CADP Toolbox Research Articles

Formally Modeling Autonomous Vehicles in LNT for Simulation and Testing

We present two behavioral models of an autonomous vehicle and its interaction with the environment. Both models use the formal modeling language LNT provided by the CADP toolbox. This paper discusses the modeling choices and the challenges of our autonomous vehicle models, and also illustrates how formal validation tools can be applied to a single component or the overall vehicle.

On-the-fly model checking for extended action-based probabilistic operators

The quantitative analysis of concurrent systems requires expressive and user-friendly property languages combining temporal, data handling, and quantitative aspects. In this paper, we aim at facilitating the quantitative analysis of systems modeled as PTSs (Probabilistic Transition Systems) labeled by actions containing data values and probabilities. We propose a new regular probabilistic operator that specifies the probability measure of a path described by a generalized regular formula involving arbitrary computations on data values. This operator, which subsumes the Until operators of PCTL and their action-based counterparts, can provide useful quantitative information about paths having certain (e.g., peak) cost values. We integrated the regular probabilistic operator into MCL (Model Checking Language) and we devised an associated on-the-fly model checking method, based on a combined local resolution of linear and Boolean equation systems. We implemented the method in the EVALUATOR model checker of the CADP toolbox and experimented it on realistic PTSs modeling concurrent systems.

Formal modelling and verification of GALS systems using GRL and CADP

Abstract A GALS ( Globally Asynchronous, Locally Synchronous ) system consists of several synchronous components that evolve concurrently and interact with each other asynchronously. The design of GALS systems is tedious and error-prone due to the high degree of synchronous and asynchronous concurrency present in complex architectures. In this paper, we present GRL ( GALS Representation Language ), a formal language designed to model GALS systems, for the purpose of formal verification of the asynchronous aspects. GRL combines the synchronous reactive model underlying dataflow languages and the asynchronous concurrent model underlying process algebras. We propose a translation from GRL to LNT, a value-passing concurrent language with classical process algebra flavour. This makes possible the analysis of GRL specifications using all the state-of-the-art simulation and verification functionalities provided by the CADP toolbox.

Verification of EB3 specifications using CADP

Abstract E B 3 is a specification language for information systems. The core of the E B 3 language consists of process algebraic specifications describing the behaviour of the entities in a system, and attribute function definitions describing the entity attributes. The verification of E B 3 specifications against temporal properties is of great interest to users of E B 3 . In this paper, we propose a translation from E B 3 to LOTOS NT (LNT for short), a value-passing concurrent language with classical process algebra features. Our translation ensures the one-to-one correspondence between states and transitions of the labelled transition systems corresponding to the E B 3 and LNT specifications. We automated this translation with the E B 3 2 L N T tool, thus equipping the E B 3 method with the functional verification features available in the CADP toolbox.

Formal design of dynamic reconfiguration protocol for cloud applications

Cloud applications are complex applications composed of a set of interconnected software components running on different virtual machines, hosted on remote physical servers. Deploying and reconfiguring this kind of applications are very complicated tasks especially when one or multiple virtual machines fail when achieving these tasks. Hence, there is a need for protocols that can dynamically reconfigure and manage running distributed applications. In this article, we present a novel protocol, which aims at reconfiguring cloud applications. This protocol is able to ensure communication between virtual machines and resolve dependencies by exchanging messages, (dis)connecting, and starting/stopping components in a specific order. The interaction between machines is assured via a publish-subscribe messaging system. Each machine reconfigures itself in a decentralized way. The protocol supports virtual machine failures, and the reconfiguration always terminates successfully even in the presence of a finite number of failures. Due to the high degree of parallelism inherent to these applications, the protocol was specified using the LNT value-passing process algebra and verified using the model checking tools available in the CADP toolbox. The use of formal specification languages and tools helped to detect several bugs and to improve the protocol.

Revisiting sequential composition in process calculi

The article reviews the various ways sequential composition is defined in traditional process calculi, and shows that such definitions are not optimal, thus limiting the dissemination of concurrency theory ideas among computer scientists. An alternative approach is proposed, based on a symmetric binary operator and write-many variables. This approach, which generalizes traditional process calculi, has been used to define the new LNT language implemented in the CADP toolbox. Feedback gained from university lectures and real-life case studies shows a high acceptance by computer-science students and industry engineers. • Sequential composition is not optimally defined in CCS, CSP, LOTOS, ACP, PSF, mCRL. • We propose a novel solution that better matches the expectations of end-users. • We show that traditional process calculi can easily be translated to our solution. • Our solution is implemented in the LNT language of CADP and applied in real life.

Formal analysis of a hardware dynamic task dispatcher with CADP

The complexity of multiprocessor architectures for mobile multimedia applications renders their validation challenging. In addition, to provide the necessary flexibility, a part of the functionality is realized by software. Thus, a formal model has to take into account both hardware and software. In this article we report on the use of the CADP toolbox for the formal modeling and analysis of the DTD (Dynamic Task Dispatcher), a complex hardware block of an industrial hardware architecture developed by STMicroelectronics. The formal LNT model developed by an industry engineer was appropriate to discuss implementation details with the architect and enabled model-checking temporal properties expressed in MCL, which discovered a possible problem. We investigated the existence of the problem in the architect’s C++ model using co-simulation of the C++ and the formal LNT models. ► We formally model a hardware dynamic task dispatcher in LNT. ► We express correctness properties in MCL. ► We discover a problem under heavy load. ► We co-simulate the LNT model with the C++ model of the architect.

Model checking and performance evaluation with CADP illustrated on shared-memory mutual exclusion protocols

Mutual exclusion protocols are an essential building block of concurrent shared-memory systems: indeed, such a protocol is required whenever a shared resource has to be protected against concurrent non-atomic accesses. Hence, many variants of mutual exclusion protocols exist, such as Peterson’s or Dekker’s well-known protocols. Although the functional correctness of these protocols has been studied extensively, relatively little attention has been paid to their non-functional aspects, such as their performance in the long run. In this paper, we report on experiments with the Cadp toolbox for model checking and performance evaluation of mutual exclusion protocols using Interactive Markov Chains. Steady-state analysis provides an additional criterion for comparing protocols, which complements the verification of their functional properties. We also carefully re-examined the functional properties of these protocols, whose accurate formulation as temporal logic formulas in the action-based setting turns out to be quite involved. ► We illustrate the support for IMCs in CADP. ► We model shared-memory mutual exclusion protocols in LOTOS NT. ► We model check functional properties with EVALUATOR. ► We evaluate the performance with BCG_STEADY and CUNCTATOR.

A model-extraction approach to verifying concurrent C programs with CADP

The development of reliable software for industrial critical systems benefits from the use of formal models and verification tools for detecting and correcting errors as early as possible. Ideally, with a complete model-based methodology, the formal models should be the starting point to obtain the final reliable code and the verification step should be done over the high-level models. However, this is not the case for many projects, especially when integrating existing code. In this paper, we describe an approach to verify concurrent C code by automatically extracting a high-level formal model that is suitable for analysis with existing tools. The basic components of our approach are: (1) a method to construct a labeled transition system from the source code, that takes flow control and interaction among processes into account; (2) a modeling scheme of the behavior that is external to the program, namely the functionality provided by the operating system; (3) the use of demand-driven static analyses to make a further abstraction of the program, thus saving time and memory during its verification. The whole proposal has been implemented as an extension of the CADP toolbox, which already provides a variety of analysis modules for several input languages using labeled transition systems as the core model. The approach taken fits well within the existing architecture of CADP which does not need to be altered to enable C program verification. We illustrate the use of the extended CADP toolbox by considering examples of the VLTS benchmark suite and C implementations of various concurrent programs. ► We extend the CADP analysis environment to analyze programs written in C. ► Static analysis is used to compute variables not needed during the analysis. ► C code is transformed into an implicit LTS following a model-extraction method. ► Influence analysis based on model-checking optimizes the state space generation.

Sequential and distributed on-the-fly computation of weak tau-confluence

The notion of @t-confluence provides a form of partial order reduction of Labelled Transition Systems (Ltss), by enabling to identify the @t-transitions, whose execution does not alter the observable behaviour of the system. Several forms of @t-confluence adequate with branching bisimulation were studied in the literature, ranging from strong to weak forms according to the length of @t-transition sequences considered. Weak @t-confluence is more complex to compute than strong @t-confluence, but provides better Lts reductions. In this paper, we aim at devising an efficient detection of weak @t-confluent transitions during an on-the-fly exploration of Ltss. With this purpose, we define and prove new encodings of several weak @t-confluence variants using alternation-free Boolean equation systems (Bess), and we apply efficient local Bes resolution algorithms to perform the detection. The resulting reduction module, developed within the Cadp toolbox using the generic Open/Caesar environment for Lts exploration, was tested in both a sequential and a distributed setting on numerous examples of large Ltss underpinning communication protocols and distributed systems. These experiments assessed the efficiency of the reduction and enabled us to identify the best variants of weak @t-confluence that are useful in practice.

CTRL: Extension of CTL with regular expressions and fairness operators to verify genetic regulatory networks

Model checking has proven to be a useful analysis technique not only for concurrent systems, but also for genetic regulatory networks (Grns). Applications of model checking in systems biology have revealed that temporal logics should be able to capture both branching-time and fairness properties (needed for specifying multistability and oscillation properties, respectively). At the same time, they should have a user-friendly syntax easy to employ by non-experts. In this paper, we define Computation Tree Regular Logic (Ctrl), an extension of Ctl with regular expressions and fairness operators that attempts to match these criteria. Ctrl subsumes both Ctl and Ltl, and has a reduced set of temporal operators indexed by regular expressions. We also develop a translation of Ctrl into Hennessy–Milner Logic with Recursion (HmlR), an equational variant of the modal μ-calculus. This has allowed us to obtain an on-the-fly model checker with diagnostic for Ctrl by directly reusing the verification technology available in the Cadp toolbox. We illustrate the application of the Ctrl model checker by analyzing the Grn controlling the carbon starvation response of Escherichia coli.

Formal modelling and discrete-time analysis of BPEL web services

Web services are increasingly used for building enterprise information systems according to the Service Oriented Architecture (SOA) paradigm. We propose in this paper a tool-equipped methodology allowing the formal modelling and analysis of web services described in the BPEL language. The discrete-time transition systems modelling the behaviour of BPEL descriptions are obtained by an exhaustive simulation based on a formalisation of BPEL semantics using the Algebra of Timed Processes (ATP). These models are then analysed by model checking value-based temporal logic properties using the CADP toolbox. The approach is illustrated with the design of a web service for GPS navigation.

Verification of the Link layer protocol of the IEEE-1394 serial bus (FireWire): an experiment with E-LOTOS

This paper deals with the description in E-LOTOS of the asynchronous LINK layer protocol of the IEEE-1394 Standard and its verification using model-checking. The E-LOTOS descriptions are based on both the standard and the mu-CRL description written by Luttik. The verifications are performed using the CADP (CAESAR/ALDEBARAN) toolbox. We translate the E-LOTOS descriptions in LOTOS using the TRAIAN tool, and then we generate the underlying LTS models corresponding to various scenarios using the CAESAR compiler. We formally express in the ACTL temporal logic the five correctness properties of the LINK layer protocol stated in natural language by Luttik and we verify them on the LTS models using the XTL model-checker. We detect and correct a potential deadlock caused by the ambiguous semantics of the state machines given in the standard, which can be misleading for implementors of the IEEE-1394 protocol.

An experiment in automatic generation of test suites for protocols with verification technology

In this paper we describe an experiment in automatic generation of test suites for protocol testing. We report the results gained with generation of test suites based on advanced verification techniques applied to a real industrial protocol. In this experiment, several tools have been used: the commercial tool GEODE (VERILOG) was used for the generation of finite state graph models from SDL specifications, the tool Aldebaran of the CADP toolbox for the minimization of transition systems, and a prototype named TGV (for Test Generation using Verification techniques) for the generation of test suites which has been developed in the CADP toolbox. TGV is based on verification techniques such as synchronous product and on-the-fly verification. These tools have been applied to an industrial protocol, the DREX protocol. The comparison of produced test suites with hand written test suites proves the relevance of the used techniques.

Specification and verification of various distributed leader election algorithms for unidirectional ring networks

This paper deals with the formal specification and verification of distributed leader election algorithms for a set of machines connected by a unidirectional ring network. Starting from an algorithm proposed by Le Lann in 1977, and its variant proposed by Chang and Roberts in 1979, we study the robustness of these algorithms in the presence of unreliable communication medium and unreliable machines. We propose various improvements of these algorithms in order to obtain a fully fault-tolerant protocol. These algorithms are formally described using the ISO specification language Lotos and verified (for a fixed number of machines) using the Cadp ( Cæsar / Aldébaran ) toolbox. Using model-checking and bisimulation techniques, the verification of these non-trivial algorithms can be carried out automatically, in a few seconds.