Enhancing state space reduction techniques for model checking

Model-checking is een techniek voor het automatisch opsporen van fouten in en de verificatie van hardware en software. De techniek is gebaseerd op het doorzoeken van de globale toestandsruimte van het systeem. Deze toestandsruimte groeit vaak exponentieel met de grootte van de systeembeschrijving. Als gevolg hiervan is een van de voornaamste knelpunten in model-checking de zogenaamde toestandsexplosie. Er bestaan veel aanpakken om met dit probleem om te gaan. We presenteren verbeteringen van sommige bestaande technieken voor reductie van de toestandsruimte die gebaseerd zijn op expliciete enumeratie van die ruimte. We schenken vooral aandacht aan het verbeteren van verscheidene algoritmen die, hoewel ze slechts een deel van de toestandsruimte onderzoeken, nog steeds gegeven een eigenschap kunnen bewijzen of weerleggen. In het bijzonder is ons onderzoek toegespitst op twee typen reducties. Het eerste type, parti¨eleordening (PO) reductie, buit de onafhankelijkheid van acties in het systeem uit. Het tweede type is een klasse van reducties die voordeel halen uit symmetrie¨en van het systeem. De voornaamste bijdragen van dit proefschrift in verband met de parti¨ele ordening reductie zijn de volgende: – Het gebruik van systeemhi¨erarchie voor effici¨entere parti¨ele-ordening reductie door klustering van processen – De meeste model-checking technieken beschouwen het model als een platte compositie van processen. We laten zien hoe de reductie kan profiteren van de systeemstructuur door uitbuiting van de hi¨erarchie in het systeem (Hoofdstuk 2). – Correcte syntactische criteria om onafhankelijke acties te vinden voor parti¨ele ordening reductie voor systemen met synchronizerende communicaties die gecombineerd zijn met prioriteit-keuze en/of zwakke fairness (Hoofdstuk 3). – Parti¨ele-ordening reductie voor discrete tijd – We laten zien hoe het algoritme voor parti¨ele ordening reductie zonder tijd aangepast kan worden, in het geval tijd gerepresenteerd wordt middels gehele getallen (Hoofdstuk 4). De bijdragen betreffende symmetrie-gebaseerde reducties kunnen als volgt samengevat worden: – Effici¨ente heuristieken voor het vinden van representanten van equivalentieklassen voor symmetrie-gebaseerde reductie (Hoofdstuk 6). – Een effici¨ent algoritme voor model-checking onder zwakke fairness met toestandsruimte reductietechnieken die gebaseerd zijn op symmetrie (Hoofdstuk 7). Het succes van model-checking is voornamelijk gebaseerd op de relatief gemakkelijke implementatie in software gereedschappen. Bijna alle bovengenoemde theoretische resultaten zijn ge¨implementeerd in de praktijk en de ontwikkelde prototype implementaties zijn ge¨evalueerd in praktijkstudies. Het meeste implementatie werk is gerelateerd aan de model checker Spin. Van de praktische bijdragen in dit document noemen we: – DT Spin – een uitbreiding van Spin met discrete tijd die het in het proefschrift gepresenteerd discrete-tijd PO reductie algoritme bevat (Hoofdstuk 4). – if2pml – een vertaler van de modelleertaal IF naar Spins invoertaal Promela, die als het tweede deel van een vertaler van SDL naar Promela bedoeld is (Hoofdstuk 5). – SymmSpin – een symmetrie-reductie pakket voor Spin, gebaseerd op de heuristiek beschreven in dit proefschrift (Hoofdstuk 6). De implementaties zijn getest op voorbeelden uit de literatuur en het bedrijfsleven met bemoedigende resultaten. In het bijzonder noemen we MASCARA – een industrieel protocol dat draadloze communicatie met ATM combineert (Hoofdstuk 5). De experimenten zijn niet alleen een aanwijzing voor de kwaliteit van de resultaten en de implementatie, maar ze waren en zijn ook een inspiratie voor nieuw theoretisch werk. Een typerend voorbeeld is de verenigbaarheid van parti¨ele ordening reductie met prioriteit-keuze en fairness in modellen met rendez-vous communicatie. De verbetering van het parti¨ele-ordening algoritme was rechtstreeks ge¨inspireerd door experimenten met Spin en zijn discrete-tijd uitbreiding DT Spin, ontwikkeld in dit proefschrift

Efficient Symmetry Reduction and the Use of State Symmetries for Symbolic Model Checking

One technique to reduce the state-space explosion problem in temporal logic model checking is symmetry reduction. The combination of symmetry reduction and symbolic model checking by using BDDs suffered a long time from the prohibitively large BDD for the orbit relation. Dynamic symmetry reduction calculates representatives of equivalence classes of states dynamically and thus avoids the construction of the orbit relation. In this paper, we present a new efficient model checking algorithm based on dynamic symmetry reduction. Our experiments show that the algorithm is very fast and allows the verification of larger systems. We additionally implemented the use of state symmetries for symbolic symmetry reduction. To our knowledge we are the first who investigated state symmetries in combination with BDD based symbolic model checking

Automatic techniques for detecting and exploiting symmetry in model checking

The application of model checking is limited due to the state-space explosion problem – as the number of components represented by a model increase, the worst case size of the associated state-space grows exponentially. Current techniques can handle limited kinds of symmetry, e.g. full symmetry between identical components in a concurrent system. They avoid the problem of automatic symmetry detection by requiring the user to specify the presence of symmetry in a model (explicitly, or by annotating the associated specification using additional language keywords), or by restricting the input language of a model checker so that only symmetric systems can be specified. Additionally, computing unique representatives for each symmetric equivalence class is easy for these limited kinds of symmetry. We present a theoretical framework for symmetry reduction which can be applied to explicit state model checking. The framework includes techniques for automatic symmetry detection using computational group theory, which can be applied with no additional user input. These techniques detect structural symmetries induced by the topology of a concurrent system, so our framework includes exact and approximate techniques to efficiently exploit arbitrary symmetry groups which may arise in this way. These techniques are also based on computational group theoretic methods. We prove that our framework is logically sound, and demonstrate its general applicability to explicit state model checking. By providing a new symmetry reduction package for the SPIN model checker, we show that our framework can be feasibly implemented as part of a system which is widely used in both industry and academia. Through a study of SPIN users, we assess the usability of our automatic symmetry detection techniques in practice

Automata-theoretic and bounded model checking for linear temporal logic

In this work we study methods for model checking the temporal logic LTL. The focus is on the automata-theoretic approach to model checking and bounded model checking. We begin by examining automata-theoretic methods to model check LTL safety properties. The model checking problem can be reduced to checking whether the language of a finite state automaton on finite words is empty. We describe an efficient algorithm for generating small finite state automata for so called non-pathological safety properties. The presented implementation is the first tool able to decide whether a formula is non-pathological. The experimental results show that treating safety properties can benefit model checking at very little cost. In addition, we find supporting evidence for the view that minimising the automaton representing the property does not always lead to a small product state space. A deterministic property automaton can result in a smaller product state space even though it might have a larger number states. Next we investigate modular analysis. Modular analysis is a state space reduction method for modular Petri nets. The method can be used to construct a reduced state space called the synchronisation graph. We devise an on-the-fly automata-theoretic method for model checking the behaviour of a modular Petri net from the synchronisation graph. The solution is based on reducing the model checking problem to an instance of verification with testers. We analyse the tester verification problem and present an efficient on-the-fly algorithm, the first complete solution to tester verification problem, based on generalised nested depth-first search. We have also studied propositional encodings for bounded model checking LTL. A new simple linear sized encoding is developed and experimentally evaluated. The implementation in the NuSMV2 model checker is competitive with previously presented encodings. We show how to generalise the LTL encoding to a more succint logic: LTL with past operators. The generalised encoding compares favourably with previous encodings for LTL with past operators. Links between bounded model checking and the automata-theoretic approach are also explored.reviewe

Replication and Abstraction: Symmetry in Automated Formal Verification.

This article surveys fundamental and applied aspects of symmetry in system models, and of symmetry reduction methods used to counter state explosion in model checking, an automated formal verification technique. While covering the research field broadly, we particularly emphasize recent progress in applying the technique to realistic systems, including tools that promise to elevate the scope of symmetry reduction to large-scale program verification. The article targets researchers and engineers interested in formal verification of concurrent systems

Symmetry and partial order reduction techniques in model checking Rebeca

Rebeca is an actor-based language with formal semantics that can be used in modeling concurrent and distributed software and protocols. In this paper, we study the application of partial order and symmetry reduction techniques to model checking dynamic Rebeca models. Finding symmetry based equivalence classes of states is in general a difficult problem known to be as hard as graph isomorphism. We show how, for Rebeca models, we can tackle this problem with a polynomial-time solution. Moreover, the coarse-grained interleaving semantics of Rebeca causes considerable reductions when partial order reduction is applied. We have also developed a tool that can make use of both techniques in combination or separately. The evaluation results show significant improvements in model size and model-checking time

Security Analysis of System Behaviour - From "Security by Design" to "Security at Runtime" -

The Internet today provides the environment for novel applications and processes which may evolve way beyond pre-planned scope and purpose. Security analysis is growing in complexity with the increase in functionality, connectivity, and dynamics of current electronic business processes. Technical processes within critical infrastructures also have to cope with these developments. To tackle the complexity of the security analysis, the application of models is becoming standard practice. However, model-based support for security analysis is not only needed in pre-operational phases but also during process execution, in order to provide situational security awareness at runtime. This cumulative thesis provides three major contributions to modelling methodology. Firstly, this thesis provides an approach for model-based analysis and verification of security and safety properties in order to support fault prevention and fault removal in system design or redesign. Furthermore, some construction principles for the design of well-behaved scalable systems are given. The second topic is the analysis of the exposition of vulnerabilities in the software components of networked systems to exploitation by internal or external threats. This kind of fault forecasting allows the security assessment of alternative system configurations and security policies. Validation and deployment of security policies that minimise the attack surface can now improve fault tolerance and mitigate the impact of successful attacks. Thirdly, the approach is extended to runtime applicability. An observing system monitors an event stream from the observed system with the aim to detect faults - deviations from the specified behaviour or security compliance violations - at runtime. Furthermore, knowledge about the expected behaviour given by an operational model is used to predict faults in the near future. Building on this, a holistic security management strategy is proposed. The architecture of the observing system is described and the applicability of model-based security analysis at runtime is demonstrated utilising processes from several industrial scenarios. The results of this cumulative thesis are provided by 19 selected peer-reviewed papers

Certified Reinforcement Learning with Logic Guidance

This paper proposes the first model-free Reinforcement Learning (RL) framework to synthesise policies for unknown, and continuous-state Markov Decision Processes (MDPs), such that a given linear temporal property is satisfied. We convert the given property into a Limit Deterministic Buchi Automaton (LDBA), namely a finite-state machine expressing the property. Exploiting the structure of the LDBA, we shape a synchronous reward function on-the-fly, so that an RL algorithm can synthesise a policy resulting in traces that probabilistically satisfy the linear temporal property. This probability (certificate) is also calculated in parallel with policy learning when the state space of the MDP is finite: as such, the RL algorithm produces a policy that is certified with respect to the property. Under the assumption of finite state space, theoretical guarantees are provided on the convergence of the RL algorithm to an optimal policy, maximising the above probability. We also show that our method produces ''best available'' control policies when the logical property cannot be satisfied. In the general case of a continuous state space, we propose a neural network architecture for RL and we empirically show that the algorithm finds satisfying policies, if there exist such policies. The performance of the proposed framework is evaluated via a set of numerical examples and benchmarks, where we observe an improvement of one order of magnitude in the number of iterations required for the policy synthesis, compared to existing approaches whenever available.Comment: This article draws from arXiv:1801.08099, arXiv:1809.0782

Model checking concurrent and real-time systems : the PAT approach

Ph.DDOCTOR OF PHILOSOPH