Proof Obligations Research Articles

Encoding TLA+ proof obligations safely for SMT

The TLA+ Proof System (TLAPS) allows users to verify proofs with the support of automated theorem provers, including SMT solvers. To increase trust in TLAPS, we revisited the encoding of TLA+ for SMT, whose implementation had become too complex. Our approach is based on a first-order axiomatization with E-matching patterns. The new encoding is available with TLAPS and achieves performances similar to the previous version, despite its simpler design.

Reflexive Event-B: Semantics and Correctness the EB4EB Framework

The Event-B method enables correct by construction modeling of systems. It relies on set theory and first-order logic, to describe a series of refined system models expressed as a set of events modifying state variables. Invariants and theorems are introduced to express system properties submitted to the proof system associated with Event-B. While Event-B has proven its efficiency for the proof of this type of property, it does not offer powerful means allowing the explicit description of properties other than safety and specific forms of reachability. Checking other properties such as deadlock-freeness, liveness, or event scheduling requires ad hoc modeling techniques and external tools such as model checkers or other proof systems. This article presents <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EB4EB</i> , a new modeling framework offering the capability to introduce formally defined Event-B extensions, in particular new proof obligations corresponding to new properties. It is based on metamodeling techniques. It includes a theory (a metatheory) modeling Event-B and offers means for explicit manipulation of Event-B features and an extension mechanism to explicitly formalize and prove other properties. This reflexive framework relies on a trace-based semantics of Event-B and introduces a set of Event-B theories defining data types, operators, well-defined conditions, theorems, and proof rules to define Event-B constructs and their semantics. Deep and shallow instantiation mechanisms are set up to instantiate the obtained metatheory. The EB4EB framework and its instantiation mechanisms are developed in Event-B using the Rodin platform ensuring correctness and internal consistency of the defined theories. Lamport's clock example, instantiating EB4EB in both shallow and deep mechanisms, is used to evaluate the proposed approach.

Formal Verification of Stability for Parametric affine Switched Systems

We focus on switched systems with a parametric affine term and state-dependent switch logic. For these systems, we aim to synthesize a region of parameters for which we guarantee a formal proof of Global Asymptotic Stability (GAS). We propose a novel technique based on Piecewise Quadratic Lyapunov Functions that are either Locally Valid (LVPQLF) or Parametric (PPQLF), for which we can define the LMI problem for synthesis and the symbolic proof obligations for formal verification. We implement the technique and show that it scales up to industrial-size systems with 21 state variables.

A formal framework to design and prove trustworthy memory controllers

In order to prove conformance to memory standards and bound memory access latency, recently proposed real-time DRAM controllers rely on paper and pencil proofs, which can be troubling: they are difficult to read and review, they are often shown only partially and/or rely on abstractions for the sake of conciseness, and they can easily diverge from the controller implementation, as no formal link is established between both. We propose a new framework written in Coq, in which we model a DRAM controller and its expected behaviour as a formal specification. The trustworthiness in our solution is two-fold: (1) proofs that are typically done on paper and pencil are now done in Coq and thus certified by its kernel, and (2) the reviewer’s job develops into making sure that the formal specification matches the standards—instead of performing a thorough check of the mathematical formalism. Our framework provides a generic DRAM model capturing a set of controller properties as proof obligations, which all implementations must comply with. We focus on properties related to the assertiveness that timing constraints are respected, every incoming request is handled in bounded time, and the DRAM command protocol is respected. We refine our specification with two implementations based on widely-known arbitration policies—First-in First-Out (FIFO) and Time-Division Multiplexing (TDM). We extract proved code from our model and use it as a “trusted core” on a cycle-accurate DRAM simulator.

A formal approach for the correct deployment of cloud applications

The deployment of cloud applications is a complex task. It refers to the enablement of SaaS, PaaS or IaaS solutions that may be accessed on demand by end users. It encompasses all the activities from installation to uninstallation, including reconfiguration, etc. To facilitate the deployment of cloud applications, it is essential to design them as component-based applications in order to favor the design by reusing and reducing the development cost. However, assembling components can be a tedious and error-prone task if sufficient precautions are not taken regarding different constraints, dependencies, and conflicts between components. In this paper, we introduce a formal Event-B-based approach for the modeling and the verification of component-based applications deployment. Our goal is to build correct by-construction systems that fulfill the different constraints regarding the components, the cloud infrastructure, and the deployment process. Basically, our approach starts with an abstract model describing the main concepts of the system. Then different details are gradually introduced through refinement. For each refinement step, proof obligations are produced to ensure the model's correctness. The obtained formal model consists of a precise specification on which mathematical reasoning can be carried out to prove the correctness of our component-based application model and validate its deployment in a cloud environment by using ProB. The presented approach is illustrated through a case study.

Equation-Directed Axiomatization of Lustre Semantics to Enable Optimized Code Validation

Model-based design tools like SCADE Suite and Simulink are often used to design safety-critical embedded software. Consequently, generating correct code from such models is crucial. We tackle this challenge on Lustre, a dataflow synchronous language that embodies the concepts that base such tools. Instead of proving correct a whole code generator, we turn an existing compiler into a certifying compiler from Lustre to C, following a translation validation approach. We propose a solution that generates both C code and an attached specification expressing a correctness result for the generated and optionally optimized code. The specification yields proof obligations that are discharged by external solvers through the Frama-C platform.

Identifying Overly Restrictive Matching Patterns in SMT-based Program Verifiers (Extended Version)

Universal quantifiers occur frequently in proof obligations produced by program verifiers, for instance, to axiomatize uninterpreted functions and to statically express properties of arrays. SMT-based verifiers typically reason about them via E-matching, an SMT algorithm that requires syntactic matching patterns to guide the quantifier instantiations. Devising good matching patterns is challenging. In particular, overly restrictive patterns may lead to spurious verification errors if the quantifiers needed for proof are not instantiated; they may also conceal unsoundness caused by inconsistent axiomatizations. In this article, we present the first technique that identifies and helps the users and the developers of program verifiers remedy the effects of overly restrictive matching patterns. We designed a novel algorithm to synthesize missing triggering terms required to complete unsatisfiability proofs via E-matching. Tool developers can use this information to refine their matching patterns and prevent similar verification errors, or to fix a detected unsoundness.

Formal modelling and verification of scalable service composition in IoT environment

A system based on the internet of things (IoT) consists of services deployed across several devices that collaborate to fulfil IoT system goals. The growth in the number of IoT services that has occurred concurrently with the growth in the number of IoT devices is posing a significant difficulty for the process of service composition. In order to satisfy increasing demand and rapid expansion while keeping a certain level of quality of service, IoT systems need a scalable IoT service composition. However, building the correct scalable service composition is not guaranteed in IoT systems. This paper proposes formal modeling and verification of the scalability in IoT service composition at design time based on Event-B formal method. To fulfil the requirements of IoT service composition, the proposed model addresses more key qualities, mainly availability and interoperability. Further, by relying on the refinement technique, we create our model sequentially from the requirements analysis level to the target level. Finally, we validate and verify the correctness of the proposed formal model using of the Rodin platform and several proof obligations. Our verified model of the scalable IoT service composition has met its 44 proof obligations, and the Rodin prover was responsible for automatically addressing all of these proof obligations.

Everything You Always Wanted to Know About Generalization of Proof Obligations in PDR

In this article, we revisit the topic of generalizing proof obligations (POs) in bit-level property directed reachability (PDR). We provide a comprehensive study which: 1) determines the complexity of the problem; 2) thoroughly analyzes limitations of existing methods; 3) introduces approaches to PO generalization that have never been used in the context of PDR; 4) compares the strengths of different methods from a theoretical point of view; and 5) intensively evaluates the methods on various benchmarks from the hardware model checking as well as from AI planning.

A verified VCGen based on dynamic logic: An exercise in meta-verification with Why3

With the incresasing importance of program verification, an issue that has been receiving more attention is the certification of verification tools, addressing the vernacular question: “Who verifies the verifier?”. In this paper we approach this meta-verification problem by focusing on a fundamental component of program verifiers: the “Verification Conditions Generator” (VCGen), responsible for producing a set of proof obligations from a program and a specification. The semantic foundations of VCGens lie in program logics, such as Hoare logic, Dynamic logic, or Separation logic, and related predicate transformers.Dynamic logic is the basis of the KeY system, one of the foremost deductive verifiers, whose logic makes use of the notion of update, which is quite intricate to formalize. In this paper we derive systematically, based on a KeY-style dynamic logic, a correct-by-construction VCGen for a toy programming language. Our workflow covers the entire process, from the logic to the VCGen. It is implemented in the Why3 tool, which is itself a program verifier. We prove the soundness and (an appropriate notion of) completeness of the logic, then define a VCGen for our language and establish its soundness.Dynamic logic is one of a variety of research topics that our dear friend and colleague Luís Soares Barbosa has, over the years, initiated and promoted at the University of Minho. It is a pleasure for us to dedicate this work to him on the occasion of his 60th birthday.

Program Synthesis for Cyber-Resilience

Architectural tactics enable stakeholders to achieve cyber-resilience requirements. They permit systems to react, resist, detect, and recover from cyber incidents. This paper presents an approach to generate source code for architectural tactics typically used in safety and mission-critical systems. Our approach extensively relies on the use of the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> formal method and the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EventB2Java</small> code generation plugin of the Rodin platform. It leverages the modeling of architectural tactics in the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> formal language and uses a set of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EventB2Java</small> transformation rules to generate certified code implementations for the said tactics. Since resilience requirements are statements about a system over time, and because of the fact that the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> language does not provide (native) support for the writing of temporal specifications, we have implemented a novel Linear Temporal Logic (LTL) extension for <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> . We support several architectural tactics for availability, performance, and security. The generated code is certified in the following sense: discharging proof obligations in Rodin - the platform we use for writing the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> models - attests to the soundness of the architectural tactics modelled in <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Event-B</small> , and the soundness of the translation encoded by the <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EventB2Java</small> tool attests to the code correctness. Finally, we demonstrate the usability of our resilience validation approach with the aid of an Autonomous Vehicle System. It further helped us increase our confidence in the soundness of our Event-B LTL extension.

A fairness-based refinement strategy to transform liveness properties in Event-B models

Stepwise development supported by the Event-B formalism has been used in the domain of system design and verification. This refinement approach guarantees that safety properties are preserved with Event-B proof obligations, while additional reasoning and fairness assumptions are required to prove the transformation of liveness properties in Event-B models. This paper presents a new proof-based approach that integrates Linear Temporal Logic (LTL) and Event-B for reasoning about the refinement of liveness properties. We first developed an extended version of LTL that could be used in Event-B models with three basic atomic propositions: state-related propositions, event-related propositions, and enabledness of events. Then we employed this extended LTL to express four important temporal properties with Event-B proof obligations and fairness assumptions. Besides the typical Event-B proof obligations, we specified conditions such as relative deadlock freeness, conditional convergence, and fairness assumptions to allow temporal properties to be transformed during refinement steps. The generic fairness-based refinement strategies were developed to replace or strengthen the fairness assumptions in the refinement steps of Event-B models. A reliable retransmission example is used to illustrate the approach. • Formal presentation of temporal properties with proof obligations and fairness assumptions. • Define transformation function to map abstract temporal properties into concrete ones. • Provide fairness-based refinement strategies to transform temporal properties.

Keep All Objectives Satisfied (KAOS) to Event-B Models Transformation

Requirements engineering is an important aspect of the software development methodology because it is the first phase in every software development. The usefulness of formal language in requirements is well-established to ensure consistency. However, the conversion from informal requirements to the formal specification phase is still challenging because it requires advanced skills and much practice. Due to this challenge, we improve the conversion and relationship of these two phases by capturing requirements using KAOS approach and writing the formal specification using Event-B language. KAOS approach allows modeling the requirements through goal hierarchies, whereas Event-B is a formal system-level modeling and analysis method. This work proposes model transformation rules from KAOS model to Event-B model, along with implementing the rules, and evaluates the proposed rules using Mine Pump Controller case study. We used a model-driven approach, specifically model-to-model transformation, to transform KAOS model to Event-B model. We modeled the case study into the KAOS model to obtain the source model for our model transformation and extend the existing KAOS meta-model by adding four new meta-classes to ensure the KAOS model can accommodate all Event-B components. Our proposed rules manage to generate an abstract Event-B model, and a set of proof obligations have been used to verify the correctness of the model. However, the designers must manually perform the transition between the generated outputs to the Event-B platform.

Modular Over‐the‐air Software Updates for Safety‐critical Real‐time Systems

ABSTRACTAutomotive software is undergoing a rapid change toward artificial intelligence and towards more and more connectedness with other systems. For both, an incremental design paradigm is desired, where the car's software is frequently updated after production but still can guarantee the highest automotive safety standards. We present a design flow and tool framework enabling a DevOps paradigm for automotive software development. DevOps means that software is developed in a continuous loop of development, deployment, usage in the field, collection of runtime data and feedback to the developers for the next design iteration. The software developers get support in defining, developing, and verifying new software functions based on the data gathered in the field by the previous software generation. The software developers can define contracts describing the time and resource assumptions on the integration environment and guarantees for other dependent software components in the system. These contracts allow a composition of software components and proof obligations to be discharged at design time through virtual integration testing and runtime through continuous monitoring of assumptions and guarantees on the software component's interfaces. An update package, consisting of the software component and its contracts, is then automatically created, transferred over the air, and deployed in the car. Monitors derived from the contracts allow for supervising the system's behavior, detecting failures at runtime, and annotating the situation to be included in a data collection, fueling the next design iteration.

Microservice based scalable IoT architecture for device interoperability

The Internet of Things (IoT) revolutionizes the technology landscape by enabling a wide spectrum of services and applications, characterized by a large number of devices, communication protocols, and data formats. Seamless integration among various IoT-enabled technologies is the most challenging task as the technical standards are disjoint. This often results in monolithic structures with very poor scalability. Further, data heterogeneity in IoT networks increases the measure of multidimensionality, which poses a critical challenge of sharing data with other business applications. Therefore, IoT-based solution requires an architectural framework supported by a large number of independent and specialized microservices towards providing sufficient scalability and interoperability. In this manuscript, a layered architectural framework is proposed where a novel device template concept is introduced to enable flexible and interoperable integration of microservices with IoT devices. The proposed model is formally validated using Event-B in the Rodin platform with the help of proof obligations. Again, a service aggregation algorithm is proposed to reduce the latency and increase the reuse of microservices. Further, the proposed architectural framework is implemented and compared with other similar frameworks. The experimental result shows that the proposed architectural framework enables enhanced interoperability, scalability, and reusability of IoT devices and microservices.

Rigorous Design of Fault Tolerance and Recovery Algorithm for Disaster Management and Relief Distribution System using Event-B

India is vulnerable to disasters such as earthquakes, floods, tsunamis, landslides forest fires and cyclones due to its unique socio-economic and geo-climatic conditions. Twenty seven out of thirty-six states and union territories are prone to different types of disasters which cause loss of life, disruption of livelihoods, damage to infrastructure and property which in turn becomes a heavy burden on the national economy. Effective management of relief work is a key step towards normalizing human life post disaster. In this paper, we have presented the formal development and verification of a fault tolerance and recovery algorithm for district level disaster control centers in India which are connected to each other via a communication network. Formal methods help in the verification of critical properties of complex systems by developing mathematical models so that design errors can be detected and removed during the early stages of software development. Event-B, which is a formal method and Rodin platform is used for this work. Event-B is a mathematical language of first-order logic to provide a solution to the complex algorithms formally. In this algorithm a Disaster Control Centre is chosen as the coordinator based on its unique vote value. This vote value is allotted and modified dynamically based on the extent of damage in the area where the center is located. The center having the highest vote value among the currently active centers is elected as the coordinator. The correctness of the algorithm is verified through discharge of proof obligations generated by the Event-B model.

An Event-B Approach to the Development of Fork/Join Parallel Programs

Fork/Join is a simple but effective technique for exploiting the parallelism. When developing a parallel program using Fork/Join, one of the main things is how a large task is decomposed into subtasks whose results can be combined as a final result. In this paper we show how to develop Fork/Join parallel programs through refinement and decomposition. We take Fork/Join style task decomposition as a refinement which we call Fork/Join refinement. Proof obligations of refinement can ensure the correctness of decomposition. For practical application, we provide a refinement pattern for the Fork/Join refinement and extend an atomicity decomposition diagram to illustrate it. Our approach provides a good framework for modeling Fork/Join parallel programs and showing proof obligations of correctness for such programs. We illustrate the approach by applying it on a small case.

Correct-by-Construction Approach for Formal Verification of IoT Architecture

Nowadays, The Internet of Things(IoT) has shown an increased interest in the academic literature, while its implementations became involved in almost every aspect of life in modern society. IoT is the integration of virtual and physical things through distributed services to collect and share data among themselves. The number of architecture approaches designed to aid IoT has increased significantly recently. As a result of different IoT architecture approaches, in this paper, we proposed a novel correct-by-construction formal approach based on an Event-B method to describe the physical architecture of IoT layers. This formal approach inspects four layers: the physical layer, the gateway layer, the middleware layer, respectively the application layer. An Electrocardiogram (ECG) IoT system is applied in our model as a case study. Finally, we proved and validated the correctness of our formal model by using proof obligations and the model checking tool called Rodin.

Mapping Applications Intents to Programmable NDN Data-Planes via Event-B Machines

Location-agnostic content delivery, in-network caching, and native support for multicast, mobility, and security are key features of the novel named data networks (NDN) paradigm. NDNs are ideal for hosting content-centric next-generation applications such as Internet of things (IoT) and virtual reality. Intent-driven management is poised to enhance the performance of the offered NDN services to these applications while reducing its management complexity. This article proposes I2DN, intent-driven NDN, a novel architecture that aims at realizing the first step towards intent modeling and mapping to data-plane configurations for NDNs. In I2DN, network operators and application developers express their abstract and declarative content delivery and network service goals and constraints using uttered or written intents. The intents are classified using built-in intent templates, and a slot filling procedure identifies the semantics of the intent. We then employ Event-B machine (EBM) language modeling to represent these intents and their semantics. The resulting EBMs are then gradually refined to represent configurations at the NDN programmable data-plane. The advantages of the proposed adoption of EBM modeling are twofold. First, EBMs accurately capture the desired behavior of the network in response to the specified intents and automatically refine it into concrete configurations. Second, EBM’s formal verification property, referred to as its proof obligation, ensures that the desired properties of the network or its services, as defined by the intent, remain satisfied by the refined EBM representing the final data-plane configurations. Experimental evaluation results demonstrate the feasibility and efficiency of our proposed work.

Distributed systems, Formal methods, Load balancing, Proof obligations, Rodin, Verification

Load distribution is a process that involves the allocation of tasks to various nodes in the distributed system in such a manner that overall resource utilization is maximized, and overall response time is minimized. This paper presents a formal model for verification of receiver-initiated load balancing and fault tolerance protocol with recovery in distributed systems using the eclipse-based Event-B platform called Rodin. Here, the receiver-initiated load balancing approach is demonstrated along with tolerance of node failure and recovery. In this approach, an underloaded node (receiver) initiates the process of load transfer from an overloaded node (sender). The underloaded node broadcasts a request message to obtain load from the overloaded nodes. The overloaded nodes reply with their load value. The underloaded node then selects the optimal overloaded node for load transfer. The chances of node failure are minimized by reducing the number of overloaded nodes. The process of recovery from failure is also shown in the proposed model. Formal methods are used to mathematically verify the critical properties of the system by developing a model based on its specifications. Our objective is to verify and validate the model for correctness through discharge of proof obligations using Event-B. Event-B is a formal method which is used for verification of a model based on distributed systems. The proof obligations generated by the model are discharged which ensures the correctness of our model.