Model Checking Tools Research Articles

FGAC: A Fine-Grained Access Control Framework for Supply Chain Data Sharing

With the rapid development of digital economics, a large number of data have been accumulated in the supply chain system, and data islands have appeared. Data sharing is an imperative way to unlock the data value of a supply chain system. A safe and effective access control mechanism for privacy-sensitive data is key in data sharing. At present, traditional access control mechanisms are static, single-factor control, and prone to a single point of failure. For dealing with these, a fine-grained access control (FGAC) framework for supply chain data sharing is proposed, based on the blockchain Hyperledger Fabric. It augments role-based access control (RBAC) by giving different attribute keywords to different types of users. This framework is implemented in smart contract Chaincodes and quantitatively verified by using the model-checking tool UPPAAL. The experiment results show that the FGAC framework enhances the efficiency and safety in the process of data sharing for the supply chain system, compared with the existing works.

Digital mock-ups as support tools for preventing risks related to energy sources in the operation stage of industrial facilities through design

Building information modelling (BIM) and product lifecycle management (PLM) technologies provide automatic model checking (AMC) tools that can be used for the prevention of occupational health and safety (OHS) risks through design (PtD). Considering that the risks related to energy sources during the operation stage of industrial facilities can be major, our objective is to propose a PtD approach for this type of risk that uses AMC tools. For this purpose, our methodology is based on the information systems design-science paradigm. Considering that both BIM and PLM mock-ups can be used to design industrial facilities and that Catia V5 is one of the main software programs used to design industrial equipment and facilities, our methodology specifically includes a comparative literature review of the uses of AMC tools to check BIM and PLM mock-ups and a comparative study of the OHS risk prevention capabilities of the AMC tools available in Catia V5. Therefore, the PtD approach that we propose is specific to Catia V5. It consists of: 1) extracting rules related to hazardous energy control from regulatory requirements and classifying them according to their automation potential, 2) expressing the rules in a form that is compatible with the RASE method, 3) interpreting the rules using the RASE method, and 4) using a macro script to automatically check the compliance of the digital mock-ups. The proposed approach's contribution is that it makes it possible to support facility designers in automatically identifying hazardous energy sources in systems. In future studies, we intend to couple this PtD approach with methods that integrate dynamic system behavior to assess the level of risk corresponding to the hazardous sources identified.

CSECMAS: An Efficient and Secure Certificate Signing Based Elliptic Curve Multiple Authentication Scheme for Drone Communication Networks

With the rapid development of communication technology, unmanned aerial vehicles (UAVs) have been widely used in the military, rescue, agricultural and other fields. The security and privacy issues are one of the biggest challenges for UAV communications. In this paper, we propose a certificate signing based on an Elliptic Curve multiple authentication scheme (CSECMAS). The scheme employs multiple authentication tools to ensure the legitimacy of the identity and the integrity of the information. We treat multiple UAVs as a cluster, and after establishing a secure session between the ground control station (GCS) and the UAV, we use the fitness function to select one node from them as the key node. Mutual authentication between the UAVs through the key node establishes secure conversations while increasing the security and resistance to destruction of the entire communication network. The proposed protocol is formally analyzed and verified by using the model-checking tool SPIN. The informal analysis shows that the protocol can resist various attacks, such as man-in-the-middle attacks, replay attacks, and DoS attacks. The performance analysis shows that the proposed protocol is superior compared to other related protocols.

Self-Adaptive Framework With Master–Slave Architecture for Internet of Things

The Internet of Things (IoT) connects a wide range of entities and can be applied to various types of environments. In addition, IoT environments can be dynamically changed at runtime; thus, IoT systems can be deployed in various environments. To support stable operation, IoT systems must adapt to dynamic environmental changes. The self-adaptive software aims to adjust various artifacts or attributes of software to adapt the detected context by itself, and various studies have applied self-adaptive methods in IoT-related research. In this study, we proposed a self-adaptive software framework with master–slave architecture-based finite-state machine modeling. In addition, model checking is applied, which is a formal method to verify IoT systems at runtime, and a cache-based mechanism is applied to reduce the computational time required for verification. To demonstrate the efficiency of the proposed framework, an empirical evaluation was performed with several model-checking tools (RINGA, NuSMV, nuXmv, and CadenceSMV), and the results showed the efficiency of the proposed framework with the cache-based mechanism. In addition, an example application was investigated with smart greenhouse scenarios, and the application was implemented on Android and Arduino. The application was operated in physical environments, and the results showed the practical usability of the proposed framework with verification at runtime.

Timed Automata Robustness Analysis via Model Checking

Timed automata (TA) have been widely adopted as a suitable formalism to model time-critical systems. Furthermore, contemporary model-checking tools allow the designer to check whether a TA complies with a system specification. However, the exact timing constants are often uncertain during the design phase. Consequently, the designer is often able to build a TA with a correct structure, however, the timing constants need to be tuned to satisfy the specification. Moreover, even if the TA initially satisfies the specification, it can be the case that just a slight perturbation during the implementation causes a violation of the specification. Unfortunately, model-checking tools are usually not able to provide any reasonable guidance on how to fix the model in such situations. In this paper, we propose several concepts and techniques to cope with the above mentioned design phase issues when dealing with reachability and safety specifications.

A Bounded Model Checker for Timed Automata and Its Application to LTL Properties

Model checking with a time aspect is often used in verification on hardware and embedded systems. Timed automata are often used for such models. UPPAAL is a world-wide famous model checking tool for timed automata; however, UPPAAL is a Computational Tree Logic (CTL)-based model checking tool and cannot use Linear Temporal Logic (LTL) properties. Bounded model checking uses LTL (Linear Time Logic) for a checking formula. Bounded model checking specifies a boundary k and obtains counterexamples by searching from the initial state of a system to states reachable by k-steps. There are several studies on bounded model checking. Sorea has proposed a concrete algorithm for a timed automaton. There are, however, no clear details on how to implement bounded model checking tools for timed automata, and study the performance. Another problem is that the timed automaton covered by the method does not support general variables except for clock variables. The objective of this study is to implement a bounded model checking tool using LTL for timed automata. We also improve Sorea's method so that it can handle extended timed automata that handle general variables. This paper also presents some LTL examples from texts on requirement specifications for embedded systems and the results of applying the tool to them.

A Graph Transformation Approach for Modeling and Verification of UML 2.0 Sequence Diagrams

Unified Modeling Language (UML) 2.0 Sequence Diagrams (UML 2.0 SD) are used to describe interactions in software systems. These diagrams must be verified in the early stages of software development process to guarantee the production of a reliable system. However, UML 2.0 SD lack formal semantics as all UML specifications, which makes their verification difficult, especially if we are modeling a critical system where the automation of verification is necessary. Communicating Sequential Processes (CSP) is a formal specification language that is suited for analysis and has many automatic verification tools. Thus, UML and CSP have complementary aspects, which are modeling and analysis. Recently, a formalization of UML 2.0 SD using CSP has been proposed in the literature; however, no automation of that formalization exists. In this paper, we propose an approach on the basis of the above formalization and a visual modeling tool to model and automatically transform UML 2.0 SD to CSP ones; thus, the existing CSP model checker can verify them. This approach aims to use UML 2.0 SD for modeling and CSP and its tools for verification. This approach is based on graph transformation, which uses AToM3 tool and proposes a metamodel of UML 2.0 SD and a graph grammar to perform the mapping of the latter into CSP. Failures-Divergence Refinement (FDR) is the model checking tool used to verify the behavioral properties of the source model transformation such as deadlock, livelock and determinism. The proposed approach and tool are illustrated through a case study.

Correct-by-Construction Approach for Formal Verification of IoT Architecture

Nowadays, The Internet of Things(IoT) has shown an increased interest in the academic literature, while its implementations became involved in almost every aspect of life in modern society. IoT is the integration of virtual and physical things through distributed services to collect and share data among themselves. The number of architecture approaches designed to aid IoT has increased significantly recently. As a result of different IoT architecture approaches, in this paper, we proposed a novel correct-by-construction formal approach based on an Event-B method to describe the physical architecture of IoT layers. This formal approach inspects four layers: the physical layer, the gateway layer, the middleware layer, respectively the application layer. An Electrocardiogram (ECG) IoT system is applied in our model as a case study. Finally, we proved and validated the correctness of our formal model by using proof obligations and the model checking tool called Rodin.

Counterexample-guided Spatial Flow Model Checking Methods for C Code

Software verification has always been a popular research topic to ensure the correctness and security of software. However, due to the complex semantics and syntax of programming languages, the formal methods for verifying the correctness of programs have the problems of low accuracy and low efficiency. In particular, the state change in address space caused by pointer operations makes it difficult to guarantee the verification accuracy of existing model checking methods. By combining model checking and sparse value-flow analysis, this paper designs a spatial flow model to effectively describe the state behavior of C code at the symbolic-variable level and address-space level and proposes a model checking algorithm of CounterExample-Guided Abstraction refinement and Sparse value-flow strong update (CEGAS), which enables points-to-sensitive formal verification for C code. This paper establishes a C-code benchmark containing a variety of pointer operations and conducts comparative experiments on the basis of this benchmark. These experiments indicate that in the task of analyzing multi-class C code features, the model checking algorithm CEGAS proposed in this paper can achieve outstanding results compared with the existing model checking tools. The verification accuracy of CEGAS is 92.9%, and the average verification time of each line of code is 2.58 ms, both of which are better than those of existing verification tools.

Autotuning Parallel Programs by Model Checking

The paper presents a new approach to autotuning data-parallel programs. Autotuning is a search for optimal program settings which maximize its performance. The novelty of the approach lies in the use of the model checking method to find the optimal tuning parameters by the method of counterexamples. In our work, we abstract from specific programs and specific processors by defining their representative abstract patterns. Our method of counterexamples implements the following four steps. At the first step, an execution model of an abstract program on an abstract processor is described in the language of a model checking tool. At the second step, in the language of the model checking tool, we formulate the optimality property that depends on the constructed model. At the third step, we find the optimal values of the tuning parameters by using a counterexample constructed during the verification of the optimality property. In the fourth step, we extract the information about the tuning parameters from the counter-example for the optimal parameters. We apply this approach to autotuning parallel programs written in OpenCL, a popular modern language that extends the C language for programming both standard multi-core processors (CPUs) and massively parallel graphics processing units (GPUs). As a verification tool, we use the SPIN verifier and its model representation language Promela, whose formal semantics is good for modelling the execution of parallel programs on processors with different architectures.

An Applying Colored Petri Net for Computerized Accounting System and Ledger Accounts Instruction

Many learners who are not familiar with the accounting terms find blended learning very complex to understand with respect to the computerized accounting system, the journal entries process, and tracing the accounting transaction flows of accounting system. A simulation-based model is a viable option to help instructors and learners make understanding the accounting system components and monitoring the accounting transactions easier. This paper proposes a colored Petri net (CPN)-based model for the instruction of an accounting system focused on the journal entries processes, accounting modules, and accounting transaction flows. The CPN-based language and the model checking tool named CPN are used to represent the accounting system components: a chart of accounts, an account mapping profile, the journal and ledgers system, and the financial report creations. We evaluated the designed CPN models by creating the simulation cases from ground truth data of the retail department store system and the mortgage loan system, using the decision-table-based testing technique. The results show that the designed CPN model and provided simulation cases help the learners to animate, verify, trace back accounting transactions and data flows, and increase the learner’s understanding.

Automated repair for timed systems

We present algorithms and techniques for the repair of timed system models, given as networks of timed automata (NTA). The repair is based on an analysis of timed diagnostic traces (TDTs) that are computed by real-time model checking tools, such as UPPAAL, when they detect the violation of a timed safety property. We present an encoding of TDTs in linear real arithmetic and use the MaxSMT capabilities of the SMT solver Z3 to suggest a minimal number of possible syntactic repairs of the analyzed model. The suggested repairs include modified values for clock bounds in location invariants and transition guards, adding or removing clock resets, etc. We then present an admissibility criterion, called functional equivalence, which ensures that the proposed repair preserves the functional behavior of the considered NTA. We discuss a proof-of-concept tool called TarTar that we have developed, implementing the repair and admissibility analysis, and give insights into its design and architecture. We evaluate the proposed repair technique on faulty mutations generated from a diverse suite of case studies taken from the literature. We show that TarTar can admissibly repair for 69–88% of the seeded errors in the considered system models.

Inverse Gaussian processes with correlated random effects for multivariate degradation modeling

Many engineering products have more than one failure mode and the evolution of each mode can be monitored by measuring a performance characteristic (PC). It is found that the underlying multi-dimensional degradation often occurs with inherent process stochasticity and heterogeneity across units, as well as dependency among PCs. To accommodate these features, in this paper, we propose a novel multivariate degradation model based on the inverse Gaussian process. The model incorporates random effects that are subject to a multivariate normal distribution to capture both the unit-wise variability and the PC-wise dependence. Built upon this structure, we obtain some mathematically tractable properties such as the joint and conditional distribution functions, which subsequently facilitate the future degradation prediction and lifetime estimation. An expectation-maximization algorithm is developed to infer the model parameters along with the validation tools for model checking. In addition, two simulation studies are performed to assess the performance of the inference method and to evaluate the effect of model misspecification. Finally, the application of the proposed methodology is demonstrated by two illustrative examples.

The semantics of shared memory in Intel CPU/FPGA systems

Heterogeneous CPU/FPGA devices, in which a CPU and an FPGA can execute together while sharing memory, are becoming popular in several computing sectors. In this paper, we study the shared-memory semantics of these devices, with a view to providing a firm foundation for reasoning about the programs that run on them. Our focus is on Intel platforms that combine an Intel FPGA with a multicore Xeon CPU. We describe the weak-memory behaviours that are allowed (and observable) on these devices when CPU threads and an FPGA thread access common memory locations in a fine-grained manner through multiple channels. Some of these behaviours are familiar from well-studied CPU and GPU concurrency; others are weaker still. We encode these behaviours in two formal memory models: one operational, one axiomatic. We develop executable implementations of both models, using the CBMC bounded model-checking tool for our operational model and the Alloy modelling language for our axiomatic model. Using these, we cross-check our models against each other via a translator that converts Alloy-generated executions into queries for the CBMC model. We also validate our models against actual hardware by translating 583 Alloy-generated executions into litmus tests that we run on CPU/FPGA devices; when doing this, we avoid the prohibitive cost of synthesising a hardware design per litmus test by creating our own 'litmus-test processor' in hardware. We expect that our models will be useful for low-level programmers, compiler writers, and designers of analysis tools. Indeed, as a demonstration of the utility of our work, we use our operational model to reason about a producer/consumer buffer implemented across the CPU and the FPGA. When the buffer uses insufficient synchronisation -- a situation that our model is able to detect -- we observe that its performance improves at the cost of occasional data corruption.

Proving properties of autonomous car manoeuvres in urban traffic

Abstract As automated driving techniques are increasingly capturing the market, it is particularly important to consider vital functional properties of these systems. We present an overview of an approach that uses an abstract model to logically reason about properties of autonomous manoeuvres at intersections in urban traffic. The approach introduces automotive-controlling timed automata crossing controllers that use the traffic logic UMLSL (Urban Multi-lane Spatial Logic) to reason about traffic situations. Safety in the context of collision freedom is mathematically proven. Liveness (something good finally happens) and fairness (no queue-jumping) are examined and verified using a model-checking tool for timed automata, UPPAAL.

A Noninterference Model for Mobile OS Information Flow Control and Its Policy Verification

Mobile operating systems such as Android are facing serious security risk. First, they have a large number of users and store a large number of users’ private data, which have become major targets of network attack; second, their openness leads to high security risks; third, their coarse-grained static permission control mechanism leads to a large number of privacy leaks. Recent decentralized information flow control (DIFC) operating systems such as Asbestos, HiStar, and Flume dynamically adjust the label of each process. Asbestos contains inherent covert channels due to this implicit label adjustment. The others close these covert channels through the use of explicit label change, but this impedes communication and increases performance overhead. We present an enhanced implicit label change model (EILCM) for mobile operating systems that can close the known covert channel in these models with implicit label change and supports dynamic constraints on tags for separation of duty. We also formally analyze the reasons why EILCM can close the known covert channels and prove that abstract EILCM systems have the security property of noninterference with declassification by virtue of the model checker tool FDR. We also prove that the problem of EILCM policy verification is NP-complete and propose a backtrack-based search algorithm to solve the problem. Experiments are presented to show that the algorithm is effective.

Efficient data validation for geographical interlocking systems

In this paper, an efficient approach to data validation ofdistributed geographical interlocking systems (IXLs) is presented.In the distributed IXL paradigm, track elements are controlled bylocal computers communicating with other control components overlocal and wide area networks. The overall control logic isdistributed over these track-side computers and remote servercomputers that may even reside in one or more cloud server farms.Redundancy is introduced to ensure fail-safe behaviour,fault-tolerance, and to increase the availability of the overallsystem. To cope with the configuration-related complexity of suchdistributed IXLs, the software is designed according to the digitaltwin paradigm: physical track elements are associated with softwareobjects implementing supervision and control for the element. Theobjects communicate with each other and with high-level IXL controlcomponents in the cloud over logical channels realised bydistributed communication mechanisms. The objective of this articleis to explain how configuration rules for this type of IXLs can bespecified by temporal logic formulae interpreted on Kripke Structurerepresentations of the IXL configuration. Violations ofconfiguration rules can be specified using formulae from awell-defined subset of LTL. By decomposing the completeconfiguration model into sub-models corresponding to routesthrough the model, the LTL model checking problem can be transformedinto a CTL checking problem for which highly efficient algorithmsexist. Specialised rule violation queries that are hard to expressin LTL can be simplified and checked faster by performing sub-modeltransformations adding auxiliary variables to the states of theunderlying Kripke Structures. Further performance enhancements areachieved by checking each sub-model concurrently. The approachpresented here has been implemented in a model checking tool whichis applied by Siemens Mobility for data validation of geographicalIXLs.

Study of the efficiency of model checking techniques using results of the MCC from 2015 To 2019

In various scientific communities dealing with formal analysis, software competitions have emerged and contributed to fostering progress in state of the art and providing insight into the evolution of the involved technologies. The model checking contest (MCC) is one of them; it focuses on asynchronous concurrent systems. This paper reports what the organizers have observed over five editions of the MCC between 2015 and 2019. It shows the evolution of state-of-the-art model checking tools in performing large and difficult verification tasks by improving existing techniques or designing new and innovative (combinations of) techniques. This paper also shows the impact of such an event on the corresponding scientific community.

A formal approach for Docker container deployment

AbstractContainer‐based virtualization is becoming increasingly popular in the cloud industry, as it provides services to the client as per their requirements. Requirements of the user can be described in a configuration file. Cloud provider offers the services to the client using “pay‐as‐you go” model. Docker provides support to a cloud provider for the creation of a container, deployment of the container, and monitoring of services running inside a container on the host and guest system both. The creation and deployment of the container by Docker efficiently is a big challenge. In this paper, we capture the behavior of the container life cycle through process algebra (CCS) and properties of it as a formula using ‐calculus. Further we capture the behavior of deployment of the container on the host machine through CCS and its properties through the model ‐ calculus. We used model checking tool Concurrency Workbench of the New Century to verify the creation of the Docker container as well as deployment of it.

Real-time prequential goodness-of-fit testing of life distributions in renewal processes

The paper presents an omnibus goodness-of-fit (Gof) test for renewal processes based on Dawid’s prequential framework. This test compares models on the basis of their predictive abilities. It uses usual Edf statistics (KS, AD or CvM) of a prequential empirical process which, under standard regulatory conditions, is proven to converge to the Brownian bridge as in the case of known parameters. This result gives an asymptotically distribution free and computationally-simple Gof test. It can be used as a model-checking tool particularly adapted to sequential (or real-time) analysis of reliability or medical lifetimes data modelled by renewal processes. The prequential Gof test still probably valid for more complex models beyond the renewal framework.