Symbolic Model Checking Research Articles

On Verification of PLC-Programs Written in the LD-Language

We discuss some questions connected with the construction of a technology of analysing correctness of Programmable Logic Controller programs. We consider an example of modeling and automated verification of PLC-programs written in the Ladder Diagram language (including timed function blocks) of the IEC 61131-3 standard. We use the Cadence SMV for symbolic model checking. Program properties are written in the linear-time temporal logic LTL.

Model checking to assess T-helper cell plasticity.

Computational modeling constitutes a crucial step toward the functional understanding of complex cellular networks. In particular, logical modeling has proven suitable for the dynamical analysis of large signaling and transcriptional regulatory networks. In this context, signaling input components are generally meant to convey external stimuli, or environmental cues. In response to such external signals, cells acquire specific gene expression patterns modeled in terms of attractors (e.g., stable states). The capacity for cells to alter or reprogram their differentiated states upon changes in environmental conditions is referred to as cell plasticity. In this article, we present a multivalued logical framework along with computational methods recently developed to efficiently analyze large models. We mainly focus on a symbolic model checking approach to investigate switches between attractors subsequent to changes of input conditions. As a case study, we consider the cellular network regulating the differentiation of T-helper (Th) cells, which orchestrate many physiological and pathological immune responses. To account for novel cellular subtypes, we present an extended version of a published model of Th cell differentiation. We then use symbolic model checking to analyze reachability properties between Th subtypes upon changes of environmental cues. This allows for the construction of a synthetic view of Th cell plasticity in terms of a graph connecting subtypes with arcs labeled by input conditions. Finally, we explore novel strategies enabling specific Th cell polarizing or reprograming events.

Symbolic Model Checking of WISHBONE on-Chip Bus

Symbolic Model Checking of WISHBONE on-Chip Bus

Model checking temporal knowledge and commitments in multi-agent systems using reduction

Though modeling and verifying Multi-Agent Systems (MASs) have long been under study, there are still challenges when many different aspects need to be considered simultaneously. In fact, various frameworks have been carried out for modeling and verifying MASs with respect to knowledge and social commitments independently. However, considering them under the same framework still needs further investigation, particularly from the verification perspective. In this article, we present a new technique for model checking the logic of knowledge and commitments (CTLKC+). The proposed technique is fully-automatic and reduction-based in which we transform the problem of model checking CTLKC+ into the problem of model checking an existing logic of action called ARCTL. Concretely, we construct a set of transformation rules to formally reduce the CTLKC+ model into an ARCTL model and CTLKC+ formulae into ARCTL formulae to get benefit from the extended version of NuSMV symbolic model checker of ARCTL. Compared to a recent approach that reduces the problem of model checking CTLKC+ to another logic of action called GCTL∗, our technique has better scalability and efficiency. We also analyze the complexity of the proposed model checking technique. The results of this analysis reveal that the complexity of our reduction-based procedure is PSPACE-complete for local concurrent programs with respect to the size of these programs and the length of the formula being checked. From the time perspective, we prove that the complexity of the proposed approach is P-complete with regard to the size of the model and length of the formula, which makes it efficient. Finally, we implement our model checking approach on top of extended NuSMV and report verification results for the verification of the NetBill protocol, taken from business domain, against some desirable properties. The obtained results show the effectiveness of our model checking approach when the system scales up.

Generating and Solving Symbolic Parity Games

We present a new tool for verification of modal mu-calculus formulae for process specifications, based on symbolic parity games. It enhances an existing method, that first encodes the problem to a Parameterised Boolean Equation System (PBES) and then instantiates the PBES to a parity game. We improved the translation from specification to PBES to preserve the structure of the specification in the PBES, we extended LTSmin to instantiate PBESs to symbolic parity games, and implemented the recursive parity game solving algorithm by Zielonka for symbolic parity games. We use Multi-valued Decision Diagrams (MDDs) to represent sets and relations, thus enabling the tools to deal with very large systems. The transition relation is partitioned based on the structure of the specification, which allows for efficient manipulation of the MDDs. We performed two case studies on modular specifications, that demonstrate that the new method has better time and memory performance than existing PBES based tools and can be faster (but slightly less memory efficient) than the symbolic model checker NuSMV.

Schedulability of Herschel revisited using statistical model checking

Schedulability analysis is a main concern for several embedded applications due to their safety-critical nature. The classical method of response time analysis provides an efficient technique used in industrial practice. However, the method is based on conservative assumptions related to execution and blocking times of tasks. Consequently, the method may falsely declare deadline violations that will never occur during execution. This paper is a continuation of previous work of the authors in applying extended timed automata model checking (using the tool UPPAAL) to obtain more exact schedulability analysis, here in the presence of non-deterministic computation times of tasks given by intervals [BCET,WCET]. Computation intervals with preemptive schedulers make the schedulability analysis of the resulting task model undecidable. Our contribution is to propose a combination of model checking techniques to obtain some guarantee on the (un)schedulability of the model even in the presence of undecidability. Two methods are considered: symbolic model checking and statistical model checking. Since the model uses stop-watches, the reachability problem becomes undecidable so we are using an over-approximation technique. We can safely conclude that the system is schedulable for varying values of BCET. For the cases where deadlines are violated, we use polyhedra to try to confirm the witnesses. Our alternative method to confirm non-schedulability uses statistical model-checking (SMC) to generate counter-examples that are always realizable. Another use of the SMC technique is to do performance analysis on schedulable configurations to obtain, e.g., expected response times. The methods are demonstrated on a complex satellite software system yielding new insights useful for the company.

Safety assessment of AltaRica models via symbolic model checking

AltaRica is a language used to describe safety critical systems that has become a de-facto European industrial standard for Model-Based Safety Assessment (MBSA). However, even the most mature tool for the support for MBSA of AltaRica models, i.e. Dassault's OCAS, has several limitations. The most important ones are its inability to perform many analyses exhaustively, severe scalability issues, and the lack of model checking techniques for temporal properties.In this paper we present a novel approach for the analysis of AltaRica models, based on a translation into an extended version of the model checker NuSMV. The translation relies on a novel formal characterization of the Dataflow dialect of AltaRica used in OCAS. The translation is formally defined, and its correctness is proved. Based on this formal characterization, a toolset has been developed and integrated within OCAS, thus enabling functional verification and safety assessment with the state of the art techniques of NuSMV. The whole approach is validated by an experimental evaluation on a set of industrial case studies, which demonstrates the advantages of the proposed technique over the currently available tools.

Quantitative and qualitative analysis of SysML activity diagrams

Model-driven engineering refers to a range of approaches that uses models throughout systems and software development life cycle. Towards sustaining such a successful approach in practice, we present a model-based verification framework that supports the quantitative and qualitative analysis of SysML activity diagrams. To this end, we propose an algorithm that maps SysML activity diagrams into Markov decision processes expressed using the language of the probabilistic symbolic model checker PRISM. Furthermore, we elaborate on the correctness of our translation algorithm by proving its soundness with respect to a SysML activity diagrams operational semantics that we also present in this work. The generated models can be verified against a set of properties expressed in the probabilistic computation tree logic. To automate our approach, we developed a prototype tool that interfaces a modeling environment and the probabilistic model checker. We also show how to leverage adversary generation to provide the developer with a useful counterexample/witness as a feedback on the verified properties. Finally, the established theoretical foundations are complemented with an illustrative case study that demonstrates the usability and benefit of such a framework.

Summarization of Boolean satisfiability verification

As a complementary technology to Binary Decision Diagram-based (BDD-based) symbolic model checking, the verification techniques on Boolean satisfiability problem have gained an increasing wide of applications over the last few decades, which brings a dramatic improvement for automatic verification. In this paper, we firstly introduce the theory about the Boolean satisfiability verification, including the description on the problem of Boolean satisfiability verification, Davis-Putnam-Logemann-Loveland (DPLL) based complete verification algorithm, and all kinds of solvers generated and the logic languages used by those solvers. Moreover, we formulate a large number optimizations of technique revolutions based on Boolean SATisfiability (SAT) and Satisfiability Modulo Theories (SMT) solving in detail, including incomplete methods such as bounded model checking, and other methods for concurrent programs model checking. Finally, we point out the major challenge pervasively in industrial practice and prospect directions for future research in the field of formal verification.

Symbolic Verification of Control Systems and Operating Procedures

In this paper, we provide a review of Professor Powers’s and his students’ work on connecting fault analysis, discrete process control, human operating procedures, and symbolic model checking. In recent years, this type of research is placed under the banner of “cyber-physical systems research”. Some of the techniques and procedures Powers and his students developed can be found in the open literature and conference proceedings. However, they have not been published broadly due to the untimely passing of Professor Powers. A complete overview of the methods are not available, and the cap-stone results obtained in the two last Ph.D. theses have not been published.

UML-Checker: An Approach for Verifying UML Behavioral Diagrams

UML is a visual modeling language used for specifying, visualizing, constructing, and documenting software artifacts. Despite having many features to model systems, conducting verifications and validations on UML models is not an easy task. In this paper, the problem of performing verification of UML models is discussed through a translation of UML behavioral diagrams into formal models to be verified by a symbolic model checker. An approach and tool (UML checker) is presented in order to conduct verifications on UML diagrams. The main ideas are: (a) provide an approach to perform the translation of activity, state and use case diagrams to the formal input language of the NuSMV checker; (b) automate the translation of UML diagrams to a formal language; and (c) provide a set of predefined validations that are used to check the diagrams.

Supervisor Synthesis to Satisfy Safety and Reachability Requirements in Chemical Process Control

A specification expressed in computation tree logic (CTL) that enforces safety and reachability requirements in discrete event systems is proposed. It is shown that the specification has a unique minimal control strategy that maximizes the set of states that satisfy the specification, and an algorithm is provided to calculate the control strategy. The specification captures the idea that the chemical process should always be able to shut down in a safe manner. The algorithm uses established CTL model checking procedures to perform the intermediate calculations, and can incorporate symbolic model checking. The maximum problem size for which a control strategy can be calculated is similar to that of the corresponding verification problem. A small example demonstrates the application of the algorithm to a problem that includes safety and reachability constraints. Current work aims to use the techniques to solve a real process control problem supplied by industry.

Parameter Synthesis for Timed Kripke Structures

We show how to synthesise parameter values under which a given property, expressed in a certain extension of CTL, called RTCTLP, holds in a parametric timed Kripke structure. We prove the decidability of parameter synthesis for RTCTLP by showing how to restrict the infinite space of parameter valuations to its finite subset and employ a brute-force algorithm. The brute-force approach soon becomes intractable, therefore we propose a symbolic algorithm for RTCTLP parameter synthesis. Similarly to the fixed-point symbolic model checking approach, we introduce special operators which stabilise on the solution. The process of stabilisation is essentially a translation from the RTCTLP parameter synthesis problem to a discrete optimization task. We show that the proposed method is sound and complete and provide some complexity results. We argue that this approach leads to new opportunities in model checking, including the use of integer programming and related tools.

SMT-Based Reachability Checking for Bounded Time Petri Nets

Time Petri nets by Merlin and Farber are a powerful modelling formalism. However, symbolic model checking methods for them consider in most cases the nets which are 1-safe, i.e., allow the places to contain at most one token. In our paper we present an approach which applies symbolic verification to testing reachability for time Petri nets without this restriction. We deal with the class of bounded nets restricted to disallow multiple enabledness of transitions, and present the method of reachability testing based on a translation into a satisfiability modulo theory (SMT).

Verification of Embedded Real-Time Systems Using Symbolic Model Checking: A Case Study

This p aper presents a case study for symbolic model checking (SMC) with Propositional Projection Temporal Logic (PPTL). First, PPTL is briefly introduced. Then an outline of symbolic model checking algorithm for PPTL proposed in [21] is presented. As a case study, a single-track railroad crossing control system (STRCCS) is employed to illustrate how SMC for PPTL can be utilized in the specification and verification of embedded real-time systems.

A formal verification framework for SysML activity diagrams

SysML activity diagrams are OMG/INCOSE standard diagrams used for modeling and specifying probabilistic systems. They support systems composition by call behavior and send/receive artifacts. For verification, the existing approaches dedicated to these diagrams are limited to a restricted set of artifacts. In this paper, we propose a formal verification framework for these diagrams that supports the most important artifacts. It is based on mapping a composition of SysML activity diagrams to the input language of the probabilistic symbolic model checker called “PRISM”. To prove the soundness of our mapping approach, we capture the underlying semantics of both the SysML activity diagrams and their generated PRISM code. We found that the probabilistic equivalence relation between both semantics preserve the satisfaction of the system requirements. Finally, we demonstrate the effectiveness of our approach by presenting real case studies.

Abstract B134: Computational analysis of the signaling pathways in the tumor microenvironment

Abstract Tumor microenvironment and angiogenesis are two important factors contributing to the cancer development and drug resistance, which presents a challenge to the cancer treatment. Recent cancer studies found the bidirectional interaction between cancer cells and stellate cells is of importance in the tumor microenvironment, which can stimulate the synthesis and secretion of growth factors and cytokines, promote the growth of surrounding cancer cells through paracrine pathways. Since the pathways implicated in the tumor microenvironment are complicated and highly interconnected, it is not realistic to use traditional computational techniques, for example, ordinary differential equation and stochastic simulation algorithm, to analyze such a large network in a fast and effective way. Given a large crosstalk model of signaling pathways, one of systems biologist's interests is to discover and identify the key cellular components and signal transduction sequences that will drive the system to a pre-specified state (e.g., apoptosis, proliferation or angiogenesis) at a specific time point. To systematically investigate the interaction in the tumor microenvironment, we have constructed an in silico discrete value model of multicellular signaling pathways to describe the expression levels of different signaling components and dynamics of different signaling pathways without introducing any unknown parameters in the biochemical reactions. The frequently mutated pathways in our tumor microenvironment model include the pathways of Hedgehog, Wnt, Rb-E2F, P53, RAS, PI3K, VEGF, etc. Model Checking is a powerful formal verification technique, which has been successfully applied for the verification of hardware system and digital circuits. The Model Checking algorithm can automatically and exhaustively search the state transition system (up to 10 to the power of 100 possible states) to determine, whether or not, a given model M satisfies a desired temporal logic formula Φ. We, then, applied the Symbolic Model Checking, to automatically analyze the cell's proliferation, angiogenesis and apoptosis in the proposed model. Our studies predicted several important temporal logic properties and dynamic behaviors (oscillation phenomenon) in the tumor microenvironment that can be checked in the future experiments. The verification technique identified several signaling components, including the RAS, AKT, DVL, PTEN, etc, whose mutation or loss of function can promote cell growth and inhibit apoptosis (programmed cell death), some of which have been confirmed by existing experiments. With the help of Model Checking, our work provides a comprehensive understanding of the signaling networks and their crosstalk in the tumor microenvironment which might help cancer researchers to develop effective multi-gene targeted therapies for the cancer patients. Citation Format: Haijun Gong. Computational analysis of the signaling pathways in the tumor microenvironment. [abstract]. In: Proceedings of the AACR Special Conference on Advances in Breast Cancer Research: Genetics, Biology, and Clinical Applications; Oct 3-6, 2013; San Diego, CA. Philadelphia (PA): AACR; Mol Cancer Res 2013;11(10 Suppl):Abstract nr B134.

Symbolic Model Checking for Incomplete Designs with Flexible Modeling of Unknowns

We consider the problem of checking whether an incomplete design (i.e., a design containing "unknown parts", so-called Black Boxes) can still be extended to a complete design satisfying a given property or whether the property is satisfied for all possible extensions. There are many applications of property checking for incomplete designs, such as early verification checks for unfinished designs, error localization in faulty designs and the abstraction of complex parts of a design in order to simplify the property checking task. To process incomplete designs we present an approximate, yet sound algorithm. The algorithm is flexible in the sense that for every Black Box a different approximation method can be chosen. This permits us to handle less relevant Black Boxes (in terms of the property) with larger approximation and thus faster, whereas we do not lose important information when the possible effect of more relevant Black Boxes is modeled by more exact methods. Additionally, we present a concept to decide exactly whether Black Boxes with bounded memory can be implemented so that they satisfy a given property. This question is reduced to conventional symbolic model checking. The effectiveness and feasibility of the methods is demonstrated by a series of experimental results.

A symbolic model checking approach to verifying satellite onboard software

This paper discusses the use of symbolic model checking technology to verify the design of an embedded satellite software control system called the attitude and orbit control system (AOCS). This system is mission critical because it is responsible for maintaining the attitude of the satellite and for performing fault detection, isolation, and recovery decisions. An executable AOCS implementation by Space Systems Finland has been provided in Ada source code form, and we use the input language of the symbolic model checker NuSMV 2 to model the implementation at a detailed level. We describe the modeling techniques and abstractions used to alleviate the state space explosion due to the handling of timers and the large number of system components controlled by the AOCS. The required behavior has been specified as extended state machine diagrams and translated to temporal logic properties. Besides well-known LTL and CTL model checking algorithms, we adapt a previously unexplored form of the liveness-to-safety approach to the problem. The latter new technique turns out to successfully prove all desired properties of the system, outperforming both the LTL and CTL implementations of NuSMV 2.

A case study on the lightweight verification of a multi-threaded task server

We present a case study on the verification of the design of a commercial multi-threaded task server (MTTS), developed by the Novabase company, used for massively parallelizing computational tasks. In a first stage, we employed the Plural tool, which is designed to perform lightweight verification of Java programs using a data-flow analysis (DFA) framework, to specify and verify the MTTS. We wrote the Plural specification for the MTTS based on the code developed by Novabase, its informal documentation, and our discussions with Novabase engineers, who validated our understanding of the MTTS application. The Plural specification language is based on typestates and access permissions. In a second stage, we developed the Pulse tool, which enhances the analysis performed by Plural, and used the tool on the MTTS specifications. Pulse translates Plural specifications into an abstract state-machine model that captures the semantics of all the possible concurrent programs implementing the given specifications, and uses the evmdd-smc symbolic model checker to verify the machine model. The experimental results on the MTTS specification show that the exhaustive model-checking approach scales reasonably well and is efficient at finding errors in specifications that were not previously detected with the data-flow analysis (DFA) capabilities of Plural.