Leo Freitas - Profile on Academia.edu (original) (raw)
Papers by Leo Freitas
Digital Twins for Organ Preservation Devices
Protocol Correctness Analysis EMV 2nd Generation Specifications - Formal specification of EMV 2nd Generation Kernel
arXiv (Cornell University), Mar 30, 2023
For recursive functions general principles of induction needs to be applied. Instead of verifying... more For recursive functions general principles of induction needs to be applied. Instead of verifying them directly using the Vienna Development Method Specification Language (VDM-SL), we suggest a translation to Isabelle/HOL. In this paper, the challenges of such a translation for recursive functions are presented. This is an extension of an existing translation and a VDM mathematical toolbox in Isabelle/HOL enabling support for recursive functions.
arXiv (Cornell University), Mar 28, 2023
CSV is a widely used format for data representing systems control, information exchange and proce... more CSV is a widely used format for data representing systems control, information exchange and processing, logging, etc. Nevertheless, the format is riddled with tricky corner cases and inconsistencies, which can make input data unreliable, thus, rendering modelling or simulation experiments unusable or unsafe. We address this problem by providing a SAFE-CSV VDM-library that is: Simple, Accurate, Fast, and Effective. It extends an ecosystem of other VDM mathematical toolkit extensions, which also includes a translation and proof environment for VDM in Isabelle.
Formal Aspects of Computing, Feb 1, 2009
We describe: (1) the internal structures of FDR, the refinement model checker for Hoare's Communi... more We describe: (1) the internal structures of FDR, the refinement model checker for Hoare's Communicating Sequential Processes (CSP); and (2) an application-programming interface (API) that allows users to interact more closely with FDR and to have finer-grain control over its behaviour and data structures. This API makes it possible to create optimised CSP code to perform refinement checks that are more space or time efficient, enabling the analysis of more complex and data-intensive specifications. The API can be used either by those constructing CSP models or by tools that automatically generate CSP code. We present examples of using our tool, including handling advanced FDR features such as transparent functions, which compress state spaces before checking. We also show how to transform FDR's graph format into a graph notation such as JGraph, enabling visualisation of labelled transition systems of CSP specifications.
Parts of the CICS transaction processing system were modelled formally in the 1980s in a collabor... more Parts of the CICS transaction processing system were modelled formally in the 1980s in a collaborative project between IBM UK Hursley Park and Oxford University Computing Laboratory. Z was used to capture a precise description of the behaviour of various modules as a means of communicating requirements and design intentions. These descriptions were not mechanically verified in any way: proof tools for Z were not considered mature, and no business case was made for effort in this area. We report a recent experiment in using the Z/Eves theorem prover to construct a machine-checked analysis of one of the CICS modules: the File Control API. This work was carried out as part of the international Grand Challenge in Verified Software, and our results are recorded in the Verified Software Repository. We give a brief description of the other modules, and propose them as challenge problems for the verification community.
Abstract. We describe our experiences in mechanising the specification, refinement, and proof of ... more Abstract. We describe our experiences in mechanising the specification, refinement, and proof of the Mondex Electronic Purse using the Z/Eves theorem prover. We took a conservative approach and mechanised the original L ATEX sources without changing their technical content, except to correct errors. We found problems in the original specification and some missing invariants in the refinements. Based on these experiences, we present novel and detailed guidance on how to drive Z/Eves successfully. The work contributes to the Repository for the Verified Software Grand Challenge.
Cornell University - arXiv, Mar 28, 2020
To counteract the lack of competition and innovation in the financial services industry, the EU h... more To counteract the lack of competition and innovation in the financial services industry, the EU has issued the Second Payment Services Directive (PSD2) encouraging account servicing payment service providers to share data. The UK, similarly to other European countries, has promoted a standard API for data sharing: the Open Banking Standard. We present a formal security analysis of its APIs, focusing on the correctness of the Account and Transaction API protocol. The work relies on a previously proposed methodology, which provided a practical approach to protocol modelling and verification.
Formal Aspects of Component Software, 2017
The paper describes the practical use of a model checking technique to contribute to the risk ana... more The paper describes the practical use of a model checking technique to contribute to the risk analysis of a new paediatric dialysis machine. The formal analysis focuses on one component of the system, namely the table-driven software controller which drives the dialysis cycle and deals with error management. The analysis provided evidence of the verification of risk control measures relating to the software component. The paper describes the productive dialogue between the developers of the device, who had no experience or knowledge of formal methods, and an analyst who had experience of using the formal analysis tools. There were two aspects to this dialogue. The first concerned the translation of safety requirements so that they preserved the meaning of the requirement. The second involved understanding the relationship between the software component under analysis and the broader concern of the system as a whole. The paper focuses on the process, highlighting how the team recognised the advantages over a more traditional testing approach.
This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kern... more This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kernel. We discuss tools and techniques currently employed and outline future directions of research.
Number of words = 45327, as counted by detex <report.tex> | wc-w. This report consists of 9... more Number of words = 45327, as counted by detex <report.tex> | wc-w. This report consists of 98 pages in total. This includes the body of the report (without blank pages) and Appendix A, but not Appendices B, C, D, E and F. 1Updated transactional operation proofs, 21st September 2009. A separation kernel is an architecture for secure applications, which benefits from inherent security of distributed systems. Due to its small size and usage in high-integrity environments, it makes a good target for formal modelling and verification. This project presents results from mechanisation and modelling of separation kernel components: a process table, a process queue and a scheduler. The results have been developed as a part of the pilot project within the international Grand Challenge in Verified Software. This thesis covers full development life-cycle from project initiation through design and evaluation to successful completion. Important findings about kernel properties, formal modell...
EPiC Series in Computing
This paper sets out the on-going research in a project which isinvestigating how to learn from on... more This paper sets out the on-going research in a project which isinvestigating how to learn from one interactive proof so that other similar proofscan be completed automatically.
This position paper outlines the background and current approaches taken within AI4FM, a 4-year r... more This position paper outlines the background and current approaches taken within AI4FM, a 4-year research project aimed at combining AI methodologies to aid proof discovery of certain families of interest. Namely, those repeated proofs often appearing in the application of verification to industrial applications. 1
Dagstuhl Reports, 2013
This report documents the program and the outcomes of Dagstuhl Seminar 13372 "Integration of... more This report documents the program and the outcomes of Dagstuhl Seminar 13372 "Integration of Tools for Rigorous Software Construction and Analysis". The 32 participants came from 10 countries: Australia, Austria, Brazil, Canada, Denmark, France, Germany, Great Britain, Italy, Norway. The aim of the seminar was to bring together researchers and tool developers from different state- and machine-based formal methods communities in order to share expertise and promote the joint use of modelling tool technologies. Indeed, each of these communities -- from Abstract State Machines, to B, TLA, VDM, Z -- has valuable tools and technologies which would be beneficial also for the other formal approaches. Understanding and clarifying their commonalities and differences is a key factor to achieve a possible integration or integrated use of these related approaches for accomplishing, in a rigorous way, the various modelling and analysis tasks to construct reliable high quality software ...
Rigorous State-Based Methods, 2020
To counteract the lack of competition and innovation in the financial services industry, the EU h... more To counteract the lack of competition and innovation in the financial services industry, the EU has issued the Second Payment Services Directive (PSD2) encouraging account servicing payment service providers to share data. The UK, similarly to other European countries, has promoted a standard API for data sharing: the Open Banking Standard. We present an overview of the results of a formal security analysis of the Account and Transaction API protocol.
This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kern... more This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kernel. We discuss tools and techniques currently em- ployed and outline future directions of research. FreeRTOS (Bar11) is an operating system (OS) kernel for embedded real-time applications. It has recently been proposed as case study in the context of the grand challenge on software verific- ation (JOW06). For this purpose, FreeRTOS is particularly interesting because it is open-source, reasonably small in size, yet relatively complex with respect to the functionality it provides. It features memory management, I/O-device control, tasks management and scheduling, commu- nication and synchronisation directives, and real-time event handling. FreeRTOS has been ported to a range of computing platforms and compilers. The kernel comprises of roughly 3,000 lines of C code with a small fraction of assembly code. The core of FreeRTOS is its scheduler. It implements different policies for schedulin...
Unifying Theories of Undefinedness
Abstract We propose a unifying theory of undefined expressions in logics used for formally specif... more Abstract We propose a unifying theory of undefined expressions in logics used for formally specifying software systems. We show how to use classical logic to prove facts in a monotonic partial logic with guards, and we exhibit guards for several different semantical systems. We show how classical logic can be used to prove semi-classical facts. The mechanical theorem prover Z/Eves is used to prove facts about semi-classical Z specifications, although it uses classical logic; it does this with guards from McCarthy logic ...
The EMVCoorganisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperabili... more The EMVCoorganisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperability of secure electronic payments. Despite recent advances, it has proved difficult for academia to provide an acceptable solution to construction of secure applications within industry’s constraints. In this paper, we describe a methodology we have applied to EMV1. It involves domain specific languages and verification tools targeting different analysis of interest. We are currently collaborating with EMVCo on their upcoming EMV R ©2nd Generation (EMV2) specifications.
VDM at Large: Modelling the EMV® 2^nd 2 nd Generation Kernel
The EMV® (EMV® is a registered trademark or trademark of EMVCo, LLC in the US and other countries... more The EMV® (EMV® is a registered trademark or trademark of EMVCo, LLC in the US and other countries.) organisation specify payment protocols to facilitate worldwide interoperability of secure electronic payments. This paper is about the application and scalability of formal methods to a current and complex industry application. We describe the use of VDM to model EMV® \(2^{nd}\) Generation Kernel (A preliminary version of this paper was presented at the \(16^{th}\) Overture Workshop, Oxford July 2018, where papers became a Newcastle Technical Report.). VDM is useful for both formal specification, as well as simulation, test coverage, and proof obligation generation for functional correctness.
JACK: A process algebra implementation in Java [Masters Thesis]
Digital Twins for Organ Preservation Devices
Protocol Correctness Analysis EMV 2nd Generation Specifications - Formal specification of EMV 2nd Generation Kernel
arXiv (Cornell University), Mar 30, 2023
For recursive functions general principles of induction needs to be applied. Instead of verifying... more For recursive functions general principles of induction needs to be applied. Instead of verifying them directly using the Vienna Development Method Specification Language (VDM-SL), we suggest a translation to Isabelle/HOL. In this paper, the challenges of such a translation for recursive functions are presented. This is an extension of an existing translation and a VDM mathematical toolbox in Isabelle/HOL enabling support for recursive functions.
arXiv (Cornell University), Mar 28, 2023
CSV is a widely used format for data representing systems control, information exchange and proce... more CSV is a widely used format for data representing systems control, information exchange and processing, logging, etc. Nevertheless, the format is riddled with tricky corner cases and inconsistencies, which can make input data unreliable, thus, rendering modelling or simulation experiments unusable or unsafe. We address this problem by providing a SAFE-CSV VDM-library that is: Simple, Accurate, Fast, and Effective. It extends an ecosystem of other VDM mathematical toolkit extensions, which also includes a translation and proof environment for VDM in Isabelle.
Formal Aspects of Computing, Feb 1, 2009
We describe: (1) the internal structures of FDR, the refinement model checker for Hoare's Communi... more We describe: (1) the internal structures of FDR, the refinement model checker for Hoare's Communicating Sequential Processes (CSP); and (2) an application-programming interface (API) that allows users to interact more closely with FDR and to have finer-grain control over its behaviour and data structures. This API makes it possible to create optimised CSP code to perform refinement checks that are more space or time efficient, enabling the analysis of more complex and data-intensive specifications. The API can be used either by those constructing CSP models or by tools that automatically generate CSP code. We present examples of using our tool, including handling advanced FDR features such as transparent functions, which compress state spaces before checking. We also show how to transform FDR's graph format into a graph notation such as JGraph, enabling visualisation of labelled transition systems of CSP specifications.
Parts of the CICS transaction processing system were modelled formally in the 1980s in a collabor... more Parts of the CICS transaction processing system were modelled formally in the 1980s in a collaborative project between IBM UK Hursley Park and Oxford University Computing Laboratory. Z was used to capture a precise description of the behaviour of various modules as a means of communicating requirements and design intentions. These descriptions were not mechanically verified in any way: proof tools for Z were not considered mature, and no business case was made for effort in this area. We report a recent experiment in using the Z/Eves theorem prover to construct a machine-checked analysis of one of the CICS modules: the File Control API. This work was carried out as part of the international Grand Challenge in Verified Software, and our results are recorded in the Verified Software Repository. We give a brief description of the other modules, and propose them as challenge problems for the verification community.
Abstract. We describe our experiences in mechanising the specification, refinement, and proof of ... more Abstract. We describe our experiences in mechanising the specification, refinement, and proof of the Mondex Electronic Purse using the Z/Eves theorem prover. We took a conservative approach and mechanised the original L ATEX sources without changing their technical content, except to correct errors. We found problems in the original specification and some missing invariants in the refinements. Based on these experiences, we present novel and detailed guidance on how to drive Z/Eves successfully. The work contributes to the Repository for the Verified Software Grand Challenge.
Cornell University - arXiv, Mar 28, 2020
To counteract the lack of competition and innovation in the financial services industry, the EU h... more To counteract the lack of competition and innovation in the financial services industry, the EU has issued the Second Payment Services Directive (PSD2) encouraging account servicing payment service providers to share data. The UK, similarly to other European countries, has promoted a standard API for data sharing: the Open Banking Standard. We present a formal security analysis of its APIs, focusing on the correctness of the Account and Transaction API protocol. The work relies on a previously proposed methodology, which provided a practical approach to protocol modelling and verification.
Formal Aspects of Component Software, 2017
The paper describes the practical use of a model checking technique to contribute to the risk ana... more The paper describes the practical use of a model checking technique to contribute to the risk analysis of a new paediatric dialysis machine. The formal analysis focuses on one component of the system, namely the table-driven software controller which drives the dialysis cycle and deals with error management. The analysis provided evidence of the verification of risk control measures relating to the software component. The paper describes the productive dialogue between the developers of the device, who had no experience or knowledge of formal methods, and an analyst who had experience of using the formal analysis tools. There were two aspects to this dialogue. The first concerned the translation of safety requirements so that they preserved the meaning of the requirement. The second involved understanding the relationship between the software component under analysis and the broader concern of the system as a whole. The paper focuses on the process, highlighting how the team recognised the advantages over a more traditional testing approach.
This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kern... more This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kernel. We discuss tools and techniques currently employed and outline future directions of research.
Number of words = 45327, as counted by detex <report.tex> | wc-w. This report consists of 9... more Number of words = 45327, as counted by detex <report.tex> | wc-w. This report consists of 98 pages in total. This includes the body of the report (without blank pages) and Appendix A, but not Appendices B, C, D, E and F. 1Updated transactional operation proofs, 21st September 2009. A separation kernel is an architecture for secure applications, which benefits from inherent security of distributed systems. Due to its small size and usage in high-integrity environments, it makes a good target for formal modelling and verification. This project presents results from mechanisation and modelling of separation kernel components: a process table, a process queue and a scheduler. The results have been developed as a part of the pilot project within the international Grand Challenge in Verified Software. This thesis covers full development life-cycle from project initiation through design and evaluation to successful completion. Important findings about kernel properties, formal modell...
EPiC Series in Computing
This paper sets out the on-going research in a project which isinvestigating how to learn from on... more This paper sets out the on-going research in a project which isinvestigating how to learn from one interactive proof so that other similar proofscan be completed automatically.
This position paper outlines the background and current approaches taken within AI4FM, a 4-year r... more This position paper outlines the background and current approaches taken within AI4FM, a 4-year research project aimed at combining AI methodologies to aid proof discovery of certain families of interest. Namely, those repeated proofs often appearing in the application of verification to industrial applications. 1
Dagstuhl Reports, 2013
This report documents the program and the outcomes of Dagstuhl Seminar 13372 "Integration of... more This report documents the program and the outcomes of Dagstuhl Seminar 13372 "Integration of Tools for Rigorous Software Construction and Analysis". The 32 participants came from 10 countries: Australia, Austria, Brazil, Canada, Denmark, France, Germany, Great Britain, Italy, Norway. The aim of the seminar was to bring together researchers and tool developers from different state- and machine-based formal methods communities in order to share expertise and promote the joint use of modelling tool technologies. Indeed, each of these communities -- from Abstract State Machines, to B, TLA, VDM, Z -- has valuable tools and technologies which would be beneficial also for the other formal approaches. Understanding and clarifying their commonalities and differences is a key factor to achieve a possible integration or integrated use of these related approaches for accomplishing, in a rigorous way, the various modelling and analysis tasks to construct reliable high quality software ...
Rigorous State-Based Methods, 2020
To counteract the lack of competition and innovation in the financial services industry, the EU h... more To counteract the lack of competition and innovation in the financial services industry, the EU has issued the Second Payment Services Directive (PSD2) encouraging account servicing payment service providers to share data. The UK, similarly to other European countries, has promoted a standard API for data sharing: the Open Banking Standard. We present an overview of the results of a formal security analysis of the Account and Transaction API protocol.
This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kern... more This paper reports on ongoing work towards verifying the FreeRTOS real-time operating system kernel. We discuss tools and techniques currently em- ployed and outline future directions of research. FreeRTOS (Bar11) is an operating system (OS) kernel for embedded real-time applications. It has recently been proposed as case study in the context of the grand challenge on software verific- ation (JOW06). For this purpose, FreeRTOS is particularly interesting because it is open-source, reasonably small in size, yet relatively complex with respect to the functionality it provides. It features memory management, I/O-device control, tasks management and scheduling, commu- nication and synchronisation directives, and real-time event handling. FreeRTOS has been ported to a range of computing platforms and compilers. The kernel comprises of roughly 3,000 lines of C code with a small fraction of assembly code. The core of FreeRTOS is its scheduler. It implements different policies for schedulin...
Unifying Theories of Undefinedness
Abstract We propose a unifying theory of undefined expressions in logics used for formally specif... more Abstract We propose a unifying theory of undefined expressions in logics used for formally specifying software systems. We show how to use classical logic to prove facts in a monotonic partial logic with guards, and we exhibit guards for several different semantical systems. We show how classical logic can be used to prove semi-classical facts. The mechanical theorem prover Z/Eves is used to prove facts about semi-classical Z specifications, although it uses classical logic; it does this with guards from McCarthy logic ...
The EMVCoorganisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperabili... more The EMVCoorganisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperability of secure electronic payments. Despite recent advances, it has proved difficult for academia to provide an acceptable solution to construction of secure applications within industry’s constraints. In this paper, we describe a methodology we have applied to EMV1. It involves domain specific languages and verification tools targeting different analysis of interest. We are currently collaborating with EMVCo on their upcoming EMV R ©2nd Generation (EMV2) specifications.
VDM at Large: Modelling the EMV® 2^nd 2 nd Generation Kernel
The EMV® (EMV® is a registered trademark or trademark of EMVCo, LLC in the US and other countries... more The EMV® (EMV® is a registered trademark or trademark of EMVCo, LLC in the US and other countries.) organisation specify payment protocols to facilitate worldwide interoperability of secure electronic payments. This paper is about the application and scalability of formal methods to a current and complex industry application. We describe the use of VDM to model EMV® \(2^{nd}\) Generation Kernel (A preliminary version of this paper was presented at the \(16^{th}\) Overture Workshop, Oxford July 2018, where papers became a Newcastle Technical Report.). VDM is useful for both formal specification, as well as simulation, test coverage, and proof obligation generation for functional correctness.
JACK: A process algebra implementation in Java [Masters Thesis]