DOCSLIB.ORG

Program Model Checking

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Program Model Checking National Aeronautics and Space Administration Intelligent Systems Division NASA Ames Research Center Program Model Checking A Practitioner’s Guide Masoud Mansouri-Samani, Perot Systems Government Services Peter C. Mehlitz, Perot Systems Government Services Corina S. Pasareanu, Perot Systems Government Services John J. Penix, Google, Inc. Guillaume P. Brat, USRA/RIACS Lawrence Z. Markosian, Perot Systems Government Services Owen O’Malley, Yahoo, Inc. Thomas T. Pressburger, NASA Ames Research Center Willem C. Visser, Seven Networks, Inc. January 15, 2008 Version 1.1 Contents CONTENTS ..................................................................................................................... III FIGURES .........................................................................................................................IX PREFACE........................................................................................................................XI 1 INTRODUCTION......................................................................................................... 1 1.1 What is Model Checking?........................................................................................1 1.2 Hardware vs. Software Model Checking.................................................................1 1.3 What is Program Model Checking?.........................................................................2 1.4 Advantages of Model Checking...............................................................................3 1.5 Model-Checking Challenges....................................................................................4 1.6 Objectives of this Guidebook...................................................................................5 2 PROGRAMS, PROPERTIES, AND MODELS............................................................ 7 2.1 Models......................................................................................................................7 2.1.1 Model Construction ...............................................................................................7 2.1.2 Model Extraction ....................................................................................................7 2.1.3 Programs as Models...............................................................................................8 2.2 Model Checking a Program .....................................................................................8 2.3 Properties .................................................................................................................9 2.3.1 Types of Properties...............................................................................................10 2.3.1.1 Generic vs. Application-Specific Properties ....................................... 10 2.3.1.2 Safety Properties ..................................................................................... 10 2.3.1.3 Liveness Properties................................................................................. 11 2.3.1.4 Fairness Properties ................................................................................. 11 2.3.1.5 Temporal Properties............................................................................... 11 2.3.2 Identifying and Eliciting Critical Properties.....................................................11 2.3.3 Specifying Properties ...........................................................................................12 iii Program Model Checking: A Practitioner’s Guide 2.3.3.1 Property Specification in Java PathFinder .......................................... 12 2.3.3.2 Property Specification in SPIN ............................................................. 13 2.3.3.3 Property Patterns.................................................................................... 13 2.3.4 Inserting Property Oracles ..................................................................................14 2.3.4.1 Programming by Contract..................................................................... 15 2.3.4.1.1 Support for Programming by Contract 16 2.3.4.1.2 Other Uses of Programming by Contract 22 2.3.4.2 Aspect-Oriented Programming ............................................................ 22 2.3.5 Understanding Property Violations...................................................................24 3 TEST DRIVERS AND ENVIRONMENT MODELS ................................................... 25 3.1 Analyzing Open Programs.....................................................................................25 3.2 Universal Environments.........................................................................................25 3.3 Filter-Based Methods.............................................................................................27 3.3.1 Discharging Assumptions...................................................................................28 3.4 Tool Support and Applications ..............................................................................29 4 PROGRAM ABSTRACTION .................................................................................... 31 4.1 Introduction............................................................................................................31 4.1.1 Property Preservation ..........................................................................................31 4.1.1.1 Weak Preservation.................................................................................. 31 4.1.1.2 Strong Preservation ................................................................................ 32 4.1.1.3 Error Preservation .................................................................................. 32 4.1.2 Behavior Approximation.....................................................................................32 4.1.2.1 Over-approximation............................................................................... 32 4.1.2.2 Under-approximation ............................................................................ 33 4.1.2.3 Exact Abstraction.................................................................................... 33 4.2 Data Abstraction ....................................................................................................33 4.2.1 Abstract Interpretation ........................................................................................34 4.2.2 Useful Abstractions ..............................................................................................36 4.2.3 Abstracting Non-base Types...............................................................................37 4.2.3.1 Abstractions for Data Structures .......................................................... 37 4.2.3.2 Data Independence................................................................................. 37 iv 4.2.3.3 Container Abstractions .......................................................................... 37 4.2.3.4 Heap Abstractions .................................................................................. 38 4.3 Predicate Abstraction.............................................................................................39 4.4 Model-Driven Verification ....................................................................................40 4.5 Tool Support and Applications ..............................................................................42 5 SEARCH AND PARTIAL COVERAGE .................................................................... 45 5.1 Selecting a Search Strategy....................................................................................46 5.1.1 Depth-First Search ................................................................................................46 5.1.2 Breadth-First Search .............................................................................................46 5.1.3 DFS and BFS Tradeoffs ........................................................................................46 5.1.4 Bounded Searches.................................................................................................47 5.1.5 Heuristic Search....................................................................................................47 5.1.5.1 Best-First Search...................................................................................... 48 5.1.5.1.1 Greedy Best-First Search 48 5.1.5.1.2 A* Search 48 5.1.5.1.3 Beam Search 49 5.1.5.2 Random Search ....................................................................................... 49 5.2 Model Checking vs. Testing ..................................................................................50 5.3 Coverage for Model Checking...............................................................................51 5.4 Directed Model Checking......................................................................................52 5.4.1 Property-Specific Heuristics................................................................................52 5.4.2 Structural Heuristics ............................................................................................53 5.4.2.1 Code Coverage Heuristics..................................................................... 53 5.4.2.2 Thread Interleaving Heuristics............................................................. 54 5.4.2.3 Thread Preference Heuristic ................................................................. 55 5.4.2.4 Choose-free Heuristic............................................................................
Load more

Recommended publications
  • Formal Verification of Hardware Peripheral with Security Property
    EXAMENSARBETE INOM TEKNIK, GRUNDNIVÅ, 15 HP STOCKHOLM, SVERIGE 2017 Formal Verification of Hardware Peripheral with Security Property Formell verifikation av extern hårdvara med säkerhetskrav VT 2017 NIKLAS ROSENKRANTZ JONATHAN Y HÅKANSSON KTH SKOLAN FÖR DATAVETENSKAP OCH KOMMUNIKATION Formal Verification of Hardware Peripheral with Security Property Jonathan Yao Håkansson, Niklas Rosencrantz Supervisor: Roberto Guanciale Examiner: Örjan Ekeberg CSC, KTH 2017 Abstract One problem with computers is that the operating system automatically trusts any externally connected peripheral. This can result in abuse when a peripheral technically can violate the security model because the peripheral is trusted. Because of that the security is an important issue to look at. The aim of our project is to see in which cases hardware peripherals can be trusted. We built a model of the universal asynchronous transmitter/receiver (UART), a model of the main memory (RAM) and a model of a DMA controller. We analysed interaction between hardware peripherals, user processes and the main memory. One of our results is that connections with hardware peripherals are secure if the hardware is properly configured. A threat scenario could be an eavesdropper or man-in-the-middle trying to steal data or change a cryptographic key. We consider the use-cases of DMA and protecting a cryptographic key. We prove the well-behavior of the algorithm. Some error-traces resulted from incorrect modelling that was resolved by adjusting the models. Benchmarks were done for different memory sizes. The result is that a peripheral can be trusted provided a configuration is done. Our models consist of finite state machines and their corresponding SMV modules.
    [Show full text]
  • Advanced SPIN Tutorial
    Advanced SPIN Tutorial Theo C. Ruys1 and Gerard J. Holzmann2 1 Department of Computer Science, University of Twente. P.O. Box 217, 7500 AE Enschede, The Netherlands. http://www.cs.utwente.nl/~ruys/ 2 NASA/JPL, Laboratory for Reliable Software. 4800 Oak Grove Drive, Pasadena, CA 91109, USA. http://spinroot.com/gerard/ Abstract. Spin [9] is a model checker for the verification of distributed systems software. The tool is freely distributed, and often described as one of the most widely used verification systems. The Advanced Spin Tu- torial is a sequel to [7] and is targeted towards intermediate to advanced Spin users. 1 Introduction Spin [2{5, 9] supports the formal verification of distributed systems code. The software was developed at Bell Labs in the formal methods and verification group starting in 1980. Spin is freely distributed, and often described as one of the most widely used verification systems. It is estimated that between 5,000 and 10,000 people routinely use Spin. Spin was awarded the ACM Software System Award for 2001 [1]. The automata-theoretic foundation for Spin is laid by [10]. The very recent [5] describes Spin 4.0, the latest version of the tool. The Spin software is written in standard ANSI C, and is portable across all versions of the UNIX operating system, including Mac OS X. It can also be compiled to run on any standard PC running Linux or Microsoft Windows. 2 Tutorial The Advanced Spin Tutorial is a sequel to [7] and is targeted towards interme- diate to advanced Spin users. The objective of the Advanced Spin Tutorial is to (further) educate the Spin 2004 attendees on model checking technology in general and Spin in particular.
    [Show full text]
  • Experiences from Large-Scale Model Checking: Verification of a Vehicle Control System
    Experiences from Large-Scale Model Checking: Verification of a Vehicle Control System Jonas Fritzsch Tobias Schmid Stefan Wagner University of Stuttgart BMW AG University of Stuttgart Institute of Software Engineering Munich, Germany Institute of Software Engineering Stuttgart, Germany [email protected] Stuttgart, Germany [email protected] [email protected] Abstract—In the age of autonomously driving vehi- safety that depends on a system or equipment operating cles, functionality and complexity of embedded systems correctly in response to its inputs” [3] is associated with the are increasing tremendously. Safety aspects become involved electrical, electronic, and programmable systems. more important and require such systems to operate with the highest possible level of fault tolerance. Simu- Car manufacturers thus need to “prove that the designed lation and systematic testing techniques have reached system fulfills the functional safety requirements according their limits in this regard. Here, formal verification to ISO 26262” [4] which is mandatory for the certification as a long established technique can be an appropriate of automated driving systems [5]. complement. However, the necessary preparatory work Traditional testing and simulation techniques, or failure like adequately modeling a system and specifying prop- erties in temporal logic are anything but trivial. In this mode and effects analysis (FMEA) alone reach their limits paper, we report on our experiences applying model in this regard. An exhaustive verification with limited checking to verify the arbitration logic of a Vehicle resources and time is difficult to achieve or even im- Control System. We balance pros and cons of different possible.
    [Show full text]
  • Incremental Learning and Testing of Reactive Systems
    Incremental Learning and Testing of Reactive Systems MUDDASSAR AZAM SINDHU Licentiate Thesis Stockholm, Sweden 2011 TRITA-CSC-A 2011:14 ISSN 1653-5723 KTH CSC ISRN KTH/CSC/A–11/14-SE SE-100 44 Stockholm ISBN 978-91-7501-062-5 SWEDEN Akademisk avhandling som med tillstånd av Kungl Tekniska högskolan framläg- ges till offentlig granskning för avläggande av teknologie licentiatexamen i datalogi Fredagen den 30 September 2011 klockan 10.00 i K2, Kungl Tekniska högskolan, Teknikringen 28 , Stockholm. © Muddassar Azam Sindhu, September 2011 Tryck: Universitetsservice US AB iii Dedication To Ammi, Abbu and Fari Abstract This thesis concerns the design, implementation and evaluation of a spec- ification based testing architecture for reactive systems using the paradigm of learning-based testing. As part of this work we have designed, verified and implemented new incremental learning algorithms for DFA and Kripke struc- tures. These have been integrated with the NuSMV model checker to give a new learning-based testing architecture. We have evaluated our architecture on case studies and shown that the method is effective. Acknowledgements I owe my deepest gratitude to my supervisor Prof. Karl Meinke without whose support this thesis would not have been possible. His thorough understanding of the subject, deep insight into the field and expertise during his lectures and meetings was always a source of knowledge and inspiration for me. His apt comments and constructive criticism always helped me to improve my work. His patience and encouragement whenever I was down during the last two and a half years always enabled me to re-start with a new zeal.
    [Show full text]
  • Tool Presentation: Teaching Concurrency and Model Checking
    Tool Presentation: Teaching Concurrency and Model Checking Mordechai (Moti) Ben-Ari Department of Science Teaching Weizmann Institute of Science Rehovot 76100 Israel [email protected], http://stwww.weizmann.ac.il/g-cs/benari/ Abstract. This paper describes a set of software tools developed for teaching concurrency and model checking. jSpin is an elementary de- velopment environment for Spin that formats and filters the output of a simulation according to the user's specification. SpinSpider uses debugging output from Spin to generate a diagram of the state space of a Promela model; the diagram can be incrementally displayed us- ing iDot. VN supports teaching nondeterministic finite automata. The Erigone model checker is a partial reimplementation of Spin designed to be easy to use, well structured and well documented. It produces a full trace of the execution of the model checker in a format that is both readable and amenable to postprocessing. 1 Introduction Concurrency is a notoriously difficult subject to learn because the indeterminate behavior of programs poses challenges for students used to debugging programs by trial and error. They must learn new concepts of specification and correctness, as well as formal methods such as state transition diagrams and temporal logic. Several years ago, I became convinced that the Spin model checker is appropriate for teaching concurrency. This led me to write a new edition of my concurrency textbook [1], followed by an introductory textbook on Spin [2]. During this period, I developed software tools for teaching with Spin: jSpin, a development environment; SpinSpider, which automatically generates the state space diagram of a Promela program that can be viewed incrementally with iDot; VN, a tool to support learning nondeterminism of finite automata (NDFA).
    [Show full text]
  • Model Checking of Software for Microcontrollers
    Aachen Department of Computer Science Technical Report Model Checking of Software for Microcontrollers Bastian Schlich ISSN 0935–3232 Aachener Informatik Berichte AIB-2008-14 · · RWTH Aachen Department of Computer Science June 2008 · · The publications of the Department of Computer Science of RWTH Aachen University are in general accessible through the World Wide Web. http://aib.informatik.rwth-aachen.de/ Model Checking of Software for Microcontrollers Von der Fakultät für Mathematik, Informatik und Naturwissenschaften der RWTH Aachen University zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften genehmigte Dissertation vorgelegt von Diplom-Informatiker Bastian Schlich aus Essen/Ruhr Berichter: Professor Dr.-Ing. Stefan Kowalewski Professor Dr. Jan Peleska Tag der mündlichen Prüfung: 04.06.2008 Diese Dissertation ist auf den Internetseiten der Hochschulbibliothek online verfügbar. Abstract Software of microcontrollers is getting more and more complex. It is mandatory to extensively analyze their software as errors can lead to severe failures or cause high costs. Model checking is a formal method used to verify whether a system satisfies certain properties. This thesis describes a new approach for model checking software for microcon- trollers. In this approach, assembly code is used for model checking instead of an intermediate representation such as C code. The development of [mc]square, which is a microcontroller assembly code model checker implementing this approach, is detailed. [mc]square has a modular architecture to cope with the hardware dependency of this approach. The single steps of the model checking process are divided into separate packages. The creation of the states is conducted by a specific simulator, which is the only hardware-dependent package.
    [Show full text]
  • Establishing Flight Software Reliability: Testing, Model Checking, Constraint-Solving, Monitoring and Learning
    Establishing Flight Software Reliability: Testing, Model Checking, Constraint-Solving, Monitoring and Learning Groce, A., Havelund, K., Holzmann, G., Joshi, R., & Xu, R. G. (2014). Establishing flight software reliability: testing, model checking, constraint-solving, monitoring and learning. Annals of Mathematics and Artificial Intelligence, 70(4), 315-349. doi:10.1007/s10472-014-9408-8 10.1007/s10472-014-9408-8 Springer Accepted Manuscript http://cdss.library.oregonstate.edu/sa-termsofuse Annals of Mathematics and Artificial Intelligence manuscript No. (will be inserted by the editor) Establishing Flight Software Reliability: Testing, Model Checking, Constraint-Solving, Monitoring and Learning Alex Groce · Klaus Havelund · Gerard Holzmann · Rajeev Joshi · Ru-Gang Xu the date of receipt and acceptance should be inserted later Abstract In this paper we discuss the application of a range of techniques to the verification of mission-critical flight software at NASA’s Jet Propulsion Laboratory. For this type of application we want to achieve a higher level of confidence than can be achieved through standard software testing. Unfortunately, given the current state of the art, especially when efforts are constrained by the tight deadlines and resource limitations of a flight project, it is not feasible to produce a rigorous formal proof of correctness of even a well-specified stand-alone module such as a file system (much less more tightly coupled or difficult-to-specify modules). This means that we must look for a practical alternative in the area between traditional testing and proof, as we attempt to optimize rigor and coverage. The approaches we describe here are based on testing, model checking, constraint-solving, monitoring, and finite-state machine learning, in addition to static code analysis.
    [Show full text]
  • A Primer on Model Checking
    extended papers A Primer on Model Checking Mordechai (Moti) Ben-Ari odel checking is a widely used formal method for the verifi cation of concurrent programs. MThis article starts with an introduction to the concepts of model checking, followed by a description of Spin, one of the foremost model checkers. Software tools for teaching concurrency and nondeterminism using model checking are described: Erigone, a model checker for teaching; jSpin, a development environment; VN, a visualization of nondeterminism. INTRODUCTION A BIT OF LOGIC The June 2009 issue of inroads contained a special Suppose that you want to know if ~p->(p->q) is a 1 section on Formal Methods in Education and Train- 2 valid formula of the propositional calculus. You could ing. Several of the papers described the central place do what every mathematician does for a living: prove it of model checking for verifi cation of programs, primarily concurrent using a deductive system consisting of axioms assumed to be valid and distributed programs [14,17]. Model checking verifi es a pro- and rules of inference that preserve validity. The same can be done gram by using software to analyze its state space, as opposed to for computer programs: Deductive systems pioneered by C.A.R. the mathematical deductive methods proposed by the pioneers of Hoare [8] can be used to prove that a program is correct, mean- verifi cation like C.A.R. Hoare. Edmund Clarke, Allen Emerson ing that the execution of the program gives an output that satisfi es and Joseph Sifakis received the 2008 Turing Award for their inven- a correctness property expressed as a formula in logic.
    [Show full text]
  • Formal Verification of Requirements Using SPIN: a Case Study on Web
    Formal Verification of Requirements using SPIN: A Case Study on Web Services∗ Raman Kazhamiakin Marco Pistore Marco Roveri DIT, University of Trento ITC-irst Via Sommarive 14, I-38050, Trento, Italy Via Sommarive 18, I-38050, Trento, Italy {raman,pistore}@dit.unitn.it [email protected] Abstract in software development. Despite its criticality, require- ments are often described only in natural language and re- In this paper we describe a novel approach for the for- quirements analysis techniques are rarely applied. mal specification and verification of distributed processes The Tropos project (http://www.troposproject.org/) in a Web service framework. The formal specification is aims to develop a requirements driven software engineer- provided at two different levels of abstraction. The strategic ing methodology for agent-oriented, distributed systems. level describes the requirements of the Web service domain, Tropos provides graphical notations for requirements mod- in terms of the different actors participating to it, with their els, based on concepts like actors, goals, and dependencies goals and needs and with their mutual dependencies and among actors. Moreover, it adopts a variety of tools and expectations. The process level shows how these require- techniques to support the analysis of the requirements mod- ments are operationalized into communicating processes els. In particular, Tropos provides a formal specification running on the different Web servers. We model the strate- language, called Formal Tropos (hereafter FT). FT supple- gic level exploiting Formal Tropos (FT), a language for the ments the graphical notations with a first-order Linear Tem- formal definition of the requirements of agent-oriented sys- poral Logic (LTL) suitable for automated verification.
    [Show full text]
  • Model-Based Design of Cyber-Physical Systems
    Model-based Design of Cyber-Physical Systems Christian Rinderknecht 28th November 2014 Abstract We survey existing tools and methods for the simulation, testing and verification of concurrent communicating systems, and their pertinence for model-driven design and programming of cyber-physical systems. We also cover workflows and tests and conclude with two proposals. 1 Formal methods In the context of our project, we define a cyber-physical system (CPS) as a wireless mobile network of embedded systems featuring environmental sensors and computational capability. Usually, an embedded system carries on specific control functions with real-time constraints, e.g., related to safety, on top of a real-time operating system (RTOS), but we will extend the notion to encompass general-purpose computers, for example, smartphones and Raspberry Pis running GNU/Linux. Depending on the scale and the nature of the software applications, different network topologies, routing and synchronisation protocols may be used, for example centralised architectures (client-server) or decentralised ones, like peer-to-peer (P2P) or mobile ad hoc networks (MANET), where nodes are also routers. At the application layer, real-time constraints might be expected, as well as code (a.k.a. location) migration and security guarantees. The model-driven design of CPS uses formal models, possibly including real-time features, which are checked with regards to some desired properties and tested through simulation, before implementations are derived. Model checking is a formal method whereby the truth of a logical formula (e.g., of a temporal nature) is checked on a finite model of a system. It is different from testing, which consists in interacting with an implementation, whose state space may be infinite, and observing whether its responses conform to its model (if no stimulation of the system is performed, we have an instance of passive testing).
    [Show full text]
  • Formal Specification and Verification of Autonomous Robotic Systems: a Survey
    Formal Specification and Verification of Autonomous Robotic Systems: A Survey∗ Matt Luckcuck, Marie Farrell, Louise Dennis, Clare Dixon and Michael Fisher Department of Computer Science, University of Liverpool, UK 2nd May 2019 Abstract Autonomous robotic systems are complex, hybrid, and often safety-critical; this makes their formal specification and verification uniquely challenging. Though commonly used, testing and simulation alone are insufficient to ensure the correctness of, or provide sufficient evidence for the certification of, autonomous robotics. Formal methods for autonomous robotics has received some attention in the literature, but no resource provides a current overview. This paper systematically surveys the state-of-the-art in formal specification and verification for autonomous robotics. Specially, it identifies and categorises the challenges posed by, the formalisms aimed at, and the formal approaches for the specification and verification of autonomous robotics. 1 Introduction, Methodology and Related Work An autonomous system is an artificially intelligent entity that makes decisions in response to input, independent of human interaction. Robotic systems are physical entities that interact with the physical world. Thus, we consider an autonomous robotic system as a machine that uses Artificial Intelligence (AI), has a physical presence in and interacts with the real world. They are complex, inherently hybrid, systems, combining both hardware and software; they often require close safety, legal, and ethical consideration. Autonomous robotics are increasingly being used in commonplace-scenarios, such as driverless cars [68], pilotless aircraft [176], and domestic assistants [174, 60]. While for many engineered systems, testing, either through real deployment or via simulation, is deemed suf- ficient; the unique challenges of autonomous robotics, their dependence on sophisticated software control and decision-making, and their increasing deployment in safety-critical scenarios, require a stronger form of verification.
    [Show full text]