State Space Explosion Research Articles

A symbolic model checking approach to verifying satellite onboard software

This paper discusses the use of symbolic model checking technology to verify the design of an embedded satellite software control system called the attitude and orbit control system (AOCS). This system is mission critical because it is responsible for maintaining the attitude of the satellite and for performing fault detection, isolation, and recovery decisions. An executable AOCS implementation by Space Systems Finland has been provided in Ada source code form, and we use the input language of the symbolic model checker NuSMV 2 to model the implementation at a detailed level. We describe the modeling techniques and abstractions used to alleviate the state space explosion due to the handling of timers and the large number of system components controlled by the AOCS. The required behavior has been specified as extended state machine diagrams and translated to temporal logic properties. Besides well-known LTL and CTL model checking algorithms, we adapt a previously unexplored form of the liveness-to-safety approach to the problem. The latter new technique turns out to successfully prove all desired properties of the system, outperforming both the LTL and CTL implementations of NuSMV 2.

Efficient deadlock analysis of component-based software architectures

Component-based development (CBD) is a promising approach to master the design complexity of huge software products. In addition, knowledge about the architecture of such component systems can help in establishing important system properties, which in general is computationally hard because of the state space explosion problem. Extending previous work, we here investigate the novel class of disjoint circular wait free component systems and show how we can use the architectural information to establish a condition for the property of deadlock-freedom in polynomial time. Furthermore, we emphasize the importance of this class by showing how to transform an arbitrary system into a disjoint circular wait free one in linear time and in a property preserving way and by providing various computational complexity results. A running example is included. We use the framework of interaction systems, but our results carry over to other CBD models.

A Novel Framework for Real-Time Fault Diagnosis Based on Dynamic Fault Tree Analysis

To meet the real-time diagnosis requirements of the complex system, this study proposes a novel framework for real-time fault diagnosis using dynamic fault tree analysis. It pays special attention to meeting two challenges: model development and real-time reasoning. In terms of the challenge of model development, we use a dynamic fault tree model to capture the dynamic behavior of system failure mechanisms and calculate some reliability results by mapping a dynamic fault tree into an equivalent Bayesian Network (BN) in order to avoid the infamous state space explosion problem. In terms of the real-time reasoning challenge, we adopt a logic compilation based inference algorithm, which compiles the BN into an arithmetic circuit and retrieves answers to probabilistic queries by evaluating and differentiating the arithmetic circuit. Furthermore, we incorporate sensors data into fault diagnosis, cope with the sensors reliability and propose the schemes on how to update the Diagnostic Importance Factor (DIF) and the minimal cut sets. Finally, a case study is given to validate the efficiency of this method.

Combining decomposition and reduction for state space analysis of a self-stabilizing system

Fault tolerance measures of distributed systems can be calculated precisely by state space analysis of the Markov chain corresponding to the product of the system components. The power of such an approach is inherently confined by the state space explosion, i.e. the exponential growth of the Markov chain in the size of the underlying system. We propose a decompositional method to alleviate this limitation. Lumping is a well-known reduction technique facilitating computation of the relevant measures on the quotient of the Markov chain under lumping equivalence. In order to avoid computation of lumping equivalences on intractably large Markov chains, we propose a system decomposition supporting local lumping on the considerably smaller Markov chains of the subsystems. Recomposing the lumped Markov chains of the subsystems constructs a lumped transition model of the whole system, thus avoiding the construction of the full product chain. An example demonstrates how the limiting window availability (i.e. a particular fault tolerance measure) can be computed for a self-stabilizing system exploiting lumping and decomposition.

Reachability analysis of logic Petri nets using incidence matrix

Logic Petri nets (LPNs) can simplify the net-structure and mitigate the problem of state space explosion. To directly investigate the properties of LPNs, a new analysis method of LPNs is introduced in this paper based on incidence matrix. The enabled conditions of transitions are given, and reachable markings are calculated based on the constructed incidence matrix of LPNs. The state equation of LPNs is defined, and the reachability of LPNs is analysed. Compared with the previous work, the incidence matrix in this paper can contain more information and describes the logic expressions and arcs of LPNs. The computational complexity of LPNs is lower. Finally, the validity, reliability and effectiveness of the proposed method are illustrated by analysing an actual case. The theoretical and practical values of LPNs are enhanced.

A Model-checking Algorithm for Formal-verification of Peer-to-peer Fault-tolerant Networks

 Abstract— In this paper, the goal is to perform the verification of fault-tolerant properties of a peer-to-peer (P2P) network consisting of n nodes running n corresponding parallel processes. The specification of the processes is in the form of communicating finite state machines (CFSMs). The work to be reported in this paper follows the prequel work wherein, instead of the traditional approach to construct a single synchronous product machine by composing the given CFSMs, we simulate each of the CFSMs in the non-local environment of other CFSMs and generate a set of what are called Communicating Minimal Prefix Machines(CMPMs). In this paper, we take the CMPMs model and perform the reachability analysis of certain global state vectors without losing the locality of the CFSMs of the given specification. This method cuts down the state space explosion and also opens out the possibility of distributed exploration of the local CFSM states. Faulttolerance consists of both safety and liveness properties and our approach provides a sound platform for performing state exploration/model-checking to verify these properties of the given set of application tasks that run in the P2P network. Index Terms—CFSMs-to-CMPMs model, liveness, modelchecking, P2P networks, safety, state-space explosion.

Object Petri nets marking using UML

UML semantics formalisation has aroused much interest these two last decades. Among the numerous proposed works many undertake the formalisation by translation into state-transition languages. The verification is afterwards performed by model-checking. However, one important issue raised by model checking is the state space explosion. The purpose of this paper will mainly address this issue. It is threefold. We first propose an approach to mark the derived formalisms starting from any time of the system lifecycle. The marking is drawn from the object and sequence diagrams. We secondly exploit the association ends modelled on the object diagram to retrieve the first action of each object behaviour. This contribution ensures a strong consistency when handling the object and sequence diagrams. We finally propose a method based on the association end formalisation in order to deal with the models validation. The whole of the solution is analysed by model checking.

A Fast Optimization Method for Reliability and Performance of Cloud Services Composition Application

At present the cloud computing is one of the newest trends of distributed computation, which is propelling another important revolution of software industry. The cloud services composition is one of the key techniques in software development. The optimization for reliability and performance of cloud services composition application, which is a typical stochastic optimization problem, is confronted with severe challenges due to its randomness and long transaction, as well as the characteristics of the cloud computing resources such as openness and dynamic. The traditional reliability and performance optimization techniques, for example, Markov model and state space analysis and so forth, have some defects such as being too time consuming and easy to cause state space explosion and unsatisfied the assumptions of component execution independence. To overcome these defects, we propose a fast optimization method for reliability and performance of cloud services composition application based on universal generating function and genetic algorithm in this paper. At first, a reliability and performance model for cloud service composition application based on the multiple state system theory is presented. Then the reliability and performance definition based on universal generating function is proposed. Based on this, a fast reliability and performance optimization algorithm is presented. In the end, the illustrative examples are given.

The Strict Strong Coloring Based Graph Distribution Algorithm

State space explosion is a fundamental obstacle in formal verification of concurrent systems. As a solution for this problem, this paper deals with distributed state space. The authors’ solution is to introduce the coloring concept and dominance relation in graphs for finding the good distribution of given graphs. This basic solution is improved in two steps: the initialization and optimization step. The authors also report on a thorough experimental study to evaluate the performance of this new algorithm which depends strongly on the size, nature of the graphs, and the chosen number of workers. In addition, the quality of this algorithm is illustrated by comparison with the hash function (MD5) based algorithm. To the best of the authors’ knowledge, it is the first time when coloring concept is used to solve this problem.

Efficient Semantics-Based Compliance Checking Using LTL Formulae and Unfolding

Business process models are required to be in line with frequently changing regulations, policies, and environments. In the field of intelligent modeling, organisations concern automated business process compliance checking as the manual verification is a time-consuming and inefficient work. There exist two key issues for business process compliance checking. One is the definition of a business process retrieval language that can be employed to capture the compliance rules, the other concerns efficient evaluation of these rules. Traditional syntax-based retrieval approaches cannot deal with various important requirements of compliance checking in practice. Although a retrieval language that is based on semantics can overcome the drawback of syntax-based ones, it suffers from the well-known state space explosion. In this paper, we define a semantics-based process model query language through simplifying a property specification pattern system without affecting its expressiveness. We use this language to capture semantics-based compliance rules and constraints. We also propose a feasible approach in such a way that the compliance checking will not suffer from the state space explosion as much as possible. A tool is implemented to evaluate the efficiency. An experiment conducted on three model collections illustrates that our technology is very efficient.

Local Verification Using a Distributed State Space

This paper deals with the modular analysis of distributed concurrent systems modelled by Petri nets. The main analysis techniques of such systems suffer from the well-known problem of the combinatory explosion of state space. In order to cope with this problem, we use a modular representation of the state space instead of the ordinary one. The modular representation, namely modular state space, is much smaller than the ordinary state space. We propose to distribute the modular state space on every machine associated with one module. We enhance the modularity of the verification of some local properties of any module by limiting it to the exploration of local and some global information. Once the construction of the distributed state space is performed, there is no communication between modules during the verification.

OSA模型下频谱切换策略的CPN建模及性能评价<br>Modeling Spectrum Handoff Strategy of OSA Model and Evaluating Its Performance Using CPN

在认知无线电(Cognitive Radio, CR)网络中，频谱切换技术是提高用户服务质量(QoS)，保证授权用户(Primary User, PU)优先使用权的重要技术之一。本文根据CR网络中认知用户的行为为其建立了可执行的自上而下的着色Petri网(CPN)模型，克服了传统马尔科夫链(MC)为系统建模时的无记忆性，以及易于产生状态空间爆炸等问题，对不同场景的模拟更灵活，计算量更低，具有较强的开放性；通过Monitor监控器分析模型性能，验证了模型的正确性。 In Cognitive Radio Networks (CRN), spectrum mobility effectively improves the user’s Quality of Service (QoS), and has become one of the important technologies to ensure the priority of primary users and solve the scarcity of spectrum resources. An executable top-down hierarchical Colored Petri Net (CPN) model is developed for spectrum handoff in CRN. It breaks through Markov Chain’s (MC) explicit limitation, which includes MC’s memoryless property and proneness to state space explosion in evaluating handoff process, and the simulation results show that CPN offers significant advantages over MC in modeling handoff strategies and evaluating their performance with less computational complexity in addition to its flexibility and adaptability to different scenarios.

Using Formal Methods to Improve Home-Use Medical Device Safety

Using Formal Methods to Improve Home-Use Medical Device Safety

Analysis of Spark Versus Non-Spark Mediated SR Calcium Leak using a Langevin Description of Stochastic Calcium Release

Markov chain models of the coupled gating of intracellular calcium channels are used to study the stochastic dynamics of SR calcium release and whole cell calcium homeostasis [see e.g., Hartman et al. AJP Heart Circ Physiol 299(6):H1996-2008, 2010]. However, the large number of channels per release site (100-250) results in a combinatorial state space explosion that causes whole cell models that enumerate the Markov chain state space to be computationally intensive. We present an alternative Langevin formulation, i.e., a system of stochastic ordinary differential equations, for the stochastic dynamics of calcium release sites composed of many identical channels. The Langevin formulation accurately reproduces the stationary distribution for the fraction of open channels determined from the corresponding Markov chain model and over a wide range of parameters yields similar spark properties (e.g., the distribution of spark amplitude and duration). We present a whole cell model of calcium homeostasis that incorporates the Langevin description of stochastic calcium release by coupling the associated Fokker-Planck equation to concentration balance equations for bulk myoplasmic and network SR calcium under the assumption of rapid equilibration of diadic subspace and junctional SR calcium. We found that myoplasmic and SR calcium increased both spark and non-spark mediated SR calcium leak, consistent with a recent experimental study [Bovo et al. J Physiol 589(24) 6039-6050, 2011]. Future work will investigate SR calcium leak during intracellular calcium transients and extensions of this modeling approach.

PALS-Based Analysis of an Airplane Multirate Control System in Real-Time Maude

Distributed cyber-physical systems (DCPS) are pervasive in areas such as aeronautics and ground transportation systems, including the case of distributed hybrid systems. DCPS design and verification is quite challenging because of asynchronous communication, network delays, and clock skews. Furthermore, their model checking verification typically becomes unfeasible due to the huge state space explosion caused by the system's concurrency. The PALS ("physically asynchronous, logically synchronous") methodology has been proposed to reduce the design and verification of a DCPS to the much simpler task of designing and verifying its underlying synchronous version. The original PALS methodology assumes a single logical period, but Multirate PALS extends it to deal with multirate DCPS in which components may operate with different logical periods. This paper shows how Multirate PALS can be applied to formally verify a nontrivial multirate DCPS. We use Real-Time Maude to formally specify a multirate distributed hybrid system consisting of an airplane maneuvered by a pilot who turns the airplane according to a specified angle through a distributed control system. Our formal analysis revealed that the original design was ineffective in achieving a smooth turning maneuver, and led to a redesign of the system that satisfies the desired correctness properties. This shows that the Multirate PALS methodology is not only effective for formal DCPS verification, but can also be used effectively in the DCPS design process, even before properties are verified.

Dynamic Fault Trees Analysis for Importance Measures Based on Cut Sequence Set Model

Importance Measures (IMs) for dynamic fault tree (DFT) remains widely open, for that Markov-based methodology is limited to exponential distributions as well as the state space explosion. Cut sequence describes the dynamic behaviors among components, and Cut sequence set (CSS) model provides ways to generate and calculate the probabilities of cut sequences, but it does not show how to analysis IMs using CSS model. This paper proposed a novel methodology of IMs in CSS model, including Birnbaum measure (BI), Risk Achievement Worth (RAW) and Structure Importance (SI) and an example demonstrates the superiority of the methodology. In contrast to the Markov-based methodology, the proposed methodology is combinatorial and can handle with any type of time-to-failure distributions for the system components.

Tools to generate and check consistency of model classes for Java PathFinder

Java PathFinder (JPF) is a model checker for Java applications. Like any other model checker, JPF has to combat the notorious state space explosion problem. Since JPF is a JVM, it can only model check Java bytecode and needs to handle native calls differently. JPF tackles the state space explosion problem and handles native calls by means of so-called model classes and native peers. In this paper we focus on model classes. For a class that either causes a state space explosion or that contains native calls, one can introduce a model class that either abstracts away particular details or implements the native call in Java. Rather than model checking the original class, JPF model checks the model class instead. Writing such model classes is time consuming and error prone. In this paper we propose two tools to assist with the development of model classes. The one tool generates a skeleton of a model class. The other tool checks whether a model class is consistent with the original class.

Symbolic quantitative information flow

Quantitative Information Flow (QIF) is a powerful approach to quantify leaks of confidential information in a software system. Here we present a novel method that precisely quanties information leaks. In order to mitigate the state-space explosion problem, we propose a symbolic representation of data, and a general SMT-based framework to explore systematically the state space. Symbolic Execution fits well with our framework, so we implement a method of QIF analysis employing Symbolic Execution. We develop our method as a prototype tool that can perform QIF analysis for a software system developed in Java. The tool is built on top of Java Pathfinder, an open source model checking platform, and it is the first tool in the field to support information-theoretic QIF analysis.

Time-Darts: A Data Structure for Verification of Closed Timed Automata

Symbolic data structures for model checking timed systems have been subject to a significant research, with Difference Bound Matrices (DBMs) still being the preferred data structure in several mature verification tools. In comparison, discretization offers an easy alternative, with all operations having linear-time complexity in the number of clocks, and yet valid for a large class of closed systems. Unfortunately, fine-grained discretization causes itself a state-space explosion. We introduce a new data structure called time-darts for the symbolic representation of state-spaces of timed automata. Compared with the complete discretization, a single time-dart allows to represent an arbitrary large set of states, yet the time complexity of operations on time-darts remain linear in the number of clocks. We prove the correctness of the suggested reachability algorithm and perform several experiments in order to compare the performance of time-darts and the complete discretization. The main conclusion is that in all our experiments the time-dart method outperforms the complete discretization and it scales significantly better for models with larger constants.

Chiefly Symmetric: Results on the Scalability of Probabilistic Model Checking for Operating-System Code

Reliability in terms of functional properties from the safety-liveness spectrum is an indispensable requirement of low-level operating-system (OS) code. However, with evermore complex and thus less predictable hardware, quantitative and probabilistic guarantees become more and more important. Probabilistic model checking is one technique to automatically obtain these guarantees. First experiences with the automated quantitative analysis of low-level operating-system code confirm the expectation that the naive probabilistic model checking approach rapidly reaches its limits when increasing the numbers of processes. This paper reports on our work-in-progress to tackle the state explosion problem for low-level OS-code caused by the exponential blow-up of the model size when the number of processes grows. We studied the symmetry reduction approach and carried out our experiments with a simple test-and-test-and-set lock case study as a representative example for a wide range of protocols with natural inter-process dependencies and long-run properties. We quickly see a state-space explosion for scenarios where inter-process dependencies are insignificant. However, once inter-process dependencies dominate the picture models with hundred and more processes can be constructed and analysed.