State/Event-Based Software Model Checking

Microprocessors and Microsystems, 2002

We show a tool supporting ef®cient model checking of LOTOS programs. LOTOS is a well-known speci®cation language for concurrent and distributed systems. The main functionality of the tool is the syntactic reduction of a program with respect to a logic formula expressing a property to be checked. The method is useful to reduce the state-explosion problem in model checking. The tool is integrated with the Concurrency Workbench of North Carolina. The tool also supports a windows user interface. q Since 1998, she has been an assistant professor with the Department of Information Engineering of the University of Pisa. Her research interests include formal methods for description and analysis of concurrent and distributed systems, modal and temporal logics, automatic veri®cation and operational semantics.

1999

in the FSP language. We then introduce CRA, problems related to it, as well as the way in which software architecture is used to guide CRA. Chapter 4 motivates and describes the use of ALTL for expressing properties of LTSs. A generic mechanism is then provided for checking that a system satisfies properties expressed as ALTL formulas or Büchi automata. This mechanism is then adjusted to cope with issues that arise when CRA is used to construct the LTS of a system. Chapter 5 concentrates on the issue of safety-property checking. Safety properties can be specified with a less expressive model than Büchi automata. This model is amenable to an efficient checking mechanism, described in this chapter. A similar technique is presented, for checking correctness of user-specified interfaces in the context of CRA. Chapter 6 discusses the notion of fairness, and relates it to liveness property checking. It proposes efficient strategies for checking liveness properties expressed as deterministic Büchi automata, and for checking a class of liveness properties termed progress. Such checks are performed under specific fairness assumptions about the system execution, which can be refined with the use of an action priority scheme. The chapter concludes with a methodology that users are advised to follow for analysing their systems. The methodology encourages the gradual transition from efficient and inexpensive checks that may not detect all possible errors in the system, to tests that are more expensive but also more thorough. Chapter 7 describes the construction and use of our analysis tool, as well as the way in which it interacts with our other tools for the development of concurrent and distributed systems. The non-trivial case study of a Reliable Multicast Transport Protocol is used to evaluate the applicability, performance and efficiency of our approach, and to compare it with similar approaches. Chapter 8 summarises and evaluates the contribution of TRACTA to model checking, discusses open issues and explores directions for future work. Appendix A is a formal presentation of the LTS model. Appendix B is a quick reference for the FSP language. Appendix C provides the semantics of the FSP language. Finally, Appendix D presents the proofs of some theorems and lemmas used in the main body of the thesis. Model Checking 2 2.1 TEMPORAL MODEL CHECKING 28 2.2 AUTOMATA-THEORETIC METHODS 35 2.3 DISCUSSION 36 2.4 SYMBOLIC REPRESENTATION 39 2.5 ON-THE-FLY VERIFICATION 41 2.6 REDUCTION 43 2.7 COMPOSITIONAL REASONING 51 2.8 DISCUSSION 52

Abstract. The translation of temporal logic specifications constitutes an essential step in model checking and a major influence on the efficiency of formal verification via model checking. We devise a new explicit-state translation of Linear Temporal Logic to automata for the class of LTL specifications that describe safety properties, arguably the most used formal specifications in real-world systems.

Theoretical Computer Science, 1995

A simple and elegant formulation of compositional proof systems for concurrent programs results from a refinement of temporal logic semantics. The refined temporal language we propose is closed under w-stuttering and, thus, provides a fully abstract semantics with respect to some chosen observation level w. This avoids incorporating irrelevant detail in the temporal semantics of parallel programs. Besides compositional verification, concurrent program design and implementation of a coarser-grained program by a finer-grained one, are easily practicable in the setting of the new temporal logic.

2003

Rapid growth of distributed systems stimulates many attempts to describe precisely the behavior of concurrent systems. The target of the research is to model complex systems, to automatically generate an executable code from abstract models, and to check the correctness of concurrent systems. In this thesis, a new concept of concurrent system verification is presented. The idea is based on building a new version of CTL temporal logic (QsCTL) over reachability graphs of systems defined by concurrent automata CSM. The proposed method is addressed to verify control-dominated systems. Many questions on concurrent system behavior may be asked easier in QsCTL than in traditional CTL. An original algorithm CBS (Checking By Spheres) for automatic evaluation of temporal formulas in this logic is presented. Another algorithm of state space reduction is designed. The presented ideas are implemented in TempoRG program, the element of the COSMA environment developed in ICS, WUT. The purpose of COSMA is to integrate formal verification methodology with concurrent systems design environment. The formulated theoretical concepts are illustrated with several examples concerning verification processes including quite complex industrial system.

Software & Systems Modeling, 2013

Context-bounded model checking has been used successfully to verify safety properties in multi-threaded systems automatically, even if they are implemented in low-level programming languages such as C. In this paper, we describe and experiment with an approach to extend context-bounded software model checking to safety and liveness properties expressed in linear-time temporal logic (LTL). Our approach checks the actual C program, rather than an extracted abstract model. It converts the LTL formulas into Büchi automata for the corresponding never claims and then further into C monitor threads that are interleaved with the execution of the program under analysis. This combined system is then checked using the ESBMC model checker. We use an extended, fourvalued LTL semantics to handle the finite traces that bounded model checking explores; we thus check the combined system several times with different acceptance criteria to derive the correct truth value. In order to mitigate the state space Communicated by Dr.

Science of Computer Programming, 2011

We present the UMC framework for the formal analysis of concurrent systems specified by collections of UML state machines. The formal model of a system is given by a doubly labelled transition system, and the logic used to specify its properties is the state-based and event-based logic UCTL. UMC is an on-the-fly analysis framework which allows the user to interactively explore a UML model, to visualize abstract behavioural slices of it and to perform local model checking of UCTL formulae. An automotive scenario from the serviceoriented computing (SOC) domain is used as case study to illustrate our approach.

Lecture Notes in Computer Science, 2006

This paper presents Salt. Salt is a general purpose specification and assertion language developed for creating concise temporal specifications to be used in industrial verification environments. It incorporates ideas of existing approaches, such as specification patterns, but also provides nested scopes, exceptions, support for regular expressions and real-time. The latter is needed in particular for verification tasks to do with reactive systems imposing strict execution times and deadlines. However, unlike other formalisms used for temporal specification of properties, Salt does not target a specific domain. The paper details on the design rationale, syntax and semantics of Salt in terms of a translation to temporal (real-time) logic, as well as on the realisation in form of a compiler. Our results will show that the higher level of abstraction introduced with Salt does not deprave the efficiency of the subsequent verification tools-rather, on the contrary.

ACM SIGSOFT Software Engineering Notes, 2003

Model checking is an automated technique for verifying that a system satisfies a set of required properties. Such properties are typically expressed as temporal logic formulas, in which atomic propositions are predicates over state variables of the system. In event-based system descriptions, states are not characterized by state variables, but rather by the behavior that originates in these states in terms of actions. In this context, it is natural for temporal formulas to be built from atomic propositions that are predicates on the occurrence of actions. The paper identifies limitations in this approach and introduces "fluent" propositions that permit formulas to naturally express properties that combine state and action. A fluent is a property of the world that holds after it is initiated by an action and ceases to hold when terminated by another action. The paper describes an approach to model checking fluent-based linear-temporal logic properties, with its implementati...

formal methods in computer-aided design, 2010

SystemC is becoming a de-facto standard for the development of embedded systems. Verification of SystemC designs is critical since it can prevent error propagation down to the hardware. SystemC allows for very efficient simulations before synthesizing the RTL description, but formal verification is still at a preliminary stage. Recent works translate SystemC into the input language of finite-state model checkers, but they abstract away relevant semantic aspects, and show limited scalability. In this paper, we approach formal verification of SystemC by reduction to software model checking. We explore two directions. First, we rely on a translation from SystemC to a sequential C program, that contains both the mapping of the SystemC threads in form of C functions, and the coding of relevant semantic aspects (e.g. of the SystemC kernel). In terms of verification, this enables the "off-the-shelf" use of model checking techniques for sequential software, such as lazy abstraction. Second, we propose an approach that exploits the intrinsic structure of SystemC. In particular, each SystemC thread is translated into a separate sequential program and explored with lazy abstraction, while the overall verification is orchestrated by the direct execution of the SystemC scheduler. The technique can be seen as generalizing lazy abstraction to the case of multi-threaded software with exclusive threads and cooperative scheduling. The above approaches have been implemented in a new software model checker. An experimental evaluation carried out on several case studies taken from the SystemC distribution and from the literature demonstrate the potential of the approach.