Formal Verification Methods Research Articles

Verification and Validation of Simulations Against Holism

It has been argued that the Duhem problem is renewed with computational models since model assumptions having a representational aim and computational assumptions cannot be tested in isolation. In particular, while the Verification and Validation methodology is supposed to prevent such holism, Winsberg (Philos Compass 4:835–845, 2009; Science in the age of computer simulation, University of Chicago Press, Chicago, 2010) argues that verification and validation cannot be separated in practice. Morrison (Reconstructing reality: models, mathematics, and simulations, Oxford University Press, Oxford, 2015) replies that Winsberg overstates the entanglement between the steps. The paper aims at arbitrating these two positions, by stressing their respective validity in relation to domains of application. It importantly argues for an increasing use of formal methods in verification, that makes disentanglement possible.

A new hierarchical software architecture towards safety-critical aspects of a drone system

A new hierarchical software architecture is proposed to improve the safety and reliability of a safety-critical drone system from the perspective of its source code. The proposed architecture uses formal verification methods to ensure that the implementation of each module satisfies its expected design specification, so that it prevents a drone from crashing due to unexpected software failures. This study builds on top of a formally verified operating system kernel, certified kit operating system (CertiKOS). Since device drivers are considered the most important parts affecting the safety of the drone system, we focus mainly on verifying bus drivers such as the serial peripheral interface and the inter-integrated circuit drivers in a drone system using a rigorous formal verification method. Experiments have been carried out to demonstrate the improvement in reliability in case of device anomalies.

On Proactive, Transparent, and Verifiable Ethical Reasoning for Robots

Previous work on ethical machine reasoning has largely been theoretical, and where such systems have been implemented, it has, in general, been only initial proofs of principle. Here, we address the question of desirable attributes for such systems to improve their real world utility, and how controllers with these attributes might be implemented. We propose that ethically critical machine reasoning should be proactive, transparent, and verifiable. We describe an architecture where the ethical reasoning is handled by a separate layer, augmenting a typical layered control architecture, ethically moderating the robot actions. It makes use of a simulation-based internal model and supports proactive, transparent, and verifiable ethical reasoning. To do so, the reasoning component of the ethical layer uses our Python-based belief–desire–intention (BDI) implementation. The declarative logic structure of BDI facilitates both transparency, through logging of the reasoning cycle, and formal verification methods. To prove the principles of our approach, we use a case study implementation to experimentally demonstrate its operation. Importantly, it is the first such robot controller where the ethical machine reasoning has been formally verified.

Synthesizing tradeoff spaces with quantitative guarantees for families of software systems

Designing software in a way that guarantees run-time behavior while achieving an acceptable balance among multiple quality attributes is an open problem. Providing guarantees about the satisfaction of the same requirements under uncertain environments is even more challenging. Tools and techniques to inform engineers about poorly-understood design spaces in the presence of uncertainty are needed, so that engineers can explore the design space, especially when tradeoffs are crucial. To tackle this problem, we describe an approach that combines synthesis of spaces of system design alternatives from formal specifications of architectural styles with probabilistic formal verification. The main contribution of this paper is a formal framework for specification-driven synthesis and analysis of design spaces that provides formal guarantees about the correctness of system behaviors and satisfies quantitative properties (e.g., defined over system qualities) subject to uncertainty, which is treated as a first-class entity. We illustrate our approach in two case studies: a service-based adaptive system and a mobile robotics architecture. Our results show how the framework can provide useful insights into how average case probabilistic guarantees can differ from worst case guarantees, emphasizing the relevance of combining quantitative formal verification methods with structural synthesis, in contrast with techniques based on simulation and dynamic analysis that can only provide estimates about average case probabilistic properties.

Designing robust quadcopter software based on a real-time partitioned operating system and formal verification techniques

The creation of reliable unmanned aerial vehicles (drones) now is an important task in the science and technology, because such devices can have a lot of use-cases in the digital economy and modern life, so we need to ensure the reliability here. In this article, it is proposed to assemble a quadcopter from low-cost components in order to obtain a hardware prototype and to develop a software solution for the flight controller with high-reliability requirements, which will meet avionics software standards using existing open-source software solutions, and also apply the results as a model for teaching courses “Components of operating systems” and “Software verification”. In the study, we proceed to analyse the structure of quadcopters and flight controllers for them, represent a self-assembly solution. We describe Ardupilot as open-source software for unmanned aerial vehicles, the appropriate APM controller and methods of PID control. Today's avionics standard of reliable software for flight controllers is a real-time partitioning operating system that is capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. A good example of such OS is the open-source POK (Partitioned Operating Kernel). In the repository, it contains an example design of a system for the quadcopters using AADL language for modeling its hardware and software. We apply such a technique with Model-driven engineering to a demo system that runs on real hardware and contains a flight management process with PID control as a partitioned process. Using a partitioned OS brings the reliability of flight system software to the next level. And to increase the level of control logic correctness we propose to use formal verification methods and provide examples of verifiable properties at the level of code using the deductive approach as well as at the level of the cyber-physical system using Differential dynamic logic to prove the stability.

A Review on the Verification Approaches and Tools used to Verify the Correctness of Security Algorithms and Protocols

Security algorithms and protocols are typical essential upgrades that must be involved within systems and their structures to provide the best performance. The protocols and systems should go through verification and testing processes in order to be more efficient and accurate. In the testing of software, traditional methods are used for accuracy check-up. However, this could not fulfill the measurement of all the testing requirements. The usage of formal verification approaches in checking security properties considers their best environment to be applied. The available literature discussed several approaches on developing the most robust formal verification methods for addressing and analyzing errors that face systems. This could be during the implantation process, unknown attacks, and nondeterministic adversary on the security protocols and algorithm. In this paper, a comprehensive review of the main formal verification approaches such as model checking and theorem approving has been conducted. Moreover, the use of verification tools was briefly presented and explained thoroughly. Those formal verification methods could be involved in the design, redesign of security protocols, and algorithms based on standards and determined sizes that is decided by these techniques’ analysis. The critical analysis of the methods used in verifying the security of systems showed that model checking approaches and its tools were the most used approaches among all the reviewed methods.

Combining Formal and Probabilistic Modeling in Resilient Systems Design

Resilience is a system property that enables a system (or system-of-systems) to continue to provide useful service in the face of disruptions. Resilience is especially important for systems that have to operate for extended periods in uncertain, disruptive environments. Resilience approaches today tend to be ad hoc and do not scale. Importantly, it is difficult to assess their long-term impact. This paper presents a flexible contract (FC) approach that employs a combination of formal methods for verification and testing and flexible assertions coupled with probabilistic modeling to handle mission uncertainty. A FC is a hybrid modeling construct that facilitates system verification and testing while offering the requisite flexibility to cope with non-determinism. This paper illustrates the use of FCs for multi-UAV swarm operations in, partially observable, dynamic environments. The approach is sufficiently general for use in other domains such as self-driving vehicles.

A Scenario-Based Approach for Formal Modelling and Verification of Safety Properties in Automated Driving

Considering diverse scenarios in urban traffic, the safety assessment of the decision-making process in automated driving is of great concern for years. And the difficulties of assessing safety lies in the computation of massive spatio-temporal data, the classification of scenarios, and the representation of the uncertainty in the environment with mixed traffic of manned and automated driving. Formal methods are often advocated as the way of increasing confidence in the safety-critical systems via its rigorous mathematical logic. Thus, we propose an assessment scheme which involves: i) the abstract model for decision-making, ii) characterization of composable scenarios, and iii) a corresponding formal verification method to assess safety. The abstract model captures features from the real-time observation and the estimation of the feasible driving alternatives of the surrounding vehicles, as the scenario is regarded as the dynamic evolution of the spatio-temporal data in the static road geometry over time. These features enable the specification and reasoning of the spatial guard conditions and safety properties, and also contribute to the connection and composability of the scenarios. Due to our scenario-based model verification method, we can assess the safety of decisions in scenario transitions by quantitative verification on the probability of the satisfaction of safety property through mapping from our approach to UPPAAL SMC. For illustration, case studies in the fundamental scene structures and the multi-lane roundabout are introduced.

Verification Oriented Process Ontology

This paper presents the ontology of the concurrent processes close to Hoare communicating sequential processes. It is the part of the intellectual system for supporting verification of behavioural properties of these processes. Our ontological representation of the processes is oriented both to the application of formal verification methods and to the extraction of information from technical documentation (by our previously developed system of information extraction from a natural language text). We describe the ontology classes and domains that define communicating concurrent processes. These processes are characterized by sets of local and shared variables, a list of actions on these variables which change their values, a list of channels for the process communication (which, in turn, are characterized by the type of reading messages, capacity, ways of writing and reading, and reliability), and also a list of communication actions for sending messages. In addition to the formal mathematical definition of classes and domains of the ontology, examples of descriptions of some ontological classes as well as typical properties and axioms for them are specified in the editor Prot ́eg ́e in the OWL language with the use of the inference rules in the SWRL language. The formal operational semantics of communicating processes is determined on their ontological representation and is given as a labelled transition system. It is reduced to the local operational semantics of separate process instances in the interleaving model. We specialize several types of processes from the subject domain of automatic control systems that model the typical functional elements of the automatic control system (sensors, comparators and regulators) as well as their combinations. The concepts of the specialized ontology are illustrated by the example of a control part for a bottle-filling system.

Towards Combining Model Checking and Proof Checking

Model checking and automated theorem proving are two pillars of formal verification methods. This paper investigates model checking from an automated theorem proving perspective, aiming at combining the expressiveness of automated theorem proving and the complete automaticity of model checking. It places the focus on the verification of temporal logic properties of Kripke models. The main contributions are: (1) introducing an extended computation tree logic that allows polyadic predicate symbols; (2) designing a proof system for this logic, taking Kripke models as parameters; (3) developing a proof search algorithm for this system and a new automated theorem prover to implement it. The verification process of the new prover is completely automatic, and produces either a counterexample when the property does not hold, or a certificate when it does. The experimental results compare well to existing state-of-the-art tools on some benchmarks, and the efficiency is illustrated by application to an air traffic control problem.

Viola: Trustworthy Sensor Notifications for Enhanced Privacy on Mobile Systems

Modern mobile systems such as smartphones, tablets, and wearables contain a plethora of sensors such as camera, microphone, GPS, and accelerometer. These sensors can capture extremely sensitive and private information about the user including daily conversations, photos, videos, and visited locations, raising important privacy concerns. To address these concerns, we present Viola , our design and implementation of trustworthy sensor notifications , which use indicators such as LED to inform the user unconditionally when the sensors are on. We deploy Viola’s runtime monitor in low-level system software, e.g., in the operating system kernel or in the hypervisor . Moreover, we use formal verification methods to prove the functional correctness of the compilation of our invariant checks from a high-level language. We demonstrate that Viola incurs almost no overhead to the sensor’s performance and incurs only small power consumption overhead. Compared to our previous paper on Viola [1] , we present three important enhancements. First, we design, implement, and evaluate two-way sensor notifications , which guarantee that a sensor notification can be triggered if and only if the corresponding sensor is used. Second, we identify and add protection against concurrency attacks in Viola. Third, we implement Viola for an additional sensor and indicator combination.

Extending Formal Modeling for Resilient Systems Design

ABSTRACTResilience is a much‐needed characteristic in systems that are expected to operate in uncertain environments for extended periods with a high likelihood of disruptive events. Resilience approaches today employ ad hoc methods and piece‐meal solutions that are difficult to verify and test, and do not scale. Furthermore, it is difficult to assess the long‐term impact of such ad hoc “resilience solutions.” This paper presents a flexible contract‐based approach that employs a combination of formal methods for verification and testing and flexible assertions and probabilistic modelling to handle uncertainty during mission execution. A flexible contract (FC) is a hybrid modelling construct that facilitates system verification and testing while offering the requisite flexibility to cope with non‐determinism. This paper illustrates the use of FCs for multi‐UAV swarm control in, partially observable, dynamic environments. However, the approach is sufficiently general for use in other domains such as self‐driving vehicle and adaptive power/energy grids.

Formal verification approaches in the web service composition: A comprehensive analysis of the current challenges for future research

SummaryToday, service composition is emerging paradigm on the communication networks such as cloud environments, internet of things, wireless sensor network, and software‐defined network. The goal of service composition method is to provide the interactions between user requirements and smart objects of intelligent communication systems. There have been many efforts to use formal verification and behavioral modeling methods to evaluate the service composition mechanisms. Up to now, there is not a comprehensive analysis research on this topic. Therefore, this paper focuses on several formal verification approaches that are performed to confirm the service composition correctness in communication networks. The objective of this paper is to comprehensively categorize and examine current research techniques on formal verification of the service composition. This research analysis provides an overview of recent service composition approaches according to structural and functional properties. Comparison results show that most of the verification approaches in explanation of the service composition correctness are semantic‐aware approach with 43%. The most used verification method for the service composition is model checking with 69%. The process algebra is used 29%, and some theorem proving methods are applied in 9% of the investigated mechanism. Moreover, most widely used modeling tools are NuSMV (22%), SPIN (17%), CPN (12%), UPPAAL (12%), Event‐B (10%), and PAT (5%).

Model checking of reconfigurable FPGA modules specified by Petri nets

Abstract The paper proposes a novel formal verification method of reconfigurable modules implemented in FPGA devices. The modules are specified by Petri nets and can be exchanged in the already implemented and running system using dynamic partial reconfiguration. The model checking technique is used together with the abstract rule-based logical model to verify whether the new modules still satisfy the global requirements for the whole control system. The additional advantage of using the rule-based logical model is the possibility to automatically generate the VHDL code, hence the final implementation reflects the already verified specification. It allows to ensure high quality of the released product and eliminates errors related to hand-code writing. A case study is presented to illustrate the approach, as well as some experimental results.

New Metrics and Models for a Post-ISA Era

Pushed by both application and technology trends, today's computer systems employ unprecedented levels of heterogeneity, parallelism, and complexity as they seek to extend performance scaling and support new application domains. From datacenters to Internet-of-Things (IoT) devices, these scaling gains come at the expense of degraded hardware-software abstraction layers, increased complexity at the hardware-software interface, and increased challenges for software reliability, interoperability, and performance portability This talk will explore how new metrics, models, and analysis techniques can be effective in this "Post-ISA" era of shifting abstractions. The talk will cover hardware and software design opportunities, methods for formal verification, and a look into the implications on technologies like IoT.

Cloud manufacturing service composition and formal verification based on extended process calculus

Cloud manufacturing is an emerging service-oriented model to solve existing problems in manufacturing. This study proposes a process calculus–based approach to formally model cloud manufacturing service composition that is composed of description model, interaction scenario model, and composition process formal model, in which the semantics of process calculus to describe the quality of service (QoS) information of service composition is extended, and an intelligent service composition method is put forward based on the extended process calculus. Then, a platform architecture for implementing the proposed approach is addressed. The integrated development environment for the platform is set up with selection of free software tools. Thus, a prototype of the platform is developed. Finally, automated guided vehicle processing service composition and the open integrated manufacturing system service composition are taken as examples to illustrate the application of the proposed service composition method. The main attributes of the formal models for the application cases are verified. Case study results show that the proposed service composition and formal verification method based on the extended process calculus is feasible. Compared with other approaches for service composition, the proposed intelligent service composition method meets the most requirements for service composition.

Formal probabilistic analysis of a surgical robot control algorithm with different virtual fixtures

Surgical robots are increasingly being used in operation theaters involving normal or laparoscopic surgeries. The working of these surgical robots is highly dependent on their control algorithms, which require very rigorous analysis to ensure their correct functionality due to the safety-critical nature of surgeries. Traditionally, safety of control algorithms is ensured by simulations, but they provide incomplete and approximate analysis results due to their inherent sampling-based nature. We propose to use probabilistic model checking, which is a formal verification method, for quantitative analysis, to verify the control algorithms of surgical robots in this paper. As an illustrative example, the paper provides a formal analysis of a virtual fixture control algorithm, implemented in a neuro-surgical robot, using the PRISM model checker. In particular, we provide a formal discrete-time Markov chain-based model of the given control algorithm and its environment. This formal model is then analyzed for multiple virtual fixtures, like cubic, hexagonal and irregular shapes. This verification allowed us to discover new insights about the considered algorithm that allow us to design safer control algorithms.

A systematic literature review of the use of formal methods in medical software systems

AbstractThe use of formal methods is often recommended to guarantee the provision of necessary services and to assess the correctness of critical properties, such as functional safety, cybersecurity, and reliability, in medical and health care devices. In the past, several formal and rigorous methods have been proposed and consequently applied for trustworthy development of medical software and systems. In this paper, we perform a systematic literature review on the available state of the art in this domain. We collect the relevant literature on the use of formal methods for modeling, design, development, verification, and validation of software‐intensive medical systems. We apply standard systematic literature review techniques and run several queries in well‐known repositories to obtain information that can be useful for people who are either already working in this field or planning to start. Our study covers both quantitative and qualitative aspects of the subject.

Verifying chemical reaction network implementations: A bisimulation approach

Efforts in programming DNA and other biological molecules have recently focused on general schemes to physically implement arbitrary Chemical Reaction Networks. Errors in some of the proposed schemes have driven a desire for formal verification methods. By interpreting each implementation species as a multiset of formal species, the concept of weak bisimulation can be adapted to CRNs in a way that agrees with an intuitive notion of a correct implementation. The theory of CRN bisimulation can be used to prove the correctness of a general implementation scheme or to detect subtle problems. Given a specific formal CRN and a specific implementation CRN, the complexity of finding a valid interpretation between the two CRNs if one exists, and that of checking whether an interpretation is valid are both PSPACE-complete in the general case, but are NP-complete and polynomial-time respectively under an assumption that holds in many cases of interest. We present effective algorithms for both of those problems. We further discuss features of CRN bisimulation including a transitivity property and a modularity condition, the precise connection to the general theory of bisimulation, and an extension that takes into account spurious catalysts.

Applying Floyd’s Inductive Assertions Method for Verification of Generalized Net Models Without Temporal Components

Generalized Nets are extensions of Petri Nets. They are a suitable tool for describing real sequential and parallel processes in different areas. The implementation of correct Generalized Nets models is a task of great importance for the creation of a number of applications such as transportation management, e-business, medical systems, telephone networks, etc. The cost of an error in the models of some of these applications can be very high. The implementation of models of similar applications has to use formal approaches to prove that the developed models are correct. A foundation stone of software verification, which is suitable for verification of Generalized Nets models with transitions without temporal component, is Floyd’s inductive assertion method. This article presents a modification of Floyd’s inductive assertion method for verification of flowcharts, which allows Generalized Nets without temporal component to be verified. Using an illustrative example, we show that the offered adaptation is appropriate for the purpose of training university students in the Informatics and Computer Sciences in formal methods of verification.