Integrating Topological Proofs with Model Checking to Instrument Iterative Design

Abstract

System development is not a linear, one-shot process. It proceeds through refinements and revisions. To support assurance that the system satisfies its requirements, it is desirable that continuous verification can be performed after each refinement or revision step. To achieve practical adoption, formal system modeling and verification must accommodate continuous verification efficiently and effectively. Our proposal to address this problem is TOrPEDO, a verification approach where models are given via Partial Kripke Structures (PKSs) and requirements are specified as Linear-time Temporal Logic (LTL) properties. PKSs support refinement, by deliberately indicating unspecified parts of the model that are later completed. We support verification in two complementary forms: via model checking and proofs. Model checking is useful to provide counterexamples, i.e., pinpoint model behaviors that violate requirements. Proofs are instead useful since they can explain why requirements are satisfied. In our work, we introduce a specific concept of proof, called topological proof (TP). A TP produces a slice of the original PKS which justifies the property satisfaction. Because models can be incomplete, TOrPEDO supports reasoning on requirements satisfaction, violation, and possible satisfaction (in the case where the satisfaction depends on unknown parts).

TOrPEDO: witnessing model correctness with topological proofs

“…We present two implementations for the topological proof extractor component: our previous implementation [MRB20], which is based on PLTL-MUP [SGT13], and a novel SMT-based procedure, which is part of the contribution of this work. The versions of TOrPEDO that use these two topological proof extractor components are named TOrPEDO-MUP are TOrPEDO-SMT.…”

“…To tackle this problem, we recently proposed the novel notion of topological proof (TP) [MRB20], which overcomes the complexity of deductive proofs and is designed to make proofs useful for the iterative verification of model revisions. A topological proof is a slice of the original model that witnesses which part of the model impacts the property satisfaction.…”

“…In our previous work [MRB20], we formally defined topological proofs by considering Partial Kripke Structures (PKSs) [BG99] and Linear-time Temporal Logic (LTL) to respectively express the model and the properties of interest. While it is possible to consider other modeling formalisms, we chose Partial Kripke Structures since (i) they are used in requirement elicitation to reason about system behavior from different points of view [EC01, BCE + 06], and are a common theoretical reference language used in the formal method community for the specification of uncertain models (e.g, [GJ03, BG99, GP09, BG00]); (ii) other modeling formalisms commonly used in software development [FUMK06,Uch09], such as Modal Transition Systems [LT88] (MTSs), can be converted into Partial Kripke Structures through a simple transformation [GJ03] making our solution easily applicable to those models; and (iii) Kripke Structures (KSs) are particular instances of Partial Kripke Structures that represent complete models.…”

“…To support the use of topological proofs during model design, we proposed TOrPEDO (TOpological Proof drivEn Development framewOrk) [MRB20], a novel automated verification framework, that: (i) supports Partial Kripke Structures and Linear-time Temporal Logic; (ii) allows performing analysis and verification in the context of models in which "incompleteness" represents a conceptual uncertainty; (iii) guides refinements and revisions through complementary outputs: counterexamples and proofs; and (iv) when the system is completely specified allows understanding which changes impact or not the satisfaction of certain properties.…”

“…There exists two variants of TOrPEDO: TOrPEDO-MUP and TOrPEDO-SMT. TOrPEDO-MUP was developed in our previous work [MRB20], TOrPEDO-SMT is part of the contribution of this work.…”