Model Checking

Building Information Modelling (BIM) is studied within the public construction procurement scenario, analysing the current situation and further development possibilities, especially how to adopt Model Checking in Tendering. Results can help both public clients and bidders to find out new strategies to improve efficiency. In the future the BIM-based approach needs to be integrated in e-Procurement process to fully take advantage of its potentialities.

A strategy for adaptive control and energetic optimization of aerobic fermentors was implemented, with both air flow and agitation speed as manipulated variables. This strategy is separable in its components: control, optimization, estimation. We optimized parameter’s estimation (from the usual KLa correlation) using sinusoidal excitation of air flow and agitation speed. We have implemented parameter’s estimation trough recursive least squares algorithm with forgetting factor. We carried separate essays on control, optimization and estimation algorithms. We carried our essays using an original computational simulation environment, with noise and delay generating facilities for data sampling and filtering.

Our results show the convergence and robustness of the estimation algorithm used, improved with use of both forgetting factor and KLa dead-band facilities. Control algorithm used in our work compares favorably with PID using the integrated area criteria for deviation between oxygen molarity and critical molarity (set point). Optimization algorithm clearly reduces energetic consumption, respecting critical molarity. Integration of control, optimization and adaptive algorithms was implemented, but future work is needed for stability. Methods were defined and implemented for stability improvement. We have implemented data acquisition and computer manipulation of air flow and agitation speed for actual fermentors.

The construction industry, particularly the public sector, started drawing attention towards containing costs and increasing performance. This is why several public entities worldwide are promoting new strategies and adopted innovating approaches such as the Building Information
Modelling (BIM). Countries like the UK, Germany, France and Spain are working on it through
investments in the industry digitalization. In Italy, despite the fact that the growing implementation of
information-based technologies is not supported by a governmental strategy, public calls for tender
requiring BIM have been set up. In addition, in order to benefit from a BIM-based approach, cooperating processes are being arranged to involve several parties from the very first stages of the
project itself. This way flaws will be sorted out in advance and out of the construction site, and at the
same time ideal solutions will be identified for the entire building lifecycle. Within the BIM methodology, a key role is played by Model Checking, which enables verification and validation of all projects, not only in the design phase, but also throughout the process phases. In order to guarantee reliable results, an initial pre-check should be carried out, the so called BIM Validation. This validates the data content of the Information Model and subsequently carries out analyses such as Clash Detection and Code Checking. The Information Model must come out of a meticulous modelling phase, in order to validate its geometric and alphanumeric content and ensure reliable results first, and then proceed with subsequent BIM-based analyses.

La validazione del contenuto informativo è la chiave del successo di un processo BIM-based 9 Parole chiave: Building Information Modelling (BIM), Model Checking, Appalti Pubblici. Abstract L'industria delle costruzioni, e in particolar modo il settore pubblico, ha iniziato a porre più attenzione al contenimento dei costi e all'aumento delle prestazioni. Per questo motivo diversi enti pubblici in tutto il mondo stanno promuovendo nuove strategie adottando approcci innovativi come il Building Information Modelling (BIM). Paesi come Regno Unito, Germania, Francia e Spagna stanno lavorando in questa direzione investendo nella digitalizzazione del settore. Anche in Italia, sebbene l'implementazione, sempre più diffusa, delle tecnologie information-based non sia accompagnata da una strategia governativa, sono stati pubblicati bandi pubblici che richiedono l'uso del BIM. Inoltre, al fine di trarre maggiori vantaggi da un approccio BIM-based, si stanno diffondendo processi collaborativi che prevedono un coinvolgimento dei diversi attori fin dalle prime fasi del progetto. In questo modo è possibile anticipare la risoluzione di eventuali criticità prima di entrare in cantiere, individuando nello stesso tempo soluzioni ottimali per l'intero ciclo di vita di un fabbricato. All'interno della metodologia BIM, un ruolo chiave è rivestito dal Model Checking grazie al quale è possibile verificare e validare i progetti non solo in fase progettuale, ma anche durante tutte le fasi del processo. Per garantire risultati affidabili, il controllo deve partire da un'iniziale pre-check, definito BIM Validation, che validi il contenuto informativo dell'Information Model per poi procedere ad ulteriori analisi quali Clash Detection e Code Checking. L'Information Model deve essere il risultato di un'accurata fase di modellazione per poterne validare il contenuto geometrico e alfanumerico garantendo risultati affidabili per procedere, poi, con successive analisi BIM-based.

Formal hardware veri cation has recently attracted considerable interest. The need for \correct" designs in safety-critical applications, coupled with the major cost associated with products delivered late, are two of the main factors behind this. In addition, as the complexity o f t h e designs increase, an ever smaller percentage of the possible behaviors of the designs will be simulated. Hence, the con dence in the designs obtained by s i m ulation is rapidly diminishing. This paper provides an introduction to the topic by describing three of the main approaches to formal hardware veri cation: theorem-proving, model checking, and symbolic simulation. We outline the underlying theory behind each approach, we illustrate the approaches by applying them to simple examples, and we discuss their strengths and weaknesses. We conclude the paper by describing current on-going work on combining the approaches to achieve m ulti-level veri cation approaches.

What is the background of this tutorial? During the last decade, the integrative research area of systems biology has constantly been gaining more importance. Experimental and computational approaches are combined to investigate biological systems systematically. To understand biology on its system level, the structural and dynamic properties of regulatory networks in biological systems have to be represented by a model describing the involved species and their interactions. Petri net theory offers the possibility to construct and analyse such models and to represent their structural and dynamic properties by various techniques.

Who should read this tutorial? This tutorial addresses scientists who are looking for an easy and intuitive way to translate a biological system into a Petri net model at an arbitrarily chosen level of abstraction with the option of representing time and space-dependent processes. The tutorial is equally suitable for experimental and theory oriented bio-scientists. The examples given in the tutorial can be used by the interested reader to model her/his biological system.

What can I learn? The tutorial offers an introduction to the Petri net formalism, how to construct a model of a biological system, analyse its structure and dynamic behaviour regarding time-dependent behaviour, which is shown by several intuitive examples. At the end of the tutorial, you will be able to model a biological system on your own using Petri nets. You will also know how to analyse the structure of your model, how to interpret the results and how to perform simulation studies to investigate the time-dependent dynamic behaviour. Also, we also provide a chapter about model checking, which might be helpful to evaluate your model by verifying specified properties that you are interested in. We also show how to use the two Petri net tools Snoopy [19] and Charlie [8]. Based on these instruments you will be able to enhance your knowledge about the modelled biological system and to draw new conclusions from that.

Why should I use Petri nets? The graphical notation and construction of Petri nets allow you to easily and intuitively construct models of biological systems and to characterise the structure, behavioural properties related to the structure and time-dependent dynamic behaviour of a model by several related techniques. Petri nets can describe concurrent and parallel processes, as well as communication and synchronisation in bipartite systems regardless of the abstraction level in a comprehensive and mathematically correct model [12]. Time, as well as space aspects, can be modelled by a Petri net. Several specialised Petri net classes are available to describe dierent scenarios and to consider dierent simulative approaches. Therefore, the kinetics of the qualitative Petri net model can be considered as stochastic, continuous or as a mixture of both (hybrid) [12]. In silico experiments with Petri net models, permit to analyse a biological system systematically by applying structural as well as dynamic analysing techniques to investigate perturbations. From the obtained results new insights can be achieved by the biological system. Thereby, you can increase your understanding, reveal gaps in knowledge, and detect missing and essential components. Based on a valid model it is possible to predict the system behaviour. This might be helpful to investigate pathological states and their molecular basis aimed at identifying potential targets to develop therapeutical intervention strategies. The Petri net formalism offers quite a few advantages over other and more broadly used modelling frameworks. The different Petri net classes are interconvertible with each other without changing the qualitative structure. Due to the graphical visualisation of molecular networks by Petri nets, a bioscientist can intuitively understand the modelled mechanisms. The user does not have to deal with many dierent representations of a molecular network which do not obviously correspond to each other like a biological cartoon, the structure of the biological network, the mathematical equations (stochastic, continuous, etc.) and the implementation of the equations. Besides, the transformation of a molecular network represented by a Petri net into e.g. ODE equations is unique, but not vice versa [24]. Several reliable analysis tools have been developing to investigate qualitative and quantitative properties of Petri nets by structural analysis, simulation of the time-dependent dynamic behaviour and model checking.

What is the scheme of this tutorial? First of all, you will learn all the basics about the Petri net formalism motivated by small biological examples that are easy to understand. Next, you will see how to analyse the structure of a model and how to interpret the obtained results and their biological meaning. Afterwards, you will learn how to perform simulations with your model. We also offer a chapter about model checking, where you can learn how to verify specific properties of your model. Then, we introduce the two Petri net tools Snoopy [19] and Charlie [8]. All sections, where theoretical concepts are explained, are divided into an informal and a formal part. We start with an informal introduction, where we explain the basics and the biological relations. Subsequently and to be complete, we give the formal definitions and a small help on \how to read" the definitions at the end of the section.

What tools do I need? Several tools are available to model biological systems, simulate their time-dependent dynamic behaviour and analyse their structure. Here, we use the Petri net editor Snoopy [19] to model biological systems and simulate/animate their time-dependent dynamic behaviour. Charlie [8] is used to analyse the Petri net structure. Both software tools were developed at the chair of Data Structures and Software Dependability at the Brandenburg University of Technology Cottbus and are freely available for non-commercial use. You can download them at http://www-dssz.informatik. tu-cottbus.de/DSSZ/Software/Software [1].

This article describes a latent trait approach to skills diagnosis based on a particular variety of latent class models that employ item response functions (IRFs) as in typical item response theory (IRT) models. To enable and encourage comparisons with other approaches, this description is provided in terms of the main components of any psychometric approach: the ability model and the IRF structure; review of research on estimation, model checking, reliability, validity, equating, and scoring; and a brief review of real data applications. In this manner the article demonstrates that this approach to skills diagnosis has built a strong initial foundation of research and resources available to potential users. The outlook for future research and applications is discussed with special emphasis on a call for pilot studies and concomitant increased validity research.

A detailed generic model of the control design process is introduced and discussed. It is used for surveying different formal approaches in the context of PLC programming. The survey focuses on formal methods for verification and validation (V&V). The varying works in this area are categorized using three criteria: the general approach (A) to the task (model based, constraint based or without a model), the formalism (F) (Petri net, automata, etc.,) used to state the formal description, and the method (M) (model-checking, reachability analysis, etc.,) used to analyze the properties. Based on these three criteria (A-F-M) a three letter code for V&V approaches is introduced. Some works from the multitude of V&V research are presented and categorized using this new system

A structural multilevel model is presented where some of the variables cannot be observed directly but are measured using tests or questionnaires. Observed dichotomous or ordinal polytomous response data serve to measure the latent variables using an item response theory model. The latent variables can be defined at any level of the multilevel model. A Bayesian procedure Markov chain Monte Carlo (MCMC), to estimate all parameters simultaneously is presented. It is shown that certain model checks and model comparisons can be done using the MCMC output. The techniques are illustrated using a simulation study and an application involving students' achievements on a mathematics test and test results regarding management characteristics of teachers and principles.

The failure rate function commonly has a bathtub shape in practice. In this paper we discuss a regression model considering new Weibull extended distribution developed by that can be used to model this type of failure rate function. Assuming censored data, we discuss parameter estimation: maximum likelihood method and a Bayesian approach where Gibbs algorithms along with Metropolis steps are used to obtain the posterior summaries of interest. We derive the appropriate matrices for assessing the local influence on the parameter estimates under different perturbation schemes, and we also present some ways to perform global influence. Also, some discussions on case deletion influence diagnostics are developed for the joint posterior distribution based on the Kullback-Leibler divergence. Besides, for different parameter settings, sample sizes and censoring percentages, are performed various simulations and display and compare the empirical distribution of the Martingale-type residual with the standard normal distribution. These studies suggest that the residual analysis usually performed in normal linear regression models can be straightforwardly extended to the martingale-type residual in log-Weibull extended models with censored data. Finally, we analyze a real data set under a log-Weibull extended regression model. We perform diagnostic analysis and model check based on the martingale-type residual to select an appropriate model.

Recently, there has been considerable interest in the use of Model Checking for Systems Biology. Unfortunately, the state space of stochastic biological models is often too large for classical Model Checking techniques. For these models, a statistical approach to Model Checking has been shown to be an effective alternative. Extending our earlier work, we present the first algorithm for performing statistical Model Checking using Bayesian Sequential Hypothesis Testing. We show that our Bayesian approach outperforms current statistical Model Checking techniques, which rely on tests from Classical (aka Frequentist) statistics, by requiring fewer system simulations. Another advantage of our approach is the ability to incorporate prior Biological knowledge about the model being verified. We demonstrate our algorithm on a variety of models from the Systems Biology literature and show that it enables faster verification than state-of-the-art techniques, even when no prior knowledge is available.

A bathtub-shaped failure rate function is very useful in survival analysis and reliability studies. The well-known lifetime distributions do not have this property. For the first time, we propose a location-scale regression model based on the logarithm of an extended Weibull distribution which has the ability to deal with bathtub-shaped failure rate functions. We use the method of maximum likelihood to estimate the model parameters and some inferential procedures are presented. We reanalyze a real data set under the new model and the log-modified Weibull regression model. We perform a model check based on martingale-type residuals and generated envelopes and the statistics AIC and BIC to select appropriate models.

From navigation to telecommunication, and from
weather forecasting to military, or entertainment services -
satellites play a major role in our daily lives. Satellites in
the Medium Earth Orbit (MEO) and geostationary orbit have
a life span of 10 years or more. Reliability, Availability and
Maintainability (RAM) analysis of a satellite system is a  crucial part at their design phase to ensure the highest availability and optimized reliability. This paper shows the formal modeling and verification of RAM related properties of a satellite system. In a previously reported approach, time between possible failures and time between repairs are assumed to follow an exponential distribution, which does not represent a realistic scenario. In contrast, in our work, discrete time delays in the classical Continuous Time Markov Chain (CTMC) are approximated using the Erlang  distribution. This is done by approximating nonexponential holding time with several intermediate states based on a phase type distribution. The RAM properties are then verified using the PRISM model checker.We present and compare modeling results with those obtained with a previously reported approach that demonstrate an improved modeling accuracy.

The discipline of component-based modeling and simulation offers promising gains including reduction in development cost, time, and system complexity. This paradigm is very profitable as it promotes the use and reuse of modular components and is auspicious for effective development of complex simulations. It however is
confronted by a series of research challenges when it comes to actually practise this methodology. One of such important issue is Composability verification. In modeling and simulation (M&S), composability is the capability to select and assemble components in various combinations to satisfy specific user requirements. Therefore to ensure the correctness of a composed model, it is verified with respect to its requirements specifications. There are different approaches and existing component modeling frameworks that support composability. Though in our observation most of the component modeling frameworks possess none or weak built-in support for the composability verification. One such framework is Base Object Model (BOM) which fundamentally poses a
satisfactory potential for effective model composability and reuse. However it falls short of required semantics, necessary modeling characteristics and built-in
evaluation techniques, which are essential for modeling complex system behavior and reasoning about the validity of the composability at different levels. In this thesis a comprehensive verification framework is proposed to contend with
some important issues in composability verification and a verification process is
suggested to verify composability of different kinds of systems models, such as
reactive, real-time and probabilistic systems. With an assumption that all these
systems are concurrent in nature in which different composed components interact
with each other simultaneously, the requirements for the extensive techniques for the
structural and behavioral analysis becomes increasingly challenging. The proposed
verification framework provides methods, techniques and tool support for verifying
composability at its different levels. These levels are defined as foundations of
consistent model composability. Each level is discussed in detail and an approach is
presented to verify composability at that level. In particular we focus on the
Dynamic-Semantic Composability level due to its significance in the overall
composability correctness and also due to the level of difficulty it poses in the
process. In order to verify composability at this level we investigate the application of
three different approaches namely (i) Petri Nets based Algebraic Analysis (ii) Colored
Petri Nets (CPN) based State-space Analysis and (iii) Communicating Sequential
Processes based Model Checking. All the three approaches attack the problem of
verifying dynamic-semantic composability in different ways however they all share
the same aim i.e., to confirm the correctness of a composed model with respect to its
requirement specifications. Beside the operative integration of these approaches in
our framework, we also contributed in the improvement of each approach for
effective applicability in the composability verification. Such as applying algorithms
for automating Petri Net algebraic computations, introducing a state-space reduction
technique in CPN based state-space analysis, and introducing function libraries to
perform verification tasks and help the modeler with ease of use during the
composability verification. We also provide detailed examples of using each approach
with different models to explain the verification process and their functionality.
Lastly we provide a comparison of these approaches and suggest guidelines for
Page 5
choosing the right one based on the nature of the model and the available information. With a right choice of an approach and following the guidelines of our component-based M&S life-cycle a modeler can easily construct BOM based composed models and can verify them with respect to the requirement specifications.

Model checking is a crucial part of any statistical analysis. Hierarchical models present special problems because assumptions made about the distribution of unobservable parameters are dicult to check. In this article, we review some approaches to model checking and apply posterior predictive model checking to a hierarchical normal-normal model analysis of data from educational testing experiments in eight schools. Then we carry out a simulation study to investigate the di culties in model checking for hierarchical models. It turns out that it is very di cult to detect violations of the assumptions made about the population distribution of the parameters unless the extent of violation is huge or the observed data have small standard errors.

Recent studies show that configurations of network access control is one of the most complex and error prone network management tasks. For this reason, network misconfiguration becomes the main source for network unreachablility and vulnerability problems. In this paper, we present a novel approach that models the global end-to-end behavior of access control configurations of the entire network including routers, IPSec, firewalls, and NAT for unicast and multicast packets. Our model represents the network as a state machine where the packet header and location determines the state. The transitions in this model are determined by packet header information, packet location, and policy semantics for the devices being modeled. We encode the semantics of access control policies with Boolean functions using binary decision diagrams (BDDs). We then use computation tree logic (CTL) and symbolic model checking to investigate all future and past states of this packet in the network and verify network reachability and security requirements.

A new form of SAT-based symbolic model checking is described. Instead of unrolling the transition relation, it incrementally generates clauses that are inductive relative to (and augment) stepwise approximate reachability information. In this way, the algorithm gradually refines the property, eventually producing either an inductive strengthening of the property or a counterexample trace. Our experimental studies show that induction is a powerful tool for generalizing the unreachability of given error states: it can refine away many states at once, and it is effective at focusing the proof search on aspects of the transition system relevant to the property. Furthermore, the incremental structure of the algorithm lends itself to a parallel implementation.

Software architecture specifications are used for many different purposes, such as documenting architectural decisions, predicting architectural qualities before the system is implemented, and guiding the design and coding process. In these contexts, assessing the architectural model as early as possible becomes a relevant challenge. Various analysis techniques have been proposed for testing, model checking, and evaluating performance based on architectural models. Among them, model checking is an exhaustive and automatic verification technique, used to verify whether an architectural specification conforms to expected properties. While model checking is being extensively applied to software architectures, little work has been done to comprehensively enumerate and classify these different techniques.

We use model checking to establish five essential correctness properties of the Secure Electronic Transaction (SET) protocol. SET has been developed jointly by Visa and Mas-terCard as a method to secure payment card transactions over open networks, and industrial interest in the protocol is high. Our main contributions are to firstly create a formal model of the protocol capturing the purchase request, payment authorization, and payment capture transactions. Together, these transactions constitute the kernel of the protocol. We then encoded our model and the aforementioned correctness properties in the input language of the FDR model checker. Running FDR on this input established that our model of the SET protocol satisfies all five properties even though the cardholder and merchant, two of the participants in the protocol, may try to behave dishonestly in certain ways. To our knowledge, this is the first attempt to formalize the SET protocol for the purpose of model checking.

This paper proposes a unified approach for UML based safety oriented railway level crossing using model checking and fault tree analysis. The main goal of this research is to show the possibility to combine the concept of traditional safety analysis technique FTA and formal verification technique model checking for UML based safety oriented railway level crossing system. In this paper we used UML for specifying, visualizing and constructing the application of level crossing with numbers of diagram in which some of the diagrams are used for modelling the finite state machine from the UML diagrams to the support model checking. Secondly, we considered traditional safety analysis technique FTA in order to generate safety properties within the level crossing system. Similarly, after the transformation of UML models into unified finite state machine and FTA to safety properties NuSMV model checker was used in order to satisfy our model as per the safety properties.

Birnbaum-Saunders models have largely been applied in material fatigue studies and reliability analyses to relate the total time until failure with some type of cumulative damage. In many problems related to the medical field, such as chronic cardiac diseases and different types of cancer, a cumulative damage caused by several risk factors might cause some degradation that leads to a fatigue process. In these cases, BS models can be suitable for describing the propagation lifetime. However, since the cumulative damage is assumed to be normally distributed in the BS distribution, the parameter estimates from this model can be sensitive to outlying observations. In order to attenuate this influence, we present in this paper BS models, in which a Student-t distribution is assumed to explain the cumulative damage. In particular, we show that the maximum likelihood estimates of the Student-t log-BS models attribute smaller weights to outlying observations, which produce robust parameter estimates. Also, some inferential results are presented. In addition, based on local influence and deviance component and martingale-type residuals, a diagnostics analysis is derived. Finally, a motivating example from the medical field is analyzed using log-BS regression models. Since the parameter estimates appear to be very sensitive to outlying and influential observations, the Student-t log-BS regression model should attenuate such influences. The model checking methodologies developed in this paper are used to compare the fitted models.

Cloud computing is an emergent technology that has generated significant interest in the marketplace and is forecasted for high growth. Moreover, Cloud computing has a great impact on different type of users from individual consumers and businesses to small and medium size (SMBs) and enterprise businesses. Although there are many benefits to adopting Cloud computing, there are significant barriers to adoption, viz. security and privacy. In this paper, we focus on carefully planning security aspects regarding access control of Cloud computing solutions before implementing them and, furthermore, on ensuring they satisfy particular organizational security requirements. Specifically, we propose a methodology for the development of access control systems. The methodology is capable of utilizing existing security requirements engineering approaches for the definition and evaluation of access control models, and verification of access control systems against organizational security requirements using techniques that are based on formal methods. A proof of concept example is provided that demonstrates the application of the proposed methodology on Cloud computing systems.

Complex hardware systems become more and more ubiquitous in mission critical applications such as military, satellite, and medical to name but a few. In such applications, reliability remains a primary concern because a failure that occurs during their normal operations might produce important catastrophes like loss of life or loss of money. All these failures are often caused by minuscule bug that exists inside the software which controls the systems, or within the hardware itself. In addition, most of these systems cannot be interrupted while working, even for a few seconds a year, making it difficult to repair bugs found during their normal operations. The main purpose of this work is to build efficient verification techniques for asynchronous concurrent systems. Because of the pivotal roles these systems assume in a given application, designers of such systems must keep development and maintenance costs under control and meet nonfunctional constraints on the design of the system, such as cost, power, weight, or the system architecture by itself. But most importantly, they must assure their customer as well as the certification authorities that both the design and its implementation are correct. Otherwise, they may end up shipping unsafe systems to the market, and the consequences of this action would be catastrophic. To achieve this goal, designers need efficient methods and tools to assist them in verifying the correctness of the design. In this thesis we focus on a symbolic model checking technique called bounded model checking (BMC). BMC is a method targeted mainly at finding bugs in a system. It answers the questions whether there exists a counterexample, shorter than a given length, that violates a given property. During a BMC operation each execution path is encoded into Boolean formula, and the problem is reduced to satisfiability checking of the formula. Therefore, the operation consists mainly in constructing a Boolean formula that is satisfiable if and only if such a counterexample exists. We model our systems with transition systems (TSs). In particular, we are mainly interested in synchronized product of TSs. Since concurrent systems are formed by a combination of several components communicating between each other, synchronized product of TSs is well-suited to capture the behavior of such systems. The executions of concurrent systems are commonly modeled using the so-called interleaving execution, which allows only one single event to fire at each step. However, due to the complexity of such systems inteleaving method will not only require many steps but also generate long formulas. In this work, we adopt another approach based on breadth-first search (BFS). In a BMC operation, the translation of the model into a Boolean formula is polynomial in the size of the model, but the solving time of the Boolean formula can be exponential in the size of the formula. Therefore, our research hypothesis is that we can improve the efficiency of BMC by generating succinct formula, and by minimizing the number of necessary steps during an execution. We introduce several BMC techniques aimed at improving the efficiency of BMC for asynchronous concurrent systems. The techniques are grouped in two main parts (i) techniques for checking reachability properties and (ii) techniques for checking properties written in linear temporal logic (LTL). In addition, we also propose some methods for minimizing the number of execution steps or bound. We implemented all these methods in a BMC toolset. At the end of the dissertation, we will discuss the experimental results we obtained.

In this paper, we propose a new approach for the static detection of malicious code in executable programs. Our approach rests on a semantic analysis based on behaviour that even makes possible the detection of unknown malicious code. This analysis is carried out directly on binary code. Static analysis offers techniques for predicting properties of the behaviour of programs without running them. The static analysis of a given binary executable is achieved in three major steps: construction of an intermediate representation, flow-based analysis that catches securityoriented program behaviour, and static verification of critical behaviours against security policies (model checking). *

En este artículo se presenta una aplicación de las técnicas de
verificación formal en Ingeniería de Software, mediante el comprobador de modelos SMV utilizando lógica temporal CTL, en la determinación de los posibles errores de especificación de un sistema informático de gestión, en su fase de diseño, usando las propiedades de vivacidad y ausencia de bloqueo. Se opta por modelar el sistema usando diagramas de flujo estructurados por la naturalidad de conversión a un modelo de autómata finito que expresa una descripción de los diagramas de predicado- acción, al cual se aplicará el comprobador de modelos.

-How is time represented in existing specification languages? What are the domains of application of these languages and what timed systems are outside these domains? -Continuous versus discrete time: what are the practical and theoretical advantages or disadvantages of using these models of time? -What are the theoretical problems in defining the semantics of timed systems? -How should we represent and simulate time in ASM and ASML?

We introduce a generic extension of the popular branchingtime logic CTL which refines the temporal until and release operators with formal languages. For instance, a language may determine the moments along a path that an until property may be fulfilled. We consider several classes of languages leading to logics with different expressive power and complexity, whose importance is motivated by their use in model checking, synthesis, abstract interpretation, etc. We show that even with context-free languages on the until operator the logic still allows for polynomial time model-checking despite the significant increase in expressive power. This makes the logic a promising candidate for applications in verification. In addition, we analyse the complexity of satisfiability and compare the expressive power of these logics to CTL * and extensions of PDL.

Reproducing a bug that caused a system to crash is an important task for uncovering the causes of the crash and providing appropriate fixes. In this paper, we propose a novel crash reproduction approach that combines directed model checking and backward slicing to identify the program statements needed to reproduce a crash. Our approach, named JCHARMING (Java CrasH Automatic Reproduction by directed Model checkING), uses information found in crash traces combined with static program slices to guide a model checking engine in an optimal way. We show that JCHARMING is efficient in reproducing bugs from 10 different open source systems. Overall, JCHARMING is able to reproduce 80% of the bugs used in this study in an average time of 19 min.

Concurrency is used pervasively in the development of large systems programs. However, concurrent programming is difficult because of the possibility of unexpected interference among concurrently executing tasks. Such interference often results in "Heisenbugs" that appear rarely and are extremely difficult to reproduce and debug. Stress testing, in which the system is run under heavy load for a long time, is the method commonly employed to flush out such concurrency bugs. This form of testing provides inadequate coverage and has unpredictable results. This paper proposes an alternative called concurrency scenario testing which relies on systematic and exhaustive testing We have implemented a tool called CHESS for performing concurrency scenario testing of systems programs. CHESS uses model checking techniques to systematically generate all interleav

In this paper, we extended previous studies of cooperating autonomous robots to include situations when environmental changes and changes in the number of robots in the swarm can affect the efficiency to execute tasks assigned to the swarm of robots. We have presented a novel approach based on partition of the robot behavior. The sub-diagrams describing sub-routs allowed us to model advanced interactions between autonomous robots using limited number of state combinations avoiding combinatorial explosion of reachability. We identified the systems for which we can ensure the correctness of robots interactions. New techniques were presented to verify and analyze combined robots' behavior. The partitioned diagrams allowed us to model advanced interactions between autonomous robots and detect irregularities such as deadlocks, lack of termination etc. The techniques were presented to verify and analyze combined robots' behavior using model checking approach. The described system, Dedan verifier, is still under development. In the near future, timed and probabilistic verification are planned.

We consider Time Petri Nets (TPN) for which a firing time interval is associated with each transition. State space abstractions for TPN preserving various classes of properties (LTL, CTL, CTL * ) can be computed, in terms of so called state classes. Some methods were proposed to check quantitative timed properties but are not suitable for effective verification of properties of real-life systems.

for assessing cause-consequence relations between component faults and hazards that may occur during the lifetime of a system. The analysis is typically time intensive and informal, and for this reason FMEA has been extended with traditional model checking support. Such support does not take into account the probabilities associated with a component fault occurring, yet such information is crucial to developing hazard reduction strategies for a system. In this paper we propose a method for FMEA which makes use of probabilistic fault injection and probabilistic model checking. Based on this approach safety engineers are able to formally identify if a failure mode occurs with a probability higher than its tolerable hazard rate.

We define residuals for point process models fitted to spatial point pattern data, and we propose diagnostic plots based on them.The residuals apply to any point process model that has a conditional intensity; the model may exhibit spatial heterogeneity, interpoint interaction and dependence on spatial covariates. Some existing ad hoc methods for model checking (quadrat counts, scan statistic, kernel smoothed intensity and Berman's diagnostic) are recovered as special cases. Diagnostic tools are developed systematically, by using an analogy between our spatial residuals and the usual residuals for (non-spatial) generalized linear models. The conditional intensity λ plays the role of the mean response. This makes it possible to adapt existing knowledge about model validation for generalized linear models to the spatial point process context, giving recommendations for diagnostic plots. A plot of smoothed residuals against spatial location, or against a spatial covariate, is effective in diagnosing spatial trend or covariate effects. Q-Q-plots of the residuals are effective in diagnosing interpoint interaction.

Consider a random vector $(X,Y)$ and let $m(x)=E(Y|X=x)$. We are interested in testing $H_0:m\in {\cal M}_{\Theta,{\cal G}}=\{\gamma(\cdot,\theta,g):\theta \in \Theta,g\in {\cal G}\}$ for some known function $\gamma$, some compact set $\Theta \subset $IR$^p$ and some function set ${\cal G}$ of real valued functions. Specific examples of this general hypothesis include testing for a parametric regression model, a generalized linear model, a partial linear model, a single index model, but also the selection of explanatory variables can be considered as a special case of this hypothesis. To test this null hypothesis, we make use of the so-called marked empirical process introduced by \citeD and studied by \citeSt for the particular case of parametric regression, in combination with the modern technique of empirical likelihood theory in order to obtain a powerful testing procedure. The asymptotic validity of the proposed test is established, and its finite sample performance is compared with other existing tests by means of a simulation study.

Finite-state machines (FSMs) are among the oldest models employed in the formalization and analysis of both software and hardware. Owing to their simplicity, there exist various implementations to support their practical application in mainstream programming languages. Through such software libraries, programmers can explicitly define states, events and transitions in order to delegate the machine's execution to an underlying engine. However, as far as we know, no such library provides formal verification capabilities alongside its execution engine. That is to say, once an FSM is defined, the resulting program cannot be used as a formal specification to be subject to formal verification , thereby not making the analytical tractability of FSMs available. Formal verification, if any, is conducted in an independent model separate from the program, thus duplicating the information and creating the possibility of discrepancies between both. In this paper we show how to overcome this limitation. To this end, we present the Verum library, which allows the specification, execution and verification of FSMs in the Ruby language, largely bypassing the need to explicitly employ an additional modeling language. Formal verification is achieved by automatically translating the source program of the FSM into a Timed Automaton (TA) specification for the UPPAAL model checker. To illustrate the value of the approach, we present the industrial problem which inspired the creation of this tool and is currently using it, namely, a payment system. Besides the technical aspects of the tool, a number of practical lessons learned with this application are explored. Although we describe very concrete artifacts and applications, the overall approach is quite general.

SRAM-based FPGAs are increasingly popular in the aerospace industry for their field programmability and low cost. However, they suffer from cosmic radiation induced Single Event Upsets (SEUs), commonly known as soft errors. In safety-critical applications, the dependability of the design is a prime concern since failures may have catastrophic consequences. An early analysis of dependability of such safety-critical applications will enable designers to develop a design that meets the high availability and reliability requirements of the DO-254 standard. This paper introduces a novel methodology based on probabilistic model checking, to analyze the dependability properties of safety-critical systems and to suggest required mitigation techniques, such as Triple Modular Redundancy (TMR) or TMR with less frequent scrubs for early design decisions. Starting from a high-level description of a system, a Markov model is constructed from the Control Data Flow Graph (CDFG) expressing the functionality and from failure/mitigation parameters for the targeted FPGAs. Such an exhaustive model captures all the failures and repairs possible in the system within the radiation environment. We present a case study on a benchmark circuit to illustrate the applicability of the proposed approach to demonstrate that a wide range of useful dependability properties can be analyzed using our proposed methodology.

Centre of gravity (COG) analysis is an integral and cognitively demanding aspect of military operational planning. It involves identifying the enemy and friendly COG and subsequently determining the critical vulnerabilities that have to be degraded or negated to influence the COG of each side. This paper describes a modelling framework based on the causal relationships among the critical capabilities and requirements for an operation. The framework is subsequently used as a basis for the construction, population and analysis of Bayesian networks to support a rigorous and systematic approach to COG analysis. The importance of this work is that it uses existing planning process concepts to facilitate the construction of comprehensive models in which uncertainties and subjective judgements are clearly represented, thus enabling future re-use and traceability. The visual representation of the COG causal structure helps to clarify thinking and provides a way to record and impart this thinking. Moreover, it gives planners the capability to perform impact analysis, that is, to determine which actions are most likely to achieve a desirable end-state. The paper discusses the methodology, development and implementation of the COG Network Effects Tool (COGNET) suite for model population and model checking as well as impact analysis.