Existing Verification Tools Research Articles

INNAbstract: An INN-Based Abstraction Method for Large-Scale Neural Network Verification.

Neural networks (NNs) have witnessed widespread deployment across various domains, including some safety-critical applications. In this regard, the demand for verifying means of such artificial intelligence techniques is more and more pressing. Nowadays, the development of evaluation approaches for NNs is a hot topic that is attracting considerable interest, and a number of verification methods have been proposed. Yet, a challenging issue for NN verification is pertaining to the scalability when some NNs of practical interest have to be evaluated. This work aims to present INNAbstract, an abstraction method to reduce the size of NNs, which leads to improving the scalability of NN verification and reachability analysis methods. This is achieved by merging neurons while ensuring that the obtained model (i.e., abstract model) overapproximates the original one. INNAbstract supports networks with numerous activation functions. In addition, we propose a heuristic for nodes' selection to build more precise abstract models, in the sense that the outputs are closer to those of the original network. The experimental results illustrate the efficiency of the proposed approach compared to the existing relevant abstraction techniques. Furthermore, they demonstrate that INNAbstract can help the existing verification tools to be applied on larger networks while considering various activation functions.

Modelling flocks of birds and colonies of ants from the bottom up

This paper advocates the use of compositional specifications based on formal languages as a means of modelling and analysing sophisticated collective behaviour in natural systems. With the use of appropriate linguistic constructs, models can be developed that are both compact and intuitive, and can be easily refined and extended in small steps. Automated workflows can be implemented on top of this methodology to provide quick feedback, enabling rapid design iterations. To support our argument, we present three examples from the natural world, focusing on flocks of birds and colonies of ants, which feature well-known examples of emergent behaviour in collective adaptive systems. We use an agent-based language to develop simple models that aim at capturing these collective phenomena, and discuss the specific language constructs that we use in the process. Then, we adapt an existing verification tool for the language to simulate our models, and show that our simulations do display emergent behaviour.

Counterexample-guided Spatial Flow Model Checking Methods for C Code

Software verification has always been a popular research topic to ensure the correctness and security of software. However, due to the complex semantics and syntax of programming languages, the formal methods for verifying the correctness of programs have the problems of low accuracy and low efficiency. In particular, the state change in address space caused by pointer operations makes it difficult to guarantee the verification accuracy of existing model checking methods. By combining model checking and sparse value-flow analysis, this paper designs a spatial flow model to effectively describe the state behavior of C code at the symbolic-variable level and address-space level and proposes a model checking algorithm of CounterExample-Guided Abstraction refinement and Sparse value-flow strong update (CEGAS), which enables points-to-sensitive formal verification for C code. This paper establishes a C-code benchmark containing a variety of pointer operations and conducts comparative experiments on the basis of this benchmark. These experiments indicate that in the task of analyzing multi-class C code features, the model checking algorithm CEGAS proposed in this paper can achieve outstanding results compared with the existing model checking tools. The verification accuracy of CEGAS is 92.9%, and the average verification time of each line of code is 2.58 ms, both of which are better than those of existing verification tools.

Compositional Learning and Verification of Neural Network Controllers

Recent advances in deep learning have enabled data-driven controller design for autonomous systems. However, verifying safety of such controllers, which are often hard-to-analyze neural networks, remains a challenge. Inspired by compositional strategies for program verification, we propose a framework for compositional learning and verification of neural network controllers. Our approach is to decompose the task (e.g., car navigation) into a sequence of subtasks (e.g., segments of the track), each corresponding to a different mode of the system (e.g., go straight or turn). Then, we learn a separate controller for each mode, and verify correctness by proving that (i) each controller is correct within its mode, and (ii) transitions between modes are correct. This compositional strategy not only improves scalability of both learning and verification, but also enables our approach to verify correctness for arbitrary compositions of the subtasks. To handle partial observability (e.g., LiDAR), we additionally learn and verify a mode predictor that predicts which controller to use. Finally, our framework also incorporates an algorithm that, given a set of controllers, automatically synthesizes the pre- and postconditions required by our verification procedure. We validate our approach in a case study on a simulation model of the F1/10 autonomous car, a system that poses challenges for existing verification tools due to both its reliance on LiDAR observations, as well as the need to prove safety for complex track geometries. We leverage our framework to learn and verify a controller that safely completes any track consisting of an arbitrary sequence of five kinds of track segments.

Ranking Function Detection via SVM: A More General Method

The existence of a ranking function implies the termination of a loop. Different methods are designed for detection of different classes of ranking functions. Moreover, for loops with polynomial guards and polynomial assignments, existing complete solutions for detecting their ranking functions are mostly with bad complexity. In this paper, we propose an approach to the synthesis of ranking functions for loops via support vector machine (SVM). We transform the ranking function detection problem into a binary classification problem. Once ranking function templates are given, the SVM is used to learn the coefficients of the templates. In this way, candidate ranking functions can be obtained. Finally, existing verification tools are employed to certify the candidates. With our approach, multiple forms of loops can be handled, and multiple classes of ranking functions can be detected. The effectiveness is presented with experimental evidence. We can detect ranking functions (e.g., polynomial ranking functions and non-polynomial ranking functions) for given loops, especially for loops with fractional or radical update that existing tools may not be able to handle as far as we know.

Early validation of system requirements and design through correctness-by-construction

Early validation of requirements aims to reduce the need for the high-cost validation testing and corrective measures at late development stages. This work introduces a systematic process for the unambiguous specification of system requirements and the guided derivation of formal properties, which should be implied by the system ’s structure and behavior in conjunction with its external stimuli. This rigorous design takes place through the incremental construction of a model using the BIP (Behavior-Interaction-Priorities) component framework. It allows building complex designs by composing simpler reusable designs enforcing given properties. If some properties are neither enforced nor verified, the model is refined or certain requirements are revised. A validated model provides evidence of requirements’ consistency and design correctness. The process is semi-automated through a new tool and existing verification tools. Its effectiveness was evaluated on a set of requirements for the control software of the CubETH nanosatellite and an extract of software requirements for a Low Earth Orbit observation satellite. Our experience and obtained results helped in identifying open challenges for applying the method in industrial context. These challenges concern with the domain knowledge representation, the expressiveness of used specification languages, the library of reusable designs and scalability.

A method to localize faults in concurrent C programs

Abstract We describe a new approach to localize faults in concurrent programs, which is based on bounded model checking and sequentialization techniques. The main novelty is the idea of reproducing a faulty behavior, in a sequential version of a concurrent program. In order to pinpoint faulty lines, we analyze counterexamples generated by a model checker, to the new instrumented sequential program, and search for a diagnostic value, which corresponds to actual lines in a program. This approach is useful to improve debugging processes for concurrent programs, since it tells which line should be corrected and what values lead to a successful execution. We implemented this approach as a code-to-code transformation from concurrent into non-deterministic sequential programs, which are used as inputs to existing verification tools. Experimental results show that our approach is effective and capable of identifying faults in our benchmark set, which was extracted from the SV-COMP 2016 suite.

Coupling proofs are probabilistic product programs

Couplings are a powerful mathematical tool for reasoning about pairs of probabilistic processes. Recent developments in formal verification identify a close connection between couplings and pRHL, a relational program logic motivated by applications to provable security, enabling formal construction of couplings from the probability theory literature. However, existing work using pRHL merely shows existence of a coupling and does not give a way to prove quantitative properties about the coupling, needed to reason about mixing and convergence of probabilistic processes. Furthermore, pRHL is inherently incomplete, and is not able to capture some advanced forms of couplings such as shift couplings. We address both problems as follows. First, we define an extension of pRHL, called x-pRHL, which explicitly constructs the coupling in a pRHL derivation in the form of a probabilistic product program that simulates two correlated runs of the original program. Existing verification tools for probabilistic programs can then be directly applied to the probabilistic product to prove quantitative properties of the coupling. Second, we equip x-pRHL with a new rule for while loops, where reasoning can freely mix synchronized and unsynchronized loop iterations. Our proof rule can capture examples of shift couplings, and the logic is relatively complete for deterministic programs. We show soundness of x-PRHL and use it to analyze two classes of examples. First, we verify rapid mixing using different tools from coupling: standard coupling, shift coupling, and path coupling, a compositional principle for combining local couplings into a global coupling. Second, we verify (approximate) equivalence between a source and an optimized program for several instances of loop optimizations from the literature.

A survey of symbolic methods for establishing equivalence-based properties in cryptographic protocols

Cryptographic protocols aim at securing communications over insecure networks such as the Internet, where dishonest users may listen to communications and interfere with them. A secure communication has a different meaning depending on the underlying application. It ranges from the confidentiality of a data to e.g. verifiability in electronic voting systems. Another example of a security notion is privacy.Formal symbolic models have proved their usefulness for analysing the security of protocols. Until quite recently, most results focused on trace properties like confidentiality or authentication. There are however several security properties, which cannot be defined (or cannot be naturally defined) as trace properties and require a notion of behavioural equivalence. Typical examples are anonymity, and privacy related properties. During the last decade, several results and verification tools have been developed to analyse equivalence-based security properties.We propose here a synthesis of decidability and undecidability results for equivalence-based security properties. Moreover, we give an overview of existing verification tools that may be used to verify equivalence-based security properties.

An Empirical Study over Correctness Properties for Multithreaded Programs

Developing multithreaded programs has been difficult, especially when dealing with non-deterministic programs. It is nearly impossible to achieve completeness and soundness for multithreaded programs. In recent years, a number of verification tools have been developed in order to support multithreaded programs to achieve completeness and soundness. Verification tools developed through analyzing correctness properties. However, existing tools are still unable to discover all possible correctness properties for multithreaded programs and most of the tools only verifies deterministic multithreaded programs. In this paper, we have given an empirical study on the correctness of multithreaded programs and analyzed all possible correctness properties in existing verification tools. We have compared existing tools with a number of possible properties and evaluated possible improvements for developing a correct multithreaded program. With the findings of these properties, we also analyzed the high-priority and low-priority correctness properties for multithreaded programs.

Using contexts to extract models from code

Behaviour models facilitate the understanding and analysis of software systems by providing an abstract view of their behaviours and also by enabling the use of validation and verification techniques to detect errors. However, depending on the size and complexity of these systems, constructing models may not be a trivial task, even for experienced developers. Model extraction techniques can automatically obtain models from existing code, thus reducing the effort and expertise required of engineers and helping avoid errors often present in manually constructed models. Existing approaches for model extraction often fail to produce faithful models, either because they only consider static information, which may include infeasible behaviours, or because they are based only on dynamic information, thus relying on observed executions, which usually results in incomplete models. This paper describes a model extraction approach based on the concept of contexts, which are abstractions of concrete states of a program, combining static and dynamic information. Contexts merge some of the advantages of using either type of information and, by their combination, can overcome some of their problems. The approach is partially implemented by a tool called LTS Extractor, which translates information collected from execution traces produced by instrumented Java code to labelled transition systems (LTS), which can be analysed in an existing verification tool. Results from case studies are presented and discussed, showing that, considering a certain level of abstraction and a set of execution traces, the produced models are correct descriptions of the programs from which they were extracted. Thus, they can be used for a variety of analyses, such as program understanding, validation, verification, and evolution.

Verifying eventual consistency of optimistic replication systems

We address the verification problem of eventual consistency of optimistic replication systems. Such systems are typically used to implement distributed data structures over large scale networks. We introduce a formal definition of eventual consistency that applies to a wide class of existing implementations, including the ones using speculative executions. Then, we reduce the problem of checking eventual consistency to reachability and model checking problems. This reduction enables the use of existing verification tools for message-passing programs in the context of verifying optimistic replication systems. Furthermore, we derive from these reductions decision procedures for checking eventual consistency of systems implemented as finite-state programs communicating through unbounded unordered channels.

From Timed Reo Networks to Networks of Timed Automata

The Reo coordination language is an extensible graphical notation for component or service coordination wherein independent autonomous software entities exchange data through a connector or a network imposing synchronization and data constraints on those entities. Each connector is formed from a set of binary connectors, called channels, with precise semantics and, thus, amenable to formal verification. However, the development of verification tools for Reo-specific semantic models, namely, constraint automata with its multiple extensions to represent quality of service, time constraints, context-dependent or probabilistic behavior would require years of research and development. A much more promising approach is to exploit already existing verification tools. In this paper, we present a mapping of timed Reo networks to networks of timed automata used for system specification in Uppaal. Uppaal is a state-of-the-art toolset for modeling, validation and verification of real-time systems used in many large-scale industrial projects. Our work enables its application to the compositional analysis of timed service-based workflow models specified with Reo.

Verification across Intellectual Property Boundaries

In many industries, the importance of software components provided by third-party suppliers is steadily increasing. As the suppliers seek to secure their intellectual property (IP) rights, the customer usually has no direct access to the suppliers’ source code, and is able to enforce the use of verification tools only by legal requirements. In turn, the supplier has no means to convince the customer about successful verification without revealing the source code. This article presents an approach to resolve the conflict between the IP interests of the supplier and the quality interests of the customer. We introduce a protocol in which a dedicated server (called the “amanat”) is controlled by both parties: the customer controls the verification task performed by the amanat, while the supplier controls the communication channels of the amanat to ensure that the amanat does not leak information about the source code. We argue that the protocol is both practically useful and mathematically sound. As the protocol is based on well-known (and relatively lightweight) cryptographic primitives, it allows a straightforward implementation on top of existing verification tool chains. To substantiate our security claims, we establish the correctness of the protocol by cryptographic reduction proofs.

A theorem prover for Boolean BI

While separation logic is acknowledged as an enabling technology for large-scale program verification, most of the existing verification tools use only a fragment of separation logic that excludes separating implication. As the first step towards a verification tool using full separation logic, we develop a nested sequent calculus for Boolean BI (Bunched Implications), the underlying theory of separation logic, as well as a theorem prover based on it. A salient feature of our nested sequent calculus is that its sequent may have not only smaller child sequents but also multiple parent sequents, thus producing a graph structure of sequents instead of a tree structure. Our theorem prover is based on backward search in a refinement of the nested sequent calculus in which weakening and contraction are built into all the inference rules. We explain the details of designing our theorem prover and provide empirical evidence of its practicality.

Automatic behavior composition synthesis

The behavior composition problem amounts to realizing a virtual desired module (e.g., a surveillance agent system) by suitably coordinating (and re-purposing) the execution of a set of available modules (e.g., a video camera, vacuum cleaner, a robot, etc.). In particular, we investigate techniques to synthesize a controller implementing a fully controllable target behavior by suitably coordinating available partially controllable behaviors that are to execute within a shared, fully observable, but partially predictable (i.e., non-deterministic), environment. Both behaviors and environment are represented as arbitrary finite state transition systems. The technique we propose is directly based on the idea that the controller job is to coordinate the concurrent execution of the available behaviors so as to “mimic” the target behavior. To this end, we exploit a variant of the formal notion of simulation to formally capture the notion of “mimicking”, and we show that the technique proposed is sound and complete, optimal with respect to computational complexity, and robust for different kind of system failures. In addition, we demonstrate that the technique is well suited for highly efficient implementation based on synthesis by model checking technologies, by relating the problem to that of finding a winning strategy in a special safety game and explaining how to actually solve it using an existing verification tool.

Automatic Verification of Message-Based Device Drivers

We develop a practical solution to the problem of automatic verification of the interface between device drivers and the OS. Our solution relies on a combination of improved driver architecture and verification tools. It supports drivers written in C and can be implemented in any existing OS, which sets it apart from previous proposals for verification-friendly drivers. Our Linux-based evaluation shows that this methodology amplifies the power of existing verification tools in detecting driver bugs, making it possible to verify properties beyond the reach of traditional techniques.

Analyzing a χ model of a turntable system using Spin, CADP and Uppaal

Nowadays, due to increasing system complexity and growing competition and costs, industry makes high demands on powerful techniques used to design and analyze manufacturing systems. One of the most popular techniques to do performance analysis is simulation. However, simulation-based analysis cannot guarantee the correctness of a system, so it is less suitable for functional analysis. Our research focuses on examining other methods to do performance analysis and functional analysis, and trying to combine the two. One of the approaches is to translate a simulation model that is used for performance analysis to a model written in an input language of an existing verification tool. We translate a χ [D.A. van Beek, K.L. Man, M.A. Reniers, J.E. Rooda, R.R.H. Schiffelers, Syntax and Consistent Equation Semantics of Hybrid Chi, CS-Report 04-37, Eindhoven University of Technology, 2004] simulation model of a turntable system into models written in the input languages of the tools CADP [J.-C. Fernandez, H. Garavel, A. Kerbrat, L. Mounier, R. Mateescu, M. Sighireanu, CADP—a protocol validation and verification toolbox, in: Proceedings of the 8th Conference on Computer Aided Verification (CAV’96), Lecture Notes in Computer Science, vol. 1102, 1996, pp. 437–440], S pin [G.J. Holzmann, The SPIN Model Checker, Addison-Wesley, 2003] and U ppaal [K.G. Larsen, P. Pettersson, W.Yi, Uppaal in a nutshell, Int. J. Software Tools for Technology Transfer 1 (1–2) (1997) 134–152] and do a functional analysis with each of them. This allows us to evaluate the usefulness of these tools for the functional analysis of χ models. We compare the input formalisms, the expressiveness of the temporal logics, and the algorithmic techniques for model checking that are used in those tools.

On verifying distributed multithreaded Java programs

Distributed multithreaded software systems are becoming more and more important in modern networked environment. For these systems, concurrency control and thread synchronization make it much harder to do traditional extensive testing to guarantee the quality of the systems. In contrast to testing, software verification under certain formalisms and methodologies usually gives us higher confidence about the system. In this paper we consider translating some parts of program code that are sensitive to concurrency control into certain formal description so that we can reuse existing verification tools to enhance our confidence in the final code. Java language is gaining increasing popularity in distributed multithreaded system development, and CCS is one of the convenient tools for describing concurrent and multi-process systems. Under a set of reasonable restrictions, we present a general framework on how to translate the threaded control and synchronization portion of distributed multithreaded Java programs into formal specification in CCS. With the translated process terms, we are able to use some model checkers to verify properties expressed in modal /spl mu/-calculus, such as invariance eventualities, fairness etc., which are by nature hard to test.

Using goals to design and verify rule bases

The design of rule-based systems is often plagued by errors and anomalies. The verification and validation (V and V) processes to detect errors and anomalies in a rule base are complex. Methods that are general enough for comprehensive anomaly detection suffer from heavy computation. Special methods for V and V that have reduced computational needs lack in their scope and applicability. Most of the existing verification tools perform their checking based on the syntax of rule base encoding often ignoring useful meta knowledge of the domain. In this paper, we propose a way to abstract domain knowledge using goals. At the design level, goals are realized in a rule base using one of several design schemes, where a design scheme is a goal-to-hypothesis mapping satisfying certain constraints. At the implementation level, goals are inferred using partially ordered rule sequences called paths. Verification of a rule base can be performed by identifying certain rule aberrations, that can be indicative of the rule base anomalies circularity, ambivalence, redundancy, and deficiency. A case study is presented to highlight that the goal-based approach is useful for preventing rule subsumption (a form of redundancy) and for enhancing the (run time) performance of a rule base.