1. Model Checking as a Service: Towards Pragmatic Hidden
Formal Methods
Benedek Horváth12, Bence Graics3, Ákos Hajdu3, Zoltán Micskei3, Vince
Molnár3, István Ráth1, Luigi Andolfato4, Ivan Gomes5, and Robert Karban5
1 IncQuery Labs cPlc., Budapest, Hungary
2 Johannes Kepler University Linz, Linz, Austria
3 Budapest University of Technology and Economics, Budapest, Hungary
4 European Southern Observatory, München, Germany
5 Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA, USA
Contact: Benedek.Horvath@incquerylabs.com

2. Motivation
• Model-Based Systems Engineering
• Commercial tools for design, simulation
• Cloud-based, open collaborative modeling environments
• IncQuery Server [10]: scalable query evaluation over model repositories
2

3. Correctness of behavioral models
• Simulation, testing may not find every error
• Formal verification: systematically checks the model
• Challenges:
C1. High resource demand of formal verification
C2. Parallel verification tasks of multiple users
C3. Semantic gap between engineering and formal domains
3

4. Objectives
• Cloud: elastically scalable computation resources
O1. Dynamically allocate more memory and CPU
O2. Dynamically start more instances
O3. Semantic integrity
a) semantic-preserving transformations,
b) restricted but meaningful subset of engineering language
4

5. Motivating Example and Scope
5
Battery
control
Data transfer

6. Property to check
6
Should never transmit when the battery is below 40%

7. Reachability property
• State predicate of a faulty behavior
• Find a trace where the predicate is true
7

8. Gamma Statechart Composition Framework [17]
Hidden Formal Methods: V&V
Formal Compositional
Semantics
Gamma Statechart &
Composition Language
8

9. Model Checking as a Service
O1-O2. Cloud deployment: containerized components
O3. Initial subset of modeling elements, PSSM [21]
O3. Intermediate language: model checker integration
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
9

10. MCaaS: Prototype Implementation
• MCaaS add-on for IncQuery Server [10]
• Modeling and static checks:
• Allowed subset of modeling elements
• Well-formedness constraints in Viatra Query Language [3]
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
10

11. MCaaS: Prototype Implementation
• Transformation to the intermediate language:
• Gamma Statechart Language [17] + Gamma Property Language
• Traceability model
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
11

12. MCaaS: Prototype Implementation
• Translation to model checker:
• Gamma statechart → timed automata in UPPAAL
• Reachability property → liveness query (EF) in CTL
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
12

13. MCaaS: Prototype Implementation
• Back-annotation:
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
13
6 7
Model checker trace Gamma trace SysML sequence diagram

14. Conclusion and Future Work
• Cloud-based workflow to verify SysML [20] models
• Initial subset of elements for verification
• Semantic integrity of the workflow → example trace is simulateable
• Future work:
• New model checker, e.g., Theta [23]
• Adaptive scalabilityand combination of model checkers [22]
• Extend the supported elements, e.g., activity, do-behavior
• Support SysML v2 14

15. Acknowledgements
• This research was carried out at the Jet Propulsion Laboratory (JPL), California
Institute of Technology, under a contract with the National Aeronautics and
Space Administration (NASA).
• This work partially received funding from the European Union’s Horizon 2020
research and innovation programme under the Marie Skłodowska-Curie grant
agreement No 813884.
• The authors are grateful for the valuable advice of Péter Bokor, Ákos Horváth,
and the anonymous reviewers.
15

16. References
[3] Gábor Bergmann, Zoltán Ujhelyi, István Ráth, and Dániel Varró. 2011. A Graph Query
Language for EMF Models. In Proc. of the 4th Intl. Conference on Theory and Practice of
Model Transformations (LNCS, Vol. 6707). Springer, 167–182.
[7] Corrina Gibson, Robert Karban, Luigi Andolfato, and John Day. 2014. Formal Validationof
Fault Management Design Solutions. Softw. Eng. Notes 39, 1 (2014), 1-5.
[8] Corrina Gibson, Robert Karban, Luigi Andolfato, and John C. Day. 2014. Abstractions for
Executable and Checkable Fault Management Models. In Proc. of the Conference on
Systems Engineering Research. Elsevier, 146–154.
[10] Ábel Hegedüs, Gábor Bergmann, Csaba Debreceni, Ákos Horváth, Péter Lunk, Ákos
Menyhért, István Papp, Dániel Varró, Tomas Vileiniskis, and István Ráth. 2018. Incquery
Server for Teamwork Cloud: Scalable Query Evaluation over CollaborativeModel
Repositories. In Proc. of the 21st International Conference on Model Driven Engineering
Languages and Systems. ACM, 27–31.
[16] Alvaro Miyazawa, Pedro Ribeiro, Wei Li, Ana Cavalcanti, Jon Timmis, and Jim Woodcock.
2019. RoboChart: modelling and verification of the functional behaviour of robotic
applications. Softw. and Sys. Model. 18, 5 (2019), 3097–3149. 16

17. References
[17] Vince Molnár, Bence Graics, András Vörös, István Majzik, and Dániel Varró.
2018. The Gamma statechart composition framework: Design, verification and code
generation for component-based reactive systems. In Proc. of the 40th International
Conference on Software Engineering. ACM, 113–116.
[20] OMG. 2019. OMG System Modeling Language (SysML). formal/19-11-01.
[21] OMG. 2019. Precise Semantics of UML State Machines (PSSM). formal/19-05-
01.
[22] Amir Molzam Sharifloo and Andreas Metzger. 2013. MCaaS: Model Checking in
the Cloud for Assurances of Adaptive Systems. In Software Engineering for Self-
Adaptive Systems III (LNCS, Vol. 9640). Springer, 137–153.
[23] Tamás Tóth, Ákos Hajdu, András Vörös, Zoltán Micskei, and István Majzik. 2017.
Theta: a Framework for Abstraction Refinement-Based Model Checking. In Proc. of
the 17th Conference on Formal Methods in Computer-Aided Design. 176–179.
17

18. Related Work
• Gibson et al. Formal Validation of Fault Management Design Solutions [7-
8]
• Verification of collaborating SysML state machines, including do-behavior
• Model checker: Java Pathfinder
• Checkable property: assertion in Java code
• No back-annotation
• Miyazawa et al. RoboChart modelling and verification of the functional
behaviour of robotic applications [16]
• Domain-Specific Modeling Language for robotic applications
• Minimalist core of UML state machine notation, supporting collaborationand timing
• Checkable property: textual DSL with verification-specific keywords
• Model checker: CSP (Communicating Sequential Processes) problem checked by FDR
• Sharifloo and Metzger MCaaS: Model Checking in the Cloud for
Assurances of Adaptive Systems [22]
• Cloud resource allocationpredication for model checkers based on model
complexity, run-time measures from past executions
• Can be adopted in future work
18

19. MCaaS: Prototype Implementation
• Transformation to the intermediate language:
• Gamma Statechart Language [17] + Gamma Property Language
• Traceability model
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
19
EF (state Spacecraft.Operation.Transmitting && var Spacecraft.battery < 40)

20. MCaaS: Prototype Implementation
• Translation to model checker:
• Gamma statechart → timed automata in UPPAAL
• Reachability property → liveness query (EF) in CTL
7 Back-annotation
4 Transformation
SysML
tool
1 Modeling (user)
Jupyter
notebook
2 V&V actions (user)
IncQuery Server
MCaaS
add-on
3 Static checksModel
repository
MC runtime 2
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
Theta
model checker
MC runtime 1
5
Formal model + query
translation
6
Result + trace
back-annotation
Gamma
intermediate
models
UPPAAL
model checker
20EF P_OperationOfMainOfSpacecraft.Transmitting && batteryOfSpacecraft < 40