Model Checking Tools Research Articles

Program Dependence Net and on-demand slicing for property verification of concurrent system and software

When checking concurrent software using a finite-state model, we face a formidable state explosion problem. One solution to this problem is dependence-based program slicing, whose use can effectively reduce verification time. It is orthogonal to other model-checking reduction techniques. However, when slicing concurrent programs for model checking, there are conversions between multiple irreplaceable models, and dependencies need to be found for variables irrelevant to the verified property, which results in redundant computation. To resolve this issue, we propose a Program Dependence Net (PDNet) based on Petri net theory. It is a unified model that combines a control-flow structure with dependencies to avoid conversions. For reduction, we present a PDNet slicing method to capture the relevant variables’ dependencies when needed. PDNet and its on-demand slicing in verifying linear temporal logic are used to significantly reduce computation cost. We implement a model-checking tool based on PDNet and its on-demand slicing and validate the advantages of our proposed methods.

SPIN-Based Linear Temporal Logic Path Planning for Ground Vehicle Missions with Motion Constraints on Digital Elevation Models.

Linear temporal logic (LTL) formalism can ensure the correctness of mobile robot planning through concise, readable, and verifiable mission specifications. For uneven terrain, planning must consider motion constraints related to asymmetric slope traversability and maneuverability. However, even though model checker tools like the open-source Simple Promela Interpreter (SPIN) include search optimization techniques to address the state explosion problem, defining a global LTL property that encompasses both mission specifications and motion constraints on digital elevation models (DEMs) can lead to complex models and high computation times. In this article, we propose a system model that incorporates a set of uncrewed ground vehicle (UGV) motion constraints, allowing these constraints to be omitted from LTL model checking. This model is used in the LTL synthesizer for path planning, where an LTL property describes only the mission specification. Furthermore, we present a specific parameterization for path planning synthesis using a SPIN. We also offer two SPIN-efficient general LTL formulas for representative UGV missions to reach a DEM partition set, with a specified or unspecified order, respectively. Validation experiments performed on synthetic and real-world DEMs demonstrate the feasibility of the framework for complex mission specifications on DEMs, achieving a significant reduction in computation cost compared to a baseline approach that includes a global LTL property, even when applying appropriate search optimization techniques on both path planners.

Software Model Checking Distributed Applications: A Hybrid Approach

Developing reliable distributed systems poses many challenges such as concurrency, failure handling, and scalability. It is due to the non-deterministic execution of threads within processes, and communication means. Formal verification methods, such as model checking, have been used to ensure the reliability of safety-critical systems. This technique systematically explores the complete behavior of the system under test (SUT), investigating each reachable state with different thread schedules. Recent software model-checking tools, employing cache and centralization, have been applied to distributed systems. The caching technique can only check one process at a time, while the centralization technique verifies all processes simultaneously. In the centralization technique, two "ArrayByteQueue" buffers are utilized to store communication and process data byte-by-byte. However, during the backtracking process, the read and write operations, involving data insertion and removal from the queue, become resource-intensive. As a consequence, existing interprocess communication (IPC) models encounter computational limitations and experience a rapid state space explosion. To address these challenges, our work proposes the remodeling of IPC models by introducing a request and response tree structure to store communication data. Additionally, we employ pointers to navigate through the data during the backtracking process. Through experimental evaluations, the proposed implementation choices have demonstrated significantly improved performance across various metrics. By incorporating the request and response tree, we enhance the efficiency of storing communication data, while the use of pointers optimizes navigation during backtracking. This remodeling of IPC models shows promise in mitigating computational limitations and state space explosion, thereby enhancing the model-checking process in distributed systems. Our research contributes to advancing the field of model checking in distributed systems and offers potential solutions to the challenges associated with resource-intensive read and write operations during the model-checking process.

Backward Responsibility in Transition Systems Using General Power Indices

To improve reliability and the understanding of AI systems, there is increasing interest in the use of formal methods, e.g. model checking. Model checking tools produce a counterexample when a model does not satisfy a property. Understanding these counterexamples is critical for efficient debugging, as it allows the developer to focus on the parts of the program that caused the issue. To this end, we present a new technique that ascribes a responsibility value to each state in a transition system that does not satisfy a given safety property. The value is higher if the non-deterministic choices in a state have more power to change the outcome, given the behaviour observed in the counterexample. For this, we employ a concept from cooperative game theory – namely general power indices, such as the Shapley value – to compute the responsibility of the states. We present an optimistic and pessimistic version of responsibility that differ in how they treat the states that do not lie on the counterexample. We give a characterisation of optimistic responsibility that leads to an efficient algorithm for it and show computational hardness of the pessimistic version. We also present a tool to compute responsibility and show how a stochastic algorithm can be used to approximate responsibility in larger models. These methods can be deployed in the design phase, at runtime and at inspection time to gain insights on causal relations within the behavior of AI systems.

Lazy model checking for recursive state machines

Recursive state machines (RSMs) are state-based models for procedural programs with wide-ranging applications in program verification and interprocedural analysis. Model-checking algorithms for RSMs and related formalisms have been intensively studied in the literature. In this article, we devise a new model-checking algorithm for RSMs and requirements in computation tree logic (CTL) that exploits the compositional structure of RSMs by ternary model checking in combination with a lazy evaluation scheme. Specifically, a procedural component is only analyzed in those cases in which it might influence the satisfaction of the CTL requirement. We implemented our model-checking algorithms and evaluate them on randomized scalability benchmarks and on an interprocedural data-flow analysis of Java programs, showing both practical applicability and significant speedups in comparison to state-of-the-art model-checking tools for procedural programs.

Соревнования по формальной верификации VeHa-2023: опыт проведения

To create modern competitive and trusted software, it is necessary to use knowledge of formal methods. Currently, a huge number of students are studying specialties related to programming. However, when studying at a university, it is difficult to gain the skill of practical application of theoretical knowledge. Short competitions with non-standard, industrial-related problems can arouse students' interest in the field of formal methods. The article describes the first experience of organizing a competition in formal verification of programs among students of Russian universities. The competition was held in conjunction with a seminar on program semantics, specification and verification (PSSV) in Innopolis in November 2023. The format of the competition was close to the format of so-called hackathons. Participants were asked to solve verification problems using predefined model checking and deductive verification tools. We consider the issues of organizing such an event, proposed tasks, results of decisions and feedback from participants.

LTL-specification for development and verification of control programs

This work continues the series of articles on development and verification of control programs based on the LTL-specification. The essence of the approach is to describe the behavior of programs using formulas of linear temporal logic LTL of a special form. The developed LTL-specification can be directly verified by using a model checking tool. Next, according to the LTL-specification, the program code in the imperative programming language is unambiguously built. The translation of the specification into the program is carried out using a template. The novelty of the work consists in the proposal of two LTL-specifications of a new form — declarative and imperative, as well as in a more strict formal justification for this approach to program development and verification. A transition has been made to a more modern verification tool for finite and infinite systems — nuXmv. It is proposed to describe the behavior of control programs in a declarative style. For this purpose, a declarative LTL-specification is intended, which defines a labelled transition system as a formal model of program behavior. This method of describing behavior is quite expressive — the theorem on the Turing completeness of the declarative LTL-specification is proved. Next, to construct program code in an imperative language, the declarative LTL-specification is converted into an equivalent imperative LTL-specification. An equivalence theorem is proved, which guarantees that both specifications specify the same behavior. The imperative LTL-specification is translated into imperative program code according to the presented template. The declarative LTL-specification, which is subject to verification, and the control program built on it are guaranteed to specify the same behavior in the form of a corresponding transition system. Thus, during verification, a model is used that is adequate to the real behavior of the control program.

Systematic Trojan Detection in Crypto-Systems Using the Model Checker

Formal methods have been introduced as the efficient approach for Trojan detection using the model checking approach. However, systematic property generation for detecting a wide range of Trojans is the main challenge in these methods. In other words, the efficient property generation to pinpoint projected Trojan precisely in targeted hardware has been a bottleneck in this approach. This paper evaluated the feasibility of the systematic property generation methodology for Trojan detection in Cryptosystems by analyzing the vulnerable points of an implemented design respecting Trojans’ covered class. The vulnerability analysis reduces the search space of formal methods and considerably improves the scalability of these methods. We have shown in this research that these properties can be generated systematically and prove that the generated properties can be used in conventional model-checking tools to find hard-to-detect Trojans efficiently. Experimental results show that the proposed method reduces Trojan detection time considerably. Also, the memory required to evaluate circuits is possible for several hundreds of clock cycles.

The use of IoT-based wearable devices to ensure secure lightweight payments in FinTech applications

Daily digital payments in Financial Technology (FinTech) are growing exponentially. A huge demand is for developing secure, lightweight cryptography protocols for wearable IoT-based devices. The devices hold the consumer information and transit functions in a secure environment to provide authentication and confidentiality using contactless Near-Field Communication (NFC) or Bluetooth technologies. On the other hand, Security breaches have been observed in various dimensions, especially in wearable payment technologies. In this paper, we developed a threat model in the proposed framework and how to mitigate these attacks. This study accepts the three-authentication factor, as biometrics is one of the user’s most vital authentication mechanisms. The scheme uses an “Elliptic Curve Integrated Encryption Scheme (ECIES)”, “Elliptic Curve Digital Signature Algorithm (ECDSA)” and “Advanced Encryption Standard (AES)” to encrypt the messages between the entities to ensure higher security. The security analysis of the proposed scheme is demonstrated through the Real-or-Random oracle model (RoR) and Scyther’s widely accepted model-checking tools. Finally, we present a comparative summary based on security features, communication cost, and computation overhead of existing methods, specifying that the proposed framework is secure and efficient for all kinds of remote and proximity payments, such as mini, macro, and micro-payments, using wearable devices.

Formal Verification of a Change Control Process in Project Management

Compliance of processes in enterprises to internal policies and external regulations could be critical because failing to follow them could result in great losses, but manual compliance auditing is difficult and prone to errors and oversight. In this paper, we present a method for formally verifying the properties of Integrated Change Control processes using temporal logic. We express the process in terms of states, and then we formulate some of its key properties, such as prerequisites, reachability, definiteness, and cycles, using a temporal logic called Computation Tree Logic. The properties to verify in the case study we present are taken from actual change control process auditing practice in a large business in the food industry. We formally verify those properties using a model-checking tool. We end up with a formally verified Integrated Change Control process and more robust assurance of its correctness than can be reached for its informal counterpart. To the best of our knowledge, this has not been done before.

Learning-Based Testing Using SAL (Symbolic Analysis Laboratory) Model Checker

This paper studies learning-based testing (LBT) for reactive systems with different learning algorithms and model checkers. LBT is a technique that requires a learning algorithm to learn the models to generate test cases automatically. We have used the generic methodology of LBT to test reactive systems with two different model inference algorithms (i.e., IKL, DKL) and two different model checking tools (i.e., NuSMV, SAL). To investigate the feasibility of LBT, we integrated our SUTs with these algorithms in LBT and tested if LBT optimizes test generation with these algorithms. We tested our SUTs with Boolean data types to check the difference in the working of model inference and model checking algorithms which we analyzed experimentally. The results show that LBT works better with DKL and SAL. DKL is a recently proposed model inference algorithm, and SAL is the latest model checker on which the research is being carried out. DKL and SAL algorithms explore errors in reactive SUTs with the h LBT framework more quickly and efficiently.

Compliance Checking of Cloud Providers: Design and Implementation

The recognition of capabilities supplied by cloud systems is presently growing. Collecting or sharing healthcare data and sensitive information especially during the Covid-19 pandemic has motivated organizations and enterprises to leverage the upsides coming from cloud-based applications. However, the privacy of electronic data in such applications remains a significant challenge for cloud vendors to adapt their solutions with existing privacy legislation standards such as general data protection regulation (GDPR). This article first proposes a formal model and verification for data usage requests of providers in a cloud composite service using a model checking tool. A cloud pharmacy scenario is presented to illustrate the connectivity of providers in the composite service and the stream of their requests for both collection and movement of patient data. A set of verifications is then undertaken over the pharmacy service in accordance with three significant GDPR obligations, namely user consent, data access, and data transfer. Following that, the article designs and implements a cloud container virtualization based on the verified formal model realizing GDPR requirements. The container makes use of some enforcement smart contracts to only proceed with the providers’ requests that are compliant with GDPR. Finally, several experiments are provided to investigate the performance of our approach in terms of time, memory, and cost.

MFF-IoT: A Multi-Granularity Formal Framework of User Authentication for IoT

The Internet of Things (IoT) generates vast amounts of data from numerous applications. However, since wireless channels are the primary means of communication, IoT networks are vulnerable to several security threats, which can compromise their security and privacy. To address these issues, various user authentication protocols have been proposed. Thus, it is still a challenge to provide multi-granularity verifications for different authentications of the IoT. In this paper, we propose a multi-granularity formal framework of user authentication for the IoT (MFF-IoT). Our framework builds different formal models (specification language HLPSL models, process algebra CSP models, Timed CSP models, and timed automata) to complete multi-granularity formal verification. By using both coarse-grained and fine-grained modeling, we can balance the tradeoff between model complexity and verification accuracy. Specifically, our fine-grained models provide a more detailed representation of the framework’s behavior and enable us to perform timing-related probability analysis. As these formal models can be implemented by model-checking tools (AVISPA, PAT with C#, and UPPAAL), important properties and features can be analyzed and verified. We also propose several algorithms for better formal model building and evaluate our framework with a case study to show its practicality and effectiveness.

Modelling and Analysis of a Sigfox-Based IoT Network Using uppaalsmc

Wireless sensor nodes are usually powered by batteries that have limited energy capacity. In many applications, the nodes are installed in inaccessible locations where they are problematic to replace or recharge. Therefore, energy optimisation is crucial for increasing the node’s lifetime. This study presents a method for the analysis and prediction of the energy consumption of Sigfox-based Wireless Sensor Nodes. The method is illustrated in a use case where the nodes monitor the water level in drainage lines in cities to improve surface and wastewater management. We propose a formal model-based technique using the UPPAAL Statistical model checker tool to model and analyse the node’s lifetime. Statistical model checking provides a highly scalable technique for performance analysis of complex cyber-physical systems. The model captures the energy-related behaviour of the node, the Sigfox radio specification, and the sensor, each parameterised with values from the device’s datasheets. Furthermore, we calibrate the model using measurements obtained from real-world hardware. Finally, we evaluate a collection of strategies to optimise the battery lifetime of the node. We simulate the model with a 10,000 mAh battery, and the results indicate that we can extend the node’s lifetime from 202 days to 2.71 years using our most optimised transmission strategy.

Session-based concurrency in Maude: Executable semantics and type checking

Session types are a well-established approach to communication correctness in message-passing processes. Widely studied from a process calculi perspective, here we pursue an unexplored strand and investigate the use of the Maude system for implementing session-typed process languages and reasoning about session-typed process specifications.We present four technical contributions. First, we develop and implement in Maude an executable specification of the operational semantics of a session-typed π-calculus by Vasconcelos. Second, we also develop an executable specification of its associated algorithmic type checking, and describe how both specifications can be integrated. Third, we show that our executable specification can be coupled with reachability and model checking tools in Maude to detect well-typed but deadlocked processes. Finally, we demonstrate the robustness of our approach by adapting it to a higher-order session π-calculus, in which exchanged values include names but also abstractions (functions from names to processes).All in all, our contributions define a promising new approach to the (semi)automated analysis of communication correctness in message-passing concurrency.

Fresh Approaches for Structured Text Programmable Logic Controllers Programs Verification

Programmable logic controllers (PLCs) are everywhere today and perform critical tasks in industries. They are considered as a key component for the Industry 4.0. Before they are put into operation, it is necessary to check the accuracy of the PLC programs. This verification operation can be performed using model checkers. This stage is often long and costly and requires a domain expert who can understand the system, as well as the different model checker tools able to verify the code implemented in the controller. Furthermore, this verification often requires a conversion of the PLC code into a language understood by a model checker which can influence the behavior of the observed PLC. Hence, there is a need to propose methods and tools which could be used by technicians and engineers. The aim of this paper is to propose methods that require little work to set up and are robust to program sizes used in Industry 4.0. This paper explores some fresh ideas for human-adapted PLC code verification. We present different methods to test codes in structured text (ST) compliant with the IEC 61131-3 standard. Hence, the first idea is to test the ST code that will be directly implemented on a controller. For that, we propose a method using the model checker UPPAAL which allows us to obtain exact results on short codes. Second, we propose verifying the generic properties that a PLC program must avoid: deadlocks, non-accessible states and fugitive states or actions. To solve combinatory explosion problems encountered with the UPPAAL software, the third proposition consists of using relational databases. The same verification as previously followed can be obtained, but the search time is longer. The fourth and last proposal is to process the ST code with a neural network composed of long short-term memory layers (LSTM) to quickly determine the validity of the code. This method could give an approximation of code errors in a few seconds. The different proposed methods are supported with several examples.

Safety Verification of Multiple Industrial Robot Manipulators with Path Conflicts Using Model Checking

Software development for robotic systems is traditionally performed based on simulations, manual code implementation, and testing. However, this software development approach can cause safety issues in some scenarios, including multiple robots sharing a workspace. When different robots are executing individual planned tasks, they may collide when not adequately coordinated. Safety problems related to coordination between robots may not be encountered during testing, depending on timing, but may occur during the system’s operation. In this case, formal verification methods can provide a more reliable means to ensure the safety of robotic systems. This paper uses the formal method of model checking for the safety verification of multiple industrial robot manipulators with path conflicts. We give comparative results of two model-checking tools applied to a system with two robot manipulators. Whole workflows, from requirement specification to testing, are presented.

Formalization and verification of Kafka messaging mechanism using CSP

Apache Kafka is an open source distributed messaging system based on the publish-subscribe model, which achieves low latency, high throughput and good load balancing. As a popular messaging system, the transmission of messages between applications is one of the core functions of Kafka. Therefore, the reliability and security of data in the process of message transmission in Kafka have become the focus of attention. The formal methods can analyze whether a model is highly credible. Therefore, it is significant to analyze Kafka messaging mechanism which describes the communication process and rules between each module entity in Kafka from the perspective of formal methods. In this paper, we apply the process algebra CSP (Communicating Sequential Processes) and the model checking tool PAT (Process Analysis Toolkit) to analyze Kafka messaging mechanism. The results of verification show that the model caters for its specification and guarantees the reliability of messages in the normal communication process. Moreover, in order to further analyze the security of Kafka messaging mechanism, we add the intruder model and the authentication protocol Kerberos model and compare the verification results of Kafka messaging mechanism with or without the secure protocol Kerberos. The results show that the Kerberos protocol has improved the security of Kafka messaging mechanism in some aspects, but there are still some security loopholes.

Towards formal verification of smart grids: An effective modelling approach and some first experimentation

Nowadays, smart grids are used widely around the world when they enable detecting, reacting and pro-acting to changes in usage and many concerns with the power system, as well as having self-healing capabilities. Some smart grids have recently been created and operational in Vietnam. To ensure the effectiveness of the smart grids, the correctness of the system designs must be studied carefully before the explosion of the use of smart grids, particularly in developing countries such as Vietnam. As formal methods, including formal verification and model checking, recently play more important role in verifying smart grid properties such as load balancing and fault resilience, the effectiveness of formal verification depends mostly on system modeling and verification techniques. Recent researches have shown the feasibility of applying model-checking tools in smart grid verification, and also the inability to test complex properties and systems. In our opinion, the inability could be come from the complicating of the models of the system-under-test. In this study, we suggested a new method for representing smart grids using Colored Petri Net (CPN), a formal representa- tion language. In comparing to the current modeling approach, the new model allows engineers transforms complex grids into simple models. Moreover, based on the advantages of the “color” aspect of the CPN, the result model can be easily upgraded to adapt to the changes of the original smart grids without re- modeling. Also in this study, a basic case study for representing a smart grid, which consists of multiple power sources and multiple consumers, will be shown. The model will be configured to capture some problems that may happen in the grid such as the changing of the capacity of the power sources. The verification experimentation conducted on the case study shows the usefulness of the proposed method.

FTS4VMC: A front-end tool for static analysis and family-based model checking of FTSs with VMC

FTS4VMC is a publicly available front-end tool for the static analysis and family-based model checking of a Featured Transition System (FTS). It can detect ambiguities in an FTS, disambiguate an ambiguous FTS, transform an FTS into a Modal Transition System (MTS), and interact with the VMC model checker for family-based verification. • FTS4VMC is a front-end tool with a user-friendly GUI for static analysis and family-based model checking of Featured Transition Systems (FTSs). • FTS4VMC expands the possible use cases of VMC to include also FTSs. • FTS4VMC is publicly available, well documented and easy to install and run.