Bounded Model Checking Research Articles

αCheck: A mechanized metatheory model checker

AbstractThe problem of mechanically formalizing and proving metatheoretic properties of programming language calculi, type systems, operational semantics, and related formal systems has received considerable attention recently. However, the dual problem of searching for errors in such formalizations has attracted comparatively little attention. In this article, we present αCheck, a bounded model checker for metatheoretic properties of formal systems specified using nominal logic. In contrast to the current state of the art for metatheory verification, our approach is fully automatic, does not require expertise in theorem proving on the part of the user, and produces counterexamples in the case that a flaw is detected. We present two implementations of this technique, one based onnegation-as-failureand one based onnegation elimination, along with experimental results showing that these techniques are fast enough to be used interactively to debug systems as they are developed.

How to manage a conference special issue

STVR publishes a small number of special issues each year and has associated policies. However, simply following these policies/requirements does not ensure that all will run smoothly. In this editorial, I will focus on a very particular type of special issue: those that contain extended versions of conference papers. The editors of a special issue have many responsibilities. The first is to determine which authors should be invited to submit extended papers. This is not as simple as looking at the review scores from the conference and choosing the top few papers. For example, I have seen strong papers that have excellent reviews but that also are “complete” and so there is little scope to extend the work. Editors also have to consider the quality of the reviews, the contents of the reviewer comments, and also read the paper. Only then are they able to make a good assessment. The next stage of the process involves inviting authors and then advising those who accept the invitation. An extended paper should have significant additional content and not, for example, be the union of conference papers. It is also normal for an extended paper to have a different abstract and to carefully explain how the paper extends the original conference paper; I find that it is often best to place such an explanation in the introduction. Reviewers will be expected to comment on whether the extension is sufficient and authors should be encouraged to make it easy for the reviewers to make this assessment. The editors also have to choose reviewers. Ideally, this is done well in advance of the papers being received, thus limiting the scope for delays. We normally advise that, where possible, each paper should have one of the original reviewers and at least 1 reviewer who did not review the conference paper. In choosing one of the original reviewers, it is good to look at the quality of the reviews and the confidence scores. I would also recommend that the initial list of possible reviewers includes more than the minimum (3 reviewers per paper); in reality, not all those invited to review papers will accept. Once the reviews are in, the editors make recommendations (accept, minor revisions, major revisions, or reject). The recommendation should normally be made as soon as possible—there is usually no reason to make the authors wait longer than necessary. Making prompt recommendations can help speed up the overall process since, for example, reviews for 1 paper might arrive quite early but the authors might take longer to revise the paper. I certainly would advise against waiting for all of the reviews of all of the papers. The recommendations/decisions should be independent—we might have an expected number of papers for a special issue, but a paper will not be rejected because there is “no room.” As we have seen, there are many things to consider when organising a special issue—the above simply describes a few of these. However, there should be real satisfaction in seeing the final issue and hopefully, this makes the work worthwhile for the editors as well as the authors and readers. Now to this issue of STVR, which contains 2 papers. Both take a general area (testing, model checking) and explore this within a particular context. The first paper is “Pattern-Based GUI Testing: Bridging the Gap Between Design & Quality Assurance” by Moreira, Rodrigo; Paiva, Ana; Nabuco, Miguel; Memon, Atif (recommended by Le Traon). The aim of the paper is to develop new testing techniques, for graphical user interfaces, that take advantage of classic generic solutions (patterns). The authors thus develop a specialised testing technique that takes advantage of such generic solutions having been used. Essentially, this is a model-based testing technique that incorporates reuse around the test patterns identified. The work was evaluated through a case study with real faults and a second study that used seeded faults. The second paper is “Bounded Model Checking of C++ Programs based on the Qt Cross-Platform Framework” by Rodrigues Monteiro Sousa, Felipe; Praia Garcia, Mário Angel; Cordeiro, Lucas; Batista de Lima Filho, Eddie (recommended by Müller). This looks at the problem of verifying embedded systems where the software has been developed using a cross-platform software development framework (Qt) and the C++ programming language. Essentially, the authors modelled the Qt libraries. The approach was evaluated using a benchmark with 711 C++/Qt programs (many extracted from Qt documentation) plus 2 real applications.

Comparing sat-based bounded model checking rtectl and ectl properties

We compare two SAT-based bounded model checking algorithms for the properties expressed in the existential fragment of a soft real-time computation tree logic (RTECTL) and in the existential fragment of computation tree logic (ECTL). To this end, we use the generic pipeline paradigm (GPP) and the train controller system (TC), the classic concurrency problems, which we formalise by means of a finite transition system. We consider several properties of the problems that can be expressed in both RTECTL and ECTL, and we present the performance evaluation of the mentioned bounded model checking methods by means of the running time and the memory used.

Exploiting Hierarchy in the Abstraction-Based Verification of Statecharts Using SMT Solvers

Statecharts are frequently used as a modeling formalism in the design of state-based systems. Formal verification techniques are also often applied to prove certain properties about the behavior of the system. One of the most efficient techniques for formal verification is Counterexample-Guided Abstraction Refinement (CEGAR), which reduces the complexity of systems by automatically building and refining abstractions. In our paper we present a novel adaptation of the CEGAR approach to hierarchical statechart models. First we introduce an encoding of the statechart to logical formulas that preserves information about the state hierarchy. Based on this encoding we propose abstraction and refinement techniques that utilize the hierarchical structure of statecharts and also handle variables in the model. The encoding allows us to use SMT solvers for the systematic exploration and verification of the abstract model, including also bounded model checking. We demonstrate the applicability and efficiency of our abstraction techniques with measurements on an industry-motivated example.

Bounded model checking of C++ programs based on the Qt cross‐platform framework

SummaryThe software development process for embedded systems is getting faster and faster, which generally incurs an increase in the associated complexity. As a consequence, technology companies tend to invest in fast and automatic verification mechanisms, to create robust systems and reduce product recall rates. In addition, further development‐time reduction and system robustness can be achieved through cross‐platform frameworks, such as Qt, which favor the reliable port of software stacks to different devices. Based on that, the present paper proposes a simplified version of the Qt framework, which is integrated into a checker based on satisfiability modulo theories (SMT), known as the Efficient SMT‐based Context‐Bounded Model Checker, for verifying actual Qt‐based applications, with a success rate of 89%, for the developed benchmark suite. Furthermore, the simplified version of the Qt framework, named as Qt Operational Model, was also evaluated using other state‐of‐the‐art verifiers for C++ programs. In fact, Qt Operational Model was combined with 2 different verification approaches: explicit‐state model checking and also symbolic (bounded) model checking, during the experimental evaluation, which highlights its flexibility. The proposed methodology is the first one to formally verify Qt‐based applications, which has the potential to devise new directions for software verification of portable code.

Deriving Unbounded Reachability Proof of Linear Hybrid Automata during Bounded Checking Procedure

Reachability analysis of linear hybrid automata (LHA) is an important problem. Classical model checking (CMC) technique is not scalable and not guaranteed to terminate. On the other hand, bounded model checking (BMC) is more cost-effective to conduct but can not guarantee the safety beyond the bound. In this paper, we seek to bridge the gap between BMC and CMC for reachability analysis of LHA. During BMC of LHA, typical procedures can discover sets of unsatisfiable constraint cores, which can be mapped back to path segments in the graph structure of LHA. If every path connecting the initial and target location has to go through such infeasible path segment, the target location is entirely not reachable. Based on this characteristic, we propose a LTL model checking based approach to check whether the target location is blocked. To further optimize the performance, we propose an automata based solution to check the LTL specification incrementally and adopt an on-the-fly algorithm to check the accepting condition to avoid an explicit construction of product automata.

Formal Non-Fragile Stability Verification of Digital Control Systems with Uncertainty

A verification methodology is described and evaluated to formally determine uncertain linear systems stability in digital controllers with considerations to the implementation aspects. In particular, this methodology is combined with the digital-system verifier (DSVerifier), which is a verification tool that employs Bounded Model Checking based on Satisfiability Modulo Theories to check the stability of digital control systems with uncertainty. DSVerifier determines the control system stability, considering all the plant interval variation set, together with the Finite Word-length (FWL) effects in the digital controller implementation; DSVerifier checks the robust non-fragile stability of a given closed-loop system. The proposed methodology and respective tool are evaluated considering non-fragile control examples from literature. Experimental results show that the approach used in this study is able to foresee fragility problems in robust controllers, which could be overlooked by other existing approaches due to underestimating of FWL effects.

Incremental bounded model checking for embedded software

Program analysis is on the brink of mainstream usage in embedded systems development. Formal verification of behavioural requirements, finding runtime errors and test case generation are some of the most common applications of automated verification tools based on bounded model checking (BMC). Existing industrial tools for embedded software use an off-the-shelf bounded model checker and apply it iteratively to verify the program with an increasing number of unwindings. This approach unnecessarily wastes time repeating work that has already been done and fails to exploit the power of incremental SAT solving. This article reports on the extension of the software model checker CBMC to support incremental BMC and its successful integration with the industrial embedded software verification tool BTC EMBEDDEDTESTER. We present an extensive evaluation over large industrial embedded programs, mainly from the automotive industry. We show that incremental BMC cuts runtimes by one order of magnitude in comparison to the standard non-incremental approach, enabling the application of formal verification to large and complex embedded software. We furthermore report promising results on analysing programs with arbitrary loop structure using incremental BMC, demonstrating its applicability and potential to verify general software beyond the embedded domain.

Symbolic trajectory evaluation for word-level verification: theory and implementation

Symbolic trajectory evaluation (STE) is a model checking technique that has been successfully used to verify many industrial designs. Existing implementations of STE reason at the level of bits, allowing signals in a circuit to take values from a lattice comprised of three elements: 0, 1, and X. This limits the amount of abstraction that can be achieved, and presents limitations to scaling STE to even larger designs. The main contribution of this paper is to show how much more abstract lattices can be derived automatically from register-transfer level descriptions, and how a model checker for the general theory of STE instantiated with such abstract lattices can be implemented in practice. We discuss several implementation issues, including how word-level circuits can be symbolically simulated using a new encoding for words that allows representing X values of sub-words succinctly. This gives us the first practical word-level STE engine, called $$\mathsf {STEWord}$$STEWord. Experiments on a set of designs similar to those used in industry show that $$\mathsf {STEWord}$$STEWord scales better than bit-level STE, as well as word-level bounded model checking.

Multi-core model checking and maximum satisfiability applied to hardware-software partitioning

Bounded model checking (BMC) based on satisfiability modulo theories (SMT) is well-known by its capability to verify software. However, its use as optimisation tool, to solve hardware and software (HW-SW) partitioning problems, is something new. In particular, its integration with the maximum satisfiability solver vZ tool, which provides a portfolio of approaches for solving linear optimisation problems over SMT formulas, is unprecedented. We present new alternative approaches to solve the HW-SW partitioning problem. First, we use SMT-based BMC in conjunction with a multi-core support using open multi-processing to create four variants to solve the partitioning problem. The multi-core SMT-based BMC approaches allow initialising many verification instances based on the number of available processing cores, where each instance checks a different optimum value until the optimisation problem is satisfied. Additionally, we integrate the vZ into the BMC, making it a specialised solution for optimisation in a single-core environment. We implement all five approaches on top of the efficient SMT-based context-bounded model checker (ESBMC) and compare them to a state-of-the-art optimisation tool. Experimental results show that there is no single optimisation tool to solve all HW-SW partitioning benchmarks, but based on medium-size benchmarks, ESBMC-vZ had better performance.

Multi-core model checking and maximum satisfiability applied to hardware-software partitioning

Bounded model checking (BMC) based on satisfiability modulo theories (SMT) is well-known by its capability to verify software. However, its use as optimisation tool, to solve hardware and software (HW-SW) partitioning problems, is something new. In particular, its integration with the maximum satisfiability solver vZ tool, which provides a portfolio of approaches for solving linear optimisation problems over SMT formulas, is unprecedented. We present new alternative approaches to solve the HW-SW partitioning problem. First, we use SMT-based BMC in conjunction with a multi-core support using open multi-processing to create four variants to solve the partitioning problem. The multi-core SMT-based BMC approaches allow initialising many verification instances based on the number of available processing cores, where each instance checks a different optimum value until the optimisation problem is satisfied. Additionally, we integrate the vZ into the BMC, making it a specialised solution for optimisation in a single-core environment. We implement all five approaches on top of the efficient SMT-based context-bounded model checker (ESBMC) and compare them to a state-of-the-art optimisation tool. Experimental results show that there is no single optimisation tool to solve all HW-SW partitioning benchmarks, but based on medium-size benchmarks, ESBMC-vZ had better performance.

Fencing off go: liveness and safety for channel-based programming

Go is a production-level statically typed programming language whose design features explicit message-passing primitives and lightweight threads, enabling (and encouraging) programmers to develop concurrent systems where components interact through communication more so than by lock-based shared memory concurrency. Go can only detect global deadlocks at runtime, but provides no compile-time protection against all too common communication mismatches or partial deadlocks. This work develops a static verification framework for bounded liveness and safety in Go programs, able to detect communication errors and partial deadlocks in a general class of realistic concurrent programs, including those with dynamic channel creation and infinite recursion. Our approach infers from a Go program a faithful representation of its communication patterns as a behavioural type. By checking a syntactic restriction on channel usage, dubbed fencing, we ensure that programs are made up of finitely many different communication patterns that may be repeated infinitely many times. This restriction allows us to implement bounded verification procedures (akin to bounded model checking) to check for liveness and safety in types which in turn approximates liveness and safety in Go programs. We have implemented a type inference and liveness and safety checks in a tool-chain and tested it against publicly available Go programs. Updated on 27th Feb 2017. See Comments.

Combining techniques of bounded model checking and constraint programming to aid for error localization

A model checker can produce a trace of counter-example for erroneous program, which is often difficult to exploit to locate errors in source code. In my thesis, we proposed an error localization algorithm from counter-examples, named LocFaults, combining approaches of Bounded Model-Checking (BMC) with constraint satisfaction problem (CSP). This algorithm analyzes the paths of CFG (Control Flow Graph) of the erroneous program to calculate the subsets of suspicious instructions to correct the program. Indeed, we generate a system of constraints for paths of control flow graph for which at most k conditional statements can be wrong. Then we calculate the MCSs (Minimal Correction Sets) of limited size on each of these paths. Removal of one of these sets of constraints gives a maximal satisfiable subset, in other words, a maximal subset of constraints satisfying the postcondition. To calculate the MCSs, we extend the generic algorithm proposed by Liffiton and Sakallah in order to deal with programs with numerical instructions more efficiently. This approach has been experimentally evaluated on a set of academic and realistic programs.

Exact finite-state machine identification from scenarios and temporal properties

Finite-state models, such as finite-state machines (FSMs), aid software engineering in many ways. They are often used in formal verification and also can serve as visual software models. The latter application is associated with the problems of software synthesis and automatic derivation of software models from specification. Smaller synthesized models are more general and are easier to comprehend, yet the problem of minimum FSM identification has received little attention in previous research. This paper presents four exact methods to tackle the problem of minimum FSM identification from a set of test scenarios and a temporal specification represented in linear temporal logic. The methods are implemented as an open-source tool. Three of them are based on translations of the FSM identification problem to SAT or QSAT problem instances. Accounting for temporal properties is done via counterexample prohibition. Counterexamples are either obtained from previously identified FSMs, or based on bounded model checking. The fourth method uses backtracking. The proposed methods are evaluated on several case studies and on a larger number of randomly generated instances of increasing complexity. The results show that the Iterative SAT-based method is the leader among the proposed methods. The methods are also compared with existing inexact approaches, i.e. the ones which do not necessarily identify the minimum FSM, and these comparisons show encouraging results.

To be precise: regression aware debugging

Bounded model checking based debugging solutions search for mutations of program expressions that produce the expected output for a currently failing test. However, the current localization tools are not regression aware : they do not use information from the passing tests in their localization formula. On the other hand, the current repair tools attempt to guarantee regression freedom : when provided with a set of passing tests, they guarantee that none of these tests can break due to the suggested repair patch, thereby constructing a large repair formula. In this paper, we propose regression awareness as a means to improve the quality of localization and to scale repair. To enable regression awareness, we summarize the proof of correctness of each passing test by computing Craig Interpolants over a symbolic encoding of the passing execution, and use these summaries as additional soft constraints while synthesizing altered executions corresponding to failing tests. Intuitively, these additional constraints act as roadblocks, thereby discouraging executions that may damage the proof of a passing test. We use a partial MAXSAT solver to relax the proofs in a systematic way, and use a ranking function that penalizes mutations that damage the existing proofs. We have implemented our algorithms into a tool, TINTIN, that enables regression aware localization and repair. For localizations, our strategy is effective in extracting a superior ranking of suspicious locations: on a set of 52 different versions across 12 different programs spanning three benchmark suites, TINTIN achieves a saving of developer effort by almost 45% (in terms of the locations that must be examined by a developer to reach the ground-truth repair) in the worst case and 27% in the average case over existing techniques. For automated repairs, on our set of benchmarks, TINTIN achieves a 2.3X speedup over existing techniques without sacrificing much on the ranking of the repair patches: the ground-truth repair appears as the topmost suggestion in more than 70% of our benchmarks.

Garakabu2: an SMT-based bounded model checker for HSTM designs in ZIPC

Hierarchical State Transition Matrix (HSTM) is a table-based modeling language that has been broadly used for developing software designs of embedded systems. In this paper, we describe a model checker Garakabu2, which we have been implementing for verifying HSTM designs against Linear Temporal Logic (LTL) properties. The HSTM designs that Garakabu2 takes as input are those developed using an industrial-strength model-based development environment ZIPC. We focus on describing Garakabu2's verification techniques and performance, as well as our efforts to improve its practical usability for on-site software engineers. Some experiences and lessons on developing industry-oriented model checkers are also reported.

Model checking the evolution of gene regulatory networks

The behaviour of gene regulatory networks (GRNs) is typically analysed using simulation-based statistical testing-like methods. In this paper, we demonstrate that we can replace this approach by a formal verification-like method that gives higher assurance and scalability. We focus on Wagner’s weighted GRN model with varying weights, which is used in evolutionary biology. In the model, weight parameters represent the gene interaction strength that may change due to genetic mutations. For a property of interest, we synthesise the constraints over the parameter space that represent the set of GRNs satisfying the property. We experimentally show that our parameter synthesis procedure computes the mutational robustness of GRNs—an important problem of interest in evolutionary biology—more efficiently than the classical simulation method. We specify the property in linear temporal logic. We employ symbolic bounded model checking and SMT solving to compute the space of GRNs that satisfy the property, which amounts to synthesizing a set of linear constraints on the weights.

FAMe-TM: Formal analysis methodology for task migration algorithms in Many-Core systems

Distributed Dynamic Thermal Management (dDTM) through task migrations across cores provides a very promising solution to cater for the heating issues in Many-Core architectures. However, the growing number of cores, the distributed nature of dDTM and the inherent sampling-based nature of traditional analysis techniques, like simulation and emulation, makes a complete and rigorous analysis of these task migration algorithms almost impossible. These limitations compromise the analysis integrity and in worst cases may lead to the deployment of an inefficient and inaccurate dDTM scheme on chip, which in turn can cause permanent defects in the chip due to excessive heating. Leveraging upon the exhaustive nature of model checking based verification, we propose to use a model checker to formally verify task migration algorithms. This work proposes an analysis methodology, i.e., Formal Analysis Methodology for Task Migrations (FAMe-TM), and identifies a generic set of properties for the formal verification of task-migration-based dDTM schemes. In particular, we propose an analysis flow using the scalable bounded model checker, nuXmv, to formally verify the suggested task migration properties, like tasks migrations, stalls, completion, creation of hot spots, time spent in migration and time to achieve stability. For illustration purposes, we apply FAMe-TM to two recently proposed task-migration-based dDTM schemes, i.e., Thermal Coupling Aware (TCA-TM) dDTM and Hot Spot Reduction (HR-TM) dDTM. • A formal analysis methodology, FAMe-TM, for task migration (TM) algorithms is given. • Distributed Dynamic Thermal Management (dDTM) schemes are analyzed using FAMe-TM. • A set of properties are proposed and formalized for comparing TM-based dDTM schemes. • An improved version of a dDTM scheme is proposed based on the findings using FAMe-TM.

Formal modelling and verification of interlocking systems featuring sequential release

In this article, we present a method and an associated toolchain for the formal verification of the new Danish railway interlocking systems that are compatible with the European Train Control System (ETCS) Level 2. We have made a generic and reconfigurable model of the system behaviour and generic safety properties. This model accommodates sequential release – a feature in the new Danish interlocking systems. To verify the safety of an interlocking system, first a domain-specific description of interlocking configuration data is constructed and validated. Then the generic model and safety properties are automatically instantiated with the well-formed description of interlocking configuration data. This instantiation produces a model instance in the form of a Kripke structure, and concrete safety properties expressed as invariants. Finally, using a combination of SMT based bounded model checking (BMC) and inductive reasoning, it is verified that the generated model instance satisfies the generated safety properties. Using this method, we are able to verify the safety properties for model instances corresponding to railway networks of industrial size. Experiments show that BMC is also efficient for finding bugs in the railway interlocking designs. Additionally, benchmarking results comparing the performance of our approach with alternative verification techniques on the interlocking models are presented. • A formal model of the ETCS Level 2 compatible interlocking systems. • The model accommodates the complexity of the sequential release feature. • A scalable verification technique for safety properties for industrial size networks. • Experimental verification results for real networks of the Danish Signalling Programme. • Benchmarking experiments comparing our BMC approach with other techniques.

Bounded model checking for fixed-point digital filters

Currently, digital filters are employed in a wide range of signal processing applications, using fixed- and floating-point processors. Regarding the former, some filter implementations may be highly prone to errors, due to problems related to finite word-length. In particular, signal processing modules may produce overflows and unwanted noise, which are caused by quantization and round-off effects, during accumulative-addition and multiplication operations. As a consequence, the system output may overflow or even keep oscillating, which compromises the expected system performance. The present paper addresses this problem and proposes a new methodology for verifying digital filters, called digital systems verifier, which is based on state-of-the-art bounded model checkers that support full C and employ solvers for boolean satisfiability and satisfiability modulo theories. In addition to verifying overflow and limit-cycle occurrences, the present approach can also check output errors and time constraints, based on discrete-time models implemented in C. Experiments conducted during this work show that the proposed methodology is effective, when finding realistic design errors with respect to fixed-point implementations of digital filters. Going further than previous attempts, the present results suggest that the proposed method, in addition to helping designers in determining the number of bits for fixed-point representations, can also aid in defining details about filter realization and structure.