“On-the-Fly Instantiation” of Value-Passing Processes

In formal design verification, successful model checking is typically preceded by a laborious manual process of constructing design abstractions. We present a methodology for partially—and in some cases, fully—bypassing the abstraction process. For this purpose, we provide to the designer abstraction operators which, if used judiciously in the description of a design, structure the corresponding state space hierarchically. This structure can then be exploited by verification tools, and makes possible the automatic and exhaustive exploration of state spaces that would otherwise be out of scope for existing model checkers.Specifically, we present the following contributions: - A temporal abstraction operator that aggregates transitions and hides intermediate steps. Mathematically, our abstraction operator is a function that maps a flat transition system into a two-level hierarchy where each atomic upper-level transition expands into an entire lower-level transition system. For example, an arithmetic operation may expand into a sequence of bit operations. - A BDD-based algorithm for the symbolic exploration of multi-level hierarchies of transition systems. The algorithm traverses a level-n transition by expanding the corresponding level-(n − 1) transition system on-the-fly. The level-n successors of a state are determined by computing a level-(n − 1) reach set, which is then immediately released from memory. In this fashion, we can exhaustively explore hierarchically structured state spaces whose flat counterparts cause memory overflows. - We experimentally demonstrate the efficiency of our method with three examples—a multiplier, a cache coherence protocol, and a multiprocessor system. In the first two examples, we obtain significant improvements in run times and peak BDD sizes over traditional state-space search. The third example cannot be model checked at all using conventional methods (without manual abstractions), but can be analyzed fully automatically using transition hierarchies. KeywordsModel CheckTransition RelationParallel CompositionReactive ModuleReachability AnalysisThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Vehicular ad-hoc networks (VANETs) have got a wide range of attention to improve traffic systems and smart cities. Security and privacy are critical issues and need to be addressed for effective VANET systems. In this paper, we propose an efficient conditional privacy-Preserving authentication scheme based on a group secret key. Many VANETs schemes have utilized a group signature to realize the identity-less authentication, but the existing schemes suffering from long and high computational procedures, especially in the Certificate Revocation List (CRL) verification process, and group management complexity issues. As a result, they cannot satisfy the VANETs efficiency requirements. On another hand, many pseudonym-ID based VANETs schemes utilized a system key signature, but those schemes suffering from communication overhead increasing which could be caused by the increasing of the revocation list, in addition to that, and any damage in the key will cause damage for the entire system. In our scheme, we use a permanent vehicle pseudonym-ID and temporary group secret key that offers a lightweight verification and authentication process for a secure and efficient VANET system.

The features of current TV sets is increasing rapidly resulting in more complicated embedded TV software that is also harder to test and verify. Using model checking in verification of embedded software is a widely accepted practice even though it is seriously affected by the exponential increase in the number of states being produced during the verification process. Using fully non-deterministic user agent models is one of the reasons that can result in a drastic increase in the number of states being produced. In order to shrink the state space being observed during the model checking process of TV software, a method is proposed that rely on using previous test logs to generate partly nondeterministic user agent model. Results show that by using partly non-deterministic user agents, the verification time of certain safety and liveness properties can be significantly decreased.

One way of developing reliable systems is through the use of Formal Methods. A Graph Grammar specification is visual and based in a simple mechanism of rewriting rules. On the other hand, verification through theorem proving allows the proof of properties for systems with huge (and infinite) state space. There is a previously proposed approach that has allowed the application of theorem proving technique to graph grammars. One of the disadvantages of such an approach (and theorem proving in general) is the specific mathematical knowledge required from the user for concluding the proofs. This paper proposes proof strategies in order to help the developer in the verification process through theorem proving, when adopting graph grammar as specification language.

<p>This paper demonstrates the pontential of verification based on state spaces reduced by equivalence relations. The basic observation is that quite often, some states of a system are similar, i.e., they induce similar behaviours. Similarity can be formally expressed by defining equivalence relations on the set of states and the set of actions of a system under consideration. A state space can be constructed, in which the nodes correspond to equivalence classes of states and the arcs correspond to equivalence classes of actions. Such a state space is often much smaller than the ordinary full state space, but does allow derivation of many verification results.</p><p>Other researches have taken advantage of the symmetries of systems, which induce a certain kind of equivalence. The contribution fo this paper is to show that a more general notion of equivalence is useful. As example, a communication protocol modelled in the formalism of Coloured Petri Nets is verified. Aided by a computer tool supporting state spaces with equivalence classes, significant reduction of state spaces are exhibited.</p><p><strong>Topics</strong>. State space reduction methods, equivalence vs. symmetry, High-level Petri Nets, communication protocols.</p>

The Institute of Optical Sensor Systems (OS) as member of the Robotics and Mechatronics Cluster of the German Aerospace Center (DLR) has more than 30 years experiences with high-resolution imaging technology. The technology changes in the development of detectors, as well as the significant change of the manufacturing accuracy in combination with the engineering research define the next generation of spaceborne sensor systems focusing on Earth observation and remote sensing. The combination of large TDI (time delay and integration) lines, intelligent synchronization control, fast-readable sensors and new focal-plane concepts open the door to new remote-sensing instruments. This class of instruments is feasible for high-resolution sensor systems regarding geometry and radiometry and their data products like 3D virtual reality. Systemic approaches are essential for such designs of complex sensor systems for dedicated tasks. The system theory of the instrument inside a simulated environment is the beginning of the optimization process for the optical, mechanical and electrical designs. Single modules and the entire system have to be calibrated and verified. Suitable procedures must be defined on component, module and system level for the assembly test and verification process. This kind of development strategy allows the hardware-in-the-loop design. The paper gives an overview about the current developments at DLR OS in the field of innovative sensor systems design for spatial and spectral high resolution remote sensing instruments.

The department of Optical Information Systems (OS) at the Institute of Robotics and Mechatronics of the German Aerospace Center (DLR) has more than 25 years experience with high-resolution imaging technology. The technology changes in the development of detectors, as well as the significant change of the manufacturing accuracy in combination with the engineering research define the next generation of spaceborne sensor systems focusing on Earth observation and remote sensing. The combination of large TDI lines, intelligent synchronization control, fast-readable sensors and new focal-plane concepts open the door to new remote-sensing instruments. This class of instruments is feasible for high-resolution sensor systems regarding geometry and radiometry and their data products like 3D virtual reality. Systemic approaches are essential for such designs of complex sensor systems for dedicated tasks. The system theory of the instrument inside a simulated environment is the beginning of the optimization process for the optical, mechanical and electrical designs. Single modules and the entire system have to be calibrated and verified. Suitable procedures must be defined on component, module and system level for the assembly test and verification process. This kind of development strategy allows the hardware-in-the-loop design. The paper gives an overview about the current activities at DLR in the field of innovative sensor systems for photogrammetric and remote sensing purposes.

Controllability, Observability and Stabilizability of Distributed Systems with Infinite Domain

Usability is a key concern in the development of verification tools. In this paper, we present an usability extension for the verification tool ESC/Java2. This enhancement is not achieved through extensions to the underlying logic or calculi of ESC/Java2, but instead we focus on its human interface facets. User awareness of the soundness and completeness of the tool is vitally important in the verification process, and lack of information about such is one of the most requested features from ESC/Java2 users, and a primary complaint from ESC/Java2 critics. Areas of unsoundness and incompleteness of ESC/Java2 exist at three levels: the level of the underlying logic; the level of translation of program constructs into verification conditions; and at the level of the theorem prover. The user must be made aware of these issues for each particular part of the source code analysed in order to have confidence in the verification process. Our extension to ESC/Java2 provides clear warnings to the user when unsound or incomplete reasoning may be taking place.

<p>State Space Analysis is one of the most developed analysis methods for Petri Nets. The main problem of state space analysis is the size of the state spaces. Several ways to reduce it have been proposed but cannot yet handle industrial size systems.</p><p>Large models often consist of a set of modules. Local properties of each module can be checked separately, before checking the validity of the entire system. We want to avoid the construction of a single state space of the entire system.</p><p>When considering transition sharing, the behaviour of the total system can be capture by the state spaces of modules combined with a Synchronisation Graph. To verify that we do not lose information we show how the full state space can be conctructed.</p><p>We show how it is possible to determine usual Petri Nets properites, without unfolding to the ordinary state space.</p>

A myriad of proprietary (i.e., commercial tool specific) verification assertion languages exist today. These languages emerged due to the lack of formal language constructs supporting assertion specification in today’s hardware description languages (HDL). The method described in this paper presents a unique process for unifying (or neutralizing the effects of) the many proprietary languages by using a set of predefined specification modules instantiated as assertions within the designer’s HDL. This methodology creates numerous advantages and precludes the need to introduce new HDL constructs (i.e., extensions to Verilog are not required). It enables the design engineer to “specify once,” then leverage the same HDL assertion specification over multiple verification processes -- such as traditional simulation, semi-formal, and formal verification tools. It also eliminates the need for the design engineer to master tool specific and proprietary language details. Furthermore, this methodology enables evaluating new verification processes and tools (containing their own proprietary languages) seamlessly for the duration of the project, without the need to modify the original HDL text.

Slice or Unfold - Experiments on Checking Synchronous Models with Backwards Slicing

In this thesis, we introduce and examine four new temporal logic formalisms that can be used as specification languages for the automated verification of the reliability of hardware and software designs with respect to a desired behavior. The work is organized in two parts. In the first one, we reason about two logics for computations, GCTL* and MCTL*, which are useful to describe a correct execution of monolithic closed systems. In the second one, instead, we focus on two logics for strategies, SL and mATL*, which are useful to formalize several interesting properties about interactive plays in multi-entities systems modeled as multi-agent games. In the “Logics for Computations” part, we first study the immersion of the idea of graded quantifications into the temporal-logic framework. In first order logic, existential and universal quantifiers express the concepts of the existence of at least one individual object satisfying a formula, or that all individual objects satisfy a formula. In other logics, these quantifiers have been generalized to express that, for a given non-negative integer n, at least n or all but n individuals satisfy a particular formula. Here, we consider GCTL, a temporal logic with graded path quantifiers, which allows to describe properties like “there exist at least n different classes of computational fluxes in which a system reaches a predetermined state”, where the classes over paths are computed by means of a predetermined equivalence relation. More precisely, we uniformly extend the classic concept of graded quantifiers from states to paths, through the use of a concept of path equivalence with respect to a given path formula. About this logic, in particular, we study the expressiveness and succinctness relationships with respect to GµCalculus and the complexity of the satisfiability problem, which results to be ExpTime-Complete. This research is partially based on the works [BMM09] “Graded Computation Tree Logic” and [BMM10] “Graded Computation Tree Logic with Binary Coding” published, respectively, in the proceedings of the “IEEE Symposium on Logic in Computer Science, 2009” and “EACSL Annual Conference on Computer Science Logic, 2010”. Preliminary results can be also found in [Mog07]. Furthermore, we consider special quantifiers over substructures, which allow to select, using parametric criteria, small critical parts of a system to be successively verified. In literature, there are some attempts to define a logic that allows to modify the underlying structure under exam and then to verify on it some assigned property. However, as far as we know, none of them is able to select minimal submodels of a given property describing the criteria on which then execute the verification process. Here, we base our work on the search of a new operator that merges the concept of quantifiers on structures with that one derived by a generalization of the concept of pruning. The results of this work, is a class of three different extensions of CTL* with minimal model quantifiers, which we name MCTL*. Regarding these logics, we study several reductions among them, as well as the satisfiability problem that we prove to be highly undecidability, i.e., Σ_1^1-Hard, for two out of the three cases. This research is partially based on the work [MM09] “Branching-Time Temporal Logics with Minimal Model Quantifiers” published in the proceedings of the “International Conference on Developments in Language Theory, 2009”. In the “Logics for Strategies” part, we first study the problem of defining a new specification language through which it is possible to express several important properties of multi-entities systems that are neither expressible using classical monolithic temporal logics, such as CTL*, nor using two-agent-teams temporal logics, such as ATL*. In literature, we can found some proposal of logics that try to achieve this goal, but unfortunately, none of them succeeds completely on all the aspects. Among them, one of the most important attempts is CHP-SL, a logics in which one can use variables over strategies. However, this logic has a deep weakness, since it does not allow to describe games with more than two players and even two-players concurrent games. Here, we introduce SL, a logic with a syntax similar in some aspects to the first order logic, in which the strategies of the agent building the game are treated as first order objects on which we can quantify. This logic generalizes CHP-SL, by allowing the specification of the correct behavior of multi-agent concurrent games. In SL, for example, we are able to express very complex but useful Nash equilibria that are not expressible with CHP-SL. We enlighten that Nash equilibrium is one of the most important concepts in game theory. For the introduced logic, we solve two problems left open in the work on CHP-SL. Precisely, we show that the related model-checking problem is 2ExpTime-Complete, thus not harder of the same problem for several subsumed logics, while we prove that its satisfiability problem is highly undecidable, i.e., Σ_1^1-Hard. This research is partially based on the work [MMV10a] “Reasoning About Strategies” published in the proceedings of the “IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science, 2010”. Finally, we consider the concept of relentful strategic reasoning, i.e., a formalism that expresses the ability of a strategy to be used not only to achieve a first given goal, but also to change its final goal in dependence of the history of the play. In the context of planning, memoryful quantification, i.e., quantification over computations that does not lose information about the past along the time, is one of the principal way to express the fact that a system is able to achieve a desired result, and shift to a different goal if some event happens. However, this kind of quantification was not considered before in the context of multi-agent planning. Here, we introduce mATL*, a fusion of the classic alternating temporal logic ATL* with memoryful quantification, with the aim of covering the previous idea. About this logics, we prove that, although it is equivalent to ATL*, it is exponentially more succinct. Nevertheless, we prove that both the model-checking and the satisfiability problems remain 2ExpTime-Complete, as for ATL*. This research is partially based on the work [MMV10b] “Relentful Strategic Reasoning in Alternating-Time Temporal Logic” published in the proceedings of the “International Conference on Logic for Programming Artificial Intelligence and Reasoning, 2010”.

Verification of critical software is a high priority but a challenging task for industrial control systems. Model checking appears to be an appropriate approach for this purpose. However, this technique is not widely used in industry yet, due to some obstacles. The main obstacles encountered when trying to apply formal verification techniques at industrial installations are the difficulty of creating models out of PLC programs and defining formally the specification requirements. In addition, models produced out of real-life programs have a huge state space, thus preventing the verification due to performance issues. Our work at CERN (European Organization for Nuclear Research) focuses on developing efficient automatic verification methods for industrial critical installations based on PLC (Programmable Logic Controller) control systems.In this paper, we present a tool generating automatically formal models out of PLC code. The tool implements a general methodology which can support several input languages, like the PLC programming languages defined in the IEC 61131 standard, as well as the model formalisms of different model checker tools. The tool supports the three main stages of model checking: system modelization, requirement formalization and counterexample analysis. In addition, a verification case study of a PLC program, written in Structured Text (ST) language implemented at CERN is described. The paper shows that the verification process is automatized and supported by the proposed tool, thus its difficulty is completely hidden for the control engineer.

This paper aims at developing a design verification environment for complex application-specific integrated circuits (ASICs), with particular emphasis on embedded systems incorporating intellectual property (IP) cores. There exist methods to ensure correct design for IP core-based systems, but a promising approach to realize this is through the use of coverage-driven functional verification (CDV) and reuse methodology (RM). The CDV approach is based on the ASIC functionalities, and the verification process is accomplished in the early stages of the design. The use of functional coverage minimizes the number of test cases and thus enhances the verification process. The deterministic testing together with CDV and RM is applied to verify designs in the paper. The Specman e-language is used as a verification tool in the process since it incorporates the capabilities of both CDV and RM.