Model Checking Of Programs Research Articles

Model checking programs in process-oriented IEC 61131-3 Structured Text

The process-oriented programming is a paradigm based on the process concept where each process is a concurrent finite state machine inside. The paradigm is intended for PLC (programmable logic controllers) developers to write Industry 4.0-enabled software. The poST language is a promising process-oriented extension of the IEC 61131-3 Structured Text (ST) language designed to provide a conceptual consistency of the PLC source code with technological description of the process under control. This language combines the advantages of FSM-based programming with the standard syntax of the ST language. We propose transformational semantics of poST providing rules for translation of poST language statements to Promela — the input language of the SPIN model checker. Following these semantic rules, our Xtext-based translator outputs a Promela model for the poST program. Our contribution is the poST transformational semantics and the method for automatic generation of the Promela code from poST control programs. The resulting Promela program is ready to be verified with SPIN model checker against linear temporal logic requirements to the source poST program. In the paper we provide an overview of related work, as well as a brief description of the poST and Promela languages. Further, the Promela poST translation rules cover control flow statements, process creation and state management constructs, and timeout management. Then we define service processes for modeling the external environment and managing high-level LTL specifications. Then we present the main ideas of implementing the translator poST to Promela. We also illustrate our approach using the example of a system for managing electricity consumption and production, including renewable sources.

SMT-based verification of program changes through summary repair

This article provides an innovative approach for verification by model checking of programs that undergo continuous changes. To tackle the problem of repeating the entire model checking for each new version of the program, our approach verifies programs incrementally. It reuses computational history of the previous program version, namely function summaries. In particular, the summaries are over-approximations of the bounded program behaviors. Whenever reusing of summaries is not possible straight away, our algorithm repairs the summaries to maximize the chance of reusability of them for subsequent runs. We base our approach on satisfiability modulo theories (SMT) to take full advantage of lightweight modeling approach and at the same time the ability to provide concise function summarization. Our approach leverages pre-computed function summaries in SMT to localize the checks of changed functions. Furthermore, to exploit the trade-off between precision and performance, our approach relies on the use of an SMT solver, not only for underlying reasoning, but also for program modeling and the adjustment of its precision. On the benchmark suite of primarily Linux device drivers versions, we demonstrate that our algorithm achieves an order of magnitude speedup compared to prior approaches.

An algorithm of parallel model checking programs with conditions based on adjustable predicate abstraction coding

Introduction: Model checking is always considered as a logical analysis of a programme which evolves various challenges in the stages of verification. The abstraction model checking reduces the complexity of the process by translating the programme into a scale down version. Main challenge of model checking is that the space explosion may lead to a verification failure because of limited memory, timeout or space out. This giving-up result was never reported back before, which wouldn’t provide analysts much useful information about the system. Aim: The process of abstraction coding has great relevancy in designing biological systems at molecular level. Development of abstraction hierarchies in biological engineering will help us further in categorizing the biological networks. Materials and Methods: This paper combines several state-of-art model checkers, and adjusts predicate abstraction blocks dynamically during the verification of biological sequences. In this way when it comes to a verification failure, our algorithm will record and report an abstract version of path from the starting state to the current one. The reported paths could be used as an evidence for designers to review the programs. Results and Conclusion: Our experiments show that based on the advantages of implementing different model checkers serially, we use message-passing to execute our algorithm to obtain a better performance. At last the parallel version of our methods outperform some of the popular algorithms as the system scale grows, which has wide applications in computer, biomedical and other disciplines.

Proposing and verifying a security-enhanced protocol for IoT-based communication for medical devices

Internet of things technology has recently drawn much attention across industries. IoT technology has gradually been applied to industries and everyday life in general including healthcare, where people can access hospital information systems to view personal health and medical information. Still, due to security vulnerabilities, personal health and medical information is prone to hacking attacks. Thus, concerns over privacy invasion have come to the fore, and at the same time security issues are considered to override information services. This paper proposes a communication protocol based on hash lock, session keys, random numbers and security keys designed to be safe against intruders' hacking attempts in information communication between medical devices. Instead of arguing for the safety of the proposed protocol with mathematical theorem proving as in prior research on protocol proving, this paper verifies the safety of the proposed authentication protocol against a range of attacks using a model checking program, Casper/FDR program. In brief, the proposed communication protocol for medical devices is safe and secure against diverse attacks.

Stateless model checking for TSO and PSO

We present a technique for efficient stateless model checking of programs that execute under the relaxed memory models TSO and PSO. The basis for our technique is a novel representation of executions under TSO and PSO, called chronological traces. Chronological traces induce a partial order relation on relaxed memory executions, capturing dependencies that are needed to represent the interaction via shared variables. They are optimal in the sense that they only distinguish computations that are inequivalent under the widely-used representation by Shasha and Snir. This allows an optimal dynamic partial order reduction algorithm to explore a minimal number of executions while still guaranteeing full coverage. We apply our techniques to check, under the TSO and PSO memory models, LLVM assembly produced for C/pthreads programs. Our experiments show that our technique reduces the verification effort for relaxed memory models to be almost that for the standard model of sequential consistency. This article is an extended version of Abdulla et al. (Tools and algorithms for the construction and analysis of systems, Springer, New York, pp 353–367, 2015), appearing in TACAS 2015.

A framework for model checking UDP network programs with Java pathfinder

Complex asynchronous, distributed systems could benefit significantly from model checking, but model checking programs do not natively support verification of distributed software. Several frameworks have been developed recently that apply model checking to networked software, but none of these frameworks support complete modeling of programs that use the User Datagram Protocol (UDP). This paper presents the first framework to model realistic rather than ideal UDP network operations using Java Pathfinder, and describes its use in verifying a distributed UDP-based application.

Toward a backward model checking

This paper presents a new method of program verification, backward incremental model checking (BIMC). BIMC is a backward compositional technique to check, statically safety properties of C programs. A program is a hierarchy of blocks. Blocks are analysed in reverse order until we prove or disprove property. To our knowledge, it is the first work dealing with program model checking in a backward way. We define a new method: ASMA for program modelling. ASMA allows separating a program into two components: the data model and the control model. This approach allows an easy program manipulation. BIMC starts the verification with a minimal set P0 which is then incrementally extended each time needed. The weakest precondition concept is applied on the two models in an adequate and incremental way. BIMC allows handling programs containing function calls and pointers. All the techniques described in this paper are illustrated by clarifying examples.

Formal Verification, Engineering and Business Value

How to apply automated verification technology such as model checking and static program analysis to millions of lines of embedded C/C++ code? How to package this technology in a way that it can be used by software developers and engineers, who might have no background in formal verification? And how to convince business managers to actually pay for such a software? This work addresses a number of those questions. Based on our own experience on developing and distributing the Goanna source code analyzer for detecting software bugs and security vulnerabilities in C/C++ code, we explain the underlying technology of model checking, static analysis and SMT solving, steps involved in creating industrial-proof tools.

Conditioning for State Space Reduction in Program Model Checking

Conditioning for State Space Reduction in Program Model Checking

Model checking education for software engineers in Japan

This paper is the preliminary report of a joint research project on developing a body of knowledge on model checking. The project is being carried out by four organizations that give model checking courses to software engineers in Japan. The paper explains the main objective of the project and reports the results of an evaluation of model checking programs.

VyrdMC: Driving Runtime Refinement Checking with Model Checkers

This paper presents VyrdMC, a runtime verification tool we are building for concurrent software components. The correctness criterion checked by VyrdMC is refinement: Each execution of the implementation must be consistent with an atomic execution of the specification. VyrdMC combines testing, model checking, and Vyrd, the runtime refinement checker we developed earlier. A test harness first drives the component to a non-trivial state which serves as the starting state for a number of simple, very small multi-threaded test cases. An execution-based model checker explores for each test case all distinct thread interleavings while Vyrd monitors executions for refinement violations. This combined approach has the advantage of improving the coverage of runtime refinement checking at modest additional computational cost, since model checkers are only used to explore thread interleavings of a small, fixed test program. The visibility and detailed checking offered by using refinement as the correctness criterion differentiate our approach from simply being a restricted application of model checking. An important side benefit is the reduction in program instrumentation made possible if VyrdMC is built using a model checker with its own virtual machine, such as Java PathFinder [Guillaume Brat, Klaus Havelund, Seung-Joon Park, and Willem Visser. Model Checking Programs. In IEEE International Conference on Automated Software Engineering (ASE), September 2000]. We are investigating the use of two different model checkers for building VyrdMC: Java PathFinder, an explicit-state model checker and Verisoft, a “stateless” model checker [P. Godefroid. Model Checking for Programming Languages using VeriSoft. In Proceedings of the 24th ACM Symposium on Principles of Programming Languages, pages 174–186, Paris, January 1997].

Dynamic Incremental Hashing in Program Model Checking

Although computationaly neglegdible in other domains, the hashing of states can become one of the most expensive operations in software model checking. The reason lies in the potentially large state descriptions that programs expose. In this paper we introduce incremental hashing on large, dynamically changing state vectors that naturally arise during the verification of software in program model checkers. We exploit the fact that only small portions of the state description are changed by a single transition. Based on the changes in the predecessor state, the new state and its hash value can be computed efficiently.

Translating Java for Multiple Model Checkers: The Bandera Back-End

One approach to model checking program source code is to view a model checker as a target machine. In this setting, program source code is translated to a model checker’s input language using a process that shares much in common with program compilation. For example, well-defined intermediate program representations are used to stage the translation through a series of analyses and optimizing transformations and target-specific details are isolated in code generation modules. In this paper, we present the Bandera Intermediate Representation (BIR)—a guarded-assignment transformation system language that has been designed to support the translation of Java programs to a variety of model checkers. BIR includes constructs, such as inheritance, dynamic creation of data, and locking primitives, that are designed to model the semantics of Java primitives. BIR also includes several non-deterministic choice constructs that support abstraction in modeling and specification of properties of dynamic heap structures. We have developed a BIR-based tool infrastructure that has been applied to develop customized analysis frameworks for several different input languages using different model checking tools. We present BIR’s type system and operational semantics in sufficient detail to support similar applications by other researchers. This semantics details several state space reductions and state space search variations. We describe the translation of Java to BIR and how BIR is translated to the input languages of several model checkers.

Adapting side effects analysis for modular program model checking

There is a widely held belief that whole program analysis is intractable for large complex software systems, and there can be little doubt that this is true for program analyses based on model checking. Model checking selected program components that comprise a cohesive unit, however, can be an effective way of uncovering subtle coding errors, especially for components of multi-threaded programs. In this setting, one of the chief problems is how to safely approximate the behavior of the rest of the application as it relates to the unit being analyzed.Non-unit application components are collectively referred to as the environment. In this paper, we describe how points-to and side-effects analyses can be adapted to support generation of summaries of environment behavior that can be reified into Java code using special modeling primitives. The resulting abstract models of the environment can be combined with the code of the unit and then model checked against unit properties. We present our analysis framework, illustrate its flexibility in generating several types of models, and present experience that provides evidence of the scalability of the approach.

Formula-based abstractions and symbolic execution for model checking programs

We define a model checking technique that applies to a finite state representation of sequential programs. This representation is built by means of an abstraction method which cuts the state explosion by introducing a special symbol, ⊥, to model ‘unknown’ variable values. Program properties are expressed by means of a temporal logic, which allow a further abstraction on the basis of the structure of the formulae. The satisfaction of the formulae is checked through a sort of symbolic execution of the programs which may produce a number of false results depending on the number of ⊥ values associated to the variables. Each abstraction produces a different level of incompleteness of the verification result.

Model checking programs

The majority of the work carried out in the formal methods community throughout the last three decades has (for good reasons) been devoted to special languages designed to make it easier to experiment with mechanized formal methods such as theorem provers and model checkers. In this paper, we give arguments for why we believe it is time for the formal methods community to shift some of its attention towards the analysis of programs written in modern programming languages. In keeping with this philosophy, we have developed a verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing. Part of this work has consisted of building a new Java Virtual Machine that interprets Java bytecode. JPF uses state compression to handle large states, and partial order reduction, slicing, abstraction and run-time analysis techniques to reduce the state space. JPF has been applied to a real-time avionics operating system developed at Honeywell, illustrating an intricate error, and to a model of a spacecraft controller, illustrating the combination of abstraction, run-time analysis and slicing with model checking.

Program model checking as a new trend

This paper introduces a special section of the STTT journal containing a selection of papers that were presented at the 7th international SPIN workshop, Stanford, 30 August – 1 September 2000. The workshop was named SPIN Model Checking and Software Verification, with an emphasis on model checking of programs. The paper outlines the motivation for stressing software verification, rather than only design and model verification, by presenting the work done in the Automated Software Engineering group at NASA Ames Research Center within the last 5 years. This includes work in software model checking, testing like technologies and static analysis.