Model checking

Hardware and software systems are all designed and implemented by humans, for whom it is impossible not to make mistakes. These mistakes imparted to systems always disturb humans, even after a complete testing. Therefore, even as people are enjoying the efficiency and convenience of information technology, they are also taking risks that the hardware or software systems will fail. How to ensure the correctness and dependability of the hardware and software systems has become a serious problem. To verify the correctness and dependability of a system, during the 1980s, Clarke and Quielle proposed model checking techniques based on temporal logic [24]. Model checking is an automatic, model-based method of verifying properties; its basic idea is shown in Figure 1. The transition system T indicates the system behaviors, and an LTL or CTL formula describes the system specification. Thus, the problem of judging whether a system has the expected specification can be recast as verifying whether the transition system T satisfies formula ; formally, T| = ?. This problem is decidable when the transition system is a finite state transition system, i.e., the model checking algorithm will either terminate with the answer “true”, indicating that the model satisfies the specification, or give a counterexample execution that shows why the formula is not satisfied [25].

The model checking process has three phases: a modeling phase, a checking phase and an analysis phase.

Abstract modeling of clustering processes

Crisp clustering algorithms can be divided into categories such as partitioning methods, hierarchical methods, density-based methods, model-based methods, and SVM-based methods etc. As noted in the Introduction, clustering is an unsupervised machine learning method. Therefore, to ensure clustering quality, most of these algorithms need multiple iterations, although the clustering processes of these algorithm categories different from one another. The differences are the ways in which they group data. For example, K-Means adjusts the clusters of data objects in each iteration, DBSCAN grows clusters by gathering density-reachable objects directly from a core object in each iteration, a hierarchical clustering algorithm may merge or divide clusters in each iteration, while a neural network-based clustering method [29] adjusts the model vector to match objects in each iteration. We can then abstract and model such algorithms of different types based on the iterations of their clustering processes. In addition, employing different algorithms on the same dataset and the same algorithm on different datasets may result in different levels of clustering effectiveness. Therefore, we will formally describe the clustering process of any clustering algorithm applied to a dataset.

In model checking, transition systems are often used as models to describe the behavior of various systems, such as sequential hardware circuits, serial software programs, and parallel systems [30]. They are directed graphs whose nodes represent states and whose edges denote the state transitions. A state describes information of the system behaviors at a given moment. For example, the state of a program indicates the current values of its variables. The transitions between states are caused by actions and indicate the changes of variable values. For a data-dependent system, the state transitions may be caused by the action together with the characteristics of the system variables. For instance, the clusters will continue to adjust if the clustering is not convergent, and the clusters will not change once the clustering is convergent. To make the transitions deterministic without conditions in transition systems, we will first formalize them by means of a program graph over a set of variables, which is also a directed graph whose edges are labeled with conditions on these variables and actions [30]. Then, a transition system can be obtained by unfolding the program graph and can be used for the model in model checking.

Therefore, we build the program graph of a clustering process first to describe the changes of variable values with a clustering process, as described in Definition 1:

Definition 1. The program graph (PG) for a clustering process is a six-tuple (Loc, Act, Effect, →, Loc₀, g₀), where:

1. Loc is a set of locations in which every location corresponds to a variable evaluation set , and denotes the set of evaluations assigning values to every variable in Var.
2. Act is a set of actions in clustering.
3. is the effect function and indicates how the evaluation of variables is changed after performing an action.
4. is the set of conditional transition relations. In a conditional transition , g is the guard of the conditional transition, e.g., the Boolean variable indicating whether it is true that the clustering is convergent. Then, the behavior of location depends on the current variable value η. That is, when η satisfies condition g, the execution of action α will change the evaluation of variables according to Effect(α, η); subsequently, the system changes to location l′.
5. is a set of initial locations.
6. is the initial condition.

Based on the essentials of the clustering algorithms mentioned above, we note that there are two core operations in clustering processes: comparing distances between objects (compare) and assigning objects into clusters (allocate). If these are the actions in a program graph, a clustering process can be regarded as multiple iterations consisting of these two actions and the evaluations of variables. Obviously, the program graph is not appropriate for clustering algorithms that generate clusters without iterations. For example, an SVM-based clustering method [31] performs clustering by using constrained nonlinear programming methods, which can solve problems by KKT conditions and do not need multiple iterations; consequently, we cannot obtain its program graph based on the above idea. The program graph is also not appropriate for the algorithms with probability due to the restriction of the domains of the variables and the effect of actions in the program graph. The probability will cause states to be infinite, which will affect the decidability of model checking. For example, although the EM (Expectation Maximization) method needs multiple iterations to ensure the clustering accuracy, we also cannot obtain its program graph because of its probabilistic nature.

Then, we will use the executive process of K-Means as an example to illustrate its corresponding program graph. Figure 2 describes its graphical representation.

1. Variable set , in which array rs registers whether the objects in each cluster have changed. The domain of is , where k is the number of clusters; 0 indicates the objects in the ith cluster have not changed, while 1 indicates they have changed. conv indicates whether the clustering converges and, hence, terminates. In K-Means, for example, conv is the difference of the criterion function between any two iterations, and its domain is {0,1}, where 0 is not convergent, and 1 is convergent.
2. Act = { compare, allocate }.
3. η is the effect on variable evaluation induced by the action in Act, which is defined based on the semantics of clustering processes:
   1. Effect(compare, η) = η, indicates that none of the variable values will change after the “compare” action.
   2. Effect(allocate,η(conv = 0)) = η(rs[i] = 1), where . In K-Means, if the clustering is not convergent, the objects in a cluster will change after the “allocate” operation.
   3. Effect(allocate,η(conv = 1)) = η(rs[i] = 0), where . Here, once the clustering is convergent, the clusters will not change.
4. The initial condition of clustering is that none of the objects have been disposed of, and there is no object in any cluster, i.e., g₀ = ( rs[i] = 0; conv = 0), where .
5. The conditional transitions indicate the transitions of locations that meet the conditions. In K-Means, they include the following transitions, the action ‘allocate’ will cause the location meeting the initial condition to transfer a new location; if conv is 0, the ‘compare’ action will not cause the change of a location because the clusters do not change and the ‘allocate’ action will make the change of locations; and if conv is 1, the locations will not change after either the ‘compare’ or ‘allocate’ action.

Furthermore, different categories of clustering processes have different program graphs due to their different ways of grouping clusters, and the differences are mainly reflected in the variables and their evaluations of variables implicated by an action along with the conditional transition relations. As a comparison, the program graph of DBSCAN is shown in Figure 3. This program graph is different from K-Means, whose objects are all disposed of after allocating in each iteration. In Figure 3, a new core object is disposed of to find its density-reachable objects in each iteration. Therefore, the variables have been , where conv indicates whether all of the density-reachable objects of one core object has been found, deal indicates whether the objects are all allocated, and their domains are {0,1} with the same meaning as the above. If deal is 0, ‘allocate’ will make the change of locations; if conv is 1 and deal is 0, it will start a new iteration to dispose of a new core object; once all objects have been allocated, i.e. conv is 1 and deal is 1, the locations will not change after either the ‘compare’ or ‘allocate’ action.

The program graph describes the changes of variable values that are impacted by action and the conditions over variables in a clustering process. Subsequently, we will interpret the semantics of a program graph using a transition system. The transition system represents the behaviors of a clustering as a state transition diagram, and can be obtained by unfolding the program graph then defined as the abstract model of a clustering process, i.e., as the verification system model of model checking.

Definition 2. The transition system of a program graph describing a clustering process is a six-tuple with a Kripke frame, TS(C) = (S, Act, δ, I, AP, L), where:

1. is the finite set of system states. Every state consists of a location l of the program graph and the evaluation η of all variables. The initial state is the location satisfying initial condition g₀.
2. Act is the finite set of actions that are the operations in clustering.
3. is the set of state transition relations.
4. is the set of initial states.
5. AP = Loc∪Cond (Var) is the set of atomic propositions. The atomic propositions formally express the characteristics of a clustering.
6. is the label function, i.e., , and it maps a set of atomic propositions to any state . For a given logical formula φ, if the atomic propositions in hold the formula φ, it can be said that state s satisfies φ, formally, .

Each state in a transition system corresponds to a set of evaluations of variables. The variables also include some Boolean variables as atomic propositions, such as maxDunn, which will constitute the property formulas to be satisfied by a valid clustering process.

We then take K-Means applied to the bankdata dataset as an example. Its transition system is presented in Figure 4. We ignore the atomic propositions and set the number of clusters as two, then a state consists of three variables and their evaluations, such as ‘r₀₁,r₁₀,c₀’ in state S₁ indicates that the objects in cluster 0 have changed while those in cluster 1 have not changed, and the clustering is not convergent. The transition system depicts the changes of variable evaluation with the execution of an action, and the state transitions reflect the idea of clustering algorithms. The actual clustering process is one path in this transition system. In addition, the atomic propositions can be used to formulate the relevant clustering properties. Therefore, a transition system can be used as the verification system model of model checking.

If we want to verify the clustering validity with model checking methods, we should also formally describe the properties that valid clustering processes should satisfy. These property formulas consist of atomic propositions in Definition 2. In the next section, we will discuss the method of describing the properties with CTL formulas and their semantics in a transition system model as the basis of subsequent verification algorithms.

Property formulas of validity

Model checking requires that the formal description of the system model and the properties be verified. The formal modeling methods of clustering processes are described above. This section will discuss the methods of representing property formulas satisfied by a valid clustering process.

As the expansion of classical logic, LTL and CTL both include temporal operators and both can be used to represent the properties to be verified. The former quantifies universally over paths in the model, while the latter includes the quantifiers A and E to respectively express the “all paths” and “existing one path” as well as the temporal operators in LTL. For example, CTL can express the semantic describing that there is a reachable state satisfying the property p or that whenever a state satisfying property p is reached the system can satisfy the property q continuously forever. A process of applying a clustering algorithm over specific parameters on a dataset is a path in a state transition diagram. Accordingly, we will describe the property specifications that a valid clustering process should satisfy based on CTL formulas along with a consideration of the balance of its expressive power and moderate decision procedure complexity [30].

The CTL formulas are presented in Appendix S1, whose detailed explanations can be found in [23]. In addition, there is redundancy between the connectives in CTL formulas in Appendix S1, and we can reduce the number of categories of verification algorithms by analyzing the equivalence relations with each other. As in [32], an adequate set of CTL is a subset of temporal connectives in CTL that is sufficient to express the equivalent formulas in CTL. An adequate set of temporal connectives in CTL contains at least one of {AX, EX} and one of {EG, AF, AU}, as well as EU. A common adequate set of CTL is {AF, EU, EX}. Then, the CTL formulas can be described as Appendix S2. The CTL model checking algorithms can be designed based on the connectives in an adequate set.

After the clustering processes, the clusters should be widely spaced, i.e., the separation between clusters should be maximized, while the members of each cluster should be as close to each other as possible, i.e., the compactness in clusters should be minimized. Therefore, a valid clustering result indicates that the result fits the inherent characteristics of the data better based on evaluation indices, i.e., for an external index, its value should be beyond the threshold; and for a relative index, its corresponding separation should be larger and compactness should be smaller as much as possible. A clustering process yielding a valid result can be seen as valid. In the other words, a valid clustering process can produce a valid clustering result. We will exploit these ideas to depict the properties satisfied by a clustering process that produces valid clustering results. Therefore, we develop the relationship between evaluation indices and valid clustering processes as described in Property 1 first.

Property 1. The values of evaluation indices will gradually increase (or decrease) with every iteration in a valid clustering process.

Consider an evaluation index denoting the comparison of separation between clusters and compactness in clusters. We suppose that the larger its value is, the better the clustering effect is. If the value decreases with an iteration of a clustering process, it is obvious that the algorithm to be verified fails to discover the distribution pattern of the dataset effectively. That is, the data do not tend to generate valid clusters with that clustering process. The decreasing index value indicates that the objects within a cluster do not have high similarity to one another and are not very dissimilar to objects in other clusters. Similarly, the indices in which a smaller value indicates a better clustering effect also satisfy this property.

We can now write Definition 3 to define the formula set described by CTL based on Property 1, whose formulas indicate the properties satisfied by valid clustering processes.

Definition 3. If indices and are used to define valid properties, the CTL formula set of properties that valid clustering processes should satisfy is as follows:

1. EF [ converge ∧ handled→maxDunn ∧ minDiam ],
2. E[(DunnUp U maxDunn)]∧ E[(diamDown U minDiam)],

where converge is the atomic formula to judge whether the clustering converges, the atomic formula handled judges whether all objects are disposed of by the algorithm, maxDunn is used to judge whether the dunn index reaches a maximum value, DunnUp is the atomic formula to judge whether the dunn index value increases, diamDown is used to judge whether the diam index value decreases, and the atomic formula minDiam judges whether the diam index reaches a minimum value.

We choose two indices, “Dunn” and “diam”, to define the property formulas in Definition 3. First, based on Property 1, these formulas include both the index increasing with the clustering process and the index decreasing with the clustering process to well reflect the relationship between evaluation indices and valid clustering processes. Secondly, we should choose indices based on lower computational complexity to facilitate the formal verification rather than on partition information. Next, because relative indices can be used to compare different clustering results, they can also be used to compare different iterations in a clustering process. Therefore, the common relative indices “Dunn” and “diam” are more appropriate and sufficient to describe the properties satisfied by a valid clustering process.

We will then analyze these formula semantics in the transition system model that will be used for verifying whether the model satisfies the properties described by CTL formulas with model checking. If the model satisfies the formulas, we can conclude that the corresponding clustering process is valid and, thus, that its clustering result is also valid. The transition system model consists of states and state transition relations that describe a clustering process. The semantics of the formulas in Definition 3 in the transition system model are as follows:

1. M, s| = EF [ converge ∧ handled→maxDunn ∧ minDiam] holds iff. there exists a trace started from state s in M and in some state in the future. When converge and handled are true, maxDunn and minDiam are also true, i.e., when the clustering algorithm converges and all objects are disposed of, the evaluation index Dunn reaches a maximum value, and the compactness in clusters diam reaches a minimum value.
2. M, s| = E[(DunnUp U maxDunn)]∧ E[(diamDown U minDiam)] holds iff. there exists a trace from state s in M satisfying that DunnUp stays true until maxDunn is true and diamDown stays true until minDiam is true, i.e., the value of index Dunn increases gradually until it reaches a maximum value, and the value of diam decreases until it reaches a minimum value.

We then take the same example as Figure 4 to explain these above formulas. Figure 5 presents the specific path of the clustering process in its transition system model, ignoring the “compare” operation because the variable values will not change after this operation. Simultaneously, Figure 5 also indicates atomic proposition DunnUp and diamDown with their truth-values in every state. In this figure, DunnUp starts to be false from state S₅, so we can say that the model does not satisfy the property formula (2) based on its semantic in the transition system. In the next section, we will discuss the method of verifying properties to evaluate the validity of the clustering results and localizing the causes of the unsatisfiability automatically using model checking.

Validity Verification Algorithms with Model Checking

It is expected that a clustering result is valid after the verification algorithm is run. If the result is not valid, we should investigate the causes of the invalid results. We divide these causes into two categories: 1) the allocation makes initial mistakes that go uncorrected until clustering terminates, and 2) the clusters of objects change with the clustering process. We will discuss methods of detecting the latter cause. This section discusses the formal method of verifying the clustering validity such that it can not only detect the validity of a clustering result but can also find and localize the objects causing the invalidity if the clustering process does not satisfy the properties to be verified.

As discussed above, for a valid clustering result, the transition system model describing the behaviors of its clustering process satisfies the properties in the CTL formula set defined above. We then propose the formal verification method as follows. In a model describing a clustering process, using the idea of [33], we check whether there are traces in which formulas describing the properties to be verified are false, i.e., we check by trying to find a counterexample. We can conclude that the model satisfies these properties if there are no such traces, i.e., the corresponding clustering result is valid. If there exist traces T violating the verified properties, the clustering result is invalid. We can further localize the real causes of the violation of the properties by checking the traces C in which the verified properties are true. The causes of the violation of properties can be found by computing T\C, i.e., the causes lie along edges that belong to the error traces T but do not belong to any correct traces C.

Figure 6 shows the procedure of our formal verifying method. If the model does not satisfy the properties to be verified, the cause of the invalidity can be obtained by subtracting the satisfied traces C from the initial detected traces T, as the invalidity may stem from only the iterations corresponding to violated vertices. The above processes are described by Algorithms 1 and 2. We can then use Algorithm 3 to obtain the objects that may influence invalid results from iterations violating properties. Therefore, the formal verifying method can analyze the validity of clustering results and can even localize the causes of invalidity.

The process of verifying clustering validity in the overall structure of our verifying method as shown in Figure 6 is described in Algorithm 1, and the algorithm for obtaining satisfied traces is presented in Algorithm 2. Method modelCheck(G, p) is used to check whether a model G satisfies the property p to be verified, and modelCheck() returns the traces satisfying the property p. We will perform modelCheck() with the model checking idea in [34], which is oriented toward CTL formulas. As mentioned above, an adequate set of temporal connectives in CTL is {AF, EU, EX}, and the corresponding CTL model checking labeling algorithm is based on connectives in this set.

Algorithm 1: validate(G, lf)

Input: G: state transition diagram of transition system;

 lf: set of property formulas satisfied by system model;

Output: real_causes

1. real_causes = ;
2. for i: 1 to do
3.  check : = modelcheck(G , lf.get(i));
4.  if(there is no trace) then
5.   continue;
6.  else
7.   for j: 1 to do
8.    T : = check.get(j);
9.    C : = T.getSatisfyTrace(T, lf.get(i), T.V);
10.    cause : = T – C;
11.    if( cause = ) then
12.     continue;
13.   real_causes + = cause;
    return real_causes;

Based on Algorithm 1, we can conclude that the clustering result is valid only when the model satisfies every formula in the set describing the properties, i.e., the real_cause that is returned from the function is null. Otherwise, traces T can be found by checking formulas describing that the verified properties are false in the model. However, not all of the vertexes in the traces violate the properties, and only the iterations corresponding to violating vertexes (states) may result in the invalidity. Algorithm 2 can localize traces C satisfying the verified properties. Then, the real reason for the violation will be detected by subtracting the traces C from the initial trace T.

Algorithm 2. getSatisfyTrace (G, lfe, V)

Input: G: state transition diagram of transition system;

 lfe: property formula should be satisfied by system model;

 V: set of vertexes in state transition diagram;

Output: transition traces

1. vtList : = {v′ | v′V ∧ v′. lfe = true};
2. visited : = ;
3. transition : = ;
4. while (vtList≠) then
5.  vtList : = vtList – v_j;
6.  if(v_jvisited) then
7.   visited : = visited ∪{v_j};
8.   for each (v_i,v_j)G.E do
9.    vtList : = vtList ∪{v_i};
10.    transition : = transition ∪{(v_i, v_j)};
    return transition;

Algorithm 2 examines the vertexes vtList in vertex set V satisfying the properties in the state space. While the variable vtList is not empty, an element v_j is removed. If it has not been visited before, each vertex v_i such that (v_i,v_j)G.E is added to the vtList. The transition (v_i,v_j) is a correct transition and will be added to the set transition, which is returned from the function.

The complexity of Algorithm 1 largely depends on the complexity of the CTL model checking, whose complexity is linear in both the size of the transition system M and the size of property formulas Φ [35], i.e. O (|M|·|Φ|), in which |M| is depended on the transitions and states in the transition system. The transition system represents the behaviors of a clustering and the clustering process will definitely terminate, thus, the transitions in M will not be excessive. In addition, the states in our transition system correspond to a set of evaluations of variables, so the number of the states is based on the number of variables and their domains. As discussed above, the variable domains are all {0, 1}. Thus, the number of the states will not exceed 2^t·2^k, where t and k is number of the atomic propositions and the number of the clusters respectively. Usually t is very small, so 2^t can be seen as a constant. When k is small, the exponential factor of the number will be tolerable. Therefore, the formal method of verifying the validity of clustering results based on model checking will be practical. Once the number of clusters is large enough to make the states grow exponentially, there have been some methods to reduce the states, such as symbolic model checking which can handle more than 10²⁰ states, and its various refinement have pushed the state count up to more than 10¹²⁰ [36], so its implication could not be evident.

We then take the example in Figure 5 to illustrate the operation of Algorithms 1 and 2. As mentioned above, a valid clustering process should satisfy the following properties: EF[converge ∧ handled→maxDunn ∧ minDiam], E[(DunnUp U maxDunn) ∧ (diamDown U minDiam)]. According to Algorithm 1, there are vertices whose corresponding formulas are false in the model, and we can obtain the initial trace T = (S₁, S₂, S₃, S₄, S₅, S₆, S₇, S₈). We then obtain a sub-trace C that satisfies properties based on Algorithm 2, i.e., C = (S₁, S₂, S₃, S₄). Therefore, an error trace not satisfying these properties can be obtained by subtracting trace C from the initial trace T: (S₅, S₆, S₇, S₈). Obviously, the index Dunn value does not increase gradually until it reaches a maximum value, and it starts to decrease from vertex S₅. Therefore, it fails to discover the distribution pattern of this dataset effectively starting from this iteration. We conclude that this clustering process is invalid; accordingly, the corresponding clustering result is not valid.

Algorithms 1 and 2 check whether the model describing a clustering process satisfies the verified properties to analyze the validity of clustering. Furthermore, they can detect the iterations that may cause the invalidity by analyzing counterexamples. However, if we want to detect which specific objects in some iteration caused this invalidity, we should further analyze the iterations detected by the above algorithms. As mentioned in section 2, the steps in each iteration consist of comparing distances between objects and assigning objects to proper clusters. In addition, clustering is an unsupervised machine learning method, so we can analyze the correctness of the distance metric only by comparing any two adjacent assignment iterations. Furthermore, there are objects whose clusters have changed with the iterations of the clustering process, and the change is not favorable to discovering the distribution pattern of the dataset. Thus, the trend of the index value between iterations is abnormal.

Therefore, Algorithm 3 compares the iterations violating the predefined properties with their next iteration and finally returns the objects in some iteration most likely resulting in invalid clustering. First, the algorithm obtains objects whose clusters change compared with the assignment of the previous iteration as objectSet. If the trend of index values is normal in the next iteration (i.e., the properties to be verified in the next vertex are true), objects remaining in their clusters in the next iteration can be removed from the objectSet because the cluster changes of these objects are beneficial to discovering the distribution pattern of the data. Once the trend of index values is abnormal in the next iteration (i.e., the properties to be verified in the next vertex are false) and the next iteration is not the last one, objects obtained by the recursive invocation of Algorithm 3 are added to the objectSet; if the next iteration is the last one, new objects whose clusters will be changed when checked by the next iteration are added to the objectSet.

Algorithm 3. checkIteration(successor, descend)

Input: successor: set of subsequent iterations;

 descend: the trend of index value is normal or not;

Output: objectSet: set of objects leading to the invalidity;

1. objectSet : = getChangeObj();
2. if (descend =  = true) then // trend of index values is normal in subsequent iteration;
3.  nextSuccessor : = getNextIteration();
4.  while (objectSet is not null) do
5.   if(object of objectSet is not changed in nextSuccessor) then
6.    objectSet : = objectSet – object;
7. else then // trend of index values is abnormal in subsequent iteration;
8.  nextSuccessor : = getNextIteration();
9.  if(nextSuccessor <>) then // next iteration is not the last iteration
10.   trend : = getNextTrend();
11.   nextobjSet: = checkIteration(nextSuccessor, trend);
12.   objectSet : = objectSet+nextObjSet;
13.  else then // next iteration is the last iteration
14.   if(object in nextSuccessor not in objectSet) then
15.    objectSet : = objectSet+object;
    return objectSet;

The getChangeObj() method obtains objects whose clusters have changed compared with the previous iteration (corresponding to the vertex), while the getNextIteration() method obtains the assignment of the next iteration. This algorithm compares the assignment difference of objects between iterations, so its time complexity is , where r is the number of iterations checked from the current one, and n is the number of objects.