Model Checking Tools Research Articles

Precision spraying: from map to sprayer control using model-checking

Precision agriculture is a set of methods based on spatial and timed information which aims at making agricultural operations specific to local crop needs. This study was conducted to contribute to precision spraying for trellised perennial crops such as grapevine with a new method called Automata Modelling for Precision Spraying (AMPS). AMPS is based on the timed automata formalism and the UppAal-CORA model-checking tool with cost optimisation. It takes 2D ground-based LiDAR data of the canopy as input and computes a command sequence for the sprayer that is optimized for a cost criterion. AMPS was tested on LiDAR data from a vine row and with a hypothetical sprayer model based on pneumatic technology and individual command for each spout. The chosen cost criterion was the amount of product sprayed on the row. It was demonstrated on the example that a significant proportion of phytosanitary product can be saved. It was also shown that it is necessary to take into account spout control dynamics, because the savings are inferior to the ideal case in which spout response would be instantaneous.

Branching Path Planning with Modal Logics

Path planning concerns about finding a route for an agent, such that this agent move along the route from an initial to a final goal. Some additional constraints may also have to be satisfied for the agent, such as avoiding obstacles or collisions. Path planning has been recently studied in the context of linear temporal logic with great success. Expressive constraint specifications involving temporal ordering can be succinctly expressed by logic formulas, whereas environments are abstracted as transition systems. The plan is obtained by counterexample generation in a model checking tool: finding a path, if any, such that a given formula (constraints) satisfies a given model (agent environment). Due to the expressive power of linear temporal logic, only linear planning has mostly been considered so far, that is, plans corresponding to tasks to be performed in a linear successive order. In this work, we study branching shaped (tree) plans in the context of the μ -calculus, an expressive modal logic which subsumes many program logics such as LTL, PDL and CTL. Branching plans can be succinctly expressed by logic formulas so that a team of mobile devices can concurrently satisfy the plan. In the current work, we provide a plan generator based on a model checking algorithm for the μ -calculus. We show the algorithm is sound and complete, that is, for any environment, there a satisfying plan for a given set of constraints, if and only if, the plan generator succeeds.

RINGA: Design and verification of finite state machine for self-adaptive software at runtime

ContextIn recent years, software environments such as the cloud and Internet of Things (IoT) have become increasingly sophisticated, and as a result, development of adaptable software has become very important. Self-adaptive software is appropriate for today's needs because it changes its behavior or structure in response to a changing environment at runtime. To adapt to changing environments, runtime verification is an important requirement, and research that integrates traditional verification with self-adaptive software is in high demand. ObjectiveModel checking is an effective static verification method for software, but existing problems at runtime remain unresolved. In this paper, we propose a self-adaptive software framework that applies model checking to software to enable verification at runtime. MethodThe proposed framework consists of two parts: the design of self-adaptive software using a finite state machine and the adaptation of the software during runtime. For the first part, we propose two finite state machines for self-adaptive software called the self-adaptive finite state machine (SA-FSM) and abstracted finite state machine (A-FSM). For the runtime verification part, a self-adaptation process based on a MAPE (monitoring, analyzing, planning, and executing) loop is implemented. ResultsWe performed an empirical evaluation with several model-checking tools (i.e., NuSMV and CadenceSMV), and the results show that the proposed method is more efficient at runtime. We also investigated a simple example application in six scenarios related to the IoT environment. We implemented Android and Arduino applications, and the results show the practical usability of the proposed self-adaptive framework at runtime. ConclusionsWe proposed a framework for integrating model checking with a self-adaptive software lifecycle. The results of our experiments showed that the proposed framework can achieve verify self-adaptation software at runtime.

Objective/MC: A high-level model checking language

Among model checking tools, the behaviour of a system is often formalized as a transition system with atomic propositions associated with states (Kripke structure). In current modeling languages, transitions are usually specified as updates of the system’s variables to be performed when certain conditions are satisfied. However, such a low-level representation makes the description of complex transformations difficult, in particular in the presence of structured data. We present Objective/MC, a high-level language with imperative semantics for modeling finite-state systems. The language features are selected with the aim of enabling the translation of models into compact transition systems, amenable to efficient verification via model checking. To this end, we have developed a compiler of our high-level language into the modeling language of the PRISM probabilistic model checker. One of the main characteristics of the language is that it makes a very different treatment of global and local variables. It is assumed that global variables are actually the variables that describe the state of the modeled system, whereas local variables are only used to ease the specification of the system’s internal mechanisms. In this paper, we give a complete formal definition of the language, its type system and static analyses, of the transformations to be performed at the level of the Control Flow Graph for the pruning of local variables, and of the PRISM code generation.

Information Quality Assessment for Facility Management

Assessing the quality of building information models (BIMs) is an important yet challenging task within the construction industry as projects are increasingly being delivered with BIM. This is particularly essential for facility management (FM) users as downstream information consumers that depend on the quality of models developed in the previous project phases. The research presented in this paper addresses this challenge by introducing a framework for information quality assessment (IQA) of BIMs for FM uses. The IQA framework is the outcome of an extensive study of two large owner organizations involving numerous BIM projects. The framework is structured based on the essential FM subjects: assets, spaces, and systems, and the model characteristics: objects, attributes, relationships, and spatial information. The framework is then operationalized through the development and evaluation of information quality (IQ) tests using BIM model checking tools across three projects with different levels of detail and complexity. The proposed IQA framework and associated tests advance the state of knowledge about BIM quality in terms of methods to represent and evaluate conformance to owner requirements.

Physical control framework and protocol design for cyber-physical control system

A cyber-physical system is an integration of computation, networking, and physical processes. This article introduces a novel physical control framework to integrate various devices to form the lower-level abstraction network. Two relevant protocols within this framework are proposed for information exchange between different network environments. Furthermore, a formal verification method for the proposed protocols is discussed. The model-checking tool SPIN is used to model and formally verify such protocols. The properties of the protocols are expressed using linear temporal logic to enable model-checking. Implementation results are presented to provide a deeper understanding of the proposed protocols.

Robust Nonparametric Inference

In this article, we provide a personal review of the literature on nonparametric and robust tools in the standard univariate and multivariate location and scatter, as well as linear regression problems, with a special focus on sign and rank methods, their equivariance and invariance properties, and their robustness and efficiency. Beyond parametric models, the population quantities of interest are often formulated as location, scatter, skewness, kurtosis and other functionals. Some old and recent tools for model checking, dimension reduction, and subspace estimation in wide semiparametric models are discussed. We also discuss recent extensions of procedures in certain nonstandard semiparametric cases including clustered and matrix-valued data. Our personal list of important unsolved and future issues is provided.

Using π-calculus for Formal Modeling and Verification of WS-CDL Choreographies

Service-Oriented applications are realized by composing and aggregating existing web services. Orchestration and Choreography are two interaction models for building SOA applications and several standards exist to capture and describe such interactions. The Web Service Choreography Description Language (WS-CDL) is a standard for modeling choreographies. In this paper, we propose a calculus (Chor-calculus) for formal modeling of WS-CDL and we use this language for generating WS-CDL programs. This approach enables the static verification of choreographies using existing pi-calculus model-checker tools and sets the ground for enabling the runtime monitoring of choreographies for behavioral correctness. We validate the calculus for its expressiveness by evaluating the language support for representing workflow, and service interaction, patterns. We demonstrate the use of the HAL toolkit to verify the correctness properties of choreographies.

A secure end‐to‐end SMS‐based mobile banking protocol

SummaryShort message service (SMS) provides a wide channel of communication for banking in mobile commerce and mobile payment. The transmission of SMS is not secure in the network using global system for mobile communications or general packet radio service. Security threats in SMS restricted the use of SMS in mobile banking within certain limits. This paper proposed a model to address the security of SMS using elliptic curve cryptography. The proposed model provides end‐to‐end SMS communication between the customer and the bank through the mobile application. The main objective of the proposed model is to design and develop a security framework for SMS banking. Further, the protocol is verified for its correctness and security properties because most of the protocols are not having the facility to be verified by using the formal methods. Our proposed framework is experimentally validated by formal methods using model checking tool called automated validation of internet security protocols and Scyther tools. Security analysis shows that the proposed mechanism works better compared to existing SMS payment protocols for real‐world applications.

SAT solver management strategies in IC3: an experimental approach

This paper addresses the problem of handling SAT solving in IC3. SAT queries posed by IC3 significantly differ in both character and number from those posed by other SAT-based model checking algorithms. In addition, IC3 has proven to be highly sensitive to the way its SAT solving requirements are handled at the implementation level. The scenario pictured above poses serious challenges for any implementation of the algorithm. Deciding how to manage the SAT solving work required by the algorithm is key to IC3 performance. The purpose of this paper is to determine the best way to handle SAT solving in IC3. First we provide an in-depth characterization of the SAT solving work required by IC3 in order to gain useful insights into how to best handle its queries. Then we propose an experimental comparison of different strategies for the allocation, loading and clean-up of SAT solvers in IC3. Among the compared strategies we include the ones typically used in state-of-the-art model checking tools as well as some novel ones. Alongside comparing multiple versus single SAT solver implementations of IC3, we propose the use of secondary SAT solvers dedicated to handling certain types of queries. Different heuristics for SAT solver clean-up are evaluated, including new ones that follow the locality of the verification process. We also address clause database minimality, comparing different CNF encoding techniques. Though not finding a clear winner among the different sets of strategies compared, we outline several potential improvements for portfolio-based verification tools with multiple engines and tunings.

BIM-based Code Checking for Construction Health and Safety

Rule-based Code Checking validates the design phase comparing Building Information Models against current codes and regulations translated into parametric rules. The proposed paper fits into a wider project for implementing design verification and validation within a BIM environment. The design of construction site layouts and safety plans is an essential part of an effective integrated process but it is traditionally carried out by means of error-prone and inefficient manual observation and, moreover, building designers and health and safety (H&S) coordinators still lack a collaborative working approach. The digitization of the construction site allows virtual inspections and information-based analysis of construction phases. Moreover, interoperable BIM tools allow the semi-automatic review of design compliance against normative texts, improving accuracy and reliability of the validation process. The research project aims to define an H&S BIM-based design and validation workflow, specifying the minimum level of requirements and mandatory informative content for the submission of construction site layouts and safety plans. The paper is focused on the translation into a parametric rule-set of the Italian construction sites’ H&S normative text (D.Lgs. 81/2008). A semantic analysis was used in order to translate it into computable parameters to be implemented into checking rules. Object tables have been created for each construction site element regulated by the D.Lgs. 81/2008. Based on those tables, meant as guideline for the design phase, a BIM library for the construction site has been created and a model checking tool has been used for creating rules to check and validate BIM objects and mutual relations. The customized rule-set includes legal references and information requirements specifications. Such an approach aims at including the design of construction safety plans within digital

Composition and verification of student-oriented courses

In the last few years, the popularity of online degrees has dramatically increased. In current online degrees, the school specifies the courses required to obtain a degree. For each course, the instructor specifies the course elements including teaching method and assessments. But different students have different capabilities and constraints. Most institutions provide the same courses. A student should be able to select the course that best matches his capabilities and constraints as long as it satisfies the required course outcomes. To achieve this goal, we propose the use of service-oriented architecture (SOA). We introduce an extended service-oriented architecture and an extended service definition, which will enable the specification and provision of student-oriented courses. We also propose a formal composition approach. To formally verify the result of the composition, we have also introduced a formal verification approach using the model checking tool UPPAAL.

Composition and verification of student-oriented courses

In the last few years, the popularity of online degrees has dramatically increased. In current online degrees, the school specifies the courses required to obtain a degree. For each course, the instructor specifies the course elements including teaching method and assessments. But different students have different capabilities and constraints. Most institutions provide the same courses. A student should be able to select the course that best matches his capabilities and constraints as long as it satisfies the required course outcomes. To achieve this goal, we propose the use of service-oriented architecture (SOA). We introduce an extended service-oriented architecture and an extended service definition, which will enable the specification and provision of student-oriented courses. We also propose a formal composition approach. To formally verify the result of the composition, we have also introduced a formal verification approach using the model checking tool UPPAAL.

Formal Verification for Mode Confusion in the Flight Deck Using Intent-Based Abstraction

As the flight deck has become highly automated, mode confusion between the pilot and the automation has emerged as an important issue for aviation safety. This paper presents a formal verification framework that can be used to efficiently detect a wide range of mode-confusion problems in the pilot–automation system and provide safety guarantees. To facilitate this, a novel formal modeling of the automation and pilot is proposed to efficiently verify the pilot–automation system. The automation of the aircraft is modeled as a deterministic hybrid system, and the pilot is modeled as an intent-based finite state machine. Due to the high dimension of the aircraft’s continuous states and the large number of flight-mode combinations, formal verification of the hybrid system is computationally formidable, leading to the state-space explosion problem. To tackle this problem, a computationally efficient abstraction method for the hybrid model is proposed using intent inference, from which an intent-based finite state machine for the automation is obtained. The intent-based finite state machines for the automation and pilot are synchronously composed to systematically and comprehensively verify the pilot–automation system using the NuSMV model-checking tool. The proposed framework is demonstrated with two real pilot–automation interaction incidents/accidents.

Verification Guided Refinement of Flight Safety Assessment and Management System for Takeoff

Systems that make safety-critical decisions must undergo a rigorous verification and validation process to ensure automation decisions do not jeopardize the nominal safe state of operation. Flight safety assessment and management is a high-level decision-making system to reduce loss of control risk. This paper demonstrates how tools from formal verification can be used to guide the design of a takeoff flight safety assessment and management system implemented as a deterministic Moore machine. Finite state abstractions of simplified takeoff dynamics under different control authorities (i.e., pilot vs safety controller) are computed and composed with the Moore machine. By construction, the composition captures all behaviors of simplified takeoff dynamics. Then, a model checking tool analyzes whether this composition satisfies the takeoff safety requirements specified by federal aviation regulations. The results of model checking together with the abstraction are used to refine the Moore machine to ensure satisfaction of the specification. This paper contributes a novel approach to verification of a supervisory system specified by a Moore machine and applies this technique to flight safety assessment and management, which is itself an emerging flight management automation aid.

Optimizing the resource requirements of hierarchical scheduling systems

Compositional reasoning on hierarchical scheduling systems is a well-founded formal method that can construct schedulable and optimal system configurations in a compositional way. However, a compositional framework formulates the resource requirement of a component, called an interface, by assuming that a resource is always supplied by the parent components in the most pessimistic way. For this reason, the component interface demands more resources than the amount of resources that are really sufficient to satisfy sub-components. We provide two new supply bound functions which provides tighter bounds on the resource requirements of individual components. The tighter bounds are calculated by using more information about the scheduling system. We evaluate our new tighter bounds by using a model-based schedulability framework for hierarchical scheduling systems realized as Uppaal models. The timed models are checked using model checking tools Uppaal and Uppaal SMC, and we compare our results with the state of the art tool CARTS.

Design and formal verification of a cloud compliant secure logging mechanism

Security concerns are still retarding cloud adoption. While the research community work on clearing these concerns, an optimistic fair cloud compliant logging scheme may ease the cloud to spread. This study proposes a secure logging mechanism. The mechanism employs an online bulletin board as a public write-only storage for the log records. The bulletin board also acts as a trusted third party during conflict resolution. The secure logging protocol describes how the log records are distributed to the stakeholders. The protocol's security is verified with model checking tools and no security threats could be found.

An Adaptive Goal-Based Model for Autonomous Multi-Robot Using HARMS and NuSMV

In a dynamic environment autonomous robots often encounter unexpected situations that the robots have to deal with in order to continue proceeding their mission. We propose an adaptive goal-based model that allows cyber-physical systems (CPS) to update their environmental model and helps them analyze for attainment of their goals from current state using the updated environmental model and its capabilities. Information exchange approach utilizes Human-Agent-Robot-Machine-Sensor (HARMS) model to exchange messages between CPS. Model validation method uses NuSMV, which is one of Model Checking tools, to check whether the system can continue its mission toward the goal in the given environment. We explain a practical set up of the model in a situation in which homogeneous robots that has the same capability work in the same environment.

Evaluation of properties over phylogenetic trees using stochastic logics.

BackgroundModel checking has been recently introduced as an integrated framework for extracting information of the phylogenetic trees using temporal logics as a querying language, an extension of modal logics that imposes restrictions of a boolean formula along a path of events. The phylogenetic tree is considered a transition system modeling the evolution as a sequence of genomic mutations (we understand mutation as different ways that DNA can be changed), while this kind of logics are suitable for traversing it in a strict and exhaustive way. Given a biological property that we desire to inspect over the phylogeny, the verifier returns true if the specification is satisfied or a counterexample that falsifies it. However, this approach has been only considered over qualitative aspects of the phylogeny.ResultsIn this paper, we repair the limitations of the previous framework for including and handling quantitative information such as explicit time or probability. To this end, we apply current probabilistic continuous-time extensions of model checking to phylogenetics. We reinterpret a catalog of qualitative properties in a numerical way, and we also present new properties that couldn’t be analyzed before. For instance, we obtain the likelihood of a tree topology according to a mutation model. As case of study, we analyze several phylogenies in order to obtain the maximum likelihood with the model checking tool PRISM. In addition, we have adapted the software for optimizing the computation of maximum likelihoods.ConclusionsWe have shown that probabilistic model checking is a competitive framework for describing and analyzing quantitative properties over phylogenetic trees. This formalism adds soundness and readability to the definition of models and specifications. Besides, the existence of model checking tools hides the underlying technology, omitting the extension, upgrade, debugging and maintenance of a software tool to the biologists. A set of benchmarks justify the feasibility of our approach.

Fepchecker: An Automatic Model Checker for Verifying Fairness and Non-Repudiation of Security Protocols in Web Service

Ensuring the fairness and non-repudiation in the security exchange protocol of web service is critical. Model checking is often used for automatic verification for the security properties of protocol. However, the current model checker tools cannot support formalizing protocols with cryptographic primitives, specifying properties with linear temporal logic (LTL) and automatically generating resilient intruder model simultaneously and the application range of them is severely limited. To solve this problem, a model checker Fepchecker is proposed to verify the fairness and non-repudiation properties, which are critical features in security exchange protocols. Firstly, applied pi-calculus is extended to specify the protocols, and the LTL assertion is used for precisely describing fairness and non-repudiation. Secondly, an intruder model is applied to construct their behavior sequences automatically and the protocol sessions and message pattern are used to alleviate the states explosion problem. Thirdly, in our model checking algorithm, the fairness and non-repudiation properties are verified based on Labeled Transition System (LTS) semantics model and the MakeOneMove method is used to explore the state space on-the-fly in the verification process. Finally, Fepchecker is applied to verify six representative protocols and the results show that Fepchecker can effectively verify their fairness and non-repudiation properties.