In this work, we describe a new software model-checking algorithm called GPS. GPS treats the task of model checking a program as a directed search of the program states, guided by a compositional, summary-based static analysis. The summaries produced by static analysis are used both to prune away infeasible paths and to drive test generation to reach new, unexplored program states. GPS can find both proofs of safety and counter-examples to safety (i.e., inputs that trigger bugs), and features a novel two-layered search strategy that renders it particularly efficient at finding bugs in programs featuring long, input-dependent error paths. To make GPS refutationally complete (in the sense that it will find an error if one exists, if it is allotted enough time), we introduce an instrumentation technique and show that it helps GPS achieve refutation-completeness without sacrificing overall performance. We benchmarked GPS on a diverse suite of benchmarks including programs from the Software Verification Competition (SV-COMP), from prior literature, as well as synthetic programs based on examples in this paper. We found that our implementation of GPS outperforms state-of-the-art software model checkers (including the top performers in SV-COMP ReachSafety-Loops category), both in terms of the number of benchmarks solved and in terms of running time.

Optimization transformations performed by a compiler may violate memory consistency requirements for a multithreaded program. This leads to errors, when the program behavior will differ from expected. The memory consistency requirements for a particular programming language are called the memory model. An example of an error of this class may be an incorrect change in the order of execution of instructions, which does not affect the behavior of a single-threaded program, but leads to unpredictable results in the multithreaded case. Such errors are often difficult to detect, as they occur rarely and depend significantly on the hardware and the state of the computer system. Although there are formal methods for verifying the consistency of shared memory usage, their scalability for industrial software remains a major challenge. To verify multithreaded programs, the MCC tool was previously proposed, which used a simple type of static analysis. In this article, we present a modification of the MCC tool, which implements a model verification method to verify the correctness of memory access consistency. The proposed method combines the methods of generating test programs and the method of static program analysis. The OTK tool is used to generate test programs. For static analysis, a modified version of the MCC tool is used, which checks all possible execution options for the generated test program, regardless of the specifics of a particular hardware. The tool was tested on an ARK industrial virtual machine and successfully identified two real errors in compiler optimizations.

Software Model Checking for Distributed Applications using Hybridization of Centralization and Cache Approaches

On-the-fly unfolding with optimal exploration for linear temporal logic model checking of concurrent software and systems

The verification of real-time, embedded software in complex, safety critical systems such as crewed space launch vehicles is as significant as the design. Approaches based on formal methods are necessary to ensure exhaustive validation, in addition to the traditional testing and simulation techniques. In this work, the application of software model checking and static analysis in the verification and validation of safety critical software in Ada is explored. With the embedded flight control software in the onboard computer of an aerospace system as the case study, we apply the SPIN model checker and also develop a custom tool chain based on bounded model checking, for formal static analysis of Ada code. The major contributions include the definition of a systematic procedure for model checking with SPIN tool and the development of a new verification framework for formal static analysis of Ada programs. The two approaches are applied to an actual case study through accurate modelling of the execution environment for the concurrent onboard software in a launch vehicle. The results are compared and the advantages and drawbacks of both approaches are summarized.

Optimization transformations performed by a compiler may violate memory consistency requirements for a multithreaded program. This leads to errors, when the program behavior will differ from expected. The memory consistency requirements for a particular programming language are called the memory model. An example of an error of this class may be an incorrect change in the order of execution of instructions, which does not affect the behavior of a single- threaded program, but leads to unpredictable results in the multithreaded case. Such errors are often difficult to detect, as they occur rarely and depend significantly on the hardware and the state of the computer system. Although there are formal methods for verifying the consistency of shared memory usage, their scalability for industrial software remains a major challenge. To verify multithreaded programs, the MCC tool was previously proposed, which used a simple type of static analysis. In this article, we present a modification of the MCC tool, which implements a model verification method to verify the correctness of memory access consistency. The proposed method combines the methods of generating test programs and the method of static program analysis. The OTK tool is used to generate test programs. For static analysis, a modified version of the MCC tool is used, which checks all possible execution options for the generated test program, regardless of the specifics of a particular hardware. The tool was tested on an ARK industrial virtual machine and successfully identified two real errors in compiler optimizations.

Six years ago, we performed the first large-scale comparison of automated test generators and software model checkers with respect to bug-finding capabilities on a benchmark set with 5693 C programs. Since then, the International Competition on Software Testing (Test-Comp) has established standardized formats and community-agreed rules for the experimental comparison of test generators. With this new context, it is time to revisit our initial question: Model checkers or test generators—which tools are more effective in finding bugs in software? To answer this, we perform a comparative analysis on the tools and existing data published by two competitions, the International Competition on Software Verification (SV-COMP) and Test-Comp. The results provide two insights: (1) Almost all test generators that participate in Test-Comp use hybrid approaches that include formal methods, and (2) although the considered model checkers are still highly competitive, they are now outperformed by the bug-finding capabilities of the considered test generators.

This paper presents a technique for summarizing recursive procedures operating on integer variables. The motivation of our work is to create more predictable program analyzers, and in particular to formally guarantee compositionality and monotonicity of procedure summarization. To summarize a procedure, we compute its best abstraction as a vector addition system with resets (VASR) and exactly summarize the executions of this VASR over the context-free language of syntactic paths through the procedure. We improve upon this technique by refining the language of syntactic paths using (automatically synthesized) linearpotential functionsthat bound the number of recursive calls within valid executions of the input program. We implemented our summarization technique in an automated program verification tool; our experimental evaluation demonstrates that our technique computes more precise summaries than existing abstract interpreters and that our tool’s verification capabilities are comparable with state-of-the-art software model checkers.

Developing reliable distributed systems poses many challenges such as concurrency, failure handling, and scalability. It is due to the non-deterministic execution of threads within processes, and communication means. Formal verification methods, such as model checking, have been used to ensure the reliability of safety-critical systems. This technique systematically explores the complete behavior of the system under test (SUT), investigating each reachable state with different thread schedules. Recent software model-checking tools, employing cache and centralization, have been applied to distributed systems. The caching technique can only check one process at a time, while the centralization technique verifies all processes simultaneously. In the centralization technique, two "ArrayByteQueue" buffers are utilized to store communication and process data byte-by-byte. However, during the backtracking process, the read and write operations, involving data insertion and removal from the queue, become resource-intensive. As a consequence, existing interprocess communication (IPC) models encounter computational limitations and experience a rapid state space explosion. To address these challenges, our work proposes the remodeling of IPC models by introducing a request and response tree structure to store communication data. Additionally, we employ pointers to navigate through the data during the backtracking process. Through experimental evaluations, the proposed implementation choices have demonstrated significantly improved performance across various metrics. By incorporating the request and response tree, we enhance the efficiency of storing communication data, while the use of pointers optimizes navigation during backtracking. This remodeling of IPC models shows promise in mitigating computational limitations and state space explosion, thereby enhancing the model-checking process in distributed systems. Our research contributes to advancing the field of model checking in distributed systems and offers potential solutions to the challenges associated with resource-intensive read and write operations during the model-checking process.

Program dependence net (PDNet) is a kind of Petri nets which can represent concurrent systems and software to apply the automata-theoretic approach for software model checking on Linear Temporal Logic (LTL). This paper presents a formal modelling method to construct a PDNet which is consistent with the behavior of multi-threaded C programs (PThread programs) from a source code. For concurrent programs with a function call and POSIX threads, we propose the formal operational semantics by the labeled transition system (LTS). We formalize the statements by the basic PDNet structure based on LTS operational semantics. Then, we propose the formal modelling method to build a basic flow to simulate the execution of PThread programs. Finally, we give a case study to illustrate the formal modelling method for verifying PThread programs on LTL properties.

Recent research has unveiled numerous cache-timing side-channel attacks exploiting the side effects of fine-grained cache features, such as coherence protocol and prefetch, among others. Traditional modeling methods and verification techniques are insufficient for verifying caches with fine-grained features and detecting cache timing vulnerabilities. There is a necessity for comprehensive verification of such complex cache designs. This paper presents SCAFinder, a verification framework targeting the cache designs with fine-grained features; it identifies cache side-channel attacks through model checking techniques. Specifically, it proposes a modeling methodology for cache designs that enables us to abstract the cache’s behavior and latency characteristics. We implement a search algorithm for finding all counterexamples based on open-source model checking software. Subsequently, we add an attack scenario analysis module to discover attacks applicable to specific scenarios. We evaluate SCAFinder on Intel Skylake-X microarchitecture, demonstrating its capability to generate 7 new attack sequences exploiting coherence protocol and prefetch, and 12 new replacement policy-based side channels. As a case study, we successfully built a covert channel for one of the sequences on the real-world processor. To the best of our knowledge, we are the first to implement cross-core replacement policy-based attacks on non-inclusive caches.

Modern automated program repair (APR) is well-tuned to finding and repairing bugs that introduce observable erroneous behavior to a program. However, a significant class of bugs does not lead to observable behavior (e.g., termination bugs and non-functional bugs). Such bugs can generally not be handled with current APR approaches, so complementary techniques are needed. To stimulate the systematic study of alternative approaches and hybrid combinations, we devise a novel bug classification system that enables methodical analysis of their bug detection power and bug repair capabilities. To demonstrate the benefits, we study the repair of termination bugs in sequential and concurrent programs. Our analysis shows that integrating dynamic APR with formal analysis techniques, such as termination provers and software model checkers, reduces complexity and improves the overall reliability of these repairs. We empirically investigate how well the hybrid approach can repair termination and performance bugs by experimenting with hybrids that integrate different APR approaches with termination provers and execution time monitors. Our findings indicate that hybrid repair holds promise for handling termination and performance bugs. However, the capability of the chosen tools and the completeness of the available correctness specification affects the quality of the patches that can be produced.

Instruction sets, from families like x86 and ARM, are at the center of many ambitious formal-methods projects. Many verification, synthesis, programming, and debugging tools rely on formal semantics of instruction sets, but different tools can use semantics in rather different ways. The best-known work applying single semantics across diverse tools relies on domain-specific languages like Sail, where the language and its translation tools are specialized to the realm of instruction sets. In the context of the open RISC-V instruction-set family, we decided to explore a different approach, with semantics written in a carefully chosen subset of Haskell. This style does not depend on any new language translators, relying instead on parameterization of semantics over type-class instances. We have used a single core semantics to support testing, interactive proof, and model checking of both software and hardware, demonstrating that monads and the ability to abstract over them using type classes can support pleasant prototyping of ISA semantics.

The control of real-time systems often requires taking into account simultaneous access in true parallelism to shared resources. This is particularly the case for multicore execution platforms. Timed automata or time Petri nets do not capture these features directly. We first define High-level Colored Time Petri Net (HCTPN) that extends time Petri Nets with color and high-level functionality encompassing both timed multi-enableness of transitions and sequential pseudo code. We then extend HCTPN with stopwatches to allow the modeling of preemptive scheduling, which is an important feature in the real-time context. We prove that the reachability problem is decidable for HCTPN but is undecidable for HCTPN with stopwatches, and we propose an abstraction of the state space for these models. We apply this approach to model a preemptive multi-core real-time application that uses a spinlock mechanism in order to check all possible execution paths, interleaving of service calls, and preemptive scheduling.

Model checking embedded adaptive cruise controllers

Probabilistic programs that can represent both probabilistic and non-deterministic choices are useful for creating reliability models of complex safety-critical systems that interact with humans or external systems. Such models are often quite complex, so their analysis can be hindered by state-space explosion. One common approach to deal with this problem is the application of abstraction techniques. We present improvements for an abstraction-refinement scheme for the analysis of probabilistic programs, aiming to improve the scalability of the scheme by adapting modern techniques from qualitative software model checking, and make the analysis result more reliable using better convergence checks. We implemented and evaluated the improvements in our Theta model checking framework.

<div class="section abstract"><div class="htmlview paragraph">Formal verification plays an important role in proving the safety of autonomous vehicles (AV). It is crucial to find errors in the AV system model to ensure safety critical features are not compromised. Model checking is a formal verification method which checks if the finite state machine (FSM) model meets system requirements. These requirements can be expressed as linear Temporal logic (LTL) formulae to describe a sequence of states with linear Temporal properties to be satisfied. NuSMV is a dedicated software for performing model checking based on Temporal logic formulae on FSM models. However, NuSMV does not provide model-based design. On the other hand, Stateflow in MATLAB/SIMULINK is a powerful tool for designing the model and offers an interactive Graphical User Interface (GUI) for the user/verifier but is not as efficient as NuSMV in model checking. Hence, model transformation becomes vital to convert the AV model in Stateflow to an input language of model checking software such as NuSMV. In this paper, we model an AV using Stateflow, which consists of cruise control, lane change/abortion, obstacle avoidance and gap maintenance blocks in the form of FSMs. We design an automatic verification tool to perform model transformation using a C compiler with NuSMV library included. Guard conditions are represented by Boolean expressions to capture the transition sequence between different blocks. LTL specifications of safety critical requirements are verified to guarantee the validity of the AV system design. When guard conditions fail, i.e., system requirements are not met, the verification tool will give a counterexample as the output. A case study is performed to show how this verification tool can help designers to make modifications based on the counterexamples to better meet the system requirements. We also perform a benchmark verification using the design verifier in SIMULINK to compare the performance. <span class="xref"><sup>1</sup></span></div></div>

Using model checking to formally verify rendezvous algorithms for robots with lights in Euclidean space

The 27th International Symposium on Model Checking Software, SPIN 2021, was held online, July 12, 2021. The current special issue contains extended versions of three selected works published at the symposium. This short introduction presents these selected papers and the selection process.

Java Pathfinder (JPF) was originally developed as an explicit state software model checker and subsequently evolved into an extensible Java bytecode analysis framework that has been successfully used to implement techniques such as symbolic and concolic execution, compositional verification, parallel execution, incremental program analysis, and many more. Apart from its original domain of concurrent Java programs, JPF now supports the verification of new domains such as UMLs, numeric programs, graphical user interfaces, and Android applications.