Model Checking Research Articles

Safe and reconfigurable manufacturing: safety aware multi-agent control for Plug & Produce system

Plug & Produce aims to revolutionize manufacturing by enabling seamless machine integration into production processes without extensive programming. This concept, leveraging multi-agent systems (MAS), offers increased flexibility and faster production ramp-up times after reconfiguration. As automated manufacturing moves towards greater human integration, this paper addresses safe operation within the Plug & Produce concept. The main safety challenge arises from autonomous decision-making, as agents in the MAS lack awareness of the risk consequences of their behavior. Additionally, the difficulty of perceiving the system’s exact behavior leads to the implementation of overly restrictive safety measures. This limits the system’s flexibility and ability to make decisions for efficient production. This paper proposes a method utilizing multi-agent control to conduct automatic safety analysis and reason task allocations to avoid risks. The method’s benefits are the generation of control actions that comply with safety requirements during operation, eliminating the need for overly restrictive safety measures and allowing more effective equipment utilization. The method’s benefit is illustrated through a manufacturing scenario with two different configurations: one using a hazardous machine and the other using a less hazardous one. Formal verification using the model checker NuSMV demonstrated that safety requirements were satisfied in both configurations, without the need for manual modifications of the safety control system after reconfiguration. The results for this specific manufacturing scenario showed that there are more reachable states (20 states) in the safer second configuration, compared to the first configuration (16 states). This means that the presented control strategy dynamically adjusts the system’s behavior to confirm safety. Hence, this method maintains safety without fixed safety rules that limit the operations.

Generalized possibility computation tree logic with frequency and its model checking

In recent years, there has been significant research in the field of possibilistic temporal logic. However, existing works have not yet addressed the issue of frequency, which is a common form of uncertainty in the real world. This article aims to fill this gap by incorporating frequency information into possibilistic temporal logic and focusing on the model-checking problem of generalized possibility computation tree logic (GPoCTL) with frequency information. Specifically, we introduce generalized possibility computation tree logic with frequency (GPoCTLF). Although its syntax can be considered as an extension of frequency constraints of the always operator (□) in GPoCTL, they are fundamentally different in semantics and model-checking methods. To facilitate this extension, useful frequency words such as “always”, “usually”, “often”, “sometimes”, “occasionally”, “rarely”, “hardly ever” and “never” are defined as fuzzy frequency operators in this article. Therefore, this article focuses on investigating the model-checking problem of the frequency-constrained always operator. In addition, we analyze the relationship between some GPoCTLF path formulas and GPoCTL path formulas. Then, we provide a model-checking algorithm for GPoCTLF and analyze its time complexity. Finally, an example of a social network is used to illustrate the calculation process of the proposed method and its potential applications.

A Transferability Study of Interpolation-Based Hardware Model Checking for Software Verification

A Transferability Study of Interpolation-Based Hardware Model Checking for Software Verification

Evaluation of visual property specification languages based on practical model-checking experience

Formal verification methods like model checking can provide mathematical proofs of design correctness, so their use is justified in applications where safety or reliability requirements are high. A key challenge for the wider adoption of model checking is the effort and expertise needed in formalizing functional requirements into verifiable properties. A particular challenge in specifying formal properties for industrial instrumentation and control (I&C) logics is accounting for the sequencing and timing issues that arise from, e.g., the dynamic behavior of the plant being controlled. In this paper, we evaluate different visual property specification languages that are aimed at making formal methods more accessible. We have collected 3923 formal properties from practical model checking projects in the nuclear and rail traffic industries and identified the most commonly occurring types of properties. Based on the sample data, a real-world example logic, and our practical experience, we identify requirements for a user-friendly property specification language most suited for our specific domain of industrial I&C.

End-to-End Statistical Model Checking for Parameterization and Stability Analysis of ODE Models

We propose a simulation-based technique for the parameterization and the stability analysis of parametric Ordinary Differential Equations. This technique is an adaptation of Statistical Model Checking, often used to verify the validity of biological models, to the setting of Ordinary Differential Equations systems. The aim of our technique is to estimate the probability of satisfying a given property under the variability of the parameter or initial condition of the ODE, with any metrics of choice. To do so, we discretize the values space and use statistical model checking to evaluate each individual value w.r.t. provided data. Contrary to other existing methods, we provide statistical guarantees regarding our results that take into account the unavoidable approximation errors introduced through the numerical integration of the ODE system performed while simulating. In order to show the potential of our technique, we present its application to two case studies taken from the literature, one relative to the growth of a jellyfish population, and the other concerning a well-known oscillator model.

Timed Automata-Based Strategy for Controlling Drone Access to Critical Zones: A UPPAAL Modeling Approach

Controlling access to critical zones by drones is crucial for ensuring safety and efficient operations in various applications. In this research, we propose a strategy for controlling the access of a set of drones to a critical zone using timed automata and UPPAAL. UPPAAL is a model checker and simulator for real-time systems, which allows for the modeling, simulation, and verification of timed automata. Our system consists of six drones, a controller, and a buffer, all modeled as timed automata. We present a formal model capturing the behavior and interactions of these components, considering the constraints of allowing only one drone in the critical zone at a time. Timed automata are a powerful formalism for modeling and analyzing real-time systems, as they can capture the temporal aspects of system behavior. The advantages of using timed automata include the ability to model time-critical systems, analyze safety and liveness properties, and verify the correctness of the system. We design a strategy that involves signaling the approaching drones, preventing collisions, and ensuring orderly access to the critical zone. We utilize UPPAAL for simulating and verifying the system, including the evaluation of properties such as validation properties, safety properties, liveness properties, and absence of deadlocks. However, a limitation of timed automata is that they can become complex and difficult to model for large-scale systems, and the analysis can be computationally expensive as the number of components and behaviors increases. Through simulations and formal verification, we demonstrate the effectiveness and correctness of our proposed strategy. The results highlight the ability of timed automata and UPPAAL to provide reliable and rigorous analysis of drone access control systems. Our research contributes to the development of robust and safe strategies for managing drone operations in critical zones.

P-289 Optimising the detection of obliterated Pouch of Douglas for endometriosis diagnosis, by combining unpaired endometriosis ultrasounds and magnetic resonance imaging using Artificial Intelligence

Abstract Study question Can we improve the diagnostic accuracy of the detection of POD obliteration in endometriosis magnetic resonance imaging, by leveraging results from unpaired eTVUS data sets? Summary answer We illustrate effective multimodal analysis methods improve POD obliteration detection accuracy from eMRI datasets, with an Area Under the Curve (AUC) from 65.0% to 90.6%. What is known already Traditionally, women investigated for pelvic pain and endometriosis, wait 6.4 years for laparoscopic diagnosis. There is a need for a more timely, non-invasive, accessible diagnostic tool. IMAGENDO is designed to combine eTVUS and eMRI using Artificial Intelligence (AI) to address this delay. We have previously demonstrated detection of pelvic endometriosis, including Pouch of Douglas (POD) obliteration, has a 95% specificity from endometriosis ultrasounds (eTVUS) and 72% from endometriosis magnetic resonance imaging (eMRI). This preliminary data has shown our novel multimodal AI approach, using imaging data from eTVUS and eMRIs, can improve diagnostic accuracy when detecting POD obliteration in endometriosis. Study design, size, duration The IMAGENDO study is a program of research designed to create a new diagnostic algorithm for endometriosis. The first part of the study describes the development of our initial algorithm using retrospective cross sectional transvaginal ultrasounds (n = 749), and magnetic resonance images (n = 89 private, n = 8984 public) from 9822 participants overall aged 18 to 45 years, collected between September 2011 and September 2022. Participants/materials, setting, methods Using public MRIs, we pre-trained a machine learning model, and fine-tuned the algorithm using private eMRIs to detect POD obliteration. Then unpaired eTVUSs were introduced to further improve our diagnostic model. We used a machine learning method known as Masked Autoencoder pretraining, which is unsupervised learning reconstructing masked data to generate a larger dataset. Then we embedded the data, compressing a large dataset into a small representation with the most salient features. Main results and the role of chance Scant training samples limited the generalisability of a 3D Vision Transformer to classify POD obliteration from MRI volumes, with an Area Under the Curve (AUC) of 65.0%. However, the masked auto-encoder pre-training partially mitigates this issue, improving the AUC to 87.2%. Adding knowledge distillation, and training a 3D Vision Transformer from scratch on such a small dataset is still challenging, with an AUC of 66.7%. However, adding both together: The knowledge distillation performance of 3D Vision Transformer with masked auto-encoder pre-training reaches an AUC of 77.2%, worse than without knowledge distillation, with an AUC of 87.2%. This could be due to the excessive domain shift between the pre-training dataset and TVUS dataset. However, fine-tuning the model from masked auto-encoder pre-training, the model improves accuracy from AUC=87.2% to AUC=90.6%. With all the steps using unmatched imaging from an alternative modality, this model ultimately demonstrated improvement in the AUC from 65% to 90% on our private MRI dataset. This is the first POD obliteration detection method that distils knowledge from TVUS to MRI using unpaired data, aiming to improve diagnostic accuracy of endometriosis from MRI; and the first machine learning method automatically detecting POD obliteration from MRI data to diagnose endometriosis. Limitations, reasons for caution Our eMRI datasets had some confounding problems, present as a result of artefacts, mislabelling, and misreporting. These were resolved using model checking, student auditing and expert radiology review. We will further test our algorithm with a diagnostic test accuracy study on at least two test cohorts. Wider implications of the findings Pre-training using digital data from different imaging modalities can improve the diagnosis of endometriosis especially when either imaging modality is missing. Provided specialist scanning is available, women with endometriosis will be able to obtain faster diagnosis prior to surgery. Trial registration number ACTRN12623000646640

A decentralized model for usage and information flow control in distributed systems

Data usage control enables data owners to enforce policies for their data, by defining authorizations, but also obligations, which are actions to be performed before, during or after being granted access such as accepting web cookies, and conditions bearing on the system and environment attributes, e.g., the time. Usage control is often coupled with information flow control to monitor how data are propagated. While usage control is well established and modeled in centralized systems, the literature has only partially addressed usage control for distributed systems, for instance by distributing the usage control system components. However, when it comes to assigning policy to certain data, it is always enforced by a central authority. This paper proposes an extended usage control model to integrate decentralized information flow control (DIFC), which enables users to decide collectively which policy to apply to their common data. Functions to handle connection status aspects are also considered, for dynamic Internet of Things (IoT) or peer-to-peer networks where parts of the distributed network can be disconnected. Architectural aspects and formal definitions to enable decentralized policies for shared data are proposed as a novelty, resulting from the integration of DIFC. We used the TLA+ formal specification language on the proposed model and its attached model checker TLC to detect potential issues. We detected potential deadlocks due to the new connection functions as well as temporal ordering issues then suggested mitigations accordingly. A privacy analysis is provided using a car-sharing scenario to highlight the benefits of usage control.

LEVERAGING MBSE USAGE THROUGH MODEL CHECKERS

AbstractSystem modeling is an essential part of the systems engineering process, helping with the design, analysis, and communication of complex systems. The usage of modeling languages like SysML and UML has become increasingly prevalent in this domain. To ensure the “3C” of validation of these models (correctness, completeness and consistency), model checkers play an important aspect.This paper discusses the role of model checkers in the validation of system models, and their importance in adopting MBSE approach with a quick benefit to system engineers. Different possible implementations are presented including one based on an ontology able to take advantage of semantic analyses. Finally, in order to deal with the number of issues due to the complexity of our models, we suggest correcting them regarding the goal of the model and the project milestones. This last point implies the need of an issue acknowledgement feature making it possible to justify the temporary or definitive rejection of these issues.

Leveraging Datapath Propagation in IC3 for Hardware Model Checking

Leveraging Datapath Propagation in IC3 for Hardware Model Checking

Attacking Connection Tracking Frameworks as used by Virtual Private Networks

VPNs (Virtual Private Networks) have become an essential privacy-enhancing technology, particularly for at-risk users like dissidents, journalists, NGOs, and others vulnerable to targeted threats. While previous research investigating VPN security has focused on cryptographic strength or traffic leakages, there remains a gap in understanding how lower-level primitives fundamental to VPN operations, like connection tracking, might undermine the security and privacy that VPNs are intended to provide. In this paper, we examine the connection tracking frameworks used in common operating systems, identifying a novel exploit primitive that we refer to as the port shadow. We use the port shadow to build four attacks against VPNs that allow an attacker to intercept and redirect encrypted traffic, de-anonymize a VPN peer, or even portscan a VPN peer behind the VPN server. We build a formal model of modern connection tracking frameworks and identify that the root cause of the port shadow lies in five shared, limited resources. Through bounded model checking, we propose and verify six mitigations in terms of enforcing process isolation. We hope our work leads to more attention on the security aspects of lower-level systems and the implications of integrating them into security-critical applications.

Formal timing analysis of gate-level digital circuits using model checking

Due to the continuous reduction in the transistors sizing ruled by the Moore’s law, digital devices have become smaller, and more complex resulting in an enormous rise in the delay variations. Therefore, there is a dire need of precise and rigorous timing analysis to overcome anomalies during the timing analysis. Timings of digital circuits can be verified using various simulation or static timing analysis (STA) based tools but they provide estimated results due to their inherent in-exhaustive nature or report timing paths corresponding to non-existent functional paths, respectively. Formal verification provides complete and sound analysis results and has widely been used for the functional verification of digital circuits but its application in the timing analysis domain is somewhat limited. We present a generic framework to perform formal timing analysis of digital circuits with the help of Uppaal model-checker. The given digital circuit along with its timing parameters in the form of state transition diagram are modeled using timed automata in the Uppaal model checker. Timing delays are calculated from corresponding technology parameters, and Quartus Prime Pro is used to obtain the information about the circuits’ paths. In order to make the analysis scalable, we also propose a novel path partitioning technique and compare its results with complete path analysis and traditional STA. The formal model is verified with the help of properties to assess the timing characteristics, like time period of a clock, critical path, and propagation delay of the considered circuit. Modeling and verification of ISCAS-85 and ISCAS-89 benchmark circuits is presented for illustration purposes.

Correctness Verification of Mutual Exclusion Algorithms by Model Checking

Mutual exclusion algorithms are at the heart of concurrent/parallel and distributed systems. It is well known that such algorithms are very difficult to analyze, and in the literature, different conjectures about starvation freedom and the number of by-passes (also called the overtaking factor) exist. The overtaking factor affects the (hopefully) bounded waiting time that a process competing for entering the critical section has to suffer before accessing the shared resource. This paper proposes a novel modeling approach based on Timed Automata and the Uppaal toolset, which proves effective for studying all the properties of a mutual exclusion algorithm for N≥2 processes, by exhaustive model checking. Although the approach, as already confirmed by similar experiments reported in the literature, is not scalable due to state explosion problems and can be practically applied until N≤5, it is of great value for revealing the true properties of analyzed algorithms. For dimensions N>5, the Statistical Model Checker of Uppaal can be used, which, although based on simulations, can confirm properties by estimations and probabilities. This paper describes the proposed modeling and verification method and applies it to several mutual exclusion algorithms, thus retrieving known properties but also showing new results about properties often studied by informal reasoning.

Specification and Verification of Multi-Clock Systems Using a Temporal Logic with Clock Constraints

The polychronous or multi-clock paradigm is adequate to model large distributed systems where achieving a full timed synchronization is not only very costly but also often not necessary. It concerns systems made of a set of components with loose synchronization constraints. We study an approach where those components are orchestrated using logical clocks , made popular by L. Lamport and synchronous languages. The temporal and causal specification of those systems is built by defining a set of clock relations that would constrain the instant when clocks can tick or must not tick, thus defining families of valid schedules . In this article, we propose a specification language, called \(\mathit {LTL}_c/\mathit {CCSL}\) , for specifying temporal properties of multi-clock systems. While traditional temporal logics (LTL, MTL, CTL*), whether linear or branching, rely on a global step, our language, \(\mathit {LTL}_c/\mathit {CCSL}\) , builds a partial order on logical clocks, thus allowing both a hierarchical approach based on refinement of clock hierarchies and compositionality, as what happens in one clock domain may remain largely independent of what may happen in other domains. This good property helps preserve the properties without requiring to perform the proofs again. An \(\mathit {LTL}_c/\mathit {CCSL}\) specification consists of a clock temporal logic \(\mathit {LTL}_c\) , accompanied by a clock calculus called CCSL for specifying clock relations. We build the syntax and semantics of \(\mathit {LTL}_c\) and link its semantics with CCSL. After that, we mainly focus on the verification aspect of \(\mathit {LTL}_c/\mathit {CCSL}\) specifications using a model checking technique. We show how \(\mathit {LTL}_c/\mathit {CCSL}\) can be used for specifying multi-clock systems with an example.

FuSeBMC v4: Improving Code Coverage with Smart Seeds via BMC, Fuzzing and Static Analysis

Bounded model checking (BMC) and fuzzing techniques are among the most effective methods for detecting errors and security vulnerabilities in software. However, there are still shortcomings in detecting these errors due to the inability of existing methods to cover large areas in target code. We propose FuSeBMC v4, a test generator that synthesizes seeds with useful properties, that we refer to as smart seeds , to improve the performance of its hybrid fuzzer thereby achieving high C program coverage. FuSeBMC works by first analyzing and incrementally injecting goal labels into the given C program to guide BMC and Evolutionary Fuzzing engines. After that, the engines are employed for an initial period to produce the so–called smart seeds. Finally, the engines are run again, with these smart seeds as starting seeds, in an attempt to achieve maximum code coverage/find bugs. During seed generation and normal running, the Tracer subsystem aids coordination between the engines. This subsystem conducts additional coverage analysis and updates a shared memory with information on goals covered so far. Furthermore, the Tracer evaluates test-cases dynamically to convert cases into seeds for subsequent test fuzzing. Thus, the BMC engine can provide the seed that allows the fuzzing engine to bypass complex mathematical guards (e.g., input validation). As a result, we received three awards for participation in the fourth international competition in software testing (Test-Comp 2022), outperforming all state-of-the-art tools in every category, including the coverage category.

Modeling and Verification of Natural Language Requirements based on States and Modes

The relationship between states (status of a system) and modes (capabilities of a system) used to describe system requirements is often poorly defined. The unclear relationship could make systems of interest out of control because of the out of boundaries of the systems caused by the newly added modes. Formally modeling and verifying requirements can clarify the relationship, making the system safer. To this end, an innovative approach to analyzing requirements is proposed. The MoSt language (a Domain Specific Language implemented on the Xtext framework) is firstly designed for requirements modeling and a model validator is realized to check requirements statically. A code generator is then provided to realize the automatic model transformation from the MoSt model to a NuSMV model, laying the foundation for the dynamic checks of requirements through symbolic model checking. Next, a NuSMV runner is designed to connect the NuSMV with the validator to automate the whole dynamic checks. The grammar, the model validator, the code generator, and the NuSMV runner are finally integrated into a publicly available Eclipse-based tool. Two case studies have been employed to illustrate the feasibility of our approach. For each case study, we injected 14 errors. The results show that the static and dynamic checks can successfully detect all the errors.

Formal dependability analysis of fault tolerant Virtual Machine allocation strategies in Cloud Radio Access Network

Cloud Radio Access Network (C-RAN) has been proposed as a fifth generation (5G) cellular network that is designed to physically separate the Baseband Units (BBUs) from the Remote Radio Heads (RRHs). The BBUs are placed in the BBU pool/hotel, while the RRHs are located in the cells. This separation enables sharing baseband processing resources among RRHs by generating Virtual Machines (VMs) in the BBU pool, leading to radio coordination and energy saving opportunities. Nevertheless, the failure of a BBU can affect several RRHs, causing outages in the radio network. Therefore, designing a reliable and resilient C-RAN is essential to provide high availability and service continuity in case of BBU failure. This paper deals with using formal verification techniques to analyze the performance and the dependability of C-RAN architecture. We propose fault tolerant VM allocation strategies that can handle BBU failures, thus improving the system’s overall reliability. Based on redundancy techniques, these strategies ensure call recovery through migration to functional BBUs in the case of a BBU failure. In order to evaluate the mutual impact of performance measures on the system’s dependability, we develop performability (combination of performance and dependability) Markov Reward Models (MRMs) for the proposed strategies. We use Probabilistic Model Checking (PMC) to check the performability requirements written with Continuous Stochastic Reward Logic (CSRL). The proposed models are implemented and checked using the PRISM model checker, which supports solving MRMs and checking CSRL properties.

Linear-time logics -- a coalgebraic perspective

We describe a general approach to deriving linear-time logics for a wide variety of state-based, quantitative systems, by modelling the latter as coalgebras whose type incorporates both branching and linear behaviour. Concretely, we define logics whose syntax is determined by the type of linear behaviour, and whose domain of truth values is determined by the type of branching behaviour, and we provide two semantics for them: a step-wise semantics akin to that of standard coalgebraic logics, and a path-based semantics akin to that of standard linear-time logics. The former semantics is useful for model checking, whereas the latter is the more natural semantics, as it measures the extent with which qualitative properties hold along computation paths from a given state. Our main result is the equivalence of the two semantics. We also provide a semantic characterisation of a notion of logical distance induced by these logics. Instances of our logics support reasoning about the possibility, likelihood or minimal cost of exhibiting a given linear-time property.

Synthesis and Verification of Mission Plans for Multiple Autonomous Agents under Complex Road Conditions

Mission planning for multi-agent autonomous systems aims to generate feasible and optimal mission plans that satisfy given requirements. In this article, we propose a tool-supported mission-planning methodology that combines (i) a path-planning algorithm for synthesizing path plans that are safe in environments with complex road conditions, and (ii) a task-scheduling method for synthesizing task plans that schedule the tasks in the right and fastest order, taking into account the planned paths. The task-scheduling method is based on model checking, which provides means of automatically generating task execution orders that satisfy the requirements and ensure the correctness and efficiency of the plans by construction. We implement our approach in a tool named MALTA, which offers a user-friendly GUI for configuring mission requirements, a module for path planning, an integration with the model checker UPPAAL, and functions for automatic generation of formal models, and parsing of the execution traces of models. Experiments with the tool demonstrate its applicability and performance in various configurations of an industrial case study of an autonomous quarry. We also show the adaptability of our tool by employing it in a special case of an industrial case study.

An automatic radiomic-based approach for disease localization: A pilot study on COVID-19

Radiomics is an innovative field in Personalized Medicine to help medical specialists in diagnosis and prognosis. Mainly, the application of Radiomics to medical images requires the definition and delimitation of the Region Of Interest (ROI) on the medical image to extract radiomic features. The aim of this preliminary study is to define an approach that automatically detects the specific areas indicative of a particular disease and examines them to minimize diagnostic errors associated with false positives and false negatives. This approach aims to create a nxn grid on the DICOM image sequence and each cell in the matrix is associated with a region from which radiomic features can be extracted.The proposed procedure uses the Model Checking technique and produces as output the medical diagnosis of the patient, i.e., whether the patient under analysis is affected or not by a specific disease. Furthermore, the matrix-based method also localizes where appears the disease marks. To evaluate the performance of the proposed methodology, a case study on COVID-19 disease is used. Both results on disease identification and localization seem very promising. Furthermore, this proposed approach yields better results compared to methods based on the extraction of features using the whole image as a single ROI, as evidenced by improvements in Accuracy and especially Recall. Our approach supports the advancement of knowledge, interoperability and trust in the software tool, fostering collaboration among doctors, staff and Radiomics.