Michael D. Jones

Model checking machine code with the GNU debugger

Embedded software verification is an important verification problem that requires the ability to reason about the timed semantics of concurrent behaviors at a low level of atomicity. Combining a cycle-accurate debugger with model checking algorithms provides an accurate model of software execution at the machine-code level while supporting concurrency and allowing abstractions to manage state explosion. We report on the design and implementation of such a model checker using the GNU debugger (gdb) with different processor backends. A significant feature of the resulting tool is that we can adjust the level of atomicity during the model checking run to reduce state explosion while focusing on behaviors that are likely to generate an error.

Responding to policies at runtime in TrustBuilder

Automated trust negotiation is the process of establishing trust between entities with no prior relationship through the iterative disclosure of digital credentials. One approach to negotiating trust is for the participants to exchange access control policies to inform each other of the requirements for establishing trust. When a policy is received at run-time, a compliance checker determines which credentials satisfy the policy so they can be disclosed. In situations where severed sets of credentials satisfy a policy and some of the credentials are sensitive, a compliance checker that generates all the sets is necessary to insure that the negotiation succeeds whenever possible. Compliance checkers designed for trust management do not usually generate all the satisfying sets. In this paper, we present two practical algorithms for generating all satisfying sets given a compliance checker that generates only one set. The ability to generate all of the combinations provides greater flexibility in how the system or user establishes trust. For example, the least sensitive credential combination could be disclosed first. These Ideas have been implemented in TrustBuilder, our prototype system for trust negotiation.

Parallel search for LTL violations

Recent advances in parallel model checking for liveness properties achieve significant capacity increases over sequential model checkers. However, the capacity of parallel model checkers is in turn limited by available aggregate memory and network bandwidth. We propose a new parallel algorithm that sacrifices complete coverage for increased capacity to find errors. The algorithm, called BEE (for bee-based error exploration), uses coordinated depth-bounded random walks to reduce memory and bandwidth demands. A unique advantage of BEE is that it is well suited for use on clusters of nondedicated workstations.

Incremental Proof of the Producer/Consumer Property for the PCI Protocol

We present an incremental proof of the producer/consumer property for the PCI protocol. In the incremental proof, a corrected model of the multibus PCI 2.1 protocol is shown to be a refinement of the producer/consumer property. Multi-bus PCI must be corrected because the original PCI specification violates the producer/consumer property. The final model of PCI includes transaction types and reordering along with the completion mechanism for delayed PCI transactions. Verification results include multiple concurrent sessions of the producer/consumer property in a family of topologically isomorphic network configurations. The remaining configurations are identified and left for future work. In contrast to previous case studies involving this problem [13,15], the incremental proof provides structure which simplifies otherwise difficult monolithic proof attempts.

Head mounted displays and deaf children: Facilitating Sign Language in Challenging Learning Environments

Headmounted displays (HMDs) are evaluated as a tool to facilitate studentteacher interaction in sign language. Deaf or hardofhearing children who communicate in sign language receive all instruction visually. In normal deaf educational settings the child must split visual attention between signed narration and visual aids. Settings in which visual aids are distributed over a large visual area are particularly difficult. Sign language displayed in HMDs may allow a deaf child to keep the signed narration in sight, even when not looking directly at the person signing. Children from the community who communicate primarily in American Sign Language (ASL) participated in two phases of a study designed to evaluate the comfort and utility of viewing ASL in an HMD.

Directable Weathering of Concave Rock Using Curvature Estimation

We address the problem of directable weathering of exposed concave rock for use in computer-generated animation or games. Previous weathering models that admit concave surfaces are computationally inefficient and difficult to control. In nature, the spheroidal and cavernous weathering rates depend on the surface curvature. Spheroidal weathering is fastest in areas with large positive mean curvature and cavernous weathering is fastest in areas with large negative mean curvature. We simulate both processes using an approximation of mean curvature on a voxel grid. Both weathering rates are also influenced by rock durability. The user controls rock durability by editing a durability graph before and during weathering simulation. Simulations of rockfall and colluvium deposition further improve realism. The profile of the final weathered rock matches the shape of the durability graph up to the effects of weathering and colluvium deposition. We demonstrate the top-down directability and visual plausibility of the resulting model through a series of screenshots and rendered images. The results include the weathering of a cube into a sphere and of a sheltered inside corner into a cavern as predicted by the underlying geomorphological models.

Explicit State Model Checking with Hopper

The Murϕ-based Hopper tool is a general purpose explicit model checker. Hopper leverages Murϕ’s class structure to implement new algorithms. Hopper differs from Murϕ in that it includes in its distribution published parallel and disk based algorithms, as well as several new algorithms. For example, Hopper includes parallel dynamic partitioning, cooperative parallel search for LTL violations and property-based guided search (parallel or sequential). We discuss Hopper in general and present a recently implemented randomized guided search algorithm. In multiple parallel guided searches, randomization increases the expected average time to find an error but decreases the expected minimum time to find an error.

Guided model checking with a Bayesian meta-heuristic

This work presents a formal verification algorithm for finding errors in models of complex concurrent systems. The algorithm improves explicit guided model checking by applying the empirical Bayes method to revise heuristic estimates of the distance from a given state to an error state. Guided search using the revised estimates finds errors with less search effort than the original estimates.

Delaunay deformable mesh for the weathering and erosion of 3D terrain

Computer-generated erosion and weathering are important to convey setting and mood in computer generated images. Heightmap based landforms are good for distant scenes, but inadequate for scenes containing concave rock formations. Voxel based terrain editing algorithms do admit concave surfaces but do not scale. We introduce weathering on triangulated surface meshes, using a memory efficient modification of the Delaunay deformable model. This structure allows the freedom of an unorganized point cloud, the geometric information and visualization of a surface mesh, and the topological freedom of volumetric approaches—all while scaling linearly with surface complexity. We implement both spheroidal weathering and hydraulic erosion algorithms on this structure and demonstrate that the resulting terrain is visually plausible at modest computational cost.

Test Case Generation Using Model Checking for Software Components Deployed into New Environments

In this paper, we show how to generate test cases for a componentdeployed into a new software environment. This problem is importantfor software engineers who need to deploy a component into a newenvironment. Most existing model based testing approaches generatemodels from high level specifications. This leaves a semantic gapbetween the high level specification and the actualimplementation. Furthermore, the high level specification often needsto be manually translated into a model, which is a time consuming anderror prone process. We propose generating themodel automatically by abstracting the source code of the componentusing an under-approximating predicate abstraction scheme and leaving theenvironment concrete. Test cases are generated by iterativelyexecuting the entire system and storing the border states between thecomponent and the environment. A model checker is used in the componentto explore non-deterministic behaviors of the component due to theconcurrency or data abstraction. The environment is symbolicallysimulated to detect refinement conditions. Assuming the run timeenvironment is able to do symbolic execution and that the run timeenvironment has a single unique response to a given input, we provethat our approach can generate test cases that have complete coverageof the component when the proposed algorithm terminates. When thealgorithm does not terminate, the abstract-concrete model can berefined iteratively to generate additional test cases. Test casesgenerated from this abstract-concrete model can be used to check whethera new environment is compatible with the existing component.