The nuXmv Symbolic Model Checker

Cavada, Roberto; Cimatti, Alessandro; Dorigatti, Michele; Griggio, Alberto; Mariotti, Alessandro; Micheli, Andrea; Mover, Sergio; Roveri, Marco; Tonetta, Stefano

doi:10.1007/978-3-319-08867-9_22

Cited by 387 publications

(238 citation statements)

References 39 publications

Supporting

Mentioning

235

Contrasting

Unclassified

Order By: Relevance

“…Note that we are considering in general infinite-state transition systems for which these problems are undecidable. Our methods are based on SMT-based algorithms as those implemented in nuXmv [9].…”

Section: Ltlmentioning

confidence: 99%

Tightening the contract refinements of a system architecture

Cimatti

Demasi

Tonetta

2018

Form Methods Syst Des

Self Cite

View full text Add to dashboard Cite

Contract-based design is an emerging paradigm for correct-by-construction hierarchical systems: components are associated with assumptions and guarantees expressed as formal properties; the architecture is analyzed by verifying that each contract of composite components is correctly refined by the contracts of its subcomponents. The approach is very efficient, because the overall correctness proof is decomposed into proofs local to each component. However, the process for the contract specification and refinement is quite expensive because the requirements are formalised into formal properties, where part of the complexity is delegated to the designer, who has the burden of specifying the contracts. Typical problems include understanding which contracts are necessary, and how they can be simplified without breaking the correctness of the refinement and other refinements in case some subcontracts are shared. In this paper, we tackle these problems by proposing a technique to understand and simplify the contract refinements of a system architecture during the development process for the contract specification and refinement. The technique, called tightening, is based on parameter synthesis. The idea is to generate a set of parametric proof obligations, where each parameter evaluation corresponds to a variant of the original(s) contract refinement(s), and to search for tighter variants of the contracts that still ensure the correctness of the refinement(s). We cast this approach in the OCRA framework, where contracts are expressed with LTL formulas, and we evaluate its performance and effectiveness on a number of benchmarks.

show abstract

Section: Ltlmentioning

confidence: 99%

Tightening the contract refinements of a system architecture

Cimatti

Demasi

Tonetta

2018

Form Methods Syst Des

Self Cite

View full text Add to dashboard Cite

show abstract

“…In this section, we show how to encode a BIP model into a Symbolic Transition System, thus enabling a direct application of state-of-the-art model checkers for infinite state systems, such as the NUXMV [12] symbolic model checker.…”

Section: Encoding Bip Into Transition Systemmentioning

confidence: 99%

“…We provide an implementation of both approaches: the ESST BIP is implemented in the KRATOS [13] software model checker; the translational approach is performed using the BIP framework and then verified with the NUXMV [12] model checker. We performed a thorough experimental evaluation comparing the performance of the two techniques and of DFINDER (in this case, only on the models without data transfers).…”

Section: Introductionmentioning

confidence: 99%

Formal Verification of Infinite-State BIP Models

Bliudze

Cimatti

Jaber

et al. 2015

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We propose two expressive and complementary techniques for the verification of safety properties of infinite-state BIP models. Both our techniques deal with the full BIP specification, while the existing approaches impose considerable restrictions: they either verify finite-state systems or they do not handle the transfer of data on the interactions and priorities. Firstly, we propose an instantiation of the ESST (Explicit Scheduler Symbolic Thread) framework to verify BIP models. The key insight is to apply symbolic reasoning to analyze the behavior of the system described by the BIP components, and an explicit-state search to analyze the behavior of the system induced by the BIP interactions and priorities. The combination of symbolic and explicit exploration techniques allow to benefit from abstraction, useful when reasoning about data, and from partial order reduction, useful to mitigate the state space explosion due to concurrency. Secondly, we propose an encoding from a BIP model into a symbolic, infinitestate transition system. This technique allows us to leverage the state of the art verification algorithms for the analysis of infinite-state systems. We implemented both techniques and we evaluated their performance against the existing approaches. The results show the effectiveness of our approaches with respect to the state of the art, and their complementarity for the analysis of safe and unsafe BIP models.

show abstract

“…Compared to the previously published work by the same authors [37], the following main extensions have been added: (E-1) the state space encodings and state transition relation are elaborated in more detail, (E-2) new experimental results are presented for the early deployment line (EDL) of the Danish Signalling Programme, and (E-3) benchmarking experiments comparing our BMC approach to other techniques such as BDD-based techniques or CEGAR techniques -by translating our models to nuXmv [9] -are reported.…”

Section: Introductionmentioning

confidence: 99%

Formal modelling and verification of interlocking systems featuring sequential release

Haxthausen

Peleskã

2017

Science of Computer Programming

View full text Add to dashboard Cite

In this article, we present a method and an associated toolchain for the formal verification of the new Danish railway interlocking systems that are compatible with the European Train Control System (ETCS) Level 2. We have made a generic and reconfigurable model of the system behaviour and generic safety properties. This model accommodates sequential release -a feature in the new Danish interlocking systems. To verify the safety of an interlocking system, first a domain-specific description of interlocking configuration data is constructed and validated. Then the generic model and safety properties are automatically instantiated with the well-formed description of interlocking configuration data. This instantiation produces a model instance in the form of a Kripke structure, and concrete safety properties expressed as invariants. Finally, using a combination of SMT based bounded model checking (BMC) and inductive reasoning, it is verified that the generated model instance satisfies the generated safety properties. Using this method, we are able to verify the safety properties for model instances corresponding to railway networks of industrial size. Experiments show that BMC is also efficient for finding bugs in the railway interlocking designs. Additionally, benchmarking results comparing the performance of our approach with alternative verification techniques on the interlocking models are presented.

show abstract

The nuXmv Symbolic Model Checker

Cited by 387 publications

References 39 publications

Tightening the contract refinements of a system architecture

Tightening the contract refinements of a system architecture

Formal Verification of Infinite-State BIP Models

Formal modelling and verification of interlocking systems featuring sequential release

Contact Info

Product

Resources

About