NuSMV Model Checker Research Articles

Safe and reconfigurable manufacturing: safety aware multi-agent control for Plug & Produce system

Plug & Produce aims to revolutionize manufacturing by enabling seamless machine integration into production processes without extensive programming. This concept, leveraging multi-agent systems (MAS), offers increased flexibility and faster production ramp-up times after reconfiguration. As automated manufacturing moves towards greater human integration, this paper addresses safe operation within the Plug & Produce concept. The main safety challenge arises from autonomous decision-making, as agents in the MAS lack awareness of the risk consequences of their behavior. Additionally, the difficulty of perceiving the system’s exact behavior leads to the implementation of overly restrictive safety measures. This limits the system’s flexibility and ability to make decisions for efficient production. This paper proposes a method utilizing multi-agent control to conduct automatic safety analysis and reason task allocations to avoid risks. The method’s benefits are the generation of control actions that comply with safety requirements during operation, eliminating the need for overly restrictive safety measures and allowing more effective equipment utilization. The method’s benefit is illustrated through a manufacturing scenario with two different configurations: one using a hazardous machine and the other using a less hazardous one. Formal verification using the model checker NuSMV demonstrated that safety requirements were satisfied in both configurations, without the need for manual modifications of the safety control system after reconfiguration. The results for this specific manufacturing scenario showed that there are more reachable states (20 states) in the safer second configuration, compared to the first configuration (16 states). This means that the presented control strategy dynamically adjusts the system’s behavior to confirm safety. Hence, this method maintains safety without fixed safety rules that limit the operations.

Generalized Formal Model-Verifier: A Formal Approach for Verifying Static Models

The field of software modeling has gained significant popularity in the last decades. By capturing the static aspects of the software requirements, model-driven engineering eases the development and maintenance of software. However, additional constraints, such as invariants on model elements, that the solution must conform to may be too complex to include in the structure of the model itself. External solutions are often used to describe static constraints on models, the most prevalent approach being the Object Constraint Language (OCL) and its formal variants. This paper proposes the Generalized Formal Model-Verifier (GFMV), which is a general approach for verifying static constraints on software models. GFMV employs different formal verification methods based on Kripke Structures. Kripke Structures are used to capture the static structure of the model, then the constraints are formalized using a first-order branching-time logic, the Computational Tree Logic (CTL). Finally, the NuSMV model checker is reused to verify whether the constraints formalized in CTL hold on the formal Kripke Structure. When compared to existing solutions, GFMV offers increased generality and formal proof that the constraints hold on the model. The expressive power and runtime-scalability of the approach are evaluated on a real-world example model and OCL invariants cited from literature.

Multi-valued model checking IoT and intelligent systems with commitment protocols in multi-source data environments

In today’s world of connectivity, various domains use different multi-sensor Internet of Things (IoT) and Intelligent Systems (IS) applications. These applications involve extensive interactions between thousands or millions of components in open environments, which challenges verifying their reliability and efficiency. This paper introduces the first investigation in verifying IoT applications and intelligent systems in multi-source data settings with multi-agent commitment protocols in uncertain or inconsistent environments. Specifically, we present original and efficient solutions for modeling and verifying these systems with conditional and unconditional commitment protocols under uncertain or inconsistent settings. We introduce 4v-CTLc and 4v-CTLcc, multi-valued logics of commitment for reasoning about inconsistency over these systems that expand 3v-CTLc and 3v-CTLcc for reasoning about uncertainty. Moreover, we introduce new reduction algorithms for reducing our multi-valued model checking problems to the two-valued ones. To implement these algorithms, we develop two new automatic verification tools. The first tool translates the multi-valued logics to CTL and automatically interacts with the NuSMV model checker. The second tool translates these logics to the two-valued versions, CTLc and CTLcc, and automatically interacts with the MCMAS+ model checker. We apply our verification approaches to a Smart Home, a Smart Hospital and a Smart Mortgage system with multi-source data as case studies using sets of properties, including safety, liveness and reachability. The experimental results obtained by the proposed multi-valued model checking techniques proved these techniques’ high efficiency and applicability to modeling and verifying intelligent and autonomous multi-source data systems.

Business Process Modeled with BPMN and CTL Model Checking

Despite the richness of the BPMN language and its advantages for the specification of business processes, it remains a semi-formal language that does not allow rigorous verification of the specifications produced with it, and does not offer any methodological support to cover the verification phase. Therefore, several works have been proposed with the aim of describing the semantics of the BPMN language by a mathematical formalism. In this paper we address the issue of verifying BPMN models with an approach based on model-checking, where we focus on soundness, fairness, and safety properties. Thus by having a business process modeled by BPMN, a formal semantics for BPMN models based on Kripke structure will be provided for a formal verification of correctness. The properties are expressed with CTL (Computation Tree Logic) formulas. At the end, the model checker NuSMV is used for the verification of the formula.

System verification via Model‐Checking: A case study of an autonomous multi‐differential drive robot

AbstractModel‐Based Systems Engineering (MBSE) has been utilized in practice to design and behavioral modeling cyber‐physical systems. The Vee model helps frame MBSE's lifecycle approach, with system verification a vital aspect of the qualification process. However, popular modeling language tools in MBSE, such as Systems Modeling Language (SysML), are incapable of formally verifying these systems. Model checking allows for the development of formal system models similar in abstraction to SysML models for automatically checking if these formal models satisfy formal specifications. We propose an approach to translate behavioral diagrams in SysML, such as state‐machine diagrams, to the popular symbolic model checker NuSMV for formal verification. As a case study, we apply this process to autonomous multi‐differential drive robots (DDR). Subsequently, the NuSMV model is verified against some formal operational specifications obtained from the requirements diagram of the DDR. This system verification approach can help System Engineers identify design flaws or incorrect modeling or specifications that could be missed during the design phase through the results of the model checking process.

MSI-A: An Energy Efficient Approximated Cache Coherence Protocol

Energy consumption has become an essential factor in designing modern computer system architecture. Because of physical limits, the termination of Moore’s law and Dennard’s scaling has forced the computer design community to investigate new approaches to meet the requirements for computing resources. Approximate computing has emerged as a promising method for reducing energy consumption while trading a controllable quality loss. This paper asserts that an approximated cache coherence protocol preserves overall energy for computation. We can approximate the cache coherence protocol by adding approximated cache lines to a certain level without hindering the output. This paper introduces an enhanced approximated version of the MSI (Modified Shared Invalid) cache coherence protocol MSI-A (Modified Shared Invalid-Approx). We have verified MSI-A and MSI by employing LTL specifications in the NuSMV model checker. To illustrate the benefits of MSI-A, we have added DTMC (Discrete-Time Markov Chain) with PCTL (Probabilistic Computational Tree Logic). Although the PCTL proves the theory of approximation, we have also simulated the MSI-A in the TEJAS hardware simulator on PARSEC 3.0 to investigate the energy gains and cycle gains of MSI-A in varied applications. The cache lines considered to be approx are between 10 and 30 percent. Each application benefited from approximation according to its nature, and VIPS has indicated a total energy gain of 30.18 percent.

A Model Combining BDI Logic and Temporal Logics for Decision-Making in Emergency

Abstract Nowadays, we are dealing with panic and unpleasant situations in which, we are constrained to make crucial decisions in a limited delay, due to the mixed emotions that may affect our decision, especially FEAR, this kind of emotion occurs when unwanted or uncontrollable events are present in the environment. These recent years, fear modelling has been well researched and since this emotion is usually associated with the fact that one or more fundamental desires are at stake Unluckily, most of these models miss that FEAR does not always occur similarly in all agents. This paper proposes a new conceptual architecture with a new component by extending BDI logic with the emotion of FEAR, so that the new Emotional-BDI agents may better cope with extremely dynamic unpleasant situations in their surroundings. We also address how we verify the emotional properties by employing a model checker NuSMV. The proposed architecture confirms that NuSMV can be applied to verify the emotional specifications we can program agents that are capable of reasoning over emotions, our experimental results indicate the viability and efficiency of our model. Keywords: Emotional-BDI, Model checking, NuSMV, CUDD, Unpleasant situations.

Verification modulo theories

In this paper, we consider the problem of model checking fair transition systems expressed symbolically in the framework of Satisfiability Modulo Theories. This problem, referred to as Verification Modulo Theories, is tackled by combining two key elements from the legacy of Ed Clarke: SAT-based verification and abstraction refinement. We show how fundamental SAT-based algorithms have been lifted to deal with the extended expressiveness with a tight integration of abstraction within a CEGAR loop. In turn, the case of nonlinear theories is based on a CEGAR loop over the linear case. These two elements have also deeply impacted the development of the NuSMV model checker, born from a joint project between FBK and CMU, and its successor nuXmv, whose core integrates SMT-based techniques for VMT.

Automatic Formal Verification of SysML State Machine Diagrams for Vehicular Control Systems

<div class="section abstract"><div class="htmlview paragraph">Vehicular control systems are characterized with numerous complex interactions with a steady rise of autonomous functions, which makes it more challenging for designers and safety engineers to identify unexpected failures. These systems tend to be highly integrated and exhibit features like concurrency for which traditional verification and validation techniques (i.e. testing and simulation) are insufficient to provide rigorous and complete assessment. Model Checking, a well-known formal verification technique, can be used to rigorously prove the correctness of such systems according to design Requirements. In particular, Model Checking is a method for formally verifying finite-state concurrent systems. Specifications about the system are expressed as temporal logic formulas, and efficient symbolic algorithms are used to traverse the model defined by the system and check if the specification holds or not. Systems Modeling Language (SysML) has been widely used in architectural and functional modeling in automotive industries. However, it cannot directly be verified against safety requirements. In this work, SysML is used to establish a unified system model that can present an integrated autonomy software and hardware system of a vehicular control system. A generic model transformation strategy is developed to integrate SysML with one of the state-of-the-art Model Checking tools, NuSMV. Cameo Systems Modeler is an industry leading cross-platform collaborative Model-Based Systems Engineering environment for designing standard-compliant SysML models and diagrams. A native Cameo's plugin is constructed to transform SysML state machines to the input language of NuSMV model checker and also to replay the verification results back into the Cameo's environment. A case study of an executable state machine for a high-level autonomous driving system is built. The NuSMV model checker is used to model check the state machine of the autonomous driving system against design requirements expressed as temporal logic formulas. Upon violation of design requirements, our SysML-NuSMV integration allows to replay counterexamples in the Cameo modeling environment. Thus a bi-directional integration of system modeling language with the model checker is developed and the transformation rules are defined. The case study result shows how this method can help designers and safety engineers to automatically identify hidden design errors in a variety of possible design models.</div></div>

Specification of Synchronous Network Flooding in Temporal Logic

In distributed network algorithms, network flooding algorithm is considered one of the simplest and most fundamental algorithms. This research specifies the basic synchronous memory-less network flooding algorithm where nodes on the network don’t have memory, for any fixed size of network, in Linear Temporal Logic. The specification can be customized to any single network topology or class of topologies. A specification of the termination problem is formulated and used to compare different topologies for earlier termination. This research gives a worked example of one topology resulting in earlier termination than another, for which we perform a formal verification using the model checker NuSMV

SLA-Driven modeling and verifying cloud systems: A Bigraphical reactive systems-based approach

We propose a formal approach based on Bigraphical Reactive Systems (BRSs) and model checking techniques for modeling and verifying the interaction behaviours of SLA-based cloud computing systems. In the first phase of this approach, we address the modeling of the static structure and the dynamic behavior of cloud systems using BRSs. We show how bigraphs enable the description of the different cloud entities, including cloud actors, cloud services, Service Level Agreements (SLAs), the diversity of their properties, and the complex interactions and dependencies among them. Furthermore, we propose a four-stages SLA lifecycle, and define a set of bigraphical reaction rules to abstract these stages and model the dynamic nature of the cloud. The second phase of this approach verifies that the behavior of services and cloud actors will cope with the agreed SLA terms during the lifecycle of the SLA. We map the proposed bigraphical models into SMV descriptions. Then, we express the interaction behaviors as a set of liveness and safety properties using Linear Temporal Logic (LTL) and Computation Tree Logic (CTL) formulas, and we use the NuSMV model checker to verify them. Finally, we define a case study on which we illustrate the application of our proposed approach.

An improved approach on the model checking for an agent-based simulation system

Model checking is an effective way to verify behaviours of an agent-based simulation system. Three behaviours are analysed: operational, control, and global behaviours. Global behaviours of a system emerge from operational behaviours of local components regulated by control behaviours of the system. The previous works principally focus on verifying the system from the operational point of view (operational behaviour). The satisfaction of the global behaviour of the system conforming to the control behaviour has not been investigated. Thus, in this paper, we propose a more complete approach for verifying global and operational behaviours of systems. To do so, these three behaviours are firstly formalized by automata-based techniques. The meta-transformation between automata theories and Kripke structure is then provided, in order to illustrate the feasibility for the model transformation between the agent-based simulation model and Kripke structure-based model. Then, a mapping between the models is proposed. Subsequently, the global behaviour of the system is verified by the properties extracted from the control behaviour and the operational behaviour is checked by general system performance properties (e.g. safety, deadlock freedom). Finally, a case study on the simulation system for aircraft maintenance has been carried out. A counterexample of signals sending between Flight agent and Plane agent has been produced by NuSMV model checker. Modifications for the NuSMV model and agent-based simulation model have been performed. The experiment results show that 9% out of 19% of flights have been changed to be serviceable.

A weighted resource discovery approach in grid computing

PurposeGrid computing is an effective environment for the execution of parallel applications that requires great computing power. This paper aims to present, based on the hierarchical architecture, an improved weighted resource discovery (WRD) algorithm to manage allocation of resources and minimize cost of communications between grid nodes.Design/methodology/approachA behavioral modeling method is addressed to prove the proposed method correctness. The behavioral model of the proposed algorithm is implemented by StarUML tool with two different model-checking mechanisms. Then, the resource discovery correctness is analyzed in terms of reachability condition, fairness condition and deadlock-free using NuSMV model checker.FindingsThe results show that WRD algorithm has better performance in requiring re-discovery process, the number of examined nodes in each request and discovering the free resources with high-bandwidth links.Originality/valueTo store information of resources, a new data structure called resource information table is proposed which facilitates resource finding of the algorithm. A behavioral modeling method is addressed to prove the proposed method correctness.

$$\hbox {CTL}^{\star }$$ family-based model checking using variability abstractions and modal transition systems

Variational systems can produce a (potentially huge) number of related systems, known as products or variants, by using features (configuration options) to mark the variable functionality. In many of the application domains, their rigorous verification and analysis are very important, yet the appropriate tools rarely are able to analyse variational systems. Recently, this problem was addressed by designing specialized so-called family-based model checking algorithms, which allow simultaneous verification of all variants in a single run by exploiting the commonalities between the variants. Yet, their computational cost still greatly depends on the number of variants (the size of configuration space), which is often huge. Moreover, their implementation and maintenance represent a costly research and development task. One of the most promising approaches to fighting the configuration space explosion problem is variability abstractions, which simplify variability away from variational systems. In this work, we show how to achieve efficient family-based model checking of $$\hbox {CTL}^{\star }$$ temporal properties using variability abstractions and off-the-shelf (single-system) tools. We use variability abstractions for deriving abstract family-based model checking, where the variability model of a variational system is replaced with an abstract (smaller) version of it, called modal transition system, which preserves the satisfaction of both universal and existential temporal properties, as expressible in $$\hbox {CTL}^{\star }$$. Modal transition systems contain two kinds of transitions, termed may- and must-transitions, which are defined by the conservative (over-approximating) abstractions and their dual (under-approximating) abstractions, respectively. The variability abstractions can be combined with different partitionings of the configuration space to infer suitable divide-and-conquer verification plans for the given variational system. We illustrate the practicality of this approach for several variational systems using the standard version of (single-system) NuSMV model checker.

Formal modeling and verification of cloud‐based web service composition

SummaryWeb service composition is a key technology to resolve cross‐organizational business process integration, and it faces many constraints and requirements as unexpected bugs can cause shutdown of the software. A high degree of reliability is expected from such systems, and formal modeling of web service composition is an active area of research. In this work, we propose a new approach for the formal modeling of diverse web service composition. Our approach verifies the terminate property on all possible runs of the system to ensure deadlock‐free workings. For a verification of the properties of interest, we use the NuSMV model checker and specify the properties in CTL*. The approach can be used to verify the soundness property of diverse web service composition to ensure live and deadlock‐free web services.

A symbolic model checking approach in formal verification of distributed systems

Model checking is an influential method to verify complex interactions, concurrent and distributed systems. Model checking constructs a behavioral model of the system using formal concepts such as operations, states, events and actions. The model checkers suffer some weaknesses such as state space explosion problem that has high memory consumption and time complexity. Also, automating temporal logic is the main challenge to define critical specification rules in the model checking. To improve the model checking weaknesses, this paper presents Graphical Symbolic Modeling Toolkit (GSMT) to design and verify the behavioral models of distributed systems. A behavioral modeling framework is presented to design the system behavior in the forms of Kripke structure (KS) and Labeled Transition System (LTS). The behavioral models are created and edited using a graphical user interface platform in four layers that include a design layer, a modeling layer, a logic layer and a symbolic code layer. The GSMT generates a graphical modeling diagram visually for creating behavioral models of the system. Also, the temporal logic formulas are constructed according to some functional properties automatically. The executable code is generated according to the symbolic model verifier that user can choose the original model or reduced model with respect to a recursive reduced model. Finally, the generated code is executed using the NuSMV model checker for evaluating the constructed temporal logic formulas. The code generation time for transforming the behavioral model is compared to other model checking platforms. The proposed GSMT platform has outperformed evaluation than other platforms.

Comparing approaches for model-checking strategies under imperfect information and fairness constraints

Starting from alternating-time temporal logic, many logics for reasoning about strategies in a system of agents have been proposed. Some of them consider the strategies that agents can play when they have partial information about the state of the system. $$ATLK_{irF}$$ is such a logic to reason about uniform strategies under unconditional fairness constraints. While this kind of logics has been extensively studied, practical approaches for solving their model-checking problem appeared only recently. This paper considers three approaches for model-checking strategies under partial observability of the agents, applied to $$ATLK_{irF}$$ . These three approaches have been implemented in PyNuSMV, a Python library based on the state-of-the-art model checker NuSMV. Thanks to the experimental results obtained with this library and thanks to the comparison of the relative performance of the approaches, this paper provides indications and guidelines for the use of these verification techniques, showing that different approaches are needed in different situations.

A two-step approach for pattern-based API-call constraint checking

An operating system publishes a set of application programming interface (API) functions along with a set of API-call constraints with which programs running on the operating system must comply. Any violation of these constraints may become a source of massive property damage or even human injury when such a program is used for safety-critical systems. A rigorous and targeted verification method is needed to identify such violations, which are frequently subtle and difficult to identify using conventional verification methods. As automated tool support for pre-checking constraint violations in the development process, this study presents a two-step approach for checking API-call constraints by using predefined patterns specifically designed for automotive operating systems. A lightweight checking method is designed for quick-and-easy checking of local API-call constraints, which utilizes constraint patterns and the C code model checker CBMC. The global constraint checking method is a heavyweight method, as it requires behavior models of the underlying operating system constructs as well as constraint patterns, but it produces more accurate verification results; it uses the symbolic model checker NuSMV as the backend verification engine. This two-step approach is effective in identifying constraint violations and efficient in reducing false alarms from infeasible execution paths. • A pattern-based two-step approach for API-call constraint checking is proposed. • Constraints are classified into local and global constraints for the OSEK/VDX OS. • Suggested a specialized constraint checking method for each classification. • A lightweight local constraint checking for C code is designed using CBMC. • Suggested more accurate global constraint checking method using formal OS models.

Replicated Computations Results (RCR) Report for “Design and Verification of Trusted Collective Adaptive Systems”

The article “Design and Verification of Trusted Collective Adaptive Systems” by Aldini proposes a process-algebraic framework for modeling and verifying trusted collective adaptive systems. To favor reuse, the system and trust models can be specified separately, only to be integrated at the semantic level. Through a combination of behavioral equivalence checking and model checking against branching-time temporal logic with trust predicates, the framework allows comparative analyses of different trust models as well as analyses of the effects of attacks to the trust models. The applicability of the formal framework is illustrated by means of two representative use cases: the security analysis of a trust-incentive service management system and a comparison of two different reputation systems. This replicated computations results report focuses on the reproducibility of the experiments performed in the aforementioned article, i.e. on the automatic verification of properties against models of these use cases encoded in the well-known NuSMV model checker. It was straightforward to reproduce all results from the article in reasonable time using a standard laptop machine.

Symbolic model checking for discrete real-time systems

A considerably large class of critical applications run in distributed and real-time environments, and most of the correctness requirements of such applications must be expressed by time-critical properties. To enable the specification and verification of these properties in both qualitative and quantitative manners, we propose a new real-time temporal logic $\rm~{RTCTL^*}$, by incorporating both the quantitative (bounded) future and past temporal operators from the qualitative temporal logic $\rm~{CTL^*}$. First, we propose a symbolic method for constructing the temporal tester for arbitrary principally temporal formulas. A temporal tester is constructed as a non-deterministic transducer with a fresh boolean output variable, such that at any position the output variable is set to be true if and only if the corresponding formula holds starting from that position. Then we propose a symbolic model checking method for $\rm~{RTCTL^*}$ over finite-state transition systems with weak fairness constraints based on the compositionality of testers. The soundness and completeness of the model checking method, the expressiveness of $\rm~{RTCTL^*}$, and the complexity of the tester construction are described and proven. We have already implemented an efficient model checking prototype for the real-time linear temporal logic $\rm~{RTLTL}$, which is a quantifier-free version of $\rm~{RTCTL^*}$, by building upon the NuSMV model checker. The theoretical and the experimental results from the prototype both confirm that for checking bounded temporal formulae of the form $f\texttt{U}_{[0,b]}g$ or $f\texttt{S}_{[0,b]}g$, our method performs exponentially better than the translation-based method in NuSMV.