Formal Verification Techniques Research Articles

Quantitative model checking for assessing the energy impact of a MITM attack on EPONs

Broadcasting the downstream traffic makes the Ethernet Passive Optical Networks (EPONs) vulnerable to eavesdropping which is typically the initial step of an active attack, such as Man in the Middle attack (MITM). A MITM attack in such a network can be implemented by employing a fake Optical Line Terminal (OLT) and overwhelm computational, bandwidth, or energy resources. The latter is of great interest since Passive Optical Networks (PONs) are estimated to be the largest energy consumers among optical networks. In this paper we use formal analysis to quantitatively assess the impact of a fake OLT attacking an EPON energy‐efficiency mechanism. Formal verification techniques, such as model checking, constitute the perfect candidate for security verification, since they can analyze systems and protocols based on rigorous model definitions. Our results show that a MITM attack increases the energy expenditure, since it enforces the Optical Network Units (ONUs) to stay in the active mode even in cases of none network traffic.

Reductions and abstractions for formal verification of distributed round-based algorithms

Model checking has advanced over the last decades to become an effective formal technique for verifying distributed and concurrent systems. As computers grew in memory and processing capacity, it became possible to exhaustively verify systems with billions of states, making it practical to model and verify real-world protocols and algorithms. However, writing a model is a manual task that potentially introduces defects which the model checker tool finds to fulfill the formal specification (e.g., an incorrect model that fulfills an incomplete specification). Furthermore, this kind of formal verification technique is limited by the well-known state-space explosion problem. This paper aims to provide a set of generic template models, appropriate for distributed round-based algorithms, to be used to focus modeling effort on algorithm-specific details. To mitigate state-space explosion, the paper proposes two reduction techniques, named partition symmetry reduction and message order reduction, that exploit symmetries in the state space to avoid expanding equivalent states. The reusable framework for verifying round-based algorithms and the two proposed reduction techniques provide the means for reducing by orders of magnitude the number of states required to analyze common distributed algorithms.

Using knowledge discovery to propose a two-phase model checking for safety analysis of graph transformations

Safety is one of the most important features of modern software systems, especially safety-critical systems such as nuclear power plants, which can be checked exactly by model checking. Model checking is a formal verification technique that analyzes system properties through exploring all reachable states (state space) of a model of a system. The problem of the technique is that it confronts the state space explosion in large and complex systems due to exponential memory usage. Recent researches show that a partial and intelligent exploration of the state space can be a suitable solution to overcome this problem. In this paper, we propose a two-phase model checking for safety analysis of systems specified formally through graph transformations. In the first phase, the beam-search algorithm explores the state space to a specific number of states. In case of failure of the phase, the second phase starts: in systems specified through graph transformations, the rule applied on the previous state can determine the rule that can perform on the next state. In other words, the rule on current state depends on only the rule applied to previous state, not the one on earlier states. Hence, a Markov chain (MC) is estimated to capture dependencies between the sequence of applied rules in the state space explored by the beam-search algorithm. The MC is then employed to explore the remainder of the state space intelligently. To evaluate the effectiveness of the two-phase model checking, we implement it in GROOVE, an open source toolset for designing and model checking graph transformation systems. Experimental results show that the two-phase model checking has the high speed and accuracy in comparison with the existing meta-heuristic and evolutionary techniques.

Quantitative verification of Kalman filters

AbstractKalman filters are widely used for estimating the state of a system based on noisy or inaccurate sensor readings, for example in the control and navigation of vehicles or robots. However, numerical instability or modelling errors may lead to divergence of the filter, leading to erroneous estimations. Establishing robustness against such issues can be challenging. We propose novel formal verification techniques and software to perform a rigorous quantitative analysis of the effectiveness of Kalman filters. We present a general framework for modelling Kalman filter implementations operating on linear discrete-time stochastic systems, and techniques to systematically construct a Markov model of the filter's operation using truncation and discretisation of the stochastic noise model. Numerical stability and divergence properties are then verified using probabilistic model checking. We evaluate the scalability and accuracy of our approach on two distinct probabilistic kinematic models and four Kalman filter implementations.

An IOHMM-Based Framework to Investigate Drift in Effectiveness of IoT-Based Systems.

IoT-based systems, when interacting with the physical environment through actuators, are complex systems difficult to model. Formal verification techniques carried out at design-time being often ineffective in this context, these systems have to be quantitatively evaluated for effectiveness at run-time, i.e., for the extent to which they behave as expected. This evaluation is achieved by confronting a model of the effects they should legitimately produce in different contexts to those observed in the field. However, this quantitative evaluation is not informative on the drifts in effectiveness, it does not help designers investigate their possible causes, increasing the time needed to resolve them. To address this problem, and assuming that models of legitimate behavior can be described by means of Input-Output Hidden Markov Models (IOHMMs), a novel generic unsupervised clustering-based IOHMM structure and parameters learning algorithm is developed. This algorithm is first used to learn a model of legitimate behavior. Then, a model of the observed behavior is learned from observations gathered in the field. A second algorithm builds a dissimilarity graph that makes clear structural and parametric differences between both models, thus providing guidance to designers to help them investigate possible causes of drift in effectiveness. The approach is validated on a real world dataset collected in a smart home.

Accelerating hardware security verification and vulnerability detection through state space reduction

Model checking is an effective technique for formal verification of hardware security properties in order to detect security vulnerabilities. However, a major challenge lies in state space explosion. In this work, we propose methods to accelerate hardware security verification and vulnerability detection through state space reduction. Specifically, we reduce state space of formal model by performing value reduction and transition relation reduction. The control flow and data dependent graphs control the process of value reduction and transition relation reduction. In addition, we provide an approach that allows the automated mining of security properties from register-transfer-level hardware designs. Experimental results using Trust-HUB benchmarks have demonstrated that our proposed methods can significantly reduce the complexity of the formal model and thus the formal security verification time for hardware Trojan detection.

Fast Auto-Correction algorithm for Digital VLSI Circuits

Digital integrated circuits represent a driving force in the evolution of high-performance computing and communication required for the implementation of 5G technology. The architecturally demanding nature of scaling down to ever more compact device dimensions has resulted in an increase in logic gate densities up to billions per millimeter square. Given this evolving complexity, formal verification techniques in modern digital very-large-scale integration (VLSI) designs now face a tremendously challenging search space explosion problem. Despite advances in design debugging approaches utilizing CAD tools in order to provide clarified diagnostic descriptions of bug locations, there remains a significant lack of research efforts toward efficient automatic correction approaches following bug location detection. Here, we introduce an enhanced auto-correction algorithm for fixing logic bugs of type - gate replacement, extra and missing inverters. The primary endpoints of the enhanced algorithm are reductions of logic fixing time as well as size of the compulsory injected circuit for selection of optimal designs using SAT engines. Therefore, the proposed correction algorithm avoids the trade-off between high performance and full percentage of accuracy by gradually shrinking the search space without negatively impacting the quality of the rectified design. Our findings indicate that the proposed correction algorithm outperforms previously published tools in terms of average size of injected design to about 1.5x using ISCAS’85 and ISCAS’89 benchmarks. In addition, average speed of generation of rectified digital designs is increased to about 60.73x and 4x in comparison to two recent rectification mechanisms.

How to Formally Model Human in Collaborative Robotics

Human-robot collaboration (HRC) is an emerging trend of robotics that promotes the co-presence and cooperation of humans and robots in common workspaces. Physical vicinity and interaction between humans and robots, combined with the uncertainty of human behaviour, could lead to undesired situations where humans are injured. Thus, safety is a priority for HRC applications. Safety analysis via formal modelling and verification techniques could considerably avoid dangerous consequences, but only if the models of HRC systems are comprehensive and realistic, which requires reasonably realistic models of human behaviour. This paper explores state-of-the-art solutions for modelling human and discusses which ones are suitable for HRC scenarios.

Верификация знаний, полученных при изучении моделей бизнес-процессов

The paper focuses on the method of formal verification of knowledge obtained in the study of business process models. As a formal language for the presentation and verification of business processes, a certain version of π-calculus was chosen, and linear temporal modal logic was chosen as a language for formulating test assignments, i.e., questions, to be checked. The paper gives the rationale for such choice, and considers the principles of developing the test assignments in the language of modal logic and their usage for knowledge verification. The study proposes to automate knowledge testing with logic programs obtained as a result of the transition from a description of business processes to a verification program in the logical programming language Visual Prolog. The formal knowledge verification technique is illustrated by examples of knowledge verification. Findings of research show how the transition from the description of business processes to the procedures of formal verification of knowledge is carried out. The prospects for the development of the proposed method are discussed

WITHDRAWN: Dissemination of safety messages to vehicles and verification using model checking in VANETs

Abstract Model checking is one of the formal verification techniques which is widely used to validate and correct the design errors of communication protocols. Model checking uses algorithms to verify the correctness of the system. This paper presents a complete description of verification methodology of VANET communication protocols using SPIN model checker. Most of the VANET communication protocols use Road Side Units for transmitting safety/traffic related information to far away vehicles. This proposed system presents a verification system for checking the correctness and design errors of VANET communication protocols using model checker. Finally, the simulation and verification results are presented.

Using online verification to prevent autonomous vehicles from causing accidents

Ensuring that autonomous vehicles do not cause accidents remains a challenge. We present a formal verification technique for guaranteeing legal safety in arbitrary urban traffic situations. Legal safety means that autonomous vehicles never cause accidents although other traffic participants are allowed to perform any behaviour in accordance with traffic rules. Our technique serves as a safety layer for existing motion planning frameworks that provide intended trajectories for autonomous vehicles. We verify whether intended trajectories comply with legal safety and provide fallback solutions in safety-critical situations. The benefits of our verification technique are demonstrated in critical urban scenarios, which have been recorded in real traffic. The autonomous vehicle executed only safe trajectories, even when using an intended trajectory planner that was not aware of other traffic participants. Our results indicate that our online verification technique can drastically reduce the number of traffic accidents. Recent accidents with autonomous test vehicles have eroded trust in such self-driving cars. A shift in approach is required to ensure autonomous vehicles can never be the cause of accidents. An online verification technique is presented that guarantees provably safe motions, including fallback solutions in safety-critical situations, for any intended trajectory calculated by the underlying motion planner.

Formal Verification of Heuristic Autonomous Intersection Management Using Statistical Model Checking

Autonomous vehicles are gaining popularity throughout the world among researchers and consumers. However, their popularity has not yet reached the level where it is widely accepted as a fully developed technology as a large portion of the consumer base feels skeptical about it. Proving the correctness of this technology will help in establishing faith in it. That is easier said than done because of the fact that the formal verification techniques has not attained the level of development and application that it is ought to. In this work, we present Statistical Model Checking (SMC) as a possible solution for verifying the safety of autonomous systems and algorithms. We apply it on Heuristic Autonomous Intersection Management (HAIM) algorithm. The presented verification routine can be adopted for other conflict point based autonomous intersection management algorithms as well. Along with verifying the HAIM, we also demonstrate the modeling and verification applied at each stage of development to verify the inherent behavior of the algorithm. The HAIM scheme is formally modeled using a variant of the language of Timed Automata. The model consists of automata that encode the behavior of vehicles, intersection manager (IM) and collision checkers. To verify the complete nature of the heuristic and ensure correct modeling of the system, we model it in layers and verify each layer separately for their expected behavior. Along with that, we perform implementation verification and error injection testing to ensure faithful modeling of the system. Results show with high confidence the freedom from collisions of the intersection controlled by the HAIM algorithm.

Co-Simulation of Human-Robot Collaboration: from Temporal Logic to 3D Simulation

Human-Robot Collaboration (HRC) is rapidly replacing the traditional application of robotics in the manufacturing industry. Robots and human operators no longer have to perform their tasks in segregated areas and are capable of working in close vicinity and performing hybrid tasks -- performed partially by humans and by robots. We have presented a methodology in an earlier work [16] to promote and facilitate formally modeling HRC systems, which are notoriously safety-critical. Relying on temporal logic modeling capabilities and automated model checking tools, we built a framework to formally model HRC systems and verify the physical safety of human operator against ISO 10218-2 [10] standard. In order to make our proposed formal verification framework more appealing to safety engineers, whom are usually not very fond of formal modeling and verification techniques, we decided to couple our model checking approach with a 3D simulator that demonstrates the potential hazardous situations to the safety engineers in a more transparent way. This paper reports our co-simulation approach, using Morse simulator [4] and Zot model checker [14].

The CAS‐extended model

SummaryWait‐freedom guarantees that all processes complete their operations in a finite number of steps regardless of the delay of any process. Combinatorial topology has been proposed in the literature as a formal verification technique to prove the wait‐free computability of decision tasks. Wait‐freedom is proved through the properties of a static topological structure that expresses all possible combinations of execution paths of the protocol solving the decision task. The practical application of combinatorial topology as a formal verification technique is limited because the existing theory only considers protocols in which the manner of communication between processes is through read‐write memory. This research proposes an extension to the existing theory, called the CAS‐extended model. The extended theory includes Compare‐And‐Swap (CAS) and Load‐Link/Store‐Conditional (LL/SC), which are atomic primitives used to achieve wait‐freedom in state‐of‐the‐art protocols. The CAS‐extended model theory can be used to formally verify wait‐free algorithms used in practice, such as concurrent data structures. We present new definitions detailing the construction of a protocol complex in the CAS‐extended model. As a proof‐of‐concept, we formally verify a wait‐free queue with three processes using the CAS‐extended combinatorial topology.

Parameterized model checking of networks of timed automata with Boolean guards

Parameterized model checking is a formal verification technique for verifying that some specifications hold in systems consisting of many similar cooperating but indistinguishable processes. The problem is known to be undecidable in general, even when restricted to reachability properties. To overcome this limitation, several techniques have been explored to address specific system families, logical formulas or topologies of process networks. Some use the notion of cutoff, i.e. if a certain property is verified for systems up to a certain size (the cutoff) then it is verified for systems of any size. Here we analyze the case of networks consisting of an arbitrary number of timed automata that can synchronize by looking at which state the neighbors are currently. We show that cutoffs exist independently from the checked formula, with or without a distinguished process acting as controller. We show how, exploiting the cutoffs, we can obtain upper bounds on complexity of the parameterized model-checking problem. Finally, we show how to use the theoretical results in order to model and verify a distributed algorithm for clock synchronization based on gossip techniques.

A Decomposition Workflow for Integrated Circuit Verification and Validation

This paper reviews a developed integrated circuit (IC) decomposition workflow that can be leveraged for extracting design files and performing advanced verification and validation techniques on fabricated chips. In this work, a commercial 130-nm microcontroller is delayered and imaged to recreate the full design stack-up. Using MicroNet’s Pix2Net, the features for each layer are extracted allowing a GDSII file to be generated and design netlists for target components to be recovered. The full decomposition process is executed on both the read only memory (ROM) array and universal serial communications interface (USCI) of the microcontroller to recover the layout GDSII and circuit netlist. A single-precision floating point unit (FPU) test article is used to incorporate a spectrum of error types into the design layout, thus creating a set of test articles with obfuscated errors. Once the netlists for each of the modified designs are extracted, formal verification techniques are applied to each netlist, thus illuminating the errors originally inserted into the layout. The extracted netlists are then converted into register transfer level (RTL) representations and simulated with the original design verification testbench.

A Formal Model of a Partitioned Real-Time Operating System in Promela

Real-time partitioned operating systems meet the current avionics standard of reliable software; they are capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. Model-based Checking is a formal verification technique in which a software model is developed and then it is automatically checked for the compliance with formal requirements. This method allows proving the correct operation of the model on all possible input data, all possible ways of processes switching and interactions. In this article, we describe a formalized model of an open-source partitioned operating system POK. We implement the model in Promela language for SPIN tool with the purposes of formal verification using the Model Checking method. The model is designed to describe the behavior of: partition and process schedulers, system calls through a software interrupt, kernel libraries for working with synchronization primitives and processes awaiting, user code which consists of several processes in different partitions that are synchronized through a semaphore. The described approach can be used to verify the correct synchronization, the proper operation of the scheduler algorithms, and the accurate data access from different partitions by introducing the corresponding requirements in the form of formulas of the linear-time temporal logic.

Symmetry Breaking in Model Checking of Fault-Tolerant Nuclear Instrumentation and Control Systems

One of the approaches to assure reliability of nuclear instrumentation and control (I&C) systems is model checking, a formal verification technique. Model checking is computationally demanding, but nuclear I&C systems have certain properties that simplify the verification problem. The most notable of these properties are redundancy (duplication of certain system parts in several divisions) and symmetry, which are the means of ensuring failure tolerance. In this work, we extend our previous method of model checking failure tolerance of nuclear I&C systems by proposing an automated symmetry breaking approach that utilizes these properties to simplify the verification problem. As a result, fewer failure combinations need to be checked. We evaluate this approach on a case study that encompasses three safety functions allocated to four I&C systems in the same I&C model.

A Formal Model of a Partitioned Real-Time Operating System in Promela

Real-time partitioned operating systems meet the current avionics standard of reliable software; they are capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. Model-based Checking is a formal verification technique in which a software model is developed and then it is automatically checked for the compliance with formal requirements. This method allows proving the correct operation of the model on all possible input data, all possible ways of processes switching and interactions. In this article, we describe a formalized model of an open-source partitioned operating system POK. We implement the model in Promela language for SPIN tool with the purposes of formal verification using the Model Checking method. The model is designed to describe the behavior of: partition and process schedulers, system calls through a software interrupt, kernel libraries for working with synchronization primitives and processes awaiting, user code which consists of several processes in different partitions that are synchronized through a semaphore. The described approach can be used to verify the correct synchronization, the proper operation of the scheduler algorithms, and the accurate data access from different partitions by introducing the corresponding requirements in the form of formulas of the linear-time temporal logic.

A Systematic Mapping Study on Software Quality Control Techniques for Assessing Privacy in Information Systems

Software Quality Control (SQC) techniques are widely used throughout the software development process with the objective of assessing and detecting anomalies that affect the quality of an information system. Privacy is one quality attribute of software systems for which several SQC techniques have been proposed in recent years. However, research has been carried out from different perspectives and, consequently, it has led to a growing body of knowledge scattered across different domains. To bridge this gap, we have carried out a systematic mapping study to provide practitioners and researchers with an overview of the state-of-the-art techniques to carry out software quality control of information systems focusing on aspects of privacy. Our results show a steady growth in the research efforts in this field. The European General Data Protection Regulation seems to have a significant influence on this growth, since 37% of techniques that focus on assessing compliance derive their assessment criteria from this legal framework. The maturity of the techniques varies between the type of technique: Formal verification techniques exhibit the lowest level of maturity while the combination of techniques has demonstrated its successful application in real-world scenarios. The latter seems a promising avenue of research as it provides better results in terms of coverage, precision and effectiveness than the application of individual, isolated techniques. In this paper, we describe the existing SQC techniques focusing on privacy and provide a suitable basis for identifying future research directions.