Model checking CML: tool development and industrial applications

The chapter presents a description of a novel modelling language called Alvis defined for the design of concurrent especially real-time systems. Alvis combines the advantages of formal methods and practical modelling languages. Based on CCS and XCCS process algebras, Alvis utilizes flexible graphical modelling of interconnections among agents and a high level programming language used for the description of agents behaviour. Each agent in a model can use rule-based systems to support its decisions. A small set of language statements and graphical concepts make Alvis easy to learn and use. The possibility of a formal model verification, makes Alvis a formal modelling language. Alvis modelling environment creates in parallel a model of the considered system and a labelled transition system (LTS graph) that is its formal representation. The LTS graph can be formally verified with the CADP toolbox. A survey of main Alvis features from practical point of view, is given in the chapter.

This paper discusses a Unified Modelling Language (UML) based formal verification methodology for early error detection in the model-based software development cycle. Our approach proposes a UML-based formal verification process utilising functional and behavioural modelling artifacts of UML. It reinforces these artifacts with formal model transition and property verification. The main contribution is a UML to Labelled Transition System (LTS) Translator application that automatically converts UML Statecharts to formal models. Property specifications are derived from system requirements and corresponding Computational Tree Logic (CTL)/Linear Temporal Logic (LTL) model checking procedure verifies property entailment in LTS. With its ability to verify CTL and LTL specifications, the methodology becomes generic for verifying all types of embedded system behaviours. The steep learning curve associated with formal methods is avoided through the automatic formal model generation and thus reduces the reluctance of using formal methods in software development projects. A case study of an embedded controller used in military applications validates the methodology. It establishes how the methodology finds its use in verifying the correctness and consistency of UML models before implementation.

Wireless sensor networks (WSNs) are expected to run unattendedly for critical tasks. To guarantee the correctness of WSNs is important, but highly nontrivial due to the distributed nature. In this work, we present an automatic approach to directly verify WSNs built with TinyOS applications implemented in the NesC language. To achieve this target, we firstly define a set of formal operational semantics for most of the NesC language structures for the first time. This allows us to capture the behaviors of sensors by labelled transition systems (LTSs), which are the underlying semantic models of NesC programs. Secondly, WSNs are modeled as the composition of sensors with a network topology. Verifications of individual sensors and the whole WSN become possible by exploring the corresponding LTSs using model checking. With substantial engineering efforts, we implemented this approach in the tool NesC@PAT to support verifications of deadlock-freeness, state reachability and temporal properties for WSNs. NesC@PAT has been applied to analyze and verify WSNs, with unknown bugs being detected. To the best of our knowledge, NesC@PAT is the first model checker which takes NesC language as the modeling language and completely preserves the interrupt-driven feature of the TinyOS execution model.KeywordsWireless Sensor NetworkModel CheckerOperational SemanticLinear Temporal LogicState ReachabilityThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Model checking is a technique for finding bugs in systems by systematically exploring their state spaces. We wish to extract sound models from concurrent programs automatically and check the behaviors of these models systematically. The zing project is an effort to build a flexible infrastructure to represent and model check abstractions of large concurrent software.To support automatic extraction of models from programs written in common programming languages, zing’s modeling language supports three facilities present in modern programming languages: (1) procedure calls with a call-stack, (2) objects with dynamic allocation, and (3) processes with dynamic creation, using both shared memory and message passing for communication. We believe that these three facilities capture the essence of model checking modern concurrent software.Building a scalable model-checker for such an expressive modeling language is a huge challenge. zing’s modular architecture provides a clear separation between the expressive semantics of the modeling language, and a simple view of zing programs as labeled transition systems. This separation has allowed us to decouple the design of efficient model checking algorithms from the complexity of supporting rich constructs in the modeling language. zing’s model checking algorithms have been designed to exploit existing structural abstractions in concurrent programs such as processes and procedure calls. We present two such novel techniques in the paper: (1) compositional checking of zing models for message-passing programs using a conformance theory inspired by work in the process algebra community, and (2) a new summarization algorithm, which enables zing to reuse work at procedure boundaries by extending interprocedural data-flow analysis algorithms from the compiler community to analyze concurrent programs.KeywordsModel CheckModeling LanguageProcedure CallLabel Transition SystemConcurrent ProgramThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Model checking is a systematic way of checking the absence of errors in a distributed system, i.e., assessing the functional requirements in a distributed system. However, there are certain challenges in this field, e.g., developing true abstract models and on their basis generalizing/guranteeing results, limited capacity of model checking tools and computational resources, identification of all requirements and their accurate specifications, etc. To understand and face such challenges, it is necessary to apply the prominent model checking techniques to different distributed systems designed for different communication models. In this thesis this challenge is accepted and resultantly encountered issues are discussed/addressed. The results reported are sufficient for advocating the need for applying model checking techniques as debugging. Therefore, we report bugs and the propose fixes but for ambiguous algorithms, we reconstruct them. We model check both fixed and reconstructed algorithms. We assess the following protocols: • Accelerated heartbeat protocols, • Consensus protocols in asynchronous distributed systems, • Group membership protocols and • Efficient algorithms to implement failure detectors in partially synchronous systems. We found that the accelerated heartbeat protocols proposed in [M.G. Gouda and T.M. McGuire, Accelerated Heartbeat Protocols, Proc. Of ICDCS’98], violated some natural and essential properties. We proved the results by giving counterexamples and developed the techniques to address the time-triggered events in mCRL2 and investigated the correct time bounds for all the protocols. Regarding consensus problem, we proved the correctness of the proposed algorithms where the failure detectors are unreliable (i.e., failure detectors may make mistakes). These algorithms are proposed in [T. Deepak Chandra and S. Toueg, Unreliable Failure Detectors for Reliable Distributed Systems, J. ACM, 1996 ]. For the group membership protocols proposed in [Y. Amir, D. Dolev, S. Kramer and D. Malki, Membership Algorithms for Multicast Communication Groups, Springer-Verlag, 1992], we found that the original specifications and the text explaining the protocols can be interpreted in different ways and even some natural interpretations contradict each other. Our formalization with respect to different interpretations showed the violation of claimed properties. So to resolve the ambiguities, we reconstructed the protocols and model-checked them. For analyzing the algorithms proposed in [M. Larrea, S. Arevalo and A.Fernndez, Efficient Algorithms to Implement Unreliable Failure Detectors in Partially Synchronous Systems, Proc. of DISC’99 ], we applied symmetry reduction techniques. We found that every algorithm encounters a deadlock if there is a bounded (yet arbitrarily large) buffer in the communication channel between a pair of nodes. We propose fixes for deadlock avoidance and model check the proposed algorithm in UPPAAL, FDR2 and MCRL2. We also present a comparison of these three tools for model checking one of the given four protocols.

In this paper, we adapt the abstraction refinement techniques of Clarke et al. [7] and Gulavani et al. [15] for systematic generation of model based test cases. Formal models are in general infinite state machines. We approximate such a formal model by a more abstract finite state machine. From the finite model, we obtain probable test cases through model checking, and then a guided symbolic execution is performed over the given formal model to check if this is a real test case. In case of failure, the finite abstract model is refined and the cycle is repeated. The two main results of this paper are: (a) better specification coverage is achieved, and (b) we obtain a more accurate coverage estimate. We explain our method by considering models in the specification language B.

This paper describes the application of Real-Time Maude to the formal modeling, simulation, and model checking analysis of the NORM multicast protocol standard being developed by the Internet Engineering Task Force. Because of its size and sophistication, real-time features, and the need to model and analyze subcomponents of NORM both in isolation and in combination, NORM poses a set of challenging problems for its formal specification and analysis. Our formal modeling and analysis efforts made us aware of ambiguities, inconsistencies, and cases of under-specification in the informal specification of NORM. Our work indicates that formal methods can successfully be applied by non-experts during the development of advanced Internet protocol standards.

Circus is a combination of Z, CSP, and the refinement calculus, and is based on Hoare & He's Unifying Theories of Programming. A model checker is being constructed for the language to conduct refinement checking in the style of FDR, but supported by theorem proving for reasoning about the complex states and data types that arise from the use of Z. FDR deals with bounded labelled transition systems (LTSs), but the Circus model checker manipulates LTSs with possibly infinite inscriptions on arcs and in nodes, and so, in general, the success or failure of a refinement check depends on interaction with a theorem prover. An LTS is generated from a source text using an operational interpretation of Circus; we present a Structured Operational Semantics for Circus, including both its process-algebraic and state-rich features.

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal-logic formula that specifies the behavior. The model-checking problem for the branching-time temporal logic CTL can be solved in linear running time, and model-checking tools for CTL are used successfully in industrial applications. The development of programs that must meet rigid real-time constraints has brought with it a need for real-time temporal logics that enable quantitative reference to time. Early research on real-time temporal logics uses the discrete domain of the integers to model time. Present research on real-time temporal logics focuses on continuous time and uses the dense domain of the reals to model time. There, model checking becomes significantly more complicated. For example, the model-checking problem for TCTL, a continuous-time extension of the logic CTL, is PSPACE-complete.In this paper we suggest a reduction from TCTL model checking to CTL model checking. The contribution of such a reduction is twofold. Theoretically, while it has long been known that model-checking methods for untimed temporal logics can be extended quite easily to handle discrete time, it was not clear whether and how untimed methods can handle the reset quantifier of TCTL, which resets a realvalued clock. Practically, our reduction enables anyone who has a tool for CTL model checking to use it for TCTL model checking. The TCTL model-checking algorithm that follows from our reduction is in PSPACE, matching the known bound for this problem. In addition, it enjoys the wide distribution of CTL model-checking tools and the extensive and fruitful research efforts and heuristics that have been put into these tools.KeywordsModel CheckTemporal LogicAtomic PropositionKripke StructureTemporal ReasoningThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In the development of high-assurance systems, formal modeling, analysis and verification techniques are playing an increasingly important role. In spite of significant advances, formal modeling and verification using model checking, still suffer from limited applicability. The main reason is the exponential runtime space growth exhibited, in the general case, by model checkers. We describe a less rigorous alternative to model checking. We propose an algorithm that automatically translates finite state machine models used by model checkers into a variation of AND-OR graphs. State space verification of AND-OR graphs does not suffer from state space explosion, but its exhaustive search is an NP complete problem. Hence, we demonstrate that random search of AND-OR graphs is a viable alternative to model checking, suitable for system debugging and fast analysis during system development. We support our conclusions through the studies of two models, Dekker's two process mutual exclusion algorithm and the Space Shuttle's liquid hydrogen subsystem.

Component based software engineering has been claimed as a suitable approach to improve the flexibility and reuse in software development. In this context, the Compor infrastructure provides mechanisms to promote the dynamic composition of software systems, addressing applications with support for unanticipated requirement changes. In this paper, the formal modelling and verification of the COMPOR component model is presented. Hierarchical Colored Petri Nets are used for modelling and simulation, purposing to show the correct behavior for some scenarios. Model checking is used to prove that the scenarios analyzed with simulation are correct for all possible behaviors of the model.

In this paper we propose the combination of several techniques into an agile formal development process: model-based testing, formal models, refinement of models, model checking, and test-driven development. The motivation is a smooth integration of formal techniques into an existing development cycle. Formal models are used to generate abstract test cases. These abstract tests are verified against requirement properties by means of model checking. The motivation for verifying the tests and not the model is two-fold: (1) in a typical safety-certification process the test cases are essential, not the models, (2) many common modelling tools do not provide a model checker. We refine the models, check refinement, and generate additional test cases capturing the newly added details. The final refinement step from a model to code is done with classical test-driven development. Hence, a developer implements one generated and formally verified test case after another, until all tests pass. The process is scalable to actual needs. Emphasis can be shifted between formal refinement of models and test-driven development. A car alarm system serves as a demonstrating case-study. We use Back's Action Systems as modelling language and mutation analysis for test case generation. We define refinement as input-output conformance (ioco). Model checking is done with the CADP toolbox.

Model Checking represents a mathematical method of formal verification which can prove that model satisfies its specified requirements. This article describes an approach that utilizes Function Block Diagram (FBD) models. The key benefit of this approach is the automatic transformation of the original model into a formal model which can be checked by Model Checking. In this way Model Checking can be easier integrated in the standard development process. The presented approach was developed together with the new verification process. This process can be used for the verification of safety-critical systems.

PROMELA is a high level modeling language for model checking purpose. PROMELA model can be checked using SPIN (Simple PROMELA Interpreter) model checker to ensure formally some specifications hold in the model. However, PROMELA does not have formal and clear semantics. It is interpreted under SPIN implementation only and thus is bounded into SPIN. With high-level language it has, PROMELA has gain fame in model checker world due to its easiness to capture process model using high level language. Describing PROMELA formal semantic is a good way to broaden PROMELA usage. One of PROMELA feature is the ability to model concurrent processes, in which the concurrent process may not start from the same time point. This feature, called dynamic process creation, is essential to be noticed, to ensure that state-transition of PROMELA model is correct. Dynamic process creation in PROMELA should be defined formally, we use Labeled Transition Systems (LTSs) to describe formal semantic of PROMELA dynamic process creation.

We present a thorough study of propositional dynamic logic over a variation of labeled transition systems, called accelerated labelled transition systems, which are transition systems labeled with regular expressions over action labels. We study the model checking and satisfiability decision problems. Through a notion of regular expression rewriting, we reduce these two problems to the corresponding ones of PDL in the traditional semantics (w.r.t. LTS). As for the complexity, both of problems are proved to be ExPSPACE-complete. Moreover, the program complexity of model checking problem turns out to be NLOGSPACE-complete. Furthermore, we provide an axiomatization for PDL which involves Kleene Algebra as an Oracle. The soundness and completeness are shown.