Formal Verification Techniques Research Articles

Formal Verification of Usage Control Models: A Case Study of UseCON Using TLA+

Usage control models provide an integration of access control, digital rights, and trust management. To achieve this integration, usage control models support additional concepts such as attribute mutability and continuity of decision. However, these concepts may introduce an additional level of complexity to the underlying model, rendering its definition a cumbersome and prone to errors process. Applying a formal verification technique allows for a rigorous analysis of the interactions amongst the components, and thus for formal guarantees in respect of the correctness of a model. In this paper, we elaborate on a case study, where we express the high-level functional model of the UseCON usage control model in the TLA+ formal specification language, and verify its correctness for <=12 uses in both of its supporting authorisation models.

Performing CTL model checking via DNA computing

The computation using deoxyribonucleic acid (DNA) molecules provides an enormous parallel method that breaks through the limitations of the efficiency of traditional electronic computers. Model checking is a standard formal verification technique, which has been widely used in many fields of computation. It is also a well-known complex problem in computing theory. Until now, there is only one basic formula in the computation tree logic (CTL), for which model checking via DNA computing can be conducted. To this end, Adleman’s model based on DNA computing is used in this paper, based on which a series of DNA-computing-based model-checking algorithms to check the four basic CTL formulas are proposed. As a result, a core of the DNA version of the CTL model-checking problem is solved. The simulated experimental results show that the new algorithms are valid and can be properly implemented in molecular biology.

Ant Colony Optimization based model checking extended by smell-like pheromone with hop counts

This article presents an improvement of the Ant Colony Optimization (ACO) algorithm for specifically addressing the software verification problem. Model checking is a new formal verification technique that has been studied intensively. Given a model that abstracts the behaviors of a software system, and a specification that expresses the desirable properties, a verification system called model checker automatically checks whether the model satisfies the specification or not. Since general model checkers work based on a deterministic algorithm, checking may require too much execution time and memory resource. This situation is called the state explosion problem. In order to mitigate this problem, an approach based on ACO was proposed. In this article, we have extended the ACO approach with smell-like pheromone that behaves like smell diffusing from food. In our approach, the smell-like pheromone records the number of hops from a destination state at each edge. Since our model checker searches the destination states in the direction where the number of hops decreases, it can complete the checking more efficiently. We have implemented a model checker based on our approach. The experimental results show that our approach practically decreases the execution time without sacrificing the quality of the solutions.

A Survey on Formal Verification Techniques for Safety-Critical Systems-on-Chip

The high degree of miniaturization in the electronics industry has been, for several years, a driver to push embedded systems to different fields and applications. One example is safety-critical systems, where the compactness in the form factor helps to reduce the costs and allows for the implementation of new techniques. The automotive industry is a great example of a safety-critical area with a great rise in the adoption of microelectronics. With it came the creation of the ISO 26262 standard with the goal of guaranteeing a high level of dependability in the designs. Other areas in the safety-critical applications domain have similar standards. However, these standards are mostly guidelines to make sure that designs reach the desired dependability level without explicit instructions. In the end, the success of the design to fulfill the standard is the result of a thorough verification process. Naturally, the goal of any verification team dealing with such important designs is complete coverage as well as standards conformity, but as these are complex hardware, complete functional verification is a difficult task. From the several techniques that exist to verify hardware, where each has its pros and cons, we studied six well-established in academia and in industry. We can divide them into two categories: simulation, which needs extremely large amounts of time, and formal verification, which needs unrealistic amounts of resources. Therefore, we conclude that a hybrid approach offers the best balance between simulation (time) and formal verification (resources).

The role of model checking in software engineering

Model checking is a formal verification technique. It takes an exhaustively strategy to check hardware circuits and network protocols against desired properties. Having been developed for more than three decades, model checking is now playing an important role in software engineering for verifying rather complicated software artifacts. This paper surveys the role of model checking in software engineering. In particular, we searched for the related literatures published at reputed conferences, symposiums, workshops, and journals, and took a survey of (1) various model checking techniques that can be adapted to software development and their implementations, and (2) the use of model checking at different stages of a software development life cycle. We observed that model checking is useful for software debugging, constraint solving, and malware detection, and it can help verify different types of software systems, such as object- and aspect-oriented systems, service-oriented applications, web-based applications, and GUI applications including safety- and mission-critical systems. The survey is expected to help human engineers understand the role of model checking in software engineering, and as well decide which model checking technique(s) and/or tool(s) are applicable for developing, analyzing and verifying a practical software system. For researchers, the survey also points out how model checking has been adapted to their research topics on software engineering and its challenges.

Estimation of numerical uncertainty in computational fluid dynamics simulations of a passively controlled wave energy converter

The wave loads and the resulting motions of floating wave energy converters are traditionally computed using linear radiation–diffraction methods. Yet for certain cases such as survival conditions, phase control and wave energy conver- ters operating in the resonance region, more complete mathematical models such as computational fluid dynamics are preferred and over the last 5 years, computational fluid dynamics has become more frequently used in the wave energy field. However, rigorous estimation of numerical errors, convergence rates and uncertainties associated with computa- tional fluid dynamics simulations have largely been overlooked in the wave energy sector. In this article, we apply formal verification and validation techniques to computational fluid dynamics simulations of a passively controlled point absor- ber. The phase control causes the motion response to be highly nonlinear even for almost linear incident waves. First, we show that the computational fluid dynamics simulations have acceptable agreement to experimental data. We then present a verification and validation study focusing on the solution verification covering spatial and temporal discretiza- tion, iterative and domain modelling errors. It is shown that the dominating source of errors is, as expected, the spatial discretization, but temporal and iterative errors cannot be neglected. Using hexahedral cells with low aspect ratio and 30 cells per wave height, we obtain results with less than 5% uncertainty in motion response (except for surge) and restraining forces for the buoy without phase control. The amplified nonlinear response due to phase control caused a large increase in numerical uncertainty, illustrating the difficulty to obtain reliable solutions for highly nonlinear responses, and that much denser meshes are required for such cases.

McSeVIC: A Model Checking Based Framework for Security Vulnerability Analysis of Integrated Circuits

The rising trend of globalization in the integrated circuits’ design process has increased their vulnerabilities against malicious intrusions. The security vulnerability analysis using conventional design time simulations is computationally intensive and incomplete by nature. Formal verification has the potential to overcome these limitations of simulation techniques; however, the existing state-of-the-art formal verification techniques cannot be used as such to analyze the effects of hardware Trojans (HTs) that may impact the performance of the circuit without altering its functionality. In this paper, we propose a novel model checking-based formal framework for a priori assessment of circuit vulnerabilities against both the functional and parametric HTs at the early stages of the design. This framework is characterized by the gate-level side channel parameters, i.e., dynamic power, leakage power, and propagation delay, to examine the impacts of malicious circuitry insertion. An algorithm based on the temporal logic properties is proposed, which computes the bounds for the side channel parameters to define the expected secure regions of circuit operation. Moreover, we propose a second algorithm for formally analyzing the security vulnerabilities in the circuit by introducing partitions, which significantly reduces the size of state space. We evaluate the masking effects on the intrusions while considering 3-sigma variation in the process. We demonstrate the effectiveness of our proposed approach by analyzing the security vulnerabilities on a set of ISCAS85 and $74\times $ benchmarks.

Simulation-Based Hardware Verification with a Graph-Based Specification

Simulation-based verification continues to be the primary technique for hardware verification due to its scalability and ease of use; however, it lacks exhaustiveness. Although formal verification techniques can exhaustively prove functional correctness, they are limited in terms of the scale of their design due to the state-explosion problem. Alternatively, semiformal approaches can involve a compromise between scalability, exhaustiveness, and resource costs. Therefore, we propose an event-driven flow graph-based specification, which can describe the cycle-accurate functional behaviors without the exploration of whole state space. To efficiently generate input sequences according to the proposed specification, we introduce a functional automatic test pattern generation (ATPG) approach, which involves the proposed intelligent redundancy-reduction strategy to solve problems of random test vectors. We also proposed functional coverage criterion based on the formal specification to support a more reliable measure of verification. We implement a verification platform based on the proposed semiformal approach and compare the proposed semiformal approach with the constrained randomized test (CRT) approach. The experiment results show that the proposed semiformal verification method ensures a more exhaustive and effective exploration of the functional correctness of designs under verification (DUVs).

Automated Logic-Based Technique for Formal Verification of Security Protocols

Automated Logic-Based Technique for Formal Verification of Security Protocols

A design-oriented method to build correct hypermedia documents

Over the years, different approaches to identify temporal and spatial conflicts in hypermedia applications has been proposed. Most of them are based on formal verification techniques and impose to the designers to follow a formal model or language to ensure application’s functional correctness. Furthermore, the error diagnose is hard to be interpreted by a non-specialist in this domain. In this paper, we present an approach which supports formal verification for documents written in markup languages. We proposed a method and built a verification toolchain that helps designers to verify time and spatial constraints in hypermedia applications. The input language is the designer language. Its translation towards the input of toolchain is automatic and transparent for the application designer. The errors scenarios provided by the verification tool are presented in a timeline way, easily understandable by the designer. The method and toolchain support different markup languages translated in the same intermediary language in order to facilitate the use of different verification tools in the same environment.

Underminer

Evaluation of industrial embedded control system designs is a time-consuming and imperfect process. While an ideal process would apply a formal verification technique such as model checking or theorem proving, these techniques do not scale to industrial design problems, and it is often difficult to use these techniques to verify performance aspects of control system designs, such as stability or convergence. For industrial designs, engineers rely on testing processes to identify critical or unexpected behaviors. We propose a novel framework called Underminer to improve the testing process; this is an automated technique to identify nonconverging behaviors in embedded control system designs. Underminer treats the system as a black box and lets the designer indicate the model parameters, inputs, and outputs that are of interest. It differentiates convergent from nonconvergent behaviors using Convergence Classifier Functions (CCFs). The tool can be applied in the context of testing models created late in the controller development stage, where it assumes that the given model displays mostly convergent behavior and learns a CCF in an unsupervised fashion from such convergent model behaviors. This CCF is then used to guide a thorough exploration of the model with the help of optimization-guided techniques or adaptive sampling techniques, with the goal of identifying rare nonconvergent model behaviors. Underminer can also be used early in the development stage, where models may have some significant nonconvergent behaviors. Here, the framework permits designers to indicate their mental model for convergence by labeling behaviors as convergent/nonconvergent and then constructs a CCF using a supervised learning technique. In this use case, the goal is to use the CCF to test an improved design for the model. Underminer supports a number of convergence-like notions, such as those based on Lyapunov analysis and temporal logic, and also CCFs learned directly from labeled output behaviors using machine-learning techniques such as support vector machines and neural networks. We demonstrate the efficacy of Underminer by evaluating its performance on several academic as well as industrial examples.

Model checking optimal finite-horizon control for probabilistic gene regulatory networks

BackgroundProbabilistic Boolean networks (PBNs) have been proposed for analyzing external control in gene regulatory networks with incorporation of uncertainty. A context-sensitive PBN with perturbation (CS-PBNp), extending a PBN with context-sensitivity to reflect the inherent biological stability and random perturbations to express the impact of external stimuli, is considered to be more suitable for modeling small biological systems intervened by conditions from the outside. In this paper, we apply probabilistic model checking, a formal verification technique, to optimal control for a CS-PBNp that minimizes the expected cost over a finite control horizon.ResultsWe first describe a procedure of modeling a CS-PBNp using the language provided by a widely used probabilistic model checker PRISM. We then analyze the reward-based temporal properties and the computation in probabilistic model checking; based on the analysis, we provide a method to formulate the optimal control problem as minimum reachability reward properties. Furthermore, we incorporate control and state cost information into the PRISM code of a CS-PBNp such that automated model checking a minimum reachability reward property on the code gives the solution to the optimal control problem. We conduct experiments on two examples, an apoptosis network and a WNT5A network. Preliminary experiment results show the feasibility and effectiveness of our approach.ConclusionsThe approach based on probabilistic model checking for optimal control avoids explicit computation of large-size state transition relations associated with PBNs. It enables a natural depiction of the dynamics of gene regulatory networks, and provides a canonical form to formulate optimal control problems using temporal properties that can be automated solved by leveraging the analysis power of underlying model checking engines. This work will be helpful for further utilization of the advances in formal verification techniques in system biology.

A formal verification technique for behavioural model-to-model transformations

In Model Driven Software Engineering, models and model transformations are the primary artifacts when developing a software system. In such a workflow, model transformations are used to incrementally transform initial abstract models into concrete models containing all relevant system details. Over the years, various formal methods have been proposed and further developed to determine the functional correctness of models of concurrent systems. However, the formal verification of model transformations has so far not received as much attention. In this article, we propose a formal verification technique to determine that formalisations of such transformations in the form of rule systems are guaranteed to preserve functional properties, regardless of the models they are applied on. This work extends our earlier work in various ways. Compared to our earlier approaches, the current technique involves only up to n individual checks, with n the number of rules in the rule system, whereas previously, up to 2n − 1 checks were required. Furthermore, a full correctness proof for the technique is presented, based on a formal proof conducted with the Coq proof assistant. Finally, we report on two sets of conducted experiments. In the first set, we compared traditional model checking with transformation verification, and in the second set, we compared the verification technique presented in this article with the previous version.

A Model Transformation Approach for Specifying Real-Time Systems and Its Verification Using RT-Maude

Real-time systems must be properly validated and verified before their manufacturing and deployment in order to increase their reliability and reduce their maintenance cost. Models have been used for a long time to build complex systems, in virtually every engineering field. This is because they provide invaluable help in making important design decisions before the system is implemented. In this paper, the authors propose an approach based on model transformation to apply formal verification techniques to demonstrate the correctness of system designs. At the first step, they describe real-time systems by state chart (machine) diagrams, as source models to generate RT-Maude models (target models). The second step is to use the result models to verify the real-time systems against specified LTL properties using Maude LTL Model-Checker. This approach is illustrated through an example.

Linear-time Temporal Logic with Event Freezing Functions

Formal properties represent a cornerstone of the system-correctness proofs based on formal verification techniques such as model checking. Formalizing requirements into temporal properties may be very complex and error prone, due not only to the ambiguity of the textual requirements but also to the complexity of the formal language. Finding a property specification language that balances simplicity, expressiveness, and tool support remains an open problem in many real-world contexts. In this paper, we propose a new temporal logic, which extends First-Order Linear-time Temporal Logic with Past adding two operators "at next" and "at last", which take in input a term and a formula and represent the value of the term at the next state in the future or last state in the past in which the formula holds. We consider different models of time (including discrete, dense, and super-dense time) and Satisfiability Modulo Theories (SMT) of the first-order formulas. The "at next" and "at last" functions can be seen as a generalization of Event-Clock operators and can encode some Metric Temporal operators also with counting. They are useful to formalize properties of component-based models because they allow to express constraints on the data exchanged with messages at different instants of time. We provide a simple encoding into equisatisfiable formulas without the extra functional symbols. We implement a prototype tool support based on SMT-based model checking.

Model checking the iKP electronic payment protocols

Much progress of formal verification techniques has been made and therefore many formal verification case studies of systems, such as security protocols, have been conducted and reported. Two major formal verification techniques are model checking and interactive theorem proving. Almost all case studies, however, use either model checking or interactive theorem proving. Even though both techniques are used, two different specifications dedicated to model checking and interactive theorem proving, respectively, are used. It would be desirable to make it possible to use one specification for one system for both model checking and interactive theorem proving. Observational transition systems (OTSs) have been proposed so that they can be written as equational theory specifications and used for interactive theorem proving. OTSs can also be written as rewrite theory specifications, which can be used for model checking, but it would take time to model check OTSs written as rewrite theory specifications in the existing techniques.There are two main contributions described in this article: (1) to propose an effective way to write OTSs as rewrite theory specifications, and (2) to conduct a case study in which an electronic commerce protocol has been model checked. Contribution (1) can be regarded as an effective way to translate equational theory specifications of OTSs for interactive theorem proving into rewrite theory specifications of OTSs for model checking. Moreover, since rewrite theory specifications of OTSs can be used for interactive theorem proving as well, contribution (1) may lead to the desirable situation aforementioned.

Towards Evaluating Size Reduction Techniques for Software Model Checking

Formal verification techniques are widely used for detecting design flaws in software systems. Formal verification can be done by transforming an already implemented source code to a formal model and attempting to prove certain properties of the model (e.g. that no erroneous state can occur during execution). Unfortunately, transformations from source code to a formal model often yield large and complex models, making the verification process inefficient and costly. In order to reduce the size of the resulting model, optimization transformations can be used. Such optimizations include common algorithms known from compiler design and different program slicing techniques. Our paper describes a framework for transforming C programs to a formal model, enhanced by various optimizations for size reduction. We evaluate and compare several optimization algorithms regarding their effect on the size of the model and the efficiency of the verification. Results show that different optimizations are more suitable for certain models, justifying the need for a framework that includes several algorithms.

A Formally-Verified Safety System for Closed-Loop Anesthesia

The benefits of closed-loop control of anesthesia in terms of drug usage, robustness to inter-patient variability and postoperative outcomes have been demonstrated in a number of clinical studies. However, to obtain regulatory approval for such systems to be employed as medical devices in operating rooms, patient safety must be demonstrated. This paper formalizes a previously published safety system for closed-loop anesthesia using formal model verification techniques. This safety system specifies safety constraints on the patient states based on the therapeutic window of propofol. To verify feasibility of the safety constraints in all situations, a finite number of simulation scenarios can be performed. However, the formal methods verify the feasibility problem for all possible admissible inputs and states without the need for simulation. The formalized safety system for closed-loop anesthesia guarantees that the patient states stay within safety constraints.

Formal verification of autonomous vehicle platooning

The coordination of multiple autonomous vehicles into convoys or platoons is expected on our highways in the near future. However, before such platoons can be deployed, the behaviours of the vehicles in these platoons must be certified. This is non-trivial and goes beyond current certification requirements, for human-controlled vehicles, in that these vehicles can act autonomously. In this paper, we show how formal verification can contribute to the analysis of these new, and increasingly autonomous, systems. An appropriate overall representation for vehicle platooning is as a multi-agent system in which each agent captures the “autonomous decisions” carried out by each vehicle. In order to ensure that these autonomous decision-making agents in vehicle platoons never violate safety requirements, we use formal verification. However, as the formal verification technique used to verify the individual agent's code does not scale to the full system, and as the global system verification technique does not capture the essential verification of autonomous behaviour, we use a combination of the two approaches. This mixed strategy allows us to verify safety requirements not only of a model of the system, but of the actual agent code used to program the autonomous vehicles.

Model Checking Spatial Logics for Closure Spaces

Spatial aspects of computation are becoming increasingly relevant in Computer Science, especially in the field of collective adaptive systems and when dealing with systems distributed in physical space. Traditional formal verification techniques are well suited to analyse the temporal evolution of programs; however, properties of space are typically not taken into account explicitly. We present a topology-based approach to formal verification of spatial properties depending upon physical space. We define an appropriate logic, stemming from the tradition of topological interpretations of modal logics, dating back to earlier logicians such as Tarski, where modalities describe neighbourhood. We lift the topological definitions to the more general setting of closure spaces, also encompassing discrete, graph-based structures. We extend the framework with a spatial surrounded operator, a propagation operator and with some collective operators. The latter are interpreted over arbitrary sets of points instead of individual points in space. We define efficient model checking procedures, both for the individual and the collective spatial fragments of the logic and provide a proof-of-concept tool.