Use Of Model Checking Research Articles

Towards a Methodology to Design Provably Secure Cyber-physical Systems

The inordinate financial cost of mitigating post-production cybersecurity vulnerabilities in cyber-physical systems (CPS) is forcing the industry to rethink systems design cycles: greater attention is being given to the design phase - with the goal of reducing the attack surface of systems at an early stage (i.e., before silicon tape out). Fortunately, formal methods have advanced to the point that they can address such needs and contribute towards achieving security certification. However, new methods and tools focusing on industrial scalability and usability for systems engineers are required. In this ongoing research paper, we describe a framework that will help systems engineers to: a) design cyber-assured CPS using a Model Based Engineering (MBE) approach; b) formally map security requirements to different hardware and software blocks in the model; and c) formally verify security requirements. Based on the nature of each requirement, our framework collects formal correctness evidence from different tools: while high-level architectural properties are suitable for a contract- or ontology-based reasoning, more complex properties with rich semantics require the use of model checking or theorem proving techniques.

SkiNet, A Petri Net Generation Tool for the Verification of Skillset-based Autonomous Systems

The need for high-level autonomy and robustness of autonomous systems for missions in dynamic and remote environment has pushed developers to come up with new software architectures. A common architecture style is to summarize the capabilities of the robotic system into elementary actions, called skills, on top of which a skill management layer is implemented to structure, test and control the functional layer. However, current available verification tools only provide either mission-specific verification or verification on a model that does not replicate the actual execution of the system, which makes it difficult to ensure its robustness to unexpected events. To that end, a tool, SkiNet, has been developed to transform the skill-based architecture of a system into a Petri net modeling the state-machine behaviors of the skills and the resources they handle. The Petri net allows the use of model-checking, such as Linear Temporal Logic (LTL) or Computational Tree Logic (CTL), for the user to analyze and verify the model of the system.

On the use of formal methods to model and verify neuronal archetypes

Having a formal model of neural networks can greatly help in understanding and verifying their properties, behavior, and response to external factors such as disease and medicine. In this paper, we adopt a formal model to represent neurons, some neuronal graphs, and their composition. Some specific neuronal graphs are known for having biologically relevant structures and behaviors and we call them archetypes. These archetypes are supposed to be the basis of typical instances of neuronal information processing. In this paper we study six fundamental archetypes (simple series, series with multiple outputs, parallel composition, negative loop, inhibition of a behavior, and contralateral inhibition), and we consider two ways to couple two archetypes: (i) connecting the output(s) of the first archetype to the input(s) of the second archetype and (ii) nesting the first archetype within the second one. We report and compare two key approaches to the formal modeling and verification of the proposed neuronal archetypes and some selected couplings. The first approach exploits the synchronous programming language Lustre to encode archetypes and their couplings, and to express properties concerning their dynamic behavior. These properties are verified thanks to the use of model checkers. The second approach relies on a theorem prover, the Coq Proof Assistant, to prove dynamic properties of neurons and archetypes.

Modeling and verification of contingency resolution strategies for multi-robot missions using temporal logic

This article presents an approach for assessing contingency resolution strategies using temporal logic. We present a framework for nominal mission modeling, then specifying contingency resolution strategies and evaluating their effectiveness for the mission. Our approach focuses on leveraging the use of model checkers to the domain of multi-robot missions to assess the adequacy of contingency resolution strategies that minimize the adverse effects of contingencies on the mission execution. We consider missions with deterministic as well as probabilistic transitions. We demonstrate our approach using two case studies. We consider the escorting of a ship in a port where multiple contingencies may occur concurrently and assess the adequacy of the proposed contingency resolution strategies. We also consider a manufacturing scenario where multiple assembly stations collaborate to create a product. In this case, assembly operations may fail, and human intervention is needed to complete the assembly process. We investigate several different strategies and assess their effectiveness based on mission characteristics.

Optimal Task Scheduling in a Flexible Manufacturing System using Model Checking

This paper demonstrates the use of model checking to solve the problem of optimal task scheduling in a flexible manufacturing system. The system is modelled as a discrete event system, for which the least restrictive safe behaviour is synthesised according to supervisory control theory. Then timing constraints are added to the model in the form of extended finite-state machines, and time-optimal schedules are computed using the discrete event systems and model checking tool Supremica. In the case study considered in this paper, which previously was only solved heuristically, the method successfully produces optimal schedules to manufacture up to 30 products of two different types. The method is furthermore used to find an optimal cycle, solving the scheduling problem of the case study for an arbitrary number of products in optimal or asymptotically close to optimal time.

Distributed algorithm to fight the state explosion problem

Model checking, introduced 20 years ago, combines several fully automatic techniques in which the property to be checked is tested exhaustively on all the possible executions of the system. It is an automated approach to verifying that a system meets its specifications. The main limit to the use of model checking is related to the state explosion problem, which occurs when the number of states increases exponentially according to the complexity of the system. In this article, we presented a distributed exploration algorithm executed on two different architectures to fight this problem. The first one is using two real machines interconnected across the network and the second using two virtual machines in a cloud computing. We carried out a comparative study between these two distributed approaches as well as a parallel algorithm. The aim of this paper is to give the advantages and drawbacks of each solution.

Distributed algorithm to fight the state explosion problem

Model checking, introduced 20 years ago, combines several fully automatic techniques in which the property to be checked is tested exhaustively on all the possible executions of the system. It is an automated approach to verifying that a system meets its specifications. The main limit to the use of model checking is related to the state explosion problem, which occurs when the number of states increases exponentially according to the complexity of the system. In this article, we presented a distributed exploration algorithm executed on two different architectures to fight this problem. The first one is using two real machines interconnected across the network and the second using two virtual machines in a cloud computing. We carried out a comparative study between these two distributed approaches as well as a parallel algorithm. The aim of this paper is to give the advantages and drawbacks of each solution.

Automated closed-loop model checking of implantable pacemakers using abstraction trees

Autonomous medical devices such as implantable cardiac pacemakers are capable of diagnosing the patient condition and delivering therapy without human intervention. Their ability to autonomously affect the physiological state of the patient makes them safety-critical. Sufficient evidence for the safety and efficacy of the device software, which makes these autonomous decisions, should be provided before these devices can be released on the market. Formal methods like model checking can provide safety evidence that the devices can safely operate under a large variety of physiological conditions. The challenge is to develop physiological models that are general enough to cover the large variability of human physiology, and also expressive enough to provide physiological contexts to counter-examples returned by the model checker. In this paper, the authors develop a set of physiological abstraction rules that introduce physiological constraints to heart models. By applying these abstraction rules to a initial set of heart models, an abstraction tree is created. The root model covers all possible inputs to a pacemaker and derived models cover inputs from different heart conditions. If a counter-example is returned by the model checker, the abstraction tree is traversed so that the most concrete counter-example(s) with physiological contexts can be returned to the domain experts for validity check. The abstraction tree framework replaces the manual abstraction and refinement framework, which reduced the amount of domain knowledge required to perform closed-loop model checking. It encourages the use of model checking during the development of autonomous medical devices, and identifies safety risks earlier in the design process. 1

Implementation of an interoperable process to optimise design and construction phases of a residential building: A BIM Pilot Project

Abstract Building Information Modelling (BIM) represents a long-term investment that could allow time reduction and a cost enhancement by means of optimised design and construction processes. The paper focuses on the first official Italian Public Pilot Project, dealing with the implementation of BIM-based validation and construction optimisation in a construction process. The case study concerns a residential building located in a dense urban district, causing a confined construction site affected by space shortage and coordination issues. The research aims to implement an interoperable IFC-based process in order to support the design and construction phases, performing advanced Model and Code Checking and analysing the construction phase through 4D BIM. Architectural, structural, and MEP models have been enriched with alphanumeric attributes as required by semi-automatic validation processes. An auto-matching between BIM objects and construction activities was also achieved. The early results showed the possibility of a BIM-based semi-automatic validation of design choices and an improved coordination between design disciplines. Moreover, the construction site simulation allowed the comparison of different layout options and baseline schedules. The research also tested the joint use of Model Checking and 4D BIM tools in order to analyse construction progresses by exporting an IFC-based construction site configuration directly from the 4D BIM tool. The tested process created an open, interoperable, and multi-disciplinary approach. The main findings concerning the domestic special constraints are described and analysed.

Compositional schedulability analysis of real-time actor-based systems

We present an extension of the actor model with real-time, including deadlines associated with messages, and explicit application-level scheduling policies, e.g.,“earliest deadline first” which can be associated with individual actors. Schedulability analysis in this setting amounts to checking whether, given a scheduling policy for each actor, every task is processed within its designated deadline. To check schedulability, we introduce a compositional automata-theoretic approach, based on maximal use of model checking combined with testing. Behavioral interfaces define what an actor expects from the environment, and the deadlines for messages given these assumptions. We use model checking to verify that actors match their behavioral interfaces. We extend timed automata refinement with the notion of deadlines and use it to define compatibility of actor environments with the behavioral interfaces. Model checking of compatibility is computationally hard, so we propose a special testing process. We show that the analyses are decidable and automate the process using the Uppaal model checker.

Comparing model checkers for timed UML activity diagrams

This paper describes the results of an experimental study on the use of model checkers to verify properties of UML activity diagrams. The motivation for the study derives from the desirability of checking properties of systems early in the development process, and the fact that UML is a commonly used notation for system models. The study assesses the performance of different model checking tools, and strategies for converting activity diagrams into the tools input notation, for a class of real time activity diagrams used in medical device design. This paper compares different translations for four model checkers in particular: UPPAAL, PES, SPIN and NuSMV. The performance of these model checkers is then compared using a suite of UML activity diagrams of varying complexity developed by us for this purpose. The results of a case study involving the design of an infusion pump are also presented.

Automated test generation using model checking: an industrial evaluation

In software development, testers often focus on functional testing to validate implemented programs against their specifications. In safety-critical software development, testers are also required to show that tests exercise, or cover, the structure and logic of the implementation. To achieve different types of logic coverage, various program artifacts such as decisions and conditions are required to be exercised during testing. Use of model checking for structural test generation has been proposed by several researchers. The limited application to models used in practice and the state space explosion can, however, impact model checking and hence the process of deriving tests for logic coverage. Thus, there is a need to validate these approaches against relevant industrial systems such that more knowledge is built on how to efficiently use them in practice. In this paper, we present a tool-supported approach to handle software written in the Function Block Diagram language such that logic coverage criteria can be formalized and used by a model checker to automatically generate tests. To this end, we conducted a study based on industrial use-case scenarios from Bombardier Transportation AB, showing how our toolbox CompleteTest can be applied to generate tests in software systems used in the safety-critical domain. To evaluate the approach, we applied the toolbox to 157 programs and found that it is efficient in terms of time required to generate tests that satisfy logic coverage and scales well for most of the programs.

Example of a Complementary Use of Model Checking and Human Performance Simulation

Aircraft automation designers are faced with the challenge to develop and improve automation such that it is transparent to the pilots using it. To identify problems that may arise between pilots and automation, methods are needed that can uncover potential problems with automation early in the design process. In this paper, simulation and model checking are combined and their respective advantages leveraged to find problematic human-automation interaction using methods that would be available early in the design process. A particular problem of interest is automation surprises, which describe events when pilots are surprised by the actions of the automation. The Tarom flight 381 incident involving the former Airbus automatic speed protection logic, leading to an automation surprise, is used as a common case study. Results of this case study indicate that both methods identified the automation surprise found in the Tarom flight 381 incident, and that the simulation identified additional automation surprises associated with that flight logic. The work shows that the methods can be symbiotically combined, and the joint method is suitable to identify problematic human-automation interaction such as automation surprise.

Model Checking Applied to Embedded Software of University Satellite

This work proposes the use of model checking for verifying the specification of critical embedded software of university satellites. The motivation for this work comes from two features commonly found in university satellite projects. The first one is the limited budget of the project. It usually results in a design of the on-board computer that relies on the software for detecting and treating hardware faults, instead of using radiation hard components. The second one is the lack of experience of the development team, which may compromise the quality of specification documents, jeopardizing the mission. In order to identify the advantages and limitations of model checking for university satellites, we used the software of the communication module of ITASAT satellite as a case study. The verification is performed with UPPAAL model checker. In order to avoid the state space explosion problem, similar non-deterministic events are simplified. The results show that the model checking process significantly contributed to identify and remove completeness problems in the software requirement specification documents.

Static analysis for concurrent programs with applications to data race detection

We propose a general framework for static analysis of concurrent multi-threaded programs in the presence of various types of synchronization primitives such as locks and pairwise rendezvous. In order to capture interference between threads, we use the notion of a transaction, i.e., a sequence of statements in a thread that can be executed atomically, without sacrificing the soundness of the analysis while yielding precise results. These transactions are delineated automatically, and are captured in the form of a transaction graph over the global control state space of the program. Starting from a coarse transaction graph, constructed by exploiting scheduling constraints related to synchronizations and partial order reduction, we iteratively refine the graph by removing statically unreachable nodes using the results of various analyses. Specifically, we use abstract interpretation to automatically derive program invariants, based on abstract domains of increasing precision. Progressive refinement of the transaction graph enhances scalability of the static analyses, yielding more precise invariants. We demonstrate the benefits of this framework in an application to find data race bugs in concurrent programs, where our static analyses serve to reduce the number of false warnings captured by an initial lockset analysis. This framework also facilitates use of model checking on the remaining warnings to generate concrete error traces, where we leverage the preceding static analyses to generate small program slices and the derived invariants to improve performance. We describe our experimental results on a suite of Linux device drivers.

A design methodology for verified web-service mediators

A new web service can be built by combining existing web services and coordinating their actions by a ‘mediator’. This work presents a formal design methodology based on model checking that generates all the mediator designs that meet requirements specified by a user. The methodology allows the user to explore the designs in search of the mediator that offers the best theoretical performance. Markov models of various measures of performance are considered. Each measure may result in a different ranking of the mediator designs (from best to worst for example). From these rankings the user can select the design that at least theoretically best fits the purpose. The novelty of this work is the use of model checking and Markov analysis in a single formal framework to generate, explore, and select from a set of provably-correct mediators—while still in the design stage of development.

An overview of existing modeling tools making use of model checking in the analysis of biochemical networks

Model checking is a well-established technique for automatically verifying complex systems. Recently, model checkers have appeared in computer tools for the analysis of biochemical (and gene regulatory) networks. We survey several such tools to assess the potential of model checking in computational biology. Next, our overview focuses on direct applications of existing model checkers, as well as on algorithms for biochemical network analysis influenced by model checking, such as those using binary decision diagrams (BDDs) or Boolean-satisfiability solvers. We conclude with advantages and drawbacks of model checking for the analysis of biochemical networks.

Efficient model checking of PSL safety properties

Safety properties are an important class of properties, as in the industrial use of model checking, a large majority of the properties to be checked are safety properties. This work presents an efficient approach to model check safety properties expressed in PSL (IEEE Std 1850 Property Specification Language), an industrial property specification language. The approach can also be used as a sound but incomplete bug-hunting tool for general (non-safety) PSL properties, and it will detect exactly the finite counterexamples that are the informative bad prefixes for the PSL formulae in question. The presented technique is inspired by the temporal testers approach of Pnueli and co-authors, but unlike theirs, the proposed approach is aimed at finding finite counterexamples to properties. The new approach presented here handles a larger syntactic subset of PSL safety properties than earlier translations for PSL safety subsets and has been implemented on top of the open source NuSMV 2 model checker. The experimental results show the approach to be a quite competitive model checking approach when compared to a state-of-the-art implementation of PSL model checking.

Constraint-based deadlock checking of high-level specifications

AbstractEstablishing the absence of deadlocks is important in many applications of formal methods. The use of model checking for finding deadlocks in formal models is often limited. In this paper, we propose a constraint-based approach to finding deadlocks employing the ProB constraint solver. We present the general technique, as well as various improvements that had to be performed on ProB's Prolog kernel, such as reification of membership and arithmetic constraints. This work was guided by an industrial case study, where a team from Bosch was modelling a cruise control system. Within this case study, ProB was able to quickly find counterexamples to very large deadlock-freedom constraints. In the paper, we also present other successful applications of this new technique. Experiments using SAT and SMT solvers on these constraints were thus far unsuccessful.

A practical use of model checking for synthesis: generating a dam controller for flood management

AbstractProgram synthesis with automated methods has been an active research area for many years; however, we still lack well‐known and accepted techniques for this software engineering task. In this case, the design space to be considered is infinite, even when the solution is restricted to software that meets the requirements. In this paper we propose the use of model checking (MC) techniques to automatically synthesize controllers. Given a goal in the evolution of a plant, MC can be used to search for acceptable software controllers that enable the plant to evolve as desired. We also develop a realistic application in the context of a joint project with a major water reservoir management company. This application generates controllers for dam management during flood seasons. The controllers give the proper orders (open or close the outflow elements) at precise times in order to avoid disasters and to preserve the water level in the dam. Copyright © 2011 John Wiley & Sons, Ltd.