempts M needed to achieve success
with conﬁdence ratio δ, under the assumption that pZ ≥ . The standard way of
discharging such an assumption is to use statistical hypothesis testing.Deﬁne the null
hypothesis H0 as the assumption that pZ ≥ . Rewriting inequation 1 with respect
to H0 we obtain:
P[X ≤ M |H0] ≥ 1− δ (2)
We now perform M trials. If no counterexample is found, i.e., if X > M , we reject
H0. This may introduce a type-I error: H0 may be true even though we did not
ﬁnd a counter-example. However, the probability of making this error is bounded
by δ; this is shown in inequation 3 which is obtained by taking the complement of
X ≤ M in inequation 2:
P[X > M |H0] < δ (3)
The Bernoulli random variable Z is associated with a uniform random walk
probability space (P(L),P). The sample space L is the set of all lassos of B; La and
Ln are the sets of all accepting and non-accepting lassos of B, respectively.
R. Grosu, S.A. Smolka / Electronic Notes in Theoretical Computer Science 162 (2006) 203–207204
The probability P[σ] of a lasso σ = S0e0 . . . Sn−1en−1Sn is deﬁned inductively
as follows: P[S0] = k
−1 if |S0| = k and P[S0e0 . . . Sn−1en−1Sn] = P[S0e0 . . . Sn−1] ·
π[Sn−1en−1Sn] where π[S eS
′] = m−1 if (S, e, S′) ∈ E and |E(S)| = m.
Example 2.1 [Probability of lassos] Consider the Bu¨chi automaton B of Figure 1.
It contains four lassos, 11, 1244, 1231 and 12344, having probabilities 1/2, 1/4, 1/8
and 1/8, respectively. Lasso 1231 is accepting.
2 3 41
Fig. 1. Example lasso probability space.
Deﬁnition 2.2 [Lasso Bernoulli variable] The random variable Z associated with
the probability space (P(L),P) of a Bu¨chi automaton B is deﬁned as follows: pZ =
P[Z = 1] =
∑
λa∈La
P[λa] and qZ = P[Z = 0] =
∑
λn∈Ln
P[λn].
Example 2.3 [Lassos Bernoulli variable] For the Bu¨chi automaton B of Figure 1,
the lassos Bernoulli variable has associated probabilities pZ = 1/8 and qZ = 7/8.
Having deﬁned Z, X and H0, we are now ready to presentMC2, our Monte Carlo
decision procedure for emptiness checking of BA. Its pseudo-code is given below,
where rInit(B)=random(S0), rNext(B,S)=random(E(S)) and
acc(S,B)=(S∈ F).
MC2 algorithm
input: B = (S,S0, E, F); 0 <  < 1; 0 < δ < 1.
output: Either (false, accepting lasso l) or (true, "P[X > M |H0] < δ")
(1) M := ln δ / ln(1− );
(2) for (i := 1; i≤ M; i++) if (RL(B)==(1,l)) return (false,l);
(3) return (true,"P[X > M |H0] < δ");
The main routine consists of three statements, the ﬁrst of which uses inequation 1
to determine the value for M , given parameters  and δ. The second statement
is a for-loop that successively samples up to M lassos by calling the random lasso
(RL) routine. If an accepting lasso l is found, MC2 decides false and returns l as a
counter-example. If no accepting lasso is found within M trials, MC2 decides true,
and reports that with probability less than δ, pZ > .
The RL routine generates a random lasso by using the randomized init (rInit)
and randomized next (rNext) routines. To determine if the generated lasso is ac-
cepting, it stores the index i of each encountered state s in HashTbl and records the
index of the most recently encountered accepting state in variable f. Upon detecting
a cycle, i.e., the state s := rNext(B,s) is in HashTbl, it checks if HashTbl(s)≤ f;
the cycle is an accepting cycle if and only if this is the case. The function lasso()
extracts a lasso from the states stored in HashTbl.
Given a succinct representation S of a Bu¨chi automaton B, one can avoid the
explicit construction of B, by generating random states rInit(B) and rNext(B,s)
on demand and performing the test for acceptance acc(B,s) symbolically.
R. Grosu, S.A. Smolka / Electronic Notes in Theoretical Computer Science 162 (2006) 203–207 205
MC2 is very eﬃcient. It runs in time O(MD) and uses O(D) space, where M is
optimal and D is B’s recurrence diameter (longest loop-free path starting from an
initial state).
3 The Implementation Problem for I/O Automata
An I/O Automaton (IOA) is a ﬁnite-state automaton whose transitions are associ-
ated with named actions, which are classiﬁed as input, output, or internal. Input
and output actions are used for communication with the automaton’s environment,
whereas internal actions are visible only to the automaton itself. The input ac-
tions are assumed not to be under the automaton’s control (IOA are input-enabled,
whereas the automaton itself controls which output and internal actions should be
performed. See [4] for the formal deﬁnition.
The implementation problem for I/O Automata (IOA) is the following. Given
IOA A and B, representing the implementation and speciﬁcation of the system
under investigation, does A implement B (A ≤ B)? Now, A ≤ B holds if L(A) ⊆
L(B); that is, the traces of A are a subset of the traces of B. This in turn is
equivalent to L(A× B) = ∅, where B is the complement of B. Intuitively, if every
observable behavior of A is an observable behavior of B then no observable behavior
of A is an observable behavior of B.
Speciﬁcation IOA B can be viewed as a (input-enabled) Bu¨chi automaton by
treating a subset of its states as accepting. IOA A can similarly be viewed as a BA
(all of whose states are accepting). Consequently, the IOA implementation problem
can be reduced to the language emptiness problem for BA, and the MC2 Monte Carlo
algorithm can be directly applied. A recent paper [2] suggests how this can all be
extended to the case of Timed I/O Automata.
4 Open Problems
It would be interesting to extend our Monte Carlo approach to the model-checking
problem for branching-time temporal logics, such as CTL, the modal mu-calculus,
and Hennessy-Milner logic. This extension appears to be non-trivial since the idea of
sampling accepting lassos in the product graph will no longer suﬃce. For the similar
reasons, the problem of applying Monte Carlo methods in deciding simulation [5]
and bisimulation remains open.
References
[1] R. Grosu and S. A. Smolka. Monte Carlo model checking. In Proceedings of TACAS 2005. Springer-
Verlag, 2005.
[2] R. Grosu, S. A. Smolka, W. Tan, A. Bouajjani, M. D. Bozga, and S. Tripakis. Monte Carlo model
checking of timed automata, 2005. Submitted for publication.
[3] T He´rault, R. Lassaigne, F. Magniette, and S. Peyronnet. Approximate probabilistic model checking.
In Proc. Fifth International Conference on Veriﬁcation, Model Checking, and Abstract Interpretation
(VMCAI 2004), 2004.
R. Grosu, S.A. Smolka / Electronic Notes in Theoretical Computer Science 162 (2006) 203–207206
[4] N. Lynch and M. Tuttle. An introduction to input/output automata. CWI Quarterly, 2(3):219–246,
1989.
[5] N. Lynch and F. Vaandrager. Forward and backward simulations I: untimed systems. Inf. Comput.,
121(2):214–233, 1995.
[6] K. Sen, M. Viswanathan, and G. Agha. On statistical model checking of stochastic systems. In
K. Etessami and S. Rajamani, editors, Proc, of the 17th International Conference on Computer Aided
Veriﬁcation, volume 3576 of LNCS. Springer, 2005.
[7] M. Vardi and P. Wolper. An automata-theoretic approach to automatic program veriﬁcation. In
Proc. IEEE Symposium on Logic in Computer Science, pages 332–344, 1986.
[8] H.L.S. Younes. Probabilistic veriﬁcation for black-box systems. In K. Etessami and S. Rajamani, editors,
Proc. of the 17th International Conference on Computer Aided Veriﬁcation, volume 3576 of LNCS, pages
253–265. Springer, 2005.
R. Grosu, S.A. Smolka / Electronic Notes in Theoretical Computer Science 162 (2006) 203–207 207


Monte Carlo Methods for Process Algebra 

file:///data/remote/core/dit/data/elsevier/pdf/7c1/aHR0cDovL2FwaS5lbHNldmllci5jb20vY29udGVudC9hcnRpY2xlL3BpaS9zMTU3MTA2NjEwNjAwNDM0OA==.pdf

Monte Carlo Methods for Process Algebra

Abstract

Similar works

Full text

Available Versions

Elsevier - Publisher Connector

Elsevier - Publisher Connector