Linear Temporal Logic Properties Research Articles

Certified reinforcement learning with logic guidance

Reinforcement Learning (RL) is a widely employed machine learning architecture that has been applied to a variety of control problems. However, applications in safety-critical domains require a systematic and formal approach to specifying requirements as tasks or goals. We propose a model-free RL algorithm that enables the use of Linear Temporal Logic (LTL) to formulate a goal for unknown continuous-state/action Markov Decision Processes (MDPs). The given LTL property is translated into a Limit-Deterministic Generalised Büchi Automaton (LDGBA), which is then used to shape a synchronous reward function on-the-fly. Under certain assumptions, the algorithm is guaranteed to synthesise a control policy whose traces satisfy the LTL specification with maximal probability.

A Bounded Model Checker for Timed Automata and Its Application to LTL Properties

Model checking with a time aspect is often used in verification on hardware and embedded systems. Timed automata are often used for such models. UPPAAL is a world-wide famous model checking tool for timed automata; however, UPPAAL is a Computational Tree Logic (CTL)-based model checking tool and cannot use Linear Temporal Logic (LTL) properties. Bounded model checking uses LTL (Linear Time Logic) for a checking formula. Bounded model checking specifies a boundary k and obtains counterexamples by searching from the initial state of a system to states reachable by k-steps. There are several studies on bounded model checking. Sorea has proposed a concrete algorithm for a timed automaton. There are, however, no clear details on how to implement bounded model checking tools for timed automata, and study the performance. Another problem is that the timed automaton covered by the method does not support general variables except for clock variables. The objective of this study is to implement a bounded model checking tool using LTL for timed automata. We also improve Sorea's method so that it can handle extended timed automata that handle general variables. This paper also presents some LTL examples from texts on requirement specifications for embedded systems and the results of applying the tool to them.

From LTL to rLTL monitoring: improved monitorability through robust semantics

Runtime monitoring is commonly used to detect the violation of desired properties in safety critical cyber-physical systems by observing its executions. Bauer et al. introduced an influential framework for monitoring Linear Temporal Logic (LTL) properties based on a three-valued semantics for a finite execution: the formula is already satisfied by the given execution, it is already violated, or it is still undetermined, i.e., it can still be satisfied and violated by appropriate extensions of the given execution. However, a wide range of formulas are not monitorable under this approach, meaning that there are executions for which satisfaction and violation will always remain undetermined no matter how it is extended. In particular, Bauer et al. report that 44% of the formulas they consider in their experiments fall into this category. Recently, a robust semantics for LTL was introduced to capture different degrees by which a property can be violated. In this paper we introduce a robust semantics for finite strings and show its potential in monitoring: every formula considered by Bauer et al. is monitorable under our approach. Furthermore, we discuss which properties that come naturally in LTL monitoring—such as the realizability of all truth values—can be transferred to the robust setting. We show that LTL formulas with robust semantics can be monitored by deterministic automata, and provide tight bounds on the size of the constructed automaton. Lastly, we report on a prototype implementation and compare it to the LTL monitor of Bauer et al. on a sample of examples.

Cloud manufacturing service composition in IoT applications: a formal verification-based approach

Nowadays, one of the new solutions to develop Internet of Things (IoT) applications is cloud manufacturing. By increasing the number of actuators, industrial devices and sensors in industry 4.0 technology, the IoT is going to improve the intelligence of the enterprise information systems with a fast transition towards flexible, smarter, automated and reactive services. In order to respond the needs more quickly or matching the cloud services with modified requirements, cloud manufacturing service composition is used to take advantage of several services available in the Industrial IoT applications. The cloud-based manufacturing services can be characterized, published, shared, and retrieved over the cloud infrastructure to provide integrated services according to the user QoS requirements in a collaborative environment. In this work, a service composition approach is provided for cloud manufacturing in IoT applications. For evaluating the correctness of the proposed solution, a formal verification method is presented based on Labeled Transition System (LTS). Also, Whale Optimization Algorithm (WOA) is utilized to enhance the Quality of Service (QoS), when the number of cloud services have been increased. Finally, deadlock-free and reachability factors as important logical problems are satisfied in verification of the proposed approach. The verification results obtained under different Linear Temporal Logic (LTL) properties and various number of cloud providers indicate that the proposed approach is a correct and valid solution and it outperforms in terms of the reachability, verification time, deadlock, and memory usage.

Memory-loss resilient controller design for temporal logic constraints

ABSTRACT This paper studies the problem of controlling finite nondeterministic transition systems to satisfy constraints given as linear temporal logic properties. A controller architecture is proposed that maps finite fragments of the state trajectory history to control inputs. This approach avoids the standard controller construction that employs an onboard automaton which is fragile to memory loss or errors. In contrast, the proposed architecture requires storing only a finite sequence of previous system states in memory and is therefore resilient to memory loss. In particular, the system will operate unaltered after such a memory-loss event once the system recollects this finite sequence of system states. A generalised algorithm is outlined for controller synthesis in this manner. Additionally, we demonstrate the construction and implementation of such a memory-loss resilient controller through an experimental demonstration on a differential-drive robot that experiences memory-loss events.

Safety Verification of IEC 61131-3 Structured Text Programs

With the development of the industrial control system, programmable logic controllers (PLCs) are increasingly adopted in the process automation. Moreover, many PLCs play key roles in safety-critical systems, such as nuclear power plants, where robust and reliable control programs are required. To ensure the quality of programs, testing and verification methods are necessary. In this article, we present a novel methodology which applies model checking to verifying PLC programs. Specifically, we focus on the structured text (ST) language which is a widely used, high-level programming language defined in the electro-technical commission (IEC) 61131-3 standard. A formal model named behavior model (BM) is defined to specify the behavior of ST programs. An algorithm based on variable state analysis for automatically extracting the BM from an ST program is given. An algorithm based on the automata-theoretic approach is proposed to verify linear temporal logic properties on the BM. Finally, a real-life case study is presented.

Generic Framework Architecture for Verifying Embedded Components

This dissertation presents a framework for the formal verification of standard embedded components such us bus protocol, microprocessor, memory blocks, various IP blocks, and a software component. It includes a model checking of embedded systems components. The algorithms are modeled on SystemC and transformed on Promela language (PROcess or PROtocol MEta LAnguage) with the integration of LTL (Linear Temporal Logic) properties extracting from state machines in order to reduce verification complexity. Thus, SysVerPml is not only dedicated to verifying generated properties but also for the automation integration of other properties in models if needed. In the following, we will provide the answer to the problems of component representation on the design system, what properties are appropriate for each component, and how to verify properties.

Verifying parallel dataflow transformations with model checking and its application to FPGAs

Abstract Dataflow languages are widely used for programming real-time embedded systems. They offer high level abstraction above hardware, and are amenable to program analysis and optimisation. This paper addresses the challenge of verifying parallel program transformations in the context of dynamic dataflow models, where the scheduling behaviour and the amount of data each actor computes may depend on values only known at runtime. We present a Linear Temporal Logic (LTL) model checking approach to verify a dataflow program transformation, using three LTL properties to identify cyclostatic actors in dynamic dataflow programs. The workflow abstracts dataflow actor code to Fiacre specifications to search for counterexamples of the LTL properties using the Tina model checker. We also present a new refactoring tool for the Orcc dataflow programming environment, which applies the parallelising transformation to cyclostatic actors. Parallel refactoring using verified transformations speedily improves FPGA performance, e.g.15.4 × speedup with 16 actors.

Causality for General LTL-definable Properties

In this paper we provide a notion of causality for the violation of general Linear Temporal Logic (LTL) properties. The current work is a natural extension of the previously proposed approach handling causality in the context of LTL-definable safety properties. The major difference is that now, counterexamples of general LTL properties are not merely finite traces, but infinite lasso-shaped traces. We analyze such infinite counterexamples and identify the relevant ordered occurrences of causal events, obtained by unfolding the looping part of the lasso shaped counterexample sufficiently many times. The focus is on LTL properties from practical considerations: the current results are to be implemented in QuantUM, a tool for causality checking, that exploits explicit state LTL model checking.

The early bird catches the worm: First verify, then monitor!

Trace expressions are a compact and expressive formalism, initially devised for runtime verification of agent interactions in multiagent systems, which has been successfully employed to model real-world protocols, and to generate monitors for mainstream multiagent system platforms, and generalized to support runtime verification of different kinds of properties and systems. In this paper, we propose an algorithm to check Linear Temporal Logic (LTL) properties satisfiability on trace expressions. To do this, we show how to translate a trace expression into a Büchi Automaton in order to realize an Automata-Based Model Checking . We show that this translation generates an over-approximation of our trace expression leading us to obtain a sound procedure to verify LTL properties. Once we have statically checked a set of LTL properties, we can conclude that: (1) our trace expression is formally correct (2) since we use this trace expression to generate monitors checking the runtime behavior of the system, the LTL properties verified by this trace expression are also verified by the monitored system. • Proposal of a static/dynamic hybrid approach to improve runtime monitoring. • Model Checking of a formal specification used to verify object-oriented programs at runtime. • Definition and experimentation of a 3-Steps algorithm to solve the problem.

Using gate-level side channel parameters for formally analyzing vulnerabilities in integrated circuits

• A formal framework for vulnerability analysis of integrated circuits and Hardware Trojan (HT) detection is presented. • nuXmv model checker is used for gate-level circuit modeling, and validation of side channel parameters. • A novel vulnerability analysis algorithm based on a set of LTL properties is proposed to analyze behavior of circuits. • HT detection and behavior analysis are performed while considering the impact of process variations. The rising trend of globalization in integrated circuits (ICs) design and fabrication process has increased their vulnerability against malicious intrusions and alterations. Such modifications, also referred as Hardware Trojans (HTs), can lead to highly detrimental consequences like causing an IC to subvert normal operation, leak sensitive information or inducing denial of service (DoS). The vulnerability analysis of ICs against the malicious intrusions with conventional design-time testing and exhaustive simulations is computationally intensive, and it takes substantial resources and time for all-encompassing verification. To overcome these limitations, we propose a formal framework, based on gate-level side channel parameters, for a-priori assessment of IC vulnerability against HTs at the early stages of the design. This work employs formal modeling of the IC behavior in terms of switching power, propagation delay and leakage in order to examine the impact of malicious intrusions. We used the bounded model checker nuXmv, to formally verify and analyze the identified properties, owing to its inherent ability to handle real numbers and its support for analyzing infinite state domains. The vulnerabilities of ICs against HTs, and their effects on the IC nodes are assessed by analyzing linear temporal logic (LTL) properties, which are subsequently rendered into behavioral traces. We demonstrate the effectiveness of our approach on a set of ISCAS benchmarks.

Verification and Synthesis of Clock-Gated Circuits

To reduce dynamic power dissipation in digital circuits, a dependency graph (DG) is derived for a sequential circuit to accomplish verification and synthesis of clock-gated circuits. This is used recursively to derive sufficient conditions for a given bank of flops (flip-flops) to be legally clock gated (disabled.) These conditions are expressed with linear temporal logic (LTL)/past LTL (PLTL) properties, which can be used to create hardware monitors and justified by hardware model checkers. For sequential equivalence checking (SEC), LTL/PLTL properties are formulated to be proved on a clock-gated circuit ( R ) derived from a “golden” circuit ( G ). If these sufficient conditions can be proved on R , then the clock gating structures are proved redundant and can be removed. This creates a simplified circuit ( R’ ) and makes the SEC task easier. Experiments were performed on a set of benchmarks. It was observed that since the properties are expressed in terms of the control signals which only appear in the DG, they are quite easy to prove on R because the DG abstracts away complicated arithmetic logic. Similarly, the miter between G and R’ is usually proved easily by model-checking methods because of the increased similarity between G and R’ in sequential behaviors, compared to the changes between G and R . The proposed formulation is extended to provide a systematic and automatic method for sequential clock-gating synthesis. Experiments showed that the DG-based framework for synthesis gave encouraging results.

Towards SMT-based LTL model checking of clock constraint specification language for real-time and embedded systems

The Clock Constraint Specification Language (CCSL) is a formal language companion to MARTE (shorthand for Modeling and Analysis of Real-Time and Embedded systems), a UML profile used to facilitate the design and analysis of real-time and embedded systems. CCSL is proposed to specify constraints on the occurrences of events in systems. However, the language lacks efficient verification support to formally analyze temporal properties, which are important properties to real-time and embedded systems. In this paper, we propose an SMT-based approach to model checking of the temporal properties specified in Linear Temporal Logic (LTL) for CCSL by transforming CCSL constraints and LTL formulas into SMT formulas. We implement a prototype tool for the proposed approach and use the state-of-the-art tool Z3 as its underlying SMT solver. We model two practical real-time and embedded systems, i.e., a traffic light controller and a power window system in CCSL , and model check LTL properties of them using the proposed approach. Experimental results demonstrate the effectiveness and efficiency of our approach.

Temporal Modelling and Verification of Multi-Robot Concurrent Activities

Objectives: In this work, we have introduced a method for formally verifying the concurrent activities of multiple robots. The objective is to formalize a framework for concurrent systems by using temporal logics. Methods/Statistical Analysis: The movement of the robots in given environment is modelled as a weighted transition system and the target is specified in Linear Temporal Logic (LTL) formulae over a set of propositions. Findings: The LTL formulas are characterized to handle the uncertainty or any abnormal activity during the process. The system is designed using SPIN model checker in which different LTL properties are verified. A theoretical description is supported by some experimental results, generated using the existing logics and techniques. Application/ Improvement: This work can be implemented for the surveillance task in pickup and delivery network.

Garakabu2: an SMT-based bounded model checker for HSTM designs in ZIPC

Hierarchical State Transition Matrix (HSTM) is a table-based modeling language that has been broadly used for developing software designs of embedded systems. In this paper, we describe a model checker Garakabu2, which we have been implementing for verifying HSTM designs against Linear Temporal Logic (LTL) properties. The HSTM designs that Garakabu2 takes as input are those developed using an industrial-strength model-based development environment ZIPC. We focus on describing Garakabu2's verification techniques and performance, as well as our efforts to improve its practical usability for on-site software engineers. Some experiences and lessons on developing industry-oriented model checkers are also reported.

Verification of logical consistency in robotic reasoning

Most autonomous robotic agents use logic inference to keep themselves to safe and permitted behaviour. Given a set of rules, it is important that the robot is able to establish the consistency between its rules, its perception-based beliefs, its planned actions and their consequences. This paper investigates how a robotic agent can use model checking to examine the consistency of its rules, beliefs and actions. A rule set is modelled by a Boolean evolution system with synchronous semantics, which can be translated into a labelled transition system (LTS). It is proven that stability and consistency can be formulated as computation tree logic (CTL) and linear temporal logic (LTL) properties. Two new algorithms are presented to perform realtime consistency and stability checks, respectively. Their implementation provides us a computational tool, which can form the basis of efficient consistency checks on-board robots.

Foundations for using linear temporal logic in Event-B refinement

Abstract In this paper we present a new way of reconciling Event-B refinement with linear temporal logic (LTL) properties. In particular, the results presented in this paper allow properties to be established for abstract system models, and identify conditions to ensure that the properties (suitably translated) continue to hold as those models are developed through refinement. There are several novel elements to this achievement: (1) we identify conditions that allow LTL properties to be mapped across refinement chains; (2) we provide translations of LTL predicates to reflect the introduction through refinement of new events and the renaming and splitting of existing events; (3) we do this for an extended version of LTL particularly suited to Event-B, including state predicates and enabledness of events, which can be model-checked at the abstract level. Our results are more general than any previous work in this area, covering liveness in the context of anticipated events, and relaxing constraints between adjacent refinement levels. The approach is illustrated with a case study. This enables designers to develop event based models and to consider their execution patterns so that liveness and fairness properties can be verified for Event-B systems.

Component-wise incremental LTL model checking

Abstract Efficient symbolic and explicit-state model checking approaches have been developed for the verification of linear time temporal logic (LTL) properties. Several attempts have been made to combine the advantages of the various algorithms. Model checking LTL properties usually poses two challenges: one must compute the synchronous product of the state space and the automaton model of the desired property, then look for counterexamples that is reduced to finding strongly connected components (SCCs) in the state space of the product. In case of concurrent systems, where the phenomenon of state space explosion often prevents the successful verification, the so-called saturation algorithm has proved its efficiency in state space exploration. This paper proposes a new approach that leverages the saturation algorithm both as an iteration strategy constructing the product directly, as well as in a new fixed-point computation algorithm to find strongly connected components on-the-fly by incrementally processing the components of the model. Complementing the search for SCCs, explicit techniques and component-wise abstractions are used to prove the absence of counterexamples. The resulting on-the-fly, incremental LTL model checking algorithm proved to scale well with the size of models, as the evaluation on models of the Model Checking Contest suggests.

Formal Verification of Contractual Software Architectures using SPIN

Software architectures have become one of the most crucial aspects of software engineering. Software architectures let designers specify systems in terms of components and their relations (i.e., connectors). These components along with their relations can then be verified to check whether their behaviours meet designers’ expectations. XCD is a novel architecture description language, which promotes contractual specification of software architectures and their automated formal verifications in SPIN. XCD allows designers to formally verify their system specifications for a number of properties, i.e., (i) incomplete functional behaviour of components, (ii) wrong use of services operated by system components, (iii) deadlock, (iv) race-conditions, and (v) buffer overflows in the case of asynchronous (i.e., event-based) communications. In addition to these properties, designers can specify their own properties in linear temporal logic and check their correctness. In this paper, I discuss XCD and its support for formal verification of software architectures through a simple shared-data access case study.

A model transformation framework to increase OCL usability

The usability of a modeling language has a direct relationship with several factors of models constructed with the modeling language, such as time required and accuracy. Object Constraint Language (OCL) is the most prevalent language to document system constraints that are annotated in the Unified Modeling Language (UML). OCL is reputed as a modeling language with difficult syntax, and prior knowledge of OCL is needed to use the language. These obstacles result in the low usability of OCL. Therefore, the current research proposes a model to automatically transform system constraints formed in English sentences to OCL specifications. The proposed model is based on the Model-Driven Architecture (MDA) approach. The Linear Temporal Logic (LTL) properties of the proposed model are verified by the Maude model checker. To validate the proposed model and compare it with the existing work, the En2OCL (English2OCL) application is developed. This application is tested by three evaluation metrics: precision, recall, and f-measure. The En2OCL application is further compared with the NL2OCLviaSBVR application, which is the existing work on OCL generation from English sentences. The comparison shows a considerable improvement in precision, recall, and f-measure.