Verification Of Reactive Systems Research Articles

Automata-based Software Engineering for Control System Design and Verification

The automata composition is defined as the basic language construct of automata programming. Incorporating automata composition into an arbitrary programming language allows the development of automata programs in that language. Methods for specification and verification of reactive systems are defined in detail. All kinds of correctness formulas for a reactive system with respect to its specification are defined. In addition, correctness formulas for verification using the full invariant of the reactive system are developed. The Event-B manual begins with a brilliant illustration of the basic Event-B methods using the example of a car traffic control problem on a narrow bridge. However, the latter refinement in this illustration generates a complex cumbersome program. A simpler and shorter solution to this problem was presented in our work [7] using automata programming approach. Our solution was not easy because 4 non-trivial bugs were found by verification in Event-B. This paper describes our third attempt to construct a short simple automata program to solve this problem. Verification of the automata program in Event-B and Why3 systems was carried out. No errors were found. For verification, a reactive system model is built on Why3, which is simpler and more universal than the why3-do model.

The RERS challenge: towards controllable and scalable benchmark synthesis

This paper (1) summarizes the history of the RERS challenge for the analysis and verification of reactive systems, its profile and intentions, its relation to other competitions, and, in particular, its evolution due to the feedback of participants, and (2) presents the most recent development concerning the synthesis of hard benchmark problems. In particular, the second part proposes a way to tailor benchmarks according to the depths to which programs have to be investigated in order to find all errors. This gives benchmark designers a method to challenge contributors that try to perform well by excessive guessing.

Unifying theories of reactive design contracts

Design-by-contract is an important technique for model-based design in which a composite system is specified by a collection of contracts that specify the behavioural assumptions and guarantees of each component. In this paper, we describe a unifying theory for reactive design contracts that provides the basis for modelling and verification of reactive systems. We provide a language for expression and composition of contracts that is supported by a rich calculational theory. In contrast with other semantic models in the literature, our theory of contracts allows us to specify both the evolution of state variables and the permissible interactions with the environment. Moreover, our model of interaction is abstract, and supports, for instance, discrete time, continuous time, and hybrid computational models. Being based in Unifying Theories of Programming (UTP), our theory can be composed with further computational theories to support semantics for multi-paradigm languages. Practical reasoning support is provided via our proof framework, Isabelle/UTP, including a proof tactic that reduces a conjecture about a reactive program to three predicates, symbolically characterising its assumptions and guarantees about intermediate and final observations. This allows us to verify programs with a large or infinite state space. Our work advances the state-of-the-art in semantics for reactive languages, description of their contractual specifications, and compositional verification.

Efficient CTL Verification via Horn Constraints Solving

The use of temporal logics has long been recognised as a fundamental approach to the formal specification and verification of reactive systems. In this paper, we take on the problem of automatically verifying a temporal property, given by a CTL formula, for a given (possibly infinite-state) program. We propose a method based on encoding the problem as a set of Horn constraints. The method takes a program, modeled as a transition system, and a property given by a CTL formula as input. It first generates a set of forall-exists quantified Horn constraints and well-foundedness constraints by exploiting the syntactic structure of the CTL formula. Then, the generated set of constraints are solved by applying an off-the-shelf Horn constraints solving engine. The program is said to satisfy the property if and only if the generated set of constraints has a solution. We demonstrate the practical promises of the method by applying it on a set of challenging examples. Although our method is based on a generic Horn constraint solving engine, it is able to outperform state-of-art methods specialised for CTL verification.

On Promptness in Parity Games*†

Parity games are a powerful formalism for the automatic synthesis and verification of reactive systems. They are closely related to alternating ω-automata and emerge as a natural method for the solution of the μ-calculus model checking problem. Due to these strict connections, parity games are a well-established environment to describe liveness properties such as “every request that occurs infinitely often is eventually responded”. Unfortunately, the classical form of such a condition suffers from the strong drawback that there is no bound on the effective time that separates a request from its response, i.e., responses are not promptly provided. Recently, to overcome this limitation, several parity game variants have been proposed, in which quantitative requirements are added to the classic qualitative ones.

Bounded Model Checking for Markov Decision Processes

Bounded model checking has been proven to be a powerful technique for the verification of reactive systems,since it can avoid the space blow up of BDDs(Binary Decision Diagrams).To avoid the space blow up of MTBDDs(Multi Terminal Binary Decision Diagrams),a bounded model checking technique for Markov decision processes is proposed.The biggest feature of Markov decision processes is able to describe the nondeterministic choice.For this feature,the bounded semantics of the probabilistic computation tree logic is first presented,and its correctness is proven.Second,based on the evolution trend of the sequence consisting of probability measure calculated by the bounded model checking procedure,three termination criterions are given.Third,the bounded model checking procedure of the probabilistic computation tree logic is transformed into a linear equation.Finally,the experiment results show that compared with the unbounded model checking if the length of the witness is short then the bounded model checking needs less space.

Value-passing CCS with noisy channels

Value-passing CCS, a full version of Milner’s CCS, is a process algebra in which actions consist of sending and receiving values through noiseless communication channels. The full calculus is a succinct yet expressive language for the specification and verification of reactive systems. Taking into account the reality of channel noise in reactive systems, in this paper we introduce an extension of value-passing CCS, called value-passing CCS with noisy channels (VCCSN), in which noise is described by a probability distribution over the values. After presenting the reduction operational semantics and labelled operational semantics of VCCSN, we develop the theory of behavioural equivalence by introducing barbed equivalence, barbed congruence, bisimilarity, and full bisimilarity. In particular, we show that barbed equivalence and barbed congruence coincide with bisimilarity and full bisimilarity, respectively. Based upon the labelled operational semantics of VCCSN, we establish a probabilistic modal logic for expressing system properties and show its connection with the notion of bisimilarity. Finally, we use VCCSN to model a communication protocol for ensuring the reliable transmission of data across an error-prone channel.

Verification of reactive systems via instantiation of Parameterised Boolean Equation Systems

Verification problems for finite- and infinite-state processes, like model checking and equivalence checking, can effectively be encoded in Parameterised Boolean Equation Systems (PBESs). Solving the PBES then solves the encoded problem. The decidability of solving a PBES depends on the data sorts that occur in the PBES. We describe a pragmatic methodology for solving PBESs, viz., by attempting to instantiate them to the sub-fragment of Boolean Equation Systems (BESs). Unlike solving PBESs, solving BESs is a decidable problem. Based on instantiation, verification using PBESs can effectively be done fully automatically in most practical cases. We demonstrate this by solving several complex verification problems using a prototype implementation of our instantiation technique. In addition, practical issues concerning this implementation are addressed. Furthermore, we illustrate the effectiveness of instantiation as a transformation on PBESs when solving verification problems involving systems of infinite size.

Using Stochastic State Classes in Quantitative Evaluation of Dense-Time Reactive Systems

In the verification of reactive systems with nondeterministic densely valued temporal parameters, the state-space can be covered through equivalence classes, each composed of a discrete logical location and a dense variety of clock valuations encoded as a difference bounds matrix (DBM). The reachability relation among such classes enables qualitative verification of properties pertaining events ordering and stimulus/response deadlines, but it does not provide any measure of probability for feasible behaviors. We extend DBM equivalence classes with a density-function which provides a measure for the probability of individual states. To this end, we extend time Petri nets by associating a probability density-function to the static firing interval of each nondeterministic transition. We then explain how this stochastic information induces a probability distribution for the states contained within a DBM class and how this probability evolves in the enumeration of the reachability relation among classes. This enables the construction of a stochastic transition system which supports correctness verification based on the theory of TPNs, provides a measure of probability for each feasible run, enables steady-state analysis based on Markov renewal theory. In so doing, we provide a means to identify feasible behaviors and to associate them with a measure of probability in models with multiple concurrent generally distributed nondeterministic timers.

Review of "Verification of Reactive Systems: Formal Methods and Algorithms by Klaus Schneider", Springer-Verlag Berlin Heidelberg, 2004

Review of "Verification of Reactive Systems: Formal Methods and Algorithms by Klaus Schneider", Springer-Verlag Berlin Heidelberg, 2004

Introduction to the Special Issue on Specification Analysis and Verification of Reactive Systems

This special issue is inspired by the homonymous ICLP workshops that took place during ICLP 2001 and ICLP 2002. Extending and shifting slightly from the scope of their predecessors (on verification and logic languages) held in the context of previous editions of ICLP, the aim of the SAVE workshops was to bring together researchers interested in the use of computational logic as a tool for the specification, the analysis and the validation of systems, with particular emphasis on emerging technologies such as World Wide Web and E-Commerce, (protocols for) Smart Cards and Mobile Telephony, Wireless Technology, Hybrid Systems, Real-Time and Distributed systems, etc.

Bounded Model Checking for Deontic Interpreted Systems

We propose a framework for the verification of multi-agent systems' specification by symbolic model checking. The language CTLKD (an extension of CTL) allows for the representation of the temporal evolution of epistemic states of the agents, as well as their correct and incorrect functioning behaviour. We ground our analysis on the semantics of deontic interpreted systems. The verification approach is based on an adaption of the technique of bounded model checking, a mainstream approach in verification of reactive systems. We test our results on a typical communication scenario: the bit transmission problem with faults.

Verification of Reactive Systems: Formal Methods and Algorithms. By Klaus Schneider. Published by Springer, Berlin, Germany, Texts in Theoretical Computer Science Series, 2004. ISBN: 3-540-00296-0, pp 600.

Verification of Reactive Systems: Formal Methods and Algorithms. By Klaus Schneider. Published by Springer, Berlin, Germany, Texts in Theoretical Computer Science Series, 2004. ISBN: 3-540-00296-0, pp 600.

On the set of certain conflicts of a given language

Two concurrent processes are said to be in conflict if they can get trapped in a situation where they both are waiting or running endlessly, forever unable to complete their common task. In the design of reactive systems, this is a common fault which can be very subtle and hard to detect. This paper studies conflicts in more detail and characterises the most general set of behaviours of a process which certainly leads to a conflict when accepted by another process running in parallel. It shows how this set of certain conflicts can be used to simplify the automatic detection of conflicts and thus the verification of reactive systems.

Unifying proof methodologies of duration calculus and timed linear temporal logic

Abstract. Linear temporal logic (LTL) has been widely used for specification and verification of reactive systems. Its standard model is sequences of states (or state transitions), and formulas describe sequencing of state transitions. When LTL is used to model real-time systems, a state is extended with a time stamp to record when a state transition takes place. Duration calculus (DC) is another well studied approach for real-time systems development. DC models behaviours of a system by functions from the domain of reals representing time to the system states. This paper extends this time domain to the Cartesian product of the real and the natural numbers. With the extended time domain, we provide the chop modality with a non-overlapping interpretation. This allows some linear temporal operators explicitly dealing with the discrete dimension of time to be derivable from the chop modality in essentially the same way that their continuous-time counterparts are in the classical DC. This provides a nice embedding of some timed LTL (TLTL) modalities into DC to unify the methods from DC and LTL for real-time systems development: Requirements and high level design decisions are interval properties and are therefore specified and reasoned about in DC, while properties of an implementation, as well as the refinement relation between two implementations, are specified and verified compositionally and inductively in LTL. Implementation properties are related to requirement and design properties by rules for lifting LTL formulas to DC formulas.

Dynamic Partitioning in Linear Relation Analysis: Application to the Verification of Reactive Systems

We apply linear relation analysis (P. Cousot and N. Halbwachs, in 5th ACM Symposium on Principles of Programming Languages, POPL'78, Tucson (Arizona), January 1978s N. Halbwachs, Y.E. Proy, and P. Roumanoff, Formal Methods in System Design, Vol. 11, No. 2, pp. 157–185, 1997) to the verification of declarative synchronous programs (N. Halbwachs, Science of Computer Programming, Special Issue on SAS'94, Vol. 31, No. 1, 1998). In this approach, state partitioning plays an important role: on one hand the precision of the results highly depends on the fineness of the partitionings on the other hand, a too much detailed partitioning may result in an exponential explosion of the analysis. In this paper, we propose to dynamically select a suitable partitioning according to the property to be proved. The presented approach is quite general and can be applied to other abstract interpretations.

Design and Verification of Automation Systems Using RSDS

In this paper we describe the RSDS method for automated control system specification, and the techniques used for modular decomposition and verification of reactive systems, involving a structure-preserving translation to SMV. Copyright© 2001 IFAC

PERTS: an environment for specification and verification of reactive systems

PERTS: an environment for specification and verification of reactive systems

Application of Partial-Order Methods to Reactive Programswith Event Memorization

We are concerned in this paper with the verification of reactive systems with event memorization. The reactive systems are specified with an asynchronous reactive language Electre the main feature of which is the capability of memorizing occurrences of events in order to process them later. This memory capability is quite interesting for specifying reactive systems but leads to a verification model with a dramatically large number of states (due to the stored occurrences of events). In this paper, we show that partial-order methods can be applied successfuly for verification purposes on our model of reactive programs with event memorization. The main points of our work are two-fold: (1) we show that the independence relation which is a key point for applying partial-order methods can be extracted automatically from an Electre program; (2) the partial-order technique turns out to be very efficient and may lead to a drastic reduction in the number of states of the model as demonstrated by a real-life industrial case study.

The Automata-Theoretic Approach to Verification of Reactive Systems

Basic problems related to the use of automata-theoretic methods of verification of reactive systems are considered; in particular, the construction of an automaton from a formula of a temporal logic and the reduction of the automaton being verified are described.