Figures
Abstract
Insights gained from multilevel computational models of biological systems can be translated into reallife applications only if the model correctness has been verified first. One of the most frequently employed in silico techniques for computational model verification is model checking. Traditional model checking approaches only consider the evolution of numeric values, such as concentrations, over time and are appropriate for computational models of small scale systems (e.g. intracellular networks). However for gaining a systems level understanding of how biological organisms function it is essential to consider more complex large scale biological systems (e.g. organs). Verifying computational models of such systems requires capturing both how numeric values and properties of (emergent) spatial structures (e.g. area of multicellular population) change over time and across multiple levels of organization, which are not considered by existing model checking approaches. To address this limitation we have developed a novel approximate probabilistic multiscale spatiotemporal meta model checking methodology for verifying multilevel computational models relative to specifications describing the desired/expected system behaviour. The methodology is generic and supports computational models encoded using various highlevel modelling formalisms because it is defined relative to time series data and not the models used to generate it. In addition, the methodology can be automatically adapted to case study specific types of spatial structures and properties using the spatiotemporal meta model checking concept. To automate the computational model verification process we have implemented the model checking approach in the software tool Mule (http://mule.modelchecking.org). Its applicability is illustrated against four systems biology computational models previously published in the literature encoding the rat cardiovascular system dynamics, the uterine contractions of labour, the Xenopus laevis cell cycle and the acute inflammation of the gut and lung. Our methodology and software will enable computational biologists to efficiently develop reliable multilevel computational models of biological systems.
Citation: Pârvu O, Gilbert D (2016) A Novel Method to Verify Multilevel Computational Models of Biological Systems Using Multiscale SpatioTemporal Meta Model Checking. PLoS ONE 11(5): e0154847. https://doi.org/10.1371/journal.pone.0154847
Editor: Attila CsikászNagy, King’s College London, UNITED KINGDOM
Received: June 21, 2015; Accepted: April 20, 2016; Published: May 17, 2016
Copyright: © 2016 Pârvu, Gilbert. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All relevant data are within the paper and its Supporting Information files.
Funding: The authors received no specific funding for this work.
Competing interests: The authors have declared that no competing interests exist.
Introduction
Multilevel computational models of complex biological systems are abstract representations of living systems that span multiple levels of organization. They encode the hierarchical organization of biological systems explicitly, and therefore enable reasoning about how events initiated at one level of organization reflect across multiple levels of organization. In systems biology [1, 2] multilevel, also commonly referred to as multiscale [3] computational models can be employed for gaining a better understanding of the underlying mechanisms of living systems, and to generate new hypotheses for driving experimental studies. Conversely in systems medicine it is argued [4] that multilevel computational models could potentially facilitate delivering personalized treatments by providing a patient specific understanding of how diseases and their treatment reflect across multiple levels of organization [5].
However any insights gained from model simulation results can be successfully translated into reallife applications only if the correctness of the models has been verified first. Computational models of biological systems can be validated either in the in vitro environment by checking if the model simulation results can be reproduced experimentally, or in the in silico environment by verifying if the model simulation results conform to a formal specification describing the desired/expected system behaviour. An in silico approach that automates the process of verifying models relative to formal specifications is called model checking [6, 7]; see S1 Text for a brief description of model checking. Due to the complex, stochastic nature of biological systems only approximate probabilistic model checking approaches are considered throughout this paper.
Validating multilevel computational models in the in vitro environment is challenging because there is a need for experimental data from all levels of organization and the interactions between different levels, which is often not available. Moreover in vitro validation procedures need to account for the variability inherent in biological systems [8, 9] which can be of different orders of magnitude at different levels. Conversely, verifying multilevel computational models in the in silico environment is challenging because there is a lack of model checking approaches that can explicitly distinguish between different levels of organization. Existing model checking approaches can be employed to verify submodels corresponding to each level of organization individually without the possibility of referring to interactions between different levels.
In this paper we address this issue by developing a novel multiscale model checking methodology for automatically verifying multilevel computational models relative to given specifications. Our approach is generic and supports computational models encoded using various highlevel modelling formalisms because it is defined relative to time series data representing the model simulation results and not the models themselves. Moreover our methodology could be potentially employed for analysing time series data recorded in the wetlab as well. This could enable checking if a computational model correctly describes a physical system, or that a physical system correctly implements an in silico design, but this is beyond the scope of this paper.
Both spatial and nonspatial computational models can be verified using our approach. The specifications against which the computational models are verified can describe both how numeric values (e.g. concentration of protein X) and properties of (emergent) spatial structures, called spatial entities, (e.g. area of multicellular population) are expected to change over time and across multiple levels of organization. For instance, assuming we would like to verify a computational model describing tumour growth, the specification could state that if the concentration of protein X in a cancerous cell rises above a certain threshold level (e.g. 0.8 M), then the cell will divide and the cellular density or area of the tumour (structure) will increase.
Assuming that the computational model considered is spatial, the type of spatial entities and their properties, called spatial measures, can differ between case studies. For instance given a tumour growth computational model one could be potentially interested in how the area of the tumour structure changes over time, whereas in case of a migrating multicellular population tracking the position of the population over time could be of interest.
We defined an abstraction of our approach, called multiscale spatiotemporal meta model checking that enables the automatic reconfiguration of the model checking methodology according to case study specific spatial entity types and measures. The spatiotemporal meta model checking approach resembles the metaprogramming [10] concept from computer science where an abstract type is defined that acts as a template for creating specific type instances tailored to particular applications. Our spatiotemporal meta model checking approach is not restricted to biologically relevant spatial entity types and properties, and therefore could be employed to adapt the methodology to case studies from other fields of science. However we do not illustrate this in this paper. Due to the intended general applicability of the approach, and the fact that hierarchical systems in multiple domains of science (e.g. astrophysics, energy, engineering, environmental science and materials science [11]) are commonly referred to as multiscale, our approach is called multiscale rather than multilevel spatiotemporal meta model checking.
To enable the automatic verification of multilevel computational models of biological systems relative to formal specifications we have implemented the model checking method in the software tool Mule which is made freely available online (http://mule.modelchecking.org) in binary and source code format. Moreover a Docker [12] image has been created that provides a selfcontained environment for running Mule without additional setup on all major operating systems.
We illustrate the applicability of Mule by verifying the correctness of four multilevel computational models previously published in the literature. The models considered are of different complexity, have been encoded using different modelling formalisms and software, are deterministic, stochastic or hybrid, and encode space explicitly or not. The case studies corresponding to the four multilevel computational models are the rat cardiovascular system dynamics [13], the uterine contractions of labour [14], the Xenopus laevis cell cycle [15], and the acute inflammation of the gut and lung [16]. The formal specifications against which the models are verified were derived from the original papers introducing the models. The main reason for this is that in the following we focus on describing the model verification methodology and not on presenting novel biologically relevant results.
In brief, the main contributions of our paper are:
 Definition of a multiscale spatiotemporal model checking methodology for verifying multilevel computational models of biological systems relative to formal specifications describing the desired/expected system behaviour.
 Definition of the spatiotemporal meta model checking concept which enables automatically reconfiguring the methodology according to case study specific spatial entity types and measures.
 Implementation of the multiscale spatiotemporal meta model checking approach in the freely available software Mule. Both Bayesian and frequentist model checking algorithms can be employed to verify multilevel computational models (considering userdefined error bounds).
 Illustrative examples of how to verify multilevel computational models of biological systems using multiscale spatiotemporal meta model checking.
Related work
In computational (systems) biology, model checking approaches have been employed for model verification [17–32], parameter estimation/synthesis [33–42], model construction (i.e. both model parameters and structure/topology) [43, 44], and robustness computation (considering various perturbations) [39, 44–47]; see recent review papers [48–50] for a more detailed description.
One common characteristic of these model checking approaches is that they only consider how numeric values (e.g. concentrations) change over time. They are appropriate for small scale systems where the spatial domain is usually not represented explicitly (e.g. cell cycle [23, 27, 32, 36, 44, 46, 51], gene expression/regulatory networks [20, 35, 39, 52, 53], signalling pathways [17, 22, 25, 28–30, 38, 46, 54–56]). These model checking approaches cannot be directly employed to verify either spatial computational models because they do not consider how spatial properties change over time, or multilevel computational models because they do not distinguish between different levels of organization.
In previous work [57] we have defined a model checking methodology which enables verifying computational models of biological systems with respect to both how numeric values and spatial properties change over time. However the main limitation of this approach is that it cannot explicitly distinguish between different levels of organization and therefore cannot be employed to verify multilevel computational models of biological systems. Moreover the types of spatial entities and measures are hardcoded in the methodology and cannot be reconfigured according to the model verification requirements of different case studies.
Methods
Using the novel model checking approach introduced in this paper multilevel computational models of biological systems can be verified relative to formal specifications as described by the workflow depicted in Fig 1, which comprises four steps:
 Model construction: Using biological observations and/or relevant references from the literature to construct the computational model.
 Multiscale spatiotemporal analysis: Each time the model is simulated time series data are generated in which spatial entities from multiple scales are automatically detected and analysed.
 Formal specification: The specification of the system is mapped from natural language into formal logic.
 Model checking: The model checker takes as input the processed time series data (representing the behaviour of the modelled system) and the formal specification, and verifies if the model is correct relative to the specification using the model checking algorithm chosen by the user (e.g. frequentist statistical model checking). In the case that the model is incorrect it is updated and verified again.
The first step (1) in the workflow is using biological observations and/or information from the literature to construct the multilevel computational model of the biological system considered. Next (2) the model is simulated to produce time series data in which spatial entities from multiple scales are automatically detected and analysed using a multiscale spatiotemporal analysis module. Then (3) the specification against which the model is verified is translated from natural language to a formal multiscale spatiotemporal language called PBLMSTL. Finally (4) using the model checker Mule the model is automatically verified relative to the given PBLMSTL specification considering the processed time series data representing the modelled system behaviour. If the model is declared incorrect relative to the given specification then it is updated and the steps (2) and (4) are repeated.
Model construction
The biological systems considered here are assumed to be inherently complex, stochastic, and to span multiple levels of organization [58], where different levels of organization correspond to different spatiotemporal scales. Moreover we assume in the following that biological systems which are multilevel (i.e. span multiple levels of biological organization) are inherently multiscale (i.e. span multiple spatiotemporal scales). Therefore the terms multiscale and multilevel are used interchangeably in this paper. However, since our methodology is “multiscale” instead of “multilevel” we will refer to “scales” rather than “levels” when describing it. The multiscale system representation is assumed to be hierarchical, with the most coarsegrained scales represented at the top of the hierarchy and the most finegrained scales at the bottom. Time can be represented either in a discrete (using nonnegative integer values) or continuous (using nonnegative real values) manner. Whenever space is represented explicitly, we assume throughout, similarly to our previous work [57], that it is discretised and represented in pseudo3D i.e. 2D space in which pile up is allowed, where the degree of pile up for each spatial position is computed using a density measure (e.g. representing cellular density). However adapting the methodology to other numbers of spatial dimensions requires minor changes which are described later. Furthermore we consider that the behaviour of such systems can be represented as sequences of discrete states where the system probabilistically transitions between states only when an event (e.g. a biochemical reaction) occurs.
Such systems are usually represented using highlevel modelling languages (e.g. agent based models, cellular automata etc.), examples of which are given in the Results section. However, for model checking purposes, the behaviour of the computational models is usually described using an equivalent low level representation (e.g. a state transition system). The main reason for this is to enable defining the model checking algorithms relative to a single common rather than multiple different model representations.
Low level modelling formalisms often employed to encode systems that have the above mentioned properties are stochastic discreteevent systems (SDES) [59] when no constraint is imposed on the representation of time, respectively discretetime/continuoustime Markov chains (DTMC/CTMC) when time is assumed to be discrete/continuous. One limitation of SDESs (and DTMCs/CTMCs) is that they do not explicitly distinguish between how numeric and spatial properties of the system change over time and across multiple scales. An extension of SDESs called stochastic spatial discreteevent systems (SSpDES) was defined in [57] to enable explicitly differentiating between numeric and spatial properties. However, similarly to SDESs, SSpDESs do not enable distinguishing between different scales.
In order to address this issue a multiscale extension of SSpDESs called Multiscale Stochastic Spatial Discrete Event Systems, or MSSpDES for short, is defined next. Formally an MSSpDES is a 9tuple 〈S, T, μ, NSV, SpSV, NV, CSpV, MA, SVSS〉 where:
 S = {s_{0}, s_{1}, …, s_{k}} is the set containing all possible states of the system.
 T is the set representing time and it is typically equal to the set of nonnegative integer numbers in case of a discretetime representation (i.e. T = ℤ_{+}), respectively the set of nonnegative real numbers in case of a continuoustime representation (i.e. T = ℝ_{+}).
 μ is a probability measure employed to compute the probability of the system to transition along the sequences of states described by a collection of model simulation traces. In case of biological systems it is often assumed that the Markov (memoryless) property holds i.e. the probability of the systems to transition between states depends only on the current and not on previous states. Considering this assumption, if a discretetime representation is employed then μ is defined similarly as for DTMCs [60] relative to a transition probability function P: S × S → [0, 1] which records the probability of transitioning between any two states s_{i}, s_{j} ∈ S. Conversely, if a continuoustime representation is employed then μ is defined similarly as for CTMCs [61] considering a transition rate matrix Q: S × S → ℝ which records the rate at which a system transitions between any two states s_{i}, s_{j} ∈ S and from which the corresponding state transition probabilities can be derived.
 NSV = {nsv_{1}, nsv_{2}, …, nsv_{l}} is the set of numeric state variables describing the state of the system.
 SpSV = {spsv_{1}, spsv_{2}, …, spsv_{m}} is the set of spatial state variables describing the state of the system.
 NV: S × NSV → ℝ is the numeric value assignment function employed to compute for a given state of the system s ∈ S the value val_{NSV} ∈ ℝ of the numeric state variable nsv ∈ NSV, where val_{NSV} = NV(s, nsv).
 CSpV = {SpV_{1}, SpV_{2}, …, SpV_{n}} is the collection of spatial value assignment functions, where each spatial value assignment function SpV_{i} ∈ CSpV, , is employed to compute for a given state of the system s ∈ S the value of spatial state variable spsv ∈ SpSV that corresponds to a discretised spatial domain of size m_{i} × n_{i}, where val_{SpSV} = SpV_{i}(s, spsv).
 MA = (V_{MA}, E_{MA}) is the multiscale architecture graph encoding the hierarchical multiscale structure of the system under consideration.
 SVSS: NSV ∪ SpSV → V_{MA} is the state variable scale and subsystem assignment function which associates each state variable sv ∈ NSV ∪ SpSV with a vertex v_{scsubsys} ∈ V_{MA} encoding a particular scale and subsystem, where v_{scsubsys} = SVSS(sv).
The multiscale architecture graph MA = (V_{MA}, E_{MA}) is employed to formally encode the hierarchical topdown structure of multiscale systems and is represented as a rooted (directed) tree, where V_{MA} represents the set of vertices and E_{MA} the set of directed edges. The main reason for choosing the rooted directed tree representation is that its structure is inherently hierarchical and therefore similar to the organization of biological organisms. We assume throughout that vertices higher in the tree correspond to coarsegrained scales, and vertices lower in the tree correspond to finegrained scales. Each vertex v ∈ V_{MA} is encoded as a tuple (sc, subsys) where subsys represents a particular biological subsystem (e.g. heart) and sc its corresponding scale (e.g. organ). Both scales and subsystems are recorded by the MA graph to enable distinguishing between different scales (e.g. organ and cellular), and/or different subsystems (e.g. heart and liver) corresponding to the same scale (e.g. organ). Directed edges (v, v_{i}) ∈ E_{MA}, , link the biological subsystem represented by vertex v to all its m constituent subsystems from finergrained scales represented by vertices v_{i}.
The assumption made here is that biological systems can be decomposed in a topdown manner from coarsegrained (e.g. population/organism) to finegrained (e.g. intracellular/molecular) scales. Moreover at each scale (e.g. organ) one or multiple biological subsystems (e.g. heart and kidney) could be explicitly considered. The number and type of biological subsystems and/or scales considered differs depending on the biological question addressed. A description of how to construct the MA graph corresponding to a given biological system is given in S2 Text.
Considering that the MA graph is represented as a rooted directed tree, a strict partial order < can be defined over the set of vertices V_{MA}, where v_{1} < v_{2}, for all v_{1}, v_{2} ∈ V_{MA}, if the unique path from the root to v_{1} passes through v_{2}. Similarly a nonstrict partial order ≤ can be defined over V_{MA}, where v_{1} ≤ v_{2} if the unique path from the root to v_{1} passes through v_{2}, or v_{1} = v_{2}. One of the main practical benefits of defining these partial orders is that they enable writing expressions for referring to all subsystems v_{i} of a system v_{j} (v_{i} ≤ v_{j}), and all ancestor/parent systems v_{k} of a subsystem v_{l} (v_{l} < v_{k}) in a concise manner. Therefore such expressions could be employed to write shorter formal specifications against which the computational models are verified.
A simple illustrative example of how to construct a (discretetime) MSSpDES model for a biological system spanning multiple levels of organization is given below.
Example 1 Simple illustrative example of how to construct an MSSpDES model.
Let us assume that we would like to model the movement (considering the von Neumann neighbourhood relation) of a unicellular microorganism in a fixed size environment (here a discretised rectangular grid of size 2 × 2). In order to move, the cell requires energy which it can chemically convert from an abstractly denoted nutrient A; the chemical reaction for converting A to energy is A → Energy. If nutrient A is available intracellularly then it can be converted directly to energy. Otherwise it has to be assimilated from the environment first; the cell can only assimilate nutrients from the position of the discretised space which it currently occupies. The probability of the cell to move is 20%, respectively 30% to convert A to energy and 50% to assimilate A from the environment.
Although the system considered in this example is much simpler than a reallife one, it suffices to illustrate the principles of abstractly representing a multiscale stochastic spatial discreteevent system. Throughout this example a discrete time representation is employed.
The spatial state variables employed to describe the behaviour of the system are Cell—encoding the position of the cell in the discretised space, and A_extracellular—representing the distribution of nutrient A in the environment. Conversely the employed numeric state variables are A_intracellular—encoding the intracellular availability of nutrient A, and Energy—representing the cell’s energy supply. The considered subsystems and corresponding scales are energy production reaction network at the intracellular scale, microorganism at the cellular scale, and growth media at the environment scale. State variables associated with the energy production reaction network (intracellular scale) are A_intracellular and Energy, respectively Cell with the microorganism (cellular scale), and A_extracellular with the growth media (environment scale). In the initial state (S_{0}) of the system, depicted in Fig 2, the cell is positioned in the lower right part of the environment, A_extracellular is uniformly distributed across the entire environment (A_extracellular[i, j] = 1, for all ), and the initial levels of A_intracellular and Energy are zero.
Cell and A_extracellular are the spatial state variables representing the position of the cell, respectively distribution of nutrient A in the environment. A_intracellular and Energy represent the intracellular availability of nutrient A, respectively energy.
Starting from the initial state S_{0} the system can (in)directly transition to any of the states depicted in Fig 3.
Cell and A_extracellular are the spatial state variables representing the position of the cell, respectively distribution of nutrient A in the environment. A_intracellular and Energy represent the intracellular availability of nutrient A, respectively energy. The percentage associated with the arrows connecting each pair of states represents the probability of transitioning from one state to the other.
Given that in S_{0} the cell has no supplies of intracellular nutrient A or energy, the only possible action is for it to assimilate A from its environment (S_{0} → S_{1}, probability 100%). Since only one supply of nutrient A is available the only possible next action is to convert the newly gained intracellular A supply to energy (S_{1} → S_{2}, probability 100%). Once a supply of energy is available the cell can move either above (S_{2} → S_{4}) or to its left (S_{2} → S_{3}). The probability of moving to either of the neighbouring positions is therefore equal to 100% / 2 = 50%. Continuing from either state S_{3} or S_{4} the cell will try to assimilate new A nutrient supplies, which can be converted to energy and then used to move in the environment. This process is repeated multiple times until the cell reaches a state in which it has no A nutrients available extracellularly/intracellularly, respectively no supplies of energy (i.e. S_{10}, S_{11}, S_{18}, S_{19}, S_{25}, S_{26}). In such cases the cell becomes dormant and the system reaches its final state.
Using the notations above we formally define the corresponding MSSpDES model and (state) transition probability function P as follows:

= 〈S, T, μ, NSV, SpSV, NV, CSpV, MA, SVSS〉, where:
 S = {S_{0}, S_{1}, S_{2}, S_{3}, S_{4}, S_{5}, S_{6}, S_{7}, S_{8}, S_{9}, S_{10}, S_{11}, S_{12}, S_{13}, S_{14}, S_{15}, S_{16}, S_{17}, S_{18}, S_{19}, S_{20}, S_{21}, S_{22}, S_{23}, S_{24}, S_{25}, S_{26}}.
 T = ℤ_{+} is the set representing time.
 μ is the function used to compute the probability associated with a set of paths Paths(S_{0}) starting from S_{0} having a common finite prefix σ_{finite} = {s_{0}, s_{1}, …, s_{n}}, which means that for all σ ∈ Paths(S_{0}), , where σ[i] denotes the ith state in σ. The probability value corresponding to Paths(S_{0}) is computed by multiplying the probabilities of the state transitions associated with the common finite path prefix σ_{finite}. For instance given the finite state sequence σ_{finite} = {S_{0}, S_{1}, S_{2}, S_{3}, S_{5}, S_{7}, S_{10}}, μ({σ ∈ Paths(S_{0})  σ[i] = σ_{finite}[i], 0 ≤ i ≤ 6}) = P(S_{0}, S_{1}) ⋅ P(S_{1}, S_{2}) ⋅ P(S_{2}, S_{3}) ⋅ P(S_{3}, S_{5}) ⋅ P(S_{5}, S_{7}) ⋅ P(S_{7}, S_{10}), where the probability values P(S_{i}, S_{j}) with S_{i}, S_{j} ∈ S are recorded by the transition probability function P provided below.
 NSV = {A_intracellular,Energy}, and NV is the function used to compute the value of A_intracellular and Energy in a given state of a computation path. The values of the numeric state variables for each state (e.g. NV(S_{0}, Energy) = 0) are depicted in Fig 3 and therefore will not be explicitly restated here.
 SpSV = {Cell, A_extracellular}, and CSpV = {SpV} is the collection containing the spatial value assignment function SpV used to evaluate Cell and A_extracellular in a given state of a computation path. The values of the spatial state variables for each state (e.g. SpV(S_{0},Cell) = [0, 0;0, 1]) are depicted in Fig 3 and therefore will not be explicitly restated here.
 MA is the multiscale architecture graph depicted in Fig 4 encoding the hierarchical organization of the considered subsystems, namely the growth media (environment scale), the microorganism (cellular scale) and the energy production reaction network (intracellular scale).
 SVSS is the state variable scale and subsystem assignment function which associates state variables to particular subsystems encoded as vertices in the MA graph. The values returned by SVSS for the considered state variables are: SVSS(A_intracellular) = (Intracellular, EnergyProductionReactionNetwork), SVSS(Energy) = (Intracellular, EnergyProductionReactionNetwork), SVSS(Cell) = (Cellular, Microorganism), and SVSS(A_extracellular) = (Environment, GrowthMedia).
 P is the transition probability function which records the probability of transitioning between any two states of the system s_{i}, s_{j} ∈ S. Due to page size constraints it is not possible to represent P explicitly. Instead only its nonzero entries are given below: P(S_{0}, S_{1}) = 100%, P(S_{1}, S_{2}) = 100%, P(S_{2}, S_{3}) = 50%, P(S_{2}, S_{4}) = 50%, P(S_{3}, S_{5}) = 100%, P(S_{4}, S_{6}) = 100%, P(S_{5}, S_{7}) = 100%, P(S_{6}, S_{8}) = 100%, P(S_{7}, S_{9}) = 50%, P(S_{7}, S_{10}) = 50%, P(S_{8}, S_{11}) = 50%, P(S_{8}, S_{12}) = 50%, P(S_{9}, S_{13}) = 100%, P(S_{12}, S_{14}) = 100%, P(S_{13}, S_{15}) = 100%, P(S_{14}, S_{16}) = 100%, P(S_{15}, S_{17}) = 50%, P(S_{15}, S_{18}) = 50%, P(S_{16}, S_{19}) = 50%, P(S_{16}, S_{20}) = 50%, P(S_{17}, S_{21}) = 100%, P(S_{20}, S_{22}) = 100%, P(S_{21}, S_{23}) = 100%, P(S_{22}, S_{24}) = 100%, P(S_{23}, S_{25}) = 50%, P(S_{23}, S_{26}) = 50%, P(S_{24}, S_{25}) = 50%, P(S_{24}, S_{26}) = 50%.
Each vertex in the graph (e.g. (Environment, GrowthMedia)) corresponds to a subsystem (e.g. growth media) and its associated scale (e.g. environment). Directed edges between vertices (e.g. ((Environment, GrowthMedia), (Cellular, Microorganism))) indicate how one subsystem from a coarsegrained scale (e.g. (Environment, GrowthMedia)) can be decomposed in one or multiple subsystems from more finegrained scales (e.g. (Cellular, Microorganism)).
In spite of the simplicity of the scenario described above the same model development principles apply to more complex multiscale reallife systems. However due to the inherent complexity of such systems the size of the state space is expected to be larger.
The main reason for encoding multiscale stochastic biological systems using a lowlevel modelling formalism such as MSSpDES is to enable our model checking approach to be employed for the general class of SDESs, which MSSpDESs extend, instead of restricting it to a particular highlevel modelling formalism.
Although MSSpDES models are restricted to a twodimensional spatial representation (see codomain of spatial value assignment functions SpV_{i} ∈ CSpV), extending the models from a two to, for instance threedimensional spatial representation, requires only replacing the codomain of each SpV_{i} ∈ CSpV with .
MSSpDESs are multiscale extensions of SSpDESs 〈S, Tr, μ, NSV, SpSV, NV, SpV〉, where the semantics of S, μ, NSV, SpSV and NV is preserved, the transition rates matrix Tr was replaced by the set T representing time and the state transition probabilities are defined by a transition probability function P for discretetime systems, respectively are derived from a transition rates matrix Q for continuoustime systems. The single spatial value assignment function SpV in an SSpDES is replaced by CSpV, the MA graph is defined to explicitly encode the hierarchical representation of the systems under consideration, and SVSS is introduced to associate state variables with particular scales and subsystems encoded as vertices in the MA graph. The main advantage of defining MSSpDESs as extensions of SSpDESs is backwards compatibility. SSpDESs can be encoded as MSSpDESs where the set T and probability measure μ are defined accordingly, CSpV contains a single element SpV, and the MA graph contains only one vertex to which all state variables are assigned using SVSS. Due to this, multiple SSpDESs employing the same representation of time can be easily integrated into a single MSSpDES by defining the set T and probability measure μ accordingly, gathering all spatial value assignment functions SpV into a single collection, constructing a corresponding MA graph, mapping state variables to appropriate vertices in the graph and adding interactions between submodels.
Multiscale spatiotemporal analysis
Detection and analysis of spatial entities.
Let us denote execution traces (or time series data) generated by MSSpDES models as σ = {(s_{0}, t_{0}), (s_{1}, t_{1}), …}, where s_{0}, s_{1}, … represent the states of the execution trace and t_{0}, t_{1}, … the time durations spent in each corresponding state. Typically in case of a continuoustime representation the time durations are represented by nonnegative real values t_{0}, t_{1}, … ∈ ℝ_{+}, whereas in case of a discretetime representation by nonnegative integer values t_{0}, t_{1}, … ∈ ℤ_{+}.
Given an execution trace σ = {(s_{0}, t_{0}), (s_{1}, t_{1}), …}, a numeric state variable nsv and a spatial state variable spsv, it is possible to reason about how the values of nsv and spsv change over time by evaluating them for each state in σ using NV(s_{0}, nsv), NV(s_{1}, nsv), …, respectively SpV(s_{0}, spsv), SpV(s_{1}, spsv), …. Although the sequence SpV(s_{0}, spsv), SpV(s_{1}, spsv), … describes how the entire discretised spatial domain corresponding to spsv changes over time, we are interested in reasoning about how emergent spatial structures, called spatial entities, identified by subsets of positions in DSD change over time. For instance assuming that spsv records the cellular density in a 2D environment DSD and that we would like to reason about spatial entities denoting multicellular populations, then only the subsets comprising at least x (e.g. x = 20) neighbouring positions in DSD having the cellular density value greater than 0 would be considered. To reason about such spatial entities there is a need for an additional processing step which automatically detects and analyses how the spatial entities change over time.
This processing step is denoted as the multiscale spatiotemporal analysis and its associated workflow is depicted in Fig 5. The first step in the workflow is to split up the time series data corresponding to all spatial state variables such that each resulting time subseries corresponds to a single subsystem and scale. Next each time subseries is passed to a uniscale spatiotemporal analysis module which automatically detects, analyses and annotates spatial entities with their corresponding scale and subsystem. Finally, during the last step the collections of detected spatial entities are merged such that spatial entities corresponding to the same time point are grouped together.
An MSSpDES model of the system under consideration is constructed and simulated to generate time series data. This time series data is split up into subsets (1) such that each subset corresponds to a single subsystem and scale. The time series data subsets are passed to a uniscale spatiotemporal analysis module (2) which automatically detects, analyses and annotates spatial entities with their corresponding scale and subsystem. The results of the uniscale spatiotemporal analysis are then merged (3) such that spatial entities corresponding to the same time point are grouped together. If more simulations are required, a new time series dataset is generated, for which steps (1)–(3) are repeated.
The uniscale spatiotemporal analysis module assumes that the problem of detecting and analysing spatial entities at a given time point is transformed into an image processing problem. This transformation is possible because the spatial domain is assumed to be discretised and (the value of) each position in the discretised space can be mapped to (the intensity of) a pixel in an image. One of the main advantages of this is that existing image processing approaches for detecting and analysing objects in images can be directly reused.
We define parameterized detection and analysis modules for two generic types of spatial entities, namely regions and clusters [57].
Regions represent subsets of neighbouring positions in the discretised space (considering the Moore neighbourhood relation) with associated values (e.g. concentrations) above a userdefined threshold. For instance considering a computational model that encodes the evolution of a population of cells in a 2D environment, regions could represent patches of neighbouring cells where the cellular density is greater than a userdefined value. More formally a region R is defined with respect to a state s and spatial state variable spsv as a subset (i.e. positions of the discretised space included in R are marked with 1, all others with 0) of neighbouring positions in Sp V(s,spsv) such that for all positions of the discretised space (i, j) ∈ R marked with 1, the corresponding value Sp V(s, spsv)[i, j] ≥ THRESHOLD, and the number of positions included in R is greater than ϵ_{size}, where THRESHOLD ∈ ℝ, ϵ_{size} ∈ ℕ are userdefined parameters. The module for detecting and analysing regions is an implementation of Algorithm 1 in [57] using image processing functions from the open source Computer Vision library OpenCV [62].
Conversely clusters represent subsets of neighbouring regions in the discretised space where the maximum distance between two neighbouring regions is bounded above by a userdefined threshold. For instance considering again the computational model encoding the evolution of a population of cells, clusters could represent groups of patches of cells where the distance between neighbouring patches is less or equal to a userdefined threshold value. Clusters are computed using an improved version of the DBSCAN algorithm [63]. The output of this algorithm depends on the given set of regions REG, the pseudometric d used to compute the distance between any two regions in REG, the maximum distance ϵ_{distance} between two neighbouring regions, and the minimum number of regions ϵ_{size} neighbouring a core region, where a region is denoted as core if its number of neighbouring regions is greater or equal to ϵ_{size}. The pseudometric d considered here is defined with respect to a set of regions REG, d: REG × REG → ℝ_{+}, , where (x_{A}, y_{A}) and (x_{B}, y_{B}) are the centroids of regions A, respectively B. Moreover two regions REG_{1}, REG_{n} ∈ REG are called densityreachable if there exists a sequence of regions REG_{1}, REG_{2}, …, REG_{n} ∈ REG, where i ≥ 1 and n ≥ 2 such that for all i < n, REG_{i} is a core region, and REG_{i+1} is a neighbour of REG_{i}. Using the notations above a cluster C is defined as a maximal subset (i.e. regions’ positions included in C are marked with 1, all others with 0) of the given set of regions REG = {REG_{1}, REG_{2}, …, REG_{p}} such that all regions in C are densityreachable from an arbitrary core region of C [63].
Each detected region/cluster is characterized by a set of general quantitative spatial measures that enable describing how the spatial entity changes over time. A description of the set of spatial measures considered is given in Table 1.
The spatial entity types and measures were chosen relative to the case studies considered here. Therefore depending on case study specific requirements different sets of spatial entity types and/or measures may need to be employed. For instance, extending the spatial representation from two to three dimensions requires employing appropriate types of spatial entities (e.g. 3D structure) and measures (e.g. volume), and updating the multiscale spatiotemporal analysis module (implementation) accordingly. Moreover (the value corresponding to) each position in the discretised space is mapped to (the intensity of) a voxel, rather than a pixel in an image. The model checking approach is adapted automatically to different spatial entity types and/or measures using the spatiotemporal meta model checking concept described later.
The output of the multiscale spatiotemporal analysis is time series data describing how the values of the spatial measures considered change over time for each detected spatial entity, scale and subsystem.
Multiscale Spatial Temporal Markup Language.
The MSSpDES model simulation results are represented by time series data produced by the multiscale spatiotemporal analysis and time series data describing the evolution over time of numeric state variables values.
To represent these model simulation results in a uniform manner which facilitates exchange of data sets and integration of software tools a corresponding standard data representation format is required. To the best of our knowledge such a standard data representation format does not exist.
One of the main requirements for the data representation format is that it supports recording different numbers of values at different time points because the collection of (emergent) spatial entities considered could potentially change over time. Traditional tabular (e.g. csv) representation formats are not suitable because they assume that the number of recorded values (or columns) is constant throughout the entire time series. Moreover defining a representation format similar to csv that does not annotate numeric values with their meaning could be potentially difficult to interpret.
For portability, structuring and readability purposes an eXtensible Markup Language (XML) based standard representation format is defined called Multiscale Spatial Temporal Markup Language (MSTML). The rules and constraints for the structure of MSTML files are formalised in XML Schema Definition (xsd) files. The latest version of the MSTML format is made available at http://mule.modelchecking.org/standards, a description of the format is given in S3 Text, and an example of an MSTML formatted file is depicted in Listing 1.
Listing 1. An example MSTML file recording multiscale spatiotemporal time series data.
1 <?xml version=“1.0” encoding=“utf −8”?>
2 <experiment>
3 <timepoint value=“1”>
4 <spatialEntity spatialType=“cluster” scaleAndSubsystem=“Organ.Liver”>
5 <clusteredness>0.01</clusteredness>
6 <density>0.4</density>
7 <area>15</area>
8 <perimeter>28</perimeter>
9 <distanceFromOrigin>81</distanceFromOrigin>
10 <angle>10.5</angle>
11 <triangleMeasure>0.5</triangleMeasure>
12 <rectangleMeasure>1.0</rectangleMeasure>
13 <circleMeasure>0.1</circleMeasure>
14 <centroidX>703.4999</centroidX>
15 <centroidY>118.087</centroidY>
16 </spatialEntity>
17 <numericStateVariable scaleAndSubsystem=“Cellular.Hepatocyte”>
18 <name>dysfunction</name>
19 <value>0.1</value>
20 </numericStateVariable>
21 </timepoint>
22 …
23 </experiment>
For model checking purposes the number of MSTML files #MSTML generated for an MSSpDES model assuming fixed parameter values varies depending if the model is deterministic (#MSTML = 1) or stochastic (#MSTML ≥ 1), and if the required level of confidence for the model checking result is high (e.g. 99%) or low (e.g. 70%).
To determine the correctness of a model the model checker verifies if its behaviour captured by a corresponding set of MSTML files conforms to a given formal specification.
Formal specification
The temporal logic employed to write the formal specification needs to enable reasoning about how values of numeric state variables and/or spatial measures, which are the state variables considered, are expected to change over time and multiple scales.
To the best of our knowledge the only formal language for reasoning about numeric and spatial properties corresponding to computational models of biological systems is called Bounded Linear Spatial Temporal Logic (BLSTL), which we have previously introduced in [57]. One of the main limitations of BLSTL is that it does not enable different scales to be explicitly distinguished. Therefore it is not possible to relate how changes at one scale reflect at another scale and vice versa.
Bounded Linear Multiscale Spatial Temporal Logic.
To address the issue of relating changes between scales we define the Bounded Linear Multiscale Spatial Temporal Logic (BLMSTL) which enables explicitly distinguishing between state variables corresponding to different scales and subsystems. Throughout it is assumed that the scales and subsystems considered are the same as the ones defined in the MA graph of the corresponding MSSpDES model. Although MSSpDESs can be employed to represent both discrete and continuoustime stochastic discreteevent systems, the semantics of a temporal logic usually varies with the considered representation of time. Therefore in this paper we restrict the semantics of BLMSTL to a continuoustime representation (similarly to CSL [64] and in contrast to BLSTL). However adapting BLMSTL to a discretetime representation requires changing only the semantics of the time dependent operators, whereas the definition of all other atomic propositions (related to different scales and subsystems, numeric state variables, and spatial entities) is preserved.
BLMSTL enables reasoning about how collections, or more formally bags, of spatial measures values from one time point, and collections of numeric state variables and spatial measures values corresponding to multiple time points change over time using statistical functions. Transfer relations between state variables from the same and/or different scales are encoded using standard arithmetic functions. An informal natural language description of the most relevant BLMSTL features is given below; see S4 Text for a formal definition of the BLMSTL syntax and semantics.
Similarly to BLSTL, BLMSTL employs temporal and Boolean operators for describing how a system changes over time, respectively for composing simple logic statements into more complex ones. BLMSTL atomic propositions enable describing relations between numeric state variables and/or spatial measures associated to subsets of spatial entities.
Numeric state variables are specified by their name (e.g. heartBeat) and their associated scale and subsystem (e.g. (organ, heart)); the corresponding BLMSTL notation for specifying scales and subsystems is scale.subsystem (e.g. organ.heart). Conversely spatial measures associated with subsets of spatial entities are specified by their spatial measure type (e.g. area), associated spatial entity type (e.g. regions) and their corresponding scale and subsystem. Similarly to MSTML the sets of spatial entity types and spatial measures considered are SET_{considered} = {clusters, regions}, respectively SM_{considered} = {clusteredness, density, area, perimeter, distanceFromOrigin, angle, triangleMeasure, rectangleMeasure, circleMeasure, centroidX, centroidY}.
Instead of considering all spatial entities of a given type it is possible to select only a subset of spatial entities by imposing constraints over the spatial measure values (e.g. spatial entities with area > 10), by using subset operators \ (difference), ∩ (intersection) and ∪ (union), or specifying one or multiple scales and subsystems using the partial orders < and ≤ defined over the set of vertices V_{MA} (e.g. spatial entities whose corresponding scale and subsystem < (organ, heart)).
The resulting collection of spatial measures values corresponding to multiple spatial entities (e.g. value of the area for all detected spatial entities) can be described using unary (e.g. mean), binary (e.g. covariance) or binary quantile (e.g. percentile) statistical functions. These statistical functions can be additionally employed to reason about collections of numeric state variables and spatial measures values corresponding to multiple time points (e.g. the value of numeric state variable X for all time points in the time interval [0, 100]). By considering different numbers of time points for different state variables it is possible, for instance, to describe how values corresponding to one time point (and a coarsegrained scale) relate to other values corresponding to multiple time points (and a finegrained scale), or vice versa.
Transfer functions defined over state variables from different scales can be encoded using unary (e.g. square root) and binary (e.g. add) arithmetic functions. For instance if the value of a state variable sv_{cg} from a coarsegrained scale is equal to the arithmetic mean of four state variables sv_{fg1}, sv_{fg2}, sv_{fg3}, sv_{fg4} from a more finegrained scale, this can be written as sv_{cg} = (sv_{fg1}+sv_{fg2}+sv_{fg3}+sv_{fg4})/4; in BLMSTL “+” and “/” would be replaced by the arithmetic functions add, respectively div.
Illustrative examples of statements written both in natural language and BLMSTL are given below. For simplicity the number of scales and subsystems explicitly specified is two in all examples.
 Natural language: Always during the time interval [0, 95] if the concentration of EGFR (corresponding to scale and subsystem (Intracellular, RasERKPathway)) increases over 20 M, then the cancerous cell (corresponding to scale and subsystem (Cellular, Cancerous)) will divide i.e. the cell count will increase.
BLMSTL: G[0, 95] (({EGFR}(scaleAndSubsystem =
Intracellular.RasERKPathway) > 20) ⇒
(d(count(density(filter(regions, scaleAndSubsystem =
Cellular.Cancerous)))) > 0)).  Natural language: If the concentration of drug X (corresponding to scale and subsystem (Organism, Human)) eventually increases during time interval [5, 10], then the area of the aorta cross section (corresponding to scale and subsystem (OrganSystem, Aorta)) will be larger during time interval [10, 30] than [0, 10].
BLMSTL: (F [5, 10] d({X}(scaleAndSubsystem = Organism.Human)) >0) ⇒
(min([10, 30] min(area(filter(regions, scaleAndSubsystem =
OrganSystem.Aorta)))) >
max([0, 10] max(area(filter(regions, scaleAndSubsystem =
OrganSystem.Aorta))))).  Natural language: Always during the time interval [0, 100] the liver dysfunction measure (corresponding to scale and subsystem (Organ, Liver)) is equal to the average density of damaged liver tissues (corresponding to scales and subsystems ≤ (Tissue, DamagedLiverTissue)). The assumption made here is that the density value represents the degree of damage suffered by the liver tissue.
BLMSTL:G [0, 100] ({LiverDysfunction} (scaleAndSubsystem =
Organ.Liver) = avg(density(filter(regions, scaleAndSubsystem ≤
Tissue.DamagedLiverTissue)))).
To enable the explicit encoding of the probability with which a BLMSTL statement is expected to hold, a probabilistic extension of BLMSTL called Probabilistic Bounded Linear Multiscale Spatial Temporal Logic is defined.
Probabilistic Bounded Linear Multiscale Spatial Temporal Logic.
A Probabilistic Bounded Linear Multiscale Spatial Temporal Logic (PBLMSTL) property ϕ is a logic property of the form P_{⋈θ}[ψ] where ⋈ ∈ {<, < =, > =, >}, θ ∈ (0, 1) and ψ is a BLMSTL property.
An illustrative example of a natural language probabilistic statement mapped into PBLMSTL is given below:
 Natural language: The probability is greater than 0.99 that always during the time interval [0, 95] if the concentration of EGFR (corresponding to scale and subsystem (Intracellular, RasERKPathway)) increases over 20 M, then the cancerous cell (corresponding to scale and subsystem (Cellular, Cancerous)) will divide i.e. the cell count will increase.
PBLMSTL: P > 0.99 [G[0, 95] (({EGFR}(scaleAndSubsystem = Intracellular.RasERKPathway) > 20) ⇒
(d(count(density(filter(regions, scaleAndSubsystem =
Cellular.Cancerous)))) > 0))].
A PBLMSTL property ϕ ≡ P_{⋈θ}[ψ] holds for an MSSpDES if and only if the probability of ψ to hold for a model simulation is ⋈θ. Therefore in order to determine the truth value of a PBLMSTL property ϕ the likelihood of ψ being true needs to be computed.
Model checking
The multiscale spatiotemporal model checking problem is to automatically verify if an MSSpDES satisfies a PBLMSTL property ϕ.
In order to solve the model checking problem only approximate probabilistic model checking approaches are considered throughout. As illustrated in Table 2 the approaches considered are either Bayesian or frequentist, and estimate or hypothesis testing based; a brief description of each approach was given in our previous work [57] and will not be restated here.
By means of approximate probabilistic model checking approaches the verification of a PBLMSTL specification against an MSSpDES model is guaranteed to terminate. Therefore the corresponding multiscale spatiotemporal model checking problem is welldefined; see S5 Text for a formal proof. Intuitively the main idea behind the proof is to show that in order to verify an MSSpDES model the number of required model simulations is finite, and that the number of time points considered for each model simulation is bounded. Therefore the PBLMSTL specification is evaluated against a finite number of time points and model simulations, which can be done in a finite number of steps.
Spatiotemporal meta model checking
One of the main limitations of our methodology, as described up to this point, is that the evolution over time of spatial properties can be described only with respect to the predefined collections of spatial entity types SET_{considered} = {clusters, regions} and spatial measures SM_{considered} = {clusteredness, density, area, perimeter, distanceFromOrigin, angle, triangleMeasure, rectangleMeasure, circleMeasure, centroidX, centroidY}.
In order to overcome this limitation and enable automatically reconfiguring the methodology according to case study specific spatial entity types and measures, we define a generalized version of the multiscale spatiotemporal model checking methodology called multiscale spatiotemporal meta model checking in which SET_{considered} and SM_{considered} are replaced with meta collections of spatial entity types SET, and spatial measures SM, defined as follows:

Considering the spatial state variable tuples spsvt ∈ SpSV^{p}, f_{sety} computes which positions of the discretised space are occupied (1) by spatial entities or not (0); see [57] for examples of spatial detection mechanisms corresponding to the spatial entity types clusters and regions.  SM = {sm  sm is a spatial measure, sm: SE → SMV ⊆ ℝ, where SE is a set of spatial entities and SMV is the corresponding domain of valid spatial measure values}; similarly see [57] for examples of spatial measures corresponding to the spatial entity types clusters and regions.
These collections are called meta because they provide only a description of the conditions which should hold for each spatial entity type and spatial measure but do not explicitly define instances thereof.
The multiscale spatiotemporal meta model checking methodology enables the creation of different multiscale spatiotemporal model checking methodology instances by replacing SET and SM with case study specific collections of spatial entity types and spatial measures. These instances can then be used to verify corresponding MSSpDES models. For instance, in order to verify computational models considering a 3D representation of space a corresponding model checking methodology instance could be created that replaces SET and SM with SET_{3D} = {cuboid, cylinder, sphere} and SM_{3D} = {volume, centroidX, centroidY, centroidZ}.
A graphical description of the workflow employed to create multiscale spatiotemporal model checking methodology instances is given in Fig 6. For simplicity a single multiscale model checking methodology instance is considered throughout this paper corresponding to the collections of spatial entity types and measures SET_{considered}, respectively SM_{considered}.
The workflow comprises two levels, the upper generic (meta) level, and the lower specific (instance) level. The upper level comprises the multiscale spatiotemporal meta model checking methodology. Conversely the lower level consists of the specific collections of spatial entity types and measures employed to create multiscale spatiotemporal model checking methodology instances. For each considered pair (e.g. m) of spatial entity types and spatial measures collections a corresponding multiscale model checking methodology instance is created. The resulting methodology instances (e.g. m) can then be employed for various case studies (e.g. n) to decide if computational models (e.g. m,n) are correct relative to corresponding formal specifications (e.g. m,n) or not. Rounded rectangles and arrows having the same border/line colour correspond to the same collections of spatial entity types and spatial measures.
Whenever creating new multiscale model checking methodology instances there is an additional need to define corresponding image processing functions for automatically detecting and analysing spatial entities in time series data. However such functions can often be defined based on existing approaches from the image processing literature.
Finally following on from S5 Text, when verifying an MSSpDES model relative to a formal PBLMSTL specification, the number of required model simulations and the number of required state transitions for each model simulation do not depend directly on the considered collections of spatial entity types and spatial measures. Therefore regardless of the considered instances of SET and SM the multiscale spatiotemporal model checking problem is welldefined.
Implementation
The multiscale spatiotemporal meta model checking approach was implemented in the model checking software Mule which enables automatically verifying multilevel computational models of biological systems relative to formal specifications; the model checker name is a concatenation of the first and last two letters in the word “Multiscale”. For efficiency purposes Mule was implemented in C++ and supports all approximate probabilistic model checking approaches described in Table 2.
Depending on the approximate probabilistic model checking approach employed the number of MSTML files required to verify if the computational model is valid relative to a PBLMSTL specification is computed differently. In case of ChernoffHoeffding bounds based and probabilistic blackbox model checking approaches the number of required MSTML files can be computed before running Mule (i.e. statically). Conversely in case of the improved frequentist and Bayesian statistical hypothesis testing, and Bayesian mean and variance based model checking approaches the number of required MSTML files is determined only during the execution of Mule (i.e. dynamically). To support generating MSTML files ondemand Mule can take as input the path to a script (in our case Bash script) that simulates a computational model and stores the resulting output in MSTML files; run Mule with the command line argument —help for more execution details.
The workflow for generating multiscale spatiotemporal model checker instances was implemented as described in Fig 7. The main idea behind the implementation is to use two instead of one compilation (or translation) steps. The first compilation step takes a description of the spatial entity types and measures as input and produces C++ source code as output. The second compilation step translates the generated C++ source code in binary (i.e. executable) format. Conceptually this approach is called “meta” because Mule is an abstract multiscale spatiotemporal (meta) model checker that can be instantiated according to case study specific spatial entity types and measures. From a practical point of view the user modifies only the description of the spatial entity types and measures, while the source code and the corresponding executables are automatically generated for him/her.
Starting from the problem one tries to solve, an xml file is created describing the collections of spatial entity types and spatial measures of interest. These collections are then verified with respect to relevant constraints captured by an xsd file; see http://mule.modelchecking.org/standards for the latest version of the xsd file. If the xml file verification fails then the specification of the spatial entity types and measures needs to be updated accordingly. Otherwise the xml file is employed by a C++ source code generator/translator written in Python to generate the corresponding Mule source files based on a set of predefined templates. The source files are compiled to produce an executable version of the corresponding Mule instance. This instance can then be employed to verify corresponding computational models.
The main advantage of the workflow depicted in Fig 7 is that it enables the considered spatial entity types and measures to be compiled into the model checking executable instead of being (dynamically) loaded at runtime, which could negatively impact the model checker performance.
Mule was implemented as an offline model checker and takes as input model simulation traces rather than the computational models used to generate them. Using trace analysis each model simulation trace is evaluated against the PBLMSTL specification. The trace analysis results corresponding to multiple model simulation traces are used by the employed model checking approach to determine if the PBLMSTL specification holds for the model.
The main advantage of implementing Mule as an offline model checker is that it is decoupled from the specific modelling formalisms employed to encode the computational models. Consequently Mule can be employed to verify computational models encoded using various modelling formalisms provided that the corresponding computational models satisfy the constraints of an MSSpDES model without requiring the explicit translation of the computational models to MSSpDES. In addition given that Mule takes simulation traces (i.e. time series data) as input it can be employed to evaluate PBLMSTL specifications both against time series data generated in silico or recorded in vitro. Conversely the main disadvantages of Mule are that the computational models need to be constructed and simulated using external tools, and the model simulation output needs to be stored in or translated to csv format. To generate model simulations on demand Mule needs to be able to execute the model simulator from the command line.
In contrast to Mule inline approximate probabilistic model checkers (e.g. COSMOS [74], PLASMA [75], PRISM [76], UPPAALSMC [77], Ymer [78]) are integrated modelling and verification environments that can be employed not only to verify, but also to construct and simulate computational models. In addition inline model checkers are usually more efficient than their offline counterparts, because model simulations can be generated ondemand, inmemory and potentially stopped early (i.e. as soon as the considered logic statement is accepted/rejected). However inline model checkers typically require explicitly encoding computational models in the model checker specific modelling formalism, and they can not be employed to evaluate formal specifications against time series data recorded in vitro.
Both the source code and the executable corresponding to the Mule instance employed throughout this paper are made freely available online at http://mule.modelchecking.org; this Mule instance is defined with respect to the collection of spatial entity types SET_{considered} and spatial measures SM_{considered}. Moreover a corresponding Docker image has been created providing a selfcontained environment for executing/updating model checker instances which can be run on all major operating systems without additional setup (except installing the freely available software Docker).
Results
We illustrate the applicability of the model checker based on four multiscale systems biology case studies published in the literature. The case studies were chosen such that the corresponding computational models are of different types (i.e. deterministic/hybrid/stochastic), span different levels of organization (e.g. cellular/organ) and are encoded using different modelling formalisms (e.g. ordinary differential equations/cellular automata) and software (e.g. Morpheus/NetLogo); see Table 3 for a brief comparison of the multilevel computational models considered.
Since Mule is implemented as an offline model checker and all approximate probabilistic model checking algorithms employed here (see Table 2) are defined relative to simulation traces, the computational models M1–M4 were not explicitly translated to an MSSpDES representation. Instead the computational models encoded using highlevel modelling formalisms were simulated and the simulation output was stored in MSTML files. These MSTML files were then provided as input to the model checker Mule. There are two main reasons for employing the computational models encoded in highlevel modelling formalisms (as developed by their original authors) instead of MSSpDES. First of all simulating an MSSpDES computational model on a computer requires defining an MSSpDES operational semantics, which was not given here. Secondly approximations inherent to the translation of computational models between different modelling formalisms could potentially impact the outcome of the model checker execution.
In case of the deterministic continuousstate computational model M1 an alternative approach, which is not considered here, would have been to translate M1 into a stochastic discretestate computational model. Using the approach described by Wilkinson [79] and under the assumption that the volume of the media containing the species in the model is known, concentrations can be converted into discrete numbers of molecules, and deterministic into stochastic kinetic rate constants. The main reason for not translating M1 into a stochastic model is that we want to illustrate that Mule can be employed to verify existing deterministic continuousstate computational models relative to PBLMSTL specifications without the need to initially alter the models. The probability of a PBLMSTL specification to hold for the deterministic continuousstate model M1 is either 1 (i.e. true) or 0 (i.e. false).
The natural language and corresponding formal specifications, against which the models were verified, have been derived from the original papers introducing the case studies. Quotes from the original papers have been employed to create initial natural language statements describing the expected system behaviour. The initial natural language statements were then rephrased to match the constructs and structure typical to formal PBLMSTL statements; the resulting statements are called rephrased natural language statements. Finally the rephrased natural language statements were manually mapped into corresponding PBLMSTL statements. Where insufficient information was available (e.g. probabilities) the numeric values employed in the formal specification are quantitative approximations of the corresponding natural language descriptions (e.g. with high probability ⇒ 0.9). The main purpose of the PBLMSTL statements considered is to illustrate the expressivity of the methodology and not to predict previously unknown biologically relevant properties. For reproducibility purposes the mapping between quotes from the original papers, derived natural language statements and corresponding PBLMSTL specifications is documented in the supplementary materials.
The model checking approach employed to verify the deterministic computational models (M1 and M2) was probabilistic blackbox because it does not place a lower bound on the required number of model simulations and therefore is suitable for computational models which are simulated only once. Conversely for the verification of the hybrid (M3) and stochastic (M4) computational models improved frequentist statistical hypothesis testing was employed setting the values of both input parameters α (i.e. probability of type I errors) and β (i.e. probability of type II errors) to 5%. Therefore the number of model simulations considered for the verification of computational models M3 and M4 was variable and computed relative to the values of the input parameters α and β, respectively fixed and was equal to one for computational models M1 and M2.
All approximate probabilistic model checking approaches supported by Mule (see Table 2) were previously introduced by other authors and are not directly dependent on PBLMSTL. Therefore a comparison between the different model checking approaches, although interesting, goes beyond the scope of this paper.
The computational models have been simulated, analysed and verified using the same regular desktop computer (Linux x64, Intel Core i52500 CPU @1.6 GHz, 16 GB DDR3 RAM memory). To assess the performance of the approach execution times have been recorded for all relevant steps of the model checking workflow.
Finally, for comparison purposes, the case studies and the corresponding computational models will not be described individually but in parallel considering the steps of the model checking workflow (i.e. model construction, multiscale spatiotemporal analysis, formal specification, model checking).
Model construction
Rat cardiovascular system dynamics.
The cardiovascular system comprises the heart, blood and blood vessels, and is the organ system responsible for delivering oxygen and nutrients to, and removing waste products from the entire organism. Its dynamics changes in case of a transient increase of the thoracic pressure (e.g. by performing the Valsalva manoeuvre) which leads to reduced blood flow in the right atrium, reduced cardiac output and decreased aortic pressure [13].
In order to describe the behavioural changes of the cardiovascular system during the Valsalva manoeuvre Beard et al. built a multiscale nonspatial ODE model [13] by integrating two previously existing models. The first model is an abstract representation of the cardiovascular system [80]. Conversely the second model encodes the baroreflex mechanism [81] which is employed to maintain the blood pressure of an organism at approximately constant levels. One of the main advantages of the integrated multiscale model is that it enables relating changes at the entire cardiovascular system level with changes at the baroreflex mechanism level and vice versa, which was not possible when employing the constituent models separately. The hierarchical organization of the resulting model is encoded by the MA graph depicted in Fig 8.
For verification purposes the numeric state variables considered at the organ system scale are the thoracic pressure and the heart rate, and the aortic pressure at the cellular scale.
Uterine contractions of labour.
Although it is known that usually during human labour regions across the entire uterus contract in a coordinated fashion the underlying mechanisms by which an initial local contraction propagates to the entire organ level are not fully understood [14].
One hypothesis is that a positive feedback loop is created between the tissue level contractions and the intrauterine pressure as follows: An initial tissue level contraction increases the intrauterine pressure and adds tension to the neighbouring regions, which in response start to contract, thus increasing the intrauterine pressure even further and adding tension to their corresponding neighbouring regions which also start to contract, and the entire process is repeated until all contractible regions across the entire organ are recruited.
In order to test this hypothesis Young and Barendse developed a corresponding predictive deterministic computational model [14]. The model was encoded as a cellular automaton in Mathematica and spans two levels of organization, the organ level for the uterus, and the tissue level for the uterine regions; see Fig 9 for the corresponding MA graph.
At the organ (i.e. uterus) scale the numeric state variable considered is the intrauterine pressure and space is encoded explicitly as a 4 × 4 grid, where each grid position represents a tissue (i.e. uterine region). Conversely at the tissue level there is no explicit representation of space and the recorded numeric state variables are the contractile, burst and refractory activities of the uterine regions.
Xenopus laevis cell cycle.
The cell cycle is a fundamental biological process which is responsible for the replication/division of cells and is involved in the development and partial renewal of organisms. Its complexity is usually proportional to the complexity of the considered organism. Therefore it is studied in lower and less complex organisms such as the Xenopus laevis frog.
To gain a better understanding of the Xenopus laevis embryonic cell cycle and how it affects cellular population growth the developers of the modelling software Morpheus [82] built a corresponding multiscale computational model [83]. The computational model describes how three proteins CDK1, Plk1 and APC regulate the cell cycle at the intracellular level using ODEs [15], and how cells divide and are displaced in 2D space at the cellular level using a CPM. The corresponding MA graph is depicted in Fig 10.
At the cellular level space is represented explicitly as a 52 × 52 grid recording the spatial distribution of the population of cells. Conversely at the intracellular level there is no explicit representation of space and the numeric state variables considered are the concentrations of CDK1, Plk1 and APC.
Acute inflammation of the gut and lung.
There is no single definition of inflammation in the literature [84] but here we will interpret it as the response of a biological system to bodily damaging stimuli. Depending on the intensity of the stimulus an inflammatory response initiated in one organ can propagate to other organs and eventually lead to multiple organ failure [16].
To gain a better understanding of the relation between inflammatory responses and multiple organ failure, G. An [16] built a multiscale agentbased computational model using the software NetLogo which describes how the inflammation of either the gut (i.e. gut ischemia) or lung (i.e. pneumonia) could potentially lead to the failure of both organs. The levels of organization considered in the computational model are cellular (for representing endothelial and epithelial cells), tissue (for representing the organ luminal space, the blood vessel luminal space, and the endothelial and epithelial layers), and organ (for representing the gut and lung); see Fig 11 for the corresponding MA graph.
The organism level is not modelled explicitly and the corresponding vertex (Organism, Human) was added to the MA graph in Fig 11 only to ensure that its structure is treelike. At the organ level space is not represented explicitly and the numeric state variables considered represent the amount of solute which leaked into the gut and lung. Conversely at the tissue level space is represented explicitly as a 31 × 31 grid where each grid position represents a cell. The tissue level numeric state variables considered for both gut and lung are the total concentration of cytoplasm and cell wall occludin, and the total cell damage byproduct. At the cellular level the numeric state variables considered encode the level of ischemia for both gut and lung endothelial cells.
Multiscale spatiotemporal analysis
The computational models M1–M4 were simulated and the simulation results were translated to MSTML.
The computational model simulation end time was computed as per Definition 1, S5 Text considering the PBLMSTL statements against which each computational model was verified.
The translation of the simulation results to MSTML comprises multiple steps. First of all the model simulation output is converted to csv format in order to ensure that the time series data provided as input to the multiscale spatiotemporal analysis module is represented in a uniform manner. Secondly an MSTML subfile is generated for each considered time point, numeric state variable and spatial region comprising one or multiple grid positions. In the end all subfiles are merged into a single MSTML file. The main difference between the csv and corresponding MSTML file is that for each time point the former records the values associated to entire discretised spatial domains, whereas the latter only captures the properties of the detected spatial entities. The main advantage of storing to disk the results of the csv to MSTML translation, and providing MSTML instead of csv files as input to the model checker is reusability. MSTML files can be employed for the evaluation of different PBLMSTL specifications in separate executions of the model checker without the need to run the csv to MSTML translation each time.
Execution times for the model simulation and subsequent translation steps corresponding to all computational models are given in Table 4.
The most time consuming step for the rat cardiovascular system dynamics (i.e. 37.22s) and the acute inflammation of the gut and lung (i.e. 329.6s) case studies was the model simulation due to the large number of time points considered (i.e. 30001), and the stochastic nature and high complexity associated with the model. Conversely the most time consuming step for the uterine contractions of labour (i.e. 25.15s) and Xenopus laevis cell cycle (i.e. 12.06s) case studies was generating the MSTML subfiles due to the spatial regions which have been automatically detected and analysed for each spatial state variable considered.
The least time consuming step for all case studies was converting the model simulation output to csv format.
Formal specification
The generated MSTML files representing the behaviour of the computational models and the corresponding MA graphs are employed during the evaluation of the formal specifications described in natural language in Table 5. The equivalent PBLMSTL specifications for the rat cardiovascular system dynamics, the uterine contractions of labour, the Xenopus laevis cell cycle and the acute inflammation of the gut and lung case studies are given in S1, S2 and S3 Files, respectively S4 File.
Throughout natural language specifications are translated to PBLMSTL such that the ith natural language statement corresponds to the ith PBLMSTL statement.
Model checking
Each computational model has been verified against the relevant PBLMSTL statements 500 times, where each PBLMSTL statement was stored in a separate file. The main reason for repeating the model verification procedure 500 times for each computational model and PBLMSTL statement is to compute the variation of the model checker execution time between runs, and the variation of the number of MSTML files considered for the hybrid (M3) and stochastic (M4) computational models. Results obtained for each of the 500 model checker executions and PBLMSTL statements corresponding to the computational models M1, M2, M3 and M4 are given in S6, S7 and S8 Texts, respectively S9 Text. The output of the statistical analysis of the model checking results is summarized in Table 6.
Empirical evidence shows that all computational models are correct relative to the formal specifications derived from the original papers introducing the models.
Due to the deterministic nature of computational models M1 and M2, the corresponding model checking results were obtained by considering a single MSTML file, and therefore were identical across all 500 model checker executions. The main difference between the PBLMSTL statements considered is that in case of statements 1, 2, 4 and 6 the estimated probability p for them to hold, computed as #true MSTML divided by #total MSTML, was p = (1 / 1) = 1, whereas for the PBLMSTL statements 3 and 5 it was p = (0 / 1) = 0. However since the associated probabilistic specification for the PBLMSTL statements 1, 2, 4 and 6 was p > 0.9 (i.e. 1 > 0.9), and p < 0.1 (i.e. 0 < 0.1) for the PBLMSTL statements 3 and 5, all PBLMSTL statements hold.
Conversely in case of the hybrid (M3) and stochastic (M4) computational models the model checking results were obtained by considering multiple MSTML files. Moreover the number of MSTML files against which the corresponding PBLMSTL statements evaluated true varied between model checker executions (e.g. see Table 6, row corresponding to SId 7). However the result of the model verification procedure was always the same (see Table 6, column 3).
The average model checker execution times corresponding to the verification of the deterministic computational models M1 and M2 were smaller than for the hybrid, respectively stochastic computational models M3 and M4. This is due to the difference in the number of MSTML files considered which was one for computational models M1 and M2, and ≊28 for computational models M3 and M4. Moreover the variation in the average model checker execution times between the computational models M1 and M2, respectively M3 and M4 is due to the difference in the number of time points considered per model simulation which was 30001 for M1 and 330 for M2, respectively 103 for M3 and 1000 for M4. Average model checker execution times corresponding to the same computational model but different PBLMSTL statements were approximately equal throughout because most of the execution time is spent on reading the MSTML file(s) from disk and not the evaluation of the PBLMSTL statements.
By storing the PBLMSTL statements corresponding to a computational model in separate files each MSTML file read by the model checker from disk is evaluated against only one rather than all PBLMSTL statements. Therefore in order to reduce the average model checker execution time all PBLMSTL statements corresponding to the same computational model could be written into a single file. A comparison between average execution times obtained for 500 model checker executions considering all PBLMSTL statements written into single, respectively multiple separate files are given in Table 7. Regardless of the computational model considered the average model checker execution time was approximately three times smaller when storing PBLMSTL statements in single rather than multiple separate files. The main reason for this is that the total number of MSTML files read from disk, which takes up most of the model checker execution time, was reduced by a factor equal to the number of PBLMSTL statements considered (i.e. 3).
The model checker execution times given in Tables 6 and 7 were measured when providing pregenerated MSTML files as input to Mule. However Mule can be additionally employed to verify computational models by generating MSTML files on demand. In order to measure the model checker execution time when all MSTML files are generated ondemand the computational model M3 was verified 500 times relative to the corresponding PBLMSTL statements stored in a single file, without providing any pregenerated MSTML files as input. The average execution time of the 500 runs was 317.7s i.e. ≈9 times more than when providing pregenerated MSTML files as input (i.e. 36.3s). The large difference in execution time is due to the fact that when generating MSTML files ondemand Mule needs to wait for the MSTML files to be generated (i.e. for the computational model to be simulated and the model simulation output to be translated to MSTML) before evaluating the PBLMSTL specification against them. Therefore there is a model checker execution time overhead when verifying computational models using ondemand generated MSTML files. The magnitude of the execution time overhead depends on the number of MSTML files against which the PBLMSTL specification is evaluated, and the time required to generate a new model simulation and translate the model simulation output to MSTML.
A comparison between the average execution times recorded for simulating the model, translating the output to MSTML and verifying it using model checking is given in Fig 12.
Execution times were recorded for the computational model simulation, converting the output to csv format, generating MSTML subfiles for each considered time point, numeric state variable and spatial entity, merging the subfiles into a single MSTML file, and model checking.
The most time consuming step in the model checking workflow for both the cardiovascular system dynamics and acute inflammation of the gut and lung case studies is the model simulation. This is due to the large number of time points considered in case of the former, and the high complexity associated with the stochastic computational model in case of the latter. Conversely for the uterine contractions of labour case study the most time consuming step in the model checking workflow is generating the MSTML subfiles due to the additional need to automatically detect and analyse spatial regions of three types (i.e. corresponding to the contractile, burst and refractory activities) for each simulation time point. In contrast, the most time consuming step in the model checking workflow for the Xenopus laevis cell cycle case study is model checking due to the need to evaluate each PBLMSTL statement against multiple MSTML files. The least time consuming step in the model checking workflow for all case studies is converting the simulation output to csv format.
For reproducibility purposes the MA graph, the pregenerated MSTML file(s), the formal PBLMSTL specification, and the excerpts from the referenced papers used to write the formal specification for each case study are made available as supplementary materials; see Table 8 for details. Due to file size constraints only a subset of the total number of generated MSTML files was made available for the Xenopus laevis cell cycle (see S3 Dataset) and the acute inflammation of the gut and lung (see S4 Dataset) case studies; the complete datasets are made freely available online at http://mule.modelchecking.org/casestudies.
Discussion
The need for reasoning about how systems evolve over multiple temporal and spatial scales has been previously emphasized in the literature. For instance Van de Weghe et al. [85] have defined a theoretical framework which enables describing and analysing how geographical phenomena observed at higher scales are reflected at lower scales and vice versa. However there is a lack of corresponding model checking approaches for computational models of such systems.
To the best of our knowledge the only related multiscale model checking approach which explicitly distinguishes between multiple spatial scales without (initially) accounting for time was introduced by Grosu et al. [86] for detecting patterns in images. The multiscale representation of space was created by recursively splitting a spatial domain in quadrants (a finite number of times) and representing the resulting hierarchy as a quadtree. A formal logic called Linear Spatial Superposition Logic (LSSL) and a corresponding model checking algorithm were introduced in order to encode specifications relative to spatial subdomains along a linear path through the quadtree. More recently both the formal logic and corresponding model checking algorithm were extended by Gol et al. [87] to account for branching paths through quadtrees (Tree Spatial Superposition Logic), and by Haghighi et al. [88] to account for the evolution of the quadtrees over time (SpaTel). Although efficient for pattern detection (and generation) these approaches could be potentially too restrictive for reasoning about general multiscale systems since only one spatial domain is considered and the relationship between consecutive levels/scales is fixed. Moreover it is not possible to describe how spatial entities potentially spanning multiple quadrants of the spatial domain, and their properties change over time.
In this paper we have introduced a novel multiscale spatiotemporal meta model checking methodology which enables automatically verifying multilevel computational models of biological systems relative to specifications describing the desired/expected system behaviour.
Our approach is generic and supports multilevel computational models of biological systems encoded using various highlevel modelling formalisms (e.g. CPMs, ABMs) because it is defined relative to time series data and not the models used to produce them. This is illustrated by the four case studies which were formally encoded using ODEs (rat cardiovascular system dynamics), CAs (uterine contractions of labour), CPMs (Xenopus laevis cell cycle), ABMs (acute inflammation of the gut and lung) or combinations thereof.
Although the model checker is flexible regarding the modelling formalism employed to encode the computational models it requires that the model simulation output is translated to the standard MSTML format. During the translation process nonspatial state variables (e.g. concentrations) are mapped directly from their native format to MSTML. Conversely in case of spatial state variables the multiscale spatiotemporal analysis module is additionally executed for automatically detecting emergent spatial entities (e.g. clusters) and computing their properties (e.g. area).
The model checker can be adapted automatically to case study specific spatial entity types (e.g. 3D spatial structure) and/or properties (e.g. minimum distance to a fixed point) not covered by our multiscale spatiotemporal analysis module. External analysis tools can be employed to automatically detect and analyse these case study specific spatial entities, and to convert the output to the MSTML format. The corresponding instance of the multiscale spatiotemporal meta model checker can be generated automatically based on a configuration file without the need to modify the implementation by hand.
The set of MSTML files representing the model behaviour can be generated either before or during the evaluation of a PBLMSTL specification. In case of the latter the model checker must be executed with an additional parameter representing the path to an external program which runs model simulations on demand, translates the output to MSTML and stores the resulting files in a predefined location. The overhead of generating MSTML files during (i.e. on demand) rather than before the evaluation of the PBLMSTL specification depends on the number of required MSTML files and the time required to simulate the computational model and translate the output to MSTML.
We have illustrated the applicability and flexibility of the model checker Mule by verifying four systems biology computational models previously published in the literature relative to formal specifications derived from the original papers introducing the models. Although only the probabilistic black box (see rat cardiovascular system dynamics and uterine contractions of labour case studies) and frequentist statistical model checking algorithms (see Xenopus laevis cell cycle and acute inflammation of gut and lung case studies) were employed here, additional frequentist (i.e. based on ChernoffHoeffding bounds) and Bayesian (i.e. hypothesis testing, mean and variance estimate based) model checking algorithms are supported.
The scalability of the entire model verification workflow depends on the scalability of the model simulation, multiscale spatiotemporal analysis and model checking steps. The execution time of the model simulation depends on the complexity of the system under consideration. Conversely the execution times of both the multiscale spatiotemporal analysis and the model checker depend on the size of the simulation output. In addition, the model checker execution time also depends on the formal specification. Our expectation is that scaling up to more complex systems will lead to an increase of the computational model complexity but not necessarily the size of the simulation output and/or formal specification. Therefore the expected scalability bottleneck of the entire model checking workflow is the model simulation and not the model verification step. This is supported by empirical evidence obtained from the case studies; the ratio between the maximum and minimum execution times for the model simulation step was ≊290, ≊5 for the multiscale spatiotemporal analysis, and ≊156 for model checking. In addition it would be possible to speed up the model checking step by evaluating MSTML files against the formal specification in parallel rather than sequentially as it is done now.
To enable computational modellers to easily adopt our approach for the verification of multilevel computational models of biological systems the model checker Mule (source code, binary, Docker image) and relevant supplementary materials are made freely available online via the official web page http://mule.modelchecking.org.
Building on our model checking methodology we could consider the following extensions in the future. First of all it is assumed throughout that computational models are translatable to an MSSpDES representation which means that any computational model encoded using a potentially incompatible highlevel modelling formalism will be translated to a corresponding MSSpDES representation subject to potential approximation errors (e.g. consider continuous computational models). Alternative representations could be employed instead. Secondly, although our methodology is automatically reconfigurable according to case study specific spatial entity types and measures, there is a need for the corresponding spatiotemporal analysis tools to be developed. The spatiotemporal analysis modules described here are currently restricted to pseudo3D spatial entity types and measures, but could be extended in the future for other numbers of dimensions. Thirdly the efficiency of Mule could be improved by supporting onthefly model checking. However this means that all computational models considered would need to be explicitly translated to a common (e.g. MSSpDES) representation before being verified. Fourthly the efficacy of the methodology was tested only against in silico generated time series data, but our expectation is that it could be employed for analysing experimental time series data as well. Moreover since the methodology is not restricted to biological case studies, nonbiological case studies could be additionally considered in order to test the limitations of the approach and potentially identify new features which could be included in forthcoming versions. Finally the efficacy of the multiscale model checking approach could be assessed in the future in the context of robustness analysis, parameter estimation/synthesis, and model construction problems.
Conclusions
In this paper we have defined a multiscale spatiotemporal meta model checking methodology which enables the automatic verification of multilevel computational models with respect to how both numeric (e.g. concentrations) and spatial (e.g. area) properties change over time considering multiple levels of organization.
The approach was implemented in our model checking software Mule which is made freely available online. To encourage potential contributions (e.g. extensions) the source code is hosted in a public GitHub repository. For flexibility purposes Mule supports both frequentist and Bayesian, estimate and statistical hypothesis testing based model checking approaches.
We have illustrated the applicability of the model verification approach using four representative systems biology case studies published in the literature, namely the rat cardiovascular system dynamics, the uterine contractions of labour, the Xenopus laevis cell cycle and the acute inflammation of the gut and lung.
Our approach enables computational modellers to construct reliable multilevel computational models of biological systems in a faster manner than it is done currently. These computational models could then be potentially translated into systems medicine to provide patient specific predictions on the evolution of diseases and their treatment across multiple levels of organization.
Supporting Information
S1 Text. Brief description of the in silico computational model verification approach called model checking.
https://doi.org/10.1371/journal.pone.0154847.s001
(PDF)
S2 Text. Description of how to construct the MA graph corresponding to a given biological system.
https://doi.org/10.1371/journal.pone.0154847.s002
(PDF)
S3 Text. Description of the Multiscale Spatial Temporal Markup Language.
https://doi.org/10.1371/journal.pone.0154847.s003
(PDF)
S4 Text. Formal definition of BLMSTL syntax and semantics.
https://doi.org/10.1371/journal.pone.0154847.s004
(PDF)
S5 Text. Proof that the multiscale spatiotemporal model checking problem is welldefined.
https://doi.org/10.1371/journal.pone.0154847.s005
(PDF)
S6 Text. Model checking results for the rat cardiovascular system dynamics case study.
https://doi.org/10.1371/journal.pone.0154847.s006
(PDF)
S7 Text. Model checking results for the uterine contractions of labour case study.
https://doi.org/10.1371/journal.pone.0154847.s007
(PDF)
S8 Text. Model checking results for the Xenopus laevis cell cycle case study.
https://doi.org/10.1371/journal.pone.0154847.s008
(PDF)
S9 Text. Model checking results for the acute inflammation of the gut and lung case study.
https://doi.org/10.1371/journal.pone.0154847.s009
(PDF)
S10 Text. Excerpts from the literature employed to write the formal specification for the rat cardiovascular system dynamics case study.
https://doi.org/10.1371/journal.pone.0154847.s010
(PDF)
S11 Text. Excerpts from the literature employed to write the formal specification for the uterine contractions of labour case study.
https://doi.org/10.1371/journal.pone.0154847.s011
(PDF)
S12 Text. Excerpts from the literature employed to write the formal specification for the Xenopus laevis cell cycle case study.
https://doi.org/10.1371/journal.pone.0154847.s012
(PDF)
S13 Text. Excerpts from the literature employed to write the formal specification for the acute inflammation of the gut and lung case study.
https://doi.org/10.1371/journal.pone.0154847.s013
(PDF)
S1 File. Formal PBLMSTL specification for the rat cardiovascular system dynamics case study.
https://doi.org/10.1371/journal.pone.0154847.s014
(IN)
S2 File. Formal PBLMSTL specification for the uterine contractions of labour case study.
https://doi.org/10.1371/journal.pone.0154847.s015
(IN)
S3 File. Formal PBLMSTL specification for the Xenopus laevis cell cycle case study.
https://doi.org/10.1371/journal.pone.0154847.s016
(IN)
S4 File. Formal PBLMSTL specification for the acute inflammation of the gut and lung case study.
https://doi.org/10.1371/journal.pone.0154847.s017
(IN)
S5 File. Multiscale architecture graph for the rat cardiovascular system dynamics case study.
https://doi.org/10.1371/journal.pone.0154847.s018
(XML)
S6 File. Multiscale architecture graph for the uterine contractions of labour case study.
https://doi.org/10.1371/journal.pone.0154847.s019
(XML)
S7 File. Multiscale architecture graph for the Xenopus laevis cell cycle case study.
https://doi.org/10.1371/journal.pone.0154847.s020
(XML)
S8 File. Multiscale architecture graph for the acute inflammation of the gut and lung case study.
https://doi.org/10.1371/journal.pone.0154847.s021
(XML)
S1 Dataset. Dataset of MSTML files generated for the rat cardiovascular system dynamics case study.
https://doi.org/10.1371/journal.pone.0154847.s022
(ZIP)
S2 Dataset. Dataset of MSTML files generated for the uterine contractions of labour case study.
https://doi.org/10.1371/journal.pone.0154847.s023
(ZIP)
S3 Dataset. Dataset of MSTML files generated for the Xenopus laevis cell cycle case study.
https://doi.org/10.1371/journal.pone.0154847.s024
(ZIP)
S4 Dataset. Dataset of MSTML files generated for the acute inflammation of the gut and lung case study.
https://doi.org/10.1371/journal.pone.0154847.s025
(ZIP)
Acknowledgments
We would like to thank the anonymous reviewers, Monika Heiner, Alessandro Pandini and Allan Tucker for their insightful comments which helped improve the quality of the paper.
Author Contributions
Conceived and designed the experiments: OP DG. Performed the experiments: OP. Analyzed the data: OP. Contributed reagents/materials/analysis tools: OP. Wrote the paper: OP DG. Developed and implemented the meta model checking methodology: OP. Proved that the multiscale model checking problem is welldefined: OP.
References
 1. Ideker T, Galitski T, Hood L. A NEW APPROACH TO DECODING LIFE: Systems Biology. Annual Review of Genomics and Human Genetics. 2001;2(1):343–372. Available from: http://www.annualreviews.org/doi/abs/10.1146/annurev.genom.2.1.343. pmid:11701654
 2. Kitano H. Systems Biology: A Brief Overview. Science. 2002 Jan;295(5560):1662–1664. Available from: http://www.sciencemag.org/content/295/5560/1662. pmid:11872829
 3. Dada JO, Mendes P. Multiscale modelling and simulation in systems biology. Integrative biology: quantitative biosciences from nano to macro. 2011 Feb;3(2):86–96.
 4. Boissel JP, Auffray C, Noble D, Hood L, Boissel FH. Bridging Systems Medicine and Patient Needs. CPT: Pharmacometrics & Systems Pharmacology. 2015 Mar;4(3):135–145. Available from: http://onlinelibrary.wiley.com/doi/10.1002/psp4.26/abstract.
 5. Wolkenhauer O, Auffray C, Brass O, Clairambault J, Deutsch A, Drasdo D, et al. Enabling multiscale modeling in systems medicine. Genome Medicine. 2014 Mar;6(3):21. Available from: http://genomemedicine.com/content/6/3/21. pmid:25031615
 6.
Clarke EM, Emerson EA. Design and synthesis of synchronization skeletons using branching time temporal logic. In: Kozen D, editor. Logics of Programs. No. 131 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 1982. p. 52–71. Available from: http://link.springer.com/chapter/10.1007/BFb0025774.
 7.
Queille JP, Sifakis J. Specification and verification of concurrent systems in CESAR. In: DezaniCiancaglini M, Montanari U, editors. International Symposium on Programming. No. 137 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 1982. p. 337–351. Available from: http://link.springer.com.vezproxy.brunel.ac.uk:2048/chapter/10.1007/3540114947_22.
 8. Carusi A, Burrage K, Rodríguez B. Bridging experiments, models and simulations: an integrative approach to validation in computational cardiac electrophysiology. American Journal of Physiology—Heart and Circulatory Physiology. 2012 Jul;303(2):H144–H155. Available from: http://ajpheart.physiology.org/content/303/2/H144. pmid:22582088
 9. Carusi A. Validation and variability: Dual challenges on the path from systems biology to systems medicine. Studies in History and Philosophy of Science Part C: Studies in History and Philosophy of Biological and Biomedical Sciences. 2014 Dec;48, Part A:28–37. Available from: http://www.sciencedirect.com/science/article/pii/S1369848614001265.
 10.
Sheard T. Accomplishments and Research Challenges in Metaprogramming. In: Taha W, editor. Semantics, Applications, and Implementation of Program Generation. No. 2196 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2001. p. 2–44. Available from: http://link.springer.com/chapter/10.1007/3540448063_2.
 11. Groen D, Zasada SJ, Coveney PV. Survey of Multiscale and Multiphysics Applications and Communities. Computing in Science Engineering. 2014 Mar;16(2):34–43.
 12.
Docker. Docker—Build, Ship, and Run Any App, Anywhere;. Available from: https://www.docker.com/ [cited 20150520].
 13. Beard DA, Neal ML, TabeshSaleki N, Thompson CT, Bassingtwaighte JB, Shimoyama M, et al. Multiscale Modeling and Data Integration in the Virtual Physiological Rat Project. Annals of Biomedical Engineering. 2012 Nov;40(11):2365–2378. Available from: http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3463790/. pmid:22805979
 14. Young RC, Barendse P. Linking Myometrial Physiology to Intrauterine Pressure; How TissueLevel Contractions Create Uterine Contractions of Labor. PLoS Comput Biol. 2014 Oct;10(10):e1003850. pmid:25330227
 15. Ferrell JE Jr, Tsai TYC, Yang Q. Modeling the Cell Cycle: Why Do Certain Circuits Oscillate? Cell. 2011 Mar;144(6):874–885. Available from: http://www.sciencedirect.com/science/article/pii/S0092867411002431. pmid:21414480
 16. An G. Introduction of an agentbased multiscale modular architecture for dynamic knowledge representation of acute inflammation. Theoretical Biology and Medical Modelling. 2008 May;5(1):11. Available from: http://www.tbiomed.com/content/5/1/11/abstract. pmid:18505587
 17.
Ballarini P, Gallet E, Gall PL, Manceny M. Formal Analysis of the Wnt/βcatenin through Statistical Model Checking. In: Margaria T, Steffen B, editors. Leveraging Applications of Formal Methods, Verification and Validation. Specialized Techniques and Applications. No. 8803 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2014. p. 193–207. Available from: http://link.springer.com/chapter/10.1007/9783662452318_14.
 18. Barbuti R, Levi F, Milazzo P, Scatena G. Probabilistic model checking of biological systems with uncertain kinetic rates. Theoretical Computer Science. 2012 Feb;419:2–16. Available from: http://www.sciencedirect.com/science/article/pii/S0304397511008929.
 19. Barnat J, Brim L, Černá I, Dražan S, Fabriková J, Láník J, et al.: A Framework for Parallel Analysis of Biological Models. Electronic Proceedings in Theoretical Computer Science. 2009 Oct;6:31–45. ArXiv: 0910.0928. Available from: http://arxiv.org/abs/0910.0928.
 20. Batt G, Ropers D, Jong Hd, Geiselmann J, Mateescu R, Page M, et al. Validation of qualitative models of genetic regulatory networks by model checking: analysis of the nutritional stress response in Escherichia coli. Bioinformatics. 2005 Jun;21(suppl 1):i19–i28. Available from: http://bioinformatics.oxfordjournals.org/content/21/suppl_1/i19. pmid:15961457
 21. Bernot G, Comet JP, Richard A, Guespin J. Application of formal methods to biological regulatory networks: extending Thomas’ asynchronous logical approach with temporal logic. Journal of Theoretical Biology. 2004 Aug;229(3):339–347. Available from: http://www.sciencedirect.com/science/article/pii/S0022519304001444. pmid:15234201
 22.
Calder M, Vyshemirsky V, Gilbert D, Orton R. Analysis of Signalling Pathways Using Continuous Time Markov Chains. In: Priami C, Plotkin G, editors. Transactions on Computational Systems Biology VI. No. 4220 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2006. p. 44–67. Available from: http://link.springer.com/chapter/10.1007/11880646_3.
 23.
Chabrier N, Fages F. Symbolic Model Checking of Biochemical Networks. In: Priami C, editor. Computational Methods in Systems Biology. No. 2602 in Lecture Notes in Computer Science. Rovereto, Italy: Springer Berlin Heidelberg; 2003. p. 149–162. Available from: http://link.springer.com/chapter/10.1007/3540364811_13.
 24. ChabrierRivier N, Chiaverini M, Danos V, Fages F, Schächter V. Modeling and querying biomolecular interaction networks. Theoretical Computer Science. 2004 Sep;325(1):25–44. Available from: http://www.sciencedirect.com/science/article/pii/S030439750400218X.
 25.
Clarke EM, Faeder JR, Langmead CJ, Harris LA, Jha SK, Legay A. Statistical Model Checking in BioLab: Applications to the Automated Analysis of TCell Receptor Signaling Pathway. In: Heiner M, Uhrmacher AM, editors. Computational Methods in Systems Biology. No. 5307 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2008. p. 231–250. Available from: http://link.springer.com/chapter/10.1007/9783540885627_18.
 26.
David A, Larsen KG, Legay A, Mikučionis M, Poulsen DB, Sedwards S. Runtime Verification of Biological Systems. In: Margaria T, Steffen B, editors. Leveraging Applications of Formal Methods, Verification and Validation. Technologies for Mastering Change. No. 7609 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2012. p. 388–404. Available from: http://link.springer.com/chapter/10.1007/9783642340260_29.
 27. Gong H, Feng L. Computational analysis of the roles of ERGolgi network in the cell cycle. BMC Systems Biology. 2014 Dec;8(Suppl 4):S3. Available from: http://www.biomedcentral.com/17520509/8/S4/S3/comments.
 28. Heath J, Kwiatkowska M, Norman G, Parker D, Tymchyshyn O. Probabilistic model checking of complex biological pathways. Theoretical Computer Science. 2008 Feb;391(3):239–257. Available from: http://www.sciencedirect.com/science/article/pii/S0304397507008572.
 29.
Heiner M, Gilbert D, Donaldson R. Petri Nets for Systems and Synthetic Biology. In: Bernardo M, Degano P, Zavattaro G, editors. Formal Methods for Computational Systems Biology. No. 5016 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2008. p. 215–264. Available from: http://link.springer.com/chapter/10.1007/9783540688945_7.
 30.
Kwiatkowska M, Norman G, Parker D. Stochastic Model Checking. In: Bernardo M, Hillston J, editors. Formal Methods for Performance Evaluation. No. 4486 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2007. p. 220–270. Available from: http://link.springer.com/chapter/10.1007/9783540725220_6.
 31.
Monteiro PT, Wassim AJ, Thieffry D, Chaouiya C. Model Checking Logical Regulatory Networks. In: Discrete Event Systems. vol. 12. Ecole Normale Supérieure de Cachan, Cachan, France: International Federation of Automatic Control; 2014. p. 170–175. Available from: http://www.ifacpapersonline.net/Detailed/65093.html.
 32. Van Goethem S, Jacquet JM, Brim L, Šafránek D. Timed Modelling of Gene Networks with Arbitrarily Precise Expression Discretization. Electronic Notes in Theoretical Computer Science. 2013 Mar;293:67–81. Available from: http://www.sciencedirect.com/science/article/pii/S1571066113000212.
 33.
Barnat J, Brim L, Šafránek D, Vejnár M. Parameter Scanning by Parallel Model Checking with Applications in Systems Biology. In: Second International Workshop on Parallel and Distributed Methods in Verification, 2010 Ninth International Workshop on, and High Performance Computational Systems Biology; 2010. p. 95–104.
 34.
Batt G, Belta C, Weiss R. Model Checking Genetic Regulatory Networks with Parameter Uncertainty. In: Bemporad A, Bicchi A, Buttazzo G, editors. Hybrid Systems: Computation and Control. No. 4416 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2007. p. 61–75. Available from: http://link.springer.com/chapter/10.1007/9783540714934_8.
 35. Batt G, Belta C, Weiss R. Temporal Logic Analysis of Gene Networks Under Parameter Uncertainty. IEEE Transactions on Automatic Control. 2008 Jan;53(Special Issue):215–229.
 36.
Brim L, Češka M, Dražan S, Šafránek D. Exploring Parameter Space of Stochastic Biochemical Systems Using Quantitative Model Checking. In: Sharygina N, Veith H, editors. Computer Aided Verification. No. 8044 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2013. p. 107–123. Available from: http://link.springer.com/chapter/10.1007/9783642397998_7.
 37.
Češka M, Dannenberg F, Kwiatkowska M, Paoletti N. Precise Parameter Synthesis for Stochastic Biochemical Systems. In: Mendes P, Dada JO, Smallbone K, editors. Computational Methods in Systems Biology. No. 8859 in Lecture Notes in Computer Science. Springer International Publishing; 2014. p. 86–98. Available from: http://link.springer.com/chapter/10.1007/9783319129822_7.
 38.
Donaldson R, Gilbert D. A Model Checking Approach to the Parameter Estimation of Biochemical Pathways. In: Heiner M, Uhrmacher AM, editors. Computational Methods in Systems Biology. No. 5307 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2008. p. 269–287. Available from: http://link.springer.com/chapter/10.1007/9783540885627_20.
 39.
Giacobbe M, Guet CC, Gupta A, Henzinger TA, Paixao T, Petrov T. Model Checking Gene Regulatory Networks. arXiv:14107704 [cs, qbio]. 2015 Oct;ArXiv: 1410.7704. Available from: http://arxiv.org/abs/1410.7704.
 40. Jha SK, Langmead CJ. Synthesis and infeasibility analysis for stochastic models of biochemical systems using statistical model checking and abstraction refinement. Theoretical Computer Science. 2011 May;412(21):2162–2187. Available from: http://www.sciencedirect.com/science/article/pii/S0304397511000387.
 41.
Liu B, Kong S, Gao S, Zuliani P, Clarke EM. Parameter Synthesis for Cardiac Cell Hybrid Models Using δDecisions. In: Mendes P, Dada JO, Smallbone K, editors. Computational Methods in Systems Biology. No. 8859 in Lecture Notes in Computer Science. Springer International Publishing; 2014. p. 99–113. Available from: http://link.springer.com/chapter/10.1007/9783319129822_8.
 42.
Palaniappan SK, Gyori BM, Liu B, Hsu D, Thiagarajan PS. Statistical Model Checking Based Calibration and Analysis of Biopathway Models. In: Gupta A, Henzinger TA, editors. Computational Methods in Systems Biology. No. 8130 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2013. p. 120–134. Available from: http://link.springer.com/chapter/10.1007/9783642407086_10.
 43.
Calzone L, ChabrierRivier N, Fages F, Soliman S. Machine Learning Biochemical Networks from Temporal Logic Properties. In: Priami C, Plotkin G, editors. Transactions on Computational Systems Biology VI. No. 4220 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2006. p. 68–94. Available from: http://link.springer.com/chapter/10.1007/11880646_4.
 44.
Fages F, Rizk A. From ModelChecking to Temporal Logic Constraint Solving. In: Gent IP, editor. Principles and Practice of Constraint Programming—CP 2009. No. 5732 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2009. p. 319–334. Available from: http://link.springer.com/chapter/10.1007/9783642042447_26.
 45. Česka M, Šafránek D, Dražan S, Brim L. Robustness Analysis of Stochastic Biochemical Systems. PLoS ONE. 2014 Apr;9(4):e94553. pmid:24751941
 46.
Rizk A, Batt G, Fages F, Soliman S. On a Continuous Degree of Satisfaction of Temporal Logic Formulae with Applications to Systems Biology. In: Heiner M, Uhrmacher AM, editors. Computational Methods in Systems Biology. No. 5307 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2008. p. 251–268. Available from: http://link.springer.com/chapter/10.1007/9783540885627_19.
 47. Rizk A, Batt G, Fages F, Soliman S. A general computational method for robustness analysis with applications to synthetic gene networks. Bioinformatics. 2009 Jun;25(12):i169–i178. Available from: http://bioinformatics.oxfordjournals.org/content/25/12/i169. pmid:19477984
 48.
Brim L, Češka M, Šafránek D. Model Checking of Biological Systems. In: Bernardo M, Vink Ed, Pierro AD, Wiklicky H, editors. Formal Methods for Dynamical Systems. No. 7938 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2013. p. 63–112. Available from: http://link.springer.com/chapter/10.1007/9783642388743_3.
 49.
Fisher J, Piterman N. Model Checking in Biology. In: Kulkarni VV, Stan GB, Raman K, editors. A Systems Theoretic Approach to Systems and Synthetic Biology I: Models and System Characterizations. Springer Netherlands; 2014. p. 255–279. Available from: http://link.springer.com/chapter/10.1007/9789401790413_10.
 50. Zuliani P. Statistical model checking for biological applications. International Journal on Software Tools for Technology Transfer. 2014 Aug;p. 1–10. Available from: http://link.springer.com/article/10.1007/s1000901403430.
 51.
Maria ED, Fages F, Soliman S. On Coupling Models Using ModelChecking: Effects of Irinotecan Injections on the Mammalian Cell Cycle. In: Degano P, Gorrieri R, editors. Computational Methods in Systems Biology. No. 5688 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2009. p. 142–157. Available from: http://link.springer.com/chapter/10.1007/9783642038457_10.
 52. Ciocchetta F, Gilmore S, Guerriero ML, Hillston J. Integrated Simulation and ModelChecking for the Analysis of Biochemical Systems. Electronic Notes in Theoretical Computer Science. 2009 Mar;232:17–38. Available from: http://www.sciencedirect.com/science/article/pii/S157106610900053X.
 53.
Yordanov B, Belta C. A formal verification approach to the design of synthetic gene networks. In: 2011 50th IEEE Conference on Decision and Control and European Control Conference (CDCECC); 2011. p. 4873–4878.
 54.
Gilbert D, Heiner M, Lehrack S. A Unifying Framework for Modelling and Analysing Biochemical Pathways Using Petri Nets. In: Calder M, Gilmore S, editors. Computational Methods in Systems Biology. No. 4695 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2007. p. 200–216. Available from: http://link.springer.com/chapter/10.1007/9783540751403_14.
 55.
Gong H, Zuliani P, Komuravelli A, Faeder JR, Clarke EM. Computational Modeling and Verification of Signaling Pathways in Cancer. In: Horimoto K, Nakatsui M, Popov N, editors. Algebraic and Numeric Biology. No. 6479 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2012. p. 117–135. Available from: http://link.springer.com/chapter/10.1007/9783642280672_7.
 56.
Guerriero ML. Qualitative and Quantitative Analysis of a BioPEPA Model of the Gp130/JAK/STAT Signalling Pathway. In: Priami C, Back RJ, Petre I, editors. Transactions on Computational Systems Biology XI. No. 5750 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2009. p. 90–115. Available from: http://link.springer.com/chapter/10.1007/9783642041860_5.
 57. Pârvu O, Gilbert D. Automatic validation of computational models using pseudo3D spatiotemporal model checking. BMC Systems Biology. 2014 Dec;8(1):124. Available from: http://www.biomedcentral.com/17520509/8/124/abstract. pmid:25440773
 58. Southern J, PittFrancis J, Whiteley J, Stokeley D, Kobashi H, Nobes R, et al. Multiscale computational modelling in biology and physiology. Progress in Biophysics and Molecular Biology. 2008 Jan;96(1–3):60–89. Available from: http://www.sciencedirect.com/science/article/pii/S0079610707000673. pmid:17888502
 59. Younes HL, Simmons RG. Statistical probabilistic model checking with a focus on timebounded properties. Information and Computation. 2006 Sep;204(9):1368–1409. Available from: http://www.sciencedirect.com/science/article/pii/S0890540106000678.
 60. Hansson H, Jonsson B. A logic for reasoning about time and reliability. Formal Aspects of Computing. 1994 Sep;6(5):512–535. Available from: http://link.springer.com/article/10.1007/BF01211866.
 61.
Baier C, Katoen JP, Hermanns H. Approximative Symbolic Model Checking of ContinuousTime Markov Chains. In: Baeten JCM, Mauw S, editors. CONCUR’99 Concurrency Theory. No. 1664 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 1999. p. 146–161. Available from: http://link.springer.com/chapter/10.1007/3540483209_12.
 62.
Bradski G, Kaehler A. Learning OpenCV: Computer Vision with the OpenCV Library. Cambridge, MA: O’Reilly; 2008.
 63. Tran TN, Drab K, Daszykowski M. Revised DBSCAN algorithm to cluster data with dense adjacent clusters. Chemometrics and Intelligent Laboratory Systems. 2013 Jan;120:92–96. Available from: http://www.sciencedirect.com/science/article/pii/S0169743912002249.
 64.
Aziz A, Sanwal K, Singhal V, Brayton R. Verifying Continuous Time Markov Chains. In: CAV. vol. 1102 of Lecture Notes in Computer Science. Springer; 1996. p. 269–276.
 65.
Hérault T, Lassaigne R, Magniette F, Peyronnet S. Approximate Probabilistic Model Checking. In: Steffen B, Levi G, editors. Verification, Model Checking, and Abstract Interpretation. No. 2937 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2004. p. 73–84. Available from: http://link.springer.com/chapter/10.1007/9783540246220_8.
 66. Wald A. Sequential Tests of Statistical Hypotheses. The Annals of Mathematical Statistics. 1945 Jun;16(2):117–186. Available from: http://projecteuclid.org/DPubS?service=UI&version=1.0&verb=Display&handle=euclid.aoms/1177731118.
 67.
Younes HLS. Verification and Planning for Stochastic Processes with Asynchronous Events [Doctor of Philosophy]. Carnegie Mellon. Pittsburgh; 2005.
 68. Koh CH, Palaniappan SK, Thiagarajan PS, Wong L. Improved statistical model checking methods for pathway analysis. BMC Bioinformatics. 2012 Dec;13(Suppl 17):S15. Available from: http://www.biomedcentral.com/14712105/13/S17/S15/abstract. pmid:23282174
 69.
Sen K, Viswanathan M, Agha G. Statistical Model Checking of BlackBox Probabilistic Systems. In: Alur R, Peled DA, editors. Computer Aided Verification. No. 3114 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2004. p. 202–215. Available from: http://link.springer.com/chapter/10.1007/9783540278139_16.
 70.
Younes HLS. Probabilistic Verification for “BlackBox” Systems. In: Etessami K, Rajamani SK, editors. Computer Aided Verification. No. 3576 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2005. p. 253–265. Available from: http://link.springer.com/chapter/10.1007/11513988_25.
 71.
Langmead CJ. Generalized Queries and Bayesian Statistical Model Checking in Dynamic Bayesian Networks: Application to Personalized Medicine. In: Proc. of the 8th International Conference on Computational Systems Bioinformatics (CSB). California: Life Sciences Society; 2009. p. 201–212.
 72.
Jha SK, Clarke EM, Langmead CJ, Legay A, Platzer A, Zuliani P. A Bayesian Approach to Model Checking Biological Systems. In: Degano P, Gorrieri R, editors. Computational Methods in Systems Biology. No. 5688 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2009. p. 218–234. Available from: http://link.springer.com/chapter/10.1007/9783642038457_15.
 73.
Jha SK, Clarke EM, Langmead CJ, Legay A, Platzer A, Zuliani P. Statistical Model Checking for Complex Stochastic Models in Systems Biology. Carnegie Mellon University; 2009. Available from: http://repository.cmu.edu/cgi/viewcontent.cgi?article=2244&context=compsci.
 74.
Ballarini P, Djafri H, Duflot M, Haddad S, Pekergin N. COSMOS: A Statistical Model Checker for the Hybrid Automata Stochastic Logic. In: 2011 Eighth International Conference on Quantitative Evaluation of Systems (QEST); 2011. p. 143–144.
 75.
Jegourel C, Legay A, Sedwards S. A Platform for High Performance Statistical Model Checking—PLASMA. In: Flanagan C, König B, editors. Tools and Algorithms for the Construction and Analysis of Systems. No. 7214 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2012. p. 498–503. Available from: http://link.springer.com/chapter/10.1007/9783642287565_37.
 76.
Kwiatkowska M, Norman G, Parker D. 4.0: Verification of Probabilistic RealTime Systems. In: Gopalakrishnan G, Qadeer S, editors. Computer Aided Verification. No. 6806 in Lecture Notes in Computer Science. Snowbird, UT, USA: Springer Berlin Heidelberg; 2011. p. 585–591. Available from: http://link.springer.com/chapter/10.1007/9783642221101_47.
 77.
Bulychev PE, David A, Larsen KG, Mikucionis M, Poulsen DB, Legay A, et al. UPPAALSMC: Statistical Model Checking for Priced Timed Automata. In: Proceedings 10th Workshop on Quantitative Aspects of Programming Languages and Systems, QAPL 2012, Tallinn, Estonia, 31 March and 1 April 2012.; 2012. p. 1–16. Available from: http://dx.doi.org/10.4204/EPTCS.85.1.
 78.
Younes HLS. Ymer: A Statistical Model Checker. In: Etessami K, Rajamani SK, editors. Computer Aided Verification. No. 3576 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2005. p. 429–433. Available from: http://link.springer.com/chapter/10.1007/11513988_43.
 79.
Wilkinson DJ. Stochastic Modelling for Systems Biology, Second Edition. 2nd ed. Boca Raton: CRC Press; 2011.
 80. Smith BW, Chase JG, Nokes RI, Shaw GM, Wake G. Minimal haemodynamic system model including ventricular interaction and valve dynamics. Medical Engineering & Physics. 2004 Mar;26(2):131–139.
 81. Bugenhagen SM, Cowley AW, Beard DA. Identifying physiological origins of baroreflex dysfunction in saltsensitive hypertension in the Dahl SS rat. Physiological Genomics. 2010 Jun;42(1):23–41. pmid:20354102
 82. Starruß J, Back Wd, Brusch L, Deutsch A. Morpheus: a userfriendly modeling environment for multiscale and multicellular systems biology. Bioinformatics. 2014 May;30(9):1331–1332. Available from: http://bioinformatics.oxfordjournals.org/content/30/9/1331. pmid:24443380
 83.
Starruß, J, Back Wd. Morpheus examples;. Available from: http://imc.zih.tudresden.de/wiki/morpheus/doku.php?id=examples:examples [cited 20150520].
 84. Scott A, Khan KM, Cook JL, Duronio V. What is “inflammation”? Are we ready to move beyond Celsus? British Journal of Sports Medicine. 2004 Jun;38(3):248–249. Available from: http://bjsm.bmj.com/content/38/3/248. pmid:15155418
 85. Van de Weghe N, de Roo B, Qiang Y, Versichele M, Neutens T, de Maeyer P. The continuous spatiotemporal model (CSTM) as an exhaustive framework for multiscale spatiotemporal analysis. International Journal of Geographical Information Science. 2014;28(5):1047–1060.
 86. Grosu R, Smolka SA, Corradini F, Wasilewska A, Entcheva E, Bartocci E. Learning and Detecting Emergent Behavior in Networks of Cardiac Myocytes. Commun ACM. 2009 Mar;52(3):97–105. Available from: http://doi.acm.org/10.1145/1467247.1467271.
 87.
Gol EA, Bartocci E, Belta C. A Formal Methods Approach to Pattern Synthesis in Reaction Diffusion Systems. arXiv:14095671 [cs]. 2014 Sep;arXiv: 1409.5671. Available from: http://arxiv.org/abs/1409.5671.
 88.
Haghighi I, Jones A, Kong Z, Bartocci E, Gros R, Belta C. SpaTeL: A Novel Spatialtemporal Logic and Its Applications to Networked Systems. In: Proceedings of the 18th International Conference on Hybrid Systems: Computation and Control. HSCC ’15. New York, NY, USA: ACM; 2015. p. 189–198. Available from: http://doi.acm.org/10.1145/2728606.2728633.