Debugging a Real-life Protocol with CFFD-Based Verification Tools

For over four decades now, variants of Model Checkers are being used as an approach for formal verification of systems consisting of software, hardware or combination of both. Though various model checking tools are available like NuSMV, UPPAAL, PRISM, PAT,FDR, it is difficult to comprehend their usage for systems in different domains like telecommunication, automobile, health and entertainment. However, industry experts and researchers have showcased the use of formal verifications techniques in various domains including Networking, Security and Semiconductor design. With current generation systems becoming more complex, there is an urgent need to better understand and use appropriate methodology, language and tool for definite domain. In this paper, we have made an effort to present Model checking in detail with relevance to available tools and languages to specific domain. For novices in the field, this paper would provide knowledge of model checkers languages and tools that would be suitable for various purposes in diverse systems.

Computer Aided Verification, 1996

2008

Model checking involves exploring state-space of system model and automatically proving or disproving the correct functionality of the system. Verification of all properties may not require exploration of the state-space in its entirety. However, traditional model checkers are not equipped with enough knowledge of the system apriori to make smart decisions so as to explore only those portions of state-space that contribute to the result. In this paper, we present a technique to provide such guidance to the model checker so that it can perform state-space exploration more intelligently. We incorporated our technique in XMC model checker, a tool for verifying process expressions in CCS against properties expressed by modal mu-calculus formulas. We demonstrate the applicability of our guidance mechanism by verifying several example protocols from XMC test-suite.

Proceedings 2003. Design Automation Conference (IEEE Cat. No.03CH37451), 2003

We describe a technique for verifying that a hardware design correctly implements a protocol-level formal specification. Simulation steps are translated to protocol state transitions using a refinement map and then verified against the specification using a model checker. On the specification state space, the model checker collects coverage information and identifies states violating certain properties. It then generates protocol-level traces to these coverage gaps and error states. This technique was applied to the multiprocessing hardware of the Alpha 21364 microprocessor and the cache coherence protocol. We were able to generate an error trace which exercised a bug in the implementation that had not been discovered before a prototype was built.

1996

Communication protocols pose interesting and difficult challenges for verification technologies. The state spaces of interesting protocols are either infinite or too large for finite-state verification techniques like model checking and state exploration. Theorem proving is also not effective since the formal correctness proofs of these protocols can be long and complicated. We describe a series of protocol verification experiments culminating in a methodology where theorem proving is used to abstract out the sources of unboundedness in the protocol to yield a skeletal protocol that can be verified using model checking. Our experiments focus on the Philips bounded retransmission protocol originally studied by Groote and van de Pol and by Helmink, Sellink, and Vaandrager. First, a scaled-down version of the protocol is analyzed using the Murø state exploration tool as a debugging aid and then translated into the PVS specification language. The PVS verification of the generalized protocol illustrates the difficulty of using theorem proving to verify infinite-state protocols. Some of this difficulty can be overcome by extracting a finite-state abstraction of the protocol that preserves the property of interest while being amenable to model checking. We compare the performance of Murø, SMV, and the PVS model checkers on this reduced protocol.

Proceedings of the 10th workshop on ACM SIGOPS European workshop: beyond the PC - EW10, 2002

Complex systems have errors that involve mishandled corner cases in intricate sequences of events. Conventional testing techniques usually miss these errors. In recent years, formal verification techniques such as [5] have gained popularity in checking a property in all possible behaviors of a system. However, such techniques involve generating an abstract model of the system. Such an abstraction process is unreliable, difficult and miss a lot of implementation errors. CMC is a framework for model checking a broad class of software written in the C programming language. CMC runs the software implementation directly without deriving an abstract model of the code. We used CMC to model check an existing implementation of AODV (Ad Hoc On Demand Distance Vector) routing protocol and found a total of ¡ £ ¢ bugs in two implementations [7],[6] of the protocol. One of them is a bug in the actual specification of the AODV protocol [3]. We also used CMC on the IP Fragmentation module in the Linux TCP/IPv4 stack and verified its correctness for up to ¤ fragments per packet.

2012

Model checking is applied for verification of concurrent systems by users having different skills and background. This ranges from researchers with detailed knowledge of the inner workings of the tools to engineers that are mostly interested in applying the technology as a black-box. This paper proposes JoSEL, a graphical language for specification of executable model checking jobs.

2000

The majority of the work carried out in the formal methods community throughout the last three decades has (for good reasons) been devoted to special languages designed to make it easier to experiment with mechanized formal methods such as theorem provers and model checkers. In this paper, we give arguments for why we believe it is time for the formal methods community to shift some of its attention towards the analysis of programs written in modern programming languages. In keeping with this philosophy, we have developed a verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing. Part of this work has consisted of building a new Java Virtual Machine that interprets Java bytecode. JPF uses state compression to handle large states, and partial order reduction, slicing, abstraction and run-time analysis techniques to reduce the state space. JPF has been applied to a real-time avionics operating system developed at Honeywell, illustrating an intricate error, and to a model of a spacecraft controller, illustrating the combination of abstraction, run-time analysis and slicing with model checking

Proceedings of the Tenth International Conference on Enterprise Information Systems

When we build complex business and communication systems, the question worth to be answered: How can we guarantee that the target system meets its specification? Ensuring the correctness of large systems becomes more complex when we consider that their behaviour is the result of the concurrent execution of many components. This article presents a compositional verification scheme, that integrates MEDISTAM-RT (Spanish acronym of Method for System Design based on Analytic Transformation of Real-Time Models), which is formally supported by state-of-the-art Model-Checking tools. To facilitate and guarantee the verification of large systems, the proposed scheme uses CCTL temporal logic as the property specification formal language, in which temporal properties required to any system execution are specified. In its turn, CSP+T formal language is used to formally describe a model of the system being verified, which is made up of a set of communicating processes detailing specific atomic-tasks of the system. In order to show a practical use of the proposed conceptual scheme, the critical part of a realistic industry project related to mobile phone communication is discussed.

Lecture Notes in Computer Science, 2014

Formal methods have an important role in ensuring the correctness of safety critical systems. However, their application in industry is always cumbersome: the lack of experts and the complexity of formal languages prevents the efficient application of formal verification techniques. In this paper we take a step in the direction of making formal modelling simpler by introducing a framework which helps designers to construct formal models efficiently. Our formal modelling framework supports the development of traditional transition systems enriched with complex data types with type checking and type inference services, time dependent behaviour and timing parameters with relations. In addition, we introduce a toolchain to provide formal verification. Finally, we demonstrate the usefulness of our approach in an industrial case study.

Software Testing, Verification and Reliability, 2002

obtained issuing abstractions of the system on the basis of the formula. Experimental results are shown and discussed.

Lecture Notes in Computer Science, 2012

We present McScM, a platform for implementing and comparing verification algorithms for the class of finite-state processes exchanging messages over reliable, unbounded FIFO channels. McScM provides tools for the safety verification and controller synthesis of these infinite-state models. Our verification tool implements several modelchecking techniques: CEGAR with different abstraction-refinement methods, abstract interpretation, abstract regular model checking, and lazy abstraction. Seen as a general framework for the class of transition systems with finite control/infinite data, McScM delivers the basic infrastructure for implementing verification algorithms, and privileges to conveniently implement new ideas on a high level of abstraction. It also allows us to compare and benchmark different algorithmic approaches with the same backend.

As more resources are added to computer networks, and as more vendors look to the World Wide Web as a viable marketplace, the importance of being able to restrict access and to insure some kind of acceptable behavior even in the presence of malicious intruders becomes paramount. People have looked to cryptography to help solve many of these problems. However, cryptography itself is only a tool. The security of a system depends not only on the cryptosystem being used, but also on how it is used. Typically, researchers have proposed the use of security protocols to provide these security guarantees. These protocols consist of a sequence of messages, many with encrypted parts. In this paper, we develop a way of verifying these protocols using model checking. Model checking has proven to be a very useful technique for verifying hardware designs. By modelling circuits as nite-state machines, and examining all possible execution traces, model checking has found a number of errors in real world designs. Like hardware designs, security protocols are very subtle, and can also have bugs which are di cult to nd. By examining all possible execution traces of a security protocol in the presence of a malicious intruder with well de ned capabilities, we can determine if a protocol does indeed enforce its security guarantees. If not, we can provide a sample trace of an attack on the protocol.

2008 Ninth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing, 2008

For software executing several threads in parallel, testing is unreliable, as it cannot cover all thread schedules. Model checking, however, can cover all possible thread interleavings. Software model checkers can directly verify an implementation, but typically cannot handle network input/output operations, which most programs require. This shortcoming can be addressed by a special model checker designed for multiple processes, or by different kinds of extensions and preprocessors for existing model checkers. This paper surveys currently existing approaches and tools.

Proceedings of the 10th international workshop on Formal methods for industrial critical systems - FMICS '05, 2005

The application of model checking technology to real software seems to be a promising and realistic approach to increase its quality. There are some successful examples of tools for this purpose, mainly working with self-contained programs. However, verifying software that uses external functionality provided by the operating system via APIs is currently a challenging trend. In this paper, we give a method for using the tool spin to verify distributed software systems that use the API Socket and the network protocol stack TCP/IP for communications. Our approach consists in building a model of the underlying operating system to be joined with the original C code in order to obtain the input for the model checker. We define and use a formal semantics of the API to conduct the correct construction of models. The whole modelling process is transparent to the C programmer, because it is performed automatically and without special syntactic constraints in the input C code. Regarding verification, we consider optimization techniques suitable for this application domain, and we ensure that the system only reports potential (non-spurious) errors.