Formal Methods Tools Research Articles

Systematic Evaluation and Usability Analysis of Formal Methods Tools for Railway Signaling System Design

Formal methods and supporting tools have a long record of success in the development of safety-critical systems. However, no single tool has emerged as the dominant solution for system design. Each tool differs from the others in terms of the modeling language used, its verification capabilities and other complementary features, and each development context has peculiar needs that require different tools. This is particularly problematic for the railway industry, in which formal methods are highly recommended by the norms, but no actual guidance is provided for the selection of tools. To guide companies in the selection of the most appropriate formal methods tools to adopt in their contexts, a clear assessment of the features of the currently available tools is required. To address this goal, this paper considers a set of 13 formal methods tools that have been used for the early design of railway systems, and it presents a systematic evaluation of such tools and a preliminary usability analysis of a subset of 7 tools, involving railway practitioners. The results are discussed considering the most desired aspects by industry and earlier related studies. While the focus is on the railway signaling domain, the overall methodology can be applied to similar contexts. Our study thus contributes with a systematic evaluation of formal methods tools and it shows that despite the poor graphical interfaces, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">usability</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">maturity</i> of the tools are not major problems, as claimed by contributions from the literature. Instead, support for <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">process integration</i> is the most relevant obstacle for the adoption of most of the tools. Our contribution can be useful to R&D engineers from railway signaling companies and infrastructure managers, but also to tool developers and academic researchers alike.

CryptHOL: Game-Based Proofs in Higher-Order Logic

Game-based proofs are a well-established paradigm for structuring security arguments and simplifying their understanding. We present a novel framework, CryptHOL, for rigorous game-based proofs that is supported by mechanical theorem proving. CryptHOL is based on a new semantic domain with an associated functional programming language for expressing games. We embed our framework in the Isabelle/HOL theorem prover and, using the theory of relational parametricity, we tailor Isabelle’s existing proof automation to game-based proofs. By basing our framework on a conservative extension of higher-order logic and providing automation support, the resulting proofs are trustworthy and comprehensible, and the framework is extensible and widely applicable. We evaluate our framework by formalising different game-based proofs from the literature and comparing the results with existing formal-methods tools.

Enabling continuous integration in a formal methods setting

In modern software development, the practices of continuous integration and DevOps are widely used to increase delivery speed and reduce the time it takes to deploy software changes to production. If formal method tools cannot be efficiently integrated in a DevOps paradigm, then their impact on software development will be reduced. In this paper, we present work addressing this issue through a series of extensions for the Overture tool supporting the Vienna Development Method. These extensions enable Overture to be used in a DevOps setting, through continuous integration and validation of models and generated code via integration with the Jenkins automation server. We frame the integration of formal methods and DevOps in a series of principles, demonstrate the value of this integration through a case study, and reflect on our experiences using formal methods and DevOps in an industrial setting. We hope that this work can help other formal method practitioners integrate their tools with DevOps.

A Secure Protocol for Remote-Code Integrity Attestation of Embedded Systems: The CSP Approach

No doubt, a person of modern society relying on Embedded Systems (ESs) has increased rapidly and the era of digital machines is gaining popularity among users and also systems providers. At the same time, such instruments face substantial security challenges because they usually operate in a physically unprotected environment, and thus attract the attackers to gain unauthorized access for utilizing the system functions. Accordingly, system integrity is important and hence there is a need to propose a technique/tool to verify that the original/pure systems codes have been used in those devices. In this research, our main objective is to design a system architecture with a secure communication for code integrity attestation of an ES. Indeed, the study presents the proposed system architecture for ESs integrity attestation which includes two main phases: fetching an ES code at a server site and examining the ES at a remote site (using a designed user application). Essentially, the hash function (SHA-2) with a random key to calculate a unique digest value for a targeted system have been utilized. Also, the study used timestamps and nonce values, two secure keys, and public key algorithm to design a secure protocol in-order to prevent potential attacks during data and the associated values transfer between the server and the remote user application. As many researchers state that the formal methods are very precise and accurate for presenting system specifications; this study modeled and analyzed the proposed attestation protocol using the Communicating Sequential Processes (CSP) formal method approach. Besides, the Compiler for the Analysis of Security Protocols (Casper) has been used to translate the protocol description into the corresponding process algebra CSP model. Then, the researcher used the Failures Divergences Refinement (FDR) to evaluate the proposed protocol. Those formal method tools are considered as a reliable verification measurement in-order to figure-out potential flaws and correct them. Overall, the final output of checking all the defined secrecy and authentication assertions using FDR 4.2.0, and thus all the secrecy and authentication specifications defined in the developed Casper script are passed.

You keep using that word

Formal methods tools have been shown to be effective at finding defects in and verifying the correctness of safety-critical systems such as avionics systems. The recent release of DO-178C and the accompanying Formal Methods Supplement DO-333 will make it easier for developers of software for commercial aircraft to obtain certification credit for the use of formal methods. However, most developers of avionics systems are unfamiliar with formal methods, and most developers of formal methods tools are unfamiliar with certification requirements and processes. This article provides a brief overview of the certification process for commercial aircraft, as well as some of the issues related to the use of formal methods tools in this context.

Towards Enabling Overture as a Platform for Formal Notation IDEs

Formal Methods tools will never have as many users as tools for popular programming languages and so the effort spent on constructing Integrated Development Environments (IDEs) will be orders of magnitudes lower than that of programming languages such as Java. This means newcomers to formal methods do not get the same user experience as with their favourite programming IDE. In order to improve this situation it is essential that efforts are combined so it is possible to reuse common features and thus not start from scratch every time. This paper presents the Overture platform where such a reuse philosophy is present. We give an overview of the platform itself as well as the extensibility principles that enable much of the reuse. The paper also contains several examples platform extensions, both in the form of new features and a new IDE supporting a new language.

Checking Computations of Formal Method Tools - A Secondary Toolchain for ProB

We present the implementation of pyB, a predicate - and expression - checker for the B language. The tool is to be used for a secondary tool chain for data validation and data generation, with ProB being used in the primary tool chain. Indeed, pyB is an independent cleanroom-implementation which is used to double-check solutions generated by ProB, an animator and model-checker for B specifications. One of the major goals is to use ProB together with pyB to generate reliable outputs for high-integrity safety critical applications. Although pyB is still work in progress, the ProB/pyB toolchain has already been successfully tested on various industrial B machines and data validation tasks.

Reduction-based analysis of BGP systems with BGPVerif

Today's inter-domain routing protocol, the Border Gateway Protocol (BGP), is increasingly complicated and fragile due to policy misconfiguration by individual autonomous systems (ASes). Existing configuration analysis techniques are either manual and tedious, or do not scale beyond a small number of nodes due to the state explosion problem. To aid the diagnosis of misconfigurations in real-world large BGP systems, this paper presents BGPVerif , a reduction based analysis toolkit. The key idea is to reduce BGP system size prior to analysis while preserving crucial correctness properties. BGPVerif consists of two components, NetReducer that simplifies BGP configurations, and NetAnalyzer that automatically detects routing oscillation. BGPVerif accepts a wide range of BGP configuration inputs ranging from real-world traces (Rocketfuel network topologies), randomly generated BGP networks (GT-ITM), Cisco configuration guidelines, as well as arbitrary user-defined networks. BGPVerif illustrates the applicability, efficiency, and benefits of the reduction technique, it also introduces an infrastructure that enables networking researchers to interact with advanced formal method tool.

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human–automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel's zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human–automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

The common aspect proof environment

We describe the goals, architecture, design considerations and use of the common aspect proof environment (CAPE). The CAPE is an extensible framework integrating formal methods and analysis tools for aspect-oriented programs. It is intended both to encourage the use of formal methods and analysis tools for systems with aspects and to facilitate the development of new tools for aspect analysis. The general principles of the CAPE are first explained, and the components and their high-level organization are given. The user interfaces are described, providing both application oriented and tool oriented Eclipse views. A description of the tools already integrated into the CAPE is given, and some analysis and verification scenarios are shown for an example aspect system. The aid of the CAPE in tool evaluation and experimentation with innovative usage of tools is demonstrated. As one example, verification aspects are used to aid in the abstraction and specification needed for formal analysis in Java Pathfinder. The scenarios and strategies employed are steps towards a methodology that includes multiple formal methods tools in aspect-oriented software development.

A retrospective on CZT

AbstractCommunity Z Tools (CZT) is an open‐source Java framework for building formal methods tools for the specification language Z and extensions of Z. This paper gives an overview of CZT: its history, architecture, and development process. Extensibility is core to CZT and the main aims of this paper are to encourage and enable formal methods tool developers to utilize, extend, and contribute to CZT. The paper is also of value to people interested in open‐source or formal methods software in general since many of the techniques and practices described are not specific to CZT and could be applied to other frameworks. Copyright © 2011 John Wiley &amp; Sons, Ltd.

Experiences in developing the mCRL2 toolset

AbstractThis paper presents practices and experiences in developing the formal methods toolset mCRL2. Findings are presented based on years of experiences in developing tools in an academic environment. Practical problems and ways to solve them are discussed. We also present the direction that we foresee for the coming years of development in formal methods tool support. Copyright © 2010 John Wiley &amp; Sons, Ltd.

Formal Versus Agile: Survival of the Fittest

Many research have focused on new formal methods, integrating formal methods into agile ones, and assessing the agility of formal methods. This paper proves that formal methods can survive in an agile world; they are not obsolete and can be integrated into it. The potential for combining agile and formal methods holds promise. It might not always be an easy partnership, and succeeding will depend on a fruitful interchange of expertise between the two communities. Conducting a realistic trial project using a combined approach with an appropriate formal methods tool in a controlled environment will help assess the effectiveness of such an approach.

Analysis of the Formal Specification Application for Train Control Systems

Many critical control systems are developed using formal methods. When software applied to such systems is developed, the employment of formal methods in the software requirements specification and verification will provide increased assurance for such applications. Earlier errors of overlooked requirement specification can be detected using the formal specification method. Also, the testing and full verification to examine all reachable states using model checking to undertake formal verification are able to be completed. In this paper, we proposed an eclectic approach to incorporate Z(Zed) formal language and 'Statemate MAGNUM', formal method tools using Statechart. Also we applied the proposed method to train control systems for the formal requirement specification and analyzed the specification results.

Towards Formal Verification of Role-Based Access Control Policies

Specifying and managing access control policies is a challenging problem. We propose to develop formal verification techniques for access control policies to improve the current state of the art of policy specification and management. In this paper, we formalize classes of security analysis problems in the context of role-based access control. We show that in general these problems are PSPACE-complete. We also study the factors that contribute to the computational complexity by considering a lattice of various subcases of the problem with different restrictions. We show that several subcases remain PSPACE-complete, several further restricted subcases are NP-complete, and identify two subcases that are solvable in polynomial time. We also discuss our experiences and findings from experimentations that use existing formal method tools, such as model checking and logic programming, for addressing these problems.

The connection between two ways of reasoning about partial functions

Undefined terms involving the application of partial functions and operators are common in program specifications and in discharging proof obligations that arise in design. One way of reasoning about partial functions with classical First-order Predicate Calculus (FoPC) is to use a non-strict equality notion so as to insulate logical operators from undefined operands. An alternative approach is to work only with strict (weak) equality but use an alternative Logic of Partial Functions (LPF)—a logic in which the “Law of the Excluded Middle” does not hold. This paper explores the relationships between the theorems that can be proved in the two approaches. The main result is that theorems in LPF using weak equality can be straightforwardly translated into ones that are true in FoPC; translation in the other direction results, in general, in more complicated expressions but in many cases these can be readily simplified. Such results are important if the laudable move towards interworking of formal methods tools is to be sound.

Intelligent Systems and Formal Methods in Software Engineering

Over the last few years, technologies for the formal description, construction, analysis, and validation of software - based mostly on logics and formal reasoning - have matured. We can expect them to complement and partly replace traditional software engineering methods in the future. Formal methods in software engineering are an increasingly important application area for intelligent systems. The field has outgrown the area of academic case studies, and industry is showing serious interest. We convincingly argue that we've reached the point where we can solve the problem of how to formally verify industrial-scale software. We propose program verification as a computer science Grand Challenge. Deductive software verification is a core technology of formal methods. We describe recent dramatic changes in the way it's perceived and used. Another important base technique of formal methods, besides software verification, is synthesizing software that's correct by construction because it's formally derived from its specification. We discuss recent developments and trends in this area. Surprisingly efficient decision procedures for the satisfiability modulo theories problem have recently emerged. We explain these techniques and why they're important for all formal-methods tools. We look at formal methods from an industry perspective. We explain the success of Microsoft Research's SLAM project, which has developed a verification tool for device drivers

State-rich model checking

In this paper we survey the area of formal verification techniques, with emphasis on model checking due to its wide acceptance by both academia and industry. The major approaches and their characteristics are presented, together with the main problems faced while trying to apply them. With the increased complexity of systems, as well as interest in software correctness, the demand for more powerful automatic techniques is pushing the theories and tools towards integration. We discuss the state of the art in combining formal methods tools, mainly model checking with theorem proving and abstract interpretation. In particular, we present our own recent contribution on an approach to integrate model checking and theorem proving to handle state-rich systems specified using a combination of Z and CSP.

Using Off-the-Shelf Formal Methods to Verify Attribute Grammar Properties

Attribute Grammars are the specification language of many tools that automatically generate programming language implementations. We consider the problem of verifying properties of attribute grammar specifications, particularly properties that are not well supported by existing tools. Rather than propose methods for extending existing tool implementation techniques, we propose the use of off-the-shelf formal methods tools as the basis for attribute grammar verification. Off-the-shelf tools can provide significant expressive power at a much lower cost than extending an existing evaluator generator. As a specific example, we describe how to use the Alloy model finding and checking tool to verify properties of remote attribution constructs in the LIDO attribute grammar specification language. A naive application of this approach has significant performance overheads; we discuss techniques for limiting the scope of the problems that are solved to make the approach tractable.

Web Services as a New Approach to Distributing and Coordinating Semantics-Based Veri cation Toolkits

Formal veri cation toolkits are typically of rather special and, if one compares di erent related toolkits to each other, complementary functionalities. It has therefore been proposed to integrate di erent related toolkits within common environments. The potential for such integration is a direct consequence of the very fact that formal veri cation toolkits are semantics-based in the sense that they are implementations of well-understood mathematical theories. We argue that Web services can serve as a new platform for addressing the more practical issues in connection with that: For one, service integration in general is certainly an essential ingredient of the Web service paradigm. Also, Web services promote distributed and open integration, which ts the decentralisation and dynamism of formal veri cation community. Furthermore, directory-like techniques help to tackle coordination issues in formal methods tool integration.