Verifying a signature architecture: a comparative case study

We report on a case study in using HOL-Z, an embedding of Z in higher-order logic, to specify and verify a security architecture for administering digital signatures. We have used HOL-Z to formalize and combine both data-oriented and process-oriented architectural views. Afterwards, we formalized temporal requirements in Z and carried out verification in higher-order logic. The same architecture has been previously verified using the SPIN model checker. Based on this, we provide a detailed comparison of these two different approaches to formalization (infinite state with rich data types versus finite state) and verification (theorem proving versus model checking). Contrary to common belief, our case study suggests that Z is well suited for temporal reasoning about process models with rich data. Moreover, our comparison highlights the advantages of this approach and provides evidence that, in the hands of experienced users, theorem proving is neither substantially more time-consuming nor more complex than model checking.

RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A, provides guidance for software developers wishing to use formal methods in the certification of airborne systems and air traffic management systems. This paper presents three case studies describing the use of different classes of formal methods to satisfy DO-178C certification objectives. The case studies examine different aspects of a common avionics example, a dual-channel Flight Guidance System (FGS), which is representative of the issues encountered in actual developments. The three case studies illustrate the use of theorem proving, model checking, and abstract interpretation. Each of these techniques has strengths and weaknesses and each could be applied to different life cycle data items and different objectives than those described here. Our purpose is to illustrate a reasonable application of each of these techniques to produce the evidence needed to satisfy certification objectives in a realistic avionics application. We hope that these case studies will be useful to industry and government personnel in understanding formal methods and the benefits they can provide.

Higher-order model checking - the model checking of trees generated by higher-order recursion schemes (HORS) - is a natural generalisation of finite-state and pushdown model checking. Recent work has shown that it can serve as a basis for software model checking for functional languages such as ML and Haskell. In this paper, we introduce higher-order recursion schemes with cases (HORSC), which extend HORS with a definition-by-cases construct (to express program branching based on data) and non-determinism (to express abstractions of behaviours). This paper is a study of the universal HORSC model checking problem for deterministic trivial automata : does the automaton accept every tree in the tree language generated by the given HORSC? We first characterise the model checking problem by an intersection type system extended with a carefully restricted form of union types. We then present an algorithm for deciding the model checking problem, which is based on the notion of traversals induced by the fully abstract game semantics of these schemes, but presented as a goal-directed construction of derivations in the intersection and union type system. We view HORSC model checking as a suitable backend engine for an approach to verifying functional programs. We have implemented the algorithm in a tool called TravMC , and demonstrated its effectiveness on a test suite of programs, including abstract models of functional programs obtained via an abstraction-refinement procedure from pattern-matching recursion schemes.

This brief concerns the formal verification of properties of statecharts, a hierarchical state machine formalism for designing control-system logic. Various semantics have been defined for statecharts in terms of the microsteps that determine the transitions between statechart configurations. We show how computation tree logic (CTL) specifications for a statechart can be verified using a finite-state model checker such as SMV. The inputs to the model checker are a model and an associated expansion of the CTL formula that reflect the semantics. A Kripke structure with marked states provides the formal relationship between the expanded model and the original statechart structure and CTL specification. The results apply to a general class of semantics and statecharts with bounded behaviors. The approach is illustrated with a small example

The increasing complexity and connectivity of automotive systems have raised concerns about their vulnerability to security breaches. As a result, the integration of formal methods and validation techniques has become crucial in ensuring the security of automotive systems. This survey research paper aims to provide a comprehensive overview of the current state-of-the-art formal methods and validation techniques employed in the automotive industry for system security. The paper begins by discussing the challenges associated with automotive system security and the potential consequences of security breaches. Then, it explores various formal methods, such as model checking, theorem proving, and abstract interpretation, which have been widely used to analyze and verify the security properties of automotive systems. Additionally, the survey highlights the validation techniques employed to ensure the effectiveness of security measures, including penetration testing, fault injection, and fuzz testing. Furthermore, the paper examines the integration of formal methods and validation techniques within the automotive development lifecycle, including requirements engineering, design, implementation, and testing phases. It discusses the benefits and limitations of these approaches, considering factors such as scalability, efficiency, and applicability to real-world automotive systems. Through an extensive review of relevant literature and case studies, this survey provides insights into the current research trends, challenges, and open research questions in the field of formal methods and validation techniques for automotive system security. The findings of this survey can serve as a valuable resource for researchers, practitioners, and policymakers involved in the design, development, and evaluation of secure automotive systems.

Analysis of many critical systems is usually based on the simulation of numerical models. This solution is suitable for analyzing systems with continuous and deterministic behaviors that evolve over time. However, real critical systems are more complex and can exhibit non-deterministic behavior due to unexpected events. Furthermore, critical systems present both discrete and continuous behaviors, which interact regularly. Both features can be modeled with hybrid formal methods, taking advantage of exploration techniques like model checking. We have selected dam management as a case study. A dam is a critical system that has a hybrid behavior, there are continuous variables such as the water level, and discrete states such as the opening degrees of the spillways. At present, Decision Support Systems, based on numerical models, are used to manage complete river basins. Dams are modelled as black boxes which store and release water. A Decision Support Tool (DST) for dam management provides information about the possible consequences of dam operator actions, which can help to ensure the safety of the dam, as well as the efficient use of the water. In this work we have used formal methods to model a dam as a hybrid system, and we have obtained decision support information from the analysis performed with model checking.

Model checking of safety-critical software in the nuclear engineering domain

Model checking communicative agent-based systems

Formal verification of business process models can be done through model checking (also known as property checking), where a model checker tool may automatically find violations of properties in a process model. This approach obviously has formal representations as a prerequisite. However, a key challenge for applying this approach in practice is to consistently formalize the process and its properties, which clearly cannot be done automatically. We studied this challenge in a case study of formally verifying an informally given business process against a guideline written like a legal text. Major lessons learned from this case study are that formalizing is key to success and that in its course a semi-formal representation of properties is useful. In the course of such a step-wise and incremental formalization, problems with the given process model have been found already, apart from those found with a model checker tool that used the formal property specification. In total, our approach revealed five problems not found by the official review. In summary, this paper investigates in a case study consistently formalizing a business process and its properties for verification through model checking.

Model checking is a promising formal verification method to complement testing in order to improve the quality of PLC programs. However, its application typically needs deep expertise in formal methods. To overcome this problem, we introduce PLCverif, a tool that builds on our verification methodology and hides all the formal verification-related difficulties from the user, including model construction, model reduction and requirement formalisation. The goal of this tool is to make model checking accessible to the developers of the PLC programs. Currently, PLCverif supports the verification of PLC code written in ST (Structured Text), but it is open to other languages defined in IEC 61131-3. The tool can be easily extended by adding new model checkers.

When deploying multiple UAVs each with its own sensor platform into an unstructured environment, the swarm of these sensor platforms, i.e. the team of UAVs needs to deploy in a manner that will gather information about the local environment, identify and track objects of interest, and act in a co-operative and robust manner. Guidance strategies that result in UAV platforms covering the area of interest whilst avoiding obstacle, and allow UAV platforms to arrive at specific positions at specific times and with specific sensor orientation, is the focus of this presentation. The use of Dudin's sets would provide the framework for guidance and navigation. Coordinated path planning of multiple UAVs for simultaneous arrival with safe flight-paths is described. The simultaneous arrival of all UAVs is guaranteed by paths of equal lengths. Two conditions, namely minimum separation distance and non-intersection of paths at equal length are used/proposed to ensure the safe flight-path of UAVs. These conditions are to avoid inter-UAVs collision. The Dubins paths are used for the path planning. Bisection method is used to find the optimal turning radii of paths. The path planning guarantees design of paths of equal length with shortest paths. This is having advantages in reducing fuel consumption and increasing the durability of UAVs. Furthermore formal modelling techniques are applied to this problem of multi-UAV coordination, decision making and path planning. When UAV teams are called to operate in areas with uncertain information it is impossible to validate every conceivable situation that might arise in operation in such scenarios. By using formal techniques, aspects of the operating model that must necessarily hold true throughout can be mathematically validated. Kripke models of possible worlds are used to represent formally a multi-UAV scenario, where availability of environment information is to be used by the team to collect, exchange and utilise available information to make a complete survey of the specified area. The ability of our proposed Kripke model to cope with the uncertainties and decision making involved in this process can be verified using an exhaustive proof technique known as model checking.

Model checking is a powerful formal analytical approach to verifying software and hardware systems. However, general industrial adoption is far from widespread. Some difficulties include the inaccessibility of techniques and tools and the need for further empirical evaluation in industrial contexts. This study considers the use of Simulink Design Verifier, a model checker that forms part of a modelling system already widely used in the safety-critical industry. Model checking is applied to a number of real-world problem reports, associated with aero-engine monitoring functions, to determine whether it can provide a practical route into effective verification, particularly for non-specialists. The study also considers the extent to which model checking can satisfy the requirements of the extensive DO-178C guidance on formal methods. The study shows that the benefits of model checking can be realised in an industrial setting without specialist skills, particularly when it is targeted at parts of the software that are error-prone, difficult to verify conventionally or critical. Importantly, it shows that model checking can find errors earlier in the design cycle than testing, which potentially saves money, due to reduced scrap and rework.

Given the rapid development of systems with critical infrastructures, the chances of cyber-attacks are also growing. As the smart water distribution system is one of such structures, security concerns play a significant role in the process of designing them. This paper presents a risk analysis of smart water distribution system example architecture through threat modeling and model checking. The results of the model checking process demonstrate how security requirements can be achieved in a Security-by-Design approach.

The accuracy and credibility of model is the most important determinant of development of Modeling and Simulation (M&S). There is a desperate need for an immediate practical solution to the problem of VV&A (Validation, Verification and Accreditation) of simulation systems. A discussion and experiment of the relative merits of informal methods and formal methods are provided in this paper. In spite of increasing simulation speed via parallelization, the number of problem cases that can be covered is not highly increased. On the other hand, formal methods have proven to be valuable techniques, but they require detailed specifications of systems and requirements, therefore they are not very accessible in practical simulation systems development. According to the exhaustiveness of formal methods, a Model Driven Architecture (MDA) based simulation VV&A framework guided by model checking is presented in this paper. This framework combines scalability of simulation with exhaustiveness of formal methods in order to get the best of both worlds for simulation model verification. It can provide more confidence in simulation models and increase the use of formal methods in the context of M&S by people that are not trained in formal techniques.

Testing is a necessary, but costly process for user-centric quality control. Moreover, testing is not comprehensive enough to completely detect faults. Many formal meth ods have been pro posed to avoid the drawbacks of testing, e.g., model checking that can be automatically carried out. This paper presents an approach that (i) generates test cases from the specification and (ii) transfers the specification-oriented testing process to model checking. Thus, the approach combines the advantages of testing and model checking assuming the availability of (i) a model that specifies the ex pected, desirable system behavior as required by the user and (ii) a second model that describes the system behavior as observed. The first model is complemented in also specifying the undesirable system properties. The approach analyzes both these specification models to generate test cases that are then converted into temporal logic formulae to be model checked on the second model.KeywordsModel CheckSoftware TestLinear Temporal LogicSystem Under TestGenerate Test CaseThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.