Online Model Checking Research Articles

SORT 2014

SORT 2014

Efficient integration of online model checking into a small‐footprint real‐time operating system

SummaryFor highly safety‐critical applications, rigorous offline verification should be complemented by online verification. One promising technique is Online Model Checking (OMC). The basic approaches on how to design and implement OMC have been discussed in a couple of papers. As OMC is a run‐time‐provided service, it seems to be natural providing it by an operating system (OS) service like any other service offered by the OS. In this paper, we study the feasibility of this approach, that is, whether OMC can be integrated efficiently into an OS. As we are dealing with real‐time systems, the OS in our case is a real‐time operating system (RTOS). This study makes use of a specific OMC system, implemented in our group. We also have implemented a highly efficient RTOS with an extremely small footprint, called ORCOS (Organic ReConfigurable Operating System). Therefore, we use ORCOS as an example RTOS to investigate the feasibility of integrating OMC as an RTOS service. The correctness of the RTOS is not subject to be verified in this case; it is just the service provider. In order to ease understanding the approach, the paper contains a brief introduction into the fundamental concepts of OMC and the way to provide it as an integrated RTOS service. Additionally, basic principles of ORCOS are presented. Based on these foundations, we discuss various integration methods. OMC may become an integral part of the RTOS; it may become a separate task running on the same host as the RTOS, or it may be implemented on a remote host as a kind of service‐oriented architecture. In all three cases, OMC runs concurrently to the application task to be online model checked. We argue that the second approach turns out to be the most appropriate one. It is well suited to state‐of‐the‐art hypervisor‐based mixed criticality architectures, running on a multi‐core hardware platform. In addition, the service‐oriented architecture is discussed as well, however only marginally. To test the feasibility of the approach, an analytical investigation of the implied overhead is carried out. This investigation is complemented by experiments based on a prototype implementation. The promising results obtained by these two studies then are further underpinned by a realistic case study. We use the resolution advisory component of traffic alert and collision avoidance system for this purpose. Copyright © 2015 John Wiley & Sons, Ltd.

From Offline toward Real Time: A Hybrid Systems Model Checking and CPS Codesign Approach for Medical Device Plug-and-Play Collaborations

Hybrid systems model checking is a great success in guaranteeing the safety of computerized control cyber-physical systems (CPS). However, when applying hybrid systems model checking to Medical Device Plug-and-Play (MDPnP) CPS, we encounter two challenges due to the complexity of human body: 1) there are no good offline differential equation-based models for many human body parameters; 2) the complexity of human body can result in many variables, complicating the system model. In an attempt to address the challenges, we propose to alter the traditional approach of offline hybrid systems model checking of time-unbounded (i.e., infinite horizon, a.k.a., long run) future behavior to online hybrid systems model checking of time-bounded (i.e., finite horizon, a.k.a., short run) future behavior. According to this proposal, online model checking runs as a real-time task to prevent faults. To meet the real-time requirements, certain design patterns must be followed, which brings up the codesign issue. We propose two sets of system codesign patterns for hard real time and soft real time, respectively. To evaluate our proposals, a case study on laser tracheotomy MDPnP is carried out. The study shows the necessity of online model checking. Furthermore, test results based on real-world human subject trace show the feasibility and effectiveness of our proposed codesign.

Online model checking approach based parameter estimation to a neuronal fate decision simulation model in Caenorhabditis elegans with hybrid functional Petri net with extension

Mathematical modeling and simulation studies are playing an increasingly important role in helping researchers elucidate how living organisms function in cells. In systems biology, researchers typically tune many parameters manually to achieve simulation results that are consistent with biological knowledge. This severely limits the size and complexity of simulation models built. In order to break this limitation, we propose a computational framework to automatically estimate kinetic parameters for a given network structure. We utilized an online (on-the-fly) model checking technique (which saves resources compared to the offline approach), with a quantitative modeling and simulation architecture named hybrid functional Petri net with extension (HFPNe). We demonstrate the applicability of this framework by the analysis of the underlying model for the neuronal cell fate decision model (ASE fate model) in Caenorhabditis elegans. First, we built a quantitative ASE fate model containing 3327 components emulating nine genetic conditions. Then, using our developed efficient online model checker, MIRACH 1.0, together with parameter estimation, we ran 20-million simulation runs, and were able to locate 57 parameter sets for 23 parameters in the model that are consistent with 45 biological rules extracted from published biological articles without much manual intervention. To evaluate the robustness of these 57 parameter sets, we run another 20 million simulation runs using different magnitudes of noise. Our simulation results concluded that among these models, one model is the most reasonable and robust simulation model owing to the high stability against these stochastic noises. Our simulation results provide interesting biological findings which could be used for future wet-lab experiments.

Automatic Processor Customization for Zero-Overhead Online Software Verification

The PSL-to-Verilog (P2V) compiler can translate a set of assertions about a block-structured software program into a hardware design to be executed concurrently with the program. The assertions validate the correctness of the software program without altering the program's temporal behavior in any way, a result never previously achieved by any online model-checking system. Additionally, the techniques and implementations described apply to any general purpose program and the absence of execution overhead renders the system ideal for the verification and debugging of real-time systems. Assertions are expressed in a simple subset of the property specification language (PSL), an IEEE standard originally intended for the behavioral specification of hardware designs. The target execution system is the eMIPS processor, a dynamically self-extensible processor realized with a field-programmable gate array (FPGA). The system can concurrently execute and check multiple programs at a time. Assertions are compiled into eMIPS Extensions, which are loaded by the operating system software into a portion of the FPGA, and discarded once the program terminates. If an assertion is violated, the program receives an exception, otherwise, it executes fully unaware of its verifier. The software program is not modified in any way. It can be compiled separately with full optimizations and executes with or without the corresponding hardware checker. The P2V compiler, implemented in Python, generates code for the implementation of the eMIPS processor running on the Xilinx ML401 development board. It is currently used to verify software properties in areas such as testing, debugging, intrusion detection, and the behavioral verification of concurrent and real-time programs.

Model-based Runtime Verification Framework for Self-optimizing Systems

This paper describes a novel on-line model checking approach offered as service of a real-time operating system (RTOS). The verification system is intended especially for self-optimizing component-based real-time systems where self-optimization is performed by dynamically exchanging components. The verification is performed at the level of (RT-UML) models. The properties to be checked are expressed by RT-OCL terms where the underlying temporal logic is restricted to either time-annotated ACTL or LTL formulae. The on-line model checking runs interleaved with the execution of the component to be checked in a pipelined manner. The technique applied is based on on-the-fly model checking. More specifically for ACTL formulae this means on-the-fly solution of the NHORNSAT problem while in the case of LTL the emptiness checking method is applied.