Bounded Model Checking Research Articles

Verifying chip designs at RTL level

As chip designs become increasingly complex, the potential for errors and defects in circuits inevitably rises, posing significant challenges to chip security and reliability. This study investigates the use of the SAT-based bounded model checking (BMC) for Propositional Projection Temporal Logic (PPTL) to verify Verilog chip designs at the register transfer level (RTL). To this end, we propose an algorithm to implement automated extraction of state transfer relations from AIGER netlist and construction of Kripke structure. Additionally, we employ PPTL with the full regular expressiveness to describe the circuit properties to be verified, especially the periodic repetitive properties. This is not possible with Linear Temporal Logic (LTL) and Computational Tree Logic (CTL). By combining the PPTL properties with finite system paths and transforming them into conjunctive normal forms (CNFs), we utilize an SAT solver for verification. Experimental results demonstrate that our verification tool, SAT-BMC4PPTL, achieves higher verification efficiency and comprehensiveness.

MAB-BMC: A Formal Verification Enhancer by Harnessing Multiple BMC Engines Together

In recent times, Bounded Model Checking (BMC) engines have gained wide prominence in formal verification. Different BMC engines exist, differing in their optimization, representations and solving mechanisms used to represent and navigate the underlying state transition of the given design to be verified. The objective of this article is to examine if combinations of BMC engines can help to combine their strengths. We propose an approach that can create a sequencing of BMC engines that can reach better depth in formal verification, as opposed to executing them alone for a specified time. Our approach uses machine learning, specifically, the Multi-Armed Bandit paradigm of reinforcement learning, to predict the best-performing BMC engine for a given unrolling depth of the underlying circuit design. We evaluate our approach on a set of benchmark designs from the Hardware Model Checking Competition (HWMCC) benchmarks and show that it outperforms the state-of-the-art BMC engines in terms of the depth reached or time taken to deduce a property violation. The synthesized BMC engine sequences reach better depths than HWMCC results and the state-of-the-art technique, super_deep, for more than 80% of the cases. It also outperforms single engine runs for more than 92% of the cases where a property violation is not found within a given time duration. For designs where property violations are found within the given time duration, the synthesized sequences found the property violation in a lesser time than HWMCC for all the designs and outperformed both super_deep and single engine runs for more than 87% of the designs.

Attacking Connection Tracking Frameworks as used by Virtual Private Networks

VPNs (Virtual Private Networks) have become an essential privacy-enhancing technology, particularly for at-risk users like dissidents, journalists, NGOs, and others vulnerable to targeted threats. While previous research investigating VPN security has focused on cryptographic strength or traffic leakages, there remains a gap in understanding how lower-level primitives fundamental to VPN operations, like connection tracking, might undermine the security and privacy that VPNs are intended to provide. In this paper, we examine the connection tracking frameworks used in common operating systems, identifying a novel exploit primitive that we refer to as the port shadow. We use the port shadow to build four attacks against VPNs that allow an attacker to intercept and redirect encrypted traffic, de-anonymize a VPN peer, or even portscan a VPN peer behind the VPN server. We build a formal model of modern connection tracking frameworks and identify that the root cause of the port shadow lies in five shared, limited resources. Through bounded model checking, we propose and verify six mitigations in terms of enforcing process isolation. We hope our work leads to more attention on the security aspects of lower-level systems and the implications of integrating them into security-critical applications.

FuSeBMC v4: Improving Code Coverage with Smart Seeds via BMC, Fuzzing and Static Analysis

Bounded model checking (BMC) and fuzzing techniques are among the most effective methods for detecting errors and security vulnerabilities in software. However, there are still shortcomings in detecting these errors due to the inability of existing methods to cover large areas in target code. We propose FuSeBMC v4, a test generator that synthesizes seeds with useful properties, that we refer to as smart seeds , to improve the performance of its hybrid fuzzer thereby achieving high C program coverage. FuSeBMC works by first analyzing and incrementally injecting goal labels into the given C program to guide BMC and Evolutionary Fuzzing engines. After that, the engines are employed for an initial period to produce the so–called smart seeds. Finally, the engines are run again, with these smart seeds as starting seeds, in an attempt to achieve maximum code coverage/find bugs. During seed generation and normal running, the Tracer subsystem aids coordination between the engines. This subsystem conducts additional coverage analysis and updates a shared memory with information on goals covered so far. Furthermore, the Tracer evaluates test-cases dynamically to convert cases into seeds for subsequent test fuzzing. Thus, the BMC engine can provide the seed that allows the fuzzing engine to bypass complex mathematical guards (e.g., input validation). As a result, we received three awards for participation in the fourth international competition in software testing (Test-Comp 2022), outperforming all state-of-the-art tools in every category, including the coverage category.

Exchanging information in cooperative software validation

Cooperative software validation aims at having verification and/or testing tools cooperate on the task of correctness checking. Cooperation involves the exchange of information about currently achieved results in the form of (verification) artifacts. These artifacts are typically specialized to the type of analysis performed by the tool, e.g., bounded model checking, abstract interpretation or symbolic execution, and hence require the definition of a new artifact for every new cooperation to be built. In this article, we introduce a unified artifact (called Generalized Information Exchange Automaton, short GIA) supporting the cooperation of over-approximating with under-approximating analyses. It provides information gathered by an analysis to its partner in a cooperation, independent of the type of analysis and usage context within software validation. We provide a formal definition of this artifact in the form of an automaton together with two operators on GIAs. The first operation reduces a program by excluding these parts, where the information that they are already processed is encoded in the GIA. The second operation combines partial results from two GIAs into a single on. We show that computed analysis results are never lost when connecting tools via these operations. To experimentally demonstrate the feasibility, we have implemented two such cooperation: one for verification and one for testing. The obtained results show the feasibility of our novel artifact in different contexts of cooperative software validation, in particular how the new artifact is able to overcome some drawbacks of existing artifacts.

Improving Bounded Model Checking exploiting Interpolation-based learning and strengthening

Improving Bounded Model Checking exploiting Interpolation-based learning and strengthening

Improving Bounded Model Checkers Scalability for Circuit De-Obfuscation: An Exploration

Improving Bounded Model Checkers Scalability for Circuit De-Obfuscation: An Exploration

Bounded model checking for interval probabilistic timed graph transformation systems against properties of probabilistic metric temporal graph logic

Cyber-physical systems often encompass complex concurrent behavior with timing constraints and probabilistic failures on demand. The analysis whether such systems with probabilistic timed behavior adhere to a given specification is essential. The formalism of Interval Probabilistic Timed Graph Transformation Systems (IPTGTSs) is often a suitable choice to model cyber-physical systems because (a) its rule-based approach to graph transformation can capture a wide range of system's structure dynamics when the states of the system can be represented by graphs while (b) it employs interval specifications for probabilistic behavior as well as lower and upper bounds on delays of steps to support systems where precise probabilities and delays are not known or may change during the runtime of the system. Probabilistic Metric Temporal Graph Logic (PMTGL) has been introduced as a powerful specification language to express worst-case/best-case probabilistic timed requirements such as actor-based soft deadlines using (a) path properties relying on its Metric Temporal Graph Logic fragment to track individual graph elements and (b) an operator inherited from Probabilistic Timed Computation Tree Logic to express worst-case/best-case probabilistic requirements identifying worst-case/best-case resolutions of non-determinism. Bounded Model Checking (BMC) support for Probabilistic Timed Graph Transformation Systems (PTGTSs) w.r.t. properties specified using PMTGL has been already presented. However, for IPTGTSs no analysis support w.r.t. PMTGL properties has been developed for stating metric temporal properties on identified subgraphs and their structural changes over time.In this paper, we adapt the BMC approach developed for PTGTSs to the case of IPTGTSs extending modeling and analysis support to the usage of probability intervals more appropriately covering cyber-physical systems where probabilistic effects cannot be specified precisely and need to be approximated instead. In our evaluation, we apply an implementation of our BMC approach in AutoGraph to a novel running example demonstrating the effect of using probability intervals instead of precise probability values.

Localizing faults using verification technique

In model-based fault diagnosis, it is assumed that a correct model of each program being diagnosed is available. In general, these techniques require test cases and user-specified assertions to localize the fault. This paper aims to localize faults in a faulty program without user-specified assertions and without executing the programs, and therefore, without using test cases. Given the faulty and the correct versions of a program, a product code is automatically constructed and assertions are automatically generated. The proposed method is a full y automatic, model-based static approach to fault localization. The proposed method reduces the fault search space by removing equivalent regions from the product code using verification techniques. To identify these components, the bounded model checker CBMC is used. The invoked functions from the correct and the faulty programs are considered uninterpreted functions and MiniSat is used as a backend solver. The proposed method can also be applied on static slices of the correct and faulty programs. Also, the identified fault search space can be analyzed along with the generated counterexample trace to pinpoint the fault. The experimental data is presented that supports the applicability of our approach. We demonstrate the effectiveness of the proposed method using the Siemens TCAS and NTS benchmark suite. It is observed that the method can also successfully localize the wrong safety check bug produced by the LLVM compiler.

Automated SC-MCC Test Case Generation using Bounded Model Checking for Safety-Critical Applications

Modified Condition/Decision Coverage (MC/DC) is an important criterion to test the safety-critical applications because it generates test cases in a linear manner from N+1 to 2N, where N is the number of Atomic Conditions in a given predicate. It is desirable in comparison to the exponential test cases produced for Multiple Condition Coverage (MCC), i.e., 2N. However, MCC with Short-Circuit (SC-MCC) is recommended since most of the safety-critical applications are built on the high-level languages that use Short-Circuit evaluation property. Our goal is to demonstrate that, despite the added overhead, the SC-MCC coverage-based test cases have a high error-detection probability compared to that of MC/DC. In this work, we have considered the CBMC tool to generate both the SC-MCC and MC/DC test cases for 80 RERS benchmark programs. Then, by optimizing the traditional Mutation Testing (using the GCOV tool), we computed the Mutation Score (%) to assess the quality of the generated test cases. As per the Mutation analysis, the proposed SC-MCC outperformed MC/DC for over 75% of the 80 RERS programs considered. Additionally, as per the Execution time analysis, the average total time taken to evaluate the MC/DC part of the proposed framework is 3065.98 s, whereas SC-MCC framework evaluation took 2167.70 s. This proves the efficiency of the proposed (SC-MCC) work over the traditional criterion (MC/DC) based work.

Formal Specification and Verification of JDK’s Identity Hash Map Implementation

Hash maps are a common and important data structure in efficient algorithm implementations. Despite their wide-spread use, real-world implementations are not regularly verified. In this article, we present the first case study of the IdentityHashMap class in the Java JDK. We specified its behavior using the Java Modeling Language (JML) and proved correctness for the main insertion and lookup methods with KeY, a semi-interactive theorem prover for JML-annotated Java programs. Furthermore, we report how unit testing and bounded model checking can be leveraged to find a suitable specification more quickly. We also investigated where the bottlenecks in the verification of hash maps lie for KeY by comparing required automatic proof effort for different hash map implementations and draw conclusions for the choice of hash map implementations regarding their verifiability.

Towards Building Verifiable CPS using Lingua Franca

Formal verification of cyber-physical systems (CPS) is challenging because it has to consider real-time and concurrency aspects that are often absent in ordinary software. Moreover, the software in CPS is often complex and low-level, making it hard to assure that a formal model of the system used for verification is a faithful representation of the actual implementation, which can undermine the value of a verification result. To address this problem, we propose a methodology for building verifiable CPS based on the principle that a formal model of the software can be derived automatically from its implementation. Our approach requires that the system implementation is specified in Lingua Franca (LF), a polyglot coordination language tailored for real-time, concurrent CPS, which we made amenable to the specification of safety properties via annotations in the code. The program structure and the deterministic semantics of LF enable automatic construction of formal axiomatic models directly from LF programs. The generated models are automatically checked using Bounded Model Checking (BMC) by the verification engine Uclid5 using the Z3 SMT solver. The proposed technique enables checking a well-defined fragment of Safety Metric Temporal Logic (Safety MTL) formulas. To ensure the completeness of BMC, we present a method to derive an upper bound on the completeness threshold of an axiomatic model based on the semantics of LF. We implement our approach in the LF V erifier and evaluate it using a benchmark suite with 22 programs sampled from real-life applications and benchmarks for Erlang, Lustre, actor-oriented languages, and RTOSes. The LF V erifier correctly checks 21 out of 22 programs automatically.

Automated verification of concurrent go programs via bounded model checking

Automated verification of concurrent go programs via bounded model checking

Model checking embedded adaptive cruise controllers

While checking functional correctness for automated driving is often achieved through vast amounts of automated and manual field testing, automating specification verification is essential for developing and releasing fully self-driving vehicles. This paper presents an automatic bounded model checking approach for functional specifications over longitudinal vehicle controller implementations. The proposed method checks the actual embedded program, rather than an extracted abstract model. The specification is converted into a monitor that is interleaved with the execution of the program over a finite time horizon in closed-loop simulation. A decomposition is proposed to tackle the verification complexity. This allows verifying the program for whole parameter sets using a software model checker as opposed to testing only individual samples. The approach is capable of identifying functional flaws in several exemplary longitudinal controllers with variable complexity.

Neural Policy Safety Verification via Predicate Abstraction: CEGAR

Neural networks (NN) are an increasingly important representation of action policies pi. Recent work has extended predicate abstraction to prove safety of such pi, through policy predicate abstraction (PPA) which over-approximates the state space subgraph induced by pi. The advantage of PPA is that reasoning about the NN – calls to SMT solvers – is required only locally, at individual abstract state transitions, in contrast to bounded model checking (BMC) where SMT must reason globally about sequences of NN decisions. Indeed, it has been shown that PPA can outperform a simple BMC implementation. However, the abstractions underlying these results (i.e., the abstraction predicates) were supplied manually. Here we automate this step. We extend counterexample guided abstraction refinement (CEGAR) to PPA. This involves dealing with a new source of spuriousness in abstract unsafe paths, pertaining not to transition behavior but to the decisions of the neural network pi. We introduce two methods tackling this issue based on the states involved, and we show that global SMT calls deciding spuriousness exactly can be avoided. We devise algorithmic enhancements leveraging incremental computation and heuristic search. We show empirically that the resulting verification tool has significant advantages over an encoding into the state-of-the-art model checker nuXmv. In particular, ours is the only approach in our experiments that succeeds in proving policies safe.

Verification of Safety for Synchronous-Reactive System Using Bounded Model Checking

Real-time embedded systems are increasingly applied in safety-critical areas, so guaranteeing the correctness of such systems by means of formal methods becomes particularly important. In this paper, we propose an optimized bounded model checking (BMC)-based formal verification approach for the verification of safety for synchronous-reactive (SR) models, which are often used to design systems with complicated control logic, especially the real-time embedded control systems. This method is based on the tackling of a series of challenging problems including the management of the logical clock, encoding of the contained ports, representation of the data types of ports, descriptions of behaviors of various components in a considered model, and formal consideration of the fixed-point semantics. We have implemented this proposed method in the prototype Ptolemy-Z3, and integrated this tool into the Ptolemy II environment. In addition, the experimental evaluation on 22 SR models has shown that our method performs better than the existing automatic verification method in Ptolemy II.

Parallel Software-Based Self-Testing with Bounded Model Checking for Kilo-Core Networks-on-Chip

Parallel Software-Based Self-Testing with Bounded Model Checking for Kilo-Core Networks-on-Chip

Improve Model Testing by Integrating Bounded Model Checking and Coverage Guided Fuzzing

Eectromechanical systems built by Simulink or Ptolemy have been widely used in industry fields, such as autonomous systems and robotics. It is an urgent need to ensure the safety and security of those systems. Test case generation technologies are widely used to ensure the safety and security. State-of-the-art testing tools employ model-checking techniques or search-based methods to generate test cases. Traditional search-based techniques based on Simulink simulation are plagued by problems such as low speed and high overhead. Traditional model-checking techniques such as symbolic execution have limited performance when dealing with nonlinear elements and complex loops. Recently, coverage guided fuzzing technologies are known to be effective for test case generation, due to their high efficiency and impressive effects over complex branches of loops. In this paper, we apply fuzzing methods to improve model testing and demonstrate the effectiveness. The fuzzing methods aim to cover more program branches by mutating valuable seeds. Inspired by this feature, we propose a novel integration technology SPsCGF, which leverages bounded model checking for symbolic execution to generate test cases as initial seeds and then conduct fuzzing based upon these worthy seeds. Over the evaluated benchmarks which consist of industrial cases, SPsCGF could achieve 8% to 38% higher model coverage and 3x-10x time efficiency compared with the state-of-the-art works.

SAT-Reach : A Bounded Model Checker for Affine Hybrid Systems

Bounded model checking (BMC) is well-known to be undecidable even for simple hybrid systems. Existing work targeted for a wide class of non-linear hybrid systems reduces the BMC problem to the satisfiability problem of an satisfiability modulo theory formula encoding the hybrid system dynamics. Consequently, the satisfiability of the formula is deduced with a δ-decision procedure. However, the encoded formula can be complex for large automaton and for deep exploration causing the decision procedure to be inefficient. Additionally, a generalized decision procedure can be inefficient for hybrid systems with simple dynamics. In this article, we propose a BMC algorithm built upon the foundation of the counter example guided abstraction refinement (CEGAR) technique and targeted for hybrid systems with piecewise affine dynamics, modeled as a hybrid automaton. In particular, our algorithm begins by searching an abstract counterexample in the discrete state-space of the automaton. We check whether a discovered abstract counterexample is spurious or real by a two-tier refinement of the state-space guided by the abstract counterexample. The primary refinement is through symbolic reachability analysis and the following refinement is via a search of a real counterexample by the trajectory splicing method, guided in turn by the outcome of reachability analysis. We show that our algorithm reaps the benefits of the CEGAR technique by directing the exploration in the regions of interest and pruning search space that is irrelevant to the property under consideration. In addition, an optimization by memoizing the computed symbolic states during reachability analysis has been proposed for efficiency. The proposed algorithm is implemented in the tool SAT-Reach, and we compare its performance with dReach , XSpeed , Flow* , SpaceEx, and a pattern database heuristic-guided search algorithm. Experiments demonstrate the efficacy of our algorithm.

Bounded Model Checking for Metric Temporal Logic Properties of Timed Automata with Digital Clocks

Metric temporal logic (MTL) is a popular real-time extension of linear temporal logic (LTL). This paper presents a new simple SAT-based bounded model-checking (SAT-BMC) method for MTL interpreted over discrete infinite timed models generated by discrete timed automata with digital clocks. We show a new translation of the existential part of MTL to the existential part of linear temporal logic with a new set of atomic propositions and present the details of the new translation. We compare the new method's advantages to the old method based on a translation of the hard reset LTL (HLTL). Our method does not need new clocks or new transitions. It uses only one path and requires a smaller number of propositional variables and clauses than the HLTL-based method. We also implemented the new method, and as a case study, we applied the technique to analyze several systems. We support the theoretical description with the experimental results demonstrating the method's efficiency.