Cadence SMV Research Articles

LTL-Specification of Bounded Counter Machines

The article revises the results of the work devoted to the problem of representing the behaviour of a program system as a set of formulas of the linear temporal logic LTL, followed by the use of this representation to verify the satisfiability of the program system properties through the procedure of proving the validity of logical inferences, expressed in terms of the LTL logic. The LTL logic is applied to bounded Minsky counter machines that are considered as program systems of which we need to get the specification of its behaviour. Earlier, when working with the temporal logic LTL as a program logic, a special pseudo-operator was actually introduced to refer to the previous values of variables involved in elementary propositions. Despite the fact that this pseudo-operator is easily implemented in the Cadence SMV verifier when proving the validity of logical LTL-inferences, the classical definition of the LTL logic does not imply its presence. In this article, only binary variables will be used to build an LTL-specification for the behaviour of a bounded counter machine, and tracking of previous values of these variables will be carried out exclusively within the LTL logic itself through the appropriate formulas.

Construction of CFC-Programs by LTL-Specification

This article continues a cycle of papers, which describe an approach to construction and verification of discrete PLC-programs by an LTL-specification. The approach provides a possibility of PLC-program correctness analysis by the model checking method. For the specification of the program behaviour the linear-time temporal logic LTL is used. The correctness analysis of an LTL specification is performed automatically by the symbolic model checking tool Cadence SMV. It was previously shown how ST-, LD- and IL-programs are constructed by a correct (with verified program properties) LTL-specification. In this article, a technology of CFC-program construction by an LTL-specification is described. The language CFC (Continuous Function Chart) is a variation of FBD (Function Block Diagram). FBD is a graphical language for microcircuits. CFC provides a possibility of free allocation of program components and connections on a screen. The approach to construction of CFC-programs is shown by an example. PLC-program representation on CFC within the approach to programming by LTLspecification differs from other representations. It gives the visualization of a data flow from inputs to outputs. The influence and dependence among variables is explicitly shown during the program execution within one PLC working cycle. In fact, CFC-program is a scheme of PLC-program data flow.

On the expressiveness of the approach to constructing PLC-programs by LTL-specification

The article is devoted to an approach to constructing and verification of discrete PLC-programs by LTL-specification. This approach provides a possibility of analysing the correctness of PLCprograms by using the model checking method. The linear temporal logic LTL is used as a language of specification of the program behavior. The correctness analysis of LTL-specification is automatically performed by the symbolic model checking tool Cadence SMV. The article demonstrates the consistency of the approach to constructing and verification of PLC programs by LTL-specification from the point of view of Turing power. It is proved that in accordance with this approach for any Minsky counter machine an LTL-specification can be built, which is used for machine implementation in any PLC programming language of standard IEC 61131-3. Minsky machines are equipollent to Turing machines, and the considered approach also has the Turing power. The proof focuses on representation of a counter machine behavior in the form of a set of LTL-formulas and matching these formulas to constructions of ST and SFC languages. SFC is interesting as a specific graphical language. ST is considered as a basic language because the implementation of a counter machine on IL, FBD/CFC and LD languages is reduced to rewriting blocks of an ST-program. The idea of the proof is demonstrated by an example of a Minsky 3-counter machine, which implements a function of squaring.

Construction of CFC-programs by LTL-specification

This article continues a cycle of papers, which describe an approach to construction and verification of discrete PLC-programs by an LTL-specification. The approach provides a possibility of PLC-program correctness analysis by the model checking method. For the specification of the program behavior the linear-time temporal logic LTL is used. The correctness analysis of an LTL specification is performed automatically by the symbolic model checking tool Cadence SMV. Previously it was shown how ST-, LDand IL-programs are constructed by a correct (with verified program properties) LTL-specification. In this article a technology of CFC-program construction by an LTL-specification is described. The language CFC (Continuous Function Chart) is a variation of FBD (Function Block Diagram). FBD is a graphical language for microcircuits. CFC provides a possibility of free allocation of program components and connections on a screen. The approach to construction of CFC-programs is shown by an example. PLC-program representation on CFC within the approach to programming by LTL-specification differs from other representations. It gives the visualisation of a data flow from inputs to outputs. Influence and dependence between variables is explicitly shown during program execution within one PLC working cycle. In fact, CFC-program is a scheme of PLC-program data flow.

On the Expressiveness of the Approach to Constructing PLC-programs by LTL-Specification

The article is devoted to the approach to constructing and verification of discrete PLC-programs by LTL-specification. This approach provides an ability of correctness analysis of PLC-programs by the model checking method. The linear temporal logic LTL is used as a language of specification of the program behavior. The correctness analysis of LTL-specification is automatically performed by the symbolic model checking tool Cadence SMV. The article demonstrates the consistency of the approach to constructing and verification of PLC programs by LTL-specification from the point of view of Turing power. It is proved, that in accordance with this approach for any Minsky counter machine can be built an LTL-specification, which is used for machine implementation in any PLC programming language of standard IEC 61131-3. Minsky machines equipollent Turing machines, and the considered approach also has Turing power. The proof focuses on representation of a counter machine behavior in the form of a set of LTL-formulas and matching these formulas to constructions of ST and SFC languages. SFC is interesting as a specific graphical language. ST is considered as a basic language because an implementation of a counter machine in IL, FBD/CFC and LD languages is reduced to rewriting blocks of ST-program. The idea of the proof is demonstrated by an example of a Minsky 3-counter machine, which implements a function of squaring.

Construction and Verification of PLC-programs by LTL-specification

An approach to construction and verification of PLC-programs for discrete tasks is proposed. For the specification of a program behavior we use the linear-time temporal logic LTL. Programming is carried out in the ST-language according to an LTL-specification. The correctness analysis of an LTL-specification is carried out by the symbolic model checking tool Cadence SMV. A new approach to programming and verification of PLCprograms is shown by an example. For a discrete problem we give a ST-program, its LTL-specification and an SMV-model. A purpose of the article is to describe an approach to programming PLC, which would provide a possibility of PLC-program correctness analysis by the model checking method. Under the proposed approach the change of the value of each program variable is described by a pair of LTL-formulas. The first LTL-formula describes situations that increase the value of the corresponding variable, the second LTL-formula specifies conditions leading to a decrease of the variable value. The LTL-formulas (used for specification of the corresponding variable behavior) are constructive in the sense that they construct the PLC-program, which satisfies temporal properties expressed by these formulas. Thus, the programming of PLC is reduced to the construction of LTL-specification of the behavior of each program variable. In addition, an SMV-model of a PLC-program is constructed according to LTL-specification. Then, the SMV-model is analysed by the symbolic model checking tool Cadence SMV.

Construction and Verification of PLC LD-programs by LTL-specification

An approach to construction and verification of PLC LD-programs for discrete problems is proposed. For the specification of the program behavior, we use the linear-time temporal logic LTL. Programming is carried out in the LD-language (Ladder Diagram) according to an LTL-specification. The correctness analysis of an LTL-specification is carried out by the symbolic model checking tool Cadence SMV. A new approach to programming and verification of PLC LD-programs is shown by an example. For a discrete problem, we give a LD-program, its LTL-specification and an SMV-model. The purpose of the article is to describe an approach to programming PLC, which would provide a possibility of LD-program correctness analysis by the model checking method. Under the proposed approach, the change of the value of each program variable is described by a pair of LTL-formulas. The first LTL-formula describes situations which increase the value of the corresponding variable, the second LTL-formula specifies conditions leading to a decrease of the variable value. The LTL-formulas (used for speci- fication of the corresponding variable behavior) are constructive in the sense that they construct the PLC-program (LD-program), which satisfies temporal properties expressed by these formulas. Thus, the programming of PLC is reduced to the construction of LTLspecification of the behavior of each program variable. In addition, an SMV-model of a PLC LD-program is constructed according to LTL-specification. Then, the SMV-model is analysed by the symbolic model checking tool Cadence SMV.

On Construction and Verification of PLC-Programs

We review some methods and approaches to programming discrete problems for Programmable Logic Controllers on the example of constructing PLC-programs for controling a code lock. For these approaches we evaluate the usability of the model checking method for the analysis of program correctness with respect to the automatic verification tool Cadence SMV. Some possible PLC-program vulnerabilities arising at a number approaches to programming of PLC are revealed.

On Verification of PLC-Programs Written in the LD-Language

We discuss some questions connected with the construction of a technology of analysing correctness of Programmable Logic Controller programs. We consider an example of modeling and automated verification of PLC-programs written in the Ladder Diagram language (including timed function blocks) of the IEC 61131-3 standard. We use the Cadence SMV for symbolic model checking. Program properties are written in the linear-time temporal logic LTL.

Construction and verification of PLC LD programs by the LTL specification

An approach to the construction and verification of LD programs of programmable logic controllers (PLC) for discrete problems is proposed. The specification of the program behavior is performed using the linear temporal logic language (LTL). Programming is performed using the Ladder Diagram (LD) language by the LTL specification. The correctness analysis of the LTL specification is performed using the Cadence SMV symbolic model-checking tool. An approach to programming and verifying the PLC LD programs is shown using an example. The LD program, its LTL specification, and an SMV model are given for a discrete problem. This article is aimed at the description of an approach to PLC programming that will provide the correctness analysis of PLC LD programs using the model-checking method. Therefore, the variation in each programmable variable is described using a pair of LTL formulas. The first LTL formula describes situations in which the corresponding variable increases and the second LTL formula specifies conditions leading to a decrease in the variable. LTL formulas, which are considered to specify the behavior of variables, are constructive in the sense that the PLC program corresponding to the temporal properties expressed by these formulas is constructed by them. Thus, PLC programming is reduced to the construction of the LTL specification for the behavior of each programmed variable. In addition, the SMV model of the PLC LD program is constructed by the LTL specification. Then, the SMV model is analyzed for correctness (relative to additional conventional general-programming LTL properties) by the Cadence SMV symbolic model-checking tool.

Construction of PLC IL-Programs by LTL-Specification

An approach to the construction and verification of PLC IL-programs for discrete problems is proposed. For the specification of the program behavior, we use the linear-time temporal logic LTL. Programming is carried out in the IL-language (Instruction List) according to an LTL-specification. The correctness analysis of an LTL-specification is carried out by the symbolic model checking tool Cadence SMV. A new approach to programming and verification of PLC IL-programs is shown by an example. For a discrete problem, we give an IL-program and its LTL-specification. The purpose of the article is to describe an approach to programming PLC, which would provide a possibility of IL-program correctness analysis by the model checking method. Under the proposed approach, the change of the value of each program variable is described by a pair of LTL-formulas. The first LTL-formula describes situations which increase the value of the corresponding variable, the second LTL-formula specifies conditions leading to a decrease of the variable value. The LTL-formulas (used for speci- fication of the corresponding variable behavior) are constructive in the sense that they construct the PLC-program (IL-program), which satisfies temporal properties expressed by these formulas. Thus, the programming of PLC is reduced to the construction of LTLspecification of the behavior of each program variable. In addition, an SMV-model of a PLC IL-program is constructed according to LTL-specification. Then, the SMV-model is analysed by the symbolic model checking tool Cadence SMV.

On construction and verification of PLC programs

A review of methods and approaches for programming of “discrete” problems for programmable logic controllers (PLC) based on the example of constructing a program for controlling a code lock. The usability of the analysis of a program correctness by the model checking method with respect to a Cadence SMV automatic verification tool is evaluated for these approaches. Possible PLC program vulnerabilities arising at some approaches for programming of PLC are revealed.

On the Model Checking of the SpaceWire Link Interface

In this paper we display a practical approach adopted for the formal verification of SpaceWire using model checking to solve state explosion. SpaceWire is a high-speed, full-duplex serial bus standard which is applied in aerospace, so its functions have a very high accuracy requirements. In order to prove the design of the SpaceWire was faithfully implements the SpaceWire protocol’s specification , we present our experience on the model checking of SpaceWire link interface using the Cadence SMV tool. We applied environment state machine to overcome state explosion and successfully verified a number of relevant properties about transmitter and controller of the SpaceWire in reasonable CPU time. DOI: http://dx.doi.org/10.11591/telkomnika.v11i2.2001 Full Text: PDF

Formal Verification for SpaceWire Data Flow Control Using Model Checking

SpaceWire is a high-speed, full-duplex serial bus standard which is applied in aerospace, so its functions require high accuracy. The traditional methods of verification, such as simulation and test, are not complete. In order to prove the design of the SpaceWire faithfully implemented the SpaceWire protocol’s specification, we presented our experience on the model checking of SpaceWire data flow control using the Cadence SMV tool. It overcomes the incompleteness of traditional verification. And by injecting the errors to ensure the accuracy of the artificial extraction properties and completeness, comparison tests show that the method can effectively ensure the functional coverage, improve reliability of the verification.

Sensor Graphs for Discrete Event Modeling Applied to Formal Verification of PLCs

This paper introduces Sensor Graphs, a discrete event modeling language directed at physical systems with binary and identity sensors (e.g., RFID). The aim of Sensor Graphs is to simplify the modeling of the plant/process that is to be controlled by a discrete controller, for example a programmable logic controller (PLC); thereby making formal verification and other model-based formal methods more applicable for PLC programmers. The formal syntax and semantics of Sensor Graphs are defined and a compact graphical representation is presented. The language is exemplified by modeling a conveyor module and a lab process. For comparison, the latter is also modeled using Statecharts and Net Condition/Event systems. A controller, modeled as a discrete state equation, can be composed with a Sensor Graph of the process in order to form a model of the closed-loop system. It is demonstrated how requirements on such a closed-loop system, based on a PLC program and a Sensor Graph process model, can be formally verified using the model checker Cadence SMV.

A framework for multi-robot motion planning from temporal logic specifications

We propose a framework for the coordination of a network of robots with respect to formal requirement specifications expressed in temporal logics. A regular tessellation is used to partition the space of interest into a union of disjoint regular and equal cells with finite facets, and each cell can only be occupied by a robot or an obstacle. Each robot is assumed to be equipped with a finite collection of continuous-time nonlinear closed-loop dynamics to be operated in. The robot is then modeled as a hybrid automaton for capturing the finitely many modes of operation for either staying within the current cell or reaching an adjacent cell through the corresponding facet. By taking the motion capabilities into account, a bisimilar discrete abstraction of the hybrid automaton can be constructed. Having the two systems bisimilar, all properties that are expressible in temporal logics such as Linear-time Temporal Logic, Computation Tree Logic, and µ-calculus can be preserved. Motion planning can then be performed at a discrete level by considering the parallel composition of discrete abstractions of the robots with a requirement specification given in a suitable temporal logic. The bisimilarity ensures that the discrete planning solutions are executable by the robots. For demonstration purpose, a finite automaton is used as the abstraction and the requirement specification is expressed in Computation Tree Logic. The model checker Cadence SMV is used to generate coordinated verified motion planning solutions. Two autonomous aerial robots are used to demonstrate how the proposed framework may be applied to solve coordinated motion planning problems.

Protocol Conformance through Refinement Mappings in Cadence SMV

This paper addresses the verification of protocol conformance between two types of state machines in model-driven software design: protocol state machines that enable specifying allowed sequences of signals and behavioral state machines that are intended for implementation specification. The contribution of the present paper, is to provide a methodology, which is based on refinement mappings, to automatically verify on protocol conformance. It helps to turn UML into a powerful and interesting tool for the development of business critical software systems.

모델 체킹에서 상태 투영을 이용한 모델의 추상화

지금까지 제시된 정형 검증 기법들 중에서 모델 체킹이 가장 효과적이라는 평가를 받고 있지만, 모델 체킹이 실제 활용되기 위해서는 상태 폭발 문제를 극복해야 한다. 본 논문에서는 상태 폭발 문제를 방지하기 위해서, 원래 모델 M으로 부터 추상화 모델 M'을 얻는 방법을 제안하였다. 주어진 논리식의 모델 체킹에 필요한 변수만을 추출한 후. 모델의 상태 공간을 이들 변수들에 투영함으로서 추상화 모델 M'을 얻었다. M'은 M보다 크기가 작을 뿐만 아니라 더 적은 행위를 갖고 있기 때문에(M'<TEX>$\leq$</TEX>M), 추상화 모델 M'을 이용해서 수행한 도달성 분석 결과는 M 에서도 그대로 유효하다. 따라서 M을 모델 체킹할 때 상태 폭발이 발생하면, 축소된 모델 M'을 이용하여 모델 체킹할 수 있다. 제안된 추상화 기법을 푸쉬 푸쉬 게임 풀이에 적용했고, 모델 체커로는 Cadence SMV와 NuSMV를 사용하였다. 그 결과 상태 폭발 문제로 인해서 풀 수 없었던 게임을 추상화를 이용해서 해결하였다. 그리고 추상화를 적용하기 이전에 비해서 시간 절감 및 메모리 절감 효과가 있었다. Cadence SMV의 경우 평균 87%의 시간 절감 및 79%의 메모리 절감이 있었으며, NuSMV의 경우 83%의 시간 절감 및 56%의 메모리 절감이 있었다. Although model checking has gained its popularity as one of the most effective approaches to the formal verification, it has to deal with the state explosion problem to be widely used in industry. In order to mitigate the problem, this paper proposes an ion technique to obtain a reduced model M' from a given original model M. Our technique Identifies the set of necessary variables for model checking and projects the state space onto them. The model M' is smaller in both size and behavior than the original model M, written M'<TEX>$\leq$</TEX>M. Since the result of reachability analysis with M' is preserved in M, we can do reachability analysis with model checking using M' instead of M. The abstraction technique is applied to Push Push games, and two model checkers - Cadence SMV and NuSMV - are used to solve the games. As a result, most of unsolved games with the usual model checking are solved with the ion technique. In addition, ion shows that there is much of time and space improvement. With Cadence SMV, there is 87% time improvement and 79% space one. And there is 83% time improvement and 56% space one with NuSMV.