Model Checking Analysis Research Articles

Lightweight Anonymous Authentication and Key Agreement Protocol Based on CoAP of Internet of Things.

To solve the problem regarding the lack of a lightweight and secure authentication and key agreement protocol in the Constrained Application Protocol of the Internet of Things environment, we explore the security flaws and applicability problems in the current related research. Then, we propose a new lightweight authentication and key agreement protocol based on the CoAP framework. The scheme adopts shared secret and elliptic curve public key technology, which ensures the anonymity of the communicators and provides strong security and anti-attack capacity. In terms of security analysis, the Dolev–Yao Adversary model and a security model checking analysis method based on CPN Tools are improved, in order to verify the correctness and security of the proposed scheme. Compared with other schemes, regarding communication overhead, computational cost, and security, the proposed scheme provides a robust and comprehensive security guarantee, although it is not the lightest.

A Framework for Quantitative Modeling and Analysis of Highly (Re)configurable Systems

This paper presents our approach to the quantitative modeling and analysis of highly (re)configurable systems, such as software product lines. Different combinations of the optional features of such a system give rise to combinatorially many individual system variants. We use a formal modeling language that allows us to model systems with probabilistic behavior, possibly subject to quantitative feature constraints, and able to dynamically install, remove or replace features. More precisely, our models are defined in the probabilistic feature-oriented language QFLan, a rich domain specific language (DSL) for systems with variability defined in terms of features. QFLan specifications are automatically encoded in terms of a process algebra whose operational behavior interacts with a store of constraints, and hence allows to separate system configuration from system behavior. The resulting probabilistic configurations and behavior converge seamlessly in a semantics based on discrete-time Markov chains, thus enabling quantitative analysis. Our analysis is based on statistical model checking techniques, which allow us to scale to larger models with respect to precise probabilistic analysis techniques. The analyses we can conduct range from the likelihood of specific behavior to the expected average cost, in terms of feature attributes, of specific system variants. Our approach is supported by a novel Eclipse-based tool which includes state-of-the-art DSL utilities for QFLan based on the Xtext framework as well as analysis plug-ins to seamlessly run statistical model checking analyses. We provide a number of case studies that have driven and validated the development of our framework.

A formal methods approach to semiotic engineering

Abstract This work introduces a formal methods approach to semiotic engineering: Browser-Integrated Guidance for Specifying Interface Signifiers (BIGSIS). Drawing from the semiotic engineering and formal methods literature, BIGSIS facilitates logical reasoning about human-system interface signifiers with respect to measures of effective and efficient designer-to-user communication. Signifiers that communicate correct functions or meanings are effective, and signifiers that convey nonconflicting functions or meanings are efficient. The BIGSIS approach incorporates a five-step process, an XML syntax, a Z notation formalism, an XML-to-Symbolic-Analysis-Laboratory (SAL) translator, and three signifier specifications: internal consistency, inter-channel consistency, and completeness. These elements of the approach support two analyses: BIGSIS-XML and model checking. The BIGSIS-XML analysis addresses one interface component, one sensory channel (visual, audio, or haptic), and one target-system configuration at a time. Using SAL, the model checking analysis considers all interface components including documentation, sensory channels, and a broad range of target-system configurations. We demonstrate an application of BIGSIS with a medical device case study. The analysis considers four components on the system’s controller, three sensory channels, and signified information from U.S. cultural context and explanations within an accompanying patient handbook. The BIGSIS-XML analysis aids in identifying 12 potential designer-to-user communication problems: ten involving effectiveness and two involving efficiency. The model checking analysis aids in identifying six potential designer-to-user communication problems: four involving effectiveness and two involving efficiency. Case study results indicate that BIGSIS shows promise for identifying potential instances of ineffective and inefficient designer-to-user communication in the design of a complex, safety-critical system interface.

Quantitative Analysis of Consistency in NoSQL Key-Value Stores

The promise of high scalability and availability has prompted many companies to replace traditional relational database management systems (RDBMS) with NoSQL key-value stores. This comes at the cost of relaxed consistency guarantees: key-value stores only guarantee eventual consistency in principle. In practice, however, many key-value stores seem to offer stronger consistency. Quantifying how well consistency properties are met is a non-trivial problem. We address this problem by formally modeling key-value stores as probabilistic systems and quantitatively analyzing their consistency properties by both statistical model checking and implementation evaluation. We present for the first time a formal probabilistic model of Apache Cassandra, a popular NoSQL key-value store, and quantify how much Cassandra achieves various consistency guarantees under various conditions. To validate our model, we evaluate multiple consistency properties using two methods and compare them against each other. The two methods are: (1) an implementation-based evaluation of the source code; and (2) a statistical model checking analysis of our probabilistic model.

Parametric multisingular hybrid Petri nets: Formal definitions and analysis techniques

Multisingular hybrid Petri net (MSHPN) is an extension of hybrid Petri nets enriched with the capabilities of hybrid automata to achieve the practical expressive power of multisingular hybrid automata. In this paper, we define parametric multisingular hybrid Petri nets (P-MSHPNs), as a parametric extension of MSHPNs. We present the parametric reachability analysis techniques and algorithms and prove that the parametric reachability analysis of P-MSHPNs amounts to the analysis of standard MSHPNs. Once the parametric state space of a P-MSHPNs model is computed, it can either be used for parametric model checking analysis using the existing techniques or be instantiated to obtain non-parametric state spaces. P-MSHPNs models can be analysed to obtain the set of feasible configurations for the system parameters. We also give a method for deriving the set of constraints on the parameters that ensure the correctness of an invariant property and a method for finding the optimum parameter configuration.

Probabilistic Model Checking Analysis of Palytoxin Effects on Cell Energy Reactions of the Na+/K+-ATPase

Probabilistic model checking (PMC) is a technique used for the specification and analysis of complex systems. It can be applied directly to biological systems which present these characteristics, including cell transport systems. These systems are structures responsible for exchanging ions through the plasma membrane. Their correct behavior is essential for animal cells, since changes on those are responsible for diseases. In this work, PMC is used to model and analyze the effects of the palytoxin toxin (PTX) interactions with one of these systems. Our model suggests that ATP could inhibit PTX action. Therefore, individuals with ATP deficiencies, such as in brain disorders, may be more susceptible to the toxin. We have also used heat maps to enhance the kinetic model, which is used to describe the system reactions. The map reveals unexpected situations, such as a frequent reaction between unlikely pump states, and hot spots such as likely states and reactions. This type of analysis provides a better understanding on how transmembrane ionic transport systems behave and may lead to the discovery and development of new drugs to treat diseases associated to their incorrect behavior.

Period Selection for Minimal Hyperperiod in Periodic Task Systems

Task period selection is often used to adjust the workload to the available computational resources. In this paper, we propose a model where each selected period is not restricted to be a natural number, but can be any rational number within a range. Under this generalization, we contribute a period selection algorithm that yields a much smaller hyperperiod than that of previous works: with respect to the largest period, the hyperperiod with integer constraints is exponentially bounded; with rational periods the worst case is only quadratic. By means of an integer approximation at each task activation, we show how our rational period approach can work under system clock granularity; it is thus compatible with scheduling analysis practice and implementation. Our finding has practical applications in several fields of real-time scheduling: lowering complexity in table driven schedulers, reducing search space in model checking analysis, generating synthetic workload for statistical analysis of real-time scheduling algorithms, etc.

Is my configuration any good: checking usability in an interactive sensor-based activity monitor

We investigate formal analysis of two aspects of usability in a deployed interactive, configurable and context-aware system: an event-driven, sensor-based homecare activity monitor system. The system was not designed from formal requirements or specification: we model the system as it is in the context of an agile development process. Our aim was to determine if formal modelling and analysis can contribute to improving usability, and if so, which style of modelling is most suitable. The purpose of the analysis is to inform configurers about how to interact with the system, so the system is more usable for participants, and to guide future developments. We consider redundancies in configuration rules defined by carers and participants and the interaction modality of the output messages.Two approaches to modelling are considered: a deep embedding in which devices, sensors and rules are represented explicitly by data structures in the modelling language and non-determinism is employed to model all possible device and sensor states, and a shallow embedding in which the rules and device and sensor states are represented directly in propositional logic. The former requires a conventional machine and a model-checker for analysis, whereas the latter is implemented using a SAT solver directly on the activity monitor hardware. We draw conclusions about the role of formal models and reasoning in deployed systems and the need for clear semantics and ontologies for interaction modalities.

A design methodology for verified web-service mediators

A new web service can be built by combining existing web services and coordinating their actions by a ‘mediator’. This work presents a formal design methodology based on model checking that generates all the mediator designs that meet requirements specified by a user. The methodology allows the user to explore the designs in search of the mediator that offers the best theoretical performance. Markov models of various measures of performance are considered. Each measure may result in a different ranking of the mediator designs (from best to worst for example). From these rankings the user can select the design that at least theoretically best fits the purpose. The novelty of this work is the use of model checking and Markov analysis in a single formal framework to generate, explore, and select from a set of provably-correct mediators—while still in the design stage of development.

Model Checking Analysis of Semantically Annotated Business Processes

Semantic business processes require new analysis techniques able to deal with behavioral properties that also consider semantic aspects. In this paper, a model checking method is introduced including semantic aspects in both the model description and the formula to be verified. In addition, Unary resource description framework (RDF) annotated Petri net systems, a formalism that allows the semantic description of business processes using RDF annotations, is formally defined and used to represent the input model of the model checker. Finally, the prototype implementations of both the Unary RDF annotated Petri net formalism and a model checker framework based on the use of RDF and SPARQL tools are also presented.

"Antelope": a hybrid-logic model checker for branching-time Boolean GRN analysis

BackgroundIn Thomas' formalism for modeling gene regulatory networks (GRNs), branching time, where a state can have more than one possible future, plays a prominent role. By representing a certain degree of unpredictability, branching time can model several important phenomena, such as (a) asynchrony, (b) incompletely specified behavior, and (c) interaction with the environment. Introducing more than one possible future for a state, however, creates a difficulty for ordinary simulators, because infinitely many paths may appear, limiting ordinary simulators to statistical conclusions. Model checkers for branching time, by contrast, are able to prove properties in the presence of infinitely many paths.ResultsWe have developed Antelope ("Analysis of Networks through TEmporal-LOgic sPEcifications", http://turing.iimas.unam.mx:8080/AntelopeWEB/), a model checker for analyzing and constructing Boolean GRNs. Currently, software systems for Boolean GRNs use branching time almost exclusively for asynchrony. Antelope, by contrast, also uses branching time for incompletely specified behavior and environment interaction. We show the usefulness of modeling these two phenomena in the development of a Boolean GRN of the Arabidopsis thaliana root stem cell niche.There are two obstacles to a direct approach when applying model checking to Boolean GRN analysis. First, ordinary model checkers normally only verify whether or not a given set of model states has a given property. In comparison, a model checker for Boolean GRNs is preferable if it reports the set of states having a desired property. Second, for efficiency, the expressiveness of many model checkers is limited, resulting in the inability to express some interesting properties of Boolean GRNs.Antelope tries to overcome these two drawbacks: Apart from reporting the set of all states having a given property, our model checker can express, at the expense of efficiency, some properties that ordinary model checkers (e.g., NuSMV) cannot. This additional expressiveness is achieved by employing a logic extending the standard Computation-Tree Logic (CTL) with hybrid-logic operators.ConclusionsWe illustrate the advantages of Antelope when (a) modeling incomplete networks and environment interaction, (b) exhibiting the set of all states having a given property, and (c) representing Boolean GRN properties with hybrid CTL.

Quantitative analysis of a certified e-mail protocol in mobile environments: A probabilistic model checking approach

Formal analysis techniques, such as probabilistic model checking, offer an effective mechanism for model-based performance and verification studies of communication systems’ behavior that can be abstractly described by a set of rules i.e., a protocol. This article presents an integrated approach for the quantitative analysis of the Certified E-mail Message Delivery (CEMD) protocol that provides security properties to electronic mail services. The proposed scheme employs a probabilistic model checking analysis and provides for the first time insights on the impact of CEMD’s error tolerance on computational and transmission cost. It exploits an efficient combination of quantitative analysis and specific computational and communication parameters, i.e., the widely used Texas Instruments TMS320C55x Family operating in an High Speed Downlink Packet Access (HSDPA) mobile environment, where multiple CEMD participants execute parallel sessions with high bit error rates (BERs). Furthermore, it offers a tool-assistant approach for the protocol designers and analysts towards the verification of their products under varying parameters. Finally, this analysis can be also utilized towards reliably addressing cost-related issues of certain communication protocols and deciding on their cost-dependent viability, taking into account limitations that are introduced by hardware specifications of mobile devices and noisy mobile environments.

A Rewriting-Logic-Based Technique for Modeling Thermal Systems

This paper presents a rewriting-logic-based modeling and analysis technique for physical systems, with focus on thermal systems. The contributions of this paper can be summarized as follows: (i) providing a framework for modeling and executing physical systems, where both the physical components and their physical interactions are treated as first-class citizens; (ii) showing how heat transfer problems in thermal systems can be modeled in Real-Time Maude; (iii) giving the implementation in Real-Time Maude of a basic numerical technique for executing continuous behaviors in object-oriented hybrid systems; and (iv) illustrating these techniques with a set of incremental case studies using realistic physical parameters, with examples of simulation and model checking analyses.

Scalable shared memory LTL model checking

Recent development in computer hardware has brought more widespread emergence of shared memory, multi-core systems. These architectures offer opportunities to speed up various tasks—model checking and reachability analysis among others. In this paper, we present a design for a parallel shared memory LTL model checker that is based on a distributed memory algorithm. To improve the scalability of our tool, we have devised a number of implementation techniques which we present in this paper. We also report on a number of experiments we conducted to analyse the behaviour of our tool under different conditions using various models. We demonstrate that our tool exhibits significant speedup in comparison with sequential tools, which improves the workflow of verification in general.

Advanced features in SMART

We describe some of the advanced features of the software tool SmArT, the Stochastic Model checking Analyzer for Reliability and Timing. Initially conceived as a software package for numerical solution and discrete-event simulation of stochastic models, SmArT now also provides powerful modelchecking capabilities, thanks to its extensive use of various forms of decision diagrams, which in turn also greatly increase the efficiency of its stochastic analysis algorithms. These aspects make it an excellent choice when tackling systems with extremely large state spaces.

Probabilistic Modeling and Analysis of DoS Protection for the ASV Protocol

The Adaptive Selective Verification (ASV) protocol was recently proposed as an effective and efficient DoS countermeasure within the shared channel model, in which clients and attackers probabilistically share communication bandwidth with the server. ASV has been manually shown to satisfy some desirable availability and bandwidth consumption properties. Due to the probabilistic nature of the protocol and its underlying attacker model, it is intrinsically difficult to build a faithful model of the protocol with which one may automatically verify its properties. This paper fills the gap between manual analysis and simulation-based experimental analysis of ASV, through automated formal analysis. We describe a formal model of ASV using probabilistic rewrite theories, implemented in a probabilistic extension of Maude, and show how it can be used to formally verify various characteristics of ASV through automated statistical quantitative model checking analysis techniques. In particular, we formally verify ASV's connection confidence theorem and a slightly more general bandwidth consumption theorem of ASV. This is followed by a statistical comparison of ASV with non-adaptive selective verification protocols. We conclude with remarks on possible further development and future work.

Architecture and inherent robustness of a bacterial cell-cycle control system

A closed-loop control system drives progression of the coupled stalked and swarmer cell cycles of the bacterium Caulobacter crescentus in a near-mechanical step-like fashion. The cell-cycle control has a cyclical genetic circuit composed of four regulatory proteins with tight coupling to processive chromosome replication and cell division subsystems. We report a hybrid simulation of the coupled cell-cycle control system, including asymmetric cell division and responses to external starvation signals, that replicates mRNA and protein concentration patterns and is consistent with observed mutant phenotypes. An asynchronous sequential digital circuit model equivalent to the validated simulation model was created. Formal model-checking analysis of the digital circuit showed that the cell-cycle control is robust to intrinsic stochastic variations in reaction rates and nutrient supply, and that it reliably stops and restarts to accommodate nutrient starvation. Model checking also showed that mechanisms involving methylation-state changes in regulatory promoter regions during DNA replication increase the robustness of the cell-cycle control. The hybrid cell-cycle simulation implementation is inherently extensible and provides a promising approach for development of whole-cell behavioral models that can replicate the observed functionality of the cell and its responses to changing environmental conditions.

Applying infinite state model checking and other analysis techniques to tabular requirements specifications of safety-critical systems

Although it is most often applied to finite state models, in recent years, symbolic model checking has been extended to infinite state models using symbolic representations that encode infinite sets. This paper investigates the application of an infinite state symbolic model checker called Action Language Verifier (ALV) to formal requirements specifications of safety-critical systems represented in the SCR (Software Cost Reduction) tabular notation. After reviewing the SCR method and tools, the Action Language for representing state machine models, and the ALV infinite state model checker, the paper presents experimental results of formally analyzing two SCR specifications using ALV. The application of ALV to verify or falsify (by generating counterexample behaviors) the state and transition invariants of SCR specifications and to check Disjointness and Coverage properties is described. The results of formal analysis with ALV are then compared with the results of formal analysis using techniques that have been integrated into the SCR toolset. Based on the experimental results, strengths and weaknesses of infinite state model checking with respect to other formal analysis approaches such as explicit and finite state model checking and theorem proving are discussed.

Automatic business process analysis and simulation based on DEMO

Enterprise process modelling as a core area of the Enterprises Information Systems (EIS) research has long attracted theoreticians of new concepts, designers of artefacts, and practitioners of modelling. As a result a vast number of modelling methods have been generated. However, each method is challenging because they lack certain aspects. First, these methods view processes as a flowchart, undermining the deep (nested) structure of processes. Second, most of these methods are based on informal or semi-formal representation, failing direct model checking and formal analysis without further translations and mapping procedures. Finally, because the majority of these methods originated from a computing perspective, their focal point is control-flow rather than interaction of social actors. In reality, an enterprise is a complex socio-technical system that includes interaction of technical and social components. In this paper, we discuss an innovative method that will address some of these challenges and provide an improved tool for this purpose. We base our method on the field-proven DEMO theory and methodology, where emphasis is made on the interactions between social actors. The proposed method encompasses a set of graphical notations and constructs based on the Petri nets semantics that allows direct model analysis and simulation.

Abstraction and Completeness for Real-Time Maude

This paper presents criteria that guarantee completeness of Real-Time Maude search and temporal logic model checking analyses, under the maximal time sampling strategy, for a large class of real-time systems. As a special case, we characterize simple conditions for such completeness for object-oriented real-time systems, and show that these conditions can often be easily proved even for large and complex systems, such as advanced wireless sensor network algorithms and active network multicast protocols. Our results provide completeness and decidability of time-bounded search and model checking for a large and useful class of dense-time non-Zeno real-time systems far beyond the class of automaton-based real-time systems for which well known decision procedures exist. For discrete time, our results justify abstractions that can drastically reduce the state space to make search and model checking analyses feasible.