Compositional Verification Research Articles

Dynamic Access Control Policies: Specification and Verification

Security requirements deal with the protection of assets against unauthorized access (disclosure or modification) and their availability to authorized users. Temporal constraints of history-based access control policies are difficult to express naturally in traditional policy languages. We propose a compositional formal framework for the specification and verification of temporal access control policies for security critical systems in which history-based policies and other temporal constraints can be expressed. In particular, our framework allows for the specification of policies that can change dynamically in response to time or events enabling dynamic reconfiguration of the access control mechanisms. The framework utilizes a single well-defined formalism, interval temporal logic, for defining the semantics of these policies and to reason about them. We illustrate our approach with a detailed case study of an electronic paper submission system showing the compositional verification of their safety, liveness and information flow properties.

FDR-based Compositional Verification for OWL-S Process Model

FDR-based Compositional Verification for OWL-S Process Model

CADP 2011: a toolbox for the construction and analysis of distributed processes

CADP (Construction and Analysis of Distributed Processes) is a comprehensive software toolbox that implements the results of concurrency theory. Started in the mid-1980s, CADP has been continuously developed by adding new tools and enhancing existing ones. Today, CADP benefits from a worldwide user community, both in academia and industry. This paper presents the latest release, CADP 2011, which is the result of a considerable development effort spanning the last five years. The paper first describes the theoretical principles and the modular architecture of CADP, which has inspired several other recent model checkers. The paper then reviews the main features of CADP 2011, including compilers for various formal specification languages, equivalence checkers, model checkers, compositional verification tools, performance evaluation tools, and parallel verification tools running on clusters and grids. Finally, the paper surveys some significant case studies.

A Novel Web Service Composition Verification Method based on Petri Net

A Novel Web Service Composition Verification Method based on Petri Net

Compositional verification of real-time systems using Ecdar

We present a specification theory for timed systems implemented in the Ecdar tool. We illustrate the operations of the specification theory on a running example, showing the models and verification checks. To demonstrate the power of the compositional verification, we perform an in depth case study of a leader election protocol; Modeling it in Ecdar as Timed input/output automata Specifications and performing both monolithic and compositional verification of two interesting properties on it. We compare the execution time of the compositional to the classical verification showing a huge difference in favor of compositional verification.

Conflict-preserving abstraction of discrete event systems using annotated automata

This paper proposes to enhance compositional verification of the nonblocking property of discrete event systems by introducing annotated automata. Annotations store nondeterministic branching information, which would otherwise be stored in extra states and transitions. This succinct representation makes it easier to simplify automata and enables new efficient means of abstraction, reducing the size of automata to be composed and thus the size of the synchronous product state space encountered in verification. The abstractions proposed are of polynomial complexity, and they have been successfully applied to model check the nonblocking property of the same set of large-scale industrial examples as used in related work.

Observable behavior of distributed systems: Component reasoning for concurrent objects

Distributed and concurrent object-oriented systems are difficult to analyze due to the complexity of their concurrency, communication, and synchronization mechanisms. Rather than performing analysis at the level of code in, e.g., Java or C++, we consider the analysis of such systems at the level of an abstract, executable modeling language. This language, based on concurrent objects communicating by asynchronous method calls, avoids some difficulties of mainstream object-oriented programming languages related to compositionality and aliasing. To facilitate system analysis, compositional verification systems are needed, which allow components to be analyzed independently of their environment. In this paper, a proof system for partial correctness reasoning is established based on communication histories and class invariants. A particular feature of our approach is that the alphabets of different objects are completely disjoint. Compared to related work, this allows the formulation of a much simpler Hoare-style proof system and reduces reasoning complexity by significantly simplifying formulas in terms of the number of needed quantifiers. The soundness and relative completeness of this proof system are shown using a transformational approach from a sequential language with a non-deterministic assignment operator.

Compositional Verification of Liveness Property in Inhibitor-arc Connections of Petri Net Systems

Petri net systems synthesis can construct large systems without the requirement of reachability analysis so that it can reduce the high complexity of analyzing global system. In a synthesis process, such good properties of subsystems as liveness and deadlock-freeness etc, must be preserved in synthesized system. This paper focusses on liveness preservation in inhibitor-arc connection operations. The systems dynamic, concurrent behavior relation i.e. concurrent language relation in inhibitor-arc connections is stressed studied. The corresponding language relation formula is present and proved, and it can be applied to determine liveness of synthesized system in inhibitor-arc connection operations. Furthermore, some criteria are introduced, which are necessary and sufficient for liveness, to determine the liveness of global system by the same ones of local systems. Finally, some examples are given, illustrating the effectiveness of the proposed approach in modeling and analyzing of large systems.

Epidemiological Tracking and Population Assignment of the Non-Clonal Bacterium, Burkholderia pseudomallei

Rapid assignment of bacterial pathogens into predefined populations is an important first step for epidemiological tracking. For clonal species, a single allele can theoretically define a population. For non-clonal species such as Burkholderia pseudomallei, however, shared allelic states between distantly related isolates make it more difficult to identify population defining characteristics. Two distinct B. pseudomallei populations have been previously identified using multilocus sequence typing (MLST). These populations correlate with the major foci of endemicity (Australia and Southeast Asia). Here, we use multiple Bayesian approaches to evaluate the compositional robustness of these populations, and provide assignment results for MLST sequence types (STs). Our goal was to provide a reference for assigning STs to an established population without the need for further computational analyses. We also provide allele frequency results for each population to enable estimation of population assignment even when novel STs are discovered. The ability for humans and potentially contaminated goods to move rapidly across the globe complicates the task of identifying the source of an infection or outbreak. Population genetic dynamics of B. pseudomallei are particularly complicated relative to other bacterial pathogens, but the work here provides the ability for broad scale population assignment. As there is currently no independent empirical measure of successful population assignment, we provide comprehensive analytical details of our comparisons to enable the reader to evaluate the robustness of population designations and assignments as they pertain to individual research questions. Finer scale subdivision and verification of current population compositions will likely be possible with genotyping data that more comprehensively samples the genome. The approach used here may be valuable for other non-clonal pathogens that lack simple group-defining genetic characteristics and provides a rapid reference for epidemiologists wishing to track the origin of infection without the need to compile population data and learn population assignment algorithms.

Compositional verification of a communication protocol for a remotely operated aircraft

This paper presents the formal specification and verification of a communication protocol between a ground station and a remotely operated aircraft. The protocol can be seen as the vertical composition of protocol layers, where each layer performs input and output message processing, and the horizontal composition of different processes concurrently inhabiting the same layer, where each process should satisfy a distinct delivery requirement. A compositional technique is used to formally prove that the protocol satisfies these requirements. Although the protocol itself is not novel, the methodology employed in its verification extends existing techniques by automating the tedious and usually cumbersome part of the proof, thereby making the iterative design process of protocols feasible.

Culturable bacterial communities on leaf sheaths and panicles of rice plants in Japan

Culturable bacterial communities on rice plants were investigated from 2001 to 2003. In total, 1,394 bacterial isolates were obtained from the uppermost leaf sheaths at 1month before heading time and from leaf sheaths and panicles at heading time. The average culturable bacterial population on the leaf sheaths was larger at heading time than at 1month previously. Furthermore, the population was significantly larger on panicles than on leaf sheaths, suggesting that the bacterial population is influenced by the organs of rice plants. Larger proportions of bacteria were obtained from the macerates of leaf sheaths after washing with phosphate buffer, and most culturable bacteria were verified to inhabit the inside or inner surface, rather than the outer surface, of the tissues. Verification of the bacterial composition based on 16S rRNA gene sequences revealed that genera of Sphingomonas, Microbacterium, Methylobacterium, and Acidovorax tended to be dominant colonizers on leaf sheaths, whereas Pseudomonas and Pantoea were isolated mainly from the panicles, indicating that leaf sheaths and panicles harbor distinct communities. Furthermore, the richness of bacterial genera was less on both leaf sheaths and panicles at heading time compared with that observed 1month before heading time. Phylogenetic analyses using bacterial isolates belonging to the four dominant genera inhabiting leaf sheaths at heading time revealed that particular bacterial groups in each genus colonized the leaf sheaths.

Conceptual framework for business processes compositional verification

Context To guarantee the success of Business Process Modelling (BPM) it is necessary to check whether the activities and tasks described by Business Processes (BPs) are sound and well coordinated. Objective This article describes and validates a Formal Compositional Verification Approach (FCVA) that uses a Model-Checking (MC) technique to specify and verify BPs. Method This is performed using the Communicating Sequential Processes +Time (CSP+T) process calculus, which adds new constructions to timed Business Process Model and Notation (BPMN) modelling entities for non- functional requirement specification. Results Using our proposal we are able to specify the BP Task Model (BPTM) associated with BPs by formalising the timed BPMN notational elements. The proposal also allows us to apply MC to BPTM verification. A real-life example of verifying a BPTM in the field of Customer Relationship Management (CRM) is discussed as a practical application of FCVA. Conclusion This approach facilitates the verification of complex BPs from independently verified local processes, and establishes a feasible way to use process calculi to verify BPs using state-of-the-art MC tools.

A theorem proving framework for the formal verification of Web Services Composition

We present a rigorous framework for the composition of Web Services within a higher order logic theorem prover. Our approach is based on the proofs-as-processes paradigm that enables inference rules of Classical Linear Logic (CLL) to be translated into pi-calculus processes. In this setting, composition is achieved by representing available web services as CLL sentences, proving the requested composite service as a conjecture, and then extracting the constructed pi-calculus term from the proof. Our framework, implemented in HOL Light, not only uses an expressive logic that allows us to incorporate multiple Web Services properties in the composition process, but also provides guarantees of soundness and correctness for the composition.

Counterexample-Guided Assume-Guarantee Synthesis through Learning

Assume-guarantee reasoning (AGR) is a promising compositional verification technique that can address the state space explosion problem associated with model checking. Since the construction of assumptions usually requires nontrivial human efforts, a framework was already proposed for generating assumptions automatically using the L* algorithm. However, if the framework shows that a system model does not satisfy a given specification, the designer has to manually refine the system model. To automate this refinement process, we propose a framework that can automatically eliminate all counterexamples from a system model such that the synthesized model satisfies a given safety specification. Further, the framework for synthesis is not only automatic, but is also an iterative L*-based compositional process, i.e., the global state space of the system is never generated in the synthesis process. When a model checker shows that a system model does not satisfy a specification by giving a counterexample, the proposed framework eliminates a class of equivalent counterexamples, that is, the set of counterexamples that transit to the error state through the same final transition. Then, AGR is applied again to check if there is another counterexample. The action of eliminating counterexamples continues until all classes of counterexamples are eliminated from the system model. We prove that the synthesized model satisfies the specification and the synthesis flow terminates after a finite number of iterations. Due to compositional synthesis, our target model for synthesis, namely the component models, is much smaller than the global system state graph.

Automatic music composition using answer set programming

AbstractMusic composition used to be a pen and paper activity. These days music is often composed with the aid of computer software, even to the point where the computer composes parts of the score autonomously. The composition of most styles of music is governed by rules. We show that by approaching the automation, analysis and verification of composition as a knowledge representation task and formalising these rules in a suitable logical language, powerful and expressive intelligent composition tools can be easily built. This application paper describes the use of answer set programming to construct an automated system, named Anton, that can compose melodic, harmonic and rhythmic music, diagnose errors in human compositions and serve as a computer-aided composition tool. The combination of harmonic, rhythmic and melodic composition in a single framework makes Anton unique in the growing area of algorithmic composition. With near real-time composition, Anton reaches the point where it can not only be used as a component in an interactive composition tool but also has the potential for live performances and concerts or automatically generated background music in a variety of applications. With the use of a fully declarative language and an “off-the-shelf” reasoning engine, Anton provides the human composer a tool which is significantly simpler, more compact and more versatile than other existing systems.

Complexation studies of 3-substituted β-diketones with selected d- and f-metal ions

AbstractResults of spectroscopic investigations related to complex compositions of 3-substituted derivatives of pentane-2,4-dione (β-diketonate) complexes with chosen d- and f-metal ions are presented. Ligands 3-allylacetylacetone (3all-acac) and 3-benzylacetylacetone (3ben-acac) were prepared and used for the complexation study with Cu(II), Co(II), Nd(III), and Ho(III) metal ions. Based on the absorption spectra of lanthanide ions in their hypersensitive transitions, with the use of computer assisted target factor analysis (CAT) and absorption spectra of the ligands with Cu(II) and Co(II), the verification of complex compositions and the determination of their stability constants were achieved. In case of Nd(III) and Ho(III) complexes with β-diketone ligands, absorption of their maxima were studied in the range of hypersensitive transitions 4 I 9/2 → 4 F 7/2 + 4 S 3/2 (λ max ∼ 734 nm and 748 nm) for Nd(III) and in the range of 435–465 nm, corresponding to the hypersensitive transition 5 G 6 → 5 I 8 (λ max ∼ 450 nm), for Ho(III).

Evaluation of Patient Residual Deviation and Its Impact on Dose Distribution for Proton Radiotherapy

The residual deviations after final patient repositioning based on bony anatomy and the impact of such deviations on the proton dose distributions was investigated. Digitally reconstructed radiographs (DRRs) and kilovoltage (kV) “portal verification” images from 10 patients treated with passively scattered proton radiotherapy was used to estimate the residual deviation. These changes were then applied to the location of isocenter points that, in effect, moved the isocenter relative to the apertures and compensators. A composite verification plan was obtained and compared with the original clinical treatment plan to evaluate any changes in dose distributions. The residual deviations were fitted to a Gaussian distribution with μ = –0.9 ± 0.1 mm and σ = 2.55 ± 0.07 mm. The dose distribution showed under- and overcovered dose spots with complex dose distributions both in the target volumes and in the organs at risk. In some cases, this amounts to 63.5% above the intended clinical plan. Although patient positioning is carefully verified before treatment delivery and setup uncertainties are accounted for by using compensator smearing and aperture margins, a residual shift in a patient's position can considerably affect the dose distribution.

A system for compositional verification of asynchronous objects

We present a semantics, calculus, and system for compositional verification of Creol, an object-oriented modelling language for concurrent distributed applications. The system is an instance of KeY, a framework for object-oriented software verification, which has so far been applied foremost to sequential Java. Building on KeY characteristic concepts, like dynamic logic, sequent calculus, symbolic execution via explicit substitutions, and the taclet rule language, the presented system addresses functional correctness of Creol models featuring local cooperative thread parallelism and global communication via asynchronous method calls. The calculus heavily operates on communication histories specified by the interfaces of Creol units. Two example scenarios demonstrate the usage of the system. This article extends the conference paper of Ahrendt and Dylla (2009) [5] with a denotational semantics of Creol and an assumption-commitment style semantics of the logic.

The angular dependence of a 2-dimensional diode array and the feasibility of its application in verifying the composite dose distribution of intensity-modulated radiation therapy

The planning dose distribution of intensity-modulated radiation therapy (IMRT) has to be verified before clinical implementation. The commonly used verification method is to measure the beam fluency at 0 degree gantry angle with a 2-dimensional (2D) detector array, but not the composite dose distribution of the real delivery in the planned gantry angles. This study was to investigate the angular dependence of a 2D diode array (2D array) and the feasibility of using it to verify the composite dose distribution of IMRT. Angular response of the central detector in the 2D array was measured for 6 MV X-ray, 10 cmx10 cm field and 100 cm source axis distance (SAD) in different depths. With the beam incidence angle of 0-60 degrees, at intervals of 10 degrees, and inherent buildup of the 2D array (2 g/cm2), the array was irradiated and the readings of the central diode were compared with the measurement of thimble ionization chamber. Using a combined 30 cmx30 cmx30 cm phantom which consisted of solid water slabs on top and underlying the 2D array, with the diode detectors placed at 8 g/cm2 depth, measurements were taken for beam angles of 0 degrees-180 degrees at intervals of 10 degrees and compared with the calculation of treatment planning system (TPS) that pre-verified with ion chamber measuring. Differences between the array detector and thimble chamber measurements were greater than 1% and 3.5% when the beam angle was larger than 30 degrees and 60 degrees, respectively. The measurements in the combined phantom were different from the calculation as high as 20% for 90 degrees beam angle, 2% at 90 degrees+/-5 degrees and less than 1% for all the other beam angles. The 2D diode array is capable of being used in composite dose verification of IMRT when the beam angles of 90 degrees+/-5 degrees and 270 degrees+/-5 degrees are avoided.

Automated compositional verification

Automated compositional verification