Reachability Properties Research Articles

Modular verification of heap reachability properties in separation logic

The correctness of many algorithms and data structures depends on reachability properties, that is, on the existence of chains of references between objects in the heap. Reasoning about reachability is difficult for two main reasons. First, any heap modification may affect an unbounded number of reference chains, which complicates modular verification, in particular, framing. Second, general graph reachability is not supported by first-order SMT solvers, which impedes automatic verification. In this paper, we present a modular specification and verification technique for reachability properties in separation logic. For each method, we specify reachability only locally within the fragment of the heap on which the method operates. We identify relative convexity, a novel relation between the heap fragments of a client and a callee, which enables (first-order) reachability framing, that is, extending reachability properties from the heap fragment of a callee to the larger fragment of its client, enabling precise procedure-modular reasoning. Our technique supports practically important heap structures, namely acyclic graphs with a bounded outdegree as well as (potentially cyclic) graphs with at most one path (modulo cycles) between each pair of nodes. The integration into separation logic allows us to reason about reachability and other properties in a uniform way, to verify concurrent programs, and to automate our technique via existing separation logic verifiers. We demonstrate that our verification technique is amenable to SMT-based verification by encoding a number of benchmark examples into the Viper verification infrastructure.

Typing Messages for Free in Security Protocols

Security properties of cryptographic protocols are typically expressed as reachability or equivalence properties. Secrecy and authentication are examples of reachability properties, while privacy properties such as untraceability, vote secrecy, or anonymity are generally expressed as behavioral equivalence in a process algebra that models security protocols. Our main contribution is to reduce the search space for attacks for reachability as well as equivalence properties. Specifically, we show that if there is an attack then there is one that is well-typed. Our result holds for a large class of typing systems, a family of equational theories that encompasses all standard primitives, and protocols without else branches. For many standard protocols, we deduce that it is sufficient to look for attacks that follow the format of the messages expected in an honest execution, therefore considerably reducing the search space.

Generalized rewrite theories, coherence completion, and symbolic methods

A new notion of generalized rewrite theory suitable for symbolic reasoning and generalizing the standard notion in [19] is motivated and defined. Also, new requirements for symbolic executability of generalized rewrite theories that extend those in [33] for standard rewrite theories, including a generalized notion of coherence, are given. Symbolic executability, including coherence, is both ensured and made available for a wide class of such theories by automatable theory transformations. Using these foundations, several symbolic reasoning methods using generalized rewrite theories are studied, including: (i) symbolic description of sets of terms by pattern predicates; (ii) reasoning about universal reachability properties by generalized rewriting; (iii) reasoning about existential reachability properties by constrained narrowing; and (iv) symbolic verification of safety properties such as invariants and stability properties.

Using evolutionary algorithms for reachability analysis of complex software systems specified through graph transformation

Assessing the reliability of safety-critical systems is an important and challenging task because even a minor failure in these systems may result in catastrophic consequences, like losing human life. A well-known and fully automatic technique in reliability assessing approaches is model checking. However, applying this technique to verify some properties such as safety may lead to the state space explosion problem in which all reachable states cannot be checked due to computational limitations. In such situations that the verification of a safety property is infeasible, it is possible to refute the safety property by searching a reachable state in which a special configuration (e.g., an error or an undesirable behaviour) occurs. Therefore, checking reachability can be done instead of refuting the corresponding safety property. Finding such reachable states, in the worst case, may cause the state space explosion problem again. Hence, using evolutionary algorithms to explore the state space efficiently can be a promising idea. In this paper, at first, we propose an evolutionary algorithm to check reachability properties and refute safety ones in software systems specified formally through graph transformations. Since the accuracy and convergence speed of the proposed approach can still be improved, we employ the Bayesian Optimization Algorithm (BOA) to propose another approach. In BOA, a Bayesian network is learnt from the population and then sampled to generate new solutions. The proposed approaches can be used to analyse the reachability and safety properties. The proposed approaches are implemented in GROOVE which is an open source toolset for designing and model checking graph transformation systems. To evaluate the efficiency of the proposed approaches, different benchmark problems are employed. Experimental results show that the proposed approaches are faster and more accurate than the existing methods.

Qualitative Models in Computational Simulative Sciences: Representation, Confirmation, Experimentation

The Epistemology Of Computer Simulation (EOCS) has developed as an epistemological and methodological analysis of simulative sciences using quantitative computational models to represent and predict empirical phenomena of interest. In this paper, Executable Cell Biology (ECB) and Agent-Based Modelling (ABM) are examined to show how one may take advantage of qualitative computational models to evaluate reachability properties of reactive systems. In contrast to the thesis, advanced by EOCS, that computational models are not adequate representations of the simulated empirical systems, it is shown how the representational adequacy of qualitative models is essential to evaluate reachability properties. Justification theory, if not playing an essential role in EOCS, is exhibited to be involved in the process of advancing and corroborating model-based hypotheses about empirical systems in ECB and ABM. Finally, the practice of evaluating model-based hypothesis by testing the simulated systems is shown to constitute an argument in favour of the thesis that computer simulations in ECB and ABM can be put on a par with scientific experiments.

A More Faithful Formal Definition of the Desired Property for Distributed Snapshot Algorithms to Model Check the Property

The first distributed snapshot algorithm was invented by Chandy and Lamport: Chandy-Lamport distributed snapshot algorithm (CLDSA). Distributed snapshot algorithms are crucial components to make distributed systems fault tolerant. Such algorithms are extremely important because many modern key software systems are in the form of distributed systems and should be fault tolerant. There are at least two desired properties such algorithms should satisfy: 1) the distributed snapshot reachability property (called the DSR property) and 2) the ability to run concurrently with, but not alter, an underlying distributed system (UDS). This paper identifies subtle errors in a paper on formalization of the DSR property and shows how to correct them. We give a more faithful formal definition of the DSR property; the definition involves two state machines - one state machine M_UDS that formalizes a UDS and the other M_CLDSA that formalizes the UDS on which CLDSA is superimposed (UDS-CLDSA) - and can be used to more precise model checking of the DSR property for CLDSA. We also prove a theorem on equivalence of our new definition and an existing one that only involves M_CLDSA to guarantee the validity of the existing model checking approach. Moreover, we prove the second property, namely that CLDSA does not alter the behaviors of UDS.

Formal comparison of LEACH and its extensions

Wireless Sensor Networks comprise of clusters of low-powered sensor nodes dispersed over a vast area, mostly in an unsupervised and remote environment, with inadequate computational and detection capabilities. The batteries of these sensor nodes are often small and irreplaceable, which limits the life span of a node. It is therefore essential to retain the node energy as long as possible, otherwise a large number of nodes would die at an early stage and the network would become dysfunctional. Numerous protocols are developed for the efficient energy utilization of a WSN. However, comparing the protocols on a common ground is a big challenge, which has traditionally been accomplished using simulations and other testing techniques. To cater for the limitations of these methods we propose to leverage upon the complete and sound nature of model checking i.e., a widely used formal method. For understanding our methodology, we have created a formal framework specifically to compare the LEACH protocol with its future extensions LEACH-C and LEACH-F. The proposed approach has been found to be quite effective in verifying safety, liveness and reachability properties under generalized topologies of networks. Based on our analysis results, we conclude that LEACH-F protocol is the most energy efficient among the other alternatives.

Estimating Attractor Reachability in Asynchronous Logical Models.

Logical models are well-suited to capture salient dynamical properties of regulatory networks. For networks controlling cell fate decisions, cell fates are associated with model attractors (stable states or cyclic attractors) whose identification and reachability properties are particularly relevant. While synchronous updates assume unlikely instantaneous or identical rates associated with component changes, the consideration of asynchronous updates is more realistic but, for large models, may hinder the analysis of the resulting non-deterministic concurrent dynamics. This complexity hampers the study of asymptotical behaviors, and most existing approaches suffer from efficiency bottlenecks, being generally unable to handle cyclical attractors and quantify attractor reachability. Here, we propose two algorithms providing probability estimates of attractor reachability in asynchronous dynamics. The first algorithm, named Firefront, exhaustively explores the state space from an initial state, and provides quasi-exact evaluations of the reachability probabilities of model attractors. The algorithm progresses in breadth, propagating the probabilities of each encountered state to its successors. Second, Avatar is an adapted Monte Carlo approach, better suited for models with large and intertwined transient and terminal cycles. Avatar iteratively explores the state space by randomly selecting trajectories and by using these random walks to estimate the likelihood of reaching an attractor. Unlike Monte Carlo simulations, Avatar is equipped to avoid getting trapped in transient cycles and to identify cyclic attractors. Firefront and Avatar are validated and compared to related methods, using as test cases logical models of synthetic and biological networks. Both algorithms are implemented as new functionalities of GINsim 3.0, a well-established software tool for logical modeling, providing executable GUI, Java API, and scripting facilities.

Template polyhedra and bilinear optimization

In this paper, we study the template polyhedral abstract domain using connections to bilinear optimization techniques. The connections between abstract interpretation and convex optimization approaches have been studied for nearly a decade now. Specifically, data flow constraints for numerical domains such as polyhedra can be expressed in terms of bilinear constraints. Algorithms such as policy and strategy iteration have been proposed for the special case of bilinear constraints that arise from template polyhedra wherein the desired invariants conform to a fixed template form. In particular, policy iteration improves upon a known post-fixed point by alternating between solving for an improved post-fixed point against finding certificates that are used to prove the new fixed point. In the first part of this paper, we propose a policy iteration scheme that changes the template on the fly in order to prove a target reachability property of interest. We show how the change to the template naturally fits inside a policy iteration scheme, and thus, propose a scheme that updates the template matrices associated with each program location. We demonstrate that the approach is effective over a set of benchmark instances, wherein, starting from a simple predefined choice of templates, the approach is able to infer appropriate template directions to prove a property of interest. However, it is well known that policy iteration can end up “stuck” in a saddle point from which future iterations cannot make progress. In the second part of this paper, we study this problem further by empirically comparing policy iteration with a variety of other approaches for bilinear programming. These approaches adapt well-known algorithms to the special case of bilinear programs as well as using off-the-shelf tools for nonlinear programming. Our initial experience suggests that policy iteration seems to be the most advantageous approach for problems arising from abstract interpretation, despite the potential problems of getting stuck at a saddle point.

Modeling, Reachability and Controllability of Bounded Petri Nets Based on Semi‐Tensor Product of Matrices

AbstractIn this paper, we present a comprehensive modeling technique for bounded Petri net systems (BPNSs) in the framework of the semi‐tensor product (STP) of matrices. The two dynamic properties of BPNSs, namely, reachability and controllability, are investigated systematacially. First, the dynamics of a bounded Petri net system (BPNS), by resorting to the STP of matrices, are expressed in the form of a discrete‐time bilinear equation, which is called the marking evolution equation (MEE) of BPNSs. Second, controllability and transition‐marking adjacency matrix (TMAM) of BPNSs are defined, respectively. Further, several necessary and sufficient conditions for reachability and controllability of BPNSs are given in terms of the MEE and TMAM. Third, an efficient algorithm to verify reachability property of BPNSs, in this paper, is provided, as well as its computational complexity. Finally, an example is presented to illustrate the theoretical results in this paper. The main contribution of this paper is the presentation of a precise mathematical model for BPNSs. The main advantage of the proposed approach is that not only it can be applied to verify whether or not any given marking is reachable from the other in state space, but also it is very convenient to find all firing sequences between any two reachable markings.

MS-ACO: a multi-stage ant colony optimization to refute complex software systems specified through graph transformation

Model checking is one of the successful techniques in automated verification of software and hardware systems. However, employing this technique for verification of properties such as the safety and liveness requires that all possible states of a system are generated and then the given property is checked. In large and complex systems, generating all states causes the state space explosion problem. Hence, it is possible to refute such properties by searching the state space to find a state in which the given property is violated. Of course, it is possible that detecting such states in complex systems leads to the exhaustive exploration of the state space. Recent researches confirm that using meta-heuristic and evolutionary approaches to intelligently explore a portion of the state space can be a promising idea. Hence, in this paper, we propose an approach based on ant colony optimization algorithm for refuting the safety and liveness properties and also analyzing reachability ones in systems specified formally through graph transformation system. Refutation of liveness and analyzing reachability properties in systems modeled by graph transformations are the prominent advantages of this approach in comparison with the previous approaches. The proposed approach is implemented in GROOVE which is an open source toolset for designing and model checking graph transformation systems. Experimental results show that our proposed approach is faster and it generates shorter counterexamples in comparison with others.

Formal Verification of Medical CPS

The use of robots in operating rooms improves safety and decreases patient recovery time and surgeon fatigue, but it introduces new potential hazards that can lead to severe injury or even the loss of human life. Thus, safety has been perceived as a crucial system property since the early days by the industry, the medical community, and the regulatory agents. In this article, we discuss the application of the mathematically rigorous technique known as Formal Verification to analyze the safety properties of a laser incision case study, and we assess its safe and predictable operation. Like all formal methods approaches, our analysis has three distinct components: a method to create a model of the system, a language to specify the properties, and a strategy to prove rigorously that the behavior of the model fulfills the desired properties. The model of the system takes the form of a hybrid automaton consisting of a discrete control part that operates in a continuous environment. The safety constraints are formalized as reachability properties of the hybrid automaton model, while the verification strategy exploits the capabilities of the tool A riadne to address the verification problem and answer the related questions ranging from safety to efficiency and effectiveness.

On clock-aware LTL parameter synthesis of timed automata

The parameter synthesis problem for timed automata is undecidable in general even for very simple reachability properties. In this paper we introduce restrictions on parameter valuations under which the parameter synthesis problem is decidable for Clock-Aware LTL properties. The investigated bounded integer parameter synthesis problem could be solved using an explicit enumeration of all possible parameter valuations. We propose an alternative symbolic zone-based method for this problem which can result in a faster computation. Our technique adapts the ideas of the automata-based approach to Clock-Aware LTL model checking of timed automata. In order to simplify the explanation of our method, we first introduce a parameter synthesis algorithm for timed automata, then we describe method for checking Clock-Aware LTL properties of timed automata and finally we combine these two methods together to provide general parameter synthesis algorithm for Clock-Aware LTL properties. To demonstrate the usefulness of our approach, we provide experimental evaluation and compare the proposed method with the explicit enumeration technique.

Reduction of state variables based on regulation and filtering performances

This paper provides a principal component analysis of linear discrete-time systems on the basis of optimal control and estimation. The analysis is to reveal the important state components which remain necessary for reducing performance degradation under dimensional constraints on control and estimation laws. The trade-off relations between the dimension and performance degradation are expressed as system invariants representing the importance of each principal component, which are characterized as the eigenvalues of matrices depending on the solutions of both Lyapunov and Riccati equations. Based on the analysis, the paper also provides model reduction techniques for the systems generating the optimal input and estimate with the desirable properties of stability, reachability, and observability being preserved in the reduced systems.

Abstract model repair for probabilistic systems

Given a Discrete Time Markov Chain M and a probabilistic temporal logic formula φ, where M violates φ, the problem of Model Repair is to obtain a new model M′, such that M′ satisfies φ. Additionally, the changes made to M in order to obtain M′ should be minimum with respect to all such M′. The state explosion problem makes the repair of large probabilistic systems almost infeasible. In this paper, we use the abstraction of Discrete Time Markov Chains in order to speed-up the process of model repair for temporal logic reachability properties. We present a framework based on abstraction and refinement, which reduces the state space of the probabilistic system to repair at the price of obtaining an approximate solution. A metric space is defined over the set of DTMCs, in order to measure the differences between the initial and the repaired models. For the repair, we introduce an algorithm and we discuss its important properties, such as soundness and complexity. As a proof of concept, we provide experimental results for probabilistic systems with diverse structures of state spaces, including the well-known Craps game, the IPv4 Zeroconf protocol, a message authentication protocol and the gambler's ruin model.

Lean Reachability Tree for Unbounded Petri Nets

Elaborate efforts have been made to eliminate fake markings and refine ${\omega }$ -markings in the existing modified or improved Karp–Miller trees for various classes of unbounded Petri nets since the late 1980s. The main issues fundamentally are incurred due to the generation manners of the trees that prematurely introduce some potentially unbounded markings with ${\omega }$ symbols and keep their growth into new ones. Aiming at addressing them, this work presents a non-Karp–Miller tree called a lean reachability tree (LRT). First, a sufficient and necessary condition of the unbounded places and some reachability properties are established to reveal the features of unbounded nets. Then, we present an LRT generation algorithm with a sufficiently enabling condition (SEC). When generating a tree, SEC requires that the components of a covering node are not replaced by ${\omega }$ symbols, but continue to grow until any transition on an output path of an unbounded place has been branch-enabled at least once. In return, no fake marking is produced and no legal marking is lost during the tree generation. We prove that LRT can faithfully express by folding, instead of equivalently representing, the reachability set of an unbounded net. Also, some properties of LRT are examined and a sufficient condition of deadlock existence based on it is given. The case studies show that LRT outperforms the latest modified Karp–Miller trees in terms of size, expressiveness, and applicability. It can be applied to the analysis of the emerging discrete event systems with infinite states.

Series concatenation of 2D convolutional codes by means of input-state-output representations

ABSTRACTIn this paper, we investigate the properties of two-dimensional (2D) convolutional codes which are obtained from series concatenation of two 2D convolutional codes. For this purpose, we confine ourselves to dealing with finite-support 2D convolutional codes and make use of the Fornasini–Marchesini input-state-output (ISO) model representations. Within these ISO representations, we study when the structural properties of modal reachability and modal observability of the two given ISO representations carry over to the resulting 2D convolutional code. Moreover, we provide necessary conditions for obtaining a systematic concatenated convolutional code. Finally, we present a lower bound on its free distance.

Delay-dependent partial order reduction technique for real time systems

Almost all partial order reduction techniques proposed for time Petri nets (TPNs in short) are based on the notion of Partially Ordered Sets. The idea is to explore simultaneously, by relaxing some firing order constraints of persistent transitions (An enabled transition is persistent, if it cannot be disabled until its firing.), several equivalent sequences, while computing the convex hull of the abstract states reached by these equivalent sequences. However, unlike timed automata, in the TPN state space abstractions, the union of the abstract states reached by different interleavings of the same set of non conflicting transitions is not necessarily identical to their convex hull. Moreover, the convex hull over-approximation preserves neither the boundedness nor the reachability properties of the TPN. In this context, the main challenge is to establish sufficient conditions over transitions that ensure, in addition to their persistency, identity between the union and the convex hull of the abstract states reachable by their different interleavings. This paper shows how to weaken the sufficient conditions proposed in the literature, by taking into better account the structure, the marking, the static and the dynamic time parameters of the TPN.

Maximal safe set computation for pressure swing adsorption processes

In this paper we propose a method towards purity control of pressure swing adsorption (PSA) processes which is based on the use of hybrid systems formalism. Hybrid systems feature both continuous and discrete-event dynamics and hence are very suited to describe in detail PSA processes. Based on mechanistic model of the processes, a local reduced-order model (LROM) is developed for PSA processes. Then the processes are represented as hybrid systems whose continuous evolution is described by the LROM. We then perform an analysis of hybrid reachability properties of the hybrid system obtained, based on which the so-called maximal safe set is computed. The analysis is performed for a two-bed, six-step benchmark PSA process and the influence of the control inputs and external disturbances are investigated.

Linearizing Discrete-Time Hybrid Systems

Model-based design approaches for embedded systems aim at generating correct-by-construction control software, guaranteeing that the closed-loop system (controller and plant) meets given system level formal specifications. This technical note addresses control synthesis for safety and reachability properties of possibly nonlinear discrete-time hybrid systems. By means of a syntactical transformations that requires nonlinear terms to be Lipschitz continuous functions, we overapproximate nonlinear dynamics with a linear system whose controllers are guaranteed to be controllers of the original system. We evaluate performance of our approach on meaningful control synthesis benchmarks, also comparing it to a state-of-the-art tool.