Automatic Transformation of SysML Model to Event-B Model for Railway CCS Application

Der Ausdruck Quality of Service (QoS) beschreibt die Güte eines erbrachten Dienstes. QoS beschreibt Eigenschaften wie Antwortzeit, Verfügbarkeit, den Grad der Nachrichten-Verschlüsselung oder den Durchsatz. QoS ist sowohl für Multi-Media Anwendungen (Audio- und Video-Übertragung) als auch für Geschäftsanwendungen wichtig. Die vorgelegte Arbeit konzentriert sich dabei auf das Feld der Geschäftsanwendungen. Solche Anwendungen arbeiten mit Transaktionen wie etwa dem Bestellen eines Produkts oder der Überweisung von Geld zwischen Konten. QoS Eigenschaften solcher Anwendungen sind beispielsweise die Anzahl an Transaktionen während eines Zeitintervalls, die maximale Anzahl gleichzeitig mit dem System arbeitender Nutzer, oder die zu erwartende Verfügbarkeit. Durch Middleware kann die Realisierung von Verteilung vor dem Programmierer verborgen werden. In einer idealen Welt würde Middleware dasselbe für QoS leisten. Das heißt, der Entwickler spezifiziert nur die gewünschte Dienstgüte und kümmert sich nicht darum, wie sie realisiert wird. Das ist so aber nicht möglich, denn die zu erbringende Dienstgüte hat massive Auswirkungen auf das Design einer Applikation. Daher muss QoS schon in der Design-Phase angegangen werden, was mit einer rein Middleware-gestützten Herangehensweise nicht möglich ist. Die vorgelegte Arbeit zeigt, wie dieses Problem durch einen modellgetriebenen Ansatz behoben werden kann. Die Entwicklung beginnt dann mit einem Plattform-unabhängigen Modell (PIM), welches das Verhalten und die QoS Eigenschaften der Applikation beschreibt. Dieses Modell wird automatisch durch eine Modell-Transformation in ein Plattform-spezifisches Modell (PSM) umgewandelt. Das PSM beschreibt das Design einer Implementierung für eine spezifische Plattform und berücksichtigt dabei die im PIM beschriebenen QoS-Eigenschaften. Um dieses Szenario in der Praxis anwenden zu können, müssen zwei Probleme gelöst werden: das Modellieren von QoS Eigenschaften und die Modell-Transformation. Gegenwärtig erfordert das Erstellen einer Modell-Transformation detailliertes Wissen über die Modellierungssprache und ihre Interna. Um das zu vereinfachen, wurde im Rahmen dieser Arbeit die visuelle Regelbasierte Transformationssprache Kafka entwickelt. Kafka und die zugehörigen Werkzeuge bauen auf Graphtransformations-Theorie auf. Kafka vereinfacht das Erstellen von Transformationen weil es auf der Notation des PIM und PSM aufbaut. Daher muss der Entwickler nichts von den Interna (etwa dem Meta-Modell) verstehen. Um PIMs von QoS-fähigen Applikationen zu erstellen, wurde die Modellierungssprache PIQML entwickelt, welche auf UML 2.0 Komponenten, Hierarchischen Nachrichten Sequenz Diagrammen (HMSCs) und einer neuen Meta-Modell Erweiterung für QoS Verträge basiert. Die vorgelegte Arbeit zeigt, wie PIQML Modelle auf verschiedene Zielplattformen (Programmiersprachen und Middleware Produkte) abgebildet werden können. Basierend auf PIQML und Kafka wurde das Werkzeug Kase entwickelt, welches das Editieren von PIQML Modellen (PIMs), UML Modellen (PSMs) und Kafka Transformationen integriert. Das Ergebnis ist eine integrierte Werkzeug-Kette für das modellgetriebene Entwickeln QoS-fähiger verteilter Applikationen.

The complexity of designing concurrent and highly-evolving interactive systems has grown to a point where system verification has become a hurdle. Fortunately, formal verification methods have arrived at the right time. They detect errors, inconsistencies and incompleteness at early development stages of a system formally modeled using a formal specification language. -calculus (Milner, 1999) is one such formal language which provides strong mathematical base that can be used for verifying system specifications. But manually verifying the specifications of concurrent systems is a very tedious and error-prone work, especially if the specifications are large. Consequently, an automated verification tool would be essential for efficient system design and development. In addition, formal verification tools are vital ingredient to fully harness the potential of component-based software composition. The authors developed such an automated verification tool which is highly portable and seamlessly integrates with the visualization, reduction and performance evaluation tools introduced (Ahmad & Rahimi, 2008; Rahimi, 2006; Rahimi et al., 2001, 2008) to provide a comprehensive tool for designing and analyzing multi process/agent systems. Open-Bisimulation (Sangiorgi, 1996) concept is utilized as the theoretical base for the design and implementation of the tool which incorporates an expert system implemented in Java Expert System Shell (JESS) (Friedman-Hill, 2003).

Defects in software cost money and sometimes lives. Even with rigorous testing, there are countless ways for programs to go wrong. Testing does not guarantee that a given program is correct for every input. Concurrent program testing does not guarantee that a program is correct for the example inputs. Formal program verification has been used as a technique to ensure program correctness for several years. It analyses the properties of the code and ensures that nothing goes wrong. In this thesis, a formal verification tool is designed and implemented based on Boogie IVL (Intermediate Verification Language) for a multi-threaded and object-oriented language named HARPO (HARdware Parallel Objects). We have designed the specific annotations intended only for use in verification. These annotations help the HARPO verifier to translate the program into an equivalent Boogie code. The resulting Boogie code is checked with theorem provers to verify the correctness of the HARPO program. Boogie code generation is tested using unit testing, and some of the case studies are reported. Consequently, programmers can use the HARPO verifier for verification of their concurrent programs.

All formal hardware verification tools in the market today interpret hardware description languages (HDLs) based on their synthesis semantics. This limits formal verification to synthesizable designs. The result, either a proof or a counterexample, produced by a formal tool can be inconsistent with simulation due to synthesis and simulation mismatches. And finally, conversion from a synthesized gate-level circuit to a formal model such as a Kripke structure or a Mealy machine is complex for designs containing gated clocks or latches. Existing solutions are often based on heuristics rather than language semantics. In this paper, we propose a new approach that constructs formal models based on simulation semantics. We symbolically simulate HDL designs using non-canonical word-level expressions to represent the values of design signals. We show that the formal model is consistent with simulation at specified sample points, which can be chosen to represent a clock cycle or a transaction. Our approach has been implemented in a tool called Simon. Experimental results show that Simon can efficiently construct formal models for large industrial designs.

The ever-growing complexity of software and its target hardware makes it increasingly challenging to develop reliable compilers that preserve the semantics of source code during compilation. Traditional testing methods often lack sufficient test coverage and fail to identify subtle errors and undefined behaviors that can lead to compiler malfunctions. Furthermore, while formal compiler certification ensures semantic preservation through theorem proving, the inherent complexity of this process makes re-certification after each compiler revision substantially labor-intensive. This often significantly hinders the improvement of compilers. This research aims to bridge the gap between increasing compiler complexity and the limited scalability of formal verification techniques. We present a comprehensive approach for automatic verification of compiler transformations that are the core components of any compiler design. Our approach particularly targets the foundations of state-of-the-art compilers: their intermediate representations (IRs). It provides automated verification algorithms that formally compare the IRs before and after a compiler transformation and systematically enumerate the execution paths of such transformation. First, we have developed an automated equivalence checking framework for hardware designs represented in HalideIR, the foundation of several well-known hardware design compilers. This framework conducts scalable equivalence checking by analyzing structural similarities in HalideIR across various design iterations. It identifies minimal design constructs essential for verification and performs efficient localized checks. Its application in deep learning accelerator designs has proven its capability to detect inconsistencies that manual testing fails to identify, thereby bolstering hardware design reliability. Second, we have developed an automated verification framework for HalideIR-based compiler transformations using symbolic execution. This method systematically enumerates and verifies execution paths of compiler transformations to ensure that the output program for each path is equivalent to its source. The application of this framework in common HalideIR-based compilers has uncovered previously undetected transformation bugs, highlighting its effectiveness. Third, we have pioneered a novel translation validation framework for MLIR-based compilers. This framework overcomes the complexity arising from the numerous MLIR dialects and employs the Z3 SMT solver to validate the refinement of target programs with respect to source programs in MLIR. Its evaluations on diverse MLIR-based compilers have not only showcased its versatility but also its crucial role in identifying bugs and undefined behaviors. Finally, we have also explored integrating Large Language Models (LLMs) into translation validation to target compiler transformations where formal verification tools fall short. Our framework utilizes existing formal verification tools for translation validation (in this work, we use Alive2, a

The gap between informal models used in a UML environment and formal verifications and proofs in academic research prevents UML from valid and efficient application. In this paper, we propose an approach to bridge the gap between UML class diagram and situation calculus via our formal verification tool, UCVSC (UML class diagram online verification based on situation calculus). UML class diagram describes a software system informally while situation calculus is employed as the underlying formalism to precisely specify the system. With respect to most components in UML class diagram, the strength of reasoning about actions and describing the state of the world in situation calculus can be applied to represent them appropriately. Using UML tools and predefined mapping mechanism, we transform UML class diagram to XMI, an intermediate format, and finally to situation calculus in Prolog syntax. This approach attempts to provide precise semantics of UML class diagram which can be logically verified. In addition, we automate the verification process in an online prototype system. Furthermore, a case study on an academic system is presented to illustrate and evaluate our approach.

The Accellera EDA standards body has recently approved the PSL a standard property specification language for use in assertion-based verification via simulation and formal verification tools. This language, which is based on the Sugar language from IBM, is now supported by many EDA vendors. More than 40 individuals representing over 20 companies participated in the efforts to form the PSL standard from its Sugar basis.The tutorial comprises 2 parts. In the first part, we describe the basic principles of PSL/Sugar, focusing on the ease with which complex design behaviors may be described with concise, readable PSL/Sugar assertions that crisply capture design intent. We summarize the temporal constructs of the language, including parameterized sequences and properties, directives, and modeling capabilities. We cover the general timing model of PSL/Sugar, which transparently supports both (single- or multi-clock) synchronous and asynchronous design, and, time permitting, we explain how PSL/Sugar has been defined to ensure consistent semantics for both simulation and formal verification applications.In the second part of the tutorial, we present several applications of PSL/Sugar, ranging from simple to advanced assertion-based verification solutions. These include use of PSL/Sugar for dynamic assertion checking and formal model checking, including support for environment modeling and assume/guarantee reasoning. Examples of commercial verification tools which support the PSL/Sugar languages will also be presented.Participants in the tutorial will have an excellent opportunity to learn about both the language and its applications directly from the speaker, Dr. Danny Geist, who heads a research group in the IBM Haifa lab where Sugar was conceived.

A framework for supporting the development of verifiably safe medical best practice guideline systems

RFID is an automatic identification technology that can control a range of information via IC chips and radio communication. Also known as electronic tags, smart tags or electronic labels, RFID technology enables embedding the overall process from production to sales in an ultra-small IC chip and tracking down such information using radio frequencies. Currently, RFID-based application and development is in progress in such fields as health care, national defense, logistics and security. RFID structure consists of a reader that reads tag information, a tag that provides information and the database that manages data. Yet, the wireless section between the reader and the tag is vulnerable to security issues. To sort out the vulnerability, studies on security protocols have been conducted actively. However, due to difficulties in implementation, most suggestions are concerned with theorem proving, which is prone to vulnerability found by other investigators later on, ending up in many troubles with applicability in practice. To experimentally test the security of the protocol proposed here, the formal verification tool, CasperFDR was used. To sum up, the proposed protocol was found to be secure against diverse attacks. That is, the proposed protocol meets the safety standard against new types of attacks and ensures security when applied to real tags in the future.

Formal program verification tools check that a program correctly implements its specification. Existing specification languages for well-known programming languages (Ada, C, Java, C#) have been developed independently from the programming language to which they apply. As a result, specifications are expressed separately from the code, typically as stylized comments, and the verification tools often bear no direct relation to the production compiler. We argue that this approach is problematic, and that the compiler and the verification tools should be integrated seamlessly. Based on our current work on the Hi-Lite project to develop a formal verification tool for Ada2012, we show that in an integrated setting, the compiler becomes the centerpiece of the verification architecture, and supports both static proofs and run-time assertion checking. Such an environment does much to simplify software certification.

Compilers are fundamental to software development, formal verification tools are well established for building trust in hardware designs, and formal verification is increasingly gaining traction in the world of software. The importance of compilers and verifiers mean that bugs in these tools are potentially very serious. I will give an overview of the state-of-the-art in techniques for using randomized testing - also known as “fuzzing” - for finding bugs in compilers and verifiers automatically, focusing on three case studies arising from work my research group and collaborators: automated testing of graphics shader compilers (which led to the formation of a startup company, GraphicsFuzz, that was acquired by Google), automated testing of a verifying compiler for the Dafny programming language, and automated testing of equivalence checking tools for hardware designs.

The area of formal verification of protocols has gained substantial importance in the recent years. The research results and subsequent applications have amply demonstrated that the formal verification tools have indeed helped correct the protocols even after being standardized. However, the standard protocol verification tools and techniques do not verify the security properties of a cryptographic protocol. This has resulted in the emergence of the security protocol verifiers to fill the need. In this paper, taking the two popular security verification tools namely Scyther and ProVerif as the basis, we identify a few security protocols and implement them in both Scyther and ProVerif, to aptly evaluate the tools, in terms of the security properties of the selected protocols. In the process, we not only characteristically present a comparative evaluation of the two tools, but also reveal interesting security properties of the protocols selected, showing their strengths and weaknesses. To the best of our knowledge, this is a unique attempt to juxtapose and evaluate the two verification tools using the selected security protocols.

내장형 소프트웨어 기술이 항공 및 방위산업과 같은 안전-필수 시스템에 적용됨에 따라 보다 높은 소프트웨어의 신뢰성이 요구되고 있다. 그 중에서 소프트웨어의 무결성은 주로 정적 분석 도구를 이용해 검증이 이뤄지고 있으며 최근에 개발된 정적 분석 도구는 수학적인 분석 방법을 통해 코드의 무결성을 평가하고 있다. 본 연구에서는 정형 검증 도구인 Polyspace를 이용해 자동코드의 결함을 검출하고, 코딩규칙의 준수 여부를 검증하였다. 검증된 결과를 바탕으로 결함을 가진 제어법칙 모델을 수정하여 코드 생성 이전의 원천적인 결함을 제거 가능함을 확인하였고 FBW 헬리콥터 제어법칙 자동생성코드의 무결성을 확보 할 수 있었다. Recently the embedded software has been widely applied to the safety-critical systems in aviation and defense industries, therefore, the higher level of reliability, availability and fault tolerance has become a key factor for its implementation into the systems. The integrity of the software can be verified using the static analysis tools. And recent developed static analysis tool can evaluate code integrity through the mathematical analysis method. In this paper we detect the autocode error and violation of coding rules using the formal verification tool, Polyspace(R). And the fundamental errors on the flight control law model have been detected and corrected using the formal verification results. As a result of verification process, FBW helicopter control law autocode can ensure code integrity.

We use Iris, an implementation of concurrent separation logic in the Coq proof assistant, to verify two queue data structures used for inter-process communication in an operating system under development. Our motivations are twofold. First, we wish to leverage formal verification to boost confidence in a delicate piece of industrial code that was subject to numerous revisions. Second, we aim to gain information on the cost-benefit tradeoff of applying a state-of-the-art formal verification tool in our industrial setting. On both fronts, our endeavor has been a success. The verification effort proved that the queue algorithms are correct and uncovered four algorithmic simplifications as well as bugs in client code. The simplifications involve the removal of two memory barriers, one atomic load, and one boolean check, all in a performance-sensitive part of the OS. Removing the redundant boolean check revealed unintended uses of uninitialized memory in multiple device drivers, which were fixed. The proof work was completed in person months, not years, by engineers with no prior familiarity with Iris. These findings are spurring further use of verification at Meta.

Projected control graph for computing relevant program behaviors