1. Quantitative Modeling, Verification, and Synthesis
Tom Henzinger IST Austria
With Roderick Bloem, Pavol Cerny, Krishnendu Chatterjee, Laurent Doyen, Karin Greimel, Barbara Jobstmann, Arjun Radhakrishna, and Rohit Singh.

2. Mathematical Modeling: A Tale of Two Cultures
Engineering
Differential Equations Linear Algebra Probability Theory
Computer Science
Logic Automata Theory Combinatorics

3. Uptime: 127 years

4. What went wrong? Engineering Computer Science Theories of estimation.
Theories of correctness.

5. What went wrong? Engineering Computer Science Theories of estimation.
Goal: build reliable and robust systems.
Computer Science
Theories of correctness.
Temptation: programs are mathematical objects; hence we want to prove them correct.

6. Qualitative Systems Theories
Property
Verification
Yes/No

7. Qualitative Systems Theories
Property
Verification
Yes/No
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

8. Logical Systems Theories
Property
Structure
Formula
Satisfaction
Relation
Yes/No
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

9. Logical Systems Theories
-Regular Automaton
System
Property
 (p ) } q)
Verification
Yes/No
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

10. Logical Systems Theories
Quantitative System
Quantitative Property
Timed Automaton
 (p ) }· 5 q)
Verification
Yes/No
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

11. Logical Systems Theories
Quantitative System
Quantitative Property
Markov Process
8 (p ) Pr(}q) ¸ 0.5)
Verification
Yes/No
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

12. Logical Systems Theories
Quantitative System
Quantitative Property
Markov Process
8 (p ) Pr(}q) ¸ 0.5)
Verification B
-perhaps a proof perhaps some counterexamples perhaps even a proposed fix

13. A Quantitative Systems Theory
Quantitative Property
Analysis R
-measure of “fit” between system and property could involve cost, quality, performance, etc.

14. A Quantitative Systems Theory
Quantitative Property
 (p ) } q)
Analysis
The less time between p and q, the better. R
-measure of “fit” between system and property could involve cost, quality, performance, etc.

15. A Quantitative Systems Theory
Quantitative Property
 (p ) } q)
Analysis
The fewer “unnecessary” q, the better. R
-measure of “fit” between system and property could involve cost, quality, performance, etc.

16. A Quantitative Systems Theory
Q1 Assigning values to behaviors
Boolean case: correct vs. incorrect behaviors
Q2 Assigning values to systems/properties
Boolean case: sets of behaviors (nondeterminism)
Q3 Assigning values to pairs of systems/properties
Boolean case: preorders (refinement)

17. A Quantitative Systems Theory
Q1 Assigning values to behaviors
Boolean case: correct vs. incorrect behaviors
Q2 Assigning values to systems/properties
Boolean case: sets of behaviors (nondeterminism)
Q3 Assigning values to pairs of systems/properties
Boolean case: preorders (refinement)

18. Boolean Systems TheoriesP1 P2 P3 S1
S’1 S2
S’2
S’’2

19. Boolean Systems TheoriesP1 P2 P3 S1
S’1 S2
S’2
S’’2

20. Boolean Systems TheoriesP1 P2 P3 S1
S’1 S2
S’2
S’’2

21. A Quantitative Systems TheoryP1 P2 P3
0.9
0.8 S1
S’1 S2
S’2
S’’2

22. A Quantitative Systems TheoryP1 P2 P3
0.9
0.5
0.8
0.7 S1
S’1 S2
S’2
S’’2

23. A Quantitative Systems TheoryP1 P2 P3
0.9
0.5
0.8
0.7 S1
S’1 S2
S’2
S’’2
0.2

24. Q1 Assigning Values To Behaviors
a. Probabilities

25. Q1 Assigning Values To Behaviors
a. Probabilities
b. Resource use
-worst case vs. average case (e.g. deadlines, QoS) peak vs. accumulative (e.g. power consumption)

26. Q1 Assigning Values To Behaviors
a. Probabilities
b. Resource use
-worst case vs. average case (e.g. deadlines, QoS) peak vs. accumulative (e.g. power consumption)
c. Quality measures
-discounting vs. long-run averaging

27. Q1 Assigning Values To Behaviors: Reliability
a: ok b: fail
Discounted value (0 < d < 1):  a
aaaaaaaaaa aaaaaaaab d aaab d b

28. Q1 Assigning Values To Behaviors: Reliability
a: ok b: fail
Discounted value (0 < d < 1):  a
aaaaaaaaaa aaaaaaaab d aaab d b
Long-run average value: limavg a
aaaaaaaaaa abaabaaab aaabaaabaaab... 3/ babbabbba aaaaaabbb... 0

29. Q2, Q3 Assigning Values To Systems
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } worst case

30. Q2, Q3 Assigning Values To Systems
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } worst case B(w) = expx { val(x) : obs(x) = w } avg case

31. Q2, Q3 Assigning Values To Systems
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } worst case B(w) = expx { val(x) : obs(x) = w } avg case
relative to input distribution

32. Q3 Assigning Distances To Systems
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w }
diff(A,B) = supw { |A(w) – B(w)| }
exp

33. Q3 Assigning Distances To Systems
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w }
diff(A,B) = supw { |A(w) – B(w)| }
Boolean compositionality: if A · A’ then A||B · A’||B Quantitative compositionality: diff(A||B,A’||B) · fB(diff(A,A’))

34. Is there a Quantitative Systems Theory with
-an appealing mathematical formulation, -useful expressive power, and -good algorithmic properties?
(Like the boolean theory of -regularity.)

35. Quantitative Language Inclusion
x: behaviors w: observations (infinite words) A,B: systems
A(w) = supx { val(x) : obs(x) = w } B(w) = expx { val(x) : obs(x) = w }
8 w : A(w) · B(w)
For interesting cases (e.g. nondeterministic sup limavg), open or undecidable.

36. BUT ...
We know how to solve games with quantitative objectives (e.g. limavg = mean payoff).

37. BUT ...
We know how to solve games with quantitative objectives (e.g. limavg = mean payoff).
There is a natural game-theoretic “satisfaction relation”: simulation

38. Simulation Preorder a b b a a 1 a b

39. Simulation Game Player System: chooses a transition of the system
Player Property: matches the letter by choosing a transition of the property
Player System wins if Player Property cannot match: System incorrect w.r.t. Property

40. Quantitative Simulation Game for Incorrect Systems
Player System: chooses a transition of the system
Player Property: matches the letter by choosing a transition of the property (weight 0), or chooses an illegal transition (weight 1)
Player System tries to make Player Property choose as many illegal transitions as possible: maximize limavg of weights
The more illegal transitions of the Property are needed to simulate the System, the greater the distance.

41. Quantitative Simulation Distanceb b a a
1/3
1/4 b b b b a

42. Quantitative Simulation Game for Correct Systems
Player System: chooses a transition of the system (weight 0), or chooses an illegal transition (weight 1)
Player Property: matches the letter by choosing a transition of the property
Player Property tries to make Player System choose as many illegal transitions as possible: maximize limavg of weights
The more illegal transitions of the System can be tolerated without violating the Property, the greater the robustness.

43. Quantitative Robustness Distance
2/3
1/3 a a b a

44. Qualitative Systems Theories
Property
Analysis
Yes/No

45. Qualitative Systems Theories
Property
Synthesis
Correct System

46. Qualitative Systems Theories
-Regular Automaton
Graph Game with
-Regular Objective
Correct System = Winning Strategy

47. Quantitative Systems Theories
Quantitative Property
Synthesis
Optimal System

48. Quantitative Systems Theories
Weighted Automaton
Graph Game with Quantitative Objective
Optimal System = Optimal Strategy

49. Buchi Automaton
pq pq pq
pq pq pq
pq pq
 (p ) } q)

50. Weighted Limavg Automaton 1
pq: 0 pq: 0 pq: 0
pq: 1 pq: 1
pq: 1
pq: 0 pq: 0
Following p, all steps until the next q are penalized.

51. Weighted Limavg Automaton 2
pq: 0 pq: 0 pq: 1
pq: 0 pq: 0
pq: 0
pq: 0 pq: 0
All “unnecessary” q are penalized.

52. Conclusions
-We need to move from boolean correctness criteria to quantitative system preference metrics.
-“Quantitative” is more than “timed” and “probabilistic.”
-Games with quantitative objectives offer algorithmic solutions.
-Weighted automata offer a natural quantitative specification language, but what is the corresponding temporal logic?