Automatic Verification Tool Research Articles

Reasoning about multiple related abstractions with MultiStar

Encapsulated abstractions are fundamental in object-oriented programming. A single class may employ multiple abstractions to achieve its purpose. Such abstractions are often related and combined in disciplined ways. This paper explores ways to express, verify and rely on logical relationships between abstractions. It introduces two general specification mechanisms: export clauses for relating abstractions in individual classes, and axiom clauses for relating abstractions in a class and all its descendants. MultiStar, an automatic verification tool based on separation logic and abstract predicate families, implements these mechanisms in a multiple inheritance setting. Several verified examples illustrate MultiStar's underlying logic. To demonstrate the flexibility of our approach, we also used MultiStar to verify the core iterator hierarchy of a popular data structure library.

Filet-o-fish

We address a persistent problem with using domain-specific languages to write operating systems: the effort of implementing, checking, and debugging the DSL usually outweighs any of its benefits. Because these DSLs generate C by templated string concatenation, they are tedious to write, fragile, and incompatible with automated verification tools. We present Filet-o-Fish (FoF), a semantic language to ease DSL construction. Building a DSL using FoF consists of safely composing semantically-rich building blocks. This has several advantages: input files for the DSL are formal specifications of the system's functionality, automated testing of the DSL is possible via existing tools, and we can prove that the C code generated by a given DSL respects the semantics expected by the developer. Early experience has been good: FoF is in daily use as part of the tool chain of the Barrelfish multicore OS, which makes extensive use of domain-specific languages to generate low-level OS code. We have found that the ability to rapidly generate DSLs we can rely on has changed how we have designed the OS.

Design and verification of a non-repudiation protocol based on receiver-side smart card

All the existing non-repudiation protocols ensuring strong fairness have to assume that the communication channel between trusted third party (TTP) and each player is resilient at least. Where only unreliable channel can be guaranteed, all these protocols become impractical. In this study, based on smart card on the receiver side, the authors design a fair non-repudiation protocol that needs no assumptions on the communication channel. The smart card takes over the role of an online TTP server. Without a dedicated TTP server, this protocol is ideal for some ad hoc scenarios where no infrastructure is available. This protocol can also be easily modified to support fair exchange of time-sensitive data. Compared with other traditional security protocols, automatic formal verification of fair non-repudiation protocols is much harder to achieve. The authors use meta-reasoning method to prove that the fair exchange property of this protocol can be reduced to three secrecy properties that fall into the scope of today's most automatic verification tools and therefore can be easily verified. The authors also use a recently proposed automatic method to verify the non-repudiation properties and fairness property of our protocol.

Z2SAL: a translation-based model checker for Z

AbstractDespite being widely known and accepted in industry, the Z formal specification language has not so far been well supported by automated verification tools, mostly because of the challenges in handling the abstraction of the language. In this paper we discuss a novel approach to building a model-checker for Z, which involves implementing a translation from Z into SAL, the input language for the Symbolic Analysis Laboratory, a toolset which includes a number of model-checkers and a simulator. The Z2SAL translation deals with a number of important issues, including: mapping unbounded, abstract specifications into bounded, finite models amenable to a BDD-based symbolic checker; converting a non-constructive and piecemeal style of functional specification into a deterministic, automaton-based style of specification; and supporting the rich set-based vocabulary of the Z mathematical toolkit. This paper discusses progress made towards implementing as complete and faithful a translation as possible, while highlighting certain assumptions, respecting certain limitations and making use of available optimisations. The translation is illustrated throughout with examples; and a complete working example is presented, together with performance data.

Convincing Proofs for Program Certification

At the highest level of formal certification, the current research trend consists in providing evaluators with a formal checkable proof produced by automatic verification tools. The aim is to reduce the certification process to verifying the provided proof using a proof-checker. However, to date, no certified proof-checker has emerged. In addition, checkable proofs do not eliminate the need to validate the formalization of the verification problem. In this paper we consider the point of view of evaluators. We elaborate criteria that must be fulfilled by a formal proof in order to convince skeptical evaluators. Then, we present a methodology based on this notion of convincing proofs that requires simple formalizations to reach the level of confidence of formal certification. The key idea is to build a certified proof-checker – in collaboration with the evaluators – which is finally used to validate the proof provided by developers. We illustrate our approach on the correctness proof of a buffering protocol written in c that manages the data exchanges between concurrent tasks in avionics control systems.

Automated verification tool for time-dependent cryptographic protocols

An automated verification tool for analyzing time-dependent cryptographic protocol was proposed and implemented.Based on Time-dependent Cryptographic Protocol Logic(TCPL),the tool completed verifying the goals of cryptographic protocols automatically by the method of layered logic tree and using XML as its specification language.Experimental result shows that the tool can simplify the proving process,and improve the efficiency of security protocols verification.

Model Checking Dynamic Memory Allocation in Operating Systems

Most system software, including operating systems, contains dynamic data structures whose shape and contents should satisfy design requirements during execution. Model checking technology, a powerful tool for automatic verification based on state exploration, should be adapted to deal with this kind of structure. This paper presents a method to specify and verify properties of C programs with dynamic memory management. The proposal contains two main contributions. First, we present a novel method to extend explicit model checking of C programs with dynamic memory management. The approach consists of defining a canonical representation of the heap, moving most of the information from the state vector to a global structure. We provide a formal semantics of the method that allows us to prove the soundness of the representation. Secondly, we combine temporal LTL and CTL logic to define a two-dimensional logic, in time and space, which is suitable to specify complex properties of programs with dynamic data structures. We also define the model checking algorithms for this logic. The whole method has been implemented in the well known model checker SPIN, and illustrated with an example where a typical memory reader/writer driver is modelled and analyzed.

Chosen-name Attacks: An Overlooked Class of Type-flaw Attacks

In the context of Dolev-Yao style analysis of security protocols, we consider the capability of an intruder to dynamically choose and assign names to agents. This capability has been overlooked in all significant protocol verification frameworks based on formal methods. We identify and classify new type-flaw attacks arising from this capability.Several examples of protocols that are vulnerable to this type of attack are given, including Lowe's modification of KSL. The consequences for automatic verification tools are discussed.

System-on-Chip Environment: A SpecC-Based Framework for Heterogeneous MPSoC Design

The constantly growing complexity of embedded systems is a challenge that drives the development of novel design automation techniques. C-based system-level design addresses the complexity challenge by raising the level of abstraction and integrating the design processes for the heterogeneous system components. In this article, we present a comprehensive design framework, the system-on-chip environment (SCE) which is based on the influential SpecC language and methodology. SCE implements a top-down system design flow based on a specify-explore-refine paradigm with support for heterogeneous target platforms consisting of custom hardware components, embedded software processors, dedicated IP blocks, and complex communication bus architectures. Starting from an abstract specification of the desired system, models at various levels of abstraction are automatically generated through successive step-wise refinement, resulting in a pin-and cycle-accurate system implementation. The seamless integration of automatic model generation, estimation, and verification tools enables rapid design space exploration and efficient MPSoC implementation. Using a large set of industrial-strength examples with a wide range of target architectures, our experimental results demonstrate the effectiveness of our framework and show significant productivity gains in design time.

Specification and verification challenges for sequential object-oriented programs

Abstract The state of knowledge in how to specify sequential programs in object-oriented languages such as Java and C# and the state of the art in automated verification tools for such programs have made measurable progress in the last several years. This paper describes several remaining challenges and approaches to their solution.

Early Safety Analysis: from Use Cases to Component-based Software Development.

We propose an easy-to-use but formal approach for early safety analysis in the context of component-based software development and illustrate its application with a case example. Our approach aims at adopting formal safety analysis while maintaining flexibility and consistency throughout the development process. To this end, we use semi-formal use cases with templates that can be systematically translated into the formal specification language RSML -e , whose execution environment integrates automated verification tools such as the model checker NuSMV. Consistency between use cases and the high-level component design is maintained through a systematic transition, so that the result of the safety analysis can be easily reflected in the design model.

Policy Controlled System and Its Model Checking

A policy is an execution rule (or constraint) for objects in a system to retain security and integrity of the system. We introduce a simple policy specification language and define its operational semantics. A new NFA construction algorithm that works in linear time is proposed and a model checking method for policy controlled system (PCS) is presented. We conducted verification of a sample PCS for hotel reservation by our automatic verification tool and the experimental results showed the efficiency of the proposed method.

UML Automatic Verification Tool with Formal Methods

The use of the UML specification language is very widespread due to some of its features. However, the ever more complex systems of today require modeling methods that allow errors to be detected in the initial phases of development. The use of formal methods make such error detection possible but the learning cost is high.This paper presents a tool which avoids this learning cost, enabling the active behavior of a system expressed in UML to be verified in a completely automatic way by means of formal method techniques. It incorporates an assistant for the verification that acts as a user guide for writing properties so that she/he needs no knowledge of either temporal logic or the form of the specification obtained.

Structural and dynamic changes in concurrent systems: reconfigurable Petri nets

The aim of this work is the modeling and verification of concurrent systems subject to dynamic changes using extensions of Petri nets. We begin by introducing the notion of net rewriting system. In a net rewriting system, a system configuration is described as a Petri net and a change in configuration is described as a graph rewriting rule. We show that net rewriting systems are Turing powerful, that is, the basic decidable properties of Petri nets are lost and, thus, automatic verification in not possible for this class. A subclass of net rewriting systems are reconfigurable Petri nets. In a reconfigurable Petri net, a change in configuration amounts to the modification of the flow relations of the places in the domain of the involved rule according to this rule, independently of the context in which this rewriting applies. We show that reconfigurable Petri nets are formally equivalent to Petri nets. This equivalence ensures that all the fundamental properties of Petri nets are still decidable for reconfigurable Petri nets and this model is thus amenable to automatic verification tools. Therefore, the expressiveness of both models is the same, but, with reconfigurable Petri nets, we can easily and directly model systems that change their structure dynamically.

Using Forward Reachability Analysis for Verification of Lossy Channel Systems

We consider symbolic on-the-fly verification methods for systems of finite-state machines that communicate by exchanging messages via unbounded and lossy FIFO queues. We propose a novel representation formalism, called simple regular expressions (SREs), for representing sets of states of protocols with lossy FIFO channels. We show that the class of languages representable by SREs is exactly the class of downward closed languages that arise in the analysis of such protocols. We give methods for computing (i) inclusion between SREs, (ii) an SRE representing the set of states reachable by executing a single transition in a system, and (iii) an SRE representing the set of states reachable by an arbitrary number of executions of a control loop. All these operations are rather simple and can be carried out in polynomial time. With these techniques, one can straightforwardly construct an algorithm which explores the set of reachable states of a protocol, in order to check various safety properties. We also show how one can perform model-checking of LTL properties, using a standard automata-theoretic construction. It should be noted that all these methods are by necessity incomplete, even for the class of protocols with lossy channels. To illustrate the applicability of our methods, we have developed a tool prototype and used the tool for automatic verification of (a parameterized version of) the Bounded Retransmission Protocol.

Formulae Meet Programs Over the Net: A Framework for Correct Network Aware Programming

A general framework for network aware programming is presented that consists of a language for programming mobile applications, a logic for specifying properties of the applications and an automatic tool for verifying such properties. The framework is based on X-KLAIM, eXtended KLAIM, an experimental programming language specifically designed to program distributed systems composed of several components interacting through multiple tuple spaces and mobile code. The proposed logic is a modal logic inspired by Hennessy-Milner logic and is interpreted over the same labelled structures used for the operational semantics of X-KLAIM. The automatic verification tool is based on a complete proof system that has been previously developed for the logic.

Modular semantics for a UML statechart diagrams kernel and its extension to multicharts and branching time model-checking

Statechart diagrams provide a graphical notation to model dynamic aspects of system behaviour within the unified modelling language (UML). In this paper, we present a formal operational semantics for a behavioural subset of UML statechart diagrams (UMLSDs) including a formal proof of their correctness with respect to major UML semantics requirements concerning behavioural issues. We show how the modularity of our semantics definition can be exploited to define extensions, in particular we show an extension to models composed of collections of communicating statechart diagrams, which we call multicharts. Finally we present all the conceptual issues related to building a tool for action based branching time model-checking, for the automatic verification of formal correctness of UML multicharts. The approach we propose preserves all the information necessary to report the results of model-checking in terms of the original UMLSD specification. The reference verification environment used for this model-checking approach is JACK, where automata are represented in a standard format which facilitates the use of a collection of tools for automatic verification.

Mining specifications

Program verification is a promising approach to improving program quality, because it can search all possible program executions for specific errors. However, the need to formally describe correct behavior or errors is a major barrier to the widespread adoption of program verification, since programmers historically have been reluctant to write formal specifications. Automating the process of formulating specifications would remove a barrier to program verification and enhance its practicality.This paper describes specification mining , a machine learning approach to discovering formal specifications of the protocols that code must obey when interacting with an application program interface or abstract data type. Starting from the assumption that a working program is well enough debugged to reveal strong hints of correct protocols, our tool infers a specification by observing program execution and concisely summarizing the frequent interaction patterns as state machines that capture both temporal and data dependences. These state machines can be examined by a programmer, to refine the specification and identify errors, and can be utilized by automatic verification tools, to find bugs.Our preliminary experience with the mining tool has been promising. We were able to learn specifications that not only captured the correct protocol, but also discovered serious bugs.

Lightweight reasoning about program correctness

Automated verification tools vary widely in the types of properties they are able to analyze, the complexity of their algorithms, and the amount of necessary user involvement. In this paper we propose a framework for step-wise automatic verification and describe a lightweight scalable program analysis tool that combines abstraction and model checking. The tool guarantees that its True and False answers are sound with respect to the original system. We also check the effectiveness of the tool on an implementation of the Safety-Injection System.

Network integration testing: concepts, test specifications and tools for automatic telecommunication services verification

The purpose of this tutorial is to provide concepts and historical background of the “network integration testing” (NIT) methodology. NIT is a “grey box” testing technique that is aimed at verifying the correct behaviour of interconnected networks (operated by different operators) in provisioning services to end users, or the behaviour of a complex network operated by a unique operator. The main technical concepts behind this technique are presented along with the history of some International projects that have contributed to its early definition and application. European Institute for Research and Strategic Studies in Telecommunication (EURESCOM) has actually been very active, with many projects, in defining the NIT basic methodology and providing actual NIT specifications (for narrow-band and broad-band services, covering both voice and data). EURESCOM has also been acting as a focal point in the area, e.g., encouraging the Industry in developing commercial tools supporting NIT. In particular, the EURESCOM P412 project (1994–1996) first explicitly defined the NIT methodology (the methodological aspects include test notation, test implementation, test processes, distributed testing and related co-ordination aspects). P412 applied the methodology to ISDN whilst another project, P410, applied NIT to data services. The P613 project (1997–1999) extended the basic NIT methodology to the broad band and GSM. More into details, the areas covered currently by NIT test specifications developed by EURESCOM projects include N-ISDN, N-ISUP, POTS, B-ISDN, B-ISUP, IP over ATM, ATM/FR, GSM, focusing also on their “inter-working” cases (e.g., ISDN/ISDN, ISDN/GSM, etc.). ETSI, the European Telecommunication Standards Institute, also contributed to NIT development (e.g., the definition of the TSP1+ protocol, used for the functional co-ordination and timing synchronisation of all tools involved in a distributed testing session). The paper also discusses NIT in relation to the recent major changes (processes) within the telecommunication (TLC) community. Beyond the new needs coming from the pure technical aspects (integration of voice and data, fixed mobile convergence, etc.) the full deregulation of the TLC sector has already generated new processes and new testing needs (e.g., Interconnection Testing) that had a significant influence on the methodology. NIT is likely to continue to develop further in the future according to the needs of telecom operators, authorities, user’s associations and suppliers.