Model checker aided design of a controller for a wafer scanner

Although Python is one of the most widely used programming languages, and it is a foundation for a variety of parallel and distributed computing frameworks, it still lacks an applicable and reliable software transactional memory. In this paper, we present an approach to formal verification of a Python Software Transactional Memory (PSTM) solution using UPPAAL tool. The aims are (i) to apply a formal verification process to a real STM implementation in order to derive a faithful STM model based on a PSTM design and (ii) to use developed PSTM model for automated machine-checked formal verification of core system properties such as safety and liveness using a model checker tool. Firstly, an architecture of PSTM solution is introduced. Secondly, formalization and a PSTM system model are analyzed. Finally, core PSTM system's properties are verified, namely safety, liveness, and reachability. Utilizing a UPPAAL's model checker tool it is successfully verified that the PSTM system model satisfies each of the three formerly mentioned properties.

Model checking is a systematic way of checking the absence of errors in a distributed system, i.e., assessing the functional requirements in a distributed system. However, there are certain challenges in this field, e.g., developing true abstract models and on their basis generalizing/guranteeing results, limited capacity of model checking tools and computational resources, identification of all requirements and their accurate specifications, etc. To understand and face such challenges, it is necessary to apply the prominent model checking techniques to different distributed systems designed for different communication models. In this thesis this challenge is accepted and resultantly encountered issues are discussed/addressed. The results reported are sufficient for advocating the need for applying model checking techniques as debugging. Therefore, we report bugs and the propose fixes but for ambiguous algorithms, we reconstruct them. We model check both fixed and reconstructed algorithms. We assess the following protocols: • Accelerated heartbeat protocols, • Consensus protocols in asynchronous distributed systems, • Group membership protocols and • Efficient algorithms to implement failure detectors in partially synchronous systems. We found that the accelerated heartbeat protocols proposed in [M.G. Gouda and T.M. McGuire, Accelerated Heartbeat Protocols, Proc. Of ICDCS’98], violated some natural and essential properties. We proved the results by giving counterexamples and developed the techniques to address the time-triggered events in mCRL2 and investigated the correct time bounds for all the protocols. Regarding consensus problem, we proved the correctness of the proposed algorithms where the failure detectors are unreliable (i.e., failure detectors may make mistakes). These algorithms are proposed in [T. Deepak Chandra and S. Toueg, Unreliable Failure Detectors for Reliable Distributed Systems, J. ACM, 1996 ]. For the group membership protocols proposed in [Y. Amir, D. Dolev, S. Kramer and D. Malki, Membership Algorithms for Multicast Communication Groups, Springer-Verlag, 1992], we found that the original specifications and the text explaining the protocols can be interpreted in different ways and even some natural interpretations contradict each other. Our formalization with respect to different interpretations showed the violation of claimed properties. So to resolve the ambiguities, we reconstructed the protocols and model-checked them. For analyzing the algorithms proposed in [M. Larrea, S. Arevalo and A.Fernndez, Efficient Algorithms to Implement Unreliable Failure Detectors in Partially Synchronous Systems, Proc. of DISC’99 ], we applied symmetry reduction techniques. We found that every algorithm encounters a deadlock if there is a bounded (yet arbitrarily large) buffer in the communication channel between a pair of nodes. We propose fixes for deadlock avoidance and model check the proposed algorithm in UPPAAL, FDR2 and MCRL2. We also present a comparison of these three tools for model checking one of the given four protocols.

We present a methodology for the synthesis of controllers, which exploits (explicit) model checking techniques. That is, we can cope with the systematic exploration of a very large state space. This methodology can be applied to systems where other approaches fail. In particular, we can consider systems with an highly non-linear dynamics and lacking a uniform mathematical description (model). We can also consider situations where the required control action cannot be specified as a local action, and rather a kind of planning is required. Our methodology individuates first a raw optimal controller, then extends it to obtain a more robust one. A case study is presented which considers the well known truck-trailer obstacle avoidance parking problem, in a parking lot with obstacles on it. The complex non-linear dynamics of the truck-trailer system, within the presence of obstacles, makes the parking problem extremely hard. We show how, by our methodology, we can obtain optimal controllers with different degrees of robustness.KeywordsController SynthesisController OptimizationModel CheckingNonlinear Systems

Web services are a very appropriate communication mechanism to perform distributed business processes among several organizations. These processes should be reliable, because a failure in them can cause high economic losses. In this paper, we present an approach to verify Web Service applications with time restrictions which are defined by BPEL4WS using model checking techniques. We introduce a formalism, called WS Timed Automata, to capture the timed behavior of the web service applications, and methods to translate description of web service applications written in BPEL4WS to WS Timed Automata is proposed in this paper. The formal verification tool Uppaal is used to verify related properties of the system. A particular case study, an airline travel reservation system is taken as illustration.

Proven model checking technique, i.e., the model checker applied to the formal specification created on the basis of the Temporal Logic of Actions has been considered. Two implementations of named technique have been investigated: model checking by way of exhaustive breadth-first search through the state space and by way of depth-first search. As a case study, the safety-critical domain scenario has been considered. To this end, domain-specific block-diagram has been used as an input data. It has been demonstrated that, depending on the complexity of block-diagram, the outcome of given technique implementation varies significantly - in terms of related time costs. With respect to named case study, an iterative approach to model checking technique application has been proposed - based on both breadth-first and depth-first search techniques combination.

Cyber-Physical Systems (CPS) are subject to platform-given resource constraints upon such resources as CPU, memory, and bus, in executing their functionalities. This causes the behavior of a verified application to deviate from its intended timing behavior when the application is integrated on a specific platform. For the same reason, a configuration of platforms cannot be independent from applications in most cases. This paper proposes a new analysis framework of real-time systems where an application and a platform can be analyzed in a fully independent way such that not only the application but also the platform once verified can be exploited by various applications. The dependent behaviors of application and platform are also analyzed by exploiting their individual models transformed from their independent models. To the end, we provide a highly configurable platform model that can be parameterized by various resource configurations. For analysis of application and platform models, we use two model checking techniques: symbolic and statistical model checking techniques of Uppaal. Our framework is demonstrated by a case study where a turn indicator system is analyzed with respect to various platform resource constraints.

Model checking (Baier and Katoen in Principles of model checking, MIT Press, Cambridge, 2008; Clarke et al. in Model checking, MIT Press, Cambridge, 2001) is an automatic technique to formally verify that a given specification of a concurrent system meets given functional properties. Its use has been demonstrated many times over the years. Key characteristics that make the method so appealing are its level of automaticity, its ability to determine the absence of errors in the system (contrary to testing techniques) and the fact that it produces counter-examples when errors are detected, that clearly demonstrate not only that an error is present, but also how the error can be produced. The main drawback of model checking is its limited scalability, and for this reason, research on reducing the computational effort has received much attention over the last decades. Besides the verification of qualitative functional properties, the model checking technique can also be applied for other types of analyses, such as planning and the verification of quantitative properties. We briefly discuss several contributions in the model checking field that address both its scalability and its applicability to perform planning and quantitative analysis. In particular, we introduce six papers selected from the 23rd International SPIN Symposium on Model Checking Software (SPIN 2016).

**Read paper on the following link:** https://ifaamas.org/Proceedings/aamas2022/pdfs/p1228.pdf **Abstract:** Formal models of multi-robot behaviour are fundamental to planning, simulation, and model checking techniques. However, existing models are invalidated by strong assumptions that fail to capture execution-time multi-robot behaviour, such as simplistic duration models or synchronisation constraints. In this paper we propose a novel multi-robot Markov automaton formulation which models asynchronous multi-robot execution in continuous time. Robot dynamics are captured using phase-type distributions over action durations. Moreover, we explicitly model the effects of robot interactions, as they are a key factor for the duration of action execution. We also present a scalable discrete-event simulator which yields realistic statistics over execution-time robot behaviour by sampling through the Markov automaton. We validate our model and simulator against a Gazebo simulation in a range of multi-robot navigation scenarios, demonstrating that our model accurately captures high-level multi-robot behaviour.

In the semiconductor manufacturing process, it is important to identify wafers on which faults have occurred or will occur to avoid unnecessary and costly further processing and physical inspections. This issue can be addressed by formulating the faulty wafer detection problem as a predictive modeling task, in which the process parameters/measurements and subsequent inspection results concerning the faults comprise the input and output variables at the wafer level, respectively. To achieve improved predictive performance, this paper presents a joint modeling method that incorporates classification and regression tasks into a single prediction model. Given the output variables in both binary and continuous forms, the prediction model simultaneously considers both the classification and regression tasks to complement each other, where each task predicts the binary and continuous output variables, respectively. The outputs from these two tasks are combined to predict whether a wafer is faulty. The entire model is implemented as a neural network, and is trained by optimizing a single objective function. The effectiveness of the model is demonstrated with a case study using real-world data from a semiconductor manufacturer.

The Functional Mock-up Interface (FMI) is an industry standard which enables co-simulation of complex heterogeneous systems using multiple simulation engines. In this paper, we show how to use FMI in order to co-simulate hybrid systems modeled in the model checkers SPACEEX and UPPAAL. We show how FMI components can be automatically generated from SPACEEX and UPPAAL models. We also validate the cosimulation approach by comparing the simulations of a room heating benchmark in two cases: first, when a single model is simulated in SPACEEX; and second, when the model is split in two submodels, and co-simulated using SPACEEX and UPPAAL. Finally, we perform a measurement experiment on a composite model to show a potential for statistical model checking using stochastic co-simulations.

The formal verification of a real-time system requires either a proof theoretic or model theoretic approach. Both being applicable to a model of the proposed behavior of the concurrent real-time system. This paper evaluates the use model checking and timed automata by their application to an adaptation of the Production Cell case study. The Uppaal tool is used in this evaluation. The modeling aspects were found to be straightforward, but to accomplish the necessary model checking required some knowledge of the underlying process. Nevertheless, the conclusion of the study is that these techniques are generally applicable and be can be undertaken in an engineering context without detailed domain knowledge of the model checking technique.

Conventional testing methods often fail to detect hidden flaws in complex embedded software such as device drivers or file systems. This deficiency incurs significant development and support/maintenance cost for the manufacturers. Model checking techniques have been proposed to compensate for the weaknesses of conventional testing methods through exhaustive analyses. Whereas conventional model checkers require manual effort to create an abstract target model, modern software model checkers remove this overhead by directly analyzing a target C program, and can be utilized as unit testing tools. However, since software model checkers are not fully mature yet, they have limitations according to the underlying technologies and tool implementations, potentially critical issues when applied in industrial projects. This paper reports our experience in applying Blast and CBMC to testing the components of a storage platform software for flash memory. Through this project, we analyzed the strong and weak points of two different software model checking technologies in the viewpoint of real-world industrial application-counterexample-guided abstraction refinement with predicate abstraction and SAT-based bounded analysis.

Synchronizing Decentralized Control Loops for Overall Performance Enhancement: A Youla Framework Applied to a Wafer Scanner

This paper reports on an image processing algorithm for simultaneous photometric correction and defect detection in semiconductor manufacturing. We note that this problem has some resemblance to change detection in real time image analysis. In particular, the changes between the two images are analogous to the defects in our machine vision system. We therefore applied several detection methods and examined their applicability to defect detection. We first performed a sub-pixel image registration, using a phase correlation method together with a singular value decomposition factorization of the correlation matrix to compute the necessary alignment. We then tested a few change detection methods, including the shading model, derivative model, statistical change detection, linear dependence change detector and Wronskian change detection model. We subjected this system to our collection of raw data acquired from an industrial system, and we evaluated the different methods with respect to the detection accuracy, robustness, and speed of the system. We have promising results at this stage, especially in detecting the blob and line defects that are most commonly found, and when the lighting variation is within a certain threshold.

Chapter 10 - Harmonic load flow applications for industrial power systems design