Model checking CML: tool development and industrial applications

Abstract

A model checker is an automatic tool that traverses a specific structure (normally a Kripke structure referred as the model M ) to check the satisfaction of some (temporal) logical property f . This is formally stated as M ⊧ f . For some formal notations, the model M of a specification S (written in a formal language L ) can be described as a labelled transition system (LTS). Specifically, it is not clear in general how usual tools such as SPIN, FDR, PAT, etc., create the LTS representation from a given process. Although one expects the coherence of the LTS generation with the semantics of L , it is completely hidden inside the model checker itself. In this paper we show how to create a model checker for L , using a development approach based on its operational semantics. We use a systematic semantics embedding and the formal modeling using logic programming and analysis (FORMULA) framework to this end. We illustrate our strategy considering the formal language COMPASS modelling language (CML)—a new language that was based on CSP, VDM and the refinement calculus proposed for modelling and analysis of systems of systems. As FORMULA is based on satisfiability modulo theories solving, our model checker can handle communications and predicates involving data with infinite domains by building and manipulating a symbolic LTS. This goes beyond the capabilities of traditional CSP model checkers such as FDR and PAT. Moreover, we show how to reduce time and space complexities by simple semantic modifications in the embedding. This allows a more semantics-preserving tuning. Finally, we show a real implementation of our model checker in an integrated development platform for CML and its practical use on an industrial case study.

Model‐driven architecture based security analysis

“…Mota et al 26 . proposed a new model checker with the COMPASS Modeling Language (CML) whose purpose is to provide support for modeling system‐of‐systems with infinite aspects.…”

“…However, since the time concept is not supported by ProVerif, the simplified translation to ProVerif specifications could lead to some false positive results. 25 Mota et al 26 proposed a new model checker with the COMPASS Modeling Language (CML) whose purpose is to provide support for modeling system-of-systems with infinite aspects. This model checker is embedded into the Symphony IDE, which is integrated with a SysML tool (Artisan Studio), so CML model files can be generated directly from SysML models.…”

The evolution of VDM tools from the 1990s to 2015 and the influence of CAMILA

“…Test automation is supported by the RT-Tester tool which identifies test cases, traces them to re-quirements and generates concrete test data by means of an integrated constraint solver [95]. There are also dependencies on the Isabelle theorem prover and on the Microsoft FORMULA model checker [96]. Distributed simulation was supported experimentally [97], as was the combination of the interpreter with the ProB tool [98] for interpreting implicit specifications [99].…”