Property Checking Research Articles

Model Checking of Linear-Time Properties Based on Possibility Measure

Using possibility measure, we study model checking of linear-time properties in possibilistic Kripke structures. First, the notion of possibilistic Kripke structures and the related possibility measure are introduced, and then, model checking of reachability and repeated reachability linear-time properties in finite possibilistic Kripke structures are studied. Standard safety properties and ω-regular properties in possibilistic Kripke structures are introduced; the verification of regular safety properties and ω-regular properties using finite automata are thoroughly studied. It has been shown that the verification of regular safety properties and ω-regular properties in a finite possibilistic Kripke structure can be transformed into the verification of reachability properties and repeated reachability properties in the product possibilistic Kripke structure that is introduced in this paper. Several examples are given to illustrate the methods that are presented in this paper.

Computational Profiling of Bioactive Compounds Using a Target-Dependent Composite Workflow

Computational target fishing is a chemoinformatic method aimed at determining main and secondary targets of bioactive compounds in order to explain their mechanism of action, anticipate potential side effects, or repurpose existing drugs for novel therapeutic indications. Many existing successes in this area have been based on a use of a single computational method to estimate potentially new target-ligand associations. We herewith present an automated workflow using several methods to optimally browse target-ligand space according to existing knowledge on either ligand and target space under investigation. The protocol uses four ligand-based (SVM classification, SVR affinity prediction, nearest neighbors interpolation, shape similarity) and two structure-based approaches (docking, protein-ligand pharmacophore match) in series, according to well-defined ligand and target property checks. The workflow was remarkably accurate (72%) in identifying the main target of 189 clinical candidates and proposed two novel off-targets which could be experimentally validated. Rolofylline, an adenosine A1 receptor antagonist, was confirmed to inhibit phosphodiesterase 5 with a moderate affinity (IC50 = 13.8 μM). More interestingly, we describe a strong binding (IC50 = 142 nM) of a claimed selective phosphodiesterase 10 A inhibitor (PF-2545920) with the cysteinyl leukotriene type 1 G protein-coupled receptor.

On the Verification of a WiMax Design Using Symbolic Simulation

In top-down multi-level design methodologies, design descriptions at higher levels of abstraction are incrementally refined to the final realizations. Simulation based techniques have traditionally been used to verify that such model refinements do not change the design functionality. Unfortunately, with computer simulations it is not possible to completely check that a design transformation is correct in a reasonable amount of time, as the number of test patterns required to do so increase exponentially with the number of system state variables. In this paper, we propose a methodology for the verification of conformance of models generated at higher levels of abstraction in the design process to the design specifications. We model the system behavior using sequence of recurrence equations. We then use symbolic simulation together with equivalence checking and property checking techniques for design verification. Using our proposed method, we have verified the equivalence of three WiMax system models at different levels of design abstraction, and the correctness of various system properties on those models. Our symbolic modeling and verification experiments show that the proposed verification methodology provides performance advantage over its numerical counterpart.

OASIS: An automotive analysis and safety engineering instrument

In this paper, we describe a novel software tool named OASIS (AutOmotive Analysis and Safety EngIneering InStrument). OASIS supports automotive safety engineering with features allowing the creation of consistent and complete work products and to simplify and automate workflow steps from early analysis through system development to software development. More precisely, it provides support for (a) model creation and reuse, (b) analysis and documentation and (c) configuration and code generation. We present OASIS as a part of a tool chain supporting the application of a safety engineering workflow aligned with the automotive safety standard ISO 26262. In particular, we focus on OASIS' (1) support for property checking and model correction as well as its (2) support for fault tree generation and FMEA (Failure Modes and Effects Analysis) table generation. Finally, based on the case study of hybrid electric vehicle development, we demonstrate that (1) and (2) are able to strongly support FTA (Fault Tree Analysis) and FMEA.

Symbolic Model Checking for Incomplete Designs with Flexible Modeling of Unknowns

We consider the problem of checking whether an incomplete design (i.e., a design containing "unknown parts", so-called Black Boxes) can still be extended to a complete design satisfying a given property or whether the property is satisfied for all possible extensions. There are many applications of property checking for incomplete designs, such as early verification checks for unfinished designs, error localization in faulty designs and the abstraction of complex parts of a design in order to simplify the property checking task. To process incomplete designs we present an approximate, yet sound algorithm. The algorithm is flexible in the sense that for every Black Box a different approximation method can be chosen. This permits us to handle less relevant Black Boxes (in terms of the property) with larger approximation and thus faster, whereas we do not lose important information when the possible effect of more relevant Black Boxes is modeled by more exact methods. Additionally, we present a concept to decide exactly whether Black Boxes with bounded memory can be implemented so that they satisfy a given property. This question is reduced to conventional symbolic model checking. The effectiveness and feasibility of the methods is demonstrated by a series of experimental results.

Fusing statecharts and java

This article presents FUSE, an approach for modeling and implementing embedded software components which starts from a main-stream programming language and brings some of the key concepts of Statecharts as first-class elements within this language. Our approach provides a unified programming environment which not only preserves some of the advantages of Statecharts' formal foundation but also directly supports features of object-orientation and strong typing. By specifying Statecharts directly in FUSE we eliminate the out-of-synch between the model and the generated code and we allow the tuning and debugging to be done within the same programming model. This article describes the main language constructs of FUSE and presents its semantics by translation into the Java programming language. We conclude by discussing extensions to the base language which enable the efficient static checking of program properties.

Integer Linear Programming-Based Property Checking for Asynchronous Reactive Systems

Asynchronous reactive systems form the basis of a wide range of software systems, for instance in the telecommunications domain. It is highly desirable to rigorously show that these systems are correctly designed. However, traditional formal approaches to the verification of these systems are often difficult because asynchronous reactive systems usually possess extremely large or even infinite state spaces. We propose an integer linear program (ILP) solving-based property checking framework that concentrates on the local analysis of the cyclic behavior of each individual component of a system. We apply our framework to the checking of the buffer boundedness and livelock freedom properties, both of which are undecidable for asynchronous reactive systems with an infinite state space. We illustrate the application of the proposed checking methods to Promela, the input language of the SPIN model checker. While the precision of our framework remains an issue, we propose a counterexample guided abstraction refinement procedure based on the discovery of dependences among control flow cycles. We have implemented prototype tools with which we obtained promising experimental results on real-life system models.

XTune

Resource-limited mobile embedded systems can benefit greatly from dynamic adaptation of system parameters. We propose a novel approach that employs iterative tuning using lightweight formal verification at runtime with feedback for dynamic adaptation. One objective of this approach is to enable trade-off analysis across multiple layers (e.g., application, middleware, OS) and predict the possible property violations as the system evolves dynamically over time. Specifically, an executable formal specification is developed for each layer of the mobile system under consideration. The formal specification is then analyzed using statistical property checking and statistical quantitative analysis, to determine the impact of various resource management policies for achieving desired timing/QoS properties. Integration of formal analysis with dynamic behavior from system execution results in a feedback loop that enables model refinement and further optimization of policies and parameters. We demonstrate the applicability of this approach to the adaptive provisioning of resource-limited distributed real-time systems using a mobile multimedia case study.

Constraint-based BMC: a backjumping strategy

Safety property checking is mandatory in the validation process of critical software. When formal verification tools fail to prove some properties, the automatic generation of counterexamples for a given loop depth is an important issue in practice. We investigate in this paper the capabilities of constraint-based bounded model checking for program verification and counterexample generation on real applications. We introduce dynamic post-condition variable-driven strategy (DPVS), a new backjumping strategy we developed to handle an industrial application from a car manufacturer, the Flasher Manager. This backjumping strategy is used to search a faulty path and to collect the constraints of such a path. The simplified control flow graph (CFG) of the program is explored in a backward way, starting from the post-condition and jumping to the most promising node where the variables of the post-condition are defined. In other words, the constraints are collected by exploring the CFG in a dynamic and non-sequential backward way. The Flasher Manager application has been designed and simulated using the Simulink platform. However, this module is concretely embedded as a C program in a car computer, thus we have to check that the safety properties are preserved on this C code. We report experiments on the Flasher Manager with our constraint-based bounded model checker, and with CBMC, a state-of-the-art bounded model checker. Experiments show that DPVS and CBMC have similar performances on one property of the Flasher Manager; DPVS outperforms CBMC to find a counterexample for two properties; two of the properties of the Flasher Manager remain intractable for CBMC and DPVS.

Formal verification of code motion techniques using data-flow-driven equivalence checking

A formal verification method for checking correctness of code motion techniques is presented in this article. Finite State Machine with Datapath (FSMD) models have been used to represent the input and the output behaviors of each synthesis step. The method introduces cutpoints in one FSMD, visualizes its computations as concatenation of paths from cutpoints to cutpoints, and then identifies equivalent finite path segments in the other FSMD; the process is then repeated with the FSMDs interchanged. Unlike many other reported techniques, the method is capable of verifying both uniform and nonuniform code motion techniques. It has been underlined in this work that for nonuniform code motions, identifying equivalent path segments involves model checking of some data-flow properties. Our method automatically identifies the situations where such properties are needed to be checked during equivalence checking, generates the appropriate properties, and invokes the model checking tool NuSMV to verify them. The correctness and the complexity of the method have been dealt with. Experimental results demonstrate the effectiveness of the method.

On the Church-Rosser and coherence properties of conditional order-sorted rewrite theories

In the effort to bring rewriting-based methods into contact with practical applications both in programing and in formal verification, there is a tension between: (i) expressiveness and generality—so that a wide range of applications can be expressed easily and naturally—, and (ii) support for formal verification, which is harder to get for general and expressive specifications. This paper answers the challenge of successfully negotiating the tension between goals (i) and (ii) for a wide class of Maude specifications, namely: (a) equational order-sorted conditional specifications Σ,E∪A, corresponding to functional programs modulo axioms such as associativity and/or commutativity and/or identity axioms; and (b) order-sorted conditional rewrite theories R=(Σ,E∪A,R,ϕ), corresponding to concurrent programs modulo axioms A. For Maude functional programs the key formal property checked is the Church-Rosser property. For concurrent declarative programs in rewriting logic, the key property checked is the coherence between rules and equations modulo the axioms A. Such properties are essential, both for the executability purposes and as a basis for verifying many other properties, such as, for example, proving inductive theorems of a functional program, or correct model checking of temporal logic properties for a concurrent program. This paper develops the mathematical foundations on which the checking of these properties (or ground versions of them) is based, presents two tools, the Church-Rosser Checker (CRC) and the Coherence Checker (ChC) supporting the verification of these properties, and illustrates with examples a methodology to establish such properties using the proof obligations returned by the tools.

Research on Automatic Design of Extendable TrussBased on CAD Software

This paper provides a method of automatic design for extendable truss based on CAD software. The method mainly consists of parametrical design, automatic assembly, interference checking and extraction of model properties. With Visual C + + as programming language, secondary development was done on automatic assembly and other related modules of CAD software, which can achieve parametrically automatic assembly, interference checking and automatically extracting properties of extendable truss model. Thus, this method can guide the design staff performing program design, improve the correctness and accuracy of design, shorten the design cycle of extendable truss and also has reference value on rapid design and development for other products.

On the Church-Rosser and coherence properties of conditional order-sorted rewrite theories

In the effort to bring rewriting-based methods into contact with practical applications both in programing and in formal verification, there is a tension between: (i) expressiveness and generality—so that a wide range of applications can be expressed easily and naturally— and (ii) support for formal verification, which is harder to get for general and expressive specifications. This paper answers the challenge of successfully negotiating the tension between goals (i) and (ii) for a wide class of Maude specifications, namely: (a) equational order-sorted conditional specifications (Σ,E∪A), corresponding to functional programs modulo axioms such as associativity and/or commutativity and/or identity axioms and (b) order-sorted conditional rewrite theories R=(Σ,E∪A,R,ϕ), corresponding to concurrent programs modulo axioms A. For Maude functional programs the key formal property checked is the Church-Rosser property. For concurrent declarative programs in rewriting logic, the key property checked is the coherence between rules and equations modulo the axioms A. Such properties are essential, both for executability purposes and as a basis for verifying many other properties, such as, for example, proving inductive theorems of a functional program, or correct model checking of temporal logic properties for a concurrent program. This paper develops the mathematical foundations on which the checking of these properties (or ground versions of them) is based, presents two tools, the Church-Rosser Checker (CRC) and the Coherence Checker (ChC) supporting the verification of these properties, and illustrates with examples a methodology to establish such properties using the proof obligations returned by the tools.

Achieving distributed control through model checking

We apply model checking of knowledge properties to the design of distributed controllers that enforce global constraints on concurrent systems. The problem of synthesizing a distributed controller is undecidable in the general case. We thus look at a variant of the synthesis problem that allows adding temporary synchronizations between processes. We calculate when processes can decide autonomously, based on their knowledge, whether to take or block an action so that the global constraint is not violated. The local knowledge of processes may not suffice to control the processes so as to achieve the global constraint without introducing new deadlocks. When individual processes cannot take a decision alone based on their knowledge, one may coordinate several processes to achieve joint knowledge in order to take joint decisions. A fixed coordination among sets of processes may severely degrade concurrency. Therefore, we propose the use of temporary coordinations. Since realizing such coordinations on a distributed platform induces communication overhead, we strive to minimize their number. We show how this framework is applied to the case of synthesizing a distributed controller for enforcing a priority order. Finally, we show that the general undecidability of distributed synthesis without adding synchronization holds even for the particular problem of enforcing a priority order.

Variations on Multi-Core Nested Depth-First Search

Recently, two new parallel algorithms for on-the-fly model checking of LTL properties were presented at the same conference: Automated Technology for Verification and Analysis, 2011. Both approaches extend Swarmed NDFS, which runs several sequential NDFS instances in parallel. While parallel random search already speeds up detection of bugs, the workers must share some global information in order to speed up full verification of correct models. The two algorithms differ considerably in the global information shared between workers, and in the way they synchronize. Here, we provide a thorough experimental comparison between the two algorithms, by measuring the runtime of their implementations on a multi-core machine. Both algorithms were implemented in the same framework of the model checker LTSmin, using similar optimizations, and have been subjected to the full BEEM model database. Because both algorithms have complementary advantages, we constructed an algorithm that combines both ideas. This combination clearly has an improved speedup. We also compare the results with the alternative parallel algorithm for accepting cycle detection OWCTY-MAP. Finally, we study a simple statistical model for input models that do contain accepting cycles. The goal is to distinguish the speedup due to parallel random search from the speedup that can be attributed to clever work sharing schemes.

A pragmatic approach to evaluate alternative indicators to GDP

The serious economic crisis broken out in 2008 highly stressed the limitations of GDP used as a well-being indicator and as a predictive tool for economy. This induced the need to identify new indicators able to link the economic prosperity of a country to aspects of sustainable development and externalities, both positive and negative, in the long run. The aim of this paper is to introduce a structured approach which supports the choice or the construction of alternative indicators to GDP. The starting point is the definition of what a well-being indicator actually should represent according to the Recommendations of the Stiglitz-Sen-Fitoussi Report on the measurement of economic performance and social progress. Then the paper introduces a systematic procedure for the analysis of well-being indicators. The different phases of this procedure entail the checking of indicators technical properties and their effect on the representational efficacy. Finally, some of the most representative well-being indicators drawn from the literature are compared and a detailed application example is proposed.

Model checking of emergent behaviour properties of robot swarms

This paper presents a case study on scalability of explicit state model checking. Three state space reduction methods - state vector compression, bit state hashing, and symmetry reduction - were applied on an exercise with the objective of verifying a distributed coordination algorithm for robot swarms. Based on the analysis results, the feasibility of using explicit state model checking to prove properties of large multi-agent systems is questioned and the limitations faced in verifying a dynamic cleaning algorithm are outlined.

Efficient model checking of PSL safety properties

Safety properties are an important class of properties, as in the industrial use of model checking, a large majority of the properties to be checked are safety properties. This work presents an efficient approach to model check safety properties expressed in PSL (IEEE Std 1850 Property Specification Language), an industrial property specification language. The approach can also be used as a sound but incomplete bug-hunting tool for general (non-safety) PSL properties, and it will detect exactly the finite counterexamples that are the informative bad prefixes for the PSL formulae in question. The presented technique is inspired by the temporal testers approach of Pnueli and co-authors, but unlike theirs, the proposed approach is aimed at finding finite counterexamples to properties. The new approach presented here handles a larger syntactic subset of PSL safety properties than earlier translations for PSL safety subsets and has been implemented on top of the open source NuSMV 2 model checker. The experimental results show the approach to be a quite competitive model checking approach when compared to a state-of-the-art implementation of PSL model checking.

On the consistency, expressiveness, and precision of partial modeling formalisms

Partial transition systems support abstract model checking of complex temporal properties by combining both over- and under-approximating abstractions into a single model. Over the years, three families of such modeling formalisms have emerged, represented by (1) Kripke Modal Transition Systems (KMTSs), with restrictions on necessary and possible behaviors; (2) Mixed Transition Systems (MixTSs), with relaxation on these restrictions; and (3) Generalized Kripke MTSs (GKMTSs), with hyper-transitions, respectively. In this paper, we investigate these formalisms based on two fundamental ways of using partial transition systems (PTSs) – as objects for abstracting concrete systems (and thus, a PTS is semantically consistent if it abstracts at least one concrete system) and as models for checking temporal properties (and thus, a PTS is logically consistent if it gives consistent interpretation to all temporal logic formulas). We study the connection between semantic and logical consistency of PTSs, compare the three families w.r.t. their expressive power (i.e., what can be modeled, what abstractions can be captured using them), and discuss the analysis power of these formalisms, i.e., the cost and precision of model checking.Specifically, we identify a class of PTSs for which semantic and logical consistency coincide and define a necessary and sufficient structural condition to guarantee consistency. We also show that all three families of PTSs have the same expressive power (but do differ in succinctness). However, GKMTSs are more precise (i.e., can establish more properties) for model checking than the other two families. The direct use of GKMTSs in practice has been hampered by the difficulty of encoding them symbolically. We address this problem by developing a new semantics for temporal logic of PTSs that makes the MixTS family as precise for model checking as the GKMTS family. The outcome is a symbolic model checking algorithm that combines the efficient encoding of MixTSs with the model checking precision of GKMTSs. Our preliminary experiments indicate that the new algorithm is a good match for predicate-abstraction-based model checkers.

FSM-based formal compliance verification of interface protocols

of the important steps in a platform-based system-on-a-chip design methodology. There are limitations for most of the existing methods for interface protocol compliance verifi- cation. Simulation-based methods have the false positive problem while formal property checking methods may suffer from memory explosion and excessive runtime. In this pa- per, we propose a novel approach for interface protocol compliance verification. The properties of the interface protocol are first specified as a specification FSM. Then the compliance of interface logic is formally verified at the higher FSM level so that the re- quired memory and runtime can be greatly reduced. Finally, it is shown theoretically and experimentally that the proposed algorithm possesses acceptably low time complexity for practical applications.