A Lazy Abstraction Algorithm for Markov Decision Processes

Abstract

Analysis of Markov Decision Processes (MDP) is often hindered by state space explosion. Abstraction is a well-established technique in model checking to mitigate this issue. This paper presents a novel lazy abstraction method for MDP analysis based on adaptive simulation graphs. Refinement is performed only when new parts of the state space are explored, which makes partial exploration techniques like Bounded Real-Time Dynamic Programming (BRTDP) retain more merged states. Therefore, we propose a combination of lazy abstraction and BRTDP. To evaluate the performance of our algorithm, we conduct initial experiments using the Quantitative Verification Benchmark Set.

reptheorem[1]

Theorem 0.1

1 Introduction

Ensuring the reliable operation of safety-critical systems, like railway interlocking systems and embedded controllers, is vital. Probabilistic model checking addresses this by offering an automated approach with formal mathematical guarantees for the analysis of quantitative properties, like reliability and availability [20]. We focus on a fundamental task in probabilistic model checking: computing the worst-case probability of reaching an error state.

Markov Decision Processes (MDPs) are discrete-time models able to describe both probabilistic and non-deterministic behavior, used in reliability and safety analysis for worst-case modeling of unknown factors. The analysis of other modeling formalisms, like Markov Automata or Probabilistic Timed Automata, can often be reduced to MDP analysis as well.

State space explosion presents an obstacle for MDP model checking: as the number of components or variables increases, the state space may grow exponentially. Consequently, practical implementations face problems in representing the system in memory and the numerical solution methods also become intractable.

Abstraction aims to counteract this. Several abstraction-based techniques have been adapted to probabilistic systems, like CEGAR [17, 15] and abstract interpretation [7]. Partial state space exploration, like Bounded Real-Time Dynamic Programming (BRTDP) [3, 18] is another approach for counteracting it. As most existing MDP abstraction methods rely on computing the whole abstract model to choose a refinement, they do not lend themselves well to combination with partial state space exploration techniques.

Lazy abstraction [13, 23] in contrast merges state-space exploration and refinement, making it a good candidate for this combination. However, no such method has been proposed for MDPs to our knowledge.

We adapt an existing lazy abstraction algorithm [27] to MDPs (Section 3). We combine it with BRTDP, benefiting from the synergy of lazy abstraction and partial state space exploration and enabling a trade-off between time and accuracy (Subsection 3.1). We evaluate the performance of the proposed algorithms using models from the Quantitative Verification Benchmark Set [12] (Section 4).

1.0.1 Related Work

Counterexample-Guided Abstraction Refinement (CEGAR) [6] is a successful approach for abstraction-based model checking: it starts with a coarse abstraction and refines it based on abstract counterexamples.

Lazy abstraction, introduced in [13], improved CEGAR through on-demand refinement during abstract state space exploration and varying precision from node to node in the state graph. An interpolant-based version was proposed in [23]. This was adapted to timed automata [14], introducing Adaptive Simulation Graphs (ASG) as the abstract model. This allows earlier refinement, cutting spurious paths before reaching a target, and a less expensive covering check. The ASG-based algorithm was adapted to explicit value abstraction of discrete variables in [27], which we, in turn, adapt to MDPs.

Different abstraction methods have been proposed for probabilistic systems. While some CEGAR-based methods employ MDPs as abstraction [8, 15, 5], others utilize stochastic games [24, 28, 17], which we plan to incorporate in the future. Abstract interpretation has also been used for probabilistic systems [7, 11]. Some others include magnifying lens abstraction [9], which explores the whole concrete state space but keeps only its subset in memory and assume-guarantee-style abstraction [19], specialized for composite systems. To our knowledge, no lazy abstraction method has been proposed for probabilistic models yet.

The algorithm presented in this paper uses a symmetric representation constraint, resulting in an approach similar to bisimulation reduction techniques [10, 16]. The main difference is that until the whole ASG is explored, only a limited version of “bisimilarity” holds which does not take the unexplored part of the state space into account, allowing coarser partitions on the already explored part. When combined with partial exploration, the algorithm can stop before exploring the full ASG. Finite-horizon bisimulation minimization [16] and incremental bisimulation abstraction-refinement [25] are similar in that they employ a relaxed version of bisimulation. Both of them limit the bisimilarity to a fixed path length and compute exact quotients w.r.t the relaxed relation, while we base the relaxation on the currently explored state space and do not aim for computing the coarsest relation.

BRTDP was introduced in [22] for Stochastic Shortest Paths, and [3] applied it to general MDPs. We combine it with our lazy abstraction algorithm.

2 Background and Notations

$\mathbb{D}(A)$ is the set of probability distributions over the set $A$. For $d\in\mathbb{D}(A),a\in A$, $d(a)$ denotes the probability measure of $a$ according to $d$. $f\colon A\hookrightarrow B$ means $f$ is a partial function from $A$ to $B$, and $Supp(f)$ is the set of values for which $f$ is defined. For $d\in\mathbb{D}(A)$, $Supp(d)=\{a\in A|d(a)>0\}$. $\delta_{x}$ is a Dirac distribution: $\delta_{x}(x)=1,\forall y\neq x\colon\delta_{x}(y)=0$.

2.1 Markov Decision Process (MDP)

MDPs are low-level mathematical models that describe both probabilistic and non-deterministic behavior in discrete time.

Definition 1 (MDP)

An MDP is a tuple $M=(S,Act,T,s_{0})$, where $S$ is the set of states, $Act$ is the set of actions, $T\colon S\times Act\times S\xrightarrow{}[0,1]$ is a probabilistic transition function s.t. $\forall s\in S,a\in Act\colon\sum_{s^{\prime}\in S}T(s,a,s^{\prime})\in\{0,1\}$ and $s_{0}\in S$ is the initial state.

An action $a\in Act$ is enabled in $s\in S$ if $\sum_{s^{\prime}\in S}T(s,a,s^{\prime})=1$. In this case, $T(s,a)\in\mathbb{D}(S)$ denotes the next state distribution after taking $a$ in $s$, defined as $T(s,a)(s^{\prime})=T(s,a,s^{\prime})$. The intuitive behavior of an MDP is as follows: starting in $s_{0}$ an action $a$ is chosen non-deterministically from those enabled in the current state $s_{i}$ in each step, and the next state is sampled from $T(s_{i},a)$. A trace of an MDP is an alternating list of states and actions $s_{0}\xrightarrow{a_{1}}s_{1}\xrightarrow{a_{2}}s_{2}\xrightarrow{a_{3}}\dots$ such that $\forall i\colon T(s_{i-1},a_{i},s_{i})>0$. Fixing a strategy for resolving the non-determinism, the set of traces can be equipped with a probability measure: intuitively, the probability of a trace is the product of the probability of landing in each state of the trace after taking the action specified by the strategy in the previous state. For a detailed formal treatment, see e.g. [20].

Given an MDP of the system behavior and a set of target (error) states $E$, we want to compute (an upper approximation of) the probability of the set of traces involving a state in $E$ with non-determinism resolved by a maximizing strategy: $\mathbb{P}_{max}(\{(s_{0}\xrightarrow{a_{1}}s_{1}\xrightarrow{a_{2}}s_{2}\xrightarrow{a_{3}}\dots)\ |\ \exists i\in\mathbb{Z}^{+}\colon s_{i}\in E\})$. The result is the same if we make all target states absorbing, allowing us to restrict the analysis to finite traces.

2.1.1 Symbolic MDPs

Most real-life models are specified symbolically using state variables and operations on them. We assume that the MDP is given by a set of variables $\mathcal{V}$ and a set of probabilistic guarded commands $\mathcal{C}$. Each $v\in\mathcal{V}$ has a set $\mathit{R}(v)$ of values it can take, and an initial value $v_{0}\in\mathit{R}(v)$. A valuation over $\mathcal{V}$ is a function $val\colon\mathcal{V}\xrightarrow{}\bigcup_{v\in\mathcal{V}}\mathit{R}(v)$ s.t. $\forall{v\in\mathcal{V}}\colon val(v)\in\mathit{R}(v)$, and $\mathit{VAL}_{\mathcal{V}}$ is the set of all valuations over $\mathcal{V}$. The initial valuation of the model is a valuation $val_{0}$ s.t. $\forall v\in\mathcal{V}\colon val_{0}(v)=v_{0}$. The state space of this MDP is a subset of $\mathit{VAL}_{\mathcal{V}}$, and its initial state is $val_{0}$.

Let $\mathcal{B}_{\mathcal{V}}$ denote the set of Boolean expressions over $\mathcal{V}$, $\mathcal{E}_{\mathcal{V}}^{v}$ the set of expressions over $\mathcal{V}$ that result in an element of $\mathit{R}(v)$, and $\mathcal{E}_{\mathcal{V}}=\bigcup_{v\in\mathcal{V}}\mathcal{E}_{\mathcal{V}}^{v}$. An assignment is a function $a\colon\mathcal{V}\xrightarrow{}\mathcal{E}_{\mathcal{V}}$, such that $\forall{v\in\mathcal{V}}\colon a(v)\in\mathcal{E}_{\mathcal{V}}^{v}$. Let $\mathcal{A}_{\mathcal{V}}$ denote the set of assignments for $\mathcal{V}$. $eval(e,val)$ for $e\in\mathcal{E}_{\mathcal{V}}$ and $val\in\mathit{VAL}_{\mathcal{V}}$ is the constant resulting from replacing each $v\in\mathcal{V}$ in $e$ with $val(v)$. $eval(a,val)$ for $a\in\mathcal{A}_{\mathcal{V}}$ is a valuation $val^{\prime}$ such that $\forall{v\in\mathcal{V}}\colon val^{\prime}(v)=eval(a(v),val)$. $eval(d,val)$ for $d\in\mathbb{D}(\mathcal{A}_{\mathcal{V}})$ is the distribution $d^{\prime}\in\mathbb{D}(\mathit{VAL}_{\mathcal{V}})$ such that $d^{\prime}(val^{\prime})=\sum_{a\in\{a\in Supp(d)\ |\ eval(a,val)=val^{\prime}\}}d(a)$.

A command $c\in\mathcal{C}$ consists of a guard $g_{c}\in\mathcal{B}_{\mathcal{V}}$ and a result distribution over assignments $d_{c}\in\mathbb{D}(\mathcal{A}_{\mathcal{V}})$. $c$ is enabled by $val$ iff $eval(g_{c},val)=\mathit{True}$. Let $a^{c}_{i}\in Supp(d_{c})$ denote the $i$th assignment of command $c$ for a fixed ordering. The enabled actions in each state $val$ of the represented MDP are the commands enabled by $val$, and taking the command $c$ results in the distribution $eval(d_{c},val)$. Widely used MDP description formats, like that of PRISM [21] or the JANI [4] format can be mapped to this low-level description.

Our running example is given by the following variables and commands:

$$\mathcal{V}=\{x,y\},\mathit{R}(x)=\mathit{R}(y)=\mathbb{N},x_{0}=y_{0}=0$$

$$\mathbf{c_{1}}\colon[\mathit{true}]\ 0.8:(x^{\prime}:=x+1\wedge y^{\prime}:=y),0.2:(x^{\prime}:=x\wedge y^{\prime}:=y)$$

$$\mathbf{c_{2}}\colon[x==0]\ 1.0:(x^{\prime}:=1\wedge y^{\prime}:=2)$$

$$\mathbf{c_{3}}\colon[x==2\wedge y==2]\ 1.0:(x^{\prime}:=x\wedge y^{\prime}:=3)$$

$c_{1}$ is enabled in every state, and it increments $x$ by $1$ with probability $0.8$. $c_{2}$ is enabled when $x=0$, and always sets $y$ to $2$ and $x$ to $1$. $c_{3}$ is enabled when $x$ is $2$ and $y$ is 2, and sets $y$ to $3$. 1(a) shows this MDP.

2.2 Lazy Abstraction

Abstraction-refinement methods mitigate state-space explosion by disregarding information present in the original concrete model to create an abstract model that is iteratively refined until a conclusion is reached. Lazy abstraction performs refinement on-the-fly and only on a subset of the state space.

For checking safety properties in the qualitative case, a conservative abstraction overapproximates the reachable state set. In the probabilistic setting, the probability of reaching a target state in the abstract model overapproximates that in the concrete one, which we will prove for the proposed algorithm.

We build on the lazy abstraction method of [27] for non-probabilistic systems. It constructs an Adaptive Simulation Graph (ASG) with nodes labeled by both a concrete and an abstract state: the concrete state represents all states in the abstract state regarding possible action sequences. The abstract state labels start very coarse and are refined as needed. Covering edges indicate that action sequences starting from the coverer node encompass those starting from the covered node, eliminating the need to explore paths from the covered node.

If an action is enabled in at least one concrete state described by the abstract label of a node, but not in the concrete label, the abstract label is strengthened by removing states with the action enabled. This operation can trigger additional strengthenings. The algorithm terminates once all enabled actions in non-covered nodes have been explored. The abstract labels in the finished ASG cover all reachable concrete states, and contain a target state only if one is reachable.

2.2.1 Abstract domains

Abstract states are described using an abstract domain. For a set of concrete states $S$, an abstract domain $D=(\hat{S},\preceq,\alpha,\gamma)$ consists of the abstract state set $\hat{S}$, a partial ordering $\preceq\ \subseteq\hat{S}\times\hat{S}$, an abstraction function $\alpha\colon 2^{S}\xrightarrow{}\hat{S}$ and a concretization function $\gamma\colon\hat{S}\xrightarrow{}2^{S}$ satisfying $\forall{A\in 2^{S},\hat{a}\in\hat{S}}\colon\alpha(A)\preceq\hat{a}\iff A\subseteq\gamma(\hat{a})$. $\gamma$ lets us treat abstract states as sets of concrete states; we write “$s\in\hat{s}$” for $s\in\gamma(\hat{s})$ when $\gamma$ is clear from the context. $x\preceq y$ denotes $(x,y)\in\ \preceq$. $\hat{S}$ has two special elements: $\top$ and $\bot$ satisfying $\gamma(\top)=S,\gamma(\bot)=\{\}$.

Our lazy abstraction algorithms are domain agnostic, but need an abstract domain for $S=\mathit{VAL}_{\mathcal{V}}$ with the following operations.

For $a\in\mathcal{A}_{\mathcal{V}}$ and $\hat{s}\in\hat{S}$, abstract post operator $eval(a,\hat{s})\in\hat{S}$ applies an assignment in the abstract state space: $eval(a,\hat{s})=\alpha(\{eval(a,s)|s\in\hat{s}\})$. For $b\in\mathcal{B}_{\mathcal{V}}$, $eval(b,\hat{s})\in\{\mathit{True},\mathit{False},\mathit{Unknown}\}$ denotes evaluating $b$ in the abstract state space: $\mathit{True}$ if $b$ evaluates to $\mathit{True}$ for all $s\in\hat{s}$, $\mathit{False}$ if $b$ evaluates to $\mathit{False}$ for all $s\in\hat{s}$, otherwise $\mathit{Unknown}$.

We also need a block operation: for an abstract state $\hat{s}\in\hat{S}$, a Boolean expression $b\in\mathcal{B}_{\mathcal{V}}$ and a concrete state $s\in\hat{s}$ s.t. $eval(b,s)=\mathit{False}$, $\hat{s}^{\prime}=block(\hat{s},b,s)$ is an abstract state s.t. $\hat{s}^{\prime}\preceq\hat{s},s\in\hat{s}^{\prime},eval(b,\hat{s}^{\prime})=\mathit{False}$. Its goal is to give a new abstract state by removing at least those states from $\hat{s}$ which satisfy $b$ (potentially others as well) while kee** $s$.

The abstract states must be representable as Boolean expressions: for each $\hat{s}\in\hat{S}$ a $b_{\hat{s}}\in\mathcal{B}_{\mathcal{V}}$ must exist s.t. $\forall s\in S\colon eval(b_{\hat{s}},s)=\mathit{True}\iff s\in\hat{s}$. Relying on this, we will freely use abstract states in place of Boolean expressions.

We will use the explicit value domain $D_{expl}$ (abstract states correspond to tracking only a subset of $\mathcal{V}$) as an example throughout the paper which we implemented in our prototype, along with predicate abstraction $D_{pred}$ (abstract states are Boolean predicates over $\mathcal{V}$). A partial function $pval\colon\mathcal{V}\hookrightarrow\bigcup_{v\in\mathcal{V}}\mathit{R}(v)$ s.t. $\forall v\in Supp(pval)\colon pval(v)\in\mathit{R}(v)$ is called a partial valuation, $\mathit{PVAL}_{\mathcal{V}}$ denotes the set of all partial valuations over $\mathcal{V}$. Description of these domains and their operations can be seen in Table 1, assuming a concrete state set $\mathit{VAL}_{\mathcal{V}}$.

The lazy abstraction algorithm does not use the abstraction and concretization functions $\alpha$ and $\gamma$ and the abstract post operator $eval(a,\hat{s})$ directly, only as arguments of a block operation (see later), so they need not be efficiently computable if the corresponding block operation can be implemented efficiently.

	EXPL	PRED
$\hat{S}$	$\mathit{PVAL}_{\mathcal{V}}\cup\{\bot_{expl}\}$	$\mathcal{B}_{\mathcal{V}}$
$\preceq$	$pval\preceq pval^{\prime}\iff(Supp(pval^{\prime})\subseteq Supp(pval)\wedge\forall{v\in Supp(pval^{\prime})}\colon pval(v)=pval^{\prime}(v))$	$b_{1}\preceq b_{2}\iff(b_{1}\implies b_{2})$
$\alpha$	$Supp(\alpha(A))=\{v\in\mathcal{V}\ |\ \exists k\in\mathit{R}(v)\colon\forall val\in A\colon val(v)=k\}$ and $\forall v\in Supp(\alpha(A))\colon\alpha(A)(v)=k\iff\forall val\in A\colon val(v)=k$	$\bigvee_{\mathit{val}\in A}(\forall v\in\mathcal{V}\colon v=\mathit{val}(v))$
$\gamma$	$\gamma(pval)=\{val\in\mathit{VAL}_{\mathcal{V}}\ |\ \forall v\in Supp(pval)\colon val(v)=pval(v)\}$	$\gamma(b)=\{val\in\mathit{VAL}_{\mathcal{V}}\ |\ \mathit{val}\vdash b)\}$
$\top,\bot$	$\top$ is the empty valuation, $\bot$ is a non-valuation element $\bot_{expl}$ representing contradiction	$\top=\mathit{True},\bot=\mathit{False}$
Boolean representation	$b_{pval}=(\bigwedge_{v\in Supp(pval)}v=pval(v))$	identity (already a Boolean expression)
$eval(b,\hat{s})$	Substituting the values in $Supp(\hat{{s}})$, and deciding the satisfiability of the result.	$\mathit{True}$ if $\hat{s}\implies b$, $\mathit{False}$ if $\hat{s}\implies\neg b$, $\mathit{Unknown}$ if neither.
$eval(a,\hat{s})$	Substituting known variables into the result expressions. If this results in a constant, that is the result, else unknown.	strongest postcondition

Table 1: Properties and operations of the explicit value and predicate domains

3 Lazy Abstraction for MDPs

(a)

(b)

Figure 1: Our running example MDP (a) and an in-progress PASG for it (b). The result of a refinement step is marked with orange

Algorithm 1 PASG construction

1:$N\leftarrow\{n_{0}\};E_{T}\leftarrow\{\};E_{C}\leftarrow\{\}$ ; $L_{c}(n_{0})\leftarrow s_{0};L_{a}(n_{0})\leftarrow\top$ ; waitlist $\leftarrow\{n_{0}\}$ waitlist is not empty

2:$n\in$ waitlist ; waitlist $\leftarrow$ waitlist$\setminus\{n\}$ $\exists\ n_{c}\neq n\in N:L_{c}(n)\in L_{a}(n_{c})\wedge n_{c}\text{ not covered}$

3:$E_{C}\leftarrow E_{C}\cup\{(n,n_{c})\}$ ; $Block(n,\neg L_{a}(n_{c}))$ $\triangleright$ Expansion $c\in\mathcal{C}$ $eval(g_{c},L_{c}(n))=\mathit{True}$ $\triangleright$ $c$ is enabled in $L_{c}(n)$ $c$ is target command mark $n$ as target $eval(g_{c},L_{a}(n))=\mathit{Unknown}$

4:Block($n$, $\neg g_{c}$) $\triangleright$ $c$ can be disabled in $L_{a}$, so we refine $a_{i}\in Supp(d_{c})$

5:$N\leftarrow N\cup\{n_{new}\}$; $L_{c}(n_{new})\leftarrow eval(a,L_{c}(n))$; $L_{a}(n_{new})\leftarrow\top$; $\delta(n_{new})\leftarrow p^{c}_{i}$ waitlist $\leftarrow$ waitlist $\cup\ n_{new}$

6:$E_{T}\leftarrow E_{T}\cup(n,c,\delta)$ $eval(g(c),L_{a}(n))=\mathit{Unknown}$

7:Block($n$, $g_{c}$) $\triangleright$ $c$ can be enabled in $L_{a}$, but is not in $L_{c}$, so we refine

8:PASG $(N,E_{T},E_{C},L_{c},L_{a})$

Algorithm 2 Block(n, $\phi$)

$eval(\phi,L_{c}(n))=\mathit{False}$

9:$L_{a}(n)\leftarrow block(L_{a}(n),\phi,L_{c}(n))$ $(n^{\prime},n)\in E_{C}$ $\triangleright$ Check nodes $n^{\prime}$ covered by $n$ $L_{c}(n^{\prime})\notin L_{a}(n)$ $\triangleright$ Remove if new $L_{a}$ cannot cover

10:$E_{C}\leftarrow E_{C}\setminus(n^{\prime},n);waitlist\leftarrow waitlist\cup\ n^{\prime}$ Block($n^{\prime}$, $\neg L_{a}(n)$) $\triangleright$ Else refine covered node

11:Let $e=(n_{pre},c,d)\in E_{T}\ s.t.\ n\in Supp(d)$ $\triangleright$ $n_{pre}$ denotes the parent of this node

12:Let $a^{c}_{i}$ s.t. $n^{e}_{i}=n$ $\triangleright$ $a^{c}_{i}$ is the assignment which resulted in the node $n$

13:Block($n_{pre},\neg eval^{-1}(a^{c}_{i},L_{a}(n))$) $\triangleright$ Making sure that 2 still holds for $L_{a}$

Now we adapt the lazy algorithm to symbolic MDPs given by a variable set $\mathcal{V}$ and a command set $\mathcal{C}_{0}$. Given a target formula $\phi\in\mathcal{E}_{\mathcal{V}}$, the goal is to compute the maximal probability of reaching a state $s$ s.t. $eval(\phi,s)=\mathit{True}$.

We select abstract domain $(\hat{S},\preceq,\alpha,\gamma)$. The set of commands is extended with a target command: $\mathcal{C}=\mathcal{C}_{0}\cup\{(\phi,\delta_{id})$}, where $id$ is the identity assignment. A node is a target if this command is enabled in it. This ensures that the finished ASG contains a node labeled with a target state exactly if a target state is reachable in the concrete state space [27].

3.0.1 Abstract model

We use a probabilistic extension of the ASG. A direct adaptation of the non-probabilistic lazy algorithm by switching to probabilistic actions would overapproximate the target probability with no control over the approximation. Therefore, we use a stricter, symmetric representation constraint for the relation between the concrete and abstract labels of a Probabilistic ASG node.

Definition 2 (PASG)

A Probabilistic Adaptive Simulation Graph is a tuple $(N,E_{T},E_{C},L_{c},L_{a})$, where $N$ is a set of nodes, $E_{T}\subseteq N\times\mathcal{C}\times\mathbb{D}(N)$ is a set of transition “edges” from nodes to node distributions labeled with commands, $E_{C}\subseteq N\times N$ is a set of directed covering edges, $L_{c}:N\xrightarrow{}\mathit{VAL}_{\mathcal{V}}$ is the concrete labeling function, $L_{a}:N\xrightarrow{}\hat{S}$ is the abstract labeling function.

For an edge $e=(n,c,d)\in E_{T}$, $n^{e}_{i}$ is the $i$th element of $Supp(d)$ for a fixed ordering. A PASG is well-labeled, if it satisfies the constraints in Table 2. The main difference from the original ASG is that in 2, we use a distribution of results instead of a single one, and 2 requires the set of enabled actions to be exactly the same in all concrete states contained in the abstract label.

In the original lazy algorithm, refinement is performed when an action disabled in $L_{c}(n)$, but enabled in some element of the abstract label $L_{a}(n)$, and we refine by blocking the guard of the action from $L_{a}(n)$. Here, we also refine when an action is enabled in $L_{c}(n)$ but disabled in some element of $L_{a}(n)$ by blocking the negation of the guard. We also need to adapt soundness to probabilities, see LABEL:thm:bi_soundness. 2 is a technical constraint to make our proofs easier.

Constraint	Formalisation
A1) Abstract label contains the concrete label:	$\forall n\in N:L_{c}(n)\in L_{a}(n)$
A2) Concrete label exactly represents the whole abstract label with respect to the enabled commands	$\forall n\in N:\forall c\in\mathcal{C}:eval(g_{c},L_{c}(n))=eval(g_{c},L_{a}(n))$
B1) The command of a transition edge is enabled in the concrete label of the source	$\forall(n,c,\cdot)\in E_{T}\colon{}\mathit{eval}(g_{c},L_{c}(n))=\mathit{True}$
B2) For transition edges $e=(n,c,d)\in E_{T}$, the $i$th result node is consistent with the $i$th assignment: same probability, concrete label is the result of the assignment, abstract label overapproximates the result	$d(n^{e}_{i})=d_{c}(a^{c}_{i})$ $L_{c}(n^{e}_{i})=eval(a^{c}_{i},L_{c}(n))$ $eval(a^{c}_{i},L_{a}(n))\preceq L_{a}(n^{e}_{i})$
C1) Abstract label of covering node contains the concrete label of covered node	$\forall(n,n^{\prime})\in E_{C}\colon L_{c}(n)\in L_{a}(n^{\prime})$
C2) Covering node is at least as abstract as the covered node	$\forall(n,n^{\prime})\in E_{C}\colon L_{a}(n)\preceq L_{a}(n^{\prime})$
C3) Covering node is not covered	$\forall(n,n^{\prime})\in E_{C}\colon\neg\exists(n^{\prime},n^{\prime\prime})\in E_{C}$
D1) At most one node labeled with a given concrete label can be non-covered	$\forall n,n^{\prime}\in N\colon n\neq n^{\prime}\wedge L_{c}(n)=L_{c}(n^{\prime})\implies(\exists n^{\prime\prime}\colon(n,n^{\prime\prime})\in E_{C}\vee(n^{\prime},n^{\prime\prime})\in E_{C})$

Table 2: PASG constraints

Example 1

1(b) shows an example PASG with black (the orange part is a refinement example explained later). The abstract label tracks only $x$ in all nodes (this could differ from node to node in general). $L_{c}$ is contained in $L_{a}$ for all nodes as the value of $x$ is the same in $L_{c}$ and $L_{a}$ (2).

$n_{0}$ covers $n_{1}$, $n_{2}$ covers $n_{4}$ and $n_{3}$, satisfying 2 and 2. $n_{3}$ could cover $n_{4}$ according to the labels, but it would violate 2.

This PASG is unfinished, $n_{4}$ and $n_{5}$ are not expanded. $n_{0}$ is an example for the remaining constraints. 2 is satisfied, as tracking $x$ in $L_{a}$ is enough to disable $c_{3}$, and both $c_{1}$ and $c_{2}$ are enabled in $L_{c}$ and everywhere in $L_{a}$. As the outgoing edges are labeled with $c_{1}$ and $c_{2}$, 2 is satisfied. Let $e=(n_{0},c_{1},d)$ be the $c_{1}$ edge from $n_{0}$. The assignments in $c_{1}$ are $a^{c_{1}}_{1}=(x^{\prime}:=x+1\wedge y^{\prime}:=y)$, paired with $n^{e}_{1}=n_{2}$ and $a^{c_{1}}_{2}=(x^{\prime}:=x\wedge y^{\prime}:=y)$ paired with $n^{e}_{2}=n_{1}$, which satisfies 2. E.g. for $a^{c_{1}}_{1}$: $eval(a^{c_{1}}_{1},L_{c}(n_{0}))=eval((x^{\prime}:=x+1\wedge y^{\prime}:=y),(x=0,y=0))=(x=1,y=0)$, $eval(a^{c_{1}}_{1},L_{a}(n_{0}))=(x=1)\preceq(x=1)$ and $d_{c_{1}}(a^{c_{1}}_{1})=0.8=d(n_{2})$.

3.0.2 Exploration

Algorithm 1 shows PASG construction. An initial node $n_{0}$ labeled $L_{c}(n_{0})=val_{0},L_{a}(n_{0})=\top$ is extended to a well-labeled PASG with each node either covered or expanded. Algorithm 2 shows blocking an expression from $L_{a}(n)$, used during refinement.

When removing a node $n$ from the waitlist, we check whether $\exists n_{c}\neq n\in N\colon L_{c}(n^{\prime})\in L_{a}(n_{c})$ s.t. $n_{c}$ is not covered. If so, a covering edge $(n^{\prime},n_{c})$ is created and $L_{a}(n^{\prime})$ is strengthened for 2 to hold. Else, it is expanded.

If a node $n\in N$ is selected for expansion, we check for each $c\in\mathcal{C}$ whether $eval(g_{c},L_{c}(n))=\mathit{True}$. If so, a new node $n^{\prime}_{i}$ is created for each $a_{i}\in Supp(d_{c})$ with $L_{c}(n^{\prime}_{i})=eval(a_{i},L_{c}(n)),L_{a}(n^{\prime}_{i})=\top$, and a transition edge $(n,c,d_{e})$ is created such that $d_{e}(n^{\prime}_{i})=d_{c}(a_{i})$ for $i=1\dots|Supp(d_{c})|$. Because of 2, if the abstract label contains states where the transition is disabled, we remove them by blocking out the negated guard (Line 3).

If $\mathit{eval(g_{c},L_{c}(n))=\mathit{False}}$, we compute $eval(g_{c},L_{a}(n))$. If $\mathit{False}$, we move on to the next command. If $\mathit{Unknown}$ (cannot be $\mathit{True}$, as $L_{c}\in L_{a}$), 2 is violated, so $L_{a}(n)$ needs to be strengthened: a new abstract label is computed as $\hat{s}^{\prime}=block(L_{a}(n),g_{c},L_{c}(n))$. Because of the contract of $block$, $eval(g_{c},\hat{s}^{\prime})=\mathit{False}$, so this command no longer causes a constraint violation (Line 6).

3.0.3 Refinement

Refinement is interleaved with exploring the abstract state space. Whenever the $L_{a}(n)$ changes for some $n\in N$, the constraints may be violated. If constraint 2 is violated, the problematic covering edge is removed from $E_{C}$. This makes $n$ non-covered, so we expand it later (Line 10).

If constraint 2 is violated by covering edge $(n,n^{\prime})\in E_{C}$, but constraint 2 still holds, the current $L_{a}(n)$ must be replaced with $\hat{s}^{\prime}$ such that $L_{c}(n)\in\hat{s}^{\prime}$, $\hat{s}^{\prime}\preceq L_{a}(n^{\prime})$ and $\hat{s}^{\prime}\preceq L_{a}(n)$ (referring to the current $L_{a}$). An appropriate $\hat{s}^{\prime}$ is $block(L_{a}(n),\neg L_{a}(n),L_{c}(n))$ (Line 10).

Assume that 2 is violated by an edge $e=(n,c,d)$. Because of how the PASG is constructed, the concrete label and probability subconstraints of 2 must still hold, but the abstract label part is violated by some node $n^{e}_{i}$: $L_{a}$ of $n^{e}_{i}$ no longer overapproximates applying $a^{c}_{i}$ (the assignment that led to its creation) to $L_{a}$ of its parent. The violation caused by this assignment is eliminated by changing $L_{a}(n)$ to $block(L_{a}(n),eval^{-1}(a^{c}_{i},L_{a}(n^{e}_{i}),L_{c}(n))$ (Line 13).

Strengthenings may create new violations, but all of them are eliminated after finite steps (if the concrete label can be finitely represented in the abstract domain), and we continue expanding non-covered nodes. Efficient implementations of the algorithm can employ sequence interpolation to strengthen the whole path up to the root at once [27], which we do when using the predicate domain, as we observed that both simple weakest-precondition-based refinement and binary interpolation lead to predicates growing very fast.

Example 2

1(b) shows an example of refinement in orange. Expanding $n_{5}$, we realize $c_{3}$ is enabled in some states described by abstract label $x=2$, but not in the concrete label $x=2,y=0$. Thus, we strengthen $n_{5}$ by blocking the guard $x==2\wedge y==2$, resulting in the abstract label $x=2,y=0$.

This triggers another strengthening, as $L_{a}(n_{5})$ no longer overapproximates applying $x^{\prime}=x+1\wedge y^{\prime}=y$ to $L_{a}(n_{2})$. $n_{2}$ is also strengthened, removing a cover edge as $L_{c}(n_{3})$ is no longer contained in $L_{a}(n_{2})$. Strengthening a covering node also strengthens the covered nodes if the covering remains (see $n_{4}$ and $n_{1}$).

3.0.4 Numerical analysis

The finished PASG can be treated as an MDP $(N,\mathcal{C}\cup cover,T_{\mathit{PASG{}{}}},n_{0})$. Regarding $T_{\mathit{PASG{}{}}}$, for a non-covered node $n$, a command $c\in C$ is enabled if there is an edge $(n,c,d)\in E_{T}$ in the PASG, and $T_{\mathit{PASG{}{}}}(n,c)=d$. The only action in covered nodes is $cover$, which results in their covering node.

thm:bi_soundness The maximal/minimal probability of reaching a target node in the PASG of an MDP $M$ is the same as in $M$.

Refer to the Appendix for proofs.

Due to the symmetry of constraint 2, this abstraction can be considered similar to bisimulation-reduction, but not aiming for the coarsest bisimulation. Constructing the PASG can be computationally cheaper than the coarsest bisimulation, but the larger state space may result in more expensive numerical computation. The advantages appear when the abstraction is combined with partial state space exploration, as most bisimulation reduction algorithms in the literature cannot be done on the fly. Comparing our method to bisimulation reduction in depth (both theoretically and empirically) is planned for future work.

3.1 Combining with BRTDP

Bounded Real-Time Dynamic Programming (BRTDP) [22, 3] approximates the value function of an MDP during state space exploration. It maintains an upper and a lower bound ($U$ and $L$) by generating traces and updating the bounds for the encountered states. In each step, the optimal action is chosen according to the current $U$. The strategy for choosing a state from the result distribution is a parameter of the algorithm, for which we implemented the RANDOM and DIFF_BASED trace generation strategies from [3].

Our lazy abstraction algorithm combines well with such methods. As refinement is performed during expansion, the abstract states in an in-progress PASG are coarser than those in a finished PASG. Thus, if BRTDP reaches the required threshold before constructing the full PASG, the abstract labels remain coarser. Existing probabilistic CEGAR schemes like [17] cannot benefit from this, as they need lower and upper value bounds for all nodes for refinement, while BRTDP works best when only the value of the initial node is needed. This combination enables a controlled trade-off between time and accuracy.

The skeleton of the algorithm is the same as the BRTDP algorithm described in [3] for general MDPs. The difference is that instead of generating traces from the final PASG, we use the steps of building the PASG for trace generation. As such, refinement is also possible during trace simulation, potentially removing covers used in previous simulations.

thm:bi_brtdp_soundness The maximal probability of reaching a target state is always between $L(n_{0})$ and $U(n_{0})$ if BRTDP is used with PASG construction steps.

This theorem is non-trivial, as the traces are not generated for the finished PASG, but for an in-progress version where transient cover edges can exist which would not be present when finished. The main idea behind its proof is that if a value is propagated through a cover edge, then the value has been updated only based on traces consistent with the cover edge (as we would have already removed it if any trace inconsistent with it had been explored).

4 Evaluation

Figure 2: Comparison of standard and abstract BVI with the EXPL (top row) and PRED (bottom row) domain. Columns: 1^st: number of (non-covered) nodes, 2^nd: running time on log scale, 3^rd: ratio of the original and abstract state space size (red line marks 1, which would be no reduction). Only for inputs where the two algorithms compared in the plot terminated.

Implementation Our prototype with the explicit value and predicate domains is implemented in the Theta model checker [26], taking JANI models[4] as input. Only properties of the form $P_{max}(p\ U\ q)=?$ are supported where $p,q$ are Boolean constraints. Action result probabilities must be constant. The locations of JANI models are always tracked in the abstract states and covering can only occur between nodes with the same locations. To fairly assess the algorithms rather than the implementations, we implemented both Bounded Value Iteration (BVI) [1] and BRTDP as MDP solution techniques in Theta both with and without lazy abstraction. We precompute almost sure reachability and avoidance to speed up the numerical solution if BVI is used.

The main metrics of interest are state space size and running time. As the numerical computations mostly scale with the non-covered PASG nodes, we are especially interested in the number of non-covered nodes. Our evaluation focuses on the following research questions:

RQ1. How does lazy abstraction affect the state space size and analysis time?

RQ2. Does the combination of lazy abstraction with BRTDP lead to reduced abstract model size when converged? How does it affect the running time?

4.0.1 Setup

We used the 104 MDP model-property pairs from the Quantitative Verification Benchmark Set [12] compatible with our current implementation. The experiments were conducted using BenchExec[2], running them on the Komondor HPC with AMD EPYC^TM 7763 CPUs, each run getting 8 CPU cores, 16GB RAM, and a 1-hour timeout. Convergence threshold was $10^{-6}$ (absolute) for all algorithms.

4.0.2 Results and discussion

RQ1. Figure 2 shows the BVI results. Lazy abstraction often significantly reduced the state space: for example, a 3-fold reduction was possible for beb.3-4 [N=3, prop: GaveUp] (from 4632 nodes to 1559 non-covered nodes) and csma.2-6 [prop: all_before_max] (from 67741 to 24837) with EXPL, and for beb.3-4 [N=3, prop: GaveUp] (from 4632 to 1354) with PRED. There are also inputs where the explicit domain could not reduce the state space size (e.g. blocksworld.5, cdrive.2, but that is expected because of its low granularity.

Measuring the analysis time, it turned out that the overhead of more complex operations during exploration outweighed the benefits of numerical computations on a smaller state space. The overhead is apparent for EXPL, but it is much less severe than for PRED.

Predicate abstraction was sometimes able to reduce the state space more than the explicit domain when it terminated before timeout, but the opposite was also present (related plots can be found in the appendix). The overhead of interpolating using an SMT solver was often too large, and so PRED often failed to terminate in time.

We identified several abstraction-specific optimization possibilities for the implementation. For one, the interpolants returned by Z3 were often very large and had a redundant structure, which we could mitigate through structural simplification, improving both time and memory efficiency. Investigating alternative refinement methods and other solvers could also lead to better results.

Another opportunity for optimization is that like the non-probabilistic version [27], we currently create multiple nodes with the same $L_{C}$ if a concrete state is reachable on multiple paths. As one of them always covers the others, only that is explored. However, according to our investigation, there are inputs where this led to multiple magnitudes of increase in the number of nodes during exploration. Merging such nodes instead would solve this issue, but refinement must be slightly changed as the path up to the root will no longer be unambiguous. We already had some preliminary measurements with promising results regarding this modification.

Figure 3: Comparison of abstract BVI and BRTDP. Same plot types as Figure 2.

RQ2. The simulation-based nature of BRTDP makes it harder to gauge the benefits of abstract BRTDP compared to standard BRTDP: there were inputs where abstract BRTDP converged with fewer nodes and where the concrete one did. (We relegated plots related to this comparison to the appendix.)

The benefits of abstract BRTDP compared to abstract BVI are much more apparent. The plots in Figure 3 show this comparison (the results of the strategy leading to fewer nodes were used for each input-domain pair for BRTDP).

The highest relative state space size reduction was on zeroconf [N=20, k=2, !reset, prop: correct] (170-fold from 64109 to 373 non-covered nodes) for EXPL and pnueli-zuck.3 [prop: live] (from 1888 to 239 non-covered nodes) for PRED. There were inputs where no further reduction was achieved though (e.g. blocksworld.5, cdrive.2, rectangle-tireworld.5, ij.10 for both domains). When both BVI and BRTDP terminated, BRTDP was often able to do so in less time, especially with PRED (the results are much more two-sided for EXPL).

5 Conclusions

We proposed a lazy abstraction algorithm for symbolic MDPs and combined it with BRTDP. We provided numerical evaluation for different versions of the proposed algorithm using the Quantitative Verification Benchmark Set, comparing them to explicitly computing the concrete state space.

The initial experimental evaluation shows potential in the proposed algorithm, especially if reducing the state space is paramount for staying within the memory limits. As the time overhead introduced by more complex computations in the state space exploration often outweighed the gains from analyzing a smaller state space, we plan to explore possible improvements for this aspect. Further measurements using other benchmark sets and more parameterizations of the scalable models in the QVBS are also planned.

Additionally, we wish to explore fine-grained transitioning between the strict representation version (see 2) and a more direct overapproximating adaptation by incorporating ideas from game-based abstraction refinement, moving the algorithm closer to standard abstraction approaches instead of bisimulation reduction.

Appendix 0.A Proofs

For a PASG trace $n_{0}\xrightarrow{act_{1}}n_{1}\xrightarrow{act_{2}}n_{2}\xrightarrow{act_{3}}\dots\xrightarrow{act_{k}}n_{k}$ such that $act_{k}\neq cover$, its coverless representation is constructed such that for each $i$ where $act_{i}=cover$, $act_{i}$ and $n_{i}$ is dropped from the trace. The original trace can always be reconstructed from the coverless representation, as

Lemma 1

For any well-labeled finished PASG $P$ for the MDP $M$, let $s_{0}\xrightarrow{c_{1}}s_{1}\xrightarrow{c_{2}}s_{2}\xrightarrow{c_{3}}\dots\xrightarrow{c_{k}}s_{k}$ be a trace of $M$. Then there must exist a trace of $P$ with coverless representation $n_{0}\xrightarrow{act_{1}}n_{1}\xrightarrow{act_{2}}n_{2}\xrightarrow{act_{3}}\dots\xrightarrow{act_{k}}n_{k}$ such that for all $i=1..k:s_{i}\in L_{a}(n_{i})$.

Proof

For any non-covered node $n$ and concrete state $s$, if $s\in L_{a}(n)$, then all commands enabled in $s$ are enabled in $n$ because of 2 and 2 (the concrete label has at least those commands enabled that are enabled in any state described by the abstract label, and the actions enabled in a non-covered node are the commands enabled in its concrete label). Because of 2, if there is a covering edge $(n,n^{\prime})$ and $s\in L_{a}(n)$, the $s\in L_{a}(n^{\prime})$ is also true. Because of the abstract label subconstraint of 2, if $s\in L_{a}(n)$ and choosing the assignment in $n$ leads to $n^{\prime}$, then $eval(a,s)\in L_{a}(n^{\prime})$.

Based on these observations, the theorem can be proven by induction on the trace length. It holds for the 0-length trace $s_{0}$, as $s_{0}=L_{c}(n_{0})\in L_{a}(n_{0})$. Then for an $M$ trace with length $i+1$, we know that the length $i$ prefix has a corresponding $P$ trace ending in $n_{i}$. If this is not a covered node, then $c_{i+1}$ is enabled in it as (from the induction assumption) $s_{i}\in L_{a}(n_{i})$, then we choose any assignment of $c_{i+1}$ that leads to $s_{i+1}$, and choose the same assignment in $P$ leading to a node $n_{i+1}$. As we observed, because of the abstract label subconstraint of 2, $s_{i+1}\in L_{a}(n_{i+q})$. If $n_{i}$ is covered, we take the $cover$ action to $n^{\prime}$, where $c_{i+1}$ is enabled, as $s_{i}\in L_{a}(n^{\prime})$ because of 2. We take $c_{i+1}$ and an appropriate assignment to $n_{i+1}$, and $s_{i+1}\in n_{i+1}$ is true for the same reason as in the other case. This concludes our induction proof.

A consequence of this is that if a node $n$ is covered by $n^{\prime}$ in a finished PASG, then for all traces from $L_{c}(n)$, there exists a trace from $L_{c}(n^{\prime})$ with the same commands and assignments chosen.

Lemma 2

The maximal probability of reaching a target node in a PASG for an MDP $M$ is at least as high as the maximal probability of reaching a target state in $M$.

Proof

Fix a maximizing memoryless strategy $\sigma$ for the MDP $M$ (we can restrict ourselves to memoryless strategies as an optimal memoryless strategy for an MDP is also an optimal general strategy if the optimization goal is a reachability probability). This induces a Discrete-Time Markov Chain $M^{\sigma}$, where the probability of reaching a target state from the initial state is the maximal probability of reaching a target in $M$. We will construct a strategy $\hat{\sigma}:N*\xrightarrow{}\mathcal{C}\cup\{cover\}$ for the PASG $P$ that results in at least as high probability for reaching a target node as $\sigma$. Note that $\hat{\sigma}$ is not a memoryless strategy.

The aim of $\hat{\sigma}$ will be to copy the traces of $M^{\sigma}$. The non-trivial part of this is that because of covers, multiple states of $M^{\sigma}$ can correspond to the same node in the PASG – that is why $\hat{\sigma}$ is not a memoryless strategy but uses the whole trace to select an action.

$\hat{\sigma}$ will obviously always choose $cover$ if the trace ends in a covered node, as there is no other enabled action. Let $n_{0}\xrightarrow{c_{1}}n_{1}\xrightarrow{c_{2}}n_{2}\xrightarrow{c_{3}}\dots\xrightarrow{c_{n}}c_{n}$ be a coverless representation of a PASG trace $\hat{\tau}$. Because of 2, there is a one-to-one correspondence between the assignments of $c_{i}$ and the result nodes of the transition edge. Let $a_{i}$ be the assignment corresponding to $n_{i}$ in this trace.

We have two cases:

1. A concrete trace $\tau=s_{0}\xrightarrow{c_{1}}s_{1}\xrightarrow{c_{2}}s_{2}$ can be constructed from $\hat{\tau}$ by starting in $s_{0}$, choosing $c_{i}$ and applying $a_{i}$ to $s_{i-1}$ in the $i$th step. This way, we can compute which concrete state we would actually be in if this assignment sequence happened in the original state space. We will call $\tau$ the concretization of $\hat{\tau}$. This is possible only if $c_{i}$ is enabled in $c_{i-1}$, which need not always be true – that will be the second case. Let $\hat{\sigma}(\hat{\tau})$ be the same command as $\sigma(\text{last}(\tau))$.

2. The trace is not concretizable. In this case, $\hat{\sigma}(\hat{\tau})$ can be anything, as such traces will never be generated by $\hat{\sigma}$ if it is constructed according to the previous case for concretizable traces, so it cannot change the induced MDP $P^{\hat{\sigma}}$.

This is a valid strategy, as 1 ensures the selected command is enabled in the PASG node. The fact that the choice for non-concretizable traces does not matter can be seen by induction:

• The only possible 1-length trace $n_{1}$ is trivially concretizable, the commands enabled in $n_{0}$ are exactly those enabled in $L_{c}(n_{0})=s_{0}$.

• Let $\tau$ be the concretization of a concretizable trace $\hat{\tau}$. At the end of $\hat{\tau}$, $\hat{\sigma}$ chooses a command that is enabled at the end of $\tau$, resulting in a trace one step longer that is still concretizable.

Although there is always a unique assignment that results in entering a node in the PASG, this is not true in general in the original MDP (e.g. in the state $x=1$, the assignments $x^{\prime}:=x+1$ and $x^{\prime}:=2$ both lead to the state $x=2$ – if these are the assignments of the same command, we do not know which one was chosen), so there are multiple $P^{\hat{\sigma}}$ traces with the same concretization.

Assume for a moment that concretization creates a one-to-one correspondence between abstract and concrete traces, so the aforementioned problem is not present. In this case, the probability subconstraint of 2 would ensure that the probability of $\hat{\tau}$ according to the strategy $\hat{\sigma}$ is the same as the probability of its concretization $\tau$ according to $\sigma$.

This can be generalized to the case when there are multiple abstract traces $\hat{\tau}_{1},\hat{\tau}_{2},\dots\hat{\tau}_{k}$ with the same concretization $\tau$: in this case, $\mathbb{P}_{\sigma}(\tau)=\sum_{i=1}^{k}\mathbb{P}_{\hat{\sigma}}(\hat{\tau}_{i})$.

Proof sketch for proving this by induction: if at the first command of a trace there are two assignments $a_{1}$ and $a_{2}$ in a command leading to the same concrete state $s^{\prime}$ when applied to $s$, then the probability of going from $s$ to $s^{\prime}$ is $\mathbb{P}(a_{1})+\mathbb{P}(a_{2})$, and the probability of the whole trace is $\mathbb{P}(a_{1})+\mathbb{P}(a_{2})$ times the probability of the suffix $\tau^{\prime}$; in the PASG, these two assignments result in different nodes, but the abstract traces corresponding to the suffix are available from both nodes (or there covering nodes, which only multiplies the probability of the suffix by $1.0$), so assuming the sum of the probability of these abstract traces is $\mathbb{P}(\tau^{\prime})$, then the probability of the whole trace is $\mathbb{P}(a_{1})\mathbb{P}(\tau^{\prime})+\mathbb{P}(a_{2})\mathbb{P}(\tau^{\prime})=(\mathbb{P}(a_{1})+\mathbb{P}(a_{2}))\mathbb{P}(\tau^{\prime})$, which is the original probability.

Let $abstr(\tau)$ denote the set of abstract traces that have the concretization $\tau$, and $\mathbb{P}(abstr(\tau))$ is the sum of their probabilities. From the previous statement, we have $\mathbb{P}(\tau)=\mathbb{P}(abstr(\tau))$ Let $concr(\hat{\tau})$ be the concretization of $\hat{\tau}$. Observe that concretization is deterministic, so for any $\tau_{1},\tau_{2}$, $abstr(\tau_{1})\cap abstr(\tau_{2})=\emptyset$. Let $\hat{T}$ be the set of $P^{\hat{\sigma}}$ traces that lead to target nodes, and $\hat{T}_{c}=(\hat{\tau}\in\hat{T}|concr(\hat{\tau})\text{ is a target trace in $M^{\sigma}$})$. $\hat{T}_{c}$ need not be the whole $\hat{T}$, as target nodes can cover non-target nodes, let $\hat{T}_{s}$ denote the ”spurious” target traces $\hat{T}\setminus\hat{T}_{c}$. Let $T$ denote the set of target traces of $M^{\sigma}$. Observe that $\hat{T}_{c}=\bigcup_{\tau\in T}abstr(\tau)$. Now we can prove that the target probability on $P^{\hat{\sigma}}$ is at least as high as in $M^{\sigma}$:

$$\mathbb{P}(\hat{T}) =\mathbb{P}(\hat{T}_{c})+\mathbb{P}(\hat{T}_{s})=(\sum_{\hat{\tau}\in\hat{T}_{c}}\mathbb{P}(\hat{\tau}))+\mathbb{P}(\hat{T}_{s})=$$

$$=(\sum_{\tau\in T}\mathbb{P}(abstr(\tau)))+\mathbb{P}(\hat{T}_{s})=(\sum_{\tau\in T}\mathbb{P}(\tau))+\mathbb{P}(\hat{T}_{s})=\mathbb{P}(T)+\mathbb{P}(\hat{T}_{s})$$

As $\mathbb{P}(\hat{T}_{s})$ is non-negative, and $\mathbb{P}(T)$ is exactly the target probability in $M^{\sigma}$, we have proven that the target probability in $\mathbb{P}^{\hat{\sigma}}$ is at least as high as in $M^{\sigma}$. $\hat{\sigma}$ is not necessarily a maximizing strategy, so the maximal probability in $P$ can be even higher. $\sigma$ was chosen to be maximizing, so this proves the theorem.

The probability of reaching a target state in $M^{\sigma}$ is the sum of the probabilities of all traces reaching a target state. For each of these traces, we have a “copy” in the MDP induced by $\hat{\sigma}$ for PASG, which has the same probability, as the same commands are chosen throughout the trace and the probability of choosing a given assignment in a step of the trace is the same in the PASG as in $M^{\sigma}$. There are other traces as well in the PASG with strategy $\hat{\sigma}$ that end in target nodes: non-concretizable traces because of covering nodes enabling commands that are not enabled in the covered node and traces that end in target nodes that cover non-target nodes.

As $\hat{\sigma}$ already results in at least as high target reachability probability as an optimal strategy on $M$, and it might not even be optimal, this shows that the maximal probability in the PASG must be at least as high as in $M$.

Lemma 3

The maximal probability of reaching a target node in a PASG for an MDP $M$ is at most as high as the maximal probability of reaching a target state in $M$.

Proof

Sketch: The proof is done similarly to that of 2, just the other way around. The main difference is that strategies on $M$ have less information in the trace than strategies in the PASG, as nodes in the PASG are basically labeled with which assignment was the last. This leads to a problem when two assignments of a command can lead to the same state in $M$, as a strategy on the PASG may choose a different action in them (e.g. they can be covered by different nodes).

Because of this, we construct a different MDP $M^{\prime}$ from the symbolic description of $M$, where the states also contain the assignment that was applied last time. This MDP is bisimilar to $M$, the bisimulation relation being based on forgetting the last assignment – neither the “targetness” nor the enabled commands and their result distribution depends on the last assignment if the current state is known, so it is easy to prove that this is a bisimulation. As such, the maximal target probability on $M^{\prime}$ is the same as on $M$.

For any maximizing memoryless strategy $\hat{\sigma}$ on the PASG, we can construct a non-memoryless strategy $\sigma$ on $M^{\prime}$ such that $\sigma(\tau)=\hat{\sigma}(last(abstr(\tau)))$, which is now unique because of the assignment labels. The strategy is valid, which can be proven using an “inverted” 1 based on 2. This results in at least as high a probability for reaching a target state as in the PASG.

Theorem LABEL:thm:bi_soundness

Proof

The theorem is a result of combining 2 and 3: the probability in the PASG is both a lower and an upper approximation of the probability in the MDP, so it must be the same.

Lemma 4

The maximal probability of reaching a target state is always below $U(n_{0})$ if BRTDP is used with PASG construction steps.

Proof

Sketch: Let $M^{\prime}$ be an assignment-labeled version of $M$ similarly to the proof of 3. For an element $s$ and an assignment $a$, the $M^{\prime}$ state $s\oplus a$ corresponds to the $M$ state $s$ with the latest assignment being $a$. The initial state is a special $s_{0}\oplus\bot$ element without an assignment label. For all already existing PASG nodes $n$, $U(n)\geq V(L_{c}(n)\oplus a_{n})$, where $V$ is the real value function of $M^{\prime}$, $a_{n}$ is the assignment corresponding to $n$ according to constraint 2, and $L_{c}(n)\oplus a_{n}$ is a state of $M^{\prime}$. This can be proven by induction. This is of course true when the node is created, as it is initialized to $1.0$ unless it is a non-target absorbing node, in which case $U(n)=V(L_{c}(n))=0.0$. Whenever $U(n)$ is updated in later steps, we have two cases:

1. $n$ is non-covered, so it is updated according to a transition edge. In this case, the update corresponds to an update on $M^{\prime}$ according to an upper approximation of the value function $U^{\prime}$, which is set to $U^{\prime}(s)=U(m)$ if a node exists with $L_{c}(m)\oplus a_{m}$ and $1.0$ otherwise. Because of the induction hypothesis, this is a valid upper bound for the value function, which means that computing a Bellman update using it is a valid

2. $n$ is covered by $n^{\prime}$. We do not yet know whether the currently covering node will remain covering until the finished PASG, so we cannot say that all action sequences possible from $L_{c}(n)\oplus a_{n}$ are possible from $L_{c}(n^{\prime})\oplus a_{(}n^{\prime})$. However, as the covering edge still exists, we know that those action sequences that are possible from $L_{c}(n)\oplus a_{n}$ but not from $L_{c}(n^{\prime})\oplus a_{n^{\prime}}$ have not been explored yet: along the way of these sequences, there exists a non-covered non-expanded node. The value of this node is currently overapproximated by $1.0$. So for all action sequences possible from $L_{c}(n)\oplus a_{n}$, they are either also possible from $L_{c}(n^{\prime})\oplus a_{n^{\prime}}$, or there is a prefix of it that is possible from it, and ends in a node whose value approximation is set to $1.0$. Because of this (and the fact that we are aiming to maximize the value), the current value approximation of $n^{\prime}$ must be higher than the value of $L_{c}(n)\oplus a_{n}$, so copying it to $n$ does not violate the induction assumption.

As $M^{\prime}$ is bisimilar to $M$, $V(s_{0})=V(s_{0}\oplus\bot)$, so $U(n_{0})$ is also an upper bound for $s_{0}$.

Lemma 5

The maximal probability of reaching a target state is always above $L(n_{0})$ if BRTDP is used with PASG construction steps.

Proof

Sketch: This can be proven similarly to 4. The upper approximation $U$ is replaced in all statements with the lower approximation $L$. The non-covered case goes the same.

If $n$ is covered by $n^{\prime}$ in the finished PASG, we know that all action sequences starting from $L_{c}(n^{\prime})\oplus a_{n^{\prime}}$ are also available from $L_{c}(n)\oplus a_{n}$. When an update happens during BRTDP, we do not know this yet. However, for all action sequences available from $L_{c}(n^{\prime})\oplus a_{n^{\prime}}$ and not available from $L_{c}(n)\oplus a_{n}$, as the covering edge is still there, there must be a state whose current lower approximation is $0$, as the corresponding PASG node has not been expanded yet. So the current $L(n^{\prime})$ must be lower than $V(L_{c}(n)\oplus a_{n})$.

Theorem LABEL:thm:bi_brtdp_soundness

Proof

Consequence of combining 4 and 5.

Appendix 0.B Further Experiment Results

Figure 4 compares the PRED and EXPL domains when using BVI. Although EXPL always wins in running time, PRED can sometimes reduce the number of nodes further. If the overhead of refinement in the PRED domain can be mitigated making it terminate in time on more inputs, the better reduction capability might be observed on even more inputs.

Figure 5 compares the results using BRTDP both for the baseline and abstraction-based analysis. No clear advantage of either of them can be observed.

Figure 4: Comparison of EXPL and PRED BVI.

Figure 5: Comparison of abstract and standard BRTDP. Unlike in the other two figures, the node number comparison uses log scale, as linear scaling made it hard to see.