Collection of Reports from CSC2108 Automated Verification, Fall '99
Instructor: Marsha Chechik
Students:  William Andrepoulos, Bob Bernecky, Ariel Fuxman, Benet Devereux, Kristin Hofstee, Jingjing Lu, Tsuyoshi Morioka, Peeter Piegaze, Jeffrey Tang, Sean Thompson, Cosmin Truta, Yuxiang Zhu, Wei Zhou

(Also available as Technical Report CSRG-407, Department of Computer Science, University of Toronto)

1. Title: Defining Formal Semantics for the Unified Modelling Language (UML)
Author: William Andreopolous
The Unified Modelling Language (UML) has become a standard diagrammatic notation for describing object-oriented (OO) models and designs. UML suffers from a lack of a formal (or precise) semantics. UML semantics is mostly described using lengthy paragraphs of often ambiguous informal English, or is totally missing. This paper examines the research conducted at present by the PUML (Precise UML) group towards formalising UML. We present the three main approaches that have been identified for UML formalisation; the supplemental approach, the OO-extended formal language approach, and the methods integration approach. We illustrate the approaches with specific examples from published sources. Finally, we explain the reasons for which UML formalisation is such a difficult topic and we discuss what the future might look like as a result.
Report: postscript (3199kB)  compressed postscript (1644kB)
2. Title: A Case Study - Verifying Cash Point System with PROMELA/Spin
Author: Jeffrey Tang, Wei Zhou
We develop a software controller for a cash machine system that involves multiple cash tills and users. In this report, we describe the system requirements and the design decisions made in our model. Subsequently, we describe the distributed and concurrent implementation of the model. Furthermore, we mention some LTL properties that we prove with SPIN as well as the ones that we are unable to prove. Finally, we describe our experiences in the project and draw concclusions.
Report: postscript (878kB)  compressed postscript (291kB)
Appendix: postscript (178kB)  compressed postscript (38kB)
3. Title: A Survey of Architecture Description Languages
Author: Ariel Fuxman
In the last few years, a considerable number of architecture description languages (ADLs) have been proposed for describing and reasoning about software architectures. In this work, we classify and compare several ADLs placing emphasis on their features for formal modelling and analysis.
Report: postscript (170kB)  compressed postscript (49kB)
4. Title: Automatic Verification of Probabilistic Systems
Author: Tsuyoshi Morioka
Probabilistic model checking is a natural extenstion of model checking to probabilistic systems. In order to model-check probabilistic systems, we need formal models that capture a probabilistic behaviour of a system and probabilistic temporal logics that allow us to make statememts about the likelihood that a system follows a certain execution sequence. In this paper we present three formal models of probabilistic systems: Markov chains, which can be used to model purely probabilistic systems, Probabilistic Nondeterministic Systems (PNSs), which capture both a probabilistic behaviour and a nondeterministic behaviour of a system, and Timed Probabilistic Nondeterministic Systems, which extend PNSs by modelling the passage of time explicitly. We also present three probabilistic temporal logics PCTL*, PBTL, and pTL*. PCTL* extends a traditional temporal logic CTL*, and PBTL and pTL* are further extensions of PCTL*. We briefly dicuss the model checking procedures for these logics.
Report: postscript (167kB)  compressed postscript (50kB)
5. Title: A Survey of Model Checking Java Programs
Author: Sean Thompson
Due to the recent advancements of the Internet, Java has become a dominant programming language, especially for conding concurrent applications. Finite state verification is a powerful technique for detecting subtle errors in a program. This paper reviews recent attempts to transform Java source code into a model that can be checked using verification tools. Two classes of techniques are reviewed. The first is translating Java source code into a known modeling language such as Promela. The second is building a finite state model based on the source and performing state reductions. Once state reductions are performed and the model sized reduced, the resulting model can be checked for desired properties.
Report: postscript (695kB)  compressed postscript (68kB)
6. Title: Hardware Verification with Cadence SMV: Multiplication using Booth's Algorithm
Author: Kristin Hofstee, Peeter Piegaze
A binary multiplier is an integral part of the arithmetic logic unit (ALU) subsystem found in many processors. Integer multiplication can be inefficient and costly, in time and hardware, depending on the representation of signed numbers. Booth's algorithm suggests a technique for multiplying signed numbers that works equally well for both negative and positive multipliers. In this project, we have used Cadence-SMV for describing and verifying a hardware design based on Booth's algorithm. Timing and correctness properties were verified. Cadence-SMV is a symbolic model verifier and is a good choice for specifying hardware designs since it is good at verifying combinational logic and interacting state machines. Also, Cadence-SMV produces a step by step counter examples if a desired property is false which allows for much easier debugging.
Report: postscript (706kB)  compressed postscript (375kB)
7. Title: Streams and Serialization Protocols: A Formal Approach
Author: Cosmin Truta
This paper proposes a way to elegantly approach a problem that used to be ugly by its nature: to save and restore (serialize) objects to and from magnetic support, in a portable, machine- and language-independent fashion. The solution also addresses intra- and inter-process communications, because the problems raised by portability and interchangeability are similar in both cases. To achieve this, a high-level description language that addresses low-level issues is designed. Translation from a high-level specification to a certain programming language can be done automatically, thus considerably reducing the effort that programmers used to spend when implementing complicated, standard or non-standard serialization protocols, and increasing the code reliability at the same time.
Report: postscript (193kB)  compressed postscript (60kB)
8. Title: Automatic Verification of Transmission Control Protocol Using NuSMV
Author: Jingjing Lu, Yuxiang Zhu
In this report we construct a model to simulate the TCP state machine using NuSMV. Also we try to find some possible flaws in TCP. Finally we address if NuSMV is a proper model checker for complex systems like TCP.
Report: PDF (1994kB)  compressed PDF (239kB)
Appendix: PDF (11kB) 
9. Title: Approaches to Verification of Hybrid Systems: A Survey
Author: Benet Devereux
Hybrid systems are characterized by a mix of analog and digital inputs and outputs. We define such systems formally as hybrid automata, and discuss how to specify interesting properties of them. A few approaches to verifying hybrid systems are outlined: reachability analysis, model-checking on finite-state approximating automata, theorem proving, and linear programming. These approaches work with hybrid automata, or some other formalism that can be converted into hybrid automata. The verification methods are compared on a number of practical grounds, including what sort of information they provide from failed verification runs and how they distinguish between system and environment variables in the system.
Report: postscript (165kB)  compressed postscript (51kB)
10. Title: Static Analysis of Array Language Programs
Author: Robert Bernecky
We describe an approach for performing static analysis of array shapes in array languages, such as APL, J, and SAC. Our approach is, by necessity, symbolic, as array shapes may not be known until run time, and may change dynamically during program execution. A shape algebra, based on the properties of array language primitive functions and operators, is used in conjunction with data flow analysis to create symbolic expressions that describe the rank and shape of the arrays created by each operation within an array language program. The Omega Library is used to simplify these expressions, and the simplified expressions are then used for static detection of certain run-time errors, such as rank error (array dimensions are not conformable for an operation) and length error (array shapes are not conformable for an operation). Shape information can also be used to enable a number of array optimizations, including loop fusion and array contraction and WITH-loop folding, both powerful optimizations that can produce performance improvements of an order of magnitude or more. Finally, shape information can permit removal of run-time conformability checks, by verifying that function arguments must always be conformable within a specific program. As our implementation is not yet complete, we present a few hand-executed examples of how it works.
Report: postscript (??)  compressed postscript (??)

Information about CSC2108 "Automated Verification" is available at