Formal Verification Techniques Research Articles

Formalizing and appling compliance patterns for business process compliance

Today's enterprises demand a high degree of compliance of business processes to meet diverse regulations and legislations. Several industrial studies have shown that compliance management is a daunting task, and organizations are still struggling and spending billions of dollars annually to ensure and prove their compliance. In this paper, we introduce a comprehensive compliance management framework with a main focus on design-time compliance management as a first step towards a preventive lifetime compliance support. The framework enables the automation of compliance-related activities that are amenable to automation, and therefore can significantly reduce the expenditures spent on compliance. It can help experts to carry out their work more efficiently, cut the time spent on tedious manual activities, and reduce potential human errors. An evident candidate compliance activity for automation is the compliance checking, which can be achieved by utilizing formal reasoning and verification techniques. However, formal languages are well known of their complexity as only versed users in mathematical theories and formal logics are able to use and understand them. However, this is generally not the case with business and compliance practitioners. Therefore, in the heart of the compliance management framework, we introduce the Compliance Request Language (CRL), which is formally grounded on temporal logic and enables the abstract pattern-based specification of compliance requirements. CRL constitutes a series of compliance patterns that spans three structural facets of business processes; control flow, employed resources and temporal perspectives. Furthermore, CRL supports the specification of compensations and non-monotonic requirements, which permit the relaxation of some compliance requirements to handle exceptional situations. An integrated tool suite has been developed as an instantiation artefact, and the validation of the approach is undertaken in several directions, which includes internal validity, controlled experiments, and functional testing.

Bringing Automated Model Checking to PLC Program Development — A CERN Case Study —

Verification of critical software is a high priority but a challenging task for industrial control systems. Model checking appears to be an appropriate approach for this purpose. However, this technique is not widely used in industry yet, due to some obstacles. The main obstacles encountered when trying to apply formal verification techniques at industrial installations are the difficulty of creating models out of PLC programs and defining formally the specification requirements. In addition, models produced out of real-life programs have a huge state space, thus preventing the verification due to performance issues. Our work at CERN (European Organization for Nuclear Research) focuses on developing efficient automatic verification methods for industrial critical installations based on PLC (Programmable Logic Controller) control systems.In this paper, we present a tool generating automatically formal models out of PLC code. The tool implements a general methodology which can support several input languages, like the PLC programming languages defined in the IEC 61131 standard, as well as the model formalisms of different model checker tools. The tool supports the three main stages of model checking: system modelization, requirement formalization and counterexample analysis. In addition, a verification case study of a PLC program, written in Structured Text (ST) language implemented at CERN is described. The paper shows that the verification process is automatized and supported by the proposed tool, thus its difficulty is completely hidden for the control engineer.

Predicting and Retrodicting Fate Patterns in C. elegans Vulval Development using Logic Programming

Vulval development in C. elegans is a paradigm for understanding how cell fate determination leads to organogenesis. The fate pattern of a row of six cells is specified by spatial and temporal controls, and the competition of the LET-23/SEM-5/LET-60/MAPK and Delta/Notch signalling pathways. Formal verification techniques applied to state models of vulval development have been shown as a powerful approach for demonstrating how the signalling systems interact and determine cell fate. However, the computational requirements of verification approaches become prohibitive as model complexity increases. Here we apply a logic programming based approached to derive minimal models of vulval development, increasing the speed of prediction of fate pattern from genotype by up to four orders of magnitude. This increase in speed further allows us to infer or ‘retrodict’ genotypes from the final fate pattern. We apply this new technique to understand how highly variable cell fates arises when the precise morphogen gradient of LIN-3 is effectively randomised by diffusion in dig-1 mutations. We further apply this to the study of let-23 mosaic mutations, and find that the resulting model refinements reconcile our approach with historical experimental data. Based our new findings we propose that logic programming provides an efficient approach for design and analysis of experimental data.

Safe design method of embedded control systems. Case study

Resume— This paper proposes an approach for safe design of hardware embedded control systems. The approach is based on a combination of formal verification and discrete controller synthesis techniques. Formal verification is solicited to detect design errors and provide counterexamples, while the Discrete Controller Synthesis technique is used to correct those error since it attempts to enforce previously verified specifications which do not hold. It automatically produces control code, which is assembled to the erroneous component in order to provide a system correct by construction with respect to the specification to enforce. We illustrate the approach on a train controller subsystem taken from Bombardier Transport company. Mots-cles— COTS, Verification formelle, synthese du controleur discret, systeme a evenements discrets, composant correct par conception.

On requirement verification for evolving Statecharts specifications

Software development processes have been evolving from rigid, pre-specified, and sequential to incremental, and iterative. This evolution has been dictated by the need to accommodate evolving user requirements and reduce the delay between design decision and feedback from users. Formal verification techniques, however, have largely ignored this evolution and even when they made enormous improvements and found significant uses in practice, like in the case of model checking, they remained confined into the niches of safety-critical systems. Model checking verifies if a system's model $$\mathcal{M}$$ M satisfies a set of requirements, formalized as a set of logic properties $$\Phi$$ ? . Current model-checking approaches, however, implicitly rely on the assumption that both the complete model $$\mathcal{M}$$ M and the whole set of properties $$\Phi$$ ? are fully specified when verification takes place. Very often, however, $$\mathcal{M}$$ M is subject to change because its development is iterative and its definition evolves through stages of incompleteness, where alternative design decisions are explored, typically to evaluate some quality trade-offs. Evolving systems specifications of this kind ask for novel verification approaches that tolerate incompleteness and support incremental analysis of alternative designs for certain functionalities. This is exactly the focus of this paper, which develops an incremental model-checking approach for evolving Statecharts. Statecharts have been chosen both because they are increasingly used in practice natively support model refinements.

A formal model for embedded brain reading

Purpose – The presented work contributes to research in the field of advanced man-machine interaction and to research in the field of formalisation and verification of complex systems. This work was motivated by the need to provide a detailed and well understandable formal description of embedded brain reading (eBR). The paper aims to discuss these issues. Design/methodology/approach – The paper first introduces eBR and points out its main features. Next, a general model for eBR is developed to describe the overall architecture, integral parts and dependencies between those parts. The model is developed and presented in a formal structured form that allows for application of optimisation as well as verification techniques. Findings – The paper demonstrates using implementations that the application of the formal model allows to check for completeness and correctness to detect errors in implementation, which were invisible without formalising eBR. In summary, the presented work contributes a formal model for a complex system and shows that such a formal model can improve the overall system's functionality. Research limitations/implications – For future work, the results support the application of formal modelling and verification techniques at the system level and the development of methods to prove for correctness and completeness of complex systems during their development. Originality/value – The paper describes for the first time eBR and presents a formal model for it. It illustrates how an error-prone approach like BR can be applied safely by embedding it into the control of a real system and by applying mechanisms that control for its correct function.

Formal Verification of Analog and Mixed Signal Designs Using SPICE Circuit Simulation Traces

Analog and Mixed Signal (AMS) designs can be formally modeled as hybrid systems [45] and therefore formal verification techniques applicable to hybrid systems can be deployed to verify them. An extension to a formal verification approach applicable to hybrid systems is proposed to verify AMS designs [31]. In this approach formal verification (FV) is carried out on an AMS block using simulation traces from SPICE, a simulator widely used in the design and verification of analog and AMS blocks. A broader implication of this approach is the ability to carry out hierarchical verification using relevant simulation traces obtained at different abstraction levels of a design when modeled in appropriate platforms. This enables a seamless transition of design and verification artifacts from the highest level of abstraction to the lowest level of implementation at the transistor level of any AMS design and a resulting increase in confidence on the correctness of the final implementation. The proposed approach has been justified with its applications to different AMS design blocks. For each design, its formal model and the proposed computational techniques have been incorporated into CheckMate [11] - a FV tool for hybrid systems based on MATLAB and the Simulink/Stateflow framework from MathWorks. A further justification of the proposed approach is the resulting improvements observed in terms of reduced verification time for different specifications in each design.

Abstract B134: Computational analysis of the signaling pathways in the tumor microenvironment

Abstract Tumor microenvironment and angiogenesis are two important factors contributing to the cancer development and drug resistance, which presents a challenge to the cancer treatment. Recent cancer studies found the bidirectional interaction between cancer cells and stellate cells is of importance in the tumor microenvironment, which can stimulate the synthesis and secretion of growth factors and cytokines, promote the growth of surrounding cancer cells through paracrine pathways. Since the pathways implicated in the tumor microenvironment are complicated and highly interconnected, it is not realistic to use traditional computational techniques, for example, ordinary differential equation and stochastic simulation algorithm, to analyze such a large network in a fast and effective way. Given a large crosstalk model of signaling pathways, one of systems biologist's interests is to discover and identify the key cellular components and signal transduction sequences that will drive the system to a pre-specified state (e.g., apoptosis, proliferation or angiogenesis) at a specific time point. To systematically investigate the interaction in the tumor microenvironment, we have constructed an in silico discrete value model of multicellular signaling pathways to describe the expression levels of different signaling components and dynamics of different signaling pathways without introducing any unknown parameters in the biochemical reactions. The frequently mutated pathways in our tumor microenvironment model include the pathways of Hedgehog, Wnt, Rb-E2F, P53, RAS, PI3K, VEGF, etc. Model Checking is a powerful formal verification technique, which has been successfully applied for the verification of hardware system and digital circuits. The Model Checking algorithm can automatically and exhaustively search the state transition system (up to 10 to the power of 100 possible states) to determine, whether or not, a given model M satisfies a desired temporal logic formula Φ. We, then, applied the Symbolic Model Checking, to automatically analyze the cell's proliferation, angiogenesis and apoptosis in the proposed model. Our studies predicted several important temporal logic properties and dynamic behaviors (oscillation phenomenon) in the tumor microenvironment that can be checked in the future experiments. The verification technique identified several signaling components, including the RAS, AKT, DVL, PTEN, etc, whose mutation or loss of function can promote cell growth and inhibit apoptosis (programmed cell death), some of which have been confirmed by existing experiments. With the help of Model Checking, our work provides a comprehensive understanding of the signaling networks and their crosstalk in the tumor microenvironment which might help cancer researchers to develop effective multi-gene targeted therapies for the cancer patients. Citation Format: Haijun Gong. Computational analysis of the signaling pathways in the tumor microenvironment. [abstract]. In: Proceedings of the AACR Special Conference on Advances in Breast Cancer Research: Genetics, Biology, and Clinical Applications; Oct 3-6, 2013; San Diego, CA. Philadelphia (PA): AACR; Mol Cancer Res 2013;11(10 Suppl):Abstract nr B134.

Improving the Trustworthiness of Medical Device Software with Formal Verification Methods

Wearable and implantable medical devices are commonly used for diagnosing, monitoring, and treating various medical conditions. Increasingly complex software and wireless connectivity have enabled great improvements in the quality of care and convenience for users of such devices. However, an unfortunate side-effect of these trends has been the emergence of security concerns. In this letter, we propose the use of formal verification techniques to verify temporal safety properties and improve the trustworthiness of medical device software. We demonstrate how to bridge the gap between traditional formal verification and the needs of medical device software. We apply the proposed approach to cardiac pacemaker software and demonstrate its ability to detect a range of software vulnerabilities that compromise security and safety.

A loop acceleration technique to speed up verification of automatically generated plans

The CIRCA planning system automatically creates reactive plans and uses formal verification techniques to prove that those plans will preserve system safety. CIRCA's timed automata verification system is highly efficient, yet can display pathologically bad behavior when reasoning about reaction loops, a particular form of interacting cycles of states. In this paper, we describe a loop acceleration technique that recognizes these state-space structures during the verification process and bypasses the process of expanding an arbitrarily large cycle of states, effectively compressing loops of arbitrary size into a compact, finite set of states. The resulting performance improvement can be very dramatic: in domains where tight loops of short-duration transitions interact with long-duration transitions, our new loop acceleration methods can reduce verification time (and hence planning time) from hours to below a second.

A feedback technique for unsatisfiable UML/OCL class diagrams

SUMMARYIn Model‐Driven Development (MDD), detection of model defects is necessary for correct model transformations. Formal verification tools and techniques can to some extent verify models. However, scalability is a serious issue in relation to verification of complex UML/OCL class diagrams. We have proposed a model slicing technique that slices the original model into submodels to address the scalability issue. A submodel can be detected as unsatisfiable if there are no valid values for one or more attributes of an object in the diagram or if the submodel provides inconsistent conditions on the number of objects of a given type. In this paper, we propose a novel feedback technique through model slicing that detects unsatisfiable submodels and their integrity constraints among the complex hierarchy of an entire UML/OCL class diagram. The software developers can therefore focus their revision efforts on the incorrect submodels while ignoring the rest of the model. Copyright © 2013 John Wiley & Sons, Ltd.

A bit too precise? Verification of quantized digital filters

Fixed-point digital filters are simple yet ubiquitous components of a wide variety of digital processing and control systems. Common errors in fixed-point filters include arithmetic round-off (truncation) errors, overflows and the presence of limit cycles. These errors can potentially compromise the correctness of the system as a whole. Traditionally, digital filters have been verified using a combination of design techniques from control theory and extensive testing. In this paper, we examine the use of formal verification techniques as part of the design flow for fixed-point digital filters. We study two classes of verification techniques involving bit-precise analysis and real-valued error approximations, respectively. We empirically evaluate several variants of these two fundamental approaches for verifying fixed-point implementations of digital filters. We design our comparison to reveal the best possible approach towards verifying real-world designs of infinite impulse response (IIR) digital filters. Our study compares the strengths and weaknesses of different verification techniques for digital filters and suggests efficient approaches using modern satisfiability-modulo-theories solvers (SMT) and hardware model checkers. This manuscript extends our previous work evaluating bounded verification, where a limited number of iterations of the system are explored, with unbounded verification, where an unlimited number of iterations of the system are considered. Doing so allows us to evaluate techniques that can prove the correctness of fixed-point digital filter implementations.

Testing or Formal Verification: DO-178C Alternatives and Industrial Experience

for commercial aircraft is subject to the stringent certification processes described in the DO-178B standard, Software Considerations in Airborne Systems and Equipment Certification. Issued in 1992, this document focuses strongly on the verification process, with a major emphasis on testing. In 2005, the avionics industry initiated an effort to update DO-178B, in large part to accommodate development practices (including formal verification techniques) that had matured since its publication. A revised standard, DO-178C, was issued in late 2011, incorporating new guidance that allows formal verification to replace certain forms of testing. In this article, the authors describe some of the new objectives and activities in the area of formal methods, explain how these methods may be used instead of testing in a DO-178C context, and summarize the practical experience of Dassault-Aviation and Airbus in successfully applying the new DO-178C approach. The first Web extra at http://youtu.be/tRtK4xOK-8o is part 1 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The second Web extra at http://youtu.be/BVI5J1GAQ30 is part 2 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The third Web extra at http://youtu.be/U3G1ZOoqg78 is part 3 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The fourth Web extra at http://youtu.be/WtlqS-JOHrA is part 4 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C.

Feature-interaction detection based on feature-based specifications

Formal specification and verification techniques have been used successfully to detect feature interactions. We investigate whether feature-based specifications can be used for this task. Feature-based specifications are a special class of specifications that aim at modularity in open-world, feature-oriented systems. The question we address is whether modularity of specifications impairs the ability to detect feature interactions, which cut across feature boundaries. In an exploratory study on 10 feature-oriented systems, we found that the majority of feature interactions could be detected based on feature-based specifications, but some specifications have not been modularized properly and require undesirable workarounds to modularization. Based on the study, we discuss the merits and limitations of feature-based specifications, as well as open issues and perspectives. A goal that underlies our work is to raise awareness of the importance and challenges of feature-based specification.

CONDITIONED SLICING FOR EFFICIENT MULTIWAY DECISION GRAPHS MODEL-CHECKER

Integrating formal verification techniques into the hardware design process provides the means to rigorously prove critical properties. However, most automatic verification techniques, such as model checking, are only effectively applicable to designs of limited sizes due to the state explosion problem. The Multiway Decision Graphs (MDG) method is an efficient method to define hardware designs into more abstract environments; however, the MDG model checker (MDG-MC) still suffers from the state explosion problem. Furthermore, all the backward reduction algorithms cannot be used in MDG, due to the presence of abstract state variables. In this study, an efficient extractor for MDG Hardware Descrpiton Languge (MDG-HDL) is introduced based on static (SS-MDG) and conditioned (CS-MDG) program slicing techniques. The techniques can obtain a chaining slice for given signals of interest. The main advantages of these techniques are: It has no MDG-HDL coding style limitation, it is accurate and it is competent in dealing with various MDG-HDL constructions. The main motivation for introducing this approach is to tackle the state explosion problem of MDG-MC that big MDG-HDL may cause. We apply our proposed techniques on different MDG-HDL designs and our analyses have shown that the proposed reduction techniques resulted in significantly improved performance of the MDG-MC. In this study, we present a general idea of program slicing, a discussion of how to slice MDG-HDL programs, implementation of the tool and a brief overview of some applications and experimental results. The underlying method and the tool based on it need to be empirically evaluated when applying to various applications.

A distributed design of a network recovery algorithm

The increase in design complexity emphasises the relevance of formal verification techniques for both software and hardware. Formal methods with their mathematical-based modelling can provide proofs of various properties for the designs, thus ensuring a certain degree of complexity control and enhancing the system confidence. There are numerous formal modelling and verification techniques employed in designing complex systems. Typically, they either prove or disprove the correctness of the particular specifications of a system’s algorithms with respect to certain initial requirements. The Event-B formal method has been recently extended to address the gap between specification and implementation, via the so-called modularisation extension. In this paper, we present a modularisation-based derivation of a distributed design for a network recovery algorithm, based on the refinement technique of Event-B. We thus contribute to enhancing the reliability and availability of network designs.

Analysis of intercellular signal transduction in the tumor microenvironment

BackgroundRecent cancer studies revealed, the interaction between pancreatic cancer cells and pancreatic stellate cells is of importance in the cancer progression. The activation of stellate cells is mediated by some growth factors and cytokines secreted by the cancer cells. In turn, the activated stellate cells will synthesize and secrete multiple growth factors to continuously stimulate the growth of surrounding cancer cells through paracrine pathways. The mechanism behind the evolution of stellate cells from quiescent state to a cancer-associated phenotype is still not well understood.ResultsTo systematically investigate the interaction between cancer cells and stellate cells, we constructed a multicellular discrete value model, which is composed of several intracellular and intercellular signaling pathways that are frequently mutated in the pancreatic cancer, to study the cell cycle progression and angiogenesis. We, then, introduced and applied a formal verification technique, Symbolic Model Checking, to automatically analyze the cells' proliferation, angiogenesis and apoptosis in the proposed signal transduction model of tumor microenvironment.ConclusionsOur studies predicted some important temporal logic properties and dynamic behaviors in the pancreatic cancer cells and stellate cells. The verification technique identified several signaling components, including the RAS, RAGE, AKT, IKK, DVL, RB and PTEN, whose mutation or loss of function can promote cell growth and inhibit apoptosis, some of which have been confirmed by existing experiments. Our formal studies demonstrated that, the bidirectional interaction between cancer cells and stellate cells could significantly increase cell proliferation, inhibit apoptosis, induce tumor angiogenesis, and promote cancer metastasis.

Bisimulation for Quantum Processes

Quantum cryptographic systems have been commercially available, with a striking advantage over classical systems that their security and ability to detect the presence of eavesdropping are provable based on the principles of quantum mechanics. On the other hand, quantum protocol designers may commit more faults than classical protocol designers since human intuition is poorly adapted to the quantum world. To offer formal techniques for modeling and verification of quantum protocols, several quantum extensions of process algebra have been proposed. An important issue in quantum process algebra is to discover a quantum generalization of bisimulation preserved by various process constructs, in particular, parallel composition, where one of the major differences between classical and quantum systems, namely quantum entanglement, is present. Quite a few versions of bisimulation have been defined for quantum processes in the literature, but in the best case they are only proved to be preserved by parallel composition of purely quantum processes where no classical communication is involved. Many quantum cryptographic protocols, however, employ the LOCC (Local Operations and Classical Communication) scheme, where classical communication must be explicitly specified. So, a notion of bisimulation preserved by parallel composition in the circumstance of both classical and quantum communication is crucial for process algebra approach to verification of quantum cryptographic protocols. In this article we introduce novel notions of strong bisimulation and weak bisimulation for quantum processes, and prove that they are congruent with respect to various process algebra combinators including parallel composition even when both classical and quantum communication are present. We also establish some basic algebraic laws for these bisimulations. In particular, we show the uniqueness of the solutions to recursive equations of quantum processes, which proves useful in verifying complex quantum protocols. To capture the idea that a quantum process approximately implements its specification, and provide techniques and tools for approximate reasoning, a quantified version of strong bisimulation, which defines for each pair of quantum processes a bisimulation-based distance characterizing the extent to which they are strongly bisimilar, is also introduced.

High Performance Static Analysis for Industry

Static source code analysis for software bug detection has come a long way since its early beginnings as a compiler technology. However, with the introduction of more sophisticated algorithmic techniques, such as model checking and constraint solving, questions about performance are a major concern. In this work we present an empirical study of our industrial strength source code analysis tool Goanna that uses a model checking core for static analysis of C/C++ code. We present the core technology and abstraction mechanism with a focus on performance, as guided by experience from having analyzed millions of lines of code. In particular, we present results from our recent study within the NIST/DHS SAMATE program. The results show that, maybe surprisingly, formal verification techniques can be used successfully in practical industry applications scaling roughly linearly, even for millions of lines of code.

Formal Verification and Debugging of Precise Interrupts on High Performance Microprocessors

The increased parallelism provided by Out-Of-Order (OOO) and superscalar mechanisms have made the control portion of advanced processors more complicated so that the state-of-the-art formal verification techniques for Register-Transfer-Level (RTL) and gate-level designs cannot scale to the complexity of such complicated processors. Moreover, verification and debugging of exceptions and external interrupts on such processors are nontrivial tasks. Because the exceptions arrival time, the external interrupt arrival time, as well as the microprocessor response time must be precise, verification and debugging require sophisticated hardware and software capabilities. This article proposes techniques for effective verification and debugging of cycle-accurate OOO processors in the event of exceptions and external interrupts. The results show that our techniques reduce the complexity of the verification and debugging processes by reducing the number of simulation cycles (3.3 × average reduction) and the number of state variables (8.7 × average reduction) to be traced for localizing bugs.