Software Model Checking Research Articles

Monotone Procedure Summarization via Vector Addition Systems and Inductive Potentials

This paper presents a technique for summarizing recursive procedures operating on integer variables. The motivation of our work is to create more predictable program analyzers, and in particular to formally guarantee compositionality and monotonicity of procedure summarization. To summarize a procedure, we compute its best abstraction as a vector addition system with resets (VASR) and exactly summarize the executions of this VASR over the context-free language of syntactic paths through the procedure. We improve upon this technique by refining the language of syntactic paths using (automatically synthesized) linear potential functions that bound the number of recursive calls within valid executions of the input program. We implemented our summarization technique in an automated program verification tool; our experimental evaluation demonstrates that our technique computes more precise summaries than existing abstract interpreters and that our tool’s verification capabilities are comparable with state-of-the-art software model checkers.

Software Model Checking Distributed Applications: A Hybrid Approach

Developing reliable distributed systems poses many challenges such as concurrency, failure handling, and scalability. It is due to the non-deterministic execution of threads within processes, and communication means. Formal verification methods, such as model checking, have been used to ensure the reliability of safety-critical systems. This technique systematically explores the complete behavior of the system under test (SUT), investigating each reachable state with different thread schedules. Recent software model-checking tools, employing cache and centralization, have been applied to distributed systems. The caching technique can only check one process at a time, while the centralization technique verifies all processes simultaneously. In the centralization technique, two "ArrayByteQueue" buffers are utilized to store communication and process data byte-by-byte. However, during the backtracking process, the read and write operations, involving data insertion and removal from the queue, become resource-intensive. As a consequence, existing interprocess communication (IPC) models encounter computational limitations and experience a rapid state space explosion. To address these challenges, our work proposes the remodeling of IPC models by introducing a request and response tree structure to store communication data. Additionally, we employ pointers to navigate through the data during the backtracking process. Through experimental evaluations, the proposed implementation choices have demonstrated significantly improved performance across various metrics. By incorporating the request and response tree, we enhance the efficiency of storing communication data, while the use of pointers optimizes navigation during backtracking. This remodeling of IPC models shows promise in mitigating computational limitations and state space explosion, thereby enhancing the model-checking process in distributed systems. Our research contributes to advancing the field of model checking in distributed systems and offers potential solutions to the challenges associated with resource-intensive read and write operations during the model-checking process.

Extending the range of bugs that automated program repair can handle

Modern automated program repair (APR) is well-tuned to finding and repairing bugs that introduce observable erroneous behavior to a program. However, a significant class of bugs does not lead to observable behavior (e.g., termination bugs and non-functional bugs). Such bugs can generally not be handled with current APR approaches, so complementary techniques are needed. To stimulate the systematic study of alternative approaches and hybrid combinations, we devise a novel bug classification system that enables methodical analysis of their bug detection power and bug repair capabilities. To demonstrate the benefits, we study the repair of termination bugs in sequential and concurrent programs. Our analysis shows that integrating dynamic APR with formal analysis techniques, such as termination provers and software model checkers, reduces complexity and improves the overall reliability of these repairs. We empirically investigate how well the hybrid approach can repair termination and performance bugs by experimenting with hybrids that integrate different APR approaches with termination provers and execution time monitors. Our findings indicate that hybrid repair holds promise for handling termination and performance bugs. However, the capability of the chosen tools and the completeness of the available correctness specification affects the quality of the patches that can be produced.

Flexible Instruction-Set Semantics via Abstract Monads (Experience Report)

Instruction sets, from families like x86 and ARM, are at the center of many ambitious formal-methods projects. Many verification, synthesis, programming, and debugging tools rely on formal semantics of instruction sets, but different tools can use semantics in rather different ways. The best-known work applying single semantics across diverse tools relies on domain-specific languages like Sail, where the language and its translation tools are specialized to the realm of instruction sets. In the context of the open RISC-V instruction-set family, we decided to explore a different approach, with semantics written in a carefully chosen subset of Haskell. This style does not depend on any new language translators, relying instead on parameterization of semantics over type-class instances. We have used a single core semantics to support testing, interactive proof, and model checking of both software and hardware, demonstrating that monads and the ability to abstract over them using type classes can support pleasant prototyping of ISA semantics.

Model checking embedded adaptive cruise controllers

While checking functional correctness for automated driving is often achieved through vast amounts of automated and manual field testing, automating specification verification is essential for developing and releasing fully self-driving vehicles. This paper presents an automatic bounded model checking approach for functional specifications over longitudinal vehicle controller implementations. The proposed method checks the actual embedded program, rather than an extracted abstract model. The specification is converted into a monitor that is interleaved with the execution of the program over a finite time horizon in closed-loop simulation. A decomposition is proposed to tackle the verification complexity. This allows verifying the program for whole parameter sets using a software model checker as opposed to testing only individual samples. The approach is capable of identifying functional flaws in several exemplary longitudinal controllers with variable complexity.

Towards Abstraction-based Probabilistic Program Analysis

Probabilistic programs that can represent both probabilistic and non-deterministic choices are useful for creating reliability models of complex safety-critical systems that interact with humans or external systems. Such models are often quite complex, so their analysis can be hindered by state-space explosion. One common approach to deal with this problem is the application of abstraction techniques. We present improvements for an abstraction-refinement scheme for the analysis of probabilistic programs, aiming to improve the scalability of the scheme by adapting modern techniques from qualitative software model checking, and make the analysis result more reliable using better convergence checks. We implemented and evaluated the improvements in our Theta model checking framework.

Using model checking to formally verify rendezvous algorithms for robots with lights in Euclidean space

The paper details the first successful attempt at using model checking techniques to verify the correctness of distributed algorithms for robots evolving in a continuous environment. The study focuses on the problem of rendezvous of two robots with lights.There exist many different rendezvous algorithms that aim at finding the minimal number of colors needed to solve rendezvous in various synchrony models (e.g., FSYNC, SSYNC, ASYNC). While these rendezvous algorithms are typically very simple, their analysis and proof of correctness tend to be extremely complex, tedious, and error-prone as impossibility results are based on subtle interactions between the activation schedules of the robots.The paper presents a generic verification model that can be concretely expressed in available software model-checkers. In particular, we explain the subtle design decisions that allow to keep the search space finite and tractable, as well as prove several important theorems that support them. As a sanity check, we use the model to verify several known rendezvous algorithms in six different models of synchrony. In each case, we find that the results obtained from the model checker are consistent with the results known in the literature. The model checker outputs a counter-example execution in every case that is known to fail.In the course of developing and proving the validity of the model, we identified several fundamental theorems, including the ability for a well chosen algorithm and ASYNC scheduler to produce an emerging property of memory in a system of oblivious mobile robots, and why it is not a problem when robots executing the gathering algorithms are equipped with lights.

Introduction to the special issue for SPIN 2021

The 27th International Symposium on Model Checking Software, SPIN 2021, was held online, July 12, 2021. The current special issue contains extended versions of three selected works published at the symposium. This short introduction presents these selected papers and the selection process.

The Java Pathfinder Workshop 2022

Java Pathfinder (JPF) was originally developed as an explicit state software model checker and subsequently evolved into an extensible Java bytecode analysis framework that has been successfully used to implement techniques such as symbolic and concolic execution, compositional verification, parallel execution, incremental program analysis, and many more. Apart from its original domain of concurrent Java programs, JPF now supports the verification of new domains such as UMLs, numeric programs, graphical user interfaces, and Android applications.

Finding More Bugs with Software Model Checking using Delta Debugging

Many verification tasks in model checking (one of the formal software verification approaches) can’t be solved within bounded time requirements due to combinatorial state space explosion. In order to find a bug in the verified program in a given time, a simplified version of it can be analyzed. This paper presents DD** algorithms (based on the Delta Debugging approach) to iterate over simplified versions of the given program. These algorithms were implemented in software-verification tool CPAchecker. Our experiments showed that this technique might be used to find new bugs in real software.

Parameterized Reachability Graph for Software Model Checking Based on PDNet

Parameterized Reachability Graph for Software Model Checking Based on PDNet

Review of Software Model-Checking Techniques for Dealing with Error Detection in Program Codes

Review of Software Model-Checking Techniques for Dealing with Error Detection in Program Codes

Software model-checking as cyclic-proof search

This paper shows that a variety of software model-checking algorithms can be seen as proof-search strategies for a non-standard proof system, known as a cyclic proof system . Our use of the cyclic proof system as a logical foundation of software model checking enables us to compare different algorithms, to reconstruct well-known algorithms from a few simple principles, and to obtain soundness proofs of algorithms for free. Among others, we show the significance of a heuristics based on a notion that we call maximal conservativity ; this explains the cores of important algorithms such as property-directed reachability (PDR) and reveals a surprising connection to an efficient solver of games over infinite graphs that was not regarded as a kind of PDR.

Capabilities and Restrictions of Software Model Checkers

Software model checkers enable automatic detection of violations of specified requirements in programs as well as formal proof of correctness under certain assumptions. These tools actively evolve two last decades. They were already successfully applied to a bunch of industrial projects, first of all to kernels and drivers of various operating systems. This paper considers an interface of software model checkers, their unique capabilities as well as restrictions that prevent their large-scale usage on practice.

Model checking games and a genome sequence search

The paper is considered a concept of model checking games to solve algorithmic puzzles. We describe current approaches in this field and move to a game between a user and a software model checker with the goal to provide a solution to a problem, encoded in a transition system and an LTL formula with a requirement. We show how to encode and solve some problems using this approach. Then we move to the problem of searching a pattern in a genome sequence. We implement the Z-function search method in Promela, construct the model, provide the input of real viral data, and then play a model checking game with SPIN verifier. We created a fuzzy substring search method using the non-deterministic choice operator. Based on experiments we made, we discuss that the problem to find a pattern with some deviations is only solvable using the swarm verification and hash compact methods.

A cognitive computing conceptual model for agile e-government design

Studies have linked e-government failures (primarily its adoption and development) to factors such as design shortcomings and design-reality gaps. With the increased availability of big data and analytical techniques, government agencies must leverage data-driven models in the design and implementation of electronic government (e-government) or digital government solutions. By doing so, minimizing design-reality gap problems and design shortcomings is attainable. Backed by stakeholder theory and the Agile design methodology, this study proposes a cognitive computing framework as an efficient approach to the design of public sector electronic services (e-services) so as to obtain value. Cognitive computing was deemed appropriate for inclusion into the Agile methodology for e-government design because of its rapid frequency of expansion of data for which the human mind is limited in analytical ability as well as the desire by policy makers to reduce burdens and cost against the desire for more tailored solutions. With respect to research, cognitive computing models present a novel means of implementing human-centric and data-driven processes into practical domains of discourse and these models have yet to be integrated into the e-government sphere. By applying design thinking, the proposed model is built and tested in the UPPAAL model-checking software by applying the principle of finite state deterministic automatons. Theoretical and practical contributions are made to the fields of e-government, Agile methodology, and quality service delivery. Future research recommendations for expansion and building evaluation metrics are also indicated in the study.

Model Checking of Automotive Control Software: An Industrial Approach

Model Checking of Automotive Control Software: An Industrial Approach

CPA/Tiger-MGP: test-goal set partitioning for efficient multi-goal test-suite generation

Software model checkers can be used to generate high-quality test cases from counterexamples of a reachability analysis. However, naïvely invoking a software model checker for each test goal in isolation does not scale to large programs as a repeated construction of an abstract program model is expensive. In contrast, invoking a software model checker for reaching all test goals in a single run leads to few abstraction possibilities and thus to low scalability. Therefore, our approach pursues a test-suite generation technique that incorporates configurable multi-goal set partitioning (MGP) including configurable partitioning strategies and simultaneous processing of multiple test goals in one reachability analysis. Our approach employs recent techniques from multi-property verification in order to control the computational overhead for tracking multi-goal reachability information. Our tool, called CPA/Tiger-MGP, uses predicate-abstraction-based program analysis in the model-checking framework CPAchecker.

The Java Pathfinder Workshop 2019

Java Path nder (JPF) was originally developed as an explicit- state software model checker, and subsequently evolved into an extensible Java bytecode analysis framework that has been suc- cessfully used to implement techniques such as symbolic and con- colic execution, compositional veri cation, parallel execution, in- cremental program analysis, and many more. To share recent research progress with JPF and related tools among the community, we have organized the annual JPF work- shop with the Automated Software Engineering Conference (ASE) 2019, held in San Diego, California, USA. We invited submissions about on-going and existing research, experience, and position papers on topics (1) related to JPF, its extensions and applica- tions in various domains; and (2) Java/Android program analysis in general. This paper gives an overview of all presentations and papers of the workshop, as well the results of the discussions.

An Interface for Verification and Validation of Unmanned Systems Mission Planning: Communicating Mission Objectives and Constraints

Anticipated advances in the use and capability of unmanned systems may increase the complexity in mission planning and human-machine teaming, creating challenges for mission performance, safety, and predictability. Verification and validation tools, such as model checking, have been applied to mission planning and is a promising approach but require expertise to use. This article describes the study of one such tool, with an interface that provides the human operator away to communicate their high-level mission goals and objectives to the model checking software without having to learn temporal logics or syntax. We describe the development and refinement of a prototype, as well as an experiment testing if a verification and validation tool can improve mission planning compared to a baseline without a verification and validation tool. Results showed that a tool increased mission planning accuracy, while also increasing mission planning time. Also, subjective workload was not different between the two configurations (tool & baseline). These results indicated that verification and validation tools with a suitable interface can enable humans to communicate mission objectives and constraints to machines, improving performance, safety, and predictability. Results also suggested that additional research to improve this communication would further increase the benefits and impact of these kinds of tools.