Generic Methodology for Formal Verification of UML Models

<span lang="EN-US">Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers’ expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java-based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.</span>

Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers' expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.

The emerging Die-stacking technology enables DRAM to be used as a cache to break the “Memory Wall” problem. Recent studies have proposed to use DRAM as a victim cache in both CPU and GPU memory hierarchies to improve performance. DRAM caches are large in size and, hence, when realized as a victim cache, non-inclusive design is preferred. This non-inclusive design adds significant differences to the conventional DRAM cache design in terms of its probe, fill, and writeback policies. Design and verification of a victim DRAM cache can be much more complex than that of a conventional DRAM cache. Hence, without rigorous modeling and formal verification, ensuring the correctness of such a system can be difficult. The major focus of this work is to show how formal modeling is applied to design and verify a victim DRAM cache. In this approach, we identify the agents in the victim DRAM cache design and model them in terms of interacting state machines. We derive a set of properties from the specifications of a victim cache and encode them using Linear Temporal Logic. The properties are then proven using symbolic and bounded model checking. Finally, we discuss how these properties are related to the dataflow paths in a victim DRAM cache.

Considering diverse scenarios in urban traffic, the safety assessment of the decision-making process in automated driving is of great concern for years. And the difficulties of assessing safety lies in the computation of massive spatio-temporal data, the classification of scenarios, and the representation of the uncertainty in the environment with mixed traffic of manned and automated driving. Formal methods are often advocated as the way of increasing confidence in the safety-critical systems via its rigorous mathematical logic. Thus, we propose an assessment scheme which involves: i) the abstract model for decision-making, ii) characterization of composable scenarios, and iii) a corresponding formal verification method to assess safety. The abstract model captures features from the real-time observation and the estimation of the feasible driving alternatives of the surrounding vehicles, as the scenario is regarded as the dynamic evolution of the spatio-temporal data in the static road geometry over time. These features enable the specification and reasoning of the spatial guard conditions and safety properties, and also contribute to the connection and composability of the scenarios. Due to our scenario-based model verification method, we can assess the safety of decisions in scenario transitions by quantitative verification on the probability of the satisfaction of safety property through mapping from our approach to UPPAAL SMC. For illustration, case studies in the fundamental scene structures and the multi-lane roundabout are introduced.

Spatial aspects of computation are increasingly relevant in Computer Science, especially in the field of collective adaptive systems and when dealing with systems distributed in physical space. Traditional formal verification techniques are well suited to analyse the temporal evolution of concurrent systems; however, properties of space are typically not explicitly taken into account. This tutorial provides an introduction to recent work on a topology-inspired approach to formal verification of spatial properties depending upon (physical) space. A logic is presented, stemming from the tradition of topological interpretations of modal logics, dating back to earlier logicians such as Tarski, where modalities describe neighbourhood. These topological definitions are lifted to the more general setting of closure spaces, also encompassing discrete, graph-based structures. The present tutorial illustrates the extension of the framework with a spatial surrounded operator, leading to the spatial logic for closure spaces SLCS, and its combination with the temporal logic CTL, leading to STLCS. The interplay of space and time permits one to define complex spatio-temporal properties. Both for the spatial and the spatio-temporal fragment efficient model-checking algorithms have been developed and their use on a number of case studies and examples is illustrated.

A vertex centric parallel algorithm for linear temporal logic model checking in Pregel

The Unified Modeling Language UML is well-suited for the design of real-time systems. In particular the design of dynamic system behaviors is supported by interaction diagrams and statecharts. Real-time aspects of behaviors can be described by time constraints. The semantics of the UML, however, is non-formal. In order to enable formal design verification, we therefore propose to complement the UML based design by additional formal models which refine UML diagrams to precise formal models. We apply the formal specification technique cTLA which is based on L. Lamport's Temporal Logic of Actions, TLA. In particular cTLA supports modular definitions of process types and the composition of systems from coupled process instances. Since process composition has superposition character each process system has all of the relevant properties of its constituting processes. Therefore mostly small subsystems are sufficient for the verification of system properties and it is not necessary to use complete and complex formal system models. We present this approach by means of an example and also exemplify the formal verification of its hard real-time properties.

Ethereum 2.0 stands out as a progressive decentralized blockchain platform, drawing attention for its security, scalability, and flexibility. Central to Ethereum 2.0 is the Beacon Chain, serving as the cornerstone managing validator rewards, penalties, attestations, and slashing mechanisms. Rewards and Penalties Mechanism (RPM) is of particular importance within the Beacon Chain as it includes validator balances based on their attestation behavior. Despite the critical role of RPM in maintaining the reliability and security of the Beacon Chain, the absence of formal verification work employing model checking is notable. Therefore, this research endeavors to fill this gap by employing formal verification technique to assess the RPM’s behavior concerning Friendly Finality Gadget (FFG) attestations. Utilizing Process Meta Language (PROMELA), a formal model of the RPM is specified, encompassing safety and liveness properties crucial for its robust functioning. The properties, including invalid attestation, integrity, fairness, availability, failure to attest, and inactivity imposition, are formalized through Linear Temporal Logic (LTL). Subsequently, the formal model alongside the specified properties is subjected to verification using the SPIN model checker. The properties are analyzed with respect to verification time, states visited, and memory usage. The outcome of this research contributes to a rigorous analysis of the RPM’s behavior. This work not only enhances an understanding of Beacon Chain’s operational dynamics but also underscores the importance of formal verification in ensuring the reliability and security of blockchain protocols.

For quite some time, the Unified Modeling Language (UML) has been adopted by designers of safety critical control systems such as automotive and aviation control. This has led to an increased emphasis on setting up a validation flow over UML that can be used to guarantee the correctness of UML models. In this paper, we propose a dynamic Assertion-based verification (ABV) framework for validation of UML Statecharts over the Rhapsody platform of I-logix. We present an extension of Linear Temporal Logic (LTL), named Action-LTL that allows assertions to be specified over data attributes and events of UML models. We present a methodology for automatic generation of Rhapsody Statecharts from Action-LTL specifications. These generated Statecharts are added as simulation observers to an existing UML model to detect specification violations during simulation. In view of the capacity limitations of existing formal assertion-based verification tools, we believe that our methods are of immediate practical value to the UML-based design community.

For human-robot teams that operate in space, safety and robustness are paramount. In situations such as habitat construction, station inspection, or cooperative exploration, incorrect assumptions about the environment or task across the team could lead to mission failure. Thus it is important to resolve any ambiguity about the mission between teammates before embarking on a commanded task. The safeguards guaranteed by formal methods can be used to synthesize correct-by-construction reactive controllers for a robot using Linear Temporal Logic. If a robot fails to synthesize a controller given an instruction, it is clear that there exists a logical inconsistency in the environmental assumptions and/or described interactions. These specifications however are typically crafted in a language unique to the verification framework, requiring the human collaborator to be fluent in the software tool used to construct it. Furthermore, if the controller fails to synthesize, it may prove difficult to easily repair the specification. Language is a natural medium to generate these specifications using modern symbol grounding techniques. Using language empowers non-expert humans to describe tasks to robot teammates while retaining the benefits of formal verification. Additionally, dialogue could be used to inform robots about the environment and/or resolve any ambiguities before mission execution. This paper introduces an architecture for natural language interaction using a symbolic representation that informs the construction of a specification in Linear Temporal Logic. The novel aspect of this approach is that it provides a mechanism for resolving synthesis failure by hypothesizing corrections to the specification that are verified through human-robot dialogue. Experiments involving the proposed architecture are demonstrated using a simulation of an Astrobee robot navigating in the International Space Station.

This letter proposes a learning-based bounded synthesis for a semi-Markov decision process (SMDP) with a linear temporal logic (LTL) specification. In the product of the SMDP and the deterministic <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$K$ </tex-math></inline-formula> -co-Büchi automaton ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\text{d}K$ </tex-math></inline-formula> cBA) converted from the LTL specification, we learn both the winning region of satisfying the LTL specification and the dynamics therein based on reinforcement learning and Bayesian inference. Then, we synthesize an optimal policy satisfying the following two conditions. (1) It maximizes the probability of reaching the wining region. (2) It minimizes a long-term risk for the dwell time within the winning region. The minimization of the long-term risk is done based on the estimated dynamics and a value iteration. We show that, if the discount factor is sufficiently close to one, the synthesized policy converges to the optimal policy as the number of the data obtained by the exploration goes to the infinity.

First order Büchi automata and their application to verification of LTL specifications

This article continues the series of works on the development and verification of control programs based on LTL (linear temporal logic) specifications of a special type. Previously, a declarative LTL specification was proposed, which allows describing the behavior of control programs and building program code based on it in the imperative ST language for programmable logic controllers (PLCs). This LTL specification can be directly verified for compliance with specified temporal properties by the model checking method using the nuXmv symbolic verification tool. In general, it is not required to translate the LTL formulas of the specification into another formalism—an SMV specification (code in the input language of the nuXmv tool). The aim of this study is to explore alternative ways of representing the behavioral model of a program that conforms to a declarative LTL specification during its verification using the nuXmv tool. In this article, we transform the declarative LTL specification into various SMV specifications with accompanying changes of formulation of the verification problem, which leads to a significant reduction in time costs when checking temporal properties by using the nuXmv tool. The acceleration of verification is due to the reduction of the state space of the model being verified. The SMV specifications obtained as a result of the proposed transformations specify identical or bisimulational-equivalent transition systems, ensuring the same verification results when replacing one SMV specification with another.

Formal Verification and Validation of UML 2.0 Sequence Diagrams using Source and Destination of Messages

The chapter presents a description of a novel modelling language called Alvis defined for the design of concurrent especially real-time systems. Alvis combines the advantages of formal methods and practical modelling languages. Based on CCS and XCCS process algebras, Alvis utilizes flexible graphical modelling of interconnections among agents and a high level programming language used for the description of agents behaviour. Each agent in a model can use rule-based systems to support its decisions. A small set of language statements and graphical concepts make Alvis easy to learn and use. The possibility of a formal model verification, makes Alvis a formal modelling language. Alvis modelling environment creates in parallel a model of the considered system and a labelled transition system (LTS graph) that is its formal representation. The LTS graph can be formally verified with the CADP toolbox. A survey of main Alvis features from practical point of view, is given in the chapter.