UPPAAL Research Articles

Formal timing analysis of gate-level digital circuits using model checking

Due to the continuous reduction in the transistors sizing ruled by the Moore’s law, digital devices have become smaller, and more complex resulting in an enormous rise in the delay variations. Therefore, there is a dire need of precise and rigorous timing analysis to overcome anomalies during the timing analysis. Timings of digital circuits can be verified using various simulation or static timing analysis (STA) based tools but they provide estimated results due to their inherent in-exhaustive nature or report timing paths corresponding to non-existent functional paths, respectively. Formal verification provides complete and sound analysis results and has widely been used for the functional verification of digital circuits but its application in the timing analysis domain is somewhat limited. We present a generic framework to perform formal timing analysis of digital circuits with the help of Uppaal model-checker. The given digital circuit along with its timing parameters in the form of state transition diagram are modeled using timed automata in the Uppaal model checker. Timing delays are calculated from corresponding technology parameters, and Quartus Prime Pro is used to obtain the information about the circuits’ paths. In order to make the analysis scalable, we also propose a novel path partitioning technique and compare its results with complete path analysis and traditional STA. The formal model is verified with the help of properties to assess the timing characteristics, like time period of a clock, critical path, and propagation delay of the considered circuit. Modeling and verification of ISCAS-85 and ISCAS-89 benchmark circuits is presented for illustration purposes.

Synthesis and Verification of Mission Plans for Multiple Autonomous Agents under Complex Road Conditions

Mission planning for multi-agent autonomous systems aims to generate feasible and optimal mission plans that satisfy given requirements. In this article, we propose a tool-supported mission-planning methodology that combines (i) a path-planning algorithm for synthesizing path plans that are safe in environments with complex road conditions, and (ii) a task-scheduling method for synthesizing task plans that schedule the tasks in the right and fastest order, taking into account the planned paths. The task-scheduling method is based on model checking, which provides means of automatically generating task execution orders that satisfy the requirements and ensure the correctness and efficiency of the plans by construction. We implement our approach in a tool named MALTA, which offers a user-friendly GUI for configuring mission requirements, a module for path planning, an integration with the model checker UPPAAL, and functions for automatic generation of formal models, and parsing of the execution traces of models. Experiments with the tool demonstrate its applicability and performance in various configurations of an industrial case study of an autonomous quarry. We also show the adaptability of our tool by employing it in a special case of an industrial case study.

Formal modelling and verification of autonomous reasoning based flight simulation system

The emerging trends towards intelligent computing have drastically changed the human lifestyle in every facet of their lives. Due to the swift escalation of smart systems and emerging technologies, human life has become much more dependent and even more addicted to fulfilling their desire using smart and tiny resource-bounded gadgets. This revolution has evolved towards autonomous decision support systems. Autonomous decision support systems have the ability to acquire information autonomously, reason the information, and adapt behavior accordingly. As these systems are deployed in a highly decentralized environment and exhibit complex adaptive behavior, however, the inconsistent nature of information may raise different challenging issues. This paper presents a multi-agent environmentally-aware framework for modeling and reasoning flight management systems. This system has a sound reasoning mechanism to execute and monitor flight control activities while considering liveness and safety-critical constraints. We use the UPPAAL model checker to formally analyze the system’s behavior and verify correctness properties.

An Enhanced Mechanism for Fault Tolerance in Agricultural Wireless Sensor Networks

Fault tolerance is a critical aspect for any wireless sensor network (WSN), which can be defined in plain terms as the quality of being dependable or performing consistently well. In other words, it may be described as the effectiveness of fault tolerance in the event of crucial component failures in the network. As a WSN is composed of sensors with constrained energy resources, network disconnections and faults may occur because of a power failure or exhaustion of the battery. When such a network is used for precision agriculture, which needs periodic and timely readings from the agricultural field, necessary measures are needed to handle the effects of such faults in the network. As climate change is affecting many parts of the globe, WSN-based precision agriculture could provide timely and early warnings to the farmers about unpredictable weather events and they could take the necessary measures to save their crops or to lessen the potential damage. Considering this as a critical application area, in this paper, we propose a fault-tolerant scheme for WSNs deployed for precision agriculture. Along with the description of our mechanism, we provide a theoretical operational model, simulation, analysis, and a formal verification using the UPPAAL model checker.

A context-aware multi-agent reasoning based intelligent assistive formalism

In recent years, the rapid proliferation of intelligent smart resource-bounded devices and autonomous software technologies has significantly influenced human life and made human life much smarter, more efficient, flexible, comfortable, and secure but device dependent. These intelligent devices are equipped with the feature of context awareness that often run in a highly decentralized environment with minimal and/or without human intervention. As these systems are often distributed in nature, they exhibit complex adaptive behavior by exchanging contextualized information among different resource-bounded devices and/or systems. However, due to the limitation of resources (computational memory), there are still many challenges for a real-time deployment. In this paper, we present a resource-bounded multi-agent reasoning-based context-aware model that assists users intelligently to take the right action autonomously whenever and wherever needed. The core emphasis is given to the lightweight, efficient reasoning mechanism to manipulate rapidly triggering contextual information with the least utilization of computational resources. We develop algorithms along with the complexity factors to evaluate the system’s efficacy in computational time and memory utilization. To suitably formalize the specification and model the proposed formalism using UPPAAL model checker, we develop the case study of a context-aware intelligent assistant along with its rule-based reasoning strategies and priorities for the execution of prioritized tasks according to the customized needs of the user and verify the correctness properties.

Formal Analysis of Distributed Shared Memory Algorithms

The memory coherence problem occurs while mapping shared virtual memory in a loosely coupled multiprocesses setup. Memory is considered coherent if a read operation provides the same data written in the last write operation. The problem has been addressed in the literature using different algorithms, although the correctness of a distributed algorithm remains questionable. Formal verification is the principal term for a group of techniques that routinely use an analysis established on mathematical transformations to conclude the rightness of the hardware or software behavior in divergence to dynamic verification techniques. The current study employed UPPAAL model checker to model the Dynamic Distributed algorithm for shared virtual memory given by K. Li and P. Hudak. The results showed that the Dynamic Distributed algorithm for shared virtual memory partially fulfils its functional requirements.

Formal Modelling and Verification of the Clock Synchronization Algorithm of FlexRay


 
 
 
 The hundreds of electronic control devices used in an automotive system can effectively communicate with one another, thanks to an in-vehicle network (IVN) like FlexRay. Even though every node in the network will be running on its local clock, a global notion of time is essential. The clock synchronisation algorithm accomplishes this global time between the nodes in FlexRay. In this era of self-driving cars, the vehicle’s safety is paramount. For the vehicle to operate safely and smoothly, timely communication of information is critical, and the clock synchronisation algorithm plays a vital role in this. It is essential to formally test the clock synchronisation algorithm’s correctness. This paper attempts to model and verify the clock synchronisation algorithm of FlexRay using formal methods, which in turn enhance the reliability of safety-critical automotive systems. The clock synchronisation is modelled as a network of six timed automata in the UPPAAL model checker. Three system models were developed, a model for an ideal clock, another for a drifting clock, and a third model considering propagation delay. The precision of the clocks is verified to be within the prescribed limits. Simulation studies are also conducted on the model to ensure that the clock’s drift is always within the precision.
 
 
 

Formal Verification of STPA with Model Checking

As technology advances, hardware-centric systems are rapidly moving towards software-centric ones, and their complexity is rapidly increasing. In particular, systems directly related to safety require thorough verification. Model checking exhaustively explores the state space of the abstracted system to check whether properties written in a logical formula are achieved. In this paper, the control algorithm of the controller is verified using model checking to discover risk scenarios during the STPA steps. Two case studies are conducted using the widely used model checkers NuSMV and UPPAAL. We then explain the empirical results and compare two model checkers based on their characteristics. Finally, we discuss the benefits of applying model checking in the process of STPA.

Fresh Approaches for Structured Text Programmable Logic Controllers Programs Verification

Programmable logic controllers (PLCs) are everywhere today and perform critical tasks in industries. They are considered as a key component for the Industry 4.0. Before they are put into operation, it is necessary to check the accuracy of the PLC programs. This verification operation can be performed using model checkers. This stage is often long and costly and requires a domain expert who can understand the system, as well as the different model checker tools able to verify the code implemented in the controller. Furthermore, this verification often requires a conversion of the PLC code into a language understood by a model checker which can influence the behavior of the observed PLC. Hence, there is a need to propose methods and tools which could be used by technicians and engineers. The aim of this paper is to propose methods that require little work to set up and are robust to program sizes used in Industry 4.0. This paper explores some fresh ideas for human-adapted PLC code verification. We present different methods to test codes in structured text (ST) compliant with the IEC 61131-3 standard. Hence, the first idea is to test the ST code that will be directly implemented on a controller. For that, we propose a method using the model checker UPPAAL which allows us to obtain exact results on short codes. Second, we propose verifying the generic properties that a PLC program must avoid: deadlocks, non-accessible states and fugitive states or actions. To solve combinatory explosion problems encountered with the UPPAAL software, the third proposition consists of using relational databases. The same verification as previously followed can be obtained, but the search time is longer. The fourth and last proposal is to process the ST code with a neural network composed of long short-term memory layers (LSTM) to quickly determine the validity of the code. This method could give an approximation of code errors in a few seconds. The different proposed methods are supported with several examples.

Bounded DBM-based clock state construction for timed automata in Uppaal

When the simulation of a system, or the verification of its model, needs to be resumed in an online context, we face the problem that a particular starting state needs to be reached or constructed, from which the process is then continued. For timed automata, especially the construction of a desired clock state, represented as a difference bound matrix (DBM), can be problematic, as only a limited set of DBM operations is available, which often does not include the ability to set DBM entries individually to the desired value. In online applications, we furthermore face strict timing requirements imposed on the generation process. In this paper, we present an approach to construct a target clock state in a model via sequences of DBM operations (as supported by the model checker Uppaal), for which we can guarantee bounded lengths, solving the present problem of ever-growing sequences over time. The approach forges new intermediate states and transitions based on an overapproximation of the target state, followed by a constraining phase, until the target state is reached. We prove that the construction sequence lengths are independent of the original trace lengths and are determined by the number of system clocks only, allowing for state construction in bounded time. Furthermore, we implement the (re-)construction routines and an extended Uppaal model simulator which provides the original operation sequences. Applying the approach to a test model suite as well as randomly generated DBM operation sequences, we empirically validate the theoretical result and the implementation.

Advanced Models for the OSPF Routing Protocol

We present two formal models for the OSPF routing protocol, designed for the model checker Uppaal. The first one is an optimised model of an existing model that allows to check larger network topologies. The second one is a specialised model for adjacency building, a complex subprocedure of OSPF, which is not part of any existing model and which is known to be vulnerable to cyber attacks. We illustrate how both models can be used to discover vulnerabilities in routing protocols.

Modeling and verifying NLSR protocol of NDN for CPS using UPPAAL

AbstractNamed Data Networking (NDN) is a new promising architecture of information‐centric networking, which supports multicast of data and adopts the publish/subscribe model in the network. The features of NDN, including name‐based data and in‐network caching, make it a promising Internet architecture for cyber‐physical systems (CPSs). Named‐Data Link State Routing (NLSR) protocol is the routing protocol for NDN, which is designed to disseminate link state advertisements (LSAs) to both build a network topology and distribute all the name prefixes to every node in the network. In this paper, we make the very first attempt to formally model and verify some fundamental properties of the NLSR protocol using model checker UPPAAL. We validate the NLSR protocol modeled into timed automata with simulator in UPPAAL. We verify our model with four fundamental properties (termination, reachability of Sync Interest, reachability of Sync Data, and digest synchronization). The first synchronization problem is found in a scenario with two nodes topology. We give the improved model that owns a valid result in digest synchronization verification. To capture more problems, we make the model to support the simulation of temporary network crash. The second synchronization problem is also exposed in two comparative scenarios. We also propose a mechanism implemented in our model, which has a valid result in digest synchronization verification. We hope that our study and preliminary results would help enhancing the adaptability and robustness of NLSR protocol.

Towards a reliable smart city through formal verification and network analysis

With the immense increase of population density, many challenges facing organizations and governments. Thus, it has become mandatory to turn up our cities to be intelligent by introducing IoT and smart grids to build smart buildings, smart communication technologies, smart healthcare systems, smart transportation, etc. Smart cities guarantee the healthy living of indoor inhabitants by sensing, processing and controlling all possible indoor–outdoor measures. In this paper, we develop a framework that systematically builds a reliable and secure Smart City Model (SCM) to be integrated then exploited by the building information model (BIM). SCM encloses both physical and digital models which highlight smart buildings in particular. First, the proposed solution identifies and models SCM components including their appropriate architectures that are responsible for communication, extension, information flow, and protection. To ensure SCM functional and security requirements, we develop a sound hybrid approach that relies on formal methods and network analysis. Uppaal model checker is used to verify the satisfiability of the smart city requirements whereas Cooja is deployed to simulate the connectivity and the communication coverage of the developed SCM. The obtained results, in Uppaal, showed that the different implemented scenarios are satisfying the functional correctness and security policies. Moreover, the simulation through Cooja showed that how different obstacles and positions of nodes affect the communication coverage and the energy consumption regarding the deployed nodes. Experimentally, the effectiveness of the developed framework has been shown through practical scenarios that are difficult to model and analyze.

Abstraction models for verifying resource adequacy of IMA systems at concept level

Complex cyber-physical systems can be difficult to analyze for resource adequacy (e.g., bandwidth and buffer size) at the concept development stage since relevant models are hard to create. During this period, details about the functions to be executed or the platforms in the architecture are partially unknown. This is especially true for Integrated Modular Avionics (IMA) systems, for which life-cycles span over several decades, with potential changes to functionality in the future. This work aims to identify abstractions for representing data exchanges among functions realized in networked IMA systems and investigates how these can be represented in formal models and analyzed with exact guarantees. Timed automata (TA) are a relevant choice for modeling since communication resource adequacy is directly related to potential network delays. We explore two alternatives in modeling with TA, a direct one representing every process using a TA template, and a more abstract one representing every computation device with a TA template. While the first approach represents process-to-process data exchanges, the modified approach reduces the state space by representing all processes currently allocated to a single computing element to obtain scalability gains. Both approaches are flexible since the templates presented can be instantiated to represent different types of network topologies and communication patterns. The instantiated TA models are used to illustrate an use case and analyzed with the UPPAAL model checker to verify that a given platform instance supports the desired system functions in terms of network bandwidth and buffer size adequacy, thereby messages reaching their final destination with freshness guarantees. Both abstraction levels are shown to be suitable for verifying the intended properties, but the more abstract one demonstrates a 67% improvement in verification time and a 66% reduction in state space during verification. The more abstract approach is also applied to a real-world example from an earlier publication, with a much larger state space and a more complex structure, to illustrate the ability to reuse the approach in multiple use cases. • A modular UPPAAL-based framework to model avionic application and platform elements. • A framework to analyze IMA systems timeliness and resource adequacy at an early stage. • Alternative abstractions for data exchanges among functions in IMA-based systems.

Model-based optimization of ARINC-653 partition scheduling

The architecture of ARINC-653 partitioned scheduling has been widely applied to avionics systems owing to its robust temporal isolation among applications. However, this partitioning mechanism causes the problem of how to optimize the partition scheduling of a complex system while guaranteeing its schedulability. In this paper, a model-based optimization approach is proposed. We formulate the problem as a parameter sweep application, which searches for the optimal partition scheduling parameters with respect to minimum processor occupancy via an evolutionary algorithm. An ARINC-653 partitioned scheduling system is modeled as a set of timed automata in the model checker UPPAAL. The optimizer tentatively assigns parameter settings to the models and subsequently invokes UPPAAL to verify schedulability as well as evaluate promising solutions. The parameter space is explored with an evolutionary algorithm that combines refined genetic operators and the self-adaptation of evolution strategies. The experimental results show the applicability of our optimization method.

Formalization and Model Checking of BPMN Collaboration Diagrams with DD-LOTOS

Business Process Model and Notation (BPMN) is a standard graphical notation for modeling complex business processes. Given the importance of business processes, the modeling analysis and validation stage for BPMN is essential. In recent years, BPMN notation has become a widespread practice in business process modeling because of these intuitive diagrams. BPMN diagrams are built from basic elements. The major challenge of BPMN diagrams is the lack of formal semantics, which leads to several interpretations of the concerned diagrams. Hence, this work aims to propose an approach for checking BPMN collaboration diagrams to guarantee some properties of smooth functioning of systems modeled by BPMN notation. The verification approach used in this work is based on model checking techniques. The approach proposes as a first step a formal semantics of the collaboration diagrams in terms of the formal language DD-LOTOS, i.e., a phase of the transformation of collaboration diagrams into DD-LOTOS. This transformation is guided by applying the inference rules of the formal semantics of the DD-LOTOS formal language, and we then use the UPPAAL model checker to check the absence of deadlock, safety properties, and liveness properties.

Hubs for VirtuosoNext: Online verification of real-time coordinators

• Modelling of the coordination mechanism between tasks in a RTOS (VirtuosoNext); • Build new coordinators by plugging existing ones; • Specify timed scenarios to interact with the coordinator; • Verify timed behavioural properties of coordinators using UPPAAL; • Implementation: open source and running as a service online. VirtuosoNext TM is a distributed real-time operating system (RTOS) featuring a generic programming model dubbed Interacting Entities . This paper focuses on these interactions, implemented as so-called Hubs . Hubs act as synchronisation and communication mechanisms between the application tasks and implement the services provided by the kernel. While the kernel provides the most basic services, each carefully designed, tested and optimised, tasks are limited to this handful of basic hubs, leaving the development of more complex mechanisms up to application specific implementations. This work presents a toolset that supports the building of new services compositionally, using notions borrowed from the Reo coordination language, on which the developer can delegate coordination-related duties. This toolset uses a formal compositional semantics for hubs that captures dataflow and time, formalising the behaviour of existing hubs, and allowing the definition of new ones. Furthermore, it enables the analysis and verification of hubs under our automata interpretation, including time-sensitive behaviour via the Uppaal model checker, usable on http://arcatools.org/hubs . We illustrate the proposed tools and methods by verifying key properties on different interaction scenarios between tasks and a composed hub.

Formal Analysis of TSN Scheduler for Real-Time Communications

Time sensitive networking (TSN) is an emerging technology for in-vehicle networks, which has strict timing constraints and dependability requirements. The performance and efficiency of TSN depend on a reliable scheduling mechanism for real-time communications. Traditionally, the TSN scheduler is analyzed using simulations and testing, which are error-prone and inaccurate. In this article, we employ a timed model checker UPPAAL to formally model and analyze the TSN scheduler with a consideration of its transmission latency and time utilization. We first use the build-in assertion in UPPAAL to verify the deadlock-free property, safety property, and starvation-free property of our model. Then, we calculate the time utilization and the transmission delay of audio video bridging data frame under two scheduling mechanisms according to the simulation process. Then, we compared the time performance of this two scheduling mechanisms and found that each of them has their own advantages and disadvantages. This article provides a formal analysis framework for investigating scheduling strategies in TSN, which facilitates the designers to have a better understanding and development of TSN schedulers in the future.

Formal Models of the OSPF Routing Protocol

We present three formal models of the OSPF routing protocol. The first two are formalised in the timed process algebra T-AWN, which is not only tailored to routing protocols, but also specifies protocols in pseudo-code that is easily readable. The difference between the two models lies in the level of detail (level of abstraction). From the more abstract model we then generate the third model. It is based on networks of timed automata and can be executed in the model checker Uppaal.

A Formal Approach to Physics-based Attacks in Cyber-physical Systems

We apply formal methods to lay and streamline theoretical foundations to reason about Cyber-Physical Systems (CPSs) and physics-based attacks, i.e., attacks targeting physical devices. We focus on a formal treatment of both integrity and denial of service attacks to sensors and actuators of CPSs, and on the timing aspects of these attacks. Our contributions are fourfold. (1) We define a hybrid process calculus to model both CPSs and physics-based attacks. (2) We formalise a threat model that specifies MITM attacks that can manipulate sensor readings or control commands to drive a CPS into an undesired state; we group these attacks into classes and provide the means to assess attack tolerance/vulnerability with respect to a given class of attacks, based on a proper notion of most powerful physics-based attack. (3) We formalise how to estimate the impact of a successful attack on a CPS and investigate possible quantifications of the success chances of an attack. (4) We illustrate our definitions and results by formalising a non-trivial running example in U PPAAL SMC, the statistical extension of the U PPAAL model checker; we use U PPAAL SMC as an automatic tool for carrying out a static security analysis of our running example in isolation and when exposed to three different physics-based attacks with different impacts.