Formal Verification of Self-Assembling Systems

Abstract

This paper introduces the theory and practice of formal verification of self-assembling systems. We interpret a well-studied abstraction of nanomolecular self assembly, the Abstract Tile Assembly Model (aTAM), into Computation Tree Logic (CTL), a temporal logic often used in model checking. We then consider the class of "rectilinear" tile assembly systems. This class includes most aTAM systems studied in the theoretical literature, and all (algorithmic) DNA tile self-assembling systems that have been realized in laboratories to date. We present a polynomial-time algorithm that, given a tile assembly system T as input, either provides a counterexample to T's rectilinearity or verifies whether T has a unique terminal assembly. Using partial order reductions, the verification search space for this algorithm is reduced from exponential size to O(n^2), where n x n is the size of the assembly surface. That reduction is asymptotically the best possible. We report on experimental results obtained by translating tile assembly simulator files into a Petri net format manipulable by the SMART model checking engines devised by Ciardo et al. The model checker runs in O(|T| x n^4) time, where |T| is the number of tile types in tile assembly system T, and n x n is the surface size. Atypical for a model checking problem -- in which the practical limit usually is insufficient memory to store the state space -- the limit in this case was the amount of memory required to represent the rules of the model. (Storage of the state space and of the reachability graph were small by comparison.) We discuss how to overcome this obstacle by means of a front end tailored to the characteristics of self-assembly.

Full text

Page 1

Formal Verification of Self-Assembling Systems
Aaron Sterling
Laboratory for Nanoscale Self-Assembly, Department of Computer Science, Iowa State University.
sterling@iastate.edu
Abstract. This paper introduces the theory and practice of formal verification of self-assembling
systems. We interpret a well-studied abstraction of nanomolecular self assembly, the Abstract Tile
Assembly Model (aTAM), into Computation Tree Logic (CTL), a temporal logic often used in model
checking. We then consider the class of “rectilinear” tile assembly systems. This class includes most
aTAM systems studied in the theoretical literature, and all (algorithmic) DNA tile self-assembling
systems that have been realized in laboratories to date. We present a polynomial-time algorithm that,
given a tile assembly system T as input, either provides a counterexample to T ’s rectilinearity or verifies
whether T has a unique terminal assembly. Using partial order reductions, the verification search space
for this algorithm is reduced from exponential size to O(n2), where n × n is the size of the assembly
surface. That reduction is asymptotically the best possible. We report on experimental results obtained
by translating tile assembly simulator files into a Petri net format manipulable by the SMART model
checking engines devised by Ciardo et al. The model checker runs in O(|T | · n4) time, where |T | is the
number of tile types in tile assembly system T , and n × n is the surface size. Atypical for a model
checking problem—in which the practical limit usually is insufficient memory to store the state space—
the limit in this case was the amount of memory required to represent the rules of the model. (Storage
of the state space and of the reachability graph were small by comparison.) We discuss how to overcome
this obstacle by means of a front end tailored to the characteristics of self-assembly.
arXiv:1007.3712v1 [cs.LO] 21 Jul 2010

Page 2

1 Introduction
The emerging field of algorithmic nanomolecular self-assembly began in the mid-1990s, when Adle-
man, Rothemund, Winfree and others demonstrated through both mathematical rigor and experi-
mentation that it was possible to “program matter” by designing sets of DNA molecules that would
spontaneously combine together into desired shapes [19]. Perhaps the biggest practical success so
far has been the technology of “DNA origami,” which is now being used in joint research between
IBM and CalTech to build a microchip with transistors placed closer together than ever before [9].
Part of the reason this technology is “ahead of” other DNA self-assembly technologies is its low
error rate, especially compared to “DNA tile” self-assembly. Understanding the behavior of DNA
tiles is difficult, even if they bind error-free, and when one considers a tile assembly system designed
to perform error-correction, the analysis can be much more complex. Tools of formal verification
have been extremely useful in other areas of computer science, especially when concurrency and
nondeterminism can produce unexpected (and undesirable) executions. To date, however, methods
of formal verification have not been applied to self-assembling systems. Instead, self-assembly re-
search is reminiscent of concurrent-system research in the early 1980s: the best method to verify
a construction works is to run it in a simulator multiple times, and watch for any bad behavior.
Of course, this provides no guarantee against rare occurrences of bad behavior, which was one
motivation for the introduction of formal methods of verification. In this paper, we are similarly
motivated: we present a theory for the formal verification of DNA tile self-assembly, and we report
on initial experiments performed with a model checking tool implementing this theory.
Self-assembly is a process in which small objects, which communicate and connect only with
their local neighbors, form global structures. Algorithmic self-assembly studies self-assembly through
the “algorithmic lens,” and, in particular, considers the design and complexity of self-assembling
systems. While researchers in robotics [10] and amorphous computing [13] are active in this area,
in this paper, we focus on nanomolecular algorithmic self-assembly, achieved in the lab by building
“tiles” out of DNA molecules, using techniques pioneered by Seeman [21]. A powerful mathematical
abstraction of molecular behavior is the Abstract Tile Assembly Model (aTAM), due to Winfree [23]
and Rothemund [17]. There is, at this point, an extensive literature on the aTAM, several variations
of it, different complexity measures, and upper and lower bounds to assemble different shapes.
The formalisms in the aTAM include the following: a finite set of distinct types of self-assembling
agents, a set of local binding rules that completely determines the behavior of the agents, and an
initial configuration of the system. A particular self-assembly “run” starts with an operator placing
a finite seed assembly on the surface, and then allowing a “solution” containing infinitely many
of each agent type to mix on the surface. Agents bind nondeterministically to the seed assembly,
and to the growing configuration, consistent with the local rules. In the tile assembly models we
consider in this paper, each agent is a four-sided tile, and the assembly surface is the first quadrant
of the two-dimensional integer plane.
In general, a tile assembly system (TAS) defined in the aTAM may have infinitely-long execution
paths, and there is research into the assembly of infinite shapes such as fractals [11]. Nevertheless,
proposed applications, and laboratory experiments, have focused on the correct construction of
finite, bounded structures. We make use of this to design a theory of formal verification for the
aTAM: we take as input both a tile assembly system and a bound on the assembly surface, and then
perform model checking on the behavior of that assembly system on that surface. This guarantees
that the set of legally reachable configurations (i.e., the transition system) is finite, so it is amenable
to well-understood model-checking algorithms. With this bound on surface size, we interpret the
1

Page 3

aTAM into CTL (Computation Tree Logic, a popular model checking formalism [4]). The question,
“Does tile assembly system T have a terminal assembly bounded by n × n?” then reduces to a
model checking problem for CTL. We present the reduction of the aTAM to CTL in Section 3.
A fixed CTL model checking problem is decidable in time linear in the size of the system it
is checking. The size of the systems relevant here are determined by the number of possible legal
configurations (reachable state space) and the number of legal transitions between those configura-
tions (number of edges). Since all assembly surfaces are a finite subset of Z×Z, each possible legal
configuration is isomorphic to a connected grid graph. A transition to another configuration takes
place when one tile is added to the current assembly. Hence, for large n, the number of potential
transitions (edges) is sparse, due to the sparseness of edges of the underlying grid graph. The pa-
rameter that dominates is the size of the state space, which—even for tile assembly systems that
are very “nice”—can grow exponentially. Therefore, it is essential to reduce the size of space we
need to search, if the model checking problem for the aTAM is to be tractable.
We achieve this search space reduction for a significant class of tile assembly systems: the
“rectilinear” TASes. We define the class later, but it comprises most of the TASes studied in the
theoretical literature; and, perhaps more significantly, it also includes all DNA tile assembly systems
produced in laboratories to date, except for systems that were intentionally random (so not formally
verifiable), or which consisted of essentially just one tile that bound to itself again and again (a
context in which formal verification is not relevant). We show that rectilinear TASes are sufficiently
well behaved that it is easy to verify online whether an input TAS is part of such a class, and, if so,
to reduce the search space from exponential in size to O(n2), because most of the tiles added are
guaranteed to be independent of other tile additions. Since a configuration on an n×n surface can,
of course, have n2tiles, added one at a time, a O(n2) search space is asymptotically best possible.
We present this search space reduction in Section 4.
Armed with this reduction rule, we obtain initial experimental results. We translate tile assembly
system files from a tile assembly simulator [14] into a Petri net formalism manipulable by the
SMART model checking engines [3]. This produces an aTAM model checker that runs in O(|T |·n4)
time, where |T | is the number of tile types in tile assembly system T , and n × n is the size of
the assembly surface. Atypical for a model checking problem—in which the practical limit usually
is insufficient memory to store the state space—the limit in this case was the amount of memory
required to represent the rules of the model. (Storage of the state space and of the reachability
graph were small by comparison.) We report on our experimental results in Section 5, and, in
Section 6, discuss how to reduce both memory use and running time by constructing a front end
specialized to self-assembly.
This paper is the first to connect formal verification with self-assembly. There is, of course,
extensive research on model checking of asynchronous, concurrent systems [6]. There has also been
some initial work using model checkers to study quantitative properties of biological pathways,
such as protein creation [7]. Researchers have also started to apply formal methods to, and produce
simulation software for, the brand-new area of DNA circuits [16], though no verification tools yet
exist for such circuits. Model checkers and temporal logics have been extremely useful throughout
computer science, and we hope that the current work makes their power available to theorists and
practitioners of algorithmic self-assembly.
2

Page 4

2Background
2.1Tile self-assembly background
Winfree’s objective in defining the Tile Assembly Model was to provide a useful mathematical
abstraction of DNA tiles combining in solution in a random, nondeterministic, asynchronous man-
ner [23]. Rothemund [17], and Rothemund and Winfree [18], extended the original definition of the
model. For a comprehensive introduction to tile assembly, we refer the reader to [17]. Intuitively,
we desire a formalism that models the placement of square tiles on the integer plane, one at a time,
such that each new tile placed binds to the tiles already there, according to specific rules. Tiles
have four sides (often referred to as north, south, east and west) and exactly one orientation, i.e.,
they cannot be rotated.
A tile assembly system T is a 5-tuple (T,σ,Σ,τ,R), where T is a finite set of tile types; σ is the
seed tile or seed assembly, the “starting configuration” for assemblies of T ; τ : T ×{N,S,E,W} →
Σ × {0,1,2} is an assignment of symbols (“glue names”) and a “glue strength” (0, 1, or 2) to the
north, south, east and west sides of each tile; and a symmetric relation R ⊆ Σ × Σ that specifies
which glues can bind with nonzero strength. In this model, there are no negative glue strengths,
i.e., two tiles cannot repel each other.
A configuration of T is a set of tiles, all of which are tile types from T , that have been placed
in the plane, and the configuration is stable if the binding strength (from τ and R in T ) at every
possible cut is at least 2. An assembly sequence is a sequence of single-tile additions to the frontier
of the assembly constructed at the previous stage. Assembly sequences can be finite or infinite in
length. The result of assembly sequence− →
α is the union of the tile configurations obtained at every
finite stage of− →
α. The assemblies produced by T is the set of all stable assemblies that can be built
by starting from the seed assembly of T and legally adding tiles. If α and β are configurations of T ,
we write α −→ β if there is an assembly sequence that starts at α and produces β. An assembly of T
is terminal if no tiles can be stably added to it. Researchers are, of course, interested in being able
to prove that a certain tile assembly system always achieves a certain output. In [22], Soloveichik
and Winfree presented a strong technique for this: local determinism. An assembly sequence− →
is locally deterministic if (1) each tile added in− →
α binds with the minimum strength required for
binding; (2) if there is a tile of type t0at location l in the result of α, and t0and the immediate
“OUT-neighbors” of t0are deleted from the result of− →
at l; the result of− →
α is terminal. T is locally deterministic iff every legal tile assembly sequence of
T is locally deterministic. Local determinism is important because Soloveichik and Winfree showed
that if T is locally deterministic, then T has a unique terminal assembly [22]. In Section 3.2, we
consider how to test whether a tile assembly system is locally deterministic.
α
α, then no other tile type in T can legally bind
2.2Model checking background
We present the fundamentals of one logic often used in formal verification: CTL (Computation Tree
Logic) [4]. (We follow the presentation of CTL found in [20], which is standard.) The CTL syntax
may be defined as follows:
ϕ,ψ ::= E(ϕUψ) | A(ϕUψ) | EXϕ | AXϕ | ϕ ∧ ψ | ¬ϕ | P1| P2| ...
where AP = {P1,P2,...} is a set of atomic propositions. We interpret CTL statements over a
pointed transition system S = ?Q,R,l,s?, where Q is a finite set of states of the system, R ⊆ Q×Q
3

Page 5

is a transition relation among states, l : Q → 2APis a labeling of states with propositions (essentially
determining which atomic propositions are true in that state), and s ∈ Q is the “point” or initial
state of the system.
Intuitively, the initial state s is the tile configuration at time step 0, consisting of the seed tile
(or seed assembly) and nothing else. States of S are tile configurations on the n × n surface we
have chosen to consider. States q and q?have the property qRq?iff there is a legal tile addition that
transforms the assembly at q into the assembly at q?. Finally, the atomic propositions true at each
state are precisely the assertions that a tile of a given type is present at a given surface location in
that state, or that the location is empty.
Formally, a run π is a (possibly countably infinite) sequence of states σπ= s0,s1,s2,... with a
labeling lπ: {s0,s1,...} → 2AP. The formula ϕ holds at position i of π according to the following
recursive definition:
π,i |= P ⇐⇒ P ∈ lπ(si) (for P ∈ AP)
π,i |= ¬ϕ ⇐⇒ π,i ? ϕ
π,i |= ϕ ∧ ψ ⇐⇒ π,i |= ϕ and π,i |= ψ
π,i |= Xϕ ⇐⇒ π,i + 1 |= ϕ
π,i |= ϕUψ ⇐⇒ ∃j ≥ i such that π,j |= ψ and π,k |= ϕ for all i ≤ k < j.
Now let T be a tree rooted at an initial state, such that every path through T is a run. We can
define the CTL existence operator by
π,i |= Eϕ ⇐⇒ π?,i |= ϕ for some π?in T such that π[0,...,i] = π?[0,...,i].
From the syntax above, it is possible to define “for all” quantifiers, such as AF (“along All paths,
Finally something is true”), and AG (“along All paths, some statement holds Globally,” i.e., in
every state).
The states of a pointed transition system can be viewed as a partial order, with the the transitive
closure of the transition relation generating the ≤-relation between states. One technique to make
model checking problems tractable is the use of partial order reductions, rules (often based on
concurrency or symmetry) that allow a model checker to consider a much smaller set of states while
guaranteeing that a property holds in the reduced partial order iff it holds in the full transition
system. We use this technique in Section 4.
3Interpreting the aTAM in CTL
3.1The model checking problem for the aTAM
The goal of this subsection is to show that the behavior of the aTAM on a finite surface can be
expressed in CTL. The model checking problem for the aTAM then reduces to checking whether
a formula that expresses a particular assembly is contained in the set of possible outcomes for the
tile assembly system we are checking—and that can be determined using known model checking
algorithms. In particular, if we know that a finite shape S is a terminal assembly with respect to
the binding rules of tile assembly system T , and ψSis a formula that asserts the presence of S on
an n × n surface, then (as we will see) if the CTL-interpretation of T satisfies AF(ψS,n), we have
4