# Monte Carlo Based Statistical Model Checking of Cyber-Physical Systems: A Review

^{*}

## Abstract

**:**

## 1. Introduction

## 2. Cyber-Physical Systems

#### 2.1. Modelling the Environment

**Definition**

**1**

**.**A time set T is a subgroup of ($\mathbb{R}$, +).

**Definition**

**2**

**.**Given a set U (of input values) and a time set T, a space of input functions $\mathcal{U}$ on (U, T) is a subset of ${U}^{T}$ = $\left\{u\phantom{\rule{0.277778em}{0ex}}\right|\phantom{\rule{0.277778em}{0ex}}u:T\to U\}$.

#### 2.2. Modelling the SUV

**Definition**

**3**

**.**Let $\mathcal{I}$ be a time interval (i.e., an interval $\mathcal{I}$⊆T). Given a function $u\in {U}^{\mathcal{I}}$ (see Definition 2) and two positive real numbers ${t}_{1}\le {t}_{2}$, we denote with $u{\mid}_{[{t}_{1},{t}_{2})}$ the restriction of u to the interval $[{t}_{1},{t}_{2})$, i.e., the function $u{\mid}_{[{t}_{1},{t}_{2})}:[{t}_{1},{t}_{2})\to \mathcal{U}$, such that $u{\mid}_{[{t}_{1},{t}_{2})}\left(t\right)=u\left(t\right)$ for all $t\in [{t}_{1},{t}_{2})$. We denote ${\mathcal{U}}^{[{t}_{1},{t}_{2})}$ the restriction of ${\mathcal{U}}^{\mathcal{I}}$ to the domain $[{t}_{1},{t}_{2})$. That is, ${\mathcal{U}}^{[{t}_{1},{t}_{2})}$ = $\left\{u{\mid}_{[{t}_{1},{t}_{2})}\phantom{\rule{0.277778em}{0ex}}\right|\phantom{\rule{0.277778em}{0ex}}u\in {\mathcal{U}}^{\mathcal{I}}\}$.

**Definition**

**4**

**.**A Dynamical System, $\mathcal{H}$ is a tuple (X, U, Y, T, $\mathcal{U}$, φ, ψ), where:

- X, the space of state values of $\mathcal{H}$, is a non-empty set whose elements are said states of $\mathcal{H}$;
- U, the space of input values of $\mathcal{H}$, is a non-empty set whose elements are said input values for $\mathcal{H}$;
- Y, the space of output values of $\mathcal{H}$, is a non-empty set whose elements are said output values for $\mathcal{H}$;
- T is a time set;
- $\mathcal{U}$, the space of input functions of $\mathcal{H}$, is a non-empty subset of ${U}^{T}$;
- $\phi :T\times T\times X\times \mathcal{U}\to X$, is the transition map of $\mathcal{H}$;
- $\psi :T\times X\times U\to Y$ is the observation function of $\mathcal{H}$.

- Causality. For all ${t}_{0}\in T$, $t\ge {t}_{0}$, ${x}_{0}\in X$, $u,{u}^{\prime}\in \mathcal{U}$:$$u{\mid}_{[{t}_{0},t)}={u}^{\prime}{\mid}_{[{t}_{0},t)}\Rightarrow \phi (t,{t}_{0},{x}_{0},u{\mid}_{[{t}_{0},t)})=\phi (t,{t}_{0},{x}_{0},{u}^{\prime}{\mid}_{[{t}_{0},t)})$$
- Consistency. For all $t\in T$, ${x}_{0}\in X$, $u,\in \mathcal{U}$:$$\phi (t,t,{x}_{0},u)={x}_{0}$$
- Semigroup. For all ${t}_{0}\in T$, $t>{t}_{1}>{t}_{0}$, ${x}_{0}\in X$, $u\in \mathcal{U}$:$$\phi (t,{t}_{0},{x}_{0},u{\mid}_{[{t}_{0},t)})=\phi (t,{t}_{1},\phi ({t}_{1},{t}_{0},{x}_{0},u{\mid}_{[{t}_{0},{t}_{1})}),u{\mid}_{[{t}_{1},t)})$$

#### 2.3. Modelling the Specifications

**Notation**

**1**

**.**Let T be a time set and $\mathcal{U}\subseteq {U}^{T}$, $\mathcal{V}\subseteq {V}^{T}$ be input spaces. By abuse of language we denote with $\mathcal{U}\times \mathcal{V}$ the set $\{\theta \in {(U\times V)}^{T}\phantom{\rule{0.277778em}{0ex}}|\phantom{\rule{0.277778em}{0ex}}$ $\exists u\in \mathcal{U},v\in \mathcal{V}\phantom{\rule{0.277778em}{0ex}}s.t.\phantom{\rule{0.277778em}{0ex}}\theta \left(t\right)=\left(u\right(t),v(t\left)\right)\}$.

**Definition**

**5**

**.**Let $\mathcal{H}$ = (X, U, Y, T, $\mathcal{U}$, φ, ψ) be a system. A specification for $\mathcal{H}$ is a system $\mathcal{Q}$ = (Z, $U\times X$, $\mathbb{R}$, T, $\mathcal{U}\times {X}^{T}$, μ, θ), where:

- Z is the space of state values of the system Q;
- $U\times X$ is the space of input values of the system Q;
- $\mathbb{R}$ is the space of output values of the system Q;
- T is the time set of the system Q (and $\mathcal{H}$);
- $\mathcal{U}\times {X}^{T}$ is the space of input functions of Q;
- μ is the transition map of Q; and,
- θ is the observation function of Q.

**Example**

**1**

**.**Let $\mathcal{H}$ be the system defined by the ODE

- X = U = Y = T = $\mathbb{R}$;
- $\mathcal{U}$ is the set of constant functions from T to U;
- $\phi ({t}_{0},t,{x}_{0},u)$ = ${e}^{-3(t-{t}_{0})}({x}_{0}-\frac{u}{3})+\frac{u}{3}$;
- $\eta (t,\overline{x},u)$ = $\overline{x}$.

**Definition**

**6**

**.**Let $\mathcal{H}$ be a system and $\mathcal{Q}$ be a specification for it. The ($\mathcal{H}$, $\mathcal{Q}$) monitored system is the system $\mathcal{M}$ = ($X\times Z$, U, $\mathbb{R}$, T, $\mathcal{U}$, Φ, Ψ) where:

**Example**

**2**

**.**Using the systems $\mathcal{H}$ and $\mathcal{Q}$ from Example 1, we have that the monitored system ($\mathcal{H}$, $\mathcal{Q}$) is the system $\mathcal{M}$ = ($X\times Z$, U, $\mathbb{R}$, T, $\mathcal{U}$, Φ, Ψ) with:

- X, Z, U, T and $\mathcal{U}$ as in Example 1;
- $\mathrm{\Phi}(t,{t}_{0},({x}_{0},{z}_{0}),u)$ = (${e}^{-3(t-{t}_{0})}({x}_{0}-\frac{u}{3})+\frac{u}{3}$, ${z}_{0}$ + ${\int}_{{t}_{0}}^{t}{(({e}^{-3(\tau -{t}_{0})}({x}_{0}-\frac{u}{3})+\frac{u}{3})-\frac{u}{3})}^{2}d\tau $);
- $\mathrm{\Psi}(t,(\overline{x},\overline{z}),u)$ = $\overline{z}$

**Definition**

**7**

**.**Let $\mathcal{H}$ be a system, $\mathcal{Q}$ be a specification for $\mathcal{H}$ and ${t}_{0}\in T$ a time instant. We say that $\mathcal{H}$ satisfies its specification $\mathcal{Q}$ from ${t}_{0}$ if for all $({x}_{0},{z}_{0})\in (X\times Z)$, for all $u\in \mathcal{U}$, for all $t>{t}_{0}$, we have that: $\mathrm{\Psi}(t,\mathrm{\Phi}(t,{t}_{0},({x}_{0},{z}_{0}),u),u\left(t\right))>0$.

#### 2.4. Statistical Model Checking

## 3. Background

#### 3.1. System Models

#### 3.2. System Properties

## 4. Statistical Inference Approaches

#### 4.1. Hypothesis Testing

#### 4.2. Estimation

#### 4.3. Bayesian Analysis

#### 4.4. Summary of the Algorithms Used for HT and Estimation

## 5. Statistical Model Checking Tools

#### 5.1. (P)VeStA

**Model and Property.**This tool can verify properties expressed as CSL/PCTL formula (Section 3.2), against probabilistic systems that are specified as CTMCs or DTMCs (Section 3.1). VeStA is able also to statistically evaluate, in a Monte Carlo based way, the expected value of properties expressed in QuaTEx (Section 3.2), over the observations performed on probabilistic rewrite theories models. In this last case, models are described through PMAUDE, which is an executable algebraic specification language [35].

**Statistical Inference approach.**VeStA performs SMC by using classic statistical hypothesis testing (Section 4.1), rather than sequential hypothesis testing, according to the algorithm described in [63]. In particular, VeStA implements the Gauss-SSP hypothesis testing (Section 4.1), which is a fixed sample size version of the SPRT algorithm of Wald (Section 4.1). Consequently, it is easily parallelizable. PVeStA [64] is the tool extending and parallelizing the SMC algorithms implemented in VeStA.

#### 5.2. MultiVeStA

**Model and property.**Properties to be verified are expressed in Multi Quantitative Temporal Expressions (MultiQuaTEx) query language, which extends QuaTEx (Section 3.2) and allows for querying more variables at a time through multiple observations on the same simulation. This represents an improvement of the performance obtained when evaluating several expressions. The supported SUV models are Discrete Event Systems (DESs).

**Statistical Inference approach.**MultiVeStA performs an estimation of the expected value of MultiQuaTEx properties by HT the Chow–Robbins method (Section 4.1).

#### 5.3. Simulation-Based SMC for Hybrid Systems

**Model and Properties.**Plasma Lab accepts properties described as BLTL extended with customized temporal operators, against stochastic models such as CTMCs and MDPs (Section 3.1).

**Statistical Inference approach.**Plasma Lab can verify both qualitative and quantitative properties. In fact, the tool implements, among others, the following algorithms: the Monte Carlo probability estimation based on the Chernoff–Hoeffding bound [46], to decide a priori the number of simulations to execute; the SPRT algorithm for hypothesis testing; ISA when the properties are “rare” (Section 4.1).

#### 5.4. APMC

**Model and property.**APMC is used to verify quantitative properties over fully probabilistic transitions systems or DTMCs (Section 3.1). In 2006, APMC has been extended to manage also CTMCs (see [74]). Properties to be checked are expressed as LTL (Section 3.2) formulas.

**Inference approach.**This tool performs estimation through a Monte-Carlo sampling technique, based on the Chernoff–Hoeffding bound (Section 4.1), which is naturally parallelizable.

#### 5.5. PRISM

**Model and property.**DTMCs, CTMCs, MDPs models (Section 3.1) are described through the PRISM modelling language, while the properties to be verified are defined by several probabilistic temporal logics, incorporating PCTL, PCTL*, CSL. and LTL (Section 3.2).

**Statistical Inference approach.**The tool uses the SPRT (Section 4.1) in order to verify qualitative properties and the following algorithms to verify the quantitative properties (Section 4.2): CI method, Asymptotic Confidence Interval (ACI) method, and Approximate Probabilistic Model Checking (APMC) method. All of these algorithms precompute the number of samples to be generated. See [76] for an updated detailed description.

#### 5.6. Ymer

**Model and property.**This tool can verify CSL properties against CTMCs and PCTL properties against DTMCs (Section 3.1 and Section 3.2).

**Statistical Inference approach.**Ymer implements both sampling with a fixed number of observations and sequential acceptance sampling, performed through the SPRT method (Section 4.1). Ymer includes support for distributed acceptance sampling, i.e., the use of multiple machines to generate observations, which can result in significant speedup as each observation can be generated independently. The work in [78] also implements, in Ymer, estimation through two different approaches, the first based on Chernoff C.I and the second based on the Chow–Robbins sequential method.

#### 5.7. UPPAAL-SMC

**Model and Properties.**UPPAAL-SMC implements techniques in order to verify both quantitative and qualitative properties of timed and hybrid systems with a stochastic behavior, whose dynamic can be specified by SHA, effectively defining ODEs, and by STA [32]. Properties are expressed through a weighted extension of the temporal logic MITL (Section 3.2).

**Statistical Inference approach.**This tool carries out quantitative properties verification through a Monte Carlo based estimation algorithm using the Chernoff–Hoeffding bound (Section 4.1), where the number of samples to be generated is predetermined. Qualitative properties are verified through the SPRT algorithm (Section 4.1).

#### 5.8. COSMOS

`++`.

**Model and property.**This tool analyzes DESPs, a class of stochastic models, including CTMCs, represented in the form of a GSPN (Section 3.1). Properties to be verified are expressed as HASL formulae (Section 3.2).

**Statistical Inference approach.**COSMOS relies on Confidence Interval based methods to estimate the probability that the property under verification holds, by implementing two possible approaches: the static sample size estimation, based on the Chernoff–Hoeffding bound (Section 4.1), where the sample size is fixed a priori; the dynamic sample size estimation, where the sample size depends on a stopping condition, such as that provided by Chow and Robbins (Section 4.1). COSMOS also provides the SPRT method.

#### 5.9. GreatSPN

**Model and Properties.**GreatSPN can verify: CTL properties against models represented as GSPN or its colored extension, defined as Stochastic Symmetric Nets (SSN); ${CSL}^{TA}$ properties (Section 3.2) against CTMCs.

**Statistical Inference approach.**The CTL model checker of GreatSPN verifies CTL properties by numeric symbolic algorithms (see Section 3). The ${CSL}^{TA}$ module is a probabilistic model checker for estimation of properties that can a.so interact with external tools, like PRISM (Section 5.5) and MRMC (Section 5.10).

#### 5.10. MRMC

**Model and property.**The tool can verify CSL and PCTL properties (Section 3.2) against CTMCs and DTMCs (Section 3.1).

**Statistical Inference approach.**MRMC performs probability estimation by the Confidence interval method that is based on the Chow–Robbins test (Section 4.1), with a dynamic sample size. The only problem is that since MRMC always loads Markov chain representation completely in memory, it can lose the benefits deriving from simulating instead of using numerical techniques.

#### 5.11. SBIP

**Model and property.**It supports DTMC, CTMC, and GSMP (Section 3.1) as the input models. The properties to be verified can be expressed as PBLTL and MTL formula (Section 3.2).

**Statistical Inference approach.**The tool implements several statistical testing algorithms for stochastic systems verification of both qualitative and quantitative properties. The qualitative properties are checked through one of the following algorithms: Single Sampling Plan (SSP) [3], where the number of samples is predetermined, and SPRT, where the number of samples is generated at runtime (Section 4.1). The quantitative properties are verified through a Probability Estimation procedure, based on the Chernoff–Hoeffding bound (Section 4.1).

#### 5.12. MARCIE

**Model and property.**This tool can verify both quantitative and qualitative properties over systems that are modelled as GSPN, including CTMC (Section 3.1). Properties can be defined by CSL, Continuous Stochastic Reward Logic (CSRL) or PLTLc. CSRL includes CSL and adds reward intervals to the temporal operators (Section 3.2).

**Statistical Inference approach.**The component of MARCIE that is dedicated to estimation implements an algorithm performing several simulation runs depending on the variance of the system stochastic behavior and determined through a Confidence interval method that is based on the Chernoff–Hoeffding bound (Section 4.1).

#### 5.13. Modest Toolset Discrete Event Simulator: Modes

`modes`tool, a discrete event simulator, which is based on the Modest language, is available. From version $1.4$ it offers SMC functionalities.

**Model and property.**modes supports the analysis of SHA, STA, PTA, and MDP. THe properties to be verified are expressed in Modest language.

**Statistical Inference approach.**modes verifies quantitative properties through a confidence interval based algorithm, which allows for deciding at runtime how many simulations to do; qualitative properties through the SPRT method (Section 4.1).

#### 5.14. APD Analyser

**Model and property.**The input model consists of a probabilistic model of end-user deviations with respect to their expected behaviors. The tool computes a single domain-specific property: the APD probability distribution in Electric Distribution Networks. Further post-processing of this distribution allows for the Distribution System Operators (DSO) to compute the safety properties of interest.

**Statistical Inference approach.**As an exact computation of the required APD probability distribution is computationally prohibitive, because of its exponential dependence on the number of users, APD-Analyser computes Monte Carlo based $(\u03f5,\delta )$-approximation, through an efficient High-Performance Computing (HPC)-based implementation of the $\mathcal{OAA}$ algorithm, discussed in Section 4.2.

#### 5.15. ViP Generator

**Model and property.**The input model is a system of ODEs and the boolean property to be satisfied is the completeness of the virtual patient set generated.

**Statistical Inference approach.**HT (Section 4.1) is used to check, with high statistical confidence, the completeness of the virtual patient set S generated so far. After defining a probability threshold $\u03f5$ and a confidence threshold $\delta $, the SMC algorithm in [92] randomly extracts, from a parameter space $\mathrm{\Lambda}$, a sample $\left\{\lambda \right\}$ that, if admissible, is added to S. On the basis of [52,53], the algorithm ends when S remains unchanged after $N=ln\delta /ln(1-\u03f5)$ attempts.

#### 5.16. SAM

**Model and Properties.**Systems are specified in StoKLAIM (Section 3.1). The properties to be verified are expressed through MoSL (Section 3.2).

**Statistical Inference approach.**SAM performs the estimation of quantitative properties.

#### 5.17. Bayesian Tool

**Model and property.**The models to be analyzed are DTHS (see Section 2) defined as Stateflow/Simulink models, while properties are expressed as BLTL formula.

**Statistical Inference approach.**The Bayesian analysis includes: (i) an algorithm to perform SMC using Bayesian hypothesis testing in order to verify BLTL properties against Stateflow/Simulink models with hybrid features; (ii) a Bayesian estimation algorithm, to compute an interval estimate of the probability that a BLTL formula is satisfied in a stochastic hybrid system model.

#### 5.18. Tool Comparison

## 6. Discussion

## 7. Conclusions

## Author Contributions

## Funding

## Acknowledgments

## Conflicts of Interest

## References

- Alur, R. Principles of Cyber-Physical Systems; MIT Press: Cambridge, MA, USA, 2015. [Google Scholar]
- Clarke, E.; Wing, J.M. Formal Methods: State of the Art and Future Directions. Comput. Surv. (CSUR)
**1996**, 28, 626–643. [Google Scholar] [CrossRef] - Legay, A.; Delahaye, B.; Bensalem, S. Statistical Model Checking: An Overview. In Runtime Verification, First International Conference, RV 2010, St. Julians, Malta, November 2010. Proceedings; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 2010; Volume 6418, pp. 122–135. [Google Scholar] [CrossRef][Green Version]
- Agha, G.; Palmskog, K. A Survey of Statistical Model Checking. ACM Trans. Model. Comput. Simul.
**2018**, 28, 6:1–6:39. [Google Scholar] [CrossRef] - Reijsbergen, D.; de Boer, P.T.; Scheinhardt, W.; Haverkort, B. On hypothesis testing for statistical model checking. Int. J. Softw. Tools Technol. Transf.
**2015**, 17, 377–395. [Google Scholar] [CrossRef] - Bakir, M.; Gheorghe, M.; Konur, S.; Stannett, M. Comparative Analysis of Statistical Model Checking Tools. In Proceedings of the Membrane Computing: 17th International Conference (CMC 2016), Milan, Italy, 25–29 July 2016. [Google Scholar] [CrossRef]
- Zuliani, P.; Platzer, A.; Clarke, E. Bayesian Statistical Model Checking with Application to Stateflow/Simulink Verification. Form. Methods Syst. Des.
**2013**, 43, 338–367. [Google Scholar] [CrossRef][Green Version] - Devroye, L. Non-Uniform Random Variate Generation; Springer: Berlin/Heidelberg, Germany, 1986. [Google Scholar]
- Simulink. Available online: http://www.mathworks.com (accessed on 18 December 2020).
- Dymola. Available online: http://www.claytex.com/products/dymola/ (accessed on 18 December 2020).
- SimulationX. Available online: http://www.simulationx.com (accessed on 18 December 2020).
- Wolfram Research, Inc. SystemModeler. Available online: http://www.wolfram.com/system-modeler (accessed on 18 December 2020).
- Zhou, F.; Chen, L.; Wu, Y.; Ding, J.; Zhao, J.; Zhang, Y. MWorks: A Modern IDE for Modeling and Simulation of Multi-domain Physical Systems Based on Modelica. In Proceedings of the 5th International Modelica Conference (Modelica 2006), Vienna, Austria, 4–5 September 2006. [Google Scholar]
- OpenModelica. Available online: http://www.openmodelica.org (accessed on 18 December 2020).
- Kwiatkowska, M.; Norman, G.; Parker, D. PRISM 4.0: Verification of Probabilistic Real-time Systems. In Proceedings of the 23rd International Conference on Computer Aided Verification (CAV 2011), Snowbird, UT, USA, 14–20 July 2011; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2011; Volume 6806, pp. 585–591. [Google Scholar]
- McMillan, K. The SMV System. In Symbolic Model Checking; Springer: Berlin/Heidelberg, Germany, 1993; pp. 61–85. [Google Scholar]
- Baier, C.; Katoen, J.P. Principles of Model Checking (Representation and Mind Series); MIT Press: Cambridge, MA, USA, 2008. [Google Scholar]
- Sontag, E. Mathematical Control Theory: Deterministic Finite Dimensional Systems, 2nd ed.; Springer: Berlin/Heidelberg, Germany, 1998. [Google Scholar]
- Cellier, F.; Kofman, E. Continuous System Simulation; Springer: Berlin/Heidelberg, Germany, 2010. [Google Scholar]
- Pinisetty, S.; Jéron, T.; Tripakis, S.; Falcone, Y.; Marchand, H.; Preoteasa, V. Predictive runtime verification of timed properties. J. Syst. Softw.
**2017**, 132, 353–365. [Google Scholar] [CrossRef][Green Version] - Thati, P.; Roşu, G. Monitoring Algorithms for Metric Temporal Logic Specifications. In Runtime Verification, Fourth Workshop on Runtime Verification 2004, RV 2004, Barcelona, Spain, April 2004. Proceedings; Electronic Notes in Theoretical Computer Science; Elsevier: Amsterdam, The Netherlands, 2004; Volume 113, pp. 145–162. [Google Scholar] [CrossRef][Green Version]
- Bauer, A.; Leucker, M.; Schallhart, C. Runtime Verification for LTL and TLTL. ACM Trans. Softw. Eng. Methodol.
**2011**, 20. [Google Scholar] [CrossRef] - Abbas, H.; Fainekos, G.; Sankaranarayanan, S.; Ivančić, F.; Gupta, A. Probabilistic Temporal Logic Falsification of Cyber-Physical Systems. ACM Trans. Embed. Comput. Syst.
**2013**, 12, 95:1–95:30. [Google Scholar] [CrossRef][Green Version] - Katoen, J. The Probabilistic Model Checking Landscape. In 31st Annual ACM/IEEE Symposium on Logic in Computer Science (LICS 2016); Association for Computing Machinery: New York, NY, USA, 2016; pp. 31–45. [Google Scholar] [CrossRef]
- Younes, H.; Kwiatkowska, M.; Norman, G.; Parker, D. Numerical vs. Statistical Probabilistic Model Checking. Int. J. Softw. Tools Technol. Transf.
**2006**, 8, 216–228. [Google Scholar] [CrossRef] - Baier, C.; Haverkort, B.; Hermanns, H.; Katoen, J.P. Model-checking algorithms for continous-time markov chains. IEEE Trans. Softw. Eng.
**2003**, 29, 524–541. [Google Scholar] [CrossRef][Green Version] - Younes, H.; Simmons, R. Probabilistic Verification of Discrete Event Systems Using Acceptance Sampling. In Proceedings of the 14th International Conference on Computer Aided Verification (CAV 2002), Copenhagen, Denmark, 27–31 July 2002; Springer: Berlin/Heidelberg, Germany, 2002; Volume 2404, Lecture Notes in Computer Science. pp. 223–235. [Google Scholar] [CrossRef][Green Version]
- Sen, K.; Viswanathan, M.; Agha, G. Statistical model checking of black-box probabilistic systems. In Proceedings of the 16th International Conference on Computer Aided Verification (CAV 2004), Boston, MA, USA, 13–17 July 2004; Springer: Berlin/Heidelberg, Germany, 2004; Volume 3114, Lecture Notes in Computer Science. pp. 202–213. [Google Scholar]
- Whitt, W. Continuity of Generalized Semi-Markov Processes. Math. Oper. Res.
**1980**, 5, 494–501. [Google Scholar] [CrossRef] - Ballarini, P.; Barbot, B.; Duflot, M.; Haddad, S.; Pekergin, N. HASL: A New Approach for Performance Evaluation and Model Checking from Concepts to Experimentation. Perform. Eval.
**2015**, 90, 53–77. [Google Scholar] [CrossRef][Green Version] - Norman, G.; Parker, D.; Sproston, J. Model checking for probabilistic timed automata. Form. Methods Syst. Des.
**2013**, 43, 164–190. [Google Scholar] [CrossRef][Green Version] - David, A.; Du, D.; Larsen, K.; Legay, A.; Mikučionis, M.; Poulsen, D.; Sedwards, S. Statistical Model Checking for Stochastic Hybrid Systems. Electron. Proc. Theor. Comput. Sci.
**2012**, 92, 122–136. [Google Scholar] [CrossRef][Green Version] - Legay, A.; Sedwards, S.; Traonouez, L. Scalable Verification of Markov Decision Processes. In Software Engineering and Formal Methods; Springer: Berlin/Heidelberg, Germany, 2015; pp. 350–362. [Google Scholar] [CrossRef][Green Version]
- Puterman, M. Markov Decision Processes: Discrete Stochastic Dynamic Programming; John Wiley & Sons: Hoboken, NJ, USA, 2005. [Google Scholar]
- Agha, G.; Meseguer, J.; Sen, K. PMaude: Rewrite-based Specification Language for Probabilistic Object Systems. In Proceedings of the 3rd Workshop on Quantitative Aspects of Programming Languages (QAPL 2005); Elsevier: Amsterdam, The Netherlands, 2005. [Google Scholar]
- De Nicola, R.; Katoen, J.; Latella, D.; Loreti, M.; Massink, M. Model checking mobile stochastic logic. Theor. Comput. Sci.
**2007**, 382, 42–70. [Google Scholar] [CrossRef] - De Nicola, R.; Ferrari, G.L.; Pugliese, R. KLAIM: A kernel language for agents interaction and mobility. IEEE Trans. Softw. Eng.
**1998**, 24, 315–330. [Google Scholar] [CrossRef][Green Version] - Rozier, K. Linear Temporal Logic Symbolic Model Checking. Comput. Sci. Rev.
**2011**, 5, 163–203. [Google Scholar] [CrossRef] - Mediouni, B.; Nouri, A.; Bozga, M.; Dellabani, M.; Legay, A.; Bensalem, S. SBIP 2.0: Statistical Model Checking Stochastic Real-Time Systems. In Proceedings of the 16th International Symposium on Automated Technology for Verification and Analysis (ATVA 2018), Los Angeles, CA, USA, 7–10 October 2018; Springer: Berlin/Heidelberg, Germany, 2018; pp. 536–542. [Google Scholar]
- Alur, R.; Feder, T.; Henzinger, T. The Benefits of Relaxing Punctuality. J. ACM
**1996**, 43, 116–146. [Google Scholar] [CrossRef] - Clarke, E.; Henzinger, T.; Veith, H. Handbook of Model Checking; Springer: Berlin/Heidelberg, Germany, 2016. [Google Scholar]
- Hansson, H.; Jonsson, B. A logic for reasoning about time and reliability. Form. Asp. Comput.
**1994**, 6, 512–535. [Google Scholar] [CrossRef][Green Version] - Sen, K.; Viswanathan, M.; Agha, G. On Statistical Model Checking of Stochastic Systems. In Proceedings of the 17th International Conference on Computer Aided Verification (CAV 2005), Edinburgh, UK, 6–10 July 2005; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2005; Volume 3576, pp. 266–280. [Google Scholar]
- Baier, C. On Algorithmic Verification Methods for Probabilistic Systems. Ph.D. Thesis, University of Mannheim, Mannheim, Germany, 1998. [Google Scholar]
- Donatelli, S.; Haddad, S.; Sproston, J. Model Checking Timed and Stochastic Properties with CSL
^{TA}. IEEE Trans. Softw. Eng.**2009**, 35, 224–240. [Google Scholar] [CrossRef] - Hoeffding, W. Probability Inequalities for Sums of Bounded Random Variables. J. Am. Stat. Assoc.
**1963**, 13–30. [Google Scholar] [CrossRef] - Wald, A. Sequential tests of statistical hypotheses. Ann. Math. Stat.
**1945**, 16, 117–186. [Google Scholar] [CrossRef] - Younes, H. Verification and Planning for Stochastic Processes with Asynchronous Events. Ph.D. Thesis, Carnegie Mellon University, School of Computer Science, Pittsburgh, PA, USA, 2005. [Google Scholar]
- Jegourel, C.; Legay, A.; Sedwards, S. Command-based importance sampling for statistical model checking. Theor. Comput. Sci.
**2016**, 649, 1–24. [Google Scholar] [CrossRef][Green Version] - Jegourel, C.; Legay, A.; Sedwards, S. Importance Splitting for Statistical Model Checking Rare Properties. In Proceedings of the 25th International Conference on Computer Aided Verification (CAV 2013), Saint Petersburg, Russia, 13–19 July 2013; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2013; Volume 8044, pp. 576–591. [Google Scholar]
- Legay, A.; Lukina, A.; Traonouez, L.; Yang, J.; Smolka, S.; Grosu, R. Statistical Model Checking. In Computing and Software Science: State of the Art and Perspectives; Springer Nature: Berlin/Heidelberg, Germany, 2019; pp. 478–504. [Google Scholar] [CrossRef][Green Version]
- Grosu, R.; Smolka, S. Quantitative Model checking. In Proceedings of the 1st International Symposium on Leveraging Applications of Formal Method (ISoLA 2004), Paphos, Cyprus, 30 October–2 November 2004; pp. 165–174. [Google Scholar]
- Grosu, R.; Smolka, S. Monte Carlo Model Checking. In Proceedings of the 11th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2005), Edinburgh, UK, 4–8 April 2005; Springer: Berlin/Heidelberg, Germany, 2005; Volume 3440, Lecture Notes in Computer Science. pp. 271–286. [Google Scholar] [CrossRef][Green Version]
- Dagum, P.; Karp, R.; Luby, M.; Ross, S.M. An Optimal Algorithm for Monte Carlo Estimation. SIAM J. Comput.
**2000**, 29, 1484–1496. [Google Scholar] [CrossRef] - Jha, S.; Clarke, E.; Langmead, C.; Legay, A.; Platzer, A.; Zuliani, P. A Bayesian Approach to Model Checking Biological Systems. In Proceedings of the 7th International Conference on Computational Methods in Systems Biology (CMSB 2009), Bologna, Italy, 31 August–1 September 2009; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2009; Volume 5688, pp. 218–234. [Google Scholar] [CrossRef][Green Version]
- Bortolussi, L.; Milios, D.; Sanguinetti, G. Smoothed model checking for uncertain Continuous-Time Markov Chains. Inf. Comput.
**2016**, 247, 235–253. [Google Scholar] [CrossRef] - Mancini, T.; Mari, F.; Massini, A.; Melatti, I.; Tronci, E. SyLVaaS: System Level Formal Verification as a Service. In Proceedings of the 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing (PDP 2015), Turku, Finland, 4–6 March 2015; pp. 476–483. [Google Scholar]
- Annpureddy, Y.; Liu, C.; Fainekos, G.E.; Sankaranarayanan, S. S-TaLiRo: A Tool for Temporal Logic Falsification for Hybrid Systems. In Proceedings of the 17th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2011), Saarbrücken, Germany, 26 March–3 April 2011; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2011; Volume 6605, pp. 254–257. [Google Scholar] [CrossRef][Green Version]
- Bresolin, D.; Collins, P.; Geretti, L.; Segala, R.; Villa, T.; Gonzalez, S. A Computable and Compositional Semantics for Hybrid Automata. In Proceedings of the 23rd International Conference on Hybrid Systems: Computation and Control (HSCC 2020), Sydney, Australia, 21–24 April 2020; ACM: New York, NY, USA, 2020. [Google Scholar] [CrossRef]
- Frehse, G.; Le Guernic, C.; Donzé, A.; Cotton, S.; Ray, R.; Lebeltel, O.; Ripado, R.; Girard, A.; Dang, T.; Maler, O. SpaceEx: Scalable Verification of Hybrid Systems. In Proceedings of the 23rd International Conference on Computer Aided Verification (CAV 2011), Snowbird, UT, USA, 14–20 July 2011; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2011; Volume 6806, pp. 379–395. [Google Scholar]
- Luckow, K.; Păsăreanu, C.; Dwyer, M.; Filieri, A.; Visser, W. Exact and Approximate Probabilistic Symbolic Execution for Nondeterministic Programs. In Proceedings of the 29th ACM/IEEE International Conference on Automated Software Engineering (ASE 2014), Vsters, Sweden, 15–19 September 2014; ACM: New York, NY, USA, 2014. [Google Scholar]
- Hogg, R.; McKean, J.W.; Craig, A.T. Introduction to Mathematical Statistics, 8th ed.; Pearson Education: Upper Saddle River, NJ, USA, 2018. [Google Scholar]
- Sen, K.; Viswanathan, M.; Agha, G. VeStA: A statistical model-checker and analyzer for probabilistic systems. In Proceedings of the QEST 2005—Proceedings Second International Conference on the Quantitative Evaluation of SysTems, Torino, Italy, 19–22 September 2005; Volume 2005, pp. 251–252. [Google Scholar] [CrossRef]
- AlTurki, M.; Meseguer, J. PVeStA: A Parallel Statistical Model Checking and Quantitative Analysis Tool. In Proceedings of the 4th International Conference on Algebra and Coalgebra in Computer Science (CALCO 2011), Winchester, UK, 30 August–2 September 2011; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2011; Volume 6859, pp. 386–392. [Google Scholar]
- Sebastio, S.; Vandin, A. MultiVeStA: Statistical Model Checking for Discrete Event Simulators. In Proceedings of the 7th International Conference on Performance Evaluation Methodologies and Tools (ValueTools 2013), Torino, Italy, NY, USA, 10–12 December 2013; ICST/ACM: New York, NY, USA, 2013; pp. 310–315. [Google Scholar]
- Shmarov, F.; Zuliani, P. Probabilistic Hybrid Systems Verification via SMT and Monte Carlo Techniques. In Proceedings of the Hardware and Software: Verification and Testing, 12nd International Haifa Verification Conference (HVC 2016), Haifa, Israel, 14–17 November 2016; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2016; Volume 10028. [Google Scholar] [CrossRef][Green Version]
- Xue, B.; Fränzle, M.; Zhao, H.; Zhan, N.; Easwaran, A. Probably Approximate Safety Verification of Hybrid Dynamical Systems. In Proceedings of the Formal Methods and Software Engineering—21st International Conference on Formal Engineering Methods (ICFEM 2019), Shenzhen, China, 5–9 November 2019; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2019; Volume 11852. [Google Scholar] [CrossRef]
- Xue, B.; Liu, Y.; Ma, L.; Zhang, X.; Sun, M.; Xie, X. Safe Inputs Approximation for Black-Box Systems. In Proceedings of the 24th International Conference on Engineering of Complex Computer Systems (ICECCS 2019), Guangzhou, China, 10–13 November 2019; pp. 180–189. [Google Scholar] [CrossRef]
- Plasma Lab. Available online: https://project.inria.fr/plasma-lab/ (accessed on 18 December 2020).
- Jegourel, C.; Legay, A.; Sedwards, S. A Platform for High Performance Statistical Model Checking–PLASMA. In Proceedings of the 18th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2012), Tallinn, Estonia, 24 March–1 April 2012; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2012; Volume 7214, pp. 498–503. [Google Scholar]
- Boyer, B.; Corre, K.; Legay, A.; Sedwards, S. PLASMA-lab: A Flexible, Distributable Statistical Model Checking Library. In Proceedings of the 10th International Conference on Quantitative Evaluation of Systems (QEST 2013), Buenos Aires, Argentina, 27–30 August 2013; Springer: Berlin/Heidelberg, Germany, 2013; pp. 160–164. [Google Scholar]
- Hérault, T.; Lassaigne, R.; Magniette, F.; Peyronnet, S. Approximate Probabilistic Model Checking. In Proceedings of the 5th International Workshop on Verification, Model Checking, and Abstract Interpretation (VMCAI 2004), Venice, Italy, 11–13 January 2004; Springer: Berlin/Heidelberg, Germany, 2004; pp. 73–84. [Google Scholar] [CrossRef]
- Lassaigne, R.; Peyronnet, S. Probabilistic verification and approximation. Ann. Pure Appl. Log.
**2008**, 152, 122–131. [Google Scholar] [CrossRef][Green Version] - Peyronnet, S.; Lassaigne, R.; Herault, T. APMC 3.0: Approximate Verification of Discrete and Continuous Time Markov Chains. In Proceedings of the QEST 2006—Proceedings Third International Conference on the Quantitative Evaluation of SysTems, Riverside, CA, USA, 11–14 September 2006; pp. 129–130. [Google Scholar] [CrossRef]
- Henriques, D.; Martins, J.; Zuliani, P.; Platzer, A.; Clarke, E. Statistical Model Checking for Markov Decision Processes. In Proceedings of the 2012 Ninth International Conference on Quantitative Evaluation of Systems, London, UK, 17–20 September 2012; pp. 84–93. [Google Scholar] [CrossRef][Green Version]
- Parker, D.; Norman, G.; Kwiatkowska, M. PRISM 2017. Statistical Model Checker. Available online: https://www.prismmodelchecker.org/manual/RunningPRISM/StatisticalModelChecking (accessed on 18 December 2020).
- Younes, H. Ymer: A Statistical Model Checker. In Proceedings of the 17th International Conference on Computer Aided Verification (CAV 2005), Edinburgh, UK, 6–10 July 2005; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2005; Volume 3576, pp. 429–433. [Google Scholar] [CrossRef][Green Version]
- Younes, H.; Clarke, E.; Zuliani, P. Statistical Verification of Probabilistic Properties with Unbounded Until. In Proceedings of the 13th Brazilian Symposium on Formal Methods (SBMF 2010), Natal, Brazil, 8–11 November 2010; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2010; Volume 6527. [Google Scholar] [CrossRef][Green Version]
- David, A.; Larsen, K.; Legay, A.; Mikučionis, M.; Poulsen, D. Uppaal SMC tutorial. Int. J. Softw. Tools Technol. Transf.
**2015**, 17, 397–415. [Google Scholar] [CrossRef][Green Version] - Bengtsson, J.; Larsen, K.; Larsson, F.; Pettersson, P.; Yi, W. UPPAAL—A Tool Suite for Automatic Verification of Real-Time Systems. In Hybrid Systems III: Verification and Control; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 1996; Volume 1066, pp. 232–243. [Google Scholar] [CrossRef]
- Amparore, E.G.; Beccuti, M.; Donatelli, S. (Stochastic) Model Checking in GreatSPN. In Proceedings of the Applications and Theory of Petri Nets and Concurrency (PETRI NETS 2014), Tunis, Tunisia, 23–27 June 2014; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2014; Volume 8489, pp. 354–363. [Google Scholar] [CrossRef]
- Katoen, J.P.; Zapreev, I.S.; Hahn, E.M.; Hermanns, H.; Jansen, D.N. The ins and outs of the probabilistic model checker MRMC. Perform. Eval.
**2011**, 68, 90–104. [Google Scholar] [CrossRef][Green Version] - Nouri, A.; Mediouni, B.; Bozga, M.; Combaz, J.; Bensalem, S.; Legay, A. Performance Evaluation of Stochastic Real-Time Systems with the SBIP Framework. Int. J. Crit. Comput. Based Syst.
**2018**, 1–33. [Google Scholar] [CrossRef][Green Version] - Verimag. BIP Component Framework. Available online: http://www-verimag.imag.fr/Rigorous-Design-of-Component-Based.html (accessed on 18 December 2020).
- Heiner, M.; Rohr, C.; Schwarick, M. MARCIE—Model Checking and Reachability Analysis Done Efficiently. In Proceedings of the Applications and Theory of Petri Nets and Concurrency (PETRI NETS 2013), Milan, Italy, 24–28 June 2013; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2013; Volume 7927, pp. 389–399. [Google Scholar] [CrossRef]
- Bogdoll, J.; Hartmanns, A.; Hermanns, H. Simulation and Statistical Model Checking for Modestly Nondeterministic Models. In Proceedings of the Measurement Modelling and Evaluation of Computing Systems and Dependability and Fault Tolerance (MMB&DFT 2012), Kaiserslautern, Germany, 19–21 March 2012; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2012; pp. 249–252. [Google Scholar] [CrossRef]
- MODEST. Available online: http://www.modestchecker.net (accessed on 18 December 2020).
- Mancini, T.; Mari, F.; Melatti, I.; Salvo, I.; Tronci, E.; Gruber, J.; Hayes, B.; Prodanovic, M.; Elmegaard, L. Demand-Aware Price Policy Synthesis and Verification Services for Smart Grids. In Proceedings of the 2014 IEEE International Conference on Smart Grid Communications (SmartGridComm 2014), Venice, Italy, 3–6 November 2014; pp. 794–799. [Google Scholar] [CrossRef]
- Mancini, T.; Mari, F.; Melatti, I.; Salvo, I.; Tronci, E.; Gruber, J.; Hayes, B.; Elmegaard, L. Parallel Statistical Model Checking for Safety Verification in Smart Grids. In Proceedings of the 2018 IEEE International Conference on Smart Grid Communications (SmartGridComm 2018), Aalborg, Denmark, 29–31 October 2018. [Google Scholar] [CrossRef][Green Version]
- Mancini, T.; Mari, F.; Melatti, I.; Salvo, I.; Tronci, E.; Gruber, J.; Hayes, B.; Prodanovic, M.; Elmegaard, L. User Flexibility Aware Price Policy Synthesis for Smart Grids. In Proceedings of the 18th Euromicro Conference on Digital System Design (DSD 2015), Funchal, Portugal, 26–28 August 2015; pp. 478–485. [Google Scholar] [CrossRef]
- Hayes, B.; Melatti, I.; Mancini, T.; Prodanovic, M.; Tronci, E. Residential Demand Management using Individualised Demand Aware Price Policies. IEEE Trans. Smart Grid
**2017**, 8. [Google Scholar] [CrossRef] - Tronci, E.; Mancini, T.; Salvo, I.; Sinisi, S.; Mari, F.; Melatti, I.; Massini, A.; Davi’, F.; Dierkes, T.; Ehrig, R.; et al. Patient-Specific Models from Inter-Patient Biological Models and Clinical Records. In Proceedings of the 14th International Conference on Formal Methods in Computer-Aided Design (FMCAD 2014), Lausanne, Switzerland, 21–24 October 2014; pp. 207–214. [Google Scholar] [CrossRef]
- Mancini, T.; Tronci, E.; Salvo, I.; Mari, F.; Massini, A.; Melatti, I. Computing Biological Model Parameters by Parallel Statistical Model Checking. In Proceedings of the 3rd International Conference on Bioinformatics and Biomedical Engineering (IWBBIO 2015), Granada, Spain, 15–17 April 2015; Lecture Notes in Computer Science. Springer: Berlin/Heidelberg, Germany, 2015; Volume 9044, pp. 542–554. [Google Scholar] [CrossRef]
- Sinisi, S.; Alimguzhin, V.; Mancini, T.; Tronci, E.; Leeners, B. Complete populations of virtual patients for in silico clinical trials. Bioinformatics
**2020**. to appear. [Google Scholar] [CrossRef] - Mancini, T.; Mari, F.; Massini, A.; Melatti, I.; Salvo, I.; Sinisi, S.; Tronci, E.; Ehrig, R.; Röblitz, S.; Leeners, B. Computing Personalised Treatments through In Silico Clinical Trials. A Case Study on Downregulation in Assisted Reproduction. In Proceedings of the 25th RCRA International Workshop on Experimental Evaluation of Algorithms for Solving Problems with Combinatorial Explosion (RCRA 2018), Oxford, UK, 13 July 2018. [Google Scholar]
- Sinisi, S.; Alimguzhin, V.; Mancini, T.; Tronci, E.; Mari, F.; Leeners, B. Optimal Personalised Treatment Computation through In Silico Clinical Trials on Patient Digital Twins. Fundam. Inform.
**2020**, 174, 283–310. [Google Scholar] [CrossRef] - Guirado, G.; Hérault, T.; Lassaigne, R.; Peyronnet, S. Distribution, Approximation and Probabilistic Model Checking. In Proceedings of the 4th International Workshop on Parallel and Distributed Methods in Verification (PDMC 2005), Lisboa, Portugal, 10 July 2005; Elsevier: Amsterdam, The Netherlands, 2006; Volume 135, pp. 19–30. [Google Scholar] [CrossRef][Green Version]

**Figure 1.**Simulation-based verification setting. Signal u models exogenous inputs, signal x models the SUV state, and signal y models the verification output.

**Table 1.**For each considered algorithm we show with a • if it supports Hypothesis Testing (HT) and/or Estimation (E). In the last column yes means that the algorithm pre-computes the number of samples (#Samples Fixed a Priori), whereas no means that the number of samples is computed at runtime.

Algorithm | HT | E | #Samples Fixed a Priori |
---|---|---|---|

Gauss-SSP | • | yes | |

C.I. | • | yes | |

Chernoff C.I. | • | • | yes |

Chernoff SSP. | • | • | yes |

Chow-Robbins | • | • | no |

SPRT | • | no | |

Bayesian HT | • | no | |

Bayesian E | • | no | |

$\mathcal{OAA}$ | • | no |

**Table 2.**Monte Carlo simulation-based SMC tools comparison table. In the Time column D stands for discrete, C for continue. In the column Model, the model is specified as its representation structure or as the language describing the model. In the columns Event values and Set of states, $fin$ means finite and $inf$ means infinite. In the Search horizon column, $bnd$ stands for bounded, $ubnd$ for unbounded. In the Inference column, HT stands for Hypothesis Testing; E stands for Estimation and NS stands for Numeric-symbolic methods (see Section 3). In the same column, for each inference approach, the name of the algorithm used is specified. For further details about the algorithms, see Table 1. Depending on the algorithm, the number of samples can be computed a priori or at runtime.

ENVIRONMENT MODEL | SUV MODEL | SPECIFICATION | VERIFICATION TECHNIQUE | |||||
---|---|---|---|---|---|---|---|---|

TOOL | Time | Event Values | Model | Set of States | Property Language | Search Horizon | Inference | #samples Computing |

(P)VeStA [63] | C | fin | CTMC, DTMC / PMaude | fin/inf | CSL, PCTL, QuaTEx | ubnd | HT: Gauss-SSP; E: C.I. | HT and E: a priori |

MultiVeStA [65] | D/C | fin | DES | inf | MultiQuaTEx | ubnd | E: Chow-Robbins | E: at runtime |

Plasma [69] | C | fin/inf | CTMC, MDP | inf | BLTL | bnd | HT: SPRT; E: Chernoff C.I. | HT: at runtime; E: a priori |

APMC [73,97] | D | inf | DTMC, CTMC | fin | LTL | ubnd on monotone LTL | E: Chernoff-SSP/$\mathcal{OAA}$ | E: a priori/at runtime |

PRISM [15,75] | D/C | fin | DTMC, CTMC, MDP | fin | BLTL | ubnd | HT: SPRT; E: Chernoff C.I.; NS | HT: at runtime; E: a priori |

Ymer [77,78] | D/C | inf | DTMC, CTMC | fin | PCTL, CSL | ubnd | HT: SPRT/Gauss-SSP; E: Chow-Robbins/ Chernoff C.I. | HT: at runtime/a priori; E: at runtime/a priori; NS |

UPPAAL-SMC [79] | C | inf | SHA | inf | MITL | bnd | HT: SPRT; E: Chernoff C.I. | HT: at runtime; E: a priori |

COSMOS [30] | C | fin | GSPN | fin | HASL | ubnd | HT: SPRT; E: Chernoff C.I. / Chow-Robbins | HT: at runtime; E: a priori/at runtime |

MRMC [82] | D/C | fin | DTMC, CTMC | fin | PCTL, CSL | ubnd | E: Chow-Robbins; NS | E: at runtime |

SBIP [83] | D/C | inf | DTMC, CTMC, GSMP | inf | PBLTL | bnd | HT: SPRT; E: Chernoff C.I. | HT: at runtime; E: a priori |

MARCIE [85] | C | fin | GSPN | fin | CSL, CSRL, PCTL | ubnd | E: Chernoff C.I.; NS | E: at runtime |

modes [86] | C | fin | SHA, STA, PTA, MDP | fin | MODEST | ubnd | HT: SPRT; E: Chernoff C.I. | HT: at runtime; E: a priori |

APD Analyser [89] | D | fin | Custom model | inf | Safety properties | bnd | E: $\mathcal{OAA}$ | E: at runtime |

ViP generator [92,93] | D | fin | ODEs | inf | Boolean properties | bnd | HT: SPRT | HT: at runtime |

Bayesian tools [7,56] | D | fin | DTHS, Uncertain CTMC | inf | BLTL, MTL, MITL | bnd | HT: Bayesian HT; E: Bayesian E | HT and E: at runtime |

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |

© 2020 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Pappagallo, A.; Massini, A.; Tronci, E. Monte Carlo Based Statistical Model Checking of Cyber-Physical Systems: A Review. *Information* **2020**, *11*, 588.
https://doi.org/10.3390/info11120588

**AMA Style**

Pappagallo A, Massini A, Tronci E. Monte Carlo Based Statistical Model Checking of Cyber-Physical Systems: A Review. *Information*. 2020; 11(12):588.
https://doi.org/10.3390/info11120588

**Chicago/Turabian Style**

Pappagallo, Angela, Annalisa Massini, and Enrico Tronci. 2020. "Monte Carlo Based Statistical Model Checking of Cyber-Physical Systems: A Review" *Information* 11, no. 12: 588.
https://doi.org/10.3390/info11120588