Symbolic Model Checking Research Articles

Modeling and Verification of Natural Language Requirements based on States and Modes

The relationship between states (status of a system) and modes (capabilities of a system) used to describe system requirements is often poorly defined. The unclear relationship could make systems of interest out of control because of the out of boundaries of the systems caused by the newly added modes. Formally modeling and verifying requirements can clarify the relationship, making the system safer. To this end, an innovative approach to analyzing requirements is proposed. The MoSt language (a Domain Specific Language implemented on the Xtext framework) is firstly designed for requirements modeling and a model validator is realized to check requirements statically. A code generator is then provided to realize the automatic model transformation from the MoSt model to a NuSMV model, laying the foundation for the dynamic checks of requirements through symbolic model checking. Next, a NuSMV runner is designed to connect the NuSMV with the validator to automate the whole dynamic checks. The grammar, the model validator, the code generator, and the NuSMV runner are finally integrated into a publicly available Eclipse-based tool. Two case studies have been employed to illustrate the feasibility of our approach. For each case study, we injected 14 errors. The results show that the static and dynamic checks can successfully detect all the errors.

Impact of the COVID-19 pandemic on cancer screenings in Portugal

ObjectivesThis study aimed to evaluate the impact of the COVID-19 pandemic on cancer screening in Portugal, and its consequences on cancer morbidity and mortality. MethodsThe pre-pandemic and pandemic periods were compared using publicly available data on performance and health outcomes indicators of the Portuguese NHS, namely the numbers and proportions of eligible individuals who underwent cancer screening (breast, cervical or colorectal). Pre-pandemic data were modelled to project hypothetical scenarios without a pandemic using an exponential smoothing algorithm, and then compared with data collected during the COVID-19 pandemic. A Markov model was developed to estimate years of life lost (YLL) due the reduction in the number of cancer screenings during the pandemic. The MS Excel and the PRISM symbolic model checker software were used. ResultsThere was a decrease in the number of breast (13 %), cervical (15 %) and colorectal (9–11 %) cancers screenings during the first two years of the pandemic. The model projections are 506, 41, and 148 additional deaths, losses of 11, 6, and 4 months of life per patient, and 12.8 thousand, 576, and 4 thousand YLL by the population due to breast, cervical, and colorectal cancer, respectively, over a 25-year time horizon in Portugal. ConclusionsThe disruption in cancer screening may contribute to increase cancer morbidity and mortality, with significant YLL. The long-term implications of the impaired cancer screening should be assessed, and proactive measures put in place to mitigate the increase in cancer morbidity, and mortality associated with the COVID-19 pandemic.

A hybrid approach to system verification in early design for complex mechatronic systems based on formal functional semantics

Model-based systems engineering (MBSE) has been adopted as a mainstream design methodology for complex mechatronic systems. According to this paradigm, structured models, typically represented in SysML are used to describe the system of interest from various aspects. Among these models, the system behavior model is fundamental for the subsequent design and hence should be verified against system functions in the early design stage. However, due to the lack of formal semantics of the involved SysML models and software-physical hybrid characteristics of the mechatronic systems, it is not a trivial task to apply existing formal verification methods to solve this problem. In this study, a novel approach relying on hybrid functional semantics is proposed. First, this verification problem is formally defined based on an in-depth analysis of the architectures and traceability between the involved SysML models. Then, a graphical modeling language to represent the hybrid functional semantics in SysML is defined so that the function and behavior models can be enhanced and explicitly correlated by the formal semantics. Finally, based on the semantically enhanced models, the model verification problem is formally re-defined as a semantics verification problem and further divided into two sub-problems, i.e., continuous and discrete semantics verification problems, which are automatically solved by leveraging existing verification techniques including functional-effect compatibility check and symbolic model checking. A mobile robot is illustrated to show the effectiveness of the proposed approach.

Automatically Finding the Right Probabilities in Bayesian Networks

This paper presents alternative techniques for inference on classical Bayesian networks in which all probabilities are fixed, and for synthesis problems when conditional probability tables (CPTs) in such networks contain symbolic parameters rather than concrete probabilities. The key idea is to exploit probabilistic model checking as well as its recent extension to parameter synthesis techniques for parametric Markov chains. To enable this, the Bayesian networks are transformed into Markov chains and their objectives are mapped onto probabilistic temporal logic formulas. For exact inference, we compare probabilistic model checking to weighted model counting on various Bayesian network benchmarks. We contrast symbolic model checking using multi-terminal binary (aka: algebraic) decision diagrams to symbolic inference using proba- bilistic sentential decision diagrams, symbolic data structures that are tailored to Bayesian networks. For the parametric setting, we describe how our techniques can be used for various synthesis problems such as computing sensitivity functions (and values), simple and difference parameter tuning and ratio parameter tuning. Our parameter synthesis techniques are applicable to arbitrarily many, possibly dependent, parameters that may occur in multiple CPTs. This lifts restrictions, e.g., on the number of parametrized CPTs, or on parameter dependencies between several CPTs, that exist in the literature. Experiments on several benchmarks show that our parameter synthesis techniques can treat parameter synthesis for Bayesian networks (with hundreds of unknown parameters) that are out of reach for existing techniques.

System verification via Model‐Checking: A case study of an autonomous multi‐differential drive robot

AbstractModel‐Based Systems Engineering (MBSE) has been utilized in practice to design and behavioral modeling cyber‐physical systems. The Vee model helps frame MBSE's lifecycle approach, with system verification a vital aspect of the qualification process. However, popular modeling language tools in MBSE, such as Systems Modeling Language (SysML), are incapable of formally verifying these systems. Model checking allows for the development of formal system models similar in abstraction to SysML models for automatically checking if these formal models satisfy formal specifications. We propose an approach to translate behavioral diagrams in SysML, such as state‐machine diagrams, to the popular symbolic model checker NuSMV for formal verification. As a case study, we apply this process to autonomous multi‐differential drive robots (DDR). Subsequently, the NuSMV model is verified against some formal operational specifications obtained from the requirements diagram of the DDR. This system verification approach can help System Engineers identify design flaws or incorrect modeling or specifications that could be missed during the design phase through the results of the model checking process.

Introduction to the Special Section on FM 2021

The first attempts to apply the k-induction method to software verification are only recent. In this paper, we present a novel proof by induction algorithm, which is built on the top of a symbolic context-bounded model checker and uses an iterative ...

Utilizing Continuous Time Markov Chain for analyzing video-on-demand streaming in multimedia systems

In multimedia systems, Tree and Mesh-based topologies are the popular ways to organize the peers in an overlay and provide video streaming services. Unlike Content Delivery Networks (CDN), providing streaming services through a Peer-to-Peer (P2P) overlay poses the challenge of unpredictable churn for both provider and consumer peers. The dynamically arriving and departing peers, with Video Cassette Recorder (VCR) actions like jump, pause, forward, rewind, etc., controlled by end users, makes it challenging to reason about such systems. Though techniques like prototype test beds, simulation, etc., are successful to some extent in analyzing the behavior of such complex systems before the actual deployment, they either require lots of effort to set up or fail to capture the finer anomalies. Therefore, there is a need to have a formal framework that can specify the system at the desired abstraction level and capture the stochastic behavior exhibited by the actors of such systems. This paper addresses this issue and provides a platform for analyzing the behavior of real-time Video-on-Demand (VoD) streaming behavior with VCR actions over P2P overlays. To capture the stochastic behavior of actors, the Continuous Time Markov Chain (CTMC) is used to design a model of both the tree and mesh-based systems. This CTMC model is written in the Probabilistic Symbolic Model Checker (PRISM) language, which assists in containing the state space explosion and specifies the QoUX properties using Continuous Stochastic Logic (CSL). The proposed methodology uses the scenarios described in various simulation-based studies and industry standards of VoD systems available in the proposed formal model and finds a striking resemblance in the results. Eventually, given a joining-delay threshold of 170 ms, a P2P-Tree-based architecture resulted in an optimal tree height of 4-5 levels; after that, the startup delay of playback gets affected. Similarly, for a given startup delay threshold of 700 ms after departure and seek-jump actions, the maximum P2P-Tree height should be 5. We have also compared the performance properties of P2P tree and mesh-based VoD streaming systems with industry standards of centralized VoD systems. It is observed that the performance of P2P-tree and P2P-mesh-based VoD streaming systems also meet the industry standards. The results we got from the proposed formal framework are conclusive and establish the applicability of the approach.

Probabilistic model checking of cancer metabolism

Cancer cell metabolism is often deregulated as a result of adaption to meeting energy and biosynthesis demands of rapid growth or direct mutation of key metabolic enzymes. Better understanding of such deregulation can provide new insights on targetable vulnerabilities, but is complicated by the difficulty in probing cell metabolism at different levels of resolution and under different experimental conditions. We construct computational models of glucose and glutamine metabolism with focus on the effect of IDH1/2-mutations in cancer using a combination of experimental metabolic flux data and patient-derived gene expression data. Our models demonstrate the potential of computational exploration to reveal biologic behavior: they show that an exogenously-mutated IDH1 experimental model utilizes glutamine as an alternative carbon source for lactate production under hypoxia, but does not fully-recapitulate the patient phenotype under normoxia. We also demonstrate the utility of using gene expression data as a proxy for relative differences in metabolic activity. We use the approach of probabilistic model checking and the freely-available Probabilistic Symbolic Model Checker to construct and reason about model behavior.

A formal verification approach for composite smart contracts security using FSM

Many of today's companies use Smart Contracts to represent and execute their business processes. Smart contracts are self-executed programs running over blockchain. In this context, composite smart contracts are used to represent collaborative business processes. A composite smart contract is a smart contract that needs to execute other contracts using external calls to achieve its tasks. Composite smart contracts, through the use of external calls and the execution of other smart contracts that might belong to other owners or companies, bring many challenges with regard to security requirements. As a result, special efforts must be done to ensure composite smart contracts security verification. In this paper, we propose a novel approach to verify the security and the correctness of the composite smart contracts written in solidity in Ethereum blockchain. This approach is based on the finite state machine models and model checking method for modeling and verifying the composite smart contracts respectively. We consider seven security properties as well as the security issues that depend on the contract context to be checked in the composite smart contract. For this, we provide two different yet complementary types of verification. The first type of verification is applied to all smart contracts with properties called in our approach “standard properties” that represent the generic ones, while the second type considers the context-dependent properties that we called “specific properties” varying from one smart contract to another. Finally, we express all properties using computation tree logic formulae and we use the nuXmv symbolic model checker to verify the model against all properties. This approach is validated using a different set of solidity smart contracts.

Incremental Witness Generation for Branching-Time Logic CTL*

We propose a tester-based symbolic algorithm to incrementally generate tree-like witnesses (the dual concept of counterexamples) for branching-time logic CTL*. The CTL* witnesses are state transition directed graphs of tree-like structure in which all strongly connected components are cycles, and all branches are lasso paths with shortest prefixes. The states and transitions in these graphs may be respectively attached with satisfied state and path subformulas as annotations for intelligibility. The correctness of the lasso path generation algorithm is proved. We have developed an ordered binary decision diagrams based symbolic model checker MCTK2 for CTL* in which the proposed witness generation algorithm has been implemented. To make the generated witnesses graphs more succinct, several optimization strategies are applied to reduce the number of annotations and avoid constructing branching paths as much as possible. The interactive visualization interface of MCTK2 enables users to conveniently inspect counterexamples and expand branches of interest such that they can incrementally analyze larger and more complex counterexamples.

Probabilistic Modeling of Histogram Based Fuzzy Image Enhancement Algorithm

Probabilistic model checking is frequently used to examine stochastic behavior. Model-checking is important for examining before extensive simulations, in differing fields, including computer communications, networks, security, and biology. In this work performance of histogram-based fuzzy image enhancement (HFIE Algorithm). The fuzzy contrast enhancement algorithm based on histograms is used to improve low contrast colored photographs. K is the contrast intensification parameter calculated from the histogram. The RGB image is transformed into HSV to preserve the chromatic information in the original image. To improve the image, only the V component is stretched using the M and K parameters. HFIE Algorithm is analyzed by developing its Discrete-time Markov Chain (DTMC) model in the Probabilistic Symbolic Model Checker (PRISM). First, a labeled transition diagram showing the functionality of HFIE Algorithm is constructed, then the HFIE Algorithm model using the PRISM tool is developed. The expected time to convert RGB image to HSV, probability of achieving enhanced RGB image, and expected SNR are measured with the help of properties.

Formal Verification for Node-Based Visual Scripts Using Symbolic Model Checking

Visual script languages with a node-based interface have commonly been used in the video game industry. We examined the bug database obtained in the development of FINAL FANTASY XV (FFXV), and noticed that several types of bugs were caused by simple mis-descriptions of visual scripts and could therefore be mechanically detected. We propose a method for the automatic verification of visual scripts in order to improve productivity of video game development. Our method can automatically detect those bugs by using symbolic model checking. We show a translation algorithm which can automatically convert a visual script to an input model for NuSMV that is an implementation of symbolic model checking. For a preliminary evaluation, we applied our method to visual scripts used in the production for FFXV. The evaluation results demonstrate that our method can detect bugs of scripts and works well in a reasonable time.

Probabilistic modelling of deception-based security framework using markov decision process

Existing studies using deception are ad-hoc attempts and few theoretical models have been designed to plan and integrate deception. We theorise that a pre-planning stage should be a fundamental part to obtain information about the attackers’ behaviours and the attack process by analysing known attacks. This will help plan and take defence actions by actively interacting with the attackers and predicting their actions using a probabilistic approach. This paper proposes a framework that provides a theoretical understanding to plan and integrate deception systematically and strategically. We also present probabilistic modelling to predict attack actions by formalising a real case of attacks captured on simulated Internet of Things devices as an Markov Decision Process (MDP) and verifying related properties using Probabilistic Symbolic Model Checker (PRISM). MDP’s properties verification results reveal that the associated cost for defence actions can be decreased by successfully predicting attackers’ probable actions. Moreover, we identify several quantification metrics (e.g. cost, reward, trust, incentive and penalty) to evaluate the performance of actions performed by attackers and defenders.

Overview of Control Algorithm Verification Methods in Power Electronics Systems

The paper presents the existing verification methods for control algorithms in power electronics systems, including the application of model checking techniques. In the industry, the most frequently used verification methods are simulations and experiments; however, they have to be performed manually and do not give a 100% confidence that the system will operate correctly in all situations. Here we show the recent advancements in verification and performance assessment of power electronics systems with the usage of formal methods. Symbolic model checking can be used to achieve a guarantee that the system satisfies user-defined requirements, while statistical model checking combines simulation and statistical methods to gain statistically valid results that predict the behavior with high confidence. Both methods can be applied automatically before physical realization of the power electronics systems, so that any errors, incorrect assumptions or unforeseen situations are detected as early as possible. An additional functionality of verification with the use of formal methods is to check the converter operation in terms of reliability in various system operating conditions. It is possible to verify the distribution and uniformity of occurrence in time of the number of transistor switching, transistor conduction times for various current levels, etc. The information obtained in this way can be used to optimize control algorithms in terms of reliability in power electronics. The article provides an overview of various verification methods with an emphasis on statistical model checking. The basic functionalities of the methods, their construction, and their properties are indicated.

Reusing Solutions Modulo Theories

In this paper we propose an approach for reusing formula solutions to reduce the impact of Satisfiability Modulo Theories (SMT) solvers on the scalability of symbolic program analysis. SMT solvers can efficiently handle huge expressions in relevant logic theories, but they still represent a main bottleneck to the scalability of symbolic analyses, like symbolic execution and symbolic model checking. Reusing proofs of formulas solved during former analysis sessions can reduce the amount of invocations of SMT solvers, thus mitigating the impact of SMT solvers on symbolic program analysis. Early approaches to reuse formula solutions exploit equivalence and inclusion relations among structurally similar formulas, and are strongly tighten to the specific target logics. In this paper, we present an original approach that reuses both satisfiability and unsatisfiability proofs shared among many formulas beyond only equivalent or related-by-implication formulas. Our approach straightforwardly generalises across multiple logics. It is based on the original concept of distance between formulas, which heuristically approximates the likelihood of formulas to share either satisfiability or unsatisfiability proofs. We show the efficiency and the generalisability of our approach, by instantiating the underlying distance function for formulas that belong to most popular logic theories handled by current SMT solvers, and confirm the effectiveness of the approach, by reporting experimental results on over nine millions formulas from five logic theories.

A Semi-Automatic Semantic Consistency-Checking Method for Learning Ontology from Relational Database

To tackle the issues of semantic collision and inconsistencies between ontologies and the original data model while learning ontology from relational database (RDB), a semi-automatic semantic consistency checking method based on graph intermediate representation and model checking is presented. Initially, the W-Graph, as an intermediate model between databases and ontologies, was utilized to formalize the semantic correspondences between databases and ontologies, which were then transformed into the Kripke structure and eventually encoded with the SMV program. Meanwhile, description logics (DLs) were employed to formalize the semantic specifications of the learned ontologies, since the OWL DL showed good semantic compatibility and the DLs presented an excellent expressivity. Thereafter, the specifications were converted into a computer tree logic (CTL) formula to improve machine readability. Furthermore, the task of checking semantic consistency could be converted into a global model checking problem that could be solved automatically by the symbolic model checker. Moreover, an example is given to demonstrate the specific process of formalizing and checking the semantic consistency between learned ontologies and RDB, and a verification experiment was conducted to verify the feasibility of the presented method. The results showed that the presented method could correctly check and identify the different kinds of inconsistencies between learned ontologies and its original data model.

Inductive Validity Cores

Symbolic model checkers can construct proofs of properties over highly complex models. However, the results reported by the tool when a proof succeeds do not generally provide much insight to the user. It is often useful for users to have traceability information related to the proof: which portions of the model were necessary to construct it. This traceability information can be used to diagnose a variety of modeling problems such as overconstrained axioms and underconstrained properties, measure completeness of a set of requirements over a model, and assist with design optimization given a set of requirements for an existing or synthesized implementation. In this paper, we present a comprehensive treatment of a suite of algorithms to compute inductive validity cores (IVCs), minimal sets of model elements necessary to construct inductive proofs of safety properties for sequential systems. The algorithms are based on the UNSAT core support built into current SMT solvers and novel encodings of the inductive problem to generate approximate and guaranteed minimal inductive validity cores as well as all inductive validity cores. We demonstrate that our algorithms are correct, describe their implementation in the JKind model checker for Lustre models, and present several use cases for the algorithms. We then present a substantial experiment in which we benchmark the efficiency and efficacy of the algorithms.

Formal Analysis of QUIC Handshake Protocol Using Symbolic Model Checking

This work presents a security analysis of the QUIC handshake protocol based on symbolic model checking. As a newly proposed secure transport protocol, the purpose of QUIC is to improve the transport performance of HTTPS traffic and enable rapid deployment and evolution of transport mechanisms. QUIC is currently in the IETF standardization process and will potentially carry a significant portion of Internet traffic in the emerging future. For a better understanding of the essential security properties, we have developed a formal model of the QUIC handshake protocol and perform a comprehensive formal security analysis by using two state-of-the-art model checking tools for cryptographic protocols, i.e., ProVeirf and Verifpal. Our analysis shows that ProVerif is generally more powerful than Verifpal in terms of verifying authentication properties. Moreover, both tools produce a counterexample to some security properties, which reveal a design flaw in the current protocol specification. Last but not least, we analyze the root causes of this counterexample and suggest a possible fix.

Model checking intelligent avionics systems for test cases generation using multi-agent systems

The paper contributes by introducing a novel, formal and operational approach that addresses the open challenging issues of modeling, verifying, and testing intelligent critical avionics systems. We advance the state-of-the-art by unifying the three challenges and considering the intelligence, autonomy, and accountability of the components as first citizen concepts. The proposed methodology is effectively applied to a real, practical and complex case study of intelligent avionics systems, namely the landing gear system and uses multi-agent systems to model each main component in the system as an intelligent agent. We also introduce the formalism of extended interpreted systems that supports intelligence, autonomy, communication, input and output actions, predicate conditions and post-conditions. The paper adopts the computation tree logic of conditional commitments to model communication among autonomous agents and trace its progress. The symbolic model checker of this logic is used to run the verification of the system model, encoded in an extended input language, against coverage criteria and properties. Furthermore, we introduce a new testing methodology that: 1) Follows a test-driven development approach; 2) performs unit testing, component testing, and system testing in each increment; and 3) uses model checking to generate automatically counterexamples and witness traces interpreted into concrete test suites that achieve new coverage criteria. The experimental results showed the efficiency and scalability of the developed approach against a transformation-based technique. Finally, the computational complexity of the developed approach is analysed.

Model checking boot code from AWS data centers

This paper describes our experience with symbolic model checking in an industrial setting. We have proved that the initial boot code running in data centers at Amazon Web Services is memory safe, an essential step in establishing the security of any data center. Standard static analysis tools cannot be easily used on boot code without modification owing to issues not commonly found in higher-level code, including memory-mapped device interfaces, byte-level memory access, and linker scripts. This paper describes automated solutions to these issues and their implementation in the C Bounded Model Checker (CBMC). CBMC is now the first source-level static analysis tool to extract the memory layout described in a linker script for use in its analysis.