GMC: A performance model checker for concurrent systems

Parameterized model checking is the problem of deciding if a given formula holds irrespective of the number of participating processes. A standard approach for solving the parameterized model checking problem is to reduce it to model checking finitely many finite-state systems. This work considers the theoretical power and limitations of this technique. We focus on concurrent systems in which processes communicate via pairwise rendezvous, as well as the special cases of disjunctive guards and token passing; specifications are expressed in indexed temporal logic without the next operator; and the underlying network topologies are generated by suitable formulas and graph operations. First, we settle the exact computational complexity of the parameterized model checking problem for some of our concurrent systems, and establish new decidability results for others. Second, we consider the cases where model checking the parameterized system can be reduced to model checking some fixed number of processes, the number is known as a cutoff. We provide many cases for when such cutoffs can be computed, establish lower bounds on the size of such cutoffs, and identify cases where no cutoff exists. Third, we consider cases for which the parameterized system is equivalent to a single finite-state system (more precisely a Büchi word automaton), and establish tight bounds on the sizes of such automata.

Graphical user interfaces (GUIs) are ubiquitous in real-world software and a notorious source of bugs that are difficult to catch through software testing. Model checking has been used to prove the absence of certain kinds of bugs, but model checking works on an abstract model of the GUI application, which might be inconsistent with its implementation. We present a library for developing directly verified, state-dependent GUI applications in the dependently typed programming language Agda. In the library, the type of a GUI's controller depends on a specification of the GUI itself, statically enforcing consistency between them. Arbitrary properties can be defined and proved in terms of user interactions and state transitions. Our library connects to a custom-built Haskell back-end for declarative vector-based GUI elements. Compared to an earlier version of our library built on an existing imperative GUI framework, the more declarative back-end supports simpler definitions and proofs. As a practical application of our library to a safety-critical domain, we present a case study developed in cooperation with the Medical University of Vienna. The case study implements a healthcare process for prescribing anticoagulants, which is highly error-prone when followed manually. Our implementation generates GUIs from an abstract description of a data-aware business process, making our approach easy to reuse and adapt to other safety-critical processes. We prove medically relevant safety properties about the executable GUI application, such as that given certain inputs, certain states must or must not be reached.

Model Checking Temporal Aspects of Inconsistent Concurrent Systems Based on Paraconsistent Logic

A Compositional Automata-based Approach for Model Checking Multi-Agent Systems

Directed model checking is a well-established technique to efficiently tackle the state explosion problem when the aim is to find error states in concurrent systems. Although directed model checking has proved to be very successful in the past, additional search techniques provide much potential to efficiently handle larger and larger systems. In this work, we propose a novel technique for traversing the state space based on interference contexts. The basic idea is to preferably explore transitions that interfere with previously applied transitions, whereas other transitions are deferred accordingly. Our approach is orthogonal to the model checking process and can be applied to a wide range of search methods. We have implemented our method and empirically evaluated its potential on a range of non-trivial case studies. Compared to standard model checking techniques, we are able to detect subtle bugs with shorter error traces, consuming less memory and time.

Formal methods apply algorithms based on mathematical principles to enhance the reliability of systems. It would only be natural to try to progress from verification, model checking or testing a system against its formal specification into constructing it automatically. Classical algorithmic syn-thesis theory provides interesting algorithms but also alarming high complexity and undecidability results. The use of genetic programming, in combination of model checking and testing, provides a powerful heuristic to synthesize programs. The method is not completely automatic, as it is fine tuned by a user that sets up the specification and parameters. It also does not guarantee to always suc-ceed and converge towards a solution that satisfies all the required properties. However, we applied it successfully on quite nontrivial examples and managed to find solutions to hard programming chal-lenges, as well as to improve and to correct code. We describe here several versions of our method for synthesizing sequential and concurrent systems. 1

This work presents the Digital-Systems Verifier (DSVerifier), which is a verification tool developed for digital systems. In particular, DSVerifier employs the bounded model checking technique based on satisfiability modulo theories (SMT) solvers, which allows engineers to verify the occurrence of design errors, due to the finite word-length approach employed in fixed-point digital filters and controllers. This tool consists in an additional module for the efficient SMT-based context-bounded model checker and presents command-line and graphical user interface (GUI) versions. Indeed, the GUI version is essential for reporting property violations, together with associated counterexamples. DSVerifier is implemented in C/C\(++\) and uses JavaFX for providing GUI support.KeywordsBounded Model Checking (BMC)Digital System SpecificationBMC ToolSatisfiability Modulo Theories (SMT)Property ViolationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Event-driven systems maintain an ongoing dialog with their environment. Examples include: distributed programs, where each process reacts to received messages by performing computation and sending messages to peers; graphical user interfaces (GUI), where the interface software and the underlying application react to user inputs and web-based applications, where presentation, business logic and storage tier functionality react to user inputs and response from other web-based services. Such applications are difficult to test because the set of possible interaction sequences between the system and its environment can be very large and governed by complex constraints. The exhaustive nature of software model checking techniques offers hope for effectively validating such systems, however, they only work for closed systems. Previously, the authors developed the Bandera Environment Generator, which given an open system, called a unit under analysis, closes it with a model of its environment. The authors' previous work on environment generation has focused on developing broadly applicable mechanisms for modelling environment behaviour. The generality of this approach often makes it difficult to produce environment models that enable precise and efficient system analysis. The authors' experience shows that by exploiting information about the application domain, generated environments can be made both more precise and more efficient for model checking. This study presents the concept of domain-specific environment generation, details techniques for customising environment generation for the domain of event-driven software, and assesses those techniques on the domains of GUI and web-based applications.

With the growing usage and migration of interactive applications and systems into today’s environment, the significance of the graphical user interfaces (GUIs) increases as they act as the gates into using systems efficiently. Therefore, extensive efforts are spent to enhance the usability of the GUIs. However, most of the works focus on testing the functional properties of applications’ GUIs rather than nonfunctional features such as performance. For this reason, it is worthwhile to assess the performance of various GUI components at runtime. In this paper, the most popular programming languages used to create GUI based applications namely, Java and C# were compared experimentally to evaluate their performance in terms of the creation and manipulation of GUI components/controls. The experimental results of this study, which is based on 32 testing scenarios, showed that Java outperformed C# in all test scenarios. This might be because of the “HotSpot” performance engine that Java uses. This study is useful for developers to get insights into the performance of different GUI components provided by different programming languages. Also, it helps them to choose the right programming language for their GUI based applications hence enhance the overall applications’ performance and user satisfaction.

Software testing has become an important phase in software applications’ lifecycle. Graphical User Interface (GUI) components can be found in a large number of desktops and web applications and also in a wide variety of mobile devices. In the last years GUIs have become more and more complex and interactive, their testing process requiring an interaction with the GUI components, mainly by generating mouse, keyboard and touch events. Given their increased importance, GUIs verification for correctness contributes to the establishment of the correct functionality of the corresponding software application. The current research on GUI testing methodologies primarily focuses on automated testing. This paper presents EvoGUITest, a novel automated GUI testing framework based on evolutionary algorithms which tests the GUI independently from the application code itself. The framework is designed for testing GUIs of web applications. Results have been compared, based on specific metrics, with others existing frameworks.

Trigger-action programming (TAP) is a popular end-user programming framework that can simplify the Internet of Things (IoT) automation with simple trigger-action rules. However, it also introduces new security and safety threats. A lot of advanced techniques have been proposed to address this problem. Rigorously reasoning about the security of a TAP-based IoT system requires a well-defined model and verification method both against rule semantics and physical-world features, e.g., concurrency, rule latency, extended action, tardy attributes, and connection-based rule interactions, which has been missing until now. By analyzing these features, we find 9 new types of rule interaction vulnerabilities and validate them on two commercial IoT platforms. We then present TAPInspector, a novel system to detect these interaction vulnerabilities in concurrent TAP-based IoT systems. It automatically extracts TAP rules from IoT apps, translates them into a hybrid model by model slicing and state compression, and performs semantic analysis and model checking with various safety and liveness properties. Our experiments corroborate that TAPInspector is practical: it identifies 533 violations related to rule interaction from 1108 real-world market IoT apps and is at least 60000 times faster than the baseline without optimization.

On divergence-sensitive weak probabilistic bisimilarity

PROMELA is a high level modeling language for model checking purpose. PROMELA model can be checked using SPIN (Simple PROMELA Interpreter) model checker to ensure formally some specifications hold in the model. However, PROMELA does not have formal and clear semantics. It is interpreted under SPIN implementation only and thus is bounded into SPIN. With high-level language it has, PROMELA has gain fame in model checker world due to its easiness to capture process model using high level language. Describing PROMELA formal semantic is a good way to broaden PROMELA usage. One of PROMELA feature is the ability to model concurrent processes, in which the concurrent process may not start from the same time point. This feature, called dynamic process creation, is essential to be noticed, to ensure that state-transition of PROMELA model is correct. Dynamic process creation in PROMELA should be defined formally, we use Labeled Transition Systems (LTSs) to describe formal semantic of PROMELA dynamic process creation.

Finite transition systems play a central role as formal models for reactive and concurrent systems. A promising technique for automatically verifying transition systems is model checking. In the model-theoretic approach one mechanically determines whether a system ts meets a specification f (expressed as a formula of some temporal logic) by checking whether ts is a model for f. The authors present a kernel specification formalism BTL. They discuss efficient (linear-time) global and local model checking algorithms for BTL. The global algorithm will compute all states that satisfy a given formula whereas the local algorithm will only check a formula for one state (typically the initial system state). Both algorithms run in time linear in the size of the transition system and the length of the formula. >

A well‐known problem in the verification of concurrent systems based on model checking is state explosion: concurrent systems are often represented by automata with a prohibitive number of states. A reduction technique to reduce state explosion in deadlock checking is presented. The method is based on an automatic syntactic simplification of a calculus of communicating systems (CCS) specification, which keeps the parts of the program structure that may lead to a deadlock and deletes the other parts. Copyright © 2002 John Wiley & Sons, Ltd.