Zing: Exploiting Program Structure for Model Checking Concurrent Software

A model checker is an automatic tool that traverses a specific structure (normally a Kripke structure referred as the modelM) to check the satisfaction of some (temporal) logical propertyf. This is formally stated asM⊧f. For some formal notations, the modelMof a specificationS(written in a formal languageL) can be described as a labelled transition system (LTS). Specifically, it is not clear in general how usual tools such as SPIN, FDR, PAT, etc., create the LTS representation from a given process. Although one expects the coherence of the LTS generation with the semantics ofL, it is completely hidden inside the model checker itself. In this paper we show how to create a model checker forL, using a development approach based on its operational semantics. We use a systematic semantics embedding and the formal modeling using logic programming and analysis (FORMULA) framework to this end. We illustrate our strategy considering the formal language COMPASS modelling language (CML)—a new language that was based on CSP, VDM and the refinement calculus proposed for modelling and analysis of systems of systems. As FORMULA is based on satisfiability modulo theories solving, our model checker can handle communications and predicates involving data with infinite domains by building and manipulating a symbolic LTS. This goes beyond the capabilities of traditional CSP model checkers such as FDR and PAT. Moreover, we show how to reduce time and space complexities by simple semantic modifications in the embedding. This allows a more semantics-preserving tuning. Finally, we show a real implementation of our model checker in an integrated development platform for CML and its practical use on an industrial case study.

PROMELA is a high level modeling language for model checking purpose. PROMELA model can be checked using SPIN (Simple PROMELA Interpreter) model checker to ensure formally some specifications hold in the model. However, PROMELA does not have formal and clear semantics. It is interpreted under SPIN implementation only and thus is bounded into SPIN. With high-level language it has, PROMELA has gain fame in model checker world due to its easiness to capture process model using high level language. Describing PROMELA formal semantic is a good way to broaden PROMELA usage. One of PROMELA feature is the ability to model concurrent processes, in which the concurrent process may not start from the same time point. This feature, called dynamic process creation, is essential to be noticed, to ensure that state-transition of PROMELA model is correct. Dynamic process creation in PROMELA should be defined formally, we use Labeled Transition Systems (LTSs) to describe formal semantic of PROMELA dynamic process creation.

Wireless sensor networks (WSNs) are expected to run unattendedly for critical tasks. To guarantee the correctness of WSNs is important, but highly nontrivial due to the distributed nature. In this work, we present an automatic approach to directly verify WSNs built with TinyOS applications implemented in the NesC language. To achieve this target, we firstly define a set of formal operational semantics for most of the NesC language structures for the first time. This allows us to capture the behaviors of sensors by labelled transition systems (LTSs), which are the underlying semantic models of NesC programs. Secondly, WSNs are modeled as the composition of sensors with a network topology. Verifications of individual sensors and the whole WSN become possible by exploring the corresponding LTSs using model checking. With substantial engineering efforts, we implemented this approach in the tool NesC@PAT to support verifications of deadlock-freeness, state reachability and temporal properties for WSNs. NesC@PAT has been applied to analyze and verify WSNs, with unknown bugs being detected. To the best of our knowledge, NesC@PAT is the first model checker which takes NesC language as the modeling language and completely preserves the interrupt-driven feature of the TinyOS execution model.KeywordsWireless Sensor NetworkModel CheckerOperational SemanticLinear Temporal LogicState ReachabilityThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The article is devoted to the analysis of the analysis of the experience of teaching the most common modern programming languages in the leading institutions of higher education in Ukraine. The purpose of the article is to analyze the experience of teaching the most common modern programming languages in leading Ukrainian higher education institutions in order to determine the relevance of knowledge provided by the leading institutions of higher education of Ukraine regarding the modern popularity of programming languages. Based on recent research and publications and work plans of leading institutions of higher education, the necessary information was gathered and an analysis of the experience of training the most common modern programming languages was conducted.

The paper presents an application of model checking in teaching a concurrent programming. The success of this approach is based on features of DT-CSM automata and EMLAN modeling language. EMLAN is a C-like, high level language for modeling and model checking of embedded systems. The language is equipped with a lot of synchronization mechanisms (semaphores, mutexes, monitors). This allows easy modeling and verification of concurrent, cooperating tasks, which is very useful for educational purposes. As an example, a typical student exercise: a producer-consumer is given.

The intimate relationship between model checking and abstract interpretation has been shown in a large number of relevant papers in literature. Maybe the use of abstract interpretation to reduce the well-known state space explosion problem in model checking was the first and most successful combination of these two techniques. However, this is not the only possible way both methods can collaborate to improve the software reliability. Along these last 20 years, our contributions in this area have been focussed on the practical application of abstract interpretation in the context of model checking tools. From our point of view, model checking tools such as spin can be hardly improved in terms of efficiency. Thus, we have concentrated on applying abstraction to completely reuse the underlying model checkers. We have applied our ideas to different modelling and programming languages, tools and real applications. In this paper, we summarize some of these contributions.

Graph transformation has recently become more and more popular as a general, rule-based visual specification paradigm to formally capture (a) requirements or behavior of user models (on the model-level), and (b) the operational semantics of modeling languages (on the meta-level) as demonstrated by benchmark applications around the Unified Modeling Language (UML). The current paper focuses on the model checking-based automated formal verification of graph transformation systems used either on the model-level or meta-level. We present a general translation that inputs (i) a metamodel of an arbitrary visual modeling language, (ii) a set of graph transformation rules that defines a formal operational semantics for the language, and (iii) an arbitrary well-formed model instance of the language and generates a transitions system (TS) that serve as the underlying mathematical specification formalism of various model checker tools. The main theoretical benefit of our approach is an optimization technique that projects only the dynamic parts of the graph transformation system into the target transition system, which results in a drastical reduction in the state space. The main practical benefit is the use of existing back-end model checker tools, which directly provides formal verification facilities (without additional efforts required to implement an analysis tool) for many practical applications captured in a very high-level visual notation. The practical feasibility of the approach is demonstrated by modeling and analyzing the well-known verification benchmark of dining philosophers both on the model and meta-level.

We propose a sound, complete, and automatic method for pairwise reachability analysis of higher-order concurrent programs with recursion, nested locks, joins, and dynamic thread creation. The method is based on a reduction to higher-order model checking (i.e., model checking of trees generated by higher-order recursion schemes). It can be considered an extension of Gawlitz et al.’s work on the join-lock-sensitive reachability analysis for dynamic pushdown networks (DPN) to higher-order programs. To our knowledge, this is the first application of higher-order model checking to sound and complete verification of (reasonably expressive models of) concurrent programs.

A problem which confronts the developers of concurrent logic programming (CLP) systems concerns the design of the programming environment, particularly the provision of debugging tools. Debugging tools are useful for many activities besides identifying bugs: they can help in program testing and demonstration, in software experiments, and in teaching the language semantics. For CLP languages the questions of what debugging tools should be provided, and of how they should be used, are still open. Although the languages are closely related to other logic programming and concurrent programming languages, they are sufficiently different that new debugging techniques are required. This paper describes a primarily channel-oriented debugging methodology and a set of debugging tools that we have developed in the light of our experience in using and teaching the CLP language Parlog. With these tools a programmer can test a program by observing communication on channels, opening up a process to examine the activity on internal channels and, if necessary, to check in detail the execution steps of a process. Almost all of the ideas, which are equally applicable to other CLP languages, have been implemented in two commercial Parlog systems. As well as fulfilling the needs of existing users of CLP languages, we believe that the tools emphasise the attractions of CLP as a concurrent programming paradigm, since they are made possible by the unique attributes of CLP.

The state explosion problem is the central challenge in automatic verification using model checking. In many cases, representing the state space of a system as a lattice is an effective way of representing very large state spaces. The partial order of the lattice represents an information ordering between states, which can be used as an abstraction mechanism to reduce the computational cost of model checking. The 'traditional' logical framework for model checking finite state systems has serious deficiencies when applied to information-ordered state spaces. Interpreting the truth of a proposition about a state or a sequence of states in a four-valved truth domain is better from a modelling point of view, allowing us to reason about partial and contradictory information. Moreover, it overcomes a serious technical difficulty encountered when using a two-valued truth domain. The paper defines the syntax and semantics of a four-valued temporal logic that can be used for specifying properties of a computer system. This framework has particular relevance to hardware verification. It could be used by several model checking algorithms. Symbolic trajectory evaluation (STE) [33] is a model checking algorithm that has had success in model checking using information orderings to reduce computational cost. Previous work used a two-valued logic though, which limited the expressiveness of the logic. Using the framework presented here, the STE algorithm can be generalised, and then applied in practice to a richer logic. Some examples are shown in this paper. Keywords:Symbolic trajectory evaluation, quarternary logic, model checking, temporal logic, bilattices.

The chapter presents a description of a novel modelling language called Alvis defined for the design of concurrent especially real-time systems. Alvis combines the advantages of formal methods and practical modelling languages. Based on CCS and XCCS process algebras, Alvis utilizes flexible graphical modelling of interconnections among agents and a high level programming language used for the description of agents behaviour. Each agent in a model can use rule-based systems to support its decisions. A small set of language statements and graphical concepts make Alvis easy to learn and use. The possibility of a formal model verification, makes Alvis a formal modelling language. Alvis modelling environment creates in parallel a model of the considered system and a labelled transition system (LTS graph) that is its formal representation. The LTS graph can be formally verified with the CADP toolbox. A survey of main Alvis features from practical point of view, is given in the chapter.

Although model checking has proven remarkably effective in detecting errors in hardware designs, its success in the analysis of software specifications has been limited. Model checking algorithms for hardware verification commonly use Binary Decision Diagrams (BDDs) to represent predicates involving the many Boolean variables commonly found in hardware descriptions. Unfortunately, BDD representations may be less effective for analyzing software specifications, which usually contain not only Booleans but variables spanning a wide range of data types. Further, software specifications typically have huge, sometimes infinite, state spaces that cannot be model checked directly using conventional symbolic methods. One promising but largely unexplored approach to model checking software specifications is to apply mathematically sound abstraction methods. Such methods extract a reduced model from the specification, thus making model checking feasible. Currently, users of model checkers routinely analyze reduced models but often generate the models in ad hoc ways. As a result, the reduced models may be incorrect. This paper, an expanded version of (Bharadwaj and Heitmeyer, 1997), describes how one can model check a complete requirements specification expressed in the SCR (Software Cost Reduction) tabular notation. Unlike previous approaches which applied model checking to mode transition tables with Boolean variables, we use model checking to analyze properties of a complete SCR specification with variables ranging over many data types. The paper also describes two sound and, under certain conditions, complete methods for producing abstractions from requirements specifications. These abstractions are derived from the specification and the property to be analyzed. Finally, the paper describes how SCR requirements specifications can be translated into the languages of Spin, an explicit state model checker, and SMV, a symbolic model checker, and presents the results of model checking two sample SCR specifications using our abstraction methods and the two model checkers.

In temporal-logic model checking, we verify the correctness of a program with respect to a desired behavior by checking whether a structure that models the program satisfies a temporal-logic formula that specifies the behavior. The main practical limitation of model checking is caused by the size of the state space of the program, which grows exponentially with the number of concurrent components. This problem, known as the state-explosion problem, becomes more difficult when we consider real-time model checking, where the program and the specification involve quantitative references to time. In particular, when use timed automata to describe real-time programs and we specify timed behaviors in the logic TCTL, a real-time extension of the temporal logic CTL with clock variables, then the state space under consideration grows exponentially not only with the number of concurrent components, but also with the number of clocks and the length of the clock constraints used in the program and the specification. Two powerful methods for coping with the state-explosion problem are on-the-fly and space-efficient model checking. In on-the-fly model checking, we explore only the portion of the state space of the program whose exploration is essential for determining the satisfaction of the specification. In space-efficient model checking, we store in memory the minimal information required, preferring to spend time on reconstructing information rather than spend space on storing it. In this work we develop an automata-theoretic approach to TCTL model checking that combines both methods. We suggest, for the first time, a PSPACE on-the-fly model-checking algorithm for TCTL.KeywordsModel CheckTemporal LogicLinear Temporal LogicRegion PositionTree AutomatonThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Memory is one of the critical resources in model checking. This paper discusses a strategy for reducing peak memory in model checking by case-based partitioning of the search space. This strategy combines model checking for verification of different cases and static analysis or expert judgment for guaranteeing the completeness of the cases. Description of the static analysis is based on using PROMELA as the modeling language. The strategy is applicable to a subset of models including models for verification of certain aspects of protocols.

In this contribution, we present equivalence and model checking methods for nonlinear analog systems. Both approaches are based one the system’s nonlinear state space description. The equivalence checker computes a nonlinear transformation of the state space descriptions into a canonical form. Thus, the input/output behavior of the specifying and the target system can be compared independently of the different state representations. The model checking approach uses an automatic state space subdivision method to transfer the continuous state space into a discrete model retaining the essential analog dynamics. The analog system properties are described in an extended CTL language. Experimental results show the feasibility of both approaches.