Automatic verification has nowadays become a central domain of investigation in computer science. Over 25 years, a rich theory has been developed leading to numerous tools, both in academics and industry, allowing the verification of Boolean properties - those that can be either true or false. Current needs evolve to a finer analysis, a more quantitative one. Extension of verification techniques to quantitative domains has begun 15 years ago with probabilistic systems. However, many other quantitative properties are of interest, such as the lifespan of an equipment, energy consumption of an application, the reliability of a program, or the number of results matching a database query. Expressing these properties requires new specification languages, as well as algorithms checking these properties over a given structure. This thesis aims at investigating several formalisms, equipped with weights, able to specify such properties: denotational ones - like regular expressions, first-order logic with transitive closure, or temporal logics - or more operational ones, like navigating automata, possibly extended with pebbles. A first objective of this thesis is to study expressiveness results comparing these formalisms. In particular, we give efficient translations from denotational formalisms to the operational one. These objects, and the associated results, are presented in a unified framework of graph structures. This permits to handle finite words and trees, nested words, pictures or Mazurkiewicz traces, as special cases. Therefore, possible applications are the verification of quantitative properties of traces of programs (possibly recursive, or concurrent), querying of XML documents (modeling databases for example), or natural language processing. Second, we tackle some of the algorithmic questions that naturally arise in this context, like evaluation, satisfiability and model checking. In particular, we study some decidability and complexity results of these problems depending on the underlying semiring and the structures under consideration (words, trees...). Finally, we consider some interesting restrictions of the previous formalisms. Some permit to extend the class of semirings on which we may specify quantitative properties. Another is dedicated to the special case of probabilistic specifications: in particular, we study syntactic fragments of our generic specification formalisms generating only probabilistic behaviors.

This document presents a synthesis of the research results conducted in the eld of software veri cation for model-driven engineering (MDE). MDE is becoming one of the dominant software engineering paradigms in the industry. The main characteristic of MDE is the use of software models and model manipulation operations as main artifacts in all software engineering activities. This change of perspective implies that correctness of models (and model manipulation operations) becomes a key factor in the quality of the nal software product. The problem of ensuring software correctness is still considered to be a Grand Challenge for the software engineering community. At the modellevel, we are still missing a set of tools and methods that helps in the detection of defects and smoothly integrates in existing MDE-based tool-chains without an excessive overhead. Characteristics of existing tools, which require designer interaction, deep knowledge of formal methods or extensive manual model annotations seriously impair its usability in practice. In this document, we present our pragmatic set of techniques for formal model veri cation to overcome these limitations. We call our techniques pragmatic because they try to nd the best trade-o between completeness of the veri cation and the usability of the process.

Systems code is almost universally written in the C programming language or a variant. C has a very low level of type and memory abstraction and formal reasoning about C systems code requires a memory model that is able to capture the semantics of C pointers and types. At the same time, proof-based verification demands abstraction, in particular from the aliasing and frame problems. In this thesis, we study the mechanisation of a series of models, from semantic to separation logic, for achieving this abstraction when performing interactive theorem-prover based verification of C systems code in higher- order logic. We do not commit common oversimplifications, but correctly deal with C's model of programming language values and the heap, while developing the ability to reason abstractly and efficiently. We validate our work by demonstrating that the models are applicable to real, security- and safety-critical code by formally verifying the memory allocator of the L4 microkernel. All formalisations and proofs have been developed and machine-checked in the Isabelle/HOL theorem prover.

This dissertation shows that the bounded property verification of hardware Register Transfer Level (RTL) designs can be efficiently performed by precise abstract interpretation of a software representation of the RTL. The first part of this dissertation presents a novel framework for RTL verification using native software analyzers. To this end, we first present a translation of the hardware circuit expressed in Verilog RTL into the software in C called the software netlist. We then present the application of native software analyzers based on SAT/SMT-based decision procedures as well as abstraction-based techniques such as abstract interpretation for the formal verification of the software netlist design generated from the hardware RTL. In particular, we show that the path-based symbolic execution techniques, commonly used for automatic test case generation in system softwares, are also effective for proving bounded safety as well as detecting bugs in the software netlist designs. Furthermore, by means of experiments, we show that abstract interpretation techniques, commonly used for static program analysis, can also be used for bounded as well as unbounded safety property verification of the software netlist designs. However, the analysis using abstract interpretation shows high degree of imprecision on our benchmarks which is handled by manually guiding the analysis with various trace partitioning directives. The second part of this dissertation presents a new theoretical framework and a practical instantiation for automatically refining the precision of abstract interpretation using Conflict Driven Clause Learning (CDCL)-style analysis. The theoretical contribution is the abstract interpretation framework that generalizes CDCL to precise safety verification for automatic transformer refinement called Abstract Conflict Driven Learning for Safety (ACDLS). The practical contribution instantiates ACDLS over a template polyhedra abstract domain for bounded safety verification of the software netlist designs. We experimentally show that ACDLS is more efficient than a SAT-based analysis as well as sufficiently more precise than a commercial abstract interpreter.

Esta tese apresenta um modelo conceitual para modelagem e vericação de espe- cificações de sistemas orientados a objeto. Mais especificiamente, uma extensão da abordagem algébrica baseada em single-pushouts para gramáticas de grafos tipadas é desenvolvida, onde os morfismos de tipagem são compatíveis com as relações de ordem sobre os nodos e (hiper)arcos de um grafo, e que representam, respectivamente, as relações de herança entre classes e sobrescrita de métodos. O trabalho é dividido em trÊs linhas principais: especificações de sistemas, comportamento dinâmico de programas, e verificaçaõ formal de sistemas orientados a objeto. A hierarquia de classes de um sistema orientado a objetoé modelada por um hipergrafo rotulado chamado grafo de classes, cujos conjuntos de nodos e arcos possuem uma relação de ordem parcial restrita, com o objetivo de modelar herança e sobrescrita de métodos. Restrições adicionais garantem que grafos de classes provÊm um modelo fiel e adequado da maneira como as classes de um sistema orientado a objetos s~ao efetivamente organizadas e combinadas. Grafos orientados a objeto são hipergrafos tipados sobre um grafo de classes. O morfismo de tipagem exige que hiperarcos mapeados preservem as relações existentes entre os seus nodos de origem e destino. Esta característica modela a heran»ca de forma adequada, visto que qualquer objeto pode fazer uso de atributos ou mensagens herdadas. Mor¯smos entre grafos orientados a objeto asseguram que o polimorfismo de subclasses seja uma característica intrínseca do formalismo aqui apresentado. Regras orientadas a objeto respeitam os princípios de encapsulamento e oclusão da informação do paradigma. Uma derivação direta (ou aplicação de regra)é uma soma amalgamada (pushout) na categoria de grafos orientados a objeto e seus morfismos. Gramáticas de grafos orientados a objeto modelam o comportamento dinâmico de sistemas. Uma semântica observacional para gramáticas de grafos orientados a objeto, baseada em sistemas de transição rotulados, é definida. Tal semântica é baseada na noção de entidades visíveis (objetos ou mensagens), e que representam os elementos importantes no processo de verificação de propriedades do sistema especificado pela gramática. Finalmente, uma tradução formal de gramáticas de grafos orientados a objeto para programas na linguagem Promela é definida. Objetos são traduzidos como pro- cessos em Promela, e a troca de mensagens entre objetos é implementada com canais de comunicação. Herança, polimorfismo e ligação dinÂmica são implementados no programa Promela, que originalmente não suporta nenhuma dessas caraterísticas. A verificação de propriedades do programa pode ser efetuada tanto sobre estados como sobre eventos. / This thesis presents a graph-based formal framework to model and verify object- oriented specifications. More specifically, an extension of the algebraic single- pushout approach to (typed) graph grammars is developed, where the typing mor- phisms are compatible with the order relations defined over nodes and edges to represent, respectively, inheritance and overriding of classes and methods. This work is divided in three main lines: static specifications, dynamic behaviour, and formal verification of object-oriented systems. The object-oriented class hierarchy structure is modeled by a graph structure called class-model graph, whose set of nodes and edges have a restricted partial order relation over them, to model inheritance and method overriding. The underlying relations of such sets obey additional restrictions, intended to assure that class- model graphs provide an adequate and faithful model of how object-oriented classes are organized and combined. Object-oriented graph grammars model the dynamics of object-oriented systems. Object-oriented graphs are hypergraphs typed over a class-model graph, but the typing morphism is more flexible than the traditional one, in the sense that mapped hyperedges need to preserve relations between sources and targets. This feature adequately models inheritance, for any object can make use of inherited attributes or messages. Morphisms between object-oriented graphs assure that subclass poly- morphism is a built-in feature of the formalism. Object-oriented rules respect the principles of encapsulation and information hiding of the object-oriented paradigm. A direct derivation (or rule application) is shown to be a pushout in the category of object-oriented graphs and their morphisms. An observational semantics for object-oriented graph grammars, based on a labeled transition system, is presented. This semantics is based on a notion of visible entities (objects or messages), which are the elements we are interested in for verification purposes. Finally, a formal translation from object-oriented graph grammars specifications into Promela programs is defined. Objects in the system graph are translated as Promela processes, and message exchange is implemented with buffered communication channels. The semantics of grammar rule application is preserved by the nondeterminism in the choice of which message to consume. Inheritance, polymorphism and dynamic binding are implemented in the Promela program, which originally does not support it. The translation presented assures that both state and event verification can be performed.

Esta tese apresenta um modelo conceitual para modelagem e vericação de espe- cificações de sistemas orientados a objeto. Mais especificiamente, uma extensão da abordagem algébrica baseada em single-pushouts para gramáticas de grafos tipadas é desenvolvida, onde os morfismos de tipagem são compatíveis com as relações de ordem sobre os nodos e (hiper)arcos de um grafo, e que representam, respectivamente, as relações de herança entre classes e sobrescrita de métodos. O trabalho é dividido em trÊs linhas principais: especificações de sistemas, comportamento dinâmico de programas, e verificaçaõ formal de sistemas orientados a objeto. A hierarquia de classes de um sistema orientado a objetoé modelada por um hipergrafo rotulado chamado grafo de classes, cujos conjuntos de nodos e arcos possuem uma relação de ordem parcial restrita, com o objetivo de modelar herança e sobrescrita de métodos. Restrições adicionais garantem que grafos de classes provÊm um modelo fiel e adequado da maneira como as classes de um sistema orientado a objetos s~ao efetivamente organizadas e combinadas. Grafos orientados a objeto são hipergrafos tipados sobre um grafo de classes. O morfismo de tipagem exige que hiperarcos mapeados preservem as relações existentes entre os seus nodos de origem e destino. Esta característica modela a heran»ca de forma adequada, visto que qualquer objeto pode fazer uso de atributos ou mensagens herdadas. Mor¯smos entre grafos orientados a objeto asseguram que o polimorfismo de subclasses seja uma característica intrínseca do formalismo aqui apresentado. Regras orientadas a objeto respeitam os princípios de encapsulamento e oclusão da informação do paradigma. Uma derivação direta (ou aplicação de regra)é uma soma amalgamada (pushout) na categoria de grafos orientados a objeto e seus morfismos. Gramáticas de grafos orientados a objeto modelam o comportamento dinâmico de sistemas. Uma semântica observacional para gramáticas de grafos orientados a objeto, baseada em sistemas de transição rotulados, é definida. Tal semântica é baseada na noção de entidades visíveis (objetos ou mensagens), e que representam os elementos importantes no processo de verificação de propriedades do sistema especificado pela gramática. Finalmente, uma tradução formal de gramáticas de grafos orientados a objeto para programas na linguagem Promela é definida. Objetos são traduzidos como pro- cessos em Promela, e a troca de mensagens entre objetos é implementada com canais de comunicação. Herança, polimorfismo e ligação dinÂmica são implementados no programa Promela, que originalmente não suporta nenhuma dessas caraterísticas. A verificação de propriedades do programa pode ser efetuada tanto sobre estados como sobre eventos. / This thesis presents a graph-based formal framework to model and verify object- oriented specifications. More specifically, an extension of the algebraic single- pushout approach to (typed) graph grammars is developed, where the typing mor- phisms are compatible with the order relations defined over nodes and edges to represent, respectively, inheritance and overriding of classes and methods. This work is divided in three main lines: static specifications, dynamic behaviour, and formal verification of object-oriented systems. The object-oriented class hierarchy structure is modeled by a graph structure called class-model graph, whose set of nodes and edges have a restricted partial order relation over them, to model inheritance and method overriding. The underlying relations of such sets obey additional restrictions, intended to assure that class- model graphs provide an adequate and faithful model of how object-oriented classes are organized and combined. Object-oriented graph grammars model the dynamics of object-oriented systems. Object-oriented graphs are hypergraphs typed over a class-model graph, but the typing morphism is more flexible than the traditional one, in the sense that mapped hyperedges need to preserve relations between sources and targets. This feature adequately models inheritance, for any object can make use of inherited attributes or messages. Morphisms between object-oriented graphs assure that subclass poly- morphism is a built-in feature of the formalism. Object-oriented rules respect the principles of encapsulation and information hiding of the object-oriented paradigm. A direct derivation (or rule application) is shown to be a pushout in the category of object-oriented graphs and their morphisms. An observational semantics for object-oriented graph grammars, based on a labeled transition system, is presented. This semantics is based on a notion of visible entities (objects or messages), which are the elements we are interested in for verification purposes. Finally, a formal translation from object-oriented graph grammars specifications into Promela programs is defined. Objects in the system graph are translated as Promela processes, and message exchange is implemented with buffered communication channels. The semantics of grammar rule application is preserved by the nondeterminism in the choice of which message to consume. Inheritance, polymorphism and dynamic binding are implemented in the Promela program, which originally does not support it. The translation presented assures that both state and event verification can be performed.

Nowadays, embedded systems are becoming more and more complex. For this reason, designers focus more and more to adopt component-based methods for their designs. Consequently, there is an increasing interest on modeling and verification issues of component-based embedded systems. In this thesis, a tool, which integrates modeling, simulation and verification of component-based embedded systems, is designed and implemented. This tool uses the PRES+, Petri Net based Representation for Embedded Systems, to model component-based embedded systems. Both simulation and verification of systems are based on the PRES+ models. This tool consists of three integrated sub-tools, each of them with a graphical interface, the PRES+ Modeling tool, the PRES+ Simulation tool and the PRES+ Verification tool. The PRES+ Modeling tool is a graphical editor, with which system designers can model component-based embedded systems easily. The PRES+ Simulation tool, which is used to validate systems, visualizes the execution of a model in an intuitive manner. The PRES+ Verification tool provides a convenient access to a model checker, in which models can be formally verified with respect to temporal logic formulas.

The use of computer-based systems is rapidly increasing and such systems can now be found in a wide range of applications, including safety-critical applications such as cars and aircrafts. To make the development of such systems more efficient, there is a need for tools for automatic safety analysis, such as analysis of fault tolerance. In this thesis, a tool for automatic formal analysis of fault tolerance was developed. The tool is built on top of the existing development environment for the synchronous language Esterel, and provides an output that can be visualised in the Item toolkit for fault tree analysis (FTA). The development of the tool demonstrates how fault tolerance analysis based on formal verification can be automated. The generated output from the fault tolerance analysis can be represented as a fault tree that is familiar to engineers from the traditional FTA analysis. The work also demonstrates that interesting attributes of the relationship between a critical fault combination and the input signals can be generated automatically. Two case studies were used to test and demonstrate the functionality of the developed tool. A fault tolerance analysis was performed on a hydraulic leakage detection system, which is a real industrial system, but also on a synthetic system, which was modeled for this purpose.

A fase inicial de projeto de sistemas, baseada na elicitação, modelagem e análise dos requisitos é considerada a mais complexa e a mais estratégica para obtenção de bons resultados. Por conseguinte, erros precisam ser detectados durante esta fase inicial, antes de começar a implementação, evitando assim o desperdício de tempo e recursos. Este trabalho propõe um método formal de modelagem, análise e verificação de requisitos, partindo de uma representação semi-formal de requisitos em UML, e utilizando o formalismo das Redes de Petri para proceder à modelagem, análise e verificação. Propriedades das redes de Petri, tais como invariantes, são usadas para analisar os requisitos, permitindo uma validação antecipada dos requisitos no processo de design. O objetivo deste trabalho é estender a aplicação das redes de Petri como representação formal para a modelagem e análise de requisitos, endereçando assim a fase anterior às especificações. Pressupõe-se a existência de uma disciplina de projeto baseada em modelos (model driven) que abrange a fase inicial do projeto e se propaga para a modelagem e verificação de soluções. Assim, a abordagem proposta nesta tese se encaixa plenamente em um processo orientado a modelos que use a mesma linguagem: as redes de Petri. / The first stage of system design, which includes elicitation, modeling, and analysis of requirements is considered at the same time, very complex and very strategic to achieve proper results.Therefore it is important to detect mistakes both, conceptual and in requirements, before implementation begins, avoiding the waste of time and resources. This work proposes a formal method for modeling, analysis and verification of requirements, starting with a semi-formal representation of requirements in UML. Petri net and its properties such as invariants are used to analyze requirements, thereby allowing that requirements can be validated earlier. The main objective of this work is to extend the application of Petri Nets, as a formal representation, to requirements phase, addressing specification building. It is assumed that there is a model driven design approach that encompass the initial (requirements) phase and goes through the modeling and verification of solutions. Therefore the approach proposed in this work fits a model driven general approach which could use the same formal language: Petri Nets.

Esta tese apresenta um modelo conceitual para modelagem e vericação de espe- cificações de sistemas orientados a objeto. Mais especificiamente, uma extensão da abordagem algébrica baseada em single-pushouts para gramáticas de grafos tipadas é desenvolvida, onde os morfismos de tipagem são compatíveis com as relações de ordem sobre os nodos e (hiper)arcos de um grafo, e que representam, respectivamente, as relações de herança entre classes e sobrescrita de métodos. O trabalho é dividido em trÊs linhas principais: especificações de sistemas, comportamento dinâmico de programas, e verificaçaõ formal de sistemas orientados a objeto. A hierarquia de classes de um sistema orientado a objetoé modelada por um hipergrafo rotulado chamado grafo de classes, cujos conjuntos de nodos e arcos possuem uma relação de ordem parcial restrita, com o objetivo de modelar herança e sobrescrita de métodos. Restrições adicionais garantem que grafos de classes provÊm um modelo fiel e adequado da maneira como as classes de um sistema orientado a objetos s~ao efetivamente organizadas e combinadas. Grafos orientados a objeto são hipergrafos tipados sobre um grafo de classes. O morfismo de tipagem exige que hiperarcos mapeados preservem as relações existentes entre os seus nodos de origem e destino. Esta característica modela a heran»ca de forma adequada, visto que qualquer objeto pode fazer uso de atributos ou mensagens herdadas. Mor¯smos entre grafos orientados a objeto asseguram que o polimorfismo de subclasses seja uma característica intrínseca do formalismo aqui apresentado. Regras orientadas a objeto respeitam os princípios de encapsulamento e oclusão da informação do paradigma. Uma derivação direta (ou aplicação de regra)é uma soma amalgamada (pushout) na categoria de grafos orientados a objeto e seus morfismos. Gramáticas de grafos orientados a objeto modelam o comportamento dinâmico de sistemas. Uma semântica observacional para gramáticas de grafos orientados a objeto, baseada em sistemas de transição rotulados, é definida. Tal semântica é baseada na noção de entidades visíveis (objetos ou mensagens), e que representam os elementos importantes no processo de verificação de propriedades do sistema especificado pela gramática. Finalmente, uma tradução formal de gramáticas de grafos orientados a objeto para programas na linguagem Promela é definida. Objetos são traduzidos como pro- cessos em Promela, e a troca de mensagens entre objetos é implementada com canais de comunicação. Herança, polimorfismo e ligação dinÂmica são implementados no programa Promela, que originalmente não suporta nenhuma dessas caraterísticas. A verificação de propriedades do programa pode ser efetuada tanto sobre estados como sobre eventos. / This thesis presents a graph-based formal framework to model and verify object- oriented specifications. More specifically, an extension of the algebraic single- pushout approach to (typed) graph grammars is developed, where the typing mor- phisms are compatible with the order relations defined over nodes and edges to represent, respectively, inheritance and overriding of classes and methods. This work is divided in three main lines: static specifications, dynamic behaviour, and formal verification of object-oriented systems. The object-oriented class hierarchy structure is modeled by a graph structure called class-model graph, whose set of nodes and edges have a restricted partial order relation over them, to model inheritance and method overriding. The underlying relations of such sets obey additional restrictions, intended to assure that class- model graphs provide an adequate and faithful model of how object-oriented classes are organized and combined. Object-oriented graph grammars model the dynamics of object-oriented systems. Object-oriented graphs are hypergraphs typed over a class-model graph, but the typing morphism is more flexible than the traditional one, in the sense that mapped hyperedges need to preserve relations between sources and targets. This feature adequately models inheritance, for any object can make use of inherited attributes or messages. Morphisms between object-oriented graphs assure that subclass poly- morphism is a built-in feature of the formalism. Object-oriented rules respect the principles of encapsulation and information hiding of the object-oriented paradigm. A direct derivation (or rule application) is shown to be a pushout in the category of object-oriented graphs and their morphisms. An observational semantics for object-oriented graph grammars, based on a labeled transition system, is presented. This semantics is based on a notion of visible entities (objects or messages), which are the elements we are interested in for verification purposes. Finally, a formal translation from object-oriented graph grammars specifications into Promela programs is defined. Objects in the system graph are translated as Promela processes, and message exchange is implemented with buffered communication channels. The semantics of grammar rule application is preserved by the nondeterminism in the choice of which message to consume. Inheritance, polymorphism and dynamic binding are implemented in the Promela program, which originally does not support it. The translation presented assures that both state and event verification can be performed.