Process Algebraic Specifications Research Articles

A process algebraic mutation framework with application to a vehicle charging protocol

Modern day renewable and smart energy systems are increasingly playing an important role in our societies. Electric vehicle charging services infrastructures are becoming ever more popular and accessible, although at a pace that we argue is not well understood yet in terms of the reliability and security of this new paradigm. Often solutions are rolled out to the market with little or no analysis of their resilience and even at the standards level, specifications of systems and protocol often omit or skim over the question of reliability. In this paper, we propose a new formal approach for analysing the effects of single failures on process algebraic specifications used often in specifying communication protocols. We apply this new approach to one part of an international standard protocol, the Open Charge Point Protocol, for electric vehicle charging, and demonstrate how the effects of specification faults can impact the safety and security of the protocol.

Model Checking Based Approach for Compliance Checking


 
 
 Process mining is the set of techniques to retrieve a process model starting from available logging data. The discovered process model has to be analyzed to verify it respects the defined properties, i.e., the so-called compliance checking. Our aim is to use a model checking based approach to verify compliance. First, we propose an integrated-tool approach using existing tools as ProM (a framework supporting process mining techniques) and CADP (a formal verification environment). More precisely, the execution traces from a software system are extracted. Then, using the “Mine Transition System” plugin in ProM, we obtain a labelled transition system, that can be easily used to verify formal properties trough CADP. However, this choice presents the “state explosion” problem, i.e., models discovered through the classical process mining techniques tend to be large and complex. In order to solve this problem, another custom-made approach is shown, which accomplishes a pre- processing on the traces to obtain abstract traces, where abstraction is based on the set of temporal logic formulae specifying the system properties. Then, from the set of abstracted traces, we discover a system described in Lotos, a process algebra specification language; in this way we do not build an operational model for the system, but we produce only a language description from which a model checking environment will automatically obtain the reduced corresponding transition system. Real systems have been used as case studies to evaluate the proposed methodologies.
 
 

Enhancing Formal Methods Integration with ACP2Petri

The paper deals with the ACP2Petri tool, providing a transformation of process algebraic specification to equivalent Petri net-based specification. Long-term practical experiences with the tool revealed some suggestions for its update and extension. Shortcomings and limitations found are described and proposed solutions provided within the paper. Implemented extensions, simplifying the usage of the tool and providing more options for analysis of particular transformation, are also presented. One of the most evident extensions of the tool is its graphical user interface, which allows for convenient management and detailed control over the process of transformation.

Verification of EB3 specifications using CADP

Abstract E B 3 is a specification language for information systems. The core of the E B 3 language consists of process algebraic specifications describing the behaviour of the entities in a system, and attribute function definitions describing the entity attributes. The verification of E B 3 specifications against temporal properties is of great interest to users of E B 3 . In this paper, we propose a translation from E B 3 to LOTOS NT (LNT for short), a value-passing concurrent language with classical process algebra features. Our translation ensures the one-to-one correspondence between states and transitions of the labelled transition systems corresponding to the E B 3 and LNT specifications. We automated this translation with the E B 3 2 L N T tool, thus equipping the E B 3 method with the functional verification features available in the CADP toolbox.

CCS: It’s not fair!

In the process algebra community it is sometimes suggested that, on some level of abstraction, any distributed system can be modelled in standard process-algebraic specification formalisms like CCS. This sentiment is strengthened by results testifying that CCS, like many similar formalisms, is Turing powerful and provides a mechanism for interaction. This paper counters that sentiment by presenting a simple fair scheduler---one that in suitable variations occurs in many distributed systems---of which no implementation can be expressed in CCS, unless CCS is enriched with a fairness assumption. Since Dekker's and Peterson's mutual exclusion protocols implement fair schedulers, it follows that these protocols cannot be rendered correctly in CCS without imposing a fairness assumption. Peterson expressed this algorithm correctly in pseudocode without resorting to a fairness assumption, so it furthermore follows that CCS lacks the expressive power to accurately capture such pseudocode.

Efficient Instantiation of Parameterised Boolean Equation Systems to Parity Games

Parameterised Boolean Equation Systems (PBESs) are sequences of Boolean fixed point equations with data variables, used for, e.g., verification of modal mu-calculus formulae for process algebraic specifications with data. Solving a PBES is usually done by instantiation to a Parity Game and then solving the game. Practical game solvers exist, but the instantiation step is the bottleneck. We enhance the instantiation in two steps. First, we transform the PBES to a Parameterised Parity Game (PPG), a PBES with each equation either conjunctive or disjunctive. Then we use LTSmin, that offers transition caching, efficient storage of states and both distributed and symbolic state space generation, for generating the game graph. To that end we define a language module for LTSmin, consisting of an encoding of variables with parameters into state vectors, a grouped transition relation and a dependency matrix to indicate the dependencies between parts of the state vector and transition groups. Benchmarks on some large case studies, show that the method speeds up the instantiation significantly and decreases memory usage drastically.

A Combined Process Algebraic and Stochastic Approach to Bone Remodeling

In adult life the bone is continuously being resorbed and renewed. Here we present a stochastic model of the homeostatic nature of bone remodeling, where osteoclasts perform bone resorption which is equally balanced by bone formation performed by osteoblasts. The stochastic model is embedded in a process-algebraic specification based on the Shape Calculus, which provides an effective multiscale description of the process. Our model considers increasing dimensionality from RANKL molecular signaling to osteoclast/osteoblast stochastic dynamics within a basic multicellular unit (BMU) to bone mass formation. We show that after a micro-fracture the simulated bone remodeling dynamics is timescale consistent with the biological process. Our combined methodology provides a first effective stochastic model of the bone remodeling framework which could be used to test healthy and pathological conditions.

Reo + mCRL2 : A framework for model-checking dataflow in service compositions

Abstract The paradigm of service-oriented computing revolutionized the field of software engineering. According to this paradigm, new systems are composed of existing stand-alone services to support complex cross-organizational business processes. Correct communication of these services is not possible without a proper coordination mechanism. The Reo coordination language is a channel-based modeling language that introduces various types of channels and their composition rules. By composing Reo channels, one can specify Reo connectors that realize arbitrary complex behavioral protocols. Several formalisms have been introduced to give semantics to Reo. In their most basic form, they reflect service synchronization and dataflow constraints imposed by connectors. To ensure that the composed system behaves as intended, we need a wide range of automated verification tools to assist service composition designers. In this paper, we present our framework for the verification of Reo using the mCRL2 toolset. We unify our previous work on mapping various semantic models for Reo, namely, constraint automata, timed constraint automata, coloring semantics and the newly developed action constraint automata, to the process algebraic specification language of mCRL2, address the correctness of this mapping, discuss tool support, and present a detailed example that illustrates the use of Reo empowered with mCRL2 for the analysis of dataflow in service-based process models.

Towards reduction of Paradigm coordination models

The coordination modelling language Paradigm addresses collaboration between components in terms of dynamic constraints. Within a Paradigm model, component dynamics are consistently specified at a detailed and a global level of abstraction. To enable automated verification of Paradigm models, a translation of Paradigm into process algebra has been defined in previous work. In this paper we investigate, guided by a client-server example, reduction of Paradigm models based on a notion of global inertness. Representation of Paradigm models as process algebraic specifications helps to establish a property-preserving equivalence relation between the original and the reduced Paradigm model. Experiments indicate that in this way larger Paradigm models can be analyzed.

Input-output Conformance Testing for Channel-based Service Connectors

Service-based systems are software systems composed of autonomous components or services provided by different vendors, deployed on remote machines and accessible through the web. One of the challenges of modern software engineering is to ensure that such a system behaves as intended by its designer. The Reo coordination language is an extensible notation for formal modeling and execution of service compositions. Services that have no prior knowledge about each other communicate through advanced channel connectors which guarantee that each participant, service or client, receives the right data at the right time. Each channel is a binary relation that imposes synchronization and data constraints on input and output messages. Furthermore, channels are composed together to realize arbitrarily complex behavioral protocols. During this process, a designer may introduce errors into the connector model or the code for their execution, and thus affect the behavior of a composed service. In this paper, we present an approach for model-based testing of coordination protocols designed in Reo. Our approach is based on the input-output conformance (ioco) testing theory and exploits the mapping of automata-based semantic models for Reo to equivalent process algebra specifications.

Formally based tool support for model checking Erlang applications

Model checking as a verification technique has proved effective at the system design and hardware level, and is now beginning to be applied to program code. In this paper, we study the application of model checking techniques in the development of Erlang systems. Erlang is a concurrent functional language with specific support for the development of distributed, fault-tolerant systems with soft real-time requirements. It was designed from the start to support a concurrency-oriented programming paradigm and large distributed implementations that this supports. The methodology we describe in this paper consists of abstracting the behaviour of Erlang and OTP components into a process algebraic specification, specifically an mCRL2 specification, upon which the standard model checker CADP can be used to verify the system’s properties. In addition to rules that model the Erlang syntax, a translation mechanism for the OTP modules gen_server, supervisor and gen_fsm, and the timeout event are defined. A tool-set etomcrl2 has been developed to automate the process of translation. A small illustrative example is used to evaluate the effectiveness of the proposed techniques, and its results show that the proposed techniques are effective in both verifying properties as well as distinguishing between correct and faulty implementations of the design.

Analysis of information flow security in cyber–physical systems

Abstract Information flow is a fundamental concept underlying the security of a system. Confidentiality of information in a system can be breached through unrestricted information flow. Physical components added to a cyber system considerably increase the difficulty of determining information flow and the difficulty of mitigating the corresponding confidentiality problem. Fundamentally, physical actions inherently divulge information through simple observation. This work applies classical models of non-deducibility and non-inference to cyber–physical systems (CPSs) to determine information flow in the coupled cyber and physical worlds. The results demonstrate that the combined physical and cyber properties of a CPS can both protect and divulge information. The key to formalizing this analysis is to find a uniform semantic representation of the cyber and physical components, their interaction, and the physics of the system, and to devise a formal modeling technique for determining information flow. This paper presents a semantic model for information flow analysis in a CPS and describes an approach to perform the analysis, including both trace-based analysis and automated analysis through process algebra specification. Two model infrastructures demonstrate the approach, a gas pipeline system and a smart electric power grid system. In the gas pipeline system, cooperating flow control system devices exchange confidential information to produce physical actions in the pipeline. In the smart grid, cooperating flexible alternating current transmission system devices exchange confidential information to produce physical actions. The approach can verify whether these infrastructures inherently preserve confidentiality.

Towards model checking executable UML specifications in mCRL2

We describe a translation of a subset of executable UML (xUML) into the process algebraic specification language mCRL2. This subset includes class diagrams with class generalisations, and state machines with signal and change events. The choice of these xUML constructs is dictated by their use in the modelling of railway interlocking systems. The long-term goal is to verify safety properties of interlockings modelled in xUML using the mCRL2 and LTSmin toolsets. Initial verification of an interlocking toy example demonstrates that the safety properties of model instances depend crucially on the run-to-completion assumptions.

Security Abstractions and Intruder Models (Extended Abstract)

Process algebraic specifications of distributed systems are increasingly being targeted at identifying security primitives well-suited as high-level programming abstractions, and at the same time adequate for security analysis and verification. Drawing on our earlier work along these lines [Bugliesi, M. and R. Focardi, Language based secure communication , in: Proceedings of the 21st IEEE Computer Security Foundations Symposium, CSF 2008, Pittsburgh, Pennsylvania, 23-25 June 2008 (2008), pp. 3–16], we investigate the expressive power of a core set of security and network abstractions that provide high-level primitives for the specifications of the honest principals in a network as well as the lower-level adversarial primitives that must be assumed available to an attacker. We analyze various bisimulation equivalences for security, arising from endowing the intruder with ( i ) different adversarial capabilities and ( ii ) increasingly powerful control on the interaction among the distributed principals of a network. By comparing the relative strength of the bimimulation equivalences we obtain a direct measure of the discriminating power of the intruders, hence of the expressiveness of the corresponding models.

Reversible enhanced event structures: Towards reversible E-LOTOS

After studying how undoing of events of irreversibly aging processes complicates in the presence of urgent events or occasionally suspended subprocesses, we propose a reversibility operator for the standard process-algebraic specification language E-LOTOS, whose recently proposed true-concurrency semantics is based on enhanced event structures (EESs). With this operator, the reversibility of events executed by a real-time process and the urgency of their undoing can be specified with respect to their external appearance and the time elapsed since their execution. To facilitate definition of the operator, we introduce a very fine control of event undoing into the general EESs.

An abstract interpretation toolkit for μCRL

This paper describes a toolkit that assists in the task of generating abstract approximations of process algebraic specifications written in the language μCRL. Abstractions are represented by Modal Labelled Transition Systems, which are mixed transition systems with may and must modalities. The approach permits to infer the satisfaction or refutation of safety and liveness properties expressed in the (action-based) μ-calculus. The tool supports the abstraction of states and action labels, which allows to deal with infinitely branching systems.

State space reduction for process algebra specifications

Data-flow analysis to identify “dead” variables and reset them to an “undefined” value is an effective technique for fighting state explosion in the enumerative verification of concurrent systems. Although this technique is well-adapted to imperative languages, it is not directly applicable to value-passing process algebras, in which variables cannot be reset explicitly due to the single-assignment constraints of the functional programming style. This paper addresses this problem by performing data-flow analysis on an intermediate model (Petri nets extended with state variables) into which process algebra specifications can be translated automatically. It also addresses important issues such as avoiding the introduction of useless reset operations and handling shared read-only variables that child processes inherit from their parents.

An Abstract Interpretation Toolkit for μCRL

This paper describes a toolkit that assists in the task of generating abstract approximations of process algebraic specifications written in the language μCRL. Abstractions are represented by Modal Labelled Transition Systems, which are mixed transition systems with may and must modalities. The approach permits to infer the satisfaction or refutation of safety and liveness properties expressed in the (action-based) μ-calculus. The tool supports the abstraction of states and action labels which allows to deal with infinitely branching systems.

Stepwise Development of Process-Algebraic Specifications in Decorated Trace Semantics

Process algebras are convenient formalisms to develop specifications stepwise. This can be done with the help of partially defined states in a specification. When refining the specification, new transitions are added to partially defined states. At every step, it is verified with the help of special preorders, refinement relations, that the step leads towards a desired goal. This approach has already been introduced in the case, where the verification is based on weak bisimulation equivalence. We show in this article that refinement relations can also be developed in decorated trace semantics. Moreover, the intuitive picture seems to be simpler in trace-based than in bisimulation-based semantics. The algorithms to compute the new refinement relations are exponential in the worst case, but behave quite well in practical cases.

Development of a verified Erlang program for resource locking

In this paper, we describe a tool to verify Erlang programs and show, by means of an industrial case study, how this tool is used. The tool includes a number of components, including a translation component, a state space generation component and a model checking component. To verify properties of the code, the tool first translates the Erlang code into a process algebraic specification. The outcome of the translation is made more efficient by taking advantage of the fact that software written in Erlang builds upon software design patterns such as client–server behaviours. A labelled transition system is constructed from the specification by use of the μCRL toolset. The resulting labelled transition system is model checked against a set of properties formulated in the μ-calculus using the Caesar/Aldebaran toolset.As a case study we focus on a simplified resource manager modelled on a real implementation in the control software of the AXD 301 ATM switch. Some of the key properties we verified for the program are mutual exclusion and non-starvation. Since the toolset supports only the regular alternation-free μ-calculus, some ingenuity is needed for checking the liveness property “non-starvation”. The case study has been refined step by step to provide more functionality, with each step motivated by a corresponding formal verification using model checking .