A Model Checking-based Analysis Framework forSystems Biology Models

Bing LiuDepartment of Computational & Systems Biology

School of Medicine, University of PittsburghPittsburgh, PA 15237, U.S.A.

liubing@pitt.edu

Abstract—Biological systems are often modeled as a systemof ordinary differential equations (ODEs) with time-invariantparameters. However, cell signaling events or pharmacologicalinterventions may alter the cellular state and induce multi-mode dynamics of the system. Such systems are naturallymodeled as hybrid automata, which possess multiple operationalmodes with specific nonlinear dynamics in each mode. In thispaper we introduce a model checking-enabled framework thancan model and analyze both single- and multi-mode biologicalsystems. We tackle the central problem in systems biology–identify parameter values such that a model satisfies desiredbehaviors–using bounded model checking. We resort to the delta-decision procedures to solve satisfiability modulo theories (SMT)problems and sidestep undecidability of reachability problems.Our framework enables several analysis tasks including modelcalibration and falsification, therapeutic strategy identification,and Lyapunov stability analysis. We demonstrate the applica-blitliy of these methods using case studies of prostate cancerprogression, cardiac cell action potential and radiation diseases.

Index Terms—systems biology, model checking, hybrid sys-tems, delta-decision, parameter synthesis

I. INTRODUCTION

Biomolecules interact with each other and form large andcomplicated networks. A systems-wide view of functionalregulation in the context of biochemical networks is requiredfor contemporary drug discovery and systems pharmacology toidentify new drug targets, understand drug adverse effects, anddesign therapeutic strategies [1]. It is commonly recognizedthat systems modeling will play a crucial role in this endeavor.

A standard approach of modeling the dynamics of a bio-chemical network is through a system of ordinary differentialequations (ODEs) [2]. However, model parameters includingkinetic rate constants and initial concentrations of molecularspecies are often unknown and they will have to be estimatedusing limited and noisy experimental data. Hence constructingand calibrating ODE models of realistic biochemical networksis a challenging problem. Further, ODE models that weredeveloped for simulating single-cell behaviors were oftencalibrated and validated using population-based data. Thisconstitutes a significant additional challenge.

To address these challenges, we have developed severalmodel checking-enabled analysis techniques for ODE models.For example, by reducing the ODE dynamics as a dynamicBayesian network (DBN) [3]–[6], one can efficiently per-form parameter estimation and probabilistic model checking

analysis by exploiting Bayesian inferencing [7], [8]. Thisframework has been applied to study complement system [9]and apoptosis pathway [10].

We also developed statistical model checking (SMC) tech-niques to calibrate and analyze ODE systems with probabilisticinitial states [11]–[13]. In this setting, bounded linear temporallogic is used to encode quantitative behavioral constraints andqualitative properties of biochemical networks. By equippingexisting parameter search algorithms with a SMC-based evalu-ation method, one can arrive both novel and efficient parameterestimation and analysis methods. This framework has beengeneralized to deal with stochastic rule-based models [14],[15] and hybrid automata [16] and applied to studies of variousbiological systems such as innate immune system [17] and celldeath/survival pathways [18]–[21].

However, in many settings, it is not fruitful to view thefunctioning of a biological system in terms of a single entity.Rather, the system will possess multiple operational modeswith a specific signaling network being active in each mode.For example, signaling responses to ionizing irradiation expo-sure within individual cells follow distinct cell death pathways(Fig. 1). The interconnectivity between these pathways bringsup new challenges on determining the sequence and timingof medication administration against radiation injuries, sinceinterventions may alter the cellular state and induce differentialmodes of dynamics [22]–[24].

In such situations, using a monolithic approach will result ina messy and very large model with time-invariant parameters.Consequently, the modeling and analysis approach based onthe notion of multi-mode biological networks will be veryuseful. Multi-mode dynamics and their modeling appear fre-quently in physical and engineering settings [25]. Multiplevariants of the formalism called hybrid automata [26] are oftenused to model biological processes [27]–[32]. However suchmodels are difficult to analyze and to get around this, mostefforts end up imposing severe restrictions on the dynamiclaws associated with the modes [33]–[35].

In this paper, we present a novel model checking-basedframework for analyzing single- or multi-mode biologicalsystems with nonlinear dynamics (Fig. 2). Given a dynamicalsystem, we describe the set of states of interest as a first-order logic formula and perform bounded model checking todetermine reachability of these states. We adapt an interval

inactive

Necrostatin-1casp3

cyt c

BaxtBid

Bax

casp8

RIPK3

p53Mdm2

MLKL

casp8

Necroptosis

TNF

Release of DAMPs

JAK

IFNRTNFR

IFN-β

TRADDRIPK1

TRAF2

FADDRIPK1

cFLIP

STAT1/2

RIPK1P

P

P

JP4-039

Bcl-2FADDcasp8RIPK1

PARP1

p53

NO•

NO• donors

AA

TLRs

[Ca2+]↑

MLKL MLKLMLKLP

PP

CL

AIFXJB-Veliparib

mtDNA

mtPARP

CL

DAMPs

casp1

MyD88

Tab3Tab2Tak1

MAPKs

NFκB

IRFs

NLRP3

IL-1βIL-18

Pro-IL-1βPro-IL-18

GasderminMCC950

AA-CoAPE-AA

PE-AA-OOH

PEBP1

GPX4

BaicaleinPRIPK3

pLOXA

inactive

casp11

NLRs

TRIF

casp8

PAMPs P. aeruginosa

IKKTBK1

IFN-β

JAK

STAT1/3/5

IL-22

IL-22R/IL-10R2

cGAS

STRING

IRF3

TBK1

IRF9STATs

PIK3

AKT

Pro-survival genes &Anti-inflammatory cytokines

NFκB

Lactobacillus-IL22Lactobacillus-IFNβ

Designer probiotic

Apoptosis

mitofilin

PKA

ETC

[NAD+]↓Parthanatos

CLox

Mitophagy

Pyroptosis

Ferroptosis

15LOX

LPCAT3

ACSL4

cPLA2

Release of DAMPs

Fig. 1. Distinct cell death pathways induced by irradiation exposure.

constrains propagation (ICP) based algorithm to explore theparameter spaces and identify the sets of parameters us-ing which the model satisfies desired behavior constraints.Note that determining the truth value of first-order sentencesover the reals with nonlinear real functions is a well-knownundefinable problem. We use δ-decision procedures [36] toask for answers that may have one-sided δ-bounded errors.If the model satisfies the desired behavior (e.g. the modelmatches training and testing data), we can carry out analysistasks such as stability analysis or identify novel therapeuticstrategies using δ-decision procedures. Otherwise, we willconduct SMC-based analysis [12] to generate new hypothesesand refine the model structure iteratively. We demonstrate theapplicability of our framework by “proof-of-concept” studieson prostate cancer and cardiac disorders [37]–[39].

d-decision based parameter synthesis

Nonlinear ODEs/Hybrid Automata Models

Modelvalidated?

YesNo

Model refinement

SMC basedanalysis

Newhypotheses

d-SAT

UNSAT

CalibratedModel

Model falsification

ValidatedModel

Stability analysis & Therapy optimization

Fig. 2. A model checking-enabled modeling framework.

Turning to related work, a survey of modeling and analysisof biological systems using hybrid models can be foundin [40]. Formal verification of hybrid systems is a well-established domain [41]. Analyzing the properties of bio-chemical networks using model checking techniques is beingactively pursued by a number of groups [42]–[45]. Of partic-ular interest in our context are parameter synthesis methodswhich identify parameter values for which some qualitativebehavior [46]–[48].

The rest of the paper is organized as follows. We brieflyintroduce model checking in the next section. We describe theδ-decision procedures in Section III. We then present the ap-plications of δ-decision-based analysis methods in Section IV.In the final section, we summarize and discuss future work.

II. MODEL CHECKING

Amir Pnueli introduced temporal logics into the world ofprogram verification [49]. The algorithmic verification pro-cedure called model checking was formulated by Clarke andEmerson and independently by Joseph Sifakis [50]. Briefly,the model checking procedure operates as follows. Given amodel M with initial state s, a model checker decides if aproperty written as a temporal logic formula φ is satisfied,denoted as M, s |= φ. This can be done by: (i) constructing afinite (state) transition system corresponding to M in whicheach state represents a possible configuration of the system andeach transition represents an evolution of the system from oneconfiguration to another, and (ii) verify whether φ is satisfiedby exhaustively exploring the set of system executions. Thekey feature of the model checking procedure is that it is fullyautomated. Further, if it is not the case that M, s |= φ thenthe procedure will usually return as a “counter-example” anexecution due to which the property is not being met bythe system. This can serve as a powerful debugging tool forsystems that are large and complex. An excellent starting pointfor exploring this whole field is [51].

III. δ-DECISION PROCEDURES

A. LRF -Formulas and δ-Decisions Over The Reals

In [36], we developed a theory of decision problems overthe reals with computable functions. Most common contin-uous real functions are computable, including solutions ofLipschitz-continuous ODEs. In fact, the notion of computabil-ity of real functions directly corresponds to whether they canbe numerically simulated. We write F to denote an arbitrarycollection of symbols representing computable functions overRn for various n. We consider the first-order formulas witha signature LRF = 〈0, 1,F , >〉. Note that constants are seenas 0-ary functions in F . LRF -formulas are evaluated in thestandard way over the corresponding structure RF = 〈R,F , >〉. We use atomic formulas of the form t(x1, ..., xn) > 0or t(x1, ..., xn) ≥ 0, where t(x1, ..., xn) are built up from

functions in F . To avoid extra preprocessing of formulas, wegive an explicit definition of LRF -formulas as follows.

Definition 1 (LRF -Formulas): Let F be a collection ofType 2 functions, which contains at least 0, unary negation-, addition +, and absolute value | · |. We define:

t := x | f(t(~x)), where f ∈ F , possibly constant;ϕ := t(~x) > 0 | t(~x) ≥ 0 | ϕ ∧ ϕ | ϕ ∨ ϕ | ∃xiϕ | ∀xiϕ.

In this setting ¬ϕ is regarded as an inductively definedoperation which replaces atomic formulas t > 0 with −t ≥ 0,atomic formulas t ≥ 0 with −t > 0, swaps ∧ and ∨, andswaps ∀ and ∃. Implication ϕ1 → ϕ2 is defined as ¬ϕ1 ∨ϕ2.

Definition 2 (Bounded Quantifiers): We define

∃[u,v]x.ϕ =df ∃x.(u ≤ x ∧ x ≤ v ∧ ϕ),

∀[u,v]x.ϕ =df ∀x.((u ≤ x ∧ x ≤ v)→ ϕ),

where u and v denote LRF terms whose variables only containfree variables in ϕ, excluding x. It is easy to check that∃[u,v]x.ϕ↔ ¬∀[u,v]x.¬ϕ.

We say a sentence is bounded if it only involves boundedquantifiers.

Definition 3 (Bounded LRF -Sentences): A bounded LRF -sentence is

Q[u1,v1]1 x1 · · ·Q[un,vn]

n xn ψ(x1, ..., xn).

Q[ui,vi]i s are bounded quantifiers, and ψ(x1, ..., xn) is a

quantifier-free LRF -formula.We write ψ(x1, ..., xn) as ψ[t1(~x) > 0, ..., tk(~x) >

0; tk+1(~x) ≥ 0, ..., tm(~x) ≥ 0] to emphasize that ψ(~x) is aBoolean combination of the atomic formulas shown.

Definition 4 (δ-Variants): Let δ ∈ Q+∪{0}, and ϕ an LRF -formula of the form

ϕ : QI11 x1 · · ·QInn xn ψ[ti(~x, ~y) > 0; tj(~x, ~y) ≥ 0],

where i ∈ {1, ...k} and j ∈ {k + 1, ...,m}. The δ-weakeningϕδ of ϕ is defined as the result of replacing each atom ti > 0by ti > −δ and tj ≥ 0 by tj ≥ −δ. That is,

ϕδ : QI11 x1 · · ·QInn xn ψ[ti(~x, ~y) > −δ; tj(~x, ~y) ≥ −δ].

We then have the following main decidability result.Theorem 1 (δ-Decidability): Let δ ∈ Q+ be arbitrary. There

is an algorithm which, given any bounded ϕ, correctly returnsone of the following two answers:• φ is false (unsat);• φδ is true (δ-sat).

Note when the two cases overlap, either answer is correct.We call this new decision problem the δ-decision problem

for LRF -sentences.Definition 5 (δ-Complete Decision Procedures): If an algo-

rithm solves the δ-decision problem correctly for a set S ofLRF -sentences, we say it is δ-complete for S.

From δ-decidability, δ-complete decision procedures alwaysexist for bounded LRF -formulas. In practice, we have shownthat the combination of the DPLL(T) framework and ICPindeed gives us a δ-complete decision procedure [52].

B. Parameterized LRF -Representations of Hybrid Automata

We now describe hybrid automata using LRF -formulas, anddefine parameterization and perturbations on them.

A hybrid system is a tuple H = 〈X , Q, flow, guard, reset,inv, init〉 where X ⊆ Rn specifies the range of the continuousvariables ~x of the system. Q = {q0, ..., qm} is a finite setof discrete control modes. flow ⊆ Q ×X × R ×X specifiesthe continuous dynamics for each mode. The flow predicate isusually defined either as explicit mappings from ~a0 and t to ~at,or as solutions of systems of differential equations/inclusionsthat specify the derivative of ~x over time. jump ⊆ Q ×X ×Q × X specifies the jump conditions between modes. inv ⊆Q×X defines the invariant conditions for the system to stayin a control mode. init ⊆ Q × X defines the set of initialconfigurations of the system. Without loss of generality wealways assume that q0 is the only intial mode, and initq0 ⊆ Xdenotes the initial values for the continuous variables.

Definition 6 (LRF -Representations): Let H = 〈X , Q, flow,jump, inv, init〉 be an n-dimensional hybrid automaton. Let Fbe a set of real functions, and LRF the corresponding first-order language. We say that H has an LRF -representation, iffor every q, q′ ∈ Q, there exists quantifier-free LRF -formulas

φqflow(~x, ~x0, t), φq→q′jump (~x, ~x′), φqinv(~x), φqinit(~x)

such that for all ~a,~a′ ∈ Rn, t ∈ R:• R |= φqflow(~a,~a′, t) iff (q,~a,~a′, t) ∈ flow.• R |= φq→q

′

jump (~a,~a′) iff (q, q′,~a,~a′) ∈ jump.• R |= φqinv(~a) iff (q,~a) ∈ inv.• R |= φqinit(~a) iff q = q0 and ~a ∈ initq0 .

We can write H = 〈X,Q, φflow, φjump, φinv, φinit〉 to emphasizethat H is LRF -represented. But from now on we simply writeflow, jump, inv, init to denote these logic formulas, so that wecan use H = 〈X,Q, flow, jump, inv, init〉 directly to denotethe LRF -representation of H .

Definition 7 (Computable Representation): We say a hybridautomaton H has a computable representation, if H has anLRF -representation, where F is an arbitrary set of computablefunctions.

Combining continuous and discrete behaviors, the trajecto-ries of hybrid systems are piecewise continuous. This moti-vates a two-dimensional structure of time, with which we cankeep track of both the discrete changes and the duration ofeach continuous flow.

Definition 8 (Hybrid Time Domain): A hybrid time domainT is a subset of N × R of the form Tm = {(i, t) : i <m and t ∈ [ti, t

′i] or [ti,+∞)}, where m ∈ N ∪ {+∞},

{ti}mi=0 is an increasing sequence in R+, t0 = 0, andt′i = ti+1.

We write the set of all hybrid time domains as H.Definition 9 (Hybrid Trajectories): Suppose X ⊆ Rn and

Tm is a hybrid time domain. A hybrid trajectory is anycontinuous function ξ : Tm → X.

We write ΞX to denote the set of all possible hybridtrajectories from H to X . We can now define trajectories ofa given hybrid automaton. The intuition behind the following

definition is straightforward. The labeling function σHξ (i) isused to map a step i to the corresponding discrete mode inH . In each mode, the system flows continuously followingthe dynamics defined by flow(q, ~x0, t). Note that (t − tk) isthe actual duration in the k-th mode. When a switch betweentwo modes is performed, it is required that ξ(k + 1, tk+1) isupdated from the exit value ξ(k, t′k) in the previous mode,following the jump conditions.

Definition 10 (Trajectories of a Hybrid Automaton): Let Hbe a hybrid automaton, and ξ : Tm → X a hybrid trajectory.We say that ξ : Tm → X is a trajectory of H of discrete depthm, if there exists a labeling function σHξ : N→ Q such that:

• σHξ (0) = q0 and RF |= initq0(ξ(0, 0)).• For any (i, t) ∈ Tm, RF |= invσHξ (i)(ξ(i, t)).• When i = 0, RF |= flowq0(ξ(0, 0), ξ(0, t), t).• When i = k + 1, where 0 < k + 1 < m,

RF |= flowσHξ (k+1)(ξ(k + 1, tk+1), ξ(k + 1, t),

(t− tk+1)) andRF |= jump(σH(k)→σH(k+1))(ξ(k, t

′k), ξ(k + 1, tk+1)).

We write JHK to denote all possible trajectories of H .Definition 11 (Reachability Properties): Let H be a hybrid

automaton and U ⊆ X ×Q be a subset of its state space. LetU ⊆ X × Q be a subset of the state space of H . H reachesU if there exists ξ ∈ JHK such that there exists t ∈ R andn ∈ N satisfying

(ξ(t, n), σHξ (n)) ∈ U.

Let H be a hybrid system. Parameter synthesis for reachabilityproperties asks for a set of parameters such that some modecan be reached.

Definition 12 (Parameterized Hybrid Automaton): We say ahybrid automaton H is parameterized by ~p, if We say H isparameterized by ~p = (p1, ..., pm), if

H(~p) = 〈X,Q, flow(~p), jump(~p), inv(~p), init(~p)〉,

where ~p are among the free variables in the LRF -representationof H .

Definition 13 (Parameter Synthesis for Reachability Prop-erties): Let H(~p) be a hybrid automaton parameterized byvariables ~p = (p1, ..., pm), and U ⊆ X×Q a subset of its statespace. Thus, the parameter synthesis problem for reachabilityasks for an assignment for ~a ∈ Rm such that H(~a) reachesU .

C. Synthesizing Parameters with δ-Decisions

We now show how to encode parameter synthesis prob-lems for LRF -represented hybrid systems using LRF -formulas.Throughout the following two definitions, let H = 〈X , Q,flow, jump, init〉 be an n-dimensional LRF -represented hybridsystem with |Q| = m, and unsafe an LRF -formula thatencodes a subset U ⊆ X × Q. Let k ∈ N and M ∈ R bethe bounds on steps and time respectively. Recall that q0 ∈ Qalways denotes the starting mode.

ReachkH,q′(~xtk) defines the states that H can reach, if after

k steps of discrete changes it is in mode q′. From there, if Hmakes a jump from mode q′ to q, then the states have to makea discrete change following jumpq′→q(~x

tk, ~xk+1). As last, in

mode q′, any state ~xtk+1 that H can reach should satisfy theflow conditions flowq(~x

tk+1, ~xk+1, t) in mode q. Note that after

each discrete jump, a new time variable tk is introduced andindependent from the previous ones.

The (k,M)-reachability encoding of H and U ,Reachk,M (H,U), is defined as:

∃~a∃X~x0∃X~xt0 · · · ∃X~xk∃X~xtk∃[0,M ]t0 · · · ∃[0,M ]tk(initq0(~x0) ∧ flowq0(~a, ~x0, ~x

t0, t0)

∧ ∀[0,t0]t∀X~x (flowq0(~a, ~x0, ~x, t)→ invq0(~a, ~x))

∧k−1∨i=0

( ∨q,q′∈Q

(jumpq→q′(~a, ~x

ti, ~xi+1) ∧ flowq′(~a, ~xi+1, ~x

ti+1, ti+1)

∧ ∀[0,t0]t∀X~x (flowq′(~a, ~xi+1, ~x, t)→ invq0(~a, ~x)))))

∧ unsafe(~a, ~xtk)).

H reaches U in k steps of discrete jumps with time durationless than M for each state iff Reachk,M (H,U) is true.

IV. APPLICATIONS

A. Model Calibration and Falsification

The δ-decision problems can be solved using our dRealtool [52]. Parameter estimation of single-mode ODE modelscan be encoded as SMT formulas by BioPSy [53] and solvedby dReal, while for multi-mode models we ask a k-stepreachability question: Is there a set of parameter values usingwhich the model reaches the goal region in k steps? ThedReach tool [54] can automatically build such reachabilityformulas from a multi-mode model and a goal description,which are then verified by dReal. If unsat is returned, themodel is unfeasible, which means that the model is unable tosatisfy a desired behavior no matter which parameter valuesare used. This can be used to reject model hypotheses. Forexample, we have showed that the Fenton-Karma model [55]of cardiac cells is unable to reproduce the “spike-and-dome”morphology of action potential which has been observed inepicardial cells [37]. On the other hand, if the model is δ-sat, a witness (i.e. a set of parameter values) is returned.For example, using the Bueno-Cherry-Fenton model [56], wehave identified critical parameter ranges that can cause cardiacdisorders such as tachycardia and fibrillation [37].

B. Identification of Therapeutic Strategies

The δ-decision procedures can be used to design optimaltherapeutic strategies. For example, Fig. 3 illustrates a multi-mode model of the TBI-induced signaling network shown inFig. 1. The starting point Mode 0 corresponds to live cellsunder no treatment for 24 h after TBI. Mode 1 is the “point ofno return” which leads to cell death. Modes A-E represent livecells subjected to particular treatments (e.g. Balcalein-induced

ferroptosis inhibition). The jump conditions are defined by themolecular signature. For example, starting with Mode 0, if theoxidized CL level exceeds a threshold θ1, the system jumps toMode A, which means that we deliver the apoptosis inhibitorJP4-039. The system then evolves according to the ODEs inMode A, until another jump condition–e.g. the level of acti-vated RIP3 above threshold θ2–is reached, which implies theonset of necroptosis, or Mode B. We then deliver necroptosisinhibitor necrostatin-1. Suppose the system next jumps backto Mode 0 and stays. The mode path 0 → A → B → 0suggests a successful treatment scheme defined by a set ofjump conditions. Note that we also aim to minimize thenumber of drugs used (i.e. path length) to avoid potentialside effects. Thus, the problem of determining which drugto deliver at what time, evolves into a parameter synthesisproblem for hybrid automata and can be tackled by δ-decisionprocedures. In a “proof-of-concept” study [38], we have usedthis approach to identity personalized therapeutic strategies forprostate cancer patients.

0 1Live Death

A

C

B

D

E

Ferroptosis Inhibition Mode

AA

AA-PE

ACSL4LPCAT3 PEBP115LOX

PEBP1-15LOX

PE-AA-OOH

PE-AA-OH

RIP3

PEBP1-RIP3

Balcalein

… …

… …GPX4

Signature

Fig. 3. Multi-mode modeling. Mode 0: live cell, no treatment; Mode A:apoptosis inhibition; Mode B: necroptosis inhibition; Mode C: Ferroptosisinhibition; Mode D: Pyroptosis inhibition; Mode E: Parthanatos inhibitionMode 1: dead cell.

C. Stability Analysis

The robustness of biological systems often refers to the con-sistency of system behavior in response to small perturbations.For example, cardiac cells filter out insignificant stimulationsto ensure proper functioning in noisy environments. Usingthe δ-decision procedures, we can verify this by checking ifthe action potential can be successfully triggered by a smallrange of stimulation. An unsat answer returned by dReachwill guarantee that the model is robust to the correspondingstimulation amplitude [37].

In addition to “time-bounded” robustness, the δ-decisionprocedures can also be used to analyze the infinite-timestability of nonlinear dynamical systems [57], [58]. Suchstability–often referred as structural stability–exists in thesystems that have unique globally asymptotically stable steadystates. A standard way of verifying this property is to find aLyapunov function [59] that provides theoretical guarantees onqualitative behavior of the system. Lyapunov-enable analysishas been applied to mass-action law based kinetic models ofsignaling networks such as T-cell kinetic proofreading andERK signaling [60]. Our δ-decision procedures enable theLyapunov stable analysis for systems with non-polynomial

nonlinearity in two ways: (i) Given a template function, wecan synthesize a Lyapunov function by solving ∃∀-formulasthat encode the corresponding non-convex, multi-objective anddisjunctive optimization problem [57]; (ii) We can provide asound and relative-complete proof system for induction rulesthat robustify the standard notions of Lyapunov functions [58].

V. CONCLUSION AND FUTURE WORKS

We have presented a model checking-enabled frameworkfor analyzing systems biology models with the help of δ-decision procedures. We used the LRF -formulas to describeparameterized hybrid automata and encode parameter syn-thesis problems. We employed the δ-decision procedures toperform bounded model checking and obtain parameters usingwhich the model can satisfy desired properties. We haveshowed that the δ-decision procedures can be used to estimateunknown model parameters, reject model hypothesis, analyzethe model’s Lyapunov stability, as well as design combinationtherapies. These tasks can be assembled as a unified workflowfor understanding the mechanism of diseases and identify-ing therapeutic options. Our preliminary studies on prostatecancer, cardiac disorders, and radiation diseases have shownpromising results.

An interesting direction is extending our method for proba-bilistic settings to address the inherent variability in biologicalsystems. To cope with the model complexity, an idea is toapproximate the hybrid system as a multi-mode network ofDBNs by extending the approximation technique we havedeveloped for a single system of ODEs [5]. We plan toexplore this in our future work. In this respect, the Chow-Liutree representation-based approximation scheme used in [61]promises to offer helpful pointers.

ACKNOWLEDGMENT

This work is supported by National Institutes of Healthgrants P01DK096990, U19AI068021, and P41GM103712.

REFERENCES

[1] P. K. Sorger and B. Schoeberl, “An expanding role for cell biologistsin drug discovery and pharmacology,” Mol. Biol. Cell, vol. 23, no. 21,pp. 4162–4164, 2012.

[2] B. Liu and P. S. Thiagarajan, “Modeling and Analysis of BiopathwaysDynamics,” J. Bioinf. Comput. Biol., vol. 10, no. 4, p. 1231001, 2012.

[3] B. Liu, P. Thiagarajan, and D. Hsu, “Probabilistic approximations ofsignaling pathway dynamics,” in CMSB’09, 2009, pp. 251–265.

[4] B. Liu, D. Hsu, and P. Thiagarajan, “Probabilistic approximations ofODEs based bio-pathway dynamics,” Theor. Comput. Sci., vol. 412,no. 21, pp. 2188–2206, 2011.

[5] B. Liu et al., “Approximate probabilistic analysis of biopathway dynam-ics,” Bioinformatics, vol. 28, no. 11, pp. 1508–1516, 2012.

[6] A. Hagiescu et al., “GPU code generation for ODE-based applicationswith phased shared-data access patterns,” ACM Trans. Archit. CodeOptim, vol. 10, no. 4, pp. 1–19, 2013.

[7] S. K. Palaniappan, S. Akshay, B. Liu, B. Genest, and P. Thiagarajan, “Ahybrid factored frontier algorithm for dynamic bayesian networks with abiopathways application,” IEEE/ACM Trans. Comput. Biol. Bioinform.,vol. 9, no. 5, pp. 1352–1365, 2012.

[8] S. K. Palaniappan, M. Pichene, G. Batt, E. Fabre, and B. Genest,“A look-ahead simulation algorithm for dbn models of biochemicalpathways,” in HSB’16, 2016, pp. 3–19.

[9] B. Liu et al., “A computational and experimental study of the regulatorymechanisms of the complement system,” PLoS Comput. Biol., vol. 7,no. 1, 2011.

[10] S. K. Palaniappan, F. Bertaux, M. Pichene, E. Fabre, G. Batt, andB. Genest, “Abstracting the dynamics of biological pathways usinginformation theory: a case study of apoptosis pathway,” Bioinformatics,vol. 33, no. 13, pp. 1980–1986, 2017.

[11] S. K. Palaniappan, B. M. Gyori, B. Liu, D. Hsu, and P. S. Thiagarajan,“Statistical model checking based calibration and analysis of bio-pathway models,” in CMSB’13, vol. 8130 LNCS, 2013, pp. 120–134.

[12] B. Liu, B. M. Gyori, and P. Thiagarajan, “Statistical model checking-based analysis of biological networks,” in Automated Reasoning forSystems Biology and Medicine, 2019, pp. 63–92.

[13] R. Ramanathan, Y. Zhang, J. Zhou, B. M. Gyori, W.-F. Wong, andP. Thiagarajan, “Parallelized parameter estimation of biological pathwaymodels,” in HSB’15, 2015, pp. 37–57.

[14] B. Liu and J. R. Faeder, “Parameter estimation of rule-based modelsusing statistical model checking,” in BIBM’16, 2016, pp. 1453–1459.

[15] Q. Wang, N. Miskov-Zivanov, B. Liu, J. R. Faeder, M. Lotze, andE. M. Clarke, “Formal modeling and analysis of pancreatic cancermicroenvironment,” in CMSB’16, 2016, pp. 289–305.

[16] B. M. Gyori, B. Liu, S. Paul, R. Ramanathan, and P. Thiagarajan,“Approximate probabilistic verification of hybrid systems,” in HSB’15,2015, pp. 96–116.

[17] B. Liu, Q. Liu, S. Palaniappan, I. Bahar, P. S. Thiagarajan, and J. L.Ding, “Innate Immune Memory and Homeostasis May Be ConferredThrough TLR3-TLR7 Pathway Crosstalk,” Sci. Signal., vol. 9, no. 436,p. ra70, 2016.

[18] B. Liu, D. Bhatt, Z. N. Oltvai, J. S. Greenberger, and I. Bahar,“Significance of p53 dynamics in regulating apoptosis in response toionizing radiation, and polypharmacological strategies.” Sci. Rep., vol. 4,p. 6245, 2014.

[19] B. Liu et al., “Quantitative assessment of cell fate decision betweenautophagy and apoptosis,” Sci. Rep., vol. 7, no. 1, pp. 1–14, 2017.

[20] V. E. Kagan et al., “Oxidized arachidonic and adrenic pes navigate cellsto ferroptosis,” Nat. Chem. Biol., vol. 13, no. 1, p. 81, 2017.

[21] A. A. Kapralov et al., “Redox lipid reprogramming commands suscep-tibility of macrophages and microglia to ferroptotic death,” Nat. Chem.Biol., vol. 16, no. 3, pp. 278–290, 2020.

[22] J. Steinman et al., “Improved total-body irradiation survival by deliveryof two radiation mitigators that target distinct cell death pathways,”Radiat. Res, vol. 189, no. 1, pp. 68–83, 2018.

[23] S. Thermozier et al., “Radioresistance of serpinb3a-/- mice and derivedhematopoietic and marrow stromal cell lines,” Radiat. Res., vol. 192,no. 3, pp. 267–281, 2019.

[24] ——, “Anti-ferroptosis drug enhances total-body irradiation mitigationby drugs that block apoptosis and necroptosis,” Radiat. Res., p. [Epubahead of print], 2020.

[25] R. Goebel, R. G. Sanfelice, and A. R. Teel, “Hybrid dynamical systems,”IEEE Contr. Syst. Mag., vol. 29, no. 2, pp. 28–93, 2009.

[26] T. A. Henzinger, “The theory of hybrid automata,” in LICS’96, Wash-ington, DC, USA, 1996, pp. 278–292.

[27] R. Ghosh and C. Tomlin, “Symbolic reachable set computation of piece-wise affine hybrid automata and its application to biological modelling:Delta-notch protein signalling,” IET Syst. Biol., vol. 1, no. 1, pp. 170–183, 2004.

[28] P. Ye, E. Entcheva, S. Smolka, and R. Grosu, “Modelling excitable cellsusing cycle-linear hybrid automata,” IET Syst. Biol., vol. 2, no. 1, pp.24–32, 2008.

[29] K. Aihara and H. Suzuki, “Theory of hybrid dynamical systems and itsapplications to biological and medical systems,” Philos. Trans. R. Soc.London, Ser. A, vol. 368, no. 1930, pp. 4893–4914, 2010.

[30] M. Antoniotti, B. Mishra, C. Piazza, A. Policriti, and M. Simeoni,“Modeling cellular behavior with hybrid automata: Bisimulation andcollapsing,” in CMSB’03, 2003, pp. 57–74.

[31] P. Lincoln and A. Tiwari, “Symbolic systems biology: Hybrid modelingand analysis of biological networks,” in HSCC’04, 2004, pp. 660–672.

[32] V. Baldazzi, P. T. Monteiro, M. Page, D. Ropers, J. Geiselmann, andH. De Jong, “Qualitative analysis of genetic regulatory networks inbacteria,” in Understanding the Dynamics of Biological Systems, 2011,pp. 111–130.

[33] E. Clarke, A. Fehnker, Z. Han, B. Krogh, O. Stursberg, and M. Theobald,“Verification of hybrid systems based on counterexample-guided abstrac-tion refinement,” in TACAS’03, 2003, pp. 192–207.

[34] T. A. Henzinger and P. W. Kopke, “Discrete-time control for rectangularhybrid automata,” Theor. Comput. Sci., vol. 221, no. 1, pp. 369–392,1999.

[35] M. Agrawal, F. Stephan, P. Thiagarajan, and S. Yang, “Behaviouralapproximations for restricted linear differential hybrid automata,” inHSCC’06, 2006, pp. 4–18.

[36] S. Gao, J. Avigad, and E. M. Clarke, “Delta-complete decision proce-dures for satisfiability over the reals,” in IJCAR’12, 2012, pp. 286–300.

[37] B. Liu, S. Kong, S. Gao, P. Zuliani, and E. M. Clarke, “Parametersynthesis for cardiac cell hybrid models using δ-decisions,” in CMSB’14,vol. 8859 LNCS, 2014, pp. 99–113.

[38] ——, “Towards personalized prostate cancer therapy using delta-reachability analysis,” in HSCC’15, 2015, pp. 227–232.

[39] B. Liu, S. Kong, S. Gao, and E. Clarke, “Parameter identification usingdelta-decisions for biological hybrid systems,” Carnegie Mellon Univ.,Tech. Rep. CMU-CS-13-136, 2013.

[40] L. Bortolussi and A. Policriti, “Hybrid systems and biology,” in FormalMethods for Computational Systems Biology, 2008, pp. 424–448.

[41] R. Alur, “Formal verification of hybrid systems,” in EMSOFT’11, Taipei,Taiwan, 2011, pp. 1–6.

[42] E. M. Clarke, J. R. Faeder, C. J. Langmead, L. A. Harris, S. K. Jha, andA. Legay, “Statistical model checking in BioLab: Applications to theautomated analysis of T-Cell receptor signaling pathway,” in CMSB’08,2008, pp. 231–250.

[43] N. Chabrier-Rivier, M. Chiaverini, V. Danos, F. Fages, and V. Schchter,“Modeling and querying biomolecular interaction networks,” Theor.Comput. Sci., vol. 325, no. 1, pp. 25–44, sep 2004.

[44] M. Kwiatkowska, G. Norman, and D. Parker, “Using probabilistic modelchecking in systems biology,” SIGMETRICS Perform. Eval. Rev., vol. 35,no. 4, pp. 14–21, 2008.

[45] C. Li, M. Nagasaki, C. H. Koh, and S. Miyano, “Online model checkingapproach based parameter estimation to a neuronal fate decision simu-lation model in Caenorhabditis elegans with hybrid functional Petri netwith extension,” Mol. Biosyst., vol. 11(Suppl 7), pp. 1–13, 2010.

[46] G. Batt, C. belta, and R. Weiss, “Temporal logic analysis of genenetworks under parameter uncertainty,” IEEE T. Automat. Contr., vol. 53,pp. 215–229, 2008.

[47] A. Donze, G. Clermont, and C. J. Langmead, “Parameter synthesisin nonlinear dynamical systems: Application to systems biology,” JComput. Biol., vol. 17, no. 3, pp. 325–336, 2010.

[48] A. Khalid and S. K. Jha, “Calibration of rule-based stochastic biochemi-cal models using statistical model checking,” in BIBM’18. IEEE, 2018,pp. 179–184.

[49] A. Pnueli, “The temporal logic of programs,” in SFCS’77, 1977, pp.46–57.

[50] E. M. Clarke, “The birth of model checking,” in 25 Years of ModelChecking, 2008, pp. 1–26.

[51] E. M. Clarke Jr, O. Grumberg, D. Kroening, D. Peled, and H. Veith,Model Checking. MIT Press, 2018.

[52] S. Gao, S. Kong, and E. M. Clarke, “dReal: An SMT solver for nonlineartheories of reals,” in CADE’13, 2013, pp. 208–214.

[53] C. Madsen, F. Shmarov, and P. Zuliani, “Biopsy: an smt-based tool forguaranteed parameter set synthesis of biological models,” in CMSB’15,2015, pp. 182–194.

[54] S. Kong, S. Gao, W. Chen, and E. Clarke, “dreach: δ-reachabilityanalysis for hybrid systems,” in TACAS’15, 2015, pp. 200–205.

[55] F. Fenton and A. Karma, “Vortex dynamics in 3D continuous my-ocardium with fiber rotation: filament instability and fibrillation,” Chaos,vol. 8, pp. 20–47, 1998.

[56] A. Bueno-Orovio, E. M. Cherry, and F. H. Fenton, “Minimal model forhuman ventricular action potentials in tissue,” J. Theor. Biol., vol. 253,pp. 544–560, 2008.

[57] S. Kong, A. Solar-Lezama, and S. Gao, “Delta-decision procedures forexists-forall problems over the reals,” in CAV’18, 2018, pp. 219–235.

[58] S. Gao et al., “Numerically-robust inductive proof rules for continuousdynamical systems,” in CAV’19, 2019, pp. 137–154.

[59] E. D. Sontag, Mathematical control theory: deterministic finite dimen-sional systems, 2nd ed. Springer, New York, 1998.

[60] M. A. Al-Radhawi, D. Angeli, and E. D. Sontag, “A computationalframework for a Lyapunov-enabled analysis of biochemical reactionnetworks,” PLoS Comput. Biol., vol. 16, no. 2, p. e1007681, 2020.

[61] M. Pichene, S. K. Palanniappan, E. Fabre, and B. Genest, “Modelingvariability in populations of cells using approximated multivariate distri-butions,” IEEE/ACM Trans. Comput. Biol. Bioinform., pp. 1–12, 2019.