Formal Verification Methods Research Articles

Improving Graph-based methods for computing qualitative properties of markov decision processes

<span>Probabilistic model checking is a formal verification method, which is used to guarantee the correctness of the computer systems with stochastic behaviors. Reachability probabilities are the main class of properties that are proposed in probabilistic model checking. Some graph-based pre-computation can determine those states for which the reachability probability is exactly zero or one. Iterative numerical methods are used to compute the reachability probabilities for the remaining states. In this paper, we focus on the graph-based pre-computations and propose a heuristic to improve the performance of these pre-computations. The proposed heuristic approximates the set of states that are computed in the standard pre-computation methods. The experiments show that the proposed heuristic can compute a main part of the expected states, while reduces the running time by several orders of magnitude.</span>

A Formal Verification Framework for Security Issues of Blockchain Smart Contracts

Blockchain technology has attracted more and more attention from academia and industry recently. Ethereum, which uses blockchain technology, is a distributed computing platform and operating system. Smart contracts are small programs deployed to the Ethereum blockchain for execution. Errors in smart contracts will lead to huge losses. Formal verification can provide a reliable guarantee for the security of blockchain smart contracts. In this paper, the formal method is applied to inspect the security issues of smart contracts. We summarize five kinds of security issues in smart contracts and present formal verification methods for these issues, thus establishing a formal verification framework that can effectively verify the security vulnerabilities of smart contracts. Furthermore, we present a complete formal verification of the Binance Coin (BNB) contract. It shows how to formally verify the above security issues based on the formal verification framework in a specific smart contract. All the proofs are checked formally using the Coq proof assistant in which contract model and specification are formalized. The formal work of this paper has a variety of essential applications, such as the verification of blockchain smart contracts, program verification, and the formal establishment of mathematical and computer theoretical foundations.

Analysis of existing parallel programs verification technologies

The past few decades have seen large fluctuations in the perceived value of parallel computing. At times, parallel computation has optimistically been viewed as the solution to all of our computational limitations. The conventional division of verification methods is analyzed. It is concluded that synthetic methods of software verification can be considered as the most relevant, most useful and productive ones. It is noted that the implementation of the methods of formal verification of software of computer systems, which supplement the traditional methods of testing and debugging, and make it possible to improve the uptime and security of programs, is relevant. Methods of computer systems software formal verification can guarantee the check that verified properties are performed by system model. Nowadays, these methods are actively being developed in the direction of reducing the formal verification total cost, support of modern programming concepts and minimization of "manual" work in the transition from the system model to its implementation. Their main feature is an ability to search for errors using mathematical model, without recourse to existing realization of software. It is very convenient and economical. There are several specific techniques used for formal models analysis, such as deductive analysis, model and consistence check. Every verification method is been used in particular cases, depending on the goal. Synthetic methods of software verification are considered the most actual, useful and efficient, as they somehow try to combine the advantages of different verification approaches, getting rid of their drawbacks. Currently, there has been made significant progress in the development of such methods and their implementation in the practice of industrial software development.

A Formal Method for Service Choreography Verification based on Description Logic

A Formal Method for Service Choreography Verification based on Description Logic

Мониторинг и тестирование на основе многоуровневых спецификаций программ

Research on formal methods of software development and verification focuses on building specifications using incremental and iterative development methodologies. The presence of several levels of specifications simplifies proving of properties, since it is possible to reuse the proofs that were performed for more abstract layers of the model. It is desirable to use the same models that were used for formal verification also in testing of real systems for compliance with the requirements set by these models. In practice, large software systems are described by multi-level models. There was no experience of using such models as the basis for testing and monitoring. The paper discusses various methods for developing multi-level models, new opportunities that can be obtained through a combination of functional specifications and implementation-level refinements, limitations that must be considered during testing and monitoring of real systems for compliance with multi-level models.

A Hybrid Service Selection and Composition Model for Cloud-Edge Computing in the Internet of Things

Cloud-edge computing is a hybrid model of computing where resources and services provided via the Internet of Things (IoT) between large-scale and long-term data informs of the cloud layer and small-scale and short-term data as edge layer. The main challenge of the cloud service providers is to select the optimal candidate services that are doing the same work but offer different Quality of Service (QoS) values in IoT applications. Service composition in cloud-edge computing is an NP-hard problem; therefore, many meta-heuristic methods introduced to solve this issue. Also, the correctness of meta-heuristic and machine learning algorithms for evaluating service composition problem should be proven using formal methods to guarantee functional and non-functional specifications. In this paper, a hybrid Artificial Neural Network-based Particle Swarm Optimization (ANN-PSO) Algorithm presented to enhance the QoS factors in cloud-edge computing. To illustrate the correctness and improve the reachability rate of candidate composited services and QoS factors for the proposed hybrid algorithm, we present a formal verification method based on a labeled transition system to check some critical Linear Temporal Logics (LTL) formulas. The experimental results illustrated the high performance of the proposed model in terms of minimum verification time, memory consumption, and guaranteeing critical specifications rules as the Linear Temporal Logic (LTL) formulas. Also, we observed that the proposed model has optimal response time, availability, and price with maximum fitness function value than other service composition algorithms.

RISC-V微控制器形式化方法研究

RISC-V微控制器形式化方法研究

Operational Semantics of Annotated Reflex Programs

Reflex is a process-oriented language that provides a design of easy-to-maintain control software for programmable logic controllers. The language has been successfully used in a several reliability critical control systems, e. g. control software for a silicon single crystal growth furnace and electronic equipment control system. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents the formal operational semantics of Reflex programs extended by annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief overview of the Reflex language is given and a simple example of its use – a control program for a hand dryer – is provided. The concepts of environment and variables shared with the environment are defined that allows to disengage from specific input/output ports. Types of annotations that specify restrictions on the values of the variables at program launch, restrictions on the environment (in particular, on the control object), invariants of the control cycle, pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert and havoc. The operational semantics of the annotated Reflex programs uses the global clock as well as the local clocks of separate processes, the time of which is measured in the number of iterations of the control cycle, to simulate time constraints on the execution of processes at certain states. It stores a complete history of changes of the values of shared variables for a more precise description of the time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of process transition management from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors, transforming an annotated Reflex program to an annotated program in a very limited subset of the C language, by reducing a complex proof of preserving the truth of program requirements during the transformation to a simpler proof of equivalence of the original and the resulting annotated programs with respect to their operational semantics.

Methods for Domain Specification of Verification-Oriented Process Ontology

User-friendly formal specifications and verification of parallel and distributed systems from various subject fields, such as automatic control, telecommunications, business processes, are active research topics due to its practical significance. In this paper, we present methods for the development of verification-oriented domain-specific process ontologies which are used to describe parallel and distributed systems of subject fields. One of the advantages of such ontologies is their formal semantics which make possible formal verification of the described systems. Our method is based on the abstract verification-oriented process ontology. We use two methods of specialization of the abstract process ontology. The declarative method uses the specialization of the classes of the original ontology, introduction of new declarative classes, as well as use of new axioms system, which restrict the classes and relations of the abstract ontology. The constructive method uses semantic markup and pattern matching techniques to link sublect fields with classes of the abstract process ontology. We provide detailed ontological specifications for these techniques. Our methods preserve the formal semantics of the original process ontology and, therefore, the possibility of applying formal verification methods to the specialized process ontologies. We show that the constructive method is a refinement of the declarative method. The construction of ontology of the typical elements of automatic control systems illustrates our methods: we develop a declarative description of the classes and restrictions for the specialized ontology in the Prot´eg´e system in the OWL language using the deriving rules written in the SWRL language and we construct the system of semantic markup templates which implements typical elements of automatic control systems.

Integrating runtime validation and hardware-in-the-loop (HiL) testing with V & V in complex hybrid systems

This study addresses the problem of assuring provably safe and correct behaviour of safety-critical complex hybrid systems (CHS) throughout their life-cycles when physical system dynamics tend to change due to natural causes. Model-based development methods are needed that integrate formal specification, verification, implementation level testing and runtime validation. Scalability limitations of available algorithms/methods dictate a modular approach, but this poses conflicting issues of compositionality, falsetransitivity, soundness and completeness. In this paper a compositional solution approach based on the decomposition and hybridisation of statechart models (into hybrid automata - HA) is demonstrated. Specifically, a compositional formal verification methodology developed earlier for discrete event dynamic systems (DEDS) was elevated to hybrid dynamics, successfully overcoming the risk of false transitivity common to direct abstraction methods of continuous state-space. It was then used to develop a scalable strategy to generate sound and complete (relative to coverage criteria) tests, and configure corresponding compositional HiL tests for different abstraction and functional levels. The same decomposition was used to derive compositional runtime validation tests based on discrete invariants and differential invariants. The study formally proves that (1) the proposed HA based formal verification method is compositional, sound and complete relative to first-order logic of differential equations, (2) the modular tests are compositional and (3) the HA based test generation method is compositional, sound and complete relative to first-order logic of differential equations. To reduce complexity compositionality is rendered parallel than sequential to perform the simpler tasks concurrently. The claims have been validated experimentally on a full scale experimental rig.

A scalable model for real‐time venue recommendations using MapReduce

SummaryThe popular social networks such as Facebook, Twitter, and Foursquare closely monitor user activities to recommend different services and events. Among others, venue recommendation proposes users the most appropriates venues based on the user preferences. It offers facility to the user to mark the check‐ins when a venue is visited. The traditional venue recommendation systems have opted collaborative filtering to propose recommendations. However, collaborative filtering overlooked certain critical issues, including real‐time recommendations, cold start, and scalability, for venue recommendations. Moreover, real‐time physical factors such as distance from the venue are also not considered in traditional venue recommendation systems. Furthermore, parsing and processing of huge volume of unstructured data is the main challenge for conventional recommender systems, particularly when dealing with real‐time recommendations. For efficient scaling, significant computational and storage resources for recommendation systems are desired. This article proposes a Real‐Time Venue Recommendation (RTVR) model that utilizes cloud‐based MapReduce framework to process, compare, mine, and manage large data sets for generating recommendations. The results showed that the proposed model has improved accuracy for real‐time recommendations. The proposed RTVR is more scalable as it exploits a cloud‐based architecture. Moreover, the proposed techniques are verified using formal verification methods.

Formal modeling and verification of a service composition approach in the social customer relationship management system

Purpose The purpose of this paper is to present a formal verification method to prove the correctness of social customer relationship management (CRM)-based service composition approach. The correctness of the proposed approach is analyzed to evaluate the customer behavioral interactions for discovering, selecting and composing social CRM-based services. In addition, a Kripke structure-based verification method is presented for verifying the behavioral models of the proposed approach. Design/methodology/approach Evaluating the customer behavioral interactions using the social CRM-based service composition approach is an important issue. In addition, formal verification has an important role in assessing the social CRM-based service composition. However, model checking can be efficient as a verification method to evaluate the functional properties of the social CRM-based service composition approach. Findings The results of model checking satisfied the logical problems in the proposed behavior model analysis. In the statistical testing, the proposed URM mechanism supported the four knowledge creation process conditions. It was also shown that the percentage of state reachability in the URM with KCP conditions is higher than the URM mechanism without supporting KCP conditions. Originality/value The comparison of time and memory consumption of the model checking method shows that the social CRM-based service composition approach covers knowledge process features, which makes it an efficient method.

Verification-Oriented Process Ontology

This paper presents the ontology of the concurrent processes close to Hoare communicating sequential processes. It is a part of an intellectual system for supporting verification of behavioral properties of such processes. Our ontological representation of the processes is oriented both to the application of formal verification methods and to the extraction of information from technical documentation (by our previously developed system of information extraction from a natural language text). We describe the ontology classes and domains that define communicating concurrent processes. These processes are characterized by sets of local and shared variables, a list of actions on these variables which change their values, a list of channels for the process communication (which, in turn, are characterized by the type of reading messages, capacity, modes of writing and reading, and reliability), and also a list of communication actions for sending messages. In addition to the formal mathematical definition of classes and domains of the ontology, examples of descriptions of some ontological classes, as well as typical properties and axioms for them, are specified in the editor Protégé in the OWL language with the use of the inference rules in the SWRL language. We define the formal operational semantics of communicating processes for their ontological representation. This semantics is a labeled transition system. It is reduced to the local operational semantics of separate process instances in the interleaving model. We specialize several types of processes from the subject domain of automatic control systems that model the typical functional elements of the automatic control system (sensors, comparators and regulators), as well as their combinations. The concepts of the specialized ontology are illustrated by the example of a control part of a bottle-filling system.

Formal Verification for Task Description Languages. A Petri Net Approach.

One of the main challenges in verifying robotic systems is its asynchronous interaction with an unstructured environment, observed by imperfect sensors. Autonomous robot systems usually require some language to support task-level control. This paper presents an effective approach to apply formal verification methods for that kind of language. A main contribution of this method is to avoid modeling the robotic system with a specific formalism. The approach translates the task-level control models into a Petri net (PN) based representation. This is used to define new methods to analyze some task properties such as liveness, deadlock-freeness and terminability. The approach has been applied to the Task Description Language (TDL) and it is illustrated by experiments. The final goal is to create new tools within the application development environment to include formal verification as part of the normal software development cycle. The TDL to PN translator uses the Petri Net Markup Language (PNML) as its file format. This format permits interoperability with other Petri net tools that can also be used to analyze the PNs.

A systematic literature review on formal verification of software‐defined networks

AbstractBy raising evolutionary network connections, a software‐defined network (SDN) offers a well‐managed and flexible novel network topology. The SDN efforts are provided to abstract the original network configuration for business applications and web services. Additionally, the SDN modifies the network management policies such as topology policies, deployment policies, the applicability, and infrastructure maintenance. One of the important features of the SDN is standardizing the network interfaces with the precise functional semantics in application and control flow layers. In another hand, specification and evaluation of the existing network interfaces is a main and significant challenge to prove the correctness of the configurable scenarios in the SDN approach. Recently, formal verification presents a high potential platform to evaluate the main‐layer scenarios of the SDN as the novel perspective in this area. Up to now, there is no survey and state‐of‐the‐art review on the formal verification methods in the SDN. This paper provides a systematic literature review (SLR) for the formal verification methods in the SDN in form of the SDN plans to recognize the state of the art of the open challenges. The presented SLR is classified into three main fields: application plan, data plan, and control plan approaches. The verification mechanisms are compared with each other according to the important factors such as structural properties, quality‐of‐service metrics, applied algorithms, and measurement tools.

Formal Verification of Three-Valued Digital Waveforms

We investigate a formal verification problem (mathematically rigorous correctness checking) for digital waveforms used in practical development of digital microelectronic devices (digital circuits) at early design stages. According to modern methodologies, a digital circuit design starts at high abstraction levels provided by hardware description languages (HDLs). One of essential steps of an HDLbased circuit design is an HDL code debug, similar to the same step of program development in means and importance. A popular way of an HDL code debug is based on extraction and analysis of a waveform, which is a collection of plots for digital signals: functional descriptions of value changes related to selected circuit places in real time. We propose mathematical means for automation of correctness checking for such waveforms based on notions and methods of formal verification against temporal logic formulae, and focus on such typical featues of HDL-related digital signals and corresponding (informal) properties, such as real time, three-valuededness, and presence of signal edges. The three-valuededness means that at any given time, besides basic logical values 0 and 1, a signal may have a special undefined value: one of the values 0 and 1, but which one of them is either not known, or not important. An edge point of a signal is a time point at which the signal changes its value. The main results are mathematical notions, propositions, and algorithms which allow to formalize and solve a formal verification problem for considered waveforms, including: definitions for signals and waveforms which the mentioned typical digital signal features; a temporal logic suitable for formalization of waveform correctness properties, and a related verification problem statement; a solution technique for the verification problem, which is based on reduction to signal transfromation and analysis; a corresponding verification algorithm together with its correctness proof and “reasonable” complexity bounds.

On the Mutual Dependence Between Formal Methods and Empirical Testing in Program Verification

This paper provides a review of Raymond Turner’s book Computational Artefacts. Towards a Philosophy of Computer Science. Focus is made on the definition of program correctness as the twofold problem of evaluating whether both the symbolic program and the physical implementation satisfy a set of specifications. The review stresses how these are not two separate problems. First, it is highlighted how formal proofs of correctness need to rely on the analysis of physical computational processes. Secondly, it is underlined how software testing requires considering the formal relations holding between the specifications and the symbolic program. Such a mutual dependency between formal and empirical program verification methods is finally shown to influence the debate on the epistemological status of computer science.

Functional verification of distributed automation systems

The demand of customer-specific products leads to a fundamental change to manufacturing facilities. To adapt the facilities to new product types, frequently occurring functionality changes in industrial automation systems are expected. Functionality changes are primarily implemented by software changes. These software changes within the operation phase can be implemented, for instance, by over-the-air software updates or ad hoc integration of new components. The effects of these changes are often difficult to estimate, especially in distributed automation systems. This mainly poses a challenge on production line operators, who are required to validate their automation systems after functionality changes have been executed. The goal of this contribution is to assist production line operators in the validation process of their automation systems after software changes. Formal verification methods can support the operators, due to its fully automated execution. However, the creation process of the behavior models needed for the formal verification is complex and error-prone. This is why formal verification is usually not used. Hence, a model-based technique is presented to automate this creation process. By means of this, the subsystem affected by the software change is automatically identified and subsequently a suitable input to a model-based verification tool is generated. The concept is based on the generation of a system model by composing the Petri net models of components within the automation system. In order to identify affected components, an impact analysis is performed, starting from the component in which a modification occurred. Followingly, a tailored subsystem is composed using the component models necessary for verification. This subsystem is applied to verify the system requirements for the affected components. To evaluate the applicability of the concept in the field of industrial automation, a distributed automation system was implemented. A service-oriented, OPC-UA-based, control network is thereby used to implement a technical process. Furthermore, a configuration interface enables change of the components at runtime. This emulates over-the-air updates and ad hoc networking. The concept is implemented with the demonstrator “TestIAS.” This test device detects software changes within the automation system and verifies them automatically according to the model-based approach presented. An empirical evaluation was performed with ten different reconfiguration scenarios showing functional changes. In addition, based on the time measurements of the time saving due to the impact analysis, the efficiency enhancement is substantiated.

FinalFilter: Asserting Security Properties of a Processor at Runtime

In an ideal world, it would be possible to build a provably correct and secure processor. However, the complexity of today's processors puts this ideal out of reach. The complete verification of a modern processor remains intractable. Statically verifying even a simple security property -for example, privilege escalation never occurs -remains beyond the state of the art in formal verification. Testing can complement formal verification methods, yet testing is incomplete and bugs in the hardware that leave it vulnerable continue to elude test suites. Further, a crafty malicious actor can evade typical testing coverage metrics. Recent efforts, including that of three of the authors, have explored the use of static analysis on the design files (e.g., hardware description level source code or gate-level netlists) to find suspicious circuitry. These techniques rely on heuristics to define patterns that indicate a likely trojan and then search for instances in the design that match the pattern. However, malicious circuitry that does not match the pattern will be missed, as will inadvertent bugs that open vulnerabilities. By the time the weakness is uncovered, the hardware is already in the end user's hands and vulnerable to attack. In the absence of a full proof of correctness, what is needed is a final filter: a runtime verification technique that works-postdeployment-to detect and respond to security property violations as they occur during execution. In this article, we make the case for final filters using our tool, FinalFilter, as a case study.

Theorem proof based gate level information flow tracking for hardware security verification

Digital hardware lies in the heart of systems deployed in finance, medical care, basic infrastructure and national defense systems. However, due to the lack of effective security verification tools, hardware designs may contain security vulnerabilities resulting from performance optimizations, side channels, insecure debug ports and hardware Trojans, which provide attackers low level access to critical resources and effective attack surface to compromise a system. To address these security threats, we propose a theorem proof based gate level information flow tracking (GLIFT) method for formal verification of security properties and identifying security vulnerabilities that cause security property violations. Our method integrates a precise information flow tracking (IFT) model with the Coq theorem proof environment, inheriting the accuracy of GLIFT and the scalability of theorem proving based formal verification. We formalize semantic circuits and security theorems for proving security properties in order to detect security violations. The proposed method has been demonstrated on an OpenRISC development interface core and an RSA implementation both from OpenCores as well as several Trojan benchmarks from Trust-HUB. Experimental results show that the proposed method detects insecure debug port, timing channel and hardware Trojans that cause violation of important security properties such as confidentiality, integrity and isolation and also derives the trigger condition of hardware Trojans.