Application Of Model Checking Research Articles

Boolean Satisfiability Solvers and Their Applications in Model Checking

Boolean satisfiability (SAT)—the problem of determining whether there exists an assignment satisfying a given Boolean formula—is a fundamental intractable problem in computer science. SAT has many applications in electronic design automation (EDA), notably in synthesis and verification. Consequently, SAT has received much attention from the EDA community, who developed algorithms that have had a significant impact on the performance of SAT solvers. EDA researchers introduced techniques such as conflict-driven clause learning, novel branching heuristics, and efficient unit propagation. These techniques form the basis of all modern SAT solvers. Using these ideas, contemporary SAT solvers can often handle practical instances with millions of variables and constraints. The continuing advances of SAT solvers are the driving force of modern model checking tools, which are used to check the correctness of hardware designs. Contemporary automated verification techniques such as bounded model checking, proof-based abstraction, interpolation-based model checking, and IC3 have in common that they are all based on SAT solvers and their extensions. In this paper, we trace the most important contributions made to modern SAT solvers by the EDA community, and discuss applications of SAT in hardware model checking.

Systematically testing OpenFlow controller applications

The emergence of OpenFlow-capable switches enables exciting new network functionality, at the risk of programming errors that make communication less reliable. The centralized programming model, where a single controller program manages the network, seems to reduce the likelihood of bugs. However, the system is inherently distributed and asynchronous, with events happening at different switches and end hosts, and inevitable delays affecting communication with the controller. In this paper, we present efficient, systematic techniques for testing unmodified controller programs. Our NICE tool applies model checking to explore the state space of the entire system—the controller, the switches, and the hosts. Scalability is the main challenge, given the diversity of data packets, the large system state, and the many possible event orderings. To address this, we propose a novel way to augment model checking with symbolic execution of event handlers (to identify representative packets that exercise code paths on the controller). We also present a simplified OpenFlow switch model (to reduce the state space), and effective strategies for generating event interleavings likely to uncover bugs. Our prototype tests Python applications on the popular NOX platform. In testing three real applications—a MAC-learning switch, in-network server load balancing, and energy-efficient traffic engineering—we uncover 13 bugs.

PDDL+ Planning with Hybrid Automata: Foundations of Translating Must Behavior

Planning in hybrid domains poses a special challenge due to the involved mixed discrete-continuous dynamics. A recent solving approach for such domains is based on applying model checking techniques on a translation of PDDL+ planning problems to hybrid automata. However, the proposed translation is limited because must behavior is only over-approximated, and hence, processes and events are not reflected exactly. In this paper, we present the theoretical foundation of an exact PDDL+ translation. We propose a schema to convert a hybrid automaton with must transitions into an equivalent hybrid automaton featuring only may transitions.

A branching-time logic to verify synchronously coupled concurrent systems and its relevance to web-based systems

This paper is a sequel to our previous work wherein we proposed a state-based partial-order concurrency model from a given specification of communicating finite state machines CFSMs, constituting a cooperative system specification. We unfold the CFSMs by simulating them in global environment to generate what we proposed as communicating minimal prefix machines CMPMs. In this present work, we proceed from the unfolded CMPMs and go on to show that they form a distributed set of concurrent Kripke tree structures, over which we propose the logic computational distributed tree logic CDTL for model-checking. We show that CDTL provides an interesting set of expressive and nested formulae to verify safety, liveness and fairness properties. The component Kripke structures keep track of their respective local identities and at the same time maintain a global view through the environment vectors annotating every local CMPM state of the component Kripke structure. As a result, we achieve modularity as well as alleviation of state-explosion in our model-checking. Application of model-checking on web-systems is discussed.

Business Process Verification: The Application of Model Checking and Timed Automata


 
 
 The most important result to standardize the notation for graphical representation of Business Processes (BPs) is the Business Process Model and Notation (BPMN). Despite the BPs modeled with BPMN being able to support business designers, BPMN models are not appropriate to support the analysis phase. BPMN models have no formal seman- tics to conduct qualitative analysis (validation and verification). In this work is presented how Model Checking (MC) verification technique for software and Timed Automata (TA) formal language are integrated within a formal verification approach to check BPs mod- eled with BPMN. Also, are introduced a set of guideline to transform BPMN models into TA. The use of our approach allow to business analysts and designers to perform evaluation (i.e., qualitative analysis) of BPs, based on the formal specification of BP–task model with TA. The application of the approach is aimed to evaluate the behavior of the BP–task model with respect to business performance indicators (for instance, service time, waiting time or queue size) derived from business needs, as is shown in an instance of an enterprise–project related to Customer Relationship Management.
 
 

Incremental test case generation using bounded model checking: an application to automatic rating

In this paper we focus on the task of rating solutions to a programming exercise. State-of-the-art rating methods generally examine each solution against an exhaustive set of test cases, typically designed manually. Hence an issue of completeness arises. We propose the application of bounded model checking to the automatic generation of test cases. The experimental evaluation we have performed reveals a substantial increase in accuracy of ratings at a cost of a moderate increase in computation resources needed. Most importantly, application of model checking leads to the finding of errors in solutions that would previously have been classified as correct.

TLM.open: a SystemC/TLM Frontend for the CADP Verification Toolbox

SystemC/TLM models, which are C++ programs, allow the simulation of embedded software before hardware low-level descriptions are available and are used as golden models for hardware verification. The verification of the SystemC/TLM models is an important issue since an error in the model can mislead the system designers or reveal an error in the specifications. An open-source simulator for SystemC/TLM is provided but there are no tools for formal verification. In order to apply model checking to a SystemC/TLM model, a semantics for standard C++ code and for specific SystemC/TLM features must be provided. The usual approach relies on the translation of the SystemC/TLM code into a formal language for which a model checker is available. We propose another approach that suppresses the error-prone translation effort. Given a SystemC/TLM program, the transitions are obtained by executing the original code using g++ and an extended SystemC library, and we ask the user to provide additional functions to store the current model state. These additional functions generally represent less than 20% of the size of the original model, and allow it to apply all CADP verification tools to the SystemC/TLM model itself.

Model checking aircraft controller software: a case study

SummaryThis paper documents an application of model checking to formally verify an interrupt‐driven Slats and Flaps Control Unit software programmed in C, one component of a certain type of Chinese aircraft. Our objective was to identify errors rather than to prove correctness. We focused on the correctness of the algorithms used in the buffer operations, which are very common and important in aircraft software. In the verification, a total of four flawed code fragments was identified, including a minor efficiency issue. According to the programming team, this is regarded as a very successful result, and this project is the first successful attempt to apply model checking to the practice of verifying onboard aircraft software in China. Thanks to its completeness and reality, this case study can also serve as a complete and valuable real‐world example for teaching and learning model checking. Copyright © 2013 John Wiley & Sons, Ltd.

Efficient decomposition of strongly connected components on GPUs

The GPU (Graphics Processing Unit) has recently become one of the most power efficient processors in embedded and many other environments, and has been integrated into more and more SoCs (System on Chip). Thus modern GPUs play a very important role in power aware computing. Strongly Connected Component (SCC) decomposition is a fundamental graph algorithm which has wide applications in model checking, electronic design automation, social network analysis and other fields. GPUs have been shown to have great potential in accelerating many types of computations including graph algorithms. Recent work have demonstrated the plausibility of GPU SCC decomposition, but the implementation is inefficient due to insufficient consideration of the distinguishing GPU programming model, which leads to poor performance on irregular and sparse graphs. This paper presents a new GPU SCC decomposition algorithm that focuses on full utilization of the contemporary embedded and desktop GPU architecture. In particular, a subgraph numbering scheme is proposed to facilitate the safe and efficient management of the subgraph IDs and to serve as the basis of efficient source selection. Furthermore, we adopt a multi-source partition procedure that greatly reduces the recursion depth and use a vertex labeling approach that can highly optimize the GPU memory access. The evaluation results show that the proposed approach achieves up to 41x speedup over Tarjan's algorithm, one of the most efficient sequential SCC decomposition algorithms, and up to 3.8x speedup over the previous GPU algorithms.

Using Timed Automata for Modeling Distributed Systems with Clocks: Challenges and Solutions

The application of model checking for the formal verification of distributed embedded systems requires the adoption of techniques for realistically modeling the temporal behavior of such systems. This paper discusses how to model with timed automata the different types of relationships that may be found among the computer clocks of a distributed system, namely, ideal clocks, drifting clocks, and synchronized clocks. For each kind of relationship, a suitable modeling pattern is thoroughly described and formally verified.

Applying Model Checking to Destructive Testing and Analysis of Software System

Recently, model checking is widely applied to software and hardware verification. It can locate hard-to-find bugs in systems by exhaustively searching executing paths. In this paper, we propose a new software design method that enables us to evaluate the fault tolerance of software behavior at the specification level: we can check software behavior, not only when the hardware and network are in good order, but also when they are out of order; we can then improve fault tolerance of the target software using the model checker. We can test software under environments in which we destroy hardware and/or networks intentionally in computer simulation. The method is explained by taking an example of a network-connected AV appliance. We model the AV appliance by the modeling language Promela and analyze it by the SPIN model checker.

Automated Route Planning for Milk-Run Transport Logistics with the NuSMV Model Checker

In this paper, we propose and implement an automated route planning framework for milk-run transport logistics by applying model checking techniques. First, we develop a formal specification framework for milk-run transport logistics. The framework adopts LTL (Linear Temporal Logic), a language based on temporal logics, as a specification language for users to be able to flexibly and formally specify complex delivery requirements for trucks. Then by applying the bounded semantics of LTL, the framework then defines the notion of “optimal truck routes”, which mean truck routes on a given route map that satisfy given delivery requirements (specified by LTL) with the minimum cost. We implement the framework as an automated route planner using the NuSMV model checker, a state-of-the-art bounded model checker. The automated route planner, given route map and delivery requirements, automatically finds optimal trucks routes on the route map satisfying the given delivery requirements. The feasibility of the implementation design is investigated by analysing its computational complexity and by showing experimental results. key words: automated route planning, transport logistics, model checking

A generalization of the Kaplan–Meier estimator for analyzing bivariate mortality under right-censoring and left-truncation with applications in model-checking for survival copula models

In this paper we provide a new nonparametric estimator of the joint distribution of two lifetimes under random right censoring and left truncation which can be seen as a bivariate extension of the Kaplan–Meier estimator. We derive asymptotic results for this estimator, including uniform n1/2-consistency, and develop a general methodology for bivariate lifetime modeling, a critical issue in studying reversion conditions that are commonplace in defined benefit pensions and private annuity contracts. An application to goodness-of-fit for survival copula models is discussed. We show that the procedures that we use are consistent, and propose a bootstrap procedure based on our estimator to compute the critical values. The new technique that we propose is tested on the Canadian dataset initially studied by Frees et al. (1996).

A constraint-based variability modeling framework

Constraint-based variability modeling is a flexible, declarative approach to managing solution-space variability. Product variants are defined in a top-down manner by successively restricting the admissible combinations of product artifacts until a specific product variant is determined. In this paper, we illustrate the range of constraint-based variability modeling by discussing two of its extreme flavors: constraint-guarded variability modeling and constraint-driven variability modeling. The former applies model checking to establish the global consistency of product variants which are built by manual specification of variations points, whereas the latter uses synthesis technology to fully automatically generate product variants that satisfy all given constraints. Each flavor is illustrated by means of a concrete case study.

3.6.2 Next Generation Requirements Engineering

AbstractEstablishing and managing a “good” set of requirements is one of the critical success factors for any space system project, and for the development of any complex product in general. The NextGenRE project sponsored by the European Space Agency has developed an innovative approach featuring the use of semantic wiki technology to enable users to specify structured, semantically‐rich requirements associated with canonical system designs in OMG SysML. Reuse of requirements through templates is supported, as well as semantic reasoning to check properties such as consistency and coherence among requirements. The approach is entirely model‐based, allowing tight integration of the requirements engineering and design processes and opening the way to the application of model checking and simulation techniques. The new approach is being validated alongside an existing space project.

Ground interpolation for the theory of equality

Theory interpolation has found several successful applications in model checking. We present a novel method for computing interpolants for ground formulas in the theory of equality. The method produces interpolants from colored congruence graphs representing derivations in that theory. These graphs can be produced by conventional congruence closure algorithms in a straightforward manner. By working with graphs, rather than at the level of individual proof steps, we are able to derive interpolants that are pleasingly simple (conjunctions of Horn clauses) and smaller than those generated by other tools. Our interpolation method can be seen as a theory-specific implementation of a cooperative interpolation game between two provers. We present a generic version of the interpolation game, parametrized by the theory T, and define a general method to extract runs of the game from proofs in T and then generate interpolants from these runs.

Achieving distributed control through model checking

We apply model checking of knowledge properties to the design of distributed controllers that enforce global constraints on concurrent systems. The problem of synthesizing a distributed controller is undecidable in the general case. We thus look at a variant of the synthesis problem that allows adding temporary synchronizations between processes. We calculate when processes can decide autonomously, based on their knowledge, whether to take or block an action so that the global constraint is not violated. The local knowledge of processes may not suffice to control the processes so as to achieve the global constraint without introducing new deadlocks. When individual processes cannot take a decision alone based on their knowledge, one may coordinate several processes to achieve joint knowledge in order to take joint decisions. A fixed coordination among sets of processes may severely degrade concurrency. Therefore, we propose the use of temporary coordinations. Since realizing such coordinations on a distributed platform induces communication overhead, we strive to minimize their number. We show how this framework is applied to the case of synthesizing a distributed controller for enforcing a priority order. Finally, we show that the general undecidability of distributed synthesis without adding synchronization holds even for the particular problem of enforcing a priority order.

Improving BDD Based Symbolic Model Checking with Isomorphism Exploiting Transition Relations

Symbolic model checking by using BDDs has greatly improved the applicability of model checking. Nevertheless, BDD based symbolic model checking can still be very memory and time consuming. One main reason is the complex transition relation of systems. Sometimes, it is even not possible to generate the transition relation, due to its exhaustive memory requirements. To diminish this problem, the use of partitioned transition relations has been proposed. However, there are still systems which can not be verified at all. Furthermore, if the granularity of the partitions is too fine, the time required for verification may increase. In this paper we target the symbolic verification of asynchronous concurrent systems. For such systems we present an approach which uses similarities in the transition relation to get further memory reductions and runtime improvements. By applying our approach, even the verification of systems with an previously intractable transition relation becomes feasible.

From Counterexamples to Incremental Interactive Tracing of Errors

Abstract This article summarizes the goals and the first results of the project CITE — from Counterexamples to Interactive Incremental Tracing of Errors — at the National Institute of Informatics (NII) in Tokyo, Japan. CITE aims at developing the fundamental methods for generating both comprehensive and comprehensible error reports based on model checking results. Model checking is a powerful and efficient method for finding flaws in hardware designs, object-oriented software, business processes, and hypermedia applications. One remaining major obstacle to a broader application of model checking is its limited usability for non-experts. It requires much effort and insight to determine the root cause of errors from counterexamples generated by model checkers in the case of a specification violation. The CITE project addresses this problem by proposing tree structured error reports that can be refined successively to the desired level of detail according to the user´s interest. First evaluations demonstrate that the proposed approach reveals more errors and explains the cause of errors more accurately than the counterexamples of existing model checkers.

CTRL: Extension of CTL with regular expressions and fairness operators to verify genetic regulatory networks

Model checking has proven to be a useful analysis technique not only for concurrent systems, but also for genetic regulatory networks ( Grns). Applications of model checking in systems biology have revealed that temporal logics should be able to capture both branching-time and fairness properties (needed for specifying multistability and oscillation properties, respectively). At the same time, they should have a user-friendly syntax easy to employ by non-experts. In this paper, we define Computation Tree Regular Logic ( Ctrl), an extension of Ctl with regular expressions and fairness operators that attempts to match these criteria. Ctrl subsumes both Ctl and Ltl, and has a reduced set of temporal operators indexed by regular expressions. We also develop a translation of Ctrl into Hennessy–Milner Logic with Recursion ( HmlR), an equational variant of the modal μ -calculus. This has allowed us to obtain an on-the-fly model checker with diagnostic for Ctrl by directly reusing the verification technology available in the Cadp toolbox. We illustrate the application of the Ctrl model checker by analyzing the Grn controlling the carbon starvation response of Escherichia coli.