Model Checking Techniques Research Articles

A cooperative heterogeneous vehicular clustering framework for efficiency improvement

Heterogeneous vehicular clustering integrates multiple types of communication networks to work efficiently for various vehicular applications. One popular form of heterogeneous network is the integration of long-term evolution (LTE) and dedicated short-range communication. The heterogeneity of such a network infrastructure and the non-cooperation involved in sharing cost/data are potential problems to solve. A vehicular clustering framework is one solution to these problems, but the framework should be formally verified and validated before being deployed in the real world. To solve these issues, first, we present a heterogeneous framework, named destination and interest-aware clustering, for vehicular clustering that integrates vehicular ad hoc networks with the LTE network for improving road traffic efficiency. Then, we specify a model system of the proposed framework. The model is formally verified to evaluate its performance at the functional level using a model checking technique. To evaluate the performance of the proposed framework at the micro-level, a heterogeneous simulation environment is created by integrating state-of-the-art tools. The comparison of the simulation results with those of other known approaches shows that our proposed framework performs better.

Overview of Control Algorithm Verification Methods in Power Electronics Systems

The paper presents the existing verification methods for control algorithms in power electronics systems, including the application of model checking techniques. In the industry, the most frequently used verification methods are simulations and experiments; however, they have to be performed manually and do not give a 100% confidence that the system will operate correctly in all situations. Here we show the recent advancements in verification and performance assessment of power electronics systems with the usage of formal methods. Symbolic model checking can be used to achieve a guarantee that the system satisfies user-defined requirements, while statistical model checking combines simulation and statistical methods to gain statistically valid results that predict the behavior with high confidence. Both methods can be applied automatically before physical realization of the power electronics systems, so that any errors, incorrect assumptions or unforeseen situations are detected as early as possible. An additional functionality of verification with the use of formal methods is to check the converter operation in terms of reliability in various system operating conditions. It is possible to verify the distribution and uniformity of occurrence in time of the number of transistor switching, transistor conduction times for various current levels, etc. The information obtained in this way can be used to optimize control algorithms in terms of reliability in power electronics. The article provides an overview of various verification methods with an emphasis on statistical model checking. The basic functionalities of the methods, their construction, and their properties are indicated.

A Double-Level Model Checking Approach for an Agent-Based Autonomous Vehicle and Road Junction Regulations

Usually, the design of an Autonomous Vehicle (AV) does not take into account traffic rules and so the adoption of these rules can bring some challenges, e.g., how to come up with a Digital Highway Code which captures the proper behaviour of an AV against the traffic rules and at the same time minimises changes to the existing Highway Code? Here, we formally model and implement three Road Junction rules (from the UK Highway Code). We use timed automata to model the system and the MCAPL (Model Checking Agent Programming Language) framework to implement an agent and its environment. We also assess the behaviour of our agent according to the Road Junction rules using a double-level Model Checking technique, i.e., UPPAAL at the design level and AJPF (Agent Java PathFinder) at the development level. We have formally verified 30 properties (18 with UPPAAL and 12 with AJPF), where these properties describe the agent’s behaviour against the three Road Junction rules using a simulated traffic scenario, including artefacts like traffic signs and road users. In addition, our approach aims to extract the best from the double-level verification, i.e., using time constraints in UPPAAL timed automata to determine thresholds for the AVs actions and tracing the agent’s behaviour by using MCAPL, in a way that one can tell when and how a given Road Junction rule was selected by the agent. This work provides a proof-of-concept for the formal verification of AV behaviour with respect to traffic rules.

Study of the efficiency of model checking techniques using results of the MCC from 2015 To 2019

In various scientific communities dealing with formal analysis, software competitions have emerged and contributed to fostering progress in state of the art and providing insight into the evolution of the involved technologies. The model checking contest (MCC) is one of them; it focuses on asynchronous concurrent systems. This paper reports what the organizers have observed over five editions of the MCC between 2015 and 2019. It shows the evolution of state-of-the-art model checking tools in performing large and difficult verification tasks by improving existing techniques or designing new and innovative (combinations of) techniques. This paper also shows the impact of such an event on the corresponding scientific community.

Model Checking Based Web Service Verification: A Systematic Literature Review

Model checking is a popular formal technique facilitating automatic verification of finite-state transition systems, and it has been applied to almost all of the Web service verification aspects, such as control-flow, data-flow, interaction, time requirements, quality of service, security requirements, etc. However, no systematic literature review focused on model checking of Web services is available. Motivated by this fact, in this paper, we systematically review existing research works on model checking based Web service verification appeared during the period of 2002–2017. We present a verification goal based classification of the collected articles, and for each paper, we identify the verification technique, target Web service standard, flavor of the employed model checking technique and tool, and other supplementary techniques, if any. Further, we highlight some of the issues, gaps, key challenges in this area and propose some future directions.

A RELIABILITY TEST METHOD FOR AGRICULTURAL PADDY FIELD INTELLIGENT ROBOT

With the development of artificial intelligence technology, in order to alleviate the labour intensity of agricultural paddy field production and improve production efficiency, the development of robot used in paddy field production has been a hot research in the field of agricultural production. Different from the industrial environment, the agricultural production environment is complex, and there are many interference factors to the intelligent robot. Therefore, ensuring the reliability of the robot in the operation has become an important index in the production process. The model checking technique can evaluate the reliability of the system when designing the system. In this paper, timed automata is used to model the agricultural paddy field intelligent robot, and the environmental influence factor model is introduced, so as to evaluate the reliability of the system qualitatively and quantitatively in the design of the agricultural paddy field robot. Finally, the control prediction of the system safety is carried out, and to provide a definite basis for the actual engineering design.

On the Adoption of Radiomics and Formal Methods for COVID-19 Coronavirus Diagnosis.

Considering the current pandemic, caused by the spreading of the novel Coronavirus disease, there is the urgent need for methods to quickly and automatically diagnose infection. To assist pathologists and radiologists in the detection of the novel coronavirus, in this paper we propose a two-tiered method, based on formal methods (to the best of authors knowledge never previously introduced in this context), aimed to (i) detect whether the patient lungs are healthy or present a generic pulmonary infection; (ii) in the case of the previous tier, a generic pulmonary disease is detected to identify whether the patient under analysis is affected by the novel Coronavirus disease. The proposed approach relies on the extraction of radiomic features from medical images and on the generation of a formal model that can be automatically checked using the model checking technique. We perform an experimental analysis using a set of computed tomography medical images obtained by the authors, achieving an accuracy of higher than 81% in disease detection.

Diagnosability of Event Patterns in Safe Labeled Time Petri Nets: A Model-Checking Approach

Checking the diagnosability of a timed discrete-event system usually consists in determining whether a single fault event can always be identified with certainty after a finite amount of time. The aim of this article is to extend this type of analysis to more complex behaviors, called event patterns, and to propose an effective method to check diagnosability with the use of model-checking techniques. To do so, we propose to convert the pattern diagnosability problem into checking a linear-time property over a specific time Petri net. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —This article is motivated by the problem of improving the monitoring and the supervision of systems, such as automated and robotized manufacturing systems. Based on a model of the system, this article proposes a method to assert with certainty whether the available set of sensors will always provide enough information to ensure that a complex and unexpected behavior has not happened in the system. The proposed method uses a publicly available model-checking tool to perform this analysis.

Gray-box monitoring of hyperproperties with an application to privacy

Runtime verification is a complementary approach to testing, model checking and other static verification techniques to verify software properties. Monitorability characterizes what can be verified (monitored) at run time. Different definitions of monitorability have been given both for trace properties and for hyperproperties (properties defined over sets of traces), but these definitions usually cover only some aspects of what is important when characterizing the notion of monitorability. The first contribution of this paper is a refinement of classic notions of monitorability both for trace properties and hyperproperties, taking into account, among other things, the computability of the monitor. A second contribution of our work is to show that black-box monitoring of HyperLTL (a logic for hyperproperties) is in general unfeasible, and to suggest a gray-box approach in which we combine static and runtime verification. The main idea is to call a static verifier as an oracle at run time allowing, in some cases, to give a final verdict for properties that are considered to be non-monitorable under a black-box approach. Our third contribution is the instantiation of this solution to a privacy property called distributed data minimization which cannot be verified using black-box runtime verification. We use an SMT-based static verifier as an oracle at run time. We have implemented our gray-box approach for monitoring data minimization into the proof-of-concept tool Minion. We describe the tool and apply it to a few case studies to show its feasibility.

Formalization and Model Checking of BPMN Collaboration Diagrams with DD-LOTOS

Business Process Model and Notation (BPMN) is a standard graphical notation for modeling complex business processes. Given the importance of business processes, the modeling analysis and validation stage for BPMN is essential. In recent years, BPMN notation has become a widespread practice in business process modeling because of these intuitive diagrams. BPMN diagrams are built from basic elements. The major challenge of BPMN diagrams is the lack of formal semantics, which leads to several interpretations of the concerned diagrams. Hence, this work aims to propose an approach for checking BPMN collaboration diagrams to guarantee some properties of smooth functioning of systems modeled by BPMN notation. The verification approach used in this work is based on model checking techniques. The approach proposes as a first step a formal semantics of the collaboration diagrams in terms of the formal language DD-LOTOS, i.e., a phase of the transformation of collaboration diagrams into DD-LOTOS. This transformation is guided by applying the inference rules of the formal semantics of the DD-LOTOS formal language, and we then use the UPPAAL model checker to check the absence of deadlock, safety properties, and liveness properties.

Utilising Assured Multi-Agent Reinforcement Learning within Safety-Critical Scenarios

Multi-agent reinforcement learning allows a team of agents to learn how to work together to solve complex decision-making problems in a shared environment. However, this learning process utilises stochastic mechanisms, meaning that its use in safety-critical domains can be problematic. To overcome this issue, we propose an Assured Multi-Agent Reinforcement Learning (AMARL) approach that uses a model checking technique called quantitative verification to provide formal guarantees of agent compliance with safety, performance, and other non-functional requirements during and after the reinforcement learning process. We demonstrate the applicability of our AMARL approach in three different patrolling navigation domains in which multi-agent systems must learn to visit key areas by using different types of reinforcement learning algorithms (temporal difference learning, game theory, and direct policy search). Furthermore, we compare the effectiveness of these algorithms when used in combination with and without our approach. Our extensive experiments with both homogeneous and heterogeneous multi-agent systems of different sizes show that the use of AMARL leads to safety requirements being consistently satisfied and to better overall results than standard reinforcement learning.

Visualizing Schemes and Logics among Sentences in Paragraph

Authors have been developing algorithms to extract sentences including logical relation of “implication” from specification documents, and have generated executable test program for validating software modules with model checking techniques for years, so as to decrease manufacturing costs in times of system testing. The sentences including the relation “implication” are the key for test case design, because these are regarded as statements of reasonings in the system specifications. The reasoning requires premises, constraints and design rationales, to reinforce reasoning process. The premises, constraints and design rationales are utilized to define test parameters and their range of value in the context of test case design. The sentences corresponding to premises, constraints and design rationales are very likely to be deployed in the same paragraph, where the sentence involving “implication” is included.We tried to visualize logical relations among sentences in a paragraph by focusing the key sentence including the relation “implication (→)” to help test engineers grasp logical scheme of the paragraph at a glance with natural language processing technique. The algorithms and tools for formalizing sentences in natural language and visualizing logical relations among them were developed in the study and applied to visualizing logical scheme for 747 summaries in the technical papers for the validation.

Formalism and semantics of PyCATSHOO: A simulator of distributed stochastic hybrid automata

This article lays the mathematical foundations of PyCATSHOO, a Model-Based Safety Analysis (MBSA) framework relying on distributed stochastic hybrid automata. This tool was initially developed for use cases where continuous evolution of physical variables or component failure rates matter to assess the dependability attributes. The modelling language has been designed in order to provide to the analyst the best expressiveness and ease of use. Nevertheless, although the structure and behaviour of a PyCATSHOO model have been informally described previously, they have never been formally established, which precludes its scientific acceptance and slows down its adoption by new users. To fill this lack, this article introduces formal definitions of the structure of PyCATSHOO models using set theory and of their operational semantics using inference rules (exactly 1 axiom and eight inference rules). These formal definitions are illustrated on a simple case study: the heated room. As a result, our proposing disambiguates the semantics of PyCATSHOO models, provides a formal specification of its input language and the core logic of its simulator engine and paves the way to the integration of model checking techniques in the PyCATSHOO framework.

A clock-based dynamic logic for the verification of CCSL specifications in synchronous systems

The Clock Constraint Specification Language (CCSL) is a clock-based specification language for real-time embedded systems. With logical clocks defined as first-class citizens, CCSL provides a natural way for describing clock constraints in synchronous systems — a classical model of concurrency for real-time embedded systems. In this paper, we propose a clock-based dynamic logic called CCSL Dynamic Logic (CDL) for the verification of CCSL specifications in synchronous systems. It extends the first-order dynamic logic with a synchronous execution mechanism in its program model and with CCSL primitives as terms in its logical formulae. We build a sound and relatively complete proof system for CDL to support the verification. Compared with previous approaches for verifying CCSL specifications, which are based on model checking and SMT checking techniques, our approach, which is based on theorem-proving, offers a unified verification framework in which both bounded and unbounded CCSL specifications can be verified. Technically, with the proof system of CDL, a complex CDL formula can be semi-automatically transformed into a set of quantifier-free, arithmetical first-order logic (QF-AFOL) formulae which can be checked by an SMT solver in an efficient way. As a case study, we analyze a simple synchronous system throughout the paper to illustrate how CDL works. We analyze and prove the soundness and completeness of the proof system for CDL. Currently, CDL is partially mechanized in Coq. • Dynamic Logic to deal with Logical Clocked Systems. • Proof system for CCSL and synchronous systems. • Rely on a decidable subset theory for efficient use of SMT solvers. • Proof of soundness and relative completeness.

Reachability and reward checking for stochastic timed automata

Stochastic timed automata are an expressive formal model for hard and soft real-time systems. They support choices and delays that can be deterministic, nondeterministic or stochastic. Stochastic choices and delays can be based on arbitrary discrete and continuous distributions. In this paper, we present an analysis approach for stochastic timed automata based on abstraction and probabilistic model checking. It delivers upper/lower bounds on maximum/minimum reachability probabilities and expected cumulative reward values. Based on theory originally developed for stochastic hybrid systems, it is the first fully automated model checking technique for stochastic timed automata. Using an implementation as part of the Modest Toolset and four varied examples, we show that the approach works in practice and present a detailed evaluation of its applicability, its efficiency, and current limitations.

GRAVITAS: A model checking based planning and goal reasoning framework for autonomous systems

This work follow the verification as planning paradigm and propose to use model-checking techniques to solve planning and goal reasoning problems for autonomous systems with high-degree of assurance. It presents a novel modelling framework — Goal Task Network (GTN) that encompass both goal reasoning and planning under a unified formal description that enables the use of assurance tools. The paper provides a systematic method that highlights how an industrial model checker (PAT) can be used to solve goal reasoning and planning problems modelled by GTNs. Further, this paper also introduces the design of an automated system framework for Goal Reasoning And Verification for Independent Trusted Autonomous Systems (GRAVITAS). The proposed framework is demonstrated in an experiment that simulates a survey mission performed by the REMUS-100 autonomous underwater vehicle.

Model Checking a Logic for True Concurrency

We study the model-checking problem for a logic for true concurrency, whose formulae predicate about events in computations and their causal dependencies. The logic, which represents the logical counterpart of history-preserving bisimilarity, is naturally interpreted over event structures or any formalism that can be given a causal semantics, like Petri nets. It includes least and greatest fixpoint operators and thus it can express properties of infinite computations. Since the event structure associated with a system is typically infinite (even if the system is finite state), already the decidability of model-checking is non-trivial. We first develop a local model-checking technique based on a tableau system, for which, over a class of event structures satisfying a suitable regularity condition, referred to as strong regularity, we prove termination, soundness, and completeness. The tableau system allows for a clean and intuitive proof of decidability, but a direct implementation of the procedure can be extremely inefficient. For easing the development of a more efficient model-checking technique, we move to an automata-theoretic framework. Given a formula and a strongly regular event structure, we show how to construct a parity tree automaton whose language is non-empty if and only if the event structure satisfies the formula. The automaton is usually infinite. We discuss how it can be quotiented to an equivalent finite automaton, where emptiness can be checked effectively. To show the applicability of the approach, we discuss how it instantiates to finite safe Petri nets, providing also a corresponding proof-of-concept model-checking tool.

A security policy model transformation and verification approach for software defined networking

Software-defined networking (SDN) has been increasingly utilized to enforce the security of complex networks. However SDN-based security enforcement mechanisms rely heavily on some specific security policies containing underlying network information. Facing the increasingly complex and huge SDN networks, we urgently need a novel security policy management mechanism which can be completely transparent to any underlying network information. That is it can permit network managers to define the high-level security policy model without containing any underlying information, and by means of model transformation, high-level security policy model can be automatically transformed into its corresponding lower-level security policy model containing underlying information. Moreover, we must ensure the system model of data plane updated by the low-level security policy model can hold all of security properties defined in high-level security policy model. Based on these insights, we propose a security policy model transformation and verification approach for SDN in this paper. We first specify the security policies used in SDN networks as a formal security policy model (SPM). Then we establish the system model of SDN’s data plane and the mapping rules between the policy objects of SPM and the system objects of system model of data plane. Based on these mapping rules, we propose a security policy model transformation mechanism which transforms SPM into the low-level security policy model, RSPM. In order to verify the system model of data plane updated by RSPM can hold all of security properties defined in SPM, we propose a security policy verification mechanism based on model checking techniques and a group of validation conditions. Finally, we utilize a comprehensive case to illustrate the feasibility of this approach.

Integrating formal specifications into applications: the ProB Java API

The common formal methods workflow consists of formalising a model followed by applying model checking and proof techniques. Once an appropriate level of certainty is reached, code generators are used in order to gain executable code. In this paper, we propose a different approach: instead of generating code from formal models, it is also possible to embed a model checker or animator into applications in order to use the formal models themselves at runtime. We present a Java API to the ProB animator and model checker. We describe several case studies that use this API as enabling technology to interact with a formal specification at runtime.

A Generic Approach on How to Formally Specify and Model Check Path Finding Algorithms: Dijkstra, A* and LPA*

The paper describes how to formally specify three path finding algorithms in Maude, a rewriting logic-based programming/specification language, and how to model check if they enjoy desired properties with the Maude LTL model checker. The three algorithms are Dijkstra Shortest Path Finding Algorithm (DA), A* Algorithm and LPA* Algorithm. One desired property is that the algorithms always find the shortest path. To this end, we use a path finding algorithm (BFS) based on breadth-first search. BFS finds all paths from a start node to a goal node and the set of all shortest paths is extracted. We check if the path found by each algorithm is included in the set of all shortest paths for the property. A* is an extension of DA in that for each node [Formula: see text] an estimation [Formula: see text] of the distance to the goal node from [Formula: see text] is used and LPA* is an incremental version of A*. It is known that if [Formula: see text] is admissible, A* always finds the shortest path. We have found a possible relaxed sufficient condition. The relaxed condition is that there exists the shortest path such that for each node [Formula: see text] except for the start node on the path [Formula: see text] plus the cost to [Formula: see text] from the start node is less than the cost of any non-shortest path to the goal from the start. We informally justify the relaxed condition. For LPA*, if the relaxed condition holds in each updated version of a graph concerned including the initial graph, the shortest path is constructed. Based on the three case studies for DA, A* and LPA*, we summarize the formal specification and model checking techniques used as a generic approach to formal specification and model checking of path finding algorithms.