Formal Modelling of Separation Kernel Components

This paper presents research funded by European Space Agency (ESA) / European Space Research and Technology Engineering Centre (ESTEC) into the development of technology to incorporate security functions into spacecraft flight software. The security functions are derived from the time and space partitioning mechanism within the Integrated Modular Avionics (IMA) concept. ESA is establishing a software reference architecture for future avionics that consists of a layered architecture with defined interfaces and functionality, and abstraction levels per layer. The lower level layers handle the computer issues and each progressively higher layer adds increasing functionality and services up to the implementation of the flight software applications. This approach is complementary to the Multiple Independent Levels of Security (MILS) concept. The security components are added at the lowest layer in the form of a separation kernel which is responsible for enforcing the time and space partitioning of the flight software. The security components complement the safely critical elements of a separation kernel with measures to enforce the confidentiality, integrity and availability of data. The research study used the EBIOS method to establish a set of security objectives and functional requirements for flight software. Two separation kernels were selected, one commercial and the other open-source, and successfully ported to the LEON3 spacecraft processor. An attempt was then made to verify the kernels against the security functional requirements. The verification was incomplete because the kernels did not support all of the security mechanisms specified in the requirements. However the technology has been established and can be upgraded to fully provide the security functions for future flight software.

Formal verification of information flow security with dynamic policies of security-critical systems is a grand challenge. This paper presents the first effort to formally specify and verify a capability-based system model with dynamic information flow policies. We build a generic security model with dynamic security policies. In the security model, we define a set of information flow security properties and provide an inference framework for them. Based on the security model, we propose a system model for capability-based secure systems. The system model specifies critical events including system initialization, inter-domain communication, and capability management. We prove information flow security of the capability-based model by an unwinding theorem. Formal specification and security proof are carried out in the Isabelle/HOL theorem prover and could be applied to formally develop and verify the security of capability-based secure systems, such as separation kernels and secure hypervisors. To our knowledge, this is the first machine-checked proof of capability-based information security with dynamic policies.

Formal Modeling and Verification of Software Systems with Stepwise Refinement and Theorem Proving

This paper discusses a Unified Modelling Language (UML) based formal verification methodology for early error detection in the model-based software development cycle. Our approach proposes a UML-based formal verification process utilising functional and behavioural modelling artifacts of UML. It reinforces these artifacts with formal model transition and property verification. The main contribution is a UML to Labelled Transition System (LTS) Translator application that automatically converts UML Statecharts to formal models. Property specifications are derived from system requirements and corresponding Computational Tree Logic (CTL)/Linear Temporal Logic (LTL) model checking procedure verifies property entailment in LTS. With its ability to verify CTL and LTL specifications, the methodology becomes generic for verifying all types of embedded system behaviours. The steep learning curve associated with formal methods is avoided through the automatic formal model generation and thus reduces the reluctance of using formal methods in software development projects. A case study of an embedded controller used in military applications validates the methodology. It establishes how the methodology finds its use in verifying the correctness and consistency of UML models before implementation.

Component based software engineering has been claimed as a suitable approach to improve the flexibility and reuse in software development. In this context, the Compor infrastructure provides mechanisms to promote the dynamic composition of software systems, addressing applications with support for unanticipated requirement changes. In this paper, the formal modelling and verification of the COMPOR component model is presented. Hierarchical Colored Petri Nets are used for modelling and simulation, purposing to show the correct behavior for some scenarios. Model checking is used to prove that the scenarios analyzed with simulation are correct for all possible behaviors of the model.

To prepare the next generation of civil engineers to tackle 21st century challenges, engineering education must commit to deepening engineer’s social consciousness through exposure to societal problems in addition to teaching technical competencies. The National Academy of Engineering (NAE) Grand Challenges for Engineering offers a framework for exposing students to the role of a modern engineer and the complex global challenges that require engineering intervention. In response to these challenges, many U.S. engineering schools have adopted the Grand Challenge Scholars (GCS) program to educate a new generation of engineering professionals equipped to sustainably address society’s most imminent problems. This paper presents the development of a holistic rubric to assess student scholarship and inform competencies related to Grand Challenges. The rubric builds on best practices in assessment and evaluation of the five key NAE GCS program components, including 1) hands-on project/research experience, 2) interdisciplinary curriculum, 3) entrepreneurship, 4) global dimension, and 5) service-learning. The authors discuss potential applications of the rubric to evaluate course-level outcomes, including student projects from an interdisciplinary course entitled “Creatively Applying Science for Sustainability.” In the course, students work to address a societal Grand Challenge in a semester-long project and in interdisciplinary student projects that tackle Grand Challenges on an international scale. This rubric fills a literature gap in assessing 21 century global engineering skills by measuring capabilities based on five key NAE GCS program components and provides a mechanism to understand and influence the quality of student education and experiences within Grand Challenge-focused courses and programs.

The emerging Die-stacking technology enables DRAM to be used as a cache to break the “Memory Wall” problem. Recent studies have proposed to use DRAM as a victim cache in both CPU and GPU memory hierarchies to improve performance. DRAM caches are large in size and, hence, when realized as a victim cache, non-inclusive design is preferred. This non-inclusive design adds significant differences to the conventional DRAM cache design in terms of its probe, fill, and writeback policies. Design and verification of a victim DRAM cache can be much more complex than that of a conventional DRAM cache. Hence, without rigorous modeling and formal verification, ensuring the correctness of such a system can be difficult. The major focus of this work is to show how formal modeling is applied to design and verify a victim DRAM cache. In this approach, we identify the agents in the victim DRAM cache design and model them in terms of interacting state machines. We derive a set of properties from the specifications of a victim cache and encode them using Linear Temporal Logic. The properties are then proven using symbolic and bounded model checking. Finally, we discuss how these properties are related to the dataflow paths in a victim DRAM cache.

The verification of control system software is critical to a host of technologies and industries, from aeronautics and medical technology to the cars we drive. The failure of controller software can cost people their lives. This book provides control engineers and computer scientists with an introduction to the formal techniques for analyzing and verifying this important class of software. Too often, control engineers are unaware of the issues surrounding the verification of software, while computer scientists tend to be unfamiliar with the specificities of controller software. The book provides a unified approach that is geared to graduate students in both fields, covering formal verification methods as well as the design and verification of controllers. It presents a wealth of new verification techniques for performing exhaustive analysis of controller software. These include new means to compute nonlinear invariants, the use of convex optimization tools, and methods for dealing with numerical imprecisions such as floating point computations occurring in the analyzed software. As the autonomy of critical systems continues to increase—as evidenced by autonomous cars, drones, and satellites and landers—the numerical functions in these systems are growing ever more advanced. The techniques presented here are essential to support the formal analysis of the controller software being used in these new and emerging technologies.

Formal modeling and verification has been under consid-erable attraction of researchers these days. Using formal methods one can find bugs and hidden errors in different systems, codes and protocols. As formal models can detect worst case scenarios which are not possible in computer simulations and other testing techniques, they are often employed by researchers to detect flaws in security protocols. A lot of hidden errors have been detected in encryption techniques and secure routing protocols by analyzing them using formal modeling and verification. Although many tools have been developed to perform formal verification; but SPIN and UP-PAAL are most frequently used by researchers to demonstrate some previously unreported weaknesses. This paper analyzes these two model checkers in terms of learning time, ease of use and their features of modeling and verification. We later annotate our findings by applying these tools against a wire-less sensor network routing protocol. We claim that our paper can help future researchers to decide which formal modeling tool is best in a particular scenario thus saving a lot of time in decision making.

The Unified Modeling Language UML is well-suited for the design of real-time systems. In particular the design of dynamic system behaviors is supported by interaction diagrams and statecharts. Real-time aspects of behaviors can be described by time constraints. The semantics of the UML, however, is non-formal. In order to enable formal design verification, we therefore propose to complement the UML based design by additional formal models which refine UML diagrams to precise formal models. We apply the formal specification technique cTLA which is based on L. Lamport's Temporal Logic of Actions, TLA. In particular cTLA supports modular definitions of process types and the composition of systems from coupled process instances. Since process composition has superposition character each process system has all of the relevant properties of its constituting processes. Therefore mostly small subsystems are sufficient for the verification of system properties and it is not necessary to use complete and complex formal system models. We present this approach by means of an example and also exemplify the formal verification of its hard real-time properties.

The subject: This study focuses on improving the quality of Cyber-Physical System (CPS) software by eliminating incorrect usage of units of measurement and orientation in C/C++ programs. Incorrect usage often leads to critical errors that conventional systems cannot effectively prevent. Manual examination of code using dimensional and orientation analysis can detect these errors in physical equations, but these methods become impractical when dealing with complex physical computations. Objectives: As suggested by Siano, the proposed approach uses physical quantities and prefixes defined by the International System of Units and orientation operations on physical objects. The elaborated system incorporates dimensional and orientation analysis and metaprogramming techniques. The methods used are dimensional & orientational analysis and metaprogramming. The following results were obtained: ensuring consistency of the units, incorporating orientation operations into the programming model for accurately handling physical object rotations and alignments, and using Siano’s work to precisely manipulate object orientation, thereby reducing the likelihood of orientation-related errors. Checking physical dimensions and orientations during the compilation stage identifies potential software defects before code execution, thereby reducing debugging time and lowering the cost of addressing issues later in development. The elaborated system represents a crucial step towards safer and more dependable Cyber-Physical System applications. This approach allows us to identify approximately 90% of incorrect usage of program variables; additionally, it detects over 50% of erroneous operations during compilation and execution of large-scale programs in real-world conditions. Conclusions. Scientific novelty: it proposed and developed a specialized C++-type library for formal compile-time software verification of Cyber-Physical Systems software. The proposed C++-type library leverages dimensional and orientational analysis to enhance software quality, reliability, and real-time formal verification. Although the proposed method for formal verification is not tailor-made for cyber-physical objects and systems, given its primary focus on software-level concerns, it does exhibit adaptability for verifying general-purpose software that incorporates various physical parameters. This versatility extends to diverse domains such as educational, gaming, and simulation software.

Preface: Special issue on software verification and testing

Purpose The purpose of this paper is to present a formal verification method to prove the correctness of social customer relationship management (CRM)-based service composition approach. The correctness of the proposed approach is analyzed to evaluate the customer behavioral interactions for discovering, selecting and composing social CRM-based services. In addition, a Kripke structure-based verification method is presented for verifying the behavioral models of the proposed approach. Design/methodology/approach Evaluating the customer behavioral interactions using the social CRM-based service composition approach is an important issue. In addition, formal verification has an important role in assessing the social CRM-based service composition. However, model checking can be efficient as a verification method to evaluate the functional properties of the social CRM-based service composition approach. Findings The results of model checking satisfied the logical problems in the proposed behavior model analysis. In the statistical testing, the proposed URM mechanism supported the four knowledge creation process conditions. It was also shown that the percentage of state reachability in the URM with KCP conditions is higher than the URM mechanism without supporting KCP conditions. Originality/value The comparison of time and memory consumption of the model checking method shows that the social CRM-based service composition approach covers knowledge process features, which makes it an efficient method.

A Formal Composition and Interaction Model for a Web Component Platform

In this paper we present a back-annotation of timing information into a formal hardware component. The formal model is represented using timed action system with which we are able to model temporal properties of a system in addition to functional properties. We give a low-level timed action system model for a protocol processor's basic components. For these components we have corresponding synthesizable VHDL models. The timing information is obtained from the synthesized VHDL model, and the tenability of the timing is verified against the given time constraints. Time constraints are used to ensure that the timed action system model fulfills its timing obligations.