List of model checking tools

Last updated

This article lists model checking tools and gives an overview of the functionality of each.

Contents

Overview of some model checking tools

The following table includes model checkers that have

  1. a web site from which it can be downloaded,
  2. a declared license,
  3. a description published in archived literature, and
  4. a Wikipedia article describing it.

In the below table, the following abbreviations are used:

NameModel CheckingEquivalence checkingGUIAvailability
Plain, Probabilistic, Stochastic, ...Modelling languageProperties languageSupported equivalencesCounter example generation  GUI  Graphical SpecificationCounter example visualizationSoftware licenseProgramming language usedPlatform, OS
BLAST Code analysis C Monitor automataYesNoNoNoFree OCaml Windows, Unix related
CADP Plain and probabilistic LOTOS, FC2, FSP, LNTAFMC, MCL, XTLSB, WB, BB, OE, STE, WTE, SE, tau*EYesYesNoYesFUSC C, Bourne shell, Tcl/Tk, LOTOS, LNTmacOS, Linux, Solaris, Windows
CPAchecker Code analysis C Monitor automataYesYesNoYesFreeJavaAny
DREAM Real-time C++, Timed automata Monitor automataYesNoNoNoFree C++ Windows, Unix related
Java Pathfinder Plain and timedJavaunknownNoYesNoNoOpen Source Agreement Java macOS, Windows, Linux
Murφ (Murphi) PlainMurφInvariants, assertionsYesNoNoNoFree C++ Linux
NuSMV PlainSMV input language CTL, LTL, PSL YesNoNoNoFree C Unix, Windows, macOS
PAT Plain, real-time, probabilistic CSP#, timed CSP, probabilistic CSP LTL, assertions YesYesYesYesFree C# Windows, others with Mono
PRISM Probabilistic PEPA, PRISM language, Plain MCCSL, PLTL, PCTL NoYesNoNoFree C++, Java Windows, Linux, macOS
Rumur PlainMurφInvariants, assertionsYesNoNoNoFree C macOS, Linux
SPIN Plain Promela LTL YesYesNoYesFUSC C, C++ Windows, Unix related
TAPAAL Real-timeTimed-Arc Petri Nets, age invariants, inhibitor arcs, transport arcsTCTL subsetNoYesYesYesFree C++, Java macOS, Windows, Linux
TAPAs PlainCCSP CTL, μ-calculus SB, WB, BB, STE, WTE, me, ME, OEYesYesYesYesFree Java Windows, macOS, Unix related
UPPAAL Real-time Timed automata, C subsetTCTL subsetYesYesYesYesFUSC C++, Java macOS, Windows, Linux
ROMEO Real-timeTime Petri Nets, stopwatch parametric Petri netsTCTL subsetYesYesYesNoFree C++, Tcl/Tk macOS, Windows, Linux
TLA+ Model Checker (TLC)Plain TLA+, PlusCal TLA YesYesYesNoFree Java macOS, Windows, Linux

Modelling languages

Properties language

Comparison of model checking tools

Scientific publications

There exists a few papers that systematically compare various model checkers on a common case study. The comparison usually discusses the modelling tradeoffs faced when using the input languages of each model checker, as well as the comparison of performances of the tools when verifying correctness properties. One can mention:

International software competitions

See also

Related Research Articles

In computer science, formal methods are mathematically rigorous techniques for the specification, development, analysis, and verification of software and hardware systems. The use of formal methods for software and hardware design is motivated by the expectation that, as in other engineering disciplines, performing appropriate mathematical analysis can contribute to the reliability and robustness of a design.

In computer science, communicating sequential processes (CSP) is a formal language for describing patterns of interaction in concurrent systems. It is a member of the family of mathematical theories of concurrency known as process algebras, or process calculi, based on message passing via channels. CSP was highly influential in the design of the occam programming language and also influenced the design of programming languages such as Limbo, RaftLib, Erlang, Go, Crystal, and Clojure's core.async.

In the context of hardware and software systems, formal verification is the act of proving or disproving the correctness of a system with respect to a certain formal specification or property, using formal methods of mathematics. Formal verification is a key incentive for formal specification of systems, and is at the core of formal methods. It represents an important dimension of analysis and verification in electronic design automation and is one approach to software verification. The use of formal verification enables the highest Evaluation Assurance Level (EAL7) in the framework of common criteria for computer security certification.

<span class="mw-page-title-main">Model checking</span> Computer science field

In computer science, model checking or property checking is a method for checking whether a finite-state model of a system meets a given specification. This is typically associated with hardware or software systems, where the specification contains liveness requirements as well as safety requirements.

In theoretical computer science a bisimulation is a binary relation between state transition systems, associating systems that behave in the same way in that one system simulates the other and vice versa.

The calculus of communicating systems (CCS) is a process calculus introduced by Robin Milner around 1980 and the title of a book describing the calculus. Its actions model indivisible communications between exactly two participants. The formal language includes primitives for describing parallel composition, choice between actions and scope restriction. CCS is useful for evaluating the qualitative correctness of properties of a system such as deadlock or livelock.

In logic, linear temporal logic or linear-time temporal logic (LTL) is a modal temporal logic with modalities referring to time. In LTL, one can encode formulae about the future of paths, e.g., a condition will eventually be true, a condition will be true until another fact becomes true, etc. It is a fragment of the more complex CTL*, which additionally allows branching time and quantifiers. LTL is sometimes called propositional temporal logic, abbreviated PTL. In terms of expressive power, linear temporal logic (LTL) is a fragment of first-order logic.

Computation tree logic (CTL) is a branching-time logic, meaning that its model of time is a tree-like structure in which the future is not determined; there are different paths in the future, any one of which might be an actual path that is realized. It is used in formal verification of software or hardware artifacts, typically by software applications known as model checkers, which determine if a given artifact possesses safety or liveness properties. For example, CTL can specify that when some initial condition is satisfied, then all possible executions of a program avoid some undesirable condition. In this example, the safety property could be verified by a model checker that explores all possible transitions out of program states satisfying the initial condition and ensures that all such executions satisfy the property. Computation tree logic belongs to a class of temporal logics that includes linear temporal logic (LTL). Although there are properties expressible only in CTL and properties expressible only in LTL, all properties expressible in either logic can also be expressed in CTL*.

In computer science, the process calculi are a diverse family of related approaches for formally modelling concurrent systems. Process calculi provide a tool for the high-level description of interactions, communications, and synchronizations between a collection of independent agents or processes. They also provide algebraic laws that allow process descriptions to be manipulated and analyzed, and permit formal reasoning about equivalences between processes. Leading examples of process calculi include CSP, CCS, ACP, and LOTOS. More recent additions to the family include the π-calculus, the ambient calculus, PEPA, the fusion calculus and the join-calculus.

<span class="mw-page-title-main">Concurrency (computer science)</span> Ability to execute a task in a non-serial manner

In computer science, concurrency is the ability of different parts or units of a program, algorithm, or problem to be executed out-of-order or in partial order, without affecting the outcome. This allows for parallel execution of the concurrent units, which can significantly improve overall speed of the execution in multi-processor and multi-core systems. In more technical terms, concurrency refers to the decomposability of a program, algorithm, or problem into order-independent or partially-ordered components or units of computation.

Calculus in its most general sense is any method or system of calculation.

In computer science Language of Temporal Ordering Specification (LOTOS) is a formal specification language based on temporal ordering of events. LOTOS is used for communications protocol specification in International Organization for Standardization (ISO) Open Systems Interconnection model (OSI) standards.

In theoretical computer science, the modal μ-calculus is an extension of propositional modal logic by adding the least fixed point operator μ and the greatest fixed point operator ν, thus a fixed-point logic.

<span class="mw-page-title-main">E. Allen Emerson</span> American computer scientist

Ernest Allen Emerson II, better known as E. Allen Emerson, is an American computer scientist and winner of the 2007 Turing Award. He is Professor and Regents Chair Emeritus at the University of Texas at Austin, United States.

<span class="mw-page-title-main">Reo Coordination Language</span>

Reo is a domain-specific language for programming and analyzing coordination protocols that compose individual processes into full systems, broadly construed. Examples of classes of systems that can be composed with Reo include component-based systems, service-oriented systems, multithreading systems, biological systems, and cryptographic protocols. Reo has a graphical syntax in which every Reo program, called a connector or circuit, is a labeled directed hypergraph. Such a graph represents the data-flow among the processes in the system. Reo has formal semantics, which stand at the basis of its various formal verification techniques and compilation tools.

PRISM is a probabilistic model checker, a formal verification software tool for the modelling and analysis of systems that exhibit probabilistic behaviour. One source of such systems is the use of randomization, for example in communication protocols like Bluetooth and FireWire, or in security protocols such as Crowds and Onion routing. Stochastic behaviour also arises in many other computer systems, for example due to equipment failures, unbreliable sensors and actuators, or unpredictable communication delays. PRISM has been used to analyse a diverse range of applications, from robot planning to computer network performance analysis to biochemical reaction networks.

<span class="mw-page-title-main">Construction and Analysis of Distributed Processes</span>

CADP is a toolbox for the design of communication protocols and distributed systems. CADP is developed by the CONVECS team at INRIA Rhone-Alpes and connected to various complementary tools. CADP is maintained, regularly improved, and used in many industrial projects.

TAPAs is a tool for specifying and analyzing concurrent systems. Its aim is to support teaching of process algebras. Systems are described as process algebra terms that are then mapped to labeled transition systems (LTSs). Properties can be verified by checking equivalences between concrete and abstract system descriptions or by model checking temporal formulas over the obtained LTS. A key feature of TAPAs that makes it particularly suited for teaching is that it maintains a consistent graphical and textual representation of each system. After a change in the graphic notation, the textual representation is updated immediately; but after textual modifications, the update of the graphical representation has to be manually triggered.

<i>Principles of Model Checking</i> Computer science textbook

Principles of Model Checking is a textbook on model checking, an area of computer science that automates the problem of determining if a machine meets specification requirements. It was written by Christel Baier and Joost-Pieter Katoen, and published in 2008 by MIT Press.

<span class="mw-page-title-main">Kim Guldstrand Larsen</span>

Kim Guldstrand Larsen R is a Danish scientist and professor of computer science at Aalborg University, Denmark. His field of research includes modeling, validation and verification, performance analysis, and synthesing of real-time, embedded, and cyber-physical systems utilizing and contributing to concurrency theory and model checking. Within this domain, he has been instrumental in the invention and continuous development of one of the most widely used verification tools, and has received several awards and honors for his work.

References

  1. E.R. Olderog: Operational Petri net semantics for CCSP
  2. Rob van Glabbeek, Frits Vaandrager: Bundle Event Structures and CCSP
  3. Romijn, Judi (June 1999). Model Checking a HAVi Leader Election Protocol (Technical report). Amsterdam: CWI. SEN-R9915. Archived from the original on 2019-09-11. Retrieved 2018-06-14.
  4. Dong, Yifei; Du, Xiaoqun; Holzmann, Gerard; Smolka, Scott (2003). "Fighting Livelock in the GNU i-Protocol: A Case Study in Explicit-State Model Checking". Software Tool for Technology Transfer. 4 (4): 505–528.
  5. Bortnik, Elena M.; Trcka, Nikola; Wijs, Anton; Luttik, Bas; van de Mortel-Fronczak, J. M.; Baeten, Jos C. M.; Fokkink, Wan; Rooda, J. E. (2005). "Analyzing a chi model of a turntable system using Spin, CADP and Uppaal" (PDF). Journal of Logical and Algebraic Methods in Programming. 65 (2): 51–104. doi: 10.1016/j.jlap.2005.05.001 . Archived (PDF) from the original on 2021-01-27. Retrieved 2018-05-25.
  6. Mazzanti, Franco; Ferrari, Alessio (2018). "Ten Diverse Formal Models for a CBTC Automatic Train Supervision System". Proceedings of the 3rd Workshop on Models for Formal Analysis of Real Systems and 6th International Workshop on Verification and Program Transformation (MARS/VPT’18), Thessaloniki, Greece. Electronic Proceedings in Theoretical Computer Science. Vol. 268. pp. 104–149. arXiv: 1803.10324v1 . doi:10.4204/EPTCS.268.4.
Common benchmarks