Invited Talk.- The Embedded Systems Design Challenge.- Interactive Verification.- The Mondex Challenge: Machine Checked Proofs for an Electronic Purse.- Interactive Verification of Medical Guidelines.- Certifying Airport Security Regulations Using the Focal Environment.- Proving Safety Properties of an Aircraft Landing Protocol Using I/O Automata and the PVS Theorem Prover: A Case Study.- Invited Talk.- Validating the Microsoft Hypervisor.- Formal Modelling of Systems.- Interface Input/Output Automata.- Properties of Behavioural Model Merging.- Automatic Translation from Circus to Java.- Quantitative Refinement and Model Checking for the Analysis of Probabilistic Systems.- Real Time.- Modeling and Validating Distributed Embedded Real-Time Systems with VDM++.- Towards Modularized Verification of Distributed Time-Triggered Systems.- Industrial Experience.- A Story About Formal Methods Adoption by a Railway Signaling Manufacturer.- Partially Introducing Formal Methods into Object-Oriented Development: Case Studies Using a Metrics-Driven Approach.- Specification Refinement.- Compositional Class Refinement in Object-Z.- A Proposal for Records in Event-B.- Pointfree Factorization of Operation Refinement.- A Formal Template Language Enabling Metaproof.- Progrmming Languages.- Dynamic Frames: Support for Framing, Dependencies and Sharing Without Restrictions.- Type-Safe Two-Level Data Transformation.- Algebra.- Feature Algebra.- Education.- Using Domain-Independent Problems for Introducing Formal Methods.- Formal Modelling of Systems.- Compositional Binding in Network Domains.- Formal Modeling of Communication Protocols by Graph Transformation.- Feature Specification and Static Analysis for Interaction Resolution.- A Fully General Operational Semantics for UML 2.0 Sequence Diagrams with Potential and Mandatory Choice.- Formal Aspects of Java.- Towards Automatic Exception Safety Verification.- Enforcer - Efficient Failure Injection.- Automated Boundary Test Generation from JML Specifications.- Formal Reasoning About Non-atomic Java Card Methods in Dynamic Logic.- Programming Languages.- Formal Verification of a C Compiler Front-End.- A Memory Model Sensitive Checker for C#.- Changing Programs Correctly: Refactoring with Specifications.- Mechanical Verification of Recursive Procedures Manipulating Pointers Using Separation Logic.- Model Checking.- Model-Based Variable and Transition Orderings for Efficient Symbolic Model Checking.- Exact and Approximate Strategies for Symmetry Reduction in Model Checking.- Monitoring Distributed Controllers: When an Efficient LTL Algorithm on Sequences Is Needed to Model-Check Traces.- PSL Model Checking and Run-Time Verification Via Testers.- Industry Day: Abstracts of Invited Talks.- Formal Methods for Security: Lightweight Plug-In or New Engineering Discipline.- Formal Methods in the Security Business: Exotic Flowers Thriving in an Expanding Niche.- Connector-Based Software Development: Deriving Secure Protocols.- Model-Based Security Engineering for Real.- Cost Effective Software Engineering for Security.- Formal Methods and Cryptography.- Verified Software Grand Challenge.

FM 2006 : Formal Methods : 14th International Symposium on Formal Methods Hamilton, Canada, August 21-27, 2006 : proceedings

The model-checking approach was originally formulated for verifying qualitative properties of systems, for example safety and liveness (see Chap. 2), and subsequently extended to also handle quantitative features, such as real time (see Chap. 29), continuous flows (see Chap. 30), as well as stochastic phenomena, where system evolution is governed by a given probability distribution. Probabilistic model checking aims to establish the correctness of probabilistic system models against quantitative probabilistic specifications, such as those capable of expressing, for example, the probability of an unsafe event occurring, expected time to termination, or expected power consumption in the start-up phase. In this chapter, we present the foundations of probabilistic model checking, focusing on finite-state Markov decision processes as models and quantitative properties expressed in probabilistic temporal logic. Markov decision processes can be thought of as a probabilistic variant of labelled transition systems in the following sense: transitions are labelled with actions, which can be chosen nondeterministically, and successor states for the chosen action are specified by means of discrete probabilistic distributions, thus specifying the probability of transiting to each successor state. To reason about expectations, we additionally annotate Markov decision processes with quantitative costs, which are incurred upon taking the selected action from a given state. Quantitative properties are expressed as formulas of the probabilistic computation tree logic (PCTL) or using linear temporal logic (LTL). We summarise the main model-checking algorithms for both PCTL and LTL, and illustrate their working through examples. The chapter ends with a brief overview of extensions to more expressive models and temporal logics, existing probabilistic model-checking tool support, and main application domains.

Model Checking Probabilistic Systems

Cyclic proof provides a style of proof for logics with inductive and coinductive definitions, in which proofs are cyclic graphs representing a form of argument by infinite descent. It is easily shown that cyclic proof subsumes proof by coinduction. So cyclic proof systems are at least as powerful as the corresponding proof systems with explicit coinduction rules. Whether or not the converse inclusion holds is a non-trivial question. In this paper, we resolve this question in one interesting case. We show that a cyclic formulation of first-order arithmetic is equivalent in power to Peano Arithmetic. The proof involves formalising the meta-theory of cyclic proof in a subsystem of second-order arithmetic.

/pdf/cyclic-arithmetic-is-equivalent-to-peano-arithmetic-59q20sowup.pdf

Cyclic Arithmetic Is Equivalent to Peano Arithmetic

We introduce PGSOS, an operator specification format for (reactive) probabilistic transition systems which bears similarity to the known GSOS format for labelled (nondeterministic) transition systems. Like the standard one, the format is well behaved in the sense that on all models bisimilarity is a congruence and the up-to-context proof principle is valid. Moreover, guarded recursive equations involving the specified operators have unique solutions up to bisimilarity. These results generalize well-behavedness results given in the literature for specific operators that turn out to be definable by our format. PGSOS arose from the following procedure: Turi and Plotkin proposed to model specifications in the (standard) GSOS format as natural transformations of a type they call abstract GSOS. This formulation allows for simple proofs of several well-behavedness properties, such as bisimilarity being a congruence on all models of such a specification. First, we give a full proof of Turi and Plotkin's claim about the correspondence of abstract GSOS and standard GSOS for labelled transition systems. Next, we instantiate their categorical framework to yield a specification format for probabilistic transition systems. The main contribution of the present paper is the derivation of the PGSOS format as a rule-style representation of the natural transformations obtained this way. We benefit from the fact that some parts of our argument for the nondeterministic case can be reused. The well-behavedness results for abstract GSOS immediately carry over to the new concrete format.

/pdf/gsos-for-probabilistic-transition-systems-1gzq7ksq8x.pdf

GSOS for probabilistic transition systems

The model-checking approach was originally formulated for verifying qualitative properties of systems, for example safety and liveness, and subsequently extended to also handle quantitative features, such as real-time, continuous flows, as well as stochastic phenomena, where system evolution is governed by a given probability distribution. Probabilistic model-checking aims to establish the correctness of probabilistic system models against quantitative probabilistic specifications, such as those capable of expressing, e.g., the probability of an unsafe event occurring, expected time to termination, or expected power consumption in the start-up phase. In this chapter, we present the foundations of probabilistic model-checking, focusing on finite-state Markov decision processes as models and quantitative properties expressed in probabilistic temporal logic. Markov decision processes can be thought of as a probabilistic variant of labelled transition systems in the following sense: transitions are labelled with actions, which can be chosen nondeterministically, and successor states for the chosen action are specified by means of discrete probabilistic distributions, thus specifying the probability of transiting to each successor state. To reason about expectations, we additionally annotate Markov decision processes with quantitative costs, which are incurred upon taking the selected action from a given state. Quantitative properties are expressed as formulas of the probabilistic computation tree logic (PCTL) or using linear temporal logic (LTL). We summarise the main model-checking algorithms for both PCTL and LTL, and illustrate their working through examples. The chapter ends with a brief overview of extensions to more expressive models and temporal logics, existing probabilistic model-checking tool support, and main application domains.

/pdf/probabilistic-model-checking-3u3k8s76as.pdf

Probabilistic Model Checking

The probabilistic modal {\mu}-calculus is a fixed-point logic designed for expressing properties of probabilistic labeled transition systems (PLTS's). Two equivalent semantics have been studied for this logic, both assigning to each state a value in the interval [0,1] representing the probability that the property expressed by the formula holds at the state. One semantics is denotational and the other is a game semantics, specified in terms of two-player stochastic parity games. A shortcoming of the probabilistic modal {\mu}-calculus is the lack of expressiveness required to encode other important temporal logics for PLTS's such as Probabilistic Computation Tree Logic (PCTL). To address this limitation we extend the logic with a new pair of operators: independent product and coproduct. The resulting logic, called probabilistic modal {\mu}-calculus with independent product, can encode many properties of interest and subsumes the qualitative fragment of PCTL. The main contribution of this paper is the definition of an appropriate game semantics for this extended probabilistic {\mu}-calculus. This relies on the definition of a new class of games which generalize standard two-player stochastic (parity) games by allowing a play to be split into concurrent subplays, each continuing their evolution independently. Our main technical result is the equivalence of the two semantics. The proof is carried out in ZFC set theory extended with Martin's Axiom at an uncountable cardinal.

Probabilistic modal \mu-calculus with independent product

Probabilistic modal mu-calculus with independent product

The probabilistic (or quantitative) modal mu-calculus is a fixed-point logic de- signed for expressing properties of probabilistic labeled transition systems (PLTS). Two semantics have been studied for this logic, both assigning to every process state a value in the interval [0,1] representing the probability that the property expressed by the formula holds at the state. One semantics is denotational and the other is a game semantics, specified in terms of two-player stochastic games. The two semantics have been proved to coincide on all finite PLTS's, but the equivalence of the two semantics on arbitrary models has been open in literature. In this paper we prove that the equivalence indeed holds for arbitrary infinite models, and thus our result strengthens the fruitful connection between denotational and game semantics. Our proof adapts the unraveling or unfolding method, a general proof technique for proving result of parity games by induction on their complexity.

On the equivalence of game and denotational semantics for the probabilistic mu-calculus

https://hal.archives-ouvertes.fr/hal-00512377/document#page=54

The Equivalence of Game and Denotational Semantics for the Probabilistic mu-Calculus.

We present a formal proof system for compositional verification of probabilistic concurrent processes. Processes are specified using an SOS-style process algebra with probabilistic operators. Properties are expressed using a probabilistic modal μ-calculus. And the proof system is formulated as a sequent calculus in which sequents are given a quantitative interpretation. A key feature is that the probabilistic scenario is handled by introducing the notion of Markov proof, according to which proof trees contain probabilistic branches and are required to satisfy a condition formulated by interpreting them as Markov Decision Processes. We present simple but illustrative examples demonstrating the applicability of the approach to the compositional verification of infinite state processes. Our main result is the soundness of the proof system, which is proved by applying the coupling method from probability theory to the game semantics of the probabilistic modal μ-calculus.

/pdf/a-proof-system-for-compositional-verification-of-oy8h8w9ekt.pdf

Matteo Mio

Papers

Probabilistic modal \mu-calculus with independent product

Probabilistic modal mu-calculus with independent product

On the equivalence of game and denotational semantics for the probabilistic mu-calculus

The Equivalence of Game and Denotational Semantics for the Probabilistic mu-Calculus.

A proof system for compositional verification of probabilistic concurrent processes