Model Checking

Abstract—The current proliferation of mobile devices has resulted in a large diversity of hardware specifications, each designed for different services and applications (e.g. cell phones, smart phones, PDAs). At the same time, e-mail message delivery has become a vital part of everyday communications. This article provides a cost-aware study of an RSA-based e-mail protocol executed upon the widely used Apple iPhone1,2 with ARM1176JZF-S, operating in an High Speed Downlink Packet Access (HSDPA) mobile environment. The proposed study employs formal analysis techniques, such as probabilistic model checking, and proceeds to a quantitative analysis of the e-mail protocol, taking into account computational parameters derived by the devices ’ specifications. The value of this study is to form a computer-aided framework which balances the tradeoff between gaining in security, using high-length RSA keys, and conserving CPU resources, due to hardware limitations of mobile devices. To the best...

Obtaining accurate system models for verification is a hard and time consuming process, which is seen by industry as a hindrance to adopt otherwise powerful modeldriven development techniques and tools. In this paper we pursue an alternative approach where an accurate high-level model can be automatically constructed from observations of a given black-box embedded system. We adapt algorithms for learning finite probabilistic automata from observed system behaviors. We prove that in the limit of large sample sizes the learned model will be an accurate representation of the data-generating system. In particular, in the large sample limit, the learned model and the original system will define the same probabilities for linear temporal logic (LTL) properties. Thus, we can perform PLTL model-checking on the learned model to infer properties of the system. We perform experiments learning models from system observations at different levels of abstraction. The experimental results show the learned models provide very good approximations for relevant properties of the original system.

This work describes an algorithm of automata construction for LTL safety properties, suitable for bounded model checking. Existing automata construction methods are tailored to BDD-based symbolic model checking. The novelty of our approach is that we construct deterministic automata, unlike the standard approach, which constructs nondeterministic automata. We show that the proposed method has significant advantages for bounded model checking over traditional methods.

Abstract. In this article, the development of software for SI2000 digital switch node is described, focusing on software architecture for a MGCP protocol stack. A decoder and an encoder for the MGCP protocol have been developed with the PCCTS tool version 1.33, which supports generation of top-down ÄÄ � parsers in C and C++ programming language. Software planning phase is a very important and time-consuming task, but it is also important to investigate how to implement requested functionality and guarantee proper scalability. To meet the scalability requirements, we had to extend the PCCTS tool with the support for parallel execution of more than one decoder and encoder. Telecommunication management applications also have to support decoding and encoding of MGCP messages. To enable such support for these kinds of applications, we developed an OCX control for the MGCP protocol.

This paper deals with systems verification techniques, using Bounded Model Checking (BMC). We present a new approach that combines BMC with symmetry reduction techniques. Our goal is to reduce the number of transition sequences, which can be handled by a SAT solver, used in the resolution of verification problems. In this paper, we generate a reduced model by exploiting the symmetry of the original model,which contains only transition sequences that represent the equivalence classes of the symmetric transition sequences. We consider the construction of a new Boolean formula that manipulates only representative transition sequences. In our technique, we present a method that combines the symmetry reduction technique with BMC for the reduction of the space and time of Model Checking.

QDDC is a logic for specifying quantitative timing aspects of synchronous programs. Properties such as worst-case response time and latency (when known) can be specified elegantly in this logic and model checked. However, computing these values require finding by trial and error the least/greatest value of a parameter k making a formula D(k) valid for a program. In this paper, we discuss how an automata theoretic decision procedure for QDDC together with symbolic search for shortest/longest path can be used to compute the lengths of extremal (least/greatest length) models of a formula D. These techniques have been implemented into the DCVALID verifier for QDDC formulae. We illustrate the use of this technique by efficiently computing response and dead times of some synchronous bus arbiter circuits.

This paper presents novel language and analysis techniques that significantly speed up software model checking of data structure properties. Consider checking a red-black tree implementation. Traditional software model checkers systematically generate all red-black tree states (within some given bounds) and check every red-black tree operation (such as insert, delete, or lookup) on every red-black tree state. Our key idea is as follows. As our checker checks a red-black tree operation o on a red-black tree state s, it uses program analysis techniques to identify other red-black tree states s 1 , s 2 , ..., s k on which the operation o behaves similarly. Our analyses guarantee that if o executes correctly on s, then o will execute correctly on every s i . Our checker therefore does not need to check o on any s i once it checks o on s. It thus safely prunes those state transitions from its search space, while still achieving complete test coverage within the bounded domain. Our preliminary results show orders of magnitude improvement over previous approaches. We believe our techniques can make model checking significantly faster, and thus enable checking of much larger programs and complex program properties than currently possible.

Ensuring the correctness of a given software component has become a crucial aspect in Software Engineering and the Model Checking technique provides a fully automated way to achieve this goal. In particular, the usage of Model Checking in formal languages has been reinforced in the last decades given the fact that specifications provide an abstraction of the problem under study, supplying a model of the system of tractable size given the state explosion problem faced by the Model Checking technique. In this paper we focus on the main issues for adding Model Checking functionalities to the RAISE specification language and present the semantic foundations of our current approach for doing so. An outline of the main problems faced in the process and of the solutions to solve them are also presented.

This paper provides a review of Raymond Turner's book ​ Computational Artifacts. Towards a Philosophy of Computer Science​. Focus is made on the definition of program correctness as the twofold problem of evaluating whether ​ both the symbolic program ​ and the physical implementation satisfy a set of specifications. The review stresses how these are not two separate problems. First, it is highlighted how formal proofs of correctness need to rely on the analysis of physical computational processes. Secondly, it is underlined how software testing requires considering the formal relations holding between the specifications and the symbolic program. Such a mutual dependency between formal and empirical program verification methods is finally shown to ​ influence the debate on the epistemological status of computer science.

The Raise Specification Language (RSL) is a modeling language which supports various specification styles. To apply model checking to RSL concurrent descriptions, we translate RSL specifications into the input language CSPM of FDR. FDR is the model checker for the process algebra CSP. First, we define a syntactic and semantic translation from the concurrent applicative subset of RSL to CSPM, and show that this translation is a strong bisimulation which preserves properties such as traces and deadlock. Consequently, results obtained by refinement checks in FDR are sound for the original RSL descriptions. Second, RSL uses Linear Temporal Logic (LTL) to specify desired properties, but FDR does not support LTL. LTL formulas may be translated to CSP test processes in order to check them with FDR. We build a tool which automates the translation of RSL specifications into CSPM and translates LTL formulas to CSP processes, enabling the model checking of LTL formulas over RSL descriptions with FDR.

In recent years, there has been much advancement in the area of verification of infinite-state systems. A system can have an infinite state-space due to unbounded data structures such as counters, clocks, stacks, queues, etc. It may also be infinitestate due to parameterization, i.e., the possibility of having an arbitrary number of components in the system. For parameterized systems, we are interested in checking correctness of all the instances in one verification step. In this thesis, we consider systems which contain both sources of infiniteness, namely: (a) real-valued clocks and (b) parameterization. More precisely, we consider two models : (a) the timed Petri net (TPN) model which is an extension of the classical Petri net model; and (b) the timed network (TN) model in which an arbitrary number of timed automata run in parallel. We consider verification of safety properties for timed Petri nets using forward analysis. Since forward analysis is necessarily incomplete, we provide a semi-algorithm augmented with an acceleration technique in order to make it terminate more often on practical examples. Then we consider a number of problems which are generalisations of the corresponding ones for timed automata and Petri nets. For instance, we consider zenoness where we check the existence of an infinite computation with a finite duration. We also consider two variants of the boundedness problem: syntactic boundedness in which both live and dead tokens are considered; semantic boundedness where only live tokens are considered. We show that the former problem is decidable, while the latter is not. Finally, we show undecidability of LTL model checking both for dense and discrete timed Petri nets. Next we consider timed networks. We show undecidability of safety properties in case each component is equipped with two or more clocks. This result contrasts previous decidability result for the case where each component has a single clock. Also, we show that the problem is decidable when clocks range over the discrete time domain. This decidability result holds when the processes have any finite number of clocks. Furthermore, we outline the border between decidability and undecidability of safety for TNs by considering several syntactic and semantic variants.

In this paper we describe modeling for verification of business process with Spin model checker. Our primary goal is the development of Promela language description for e-invoice web service. Modeling for verification follows Church's synthesis problem: for input scenario "dataflow" model, output is Promela model. Sequence of model transformations translates the scenario into the Promela language code. At the end whole process is illustrated with e-invoice web service example.

This paper presents an algorithm for the fully dynamic biconnectivity problem whose running time i s exponentially faster than all previously known solutions. It is the first dynamic algorithm that answers biconnectivity queries in time O(log2n) in a n-node graph and can be updated after an edge insertion or deletion in polylogarithmic time. Our algorithm is a Las-Vegas style randomized algorithm with the update time amortized update time O(10g4 n). Only recently the best deterministic result for this problem was improved to 0(&log2 n).

Verification of Graphical User Interface (GUI) applications presents many challenges. GUI applications are open systems that are driven by user events. Verification of such applications by means of model checking therefore requires a user model in order to close the state space.

We introduce a logical verification methodology for checking behavioral properties of service-oriented computing systems. Service properties are described by means of SocL, a branching-time temporal logic that we have specifically designed for expressing in an effective way distinctive aspects of services, such as, acceptance of a request, provision of a response, correlation among service requests and responses, etc. Our approach allows service properties to be expressed in such a way that they can be independent of service domains and specifications. We show an instantiation of our general methodology that uses the formal language COWS to conveniently specify services and the expressly developed software tool CMC to assist the user in the task of verifying SocL formulas over service specifications. We demonstrate the feasibility and effectiveness of our methodology by means of the specification and analysis of a case study in the automotive domain.

We first advocate that the AUML (Agent Unified Modeling Language) notation, even in its new version, is not precise enough to adequately describe protocols. This problem was long identified by Harel and we propose to follow his solution: extend sequence diagrams with a ...

In this paper we describe our intended approach for the verification of software written in imperative programming languages. We base our approach on model checking of graph transition systems, where each state is a graph and the transitions are specified by graph transformation rules. We believe that graph transformation is a very suitable technique to model the execution semantics of languages with dynamic memory allocation. Furthermore, such representation allows us to investigate the use of graph abstractions, which can mitigate the combinatorial explosion inherent to model checking. In addition to presenting our planned approach, we reason about its feasibility, and, by providing a brief comparison to other existing methods, we highlight the benefits and drawbacks that are expected.

The i-protocol, an optimized sliding-window protocol for GNU uucp, first came to our attention in 1995 when we used the Concurrency Factory's local model checker to detect, locate, and correct a non-trivial livelock in version 1.04 of the protocol. Since then, we have conducted a systematic case study on the protocol using four verification tools, viz. Cospan, Murϕ, Spin, and XMC, each of which supports some form of explicitstate model checking. Our results show that although the i-protocol is inherently complex-the size of its state space grows exponentially in the window size and it deploys several sophisticated optimizations aimed at minimizing control-message and retransmission overhead-it is nonetheless amenable to a number of general-purpose abstraction techniques whose application can significantly reduce the size of the protocol's state space.

Memory logics are modal logics whose semantics is specified in terms of relational models enriched with additional data structure to represent memory. The logical language is then extended with a collection of operations to access and modify the data structure. In this paper we study their satisfiability and the model checking problems. We first give sound and complete tableaux calculi for the memory logic ML( k , r , e ) (the basic modal language extended with the operator r used to memorize a state, the operator e used to wipe out the memory, and the operator k used to check if the current point of evaluation is memorized) and some of its sublanguages. As the satisfiability problem of ML( k , r , e ) is undecidable, the tableau calculus we present is non terminating. Hence, we furthermore study a variation that ensures termination, at the expense of completeness, and we use model checking to ensure soundness. Secondly, we show that the model checking problem is PSpace-complete.

Problem statement: Model checking is an automated verification technique that can be used for verifying properties of a system. A number of model checking systems have been developed over the last few years. However, there is no guideline that is available for selecting the most suitable model checker to be used to model a particular system. Approach: In this study, we compare the use of four model checkers: SMV, SPIN, UPPAAL and PRISM for modeling a distributed control system. In particular, we are looking at the capabilities of the input languages of these model checkers for modeling this type of system. Limitations and differences of their input language are compared and analyses by using a set of questions. Results: The result of the study shows that although the input languages of these model checkers have a lot of similarities, they also have a significant number of differences. The result of the study also shows that one model checker may be more suitable than others for verifying this type of systems Conclusion: User need to choose the right model checker for the problem to be verified.

Formal verification is easy to use and provides significant increases in productivity and quality when used on RTL designs, which fit formal verification tool capacity. However, formal verification can be challenging when used on designs that exceed the capacity of the tools. This paper describes various techniques that were used to overcome these challenges during the verification of a real-life complex interrupt-controller using Cadence's Incisive Formal Verifier. These techniques include divideand-conquer to scale down the design, smart modeling of constraints, lightweight simulation, and use of advanced tool features. The collection of these techniques enabled the full verification of the interrupt-controller and saved many man-months of effort. The paper presents our results and concludes with pointers to areas of further improvement, currently under investigation.

Web-TLR is a software tool designed for model-checking Web applications which is based on rewriting logic. Web applications are expressed as rewrite theories which can be formally verified by using the Maude built-in LTLR model-checker. Web-TLR is equipped with a userfriendly, graphical Web interface that shields the user from unnecessary information. Whenever a property is refuted, an interactive slideshow is generated that allows the user to visually reproduce, step by step, the erroneous navigation trace that underlies the failing model checking computation. This provides deep insight into the system behavior, which helps to debug Web applications.

Systems are increasingly being constructed from off-the-shelf components acquired through a globally distributed, untrusted supply chain. The lack of trust in these components necessitates additional validation of the components before use. Additionally, hardware trojans are becoming a pressing concern. In this paper, we present a novel formalism and method to systematically derive the highlevel function of an unknown circuit component given its gate-level netlist. We define the high-level description of a circuit as an interconnection of instantiations of abstract library components characterized using logical specifications. The proposed approach is based on mining interesting behavioral patterns from the simulation traces of a gate-level netlist, and representing them as a pattern graph. A similar pattern graph is also generated for library components. Our method first computes input-output signal correspondences via subgraph isomorphism on the pattern graphs. The general function of the unknown circuit is then determined by finding the closest match in the component library, by model checking the unknown circuit against each logical specification. We demonstrate the effectiveness of our approach on publicly-available circuits.

Over the past decade, researchers have demonstrated that the technique of model checking can be extremely effective when applied to security or e-commerce protocols. Model checking is the process of determining whether a formal model of the analyzed system satisfies a correctness property specified as a temporal logic formula. Model checking result is either a claim that the property is true or else a counterexample showing that the property is false. E-Commerce protocols are techniques used to secure E-Commerce transactions. E-Commerce protocols have to own one or more from the security properties like safety, aliveness, authentication, and integrity. Unfortunately, the conventional model checking does not have the definition of these security properties, which are essential for the E-Commerce protocols. In addition, scalability is a desirable property of a protocol, which indicates its ability to handle growing amounts of work in a graceful manner , or to be readily enlarged. In this paper, we extend the conventional NuSMV model checker by adding new predicate layers to enhance its ability for verifying properties of E-Commerce protocols. The new predicates are scalable that are used to check gradient properties of different E-Commerce protocols. The new model combines features for model checking with predicate facilities. The new model can analysis and verify E-Commerce protocols easily and effectively. Therefore, we use to analyze some E-Commerce protocols to verify its security properties.

Social Virtual Reality Learning Environment (VRLE) is a novel edge computing platform for collaboration amongst distributed users. Given that VRLEs are used for critical applications (e.g., special education, public safety training), it is important to ensure security and privacy issues. In this paper, we present a novel framework to obtain quantitative assessments of threats and vulnerabilities for VRLEs. Based on the use cases from an actual social VRLE viz., vSocial, we first model the security and privacy using the attack trees. Subsequently, these attack trees are converted into stochastic timed automata representations that allow for rigorous statistical model checking. Such an analysis helps us adopt pertinent design principles such as hardening, diversity and principle of least privilege to enhance the resilience of social VRLEs.  Through experiments in a vSocial case study, we demonstrate the effectiveness of our attack tree modeling with a reduction of 26% in probability of loss of integrity (security) and 80% in privacy leakage (privacy) in before and after scenarios pertaining to the adoption of the design principles.

This paper presents the investigation and comparison of TLC model checking method (TLA Checker) properties. There are two different approaches to method usage which are considered. The first one consists of a transition system states attendance by breadth-first search (BFS), and the second one by depth-first search (DFS). The Kripke structure has been chosen as a transition system model. A case study has been conducted, where composite web service usage scenario has been considered. Obtained experimental results are aimed at increasing the effectiveness of TLA+ specifications automated verification.

Mobile computing defines a very dynamic and challenging scenario for which software engineering practices are still largely in their initial developments. Lime is a middleware designed to enable the rapid development of dependable applications in the mobile environment. The model underlying Lime allows for coordination of physical and logical mobile units by exploiting a reactive, transiently shared tuple space whose contents changes according to connectivity. In this demonstration, we report about initial experiences in developing applications for physical mobility using Lime.

This article has three objectives: (a) to describe the method of automatic ARIMA modeling (AAM), with and without intervention analysis, that has been used in the analysis; (b) to comment on the results; and (c) to comment on the M3 Competition in general. Starting with a computer program for fitting an ARIMA model and a methodology for building univariate ARIMA models, an expert system has been built, while trying to avoid the pitfalls of most existing software packages. A software package called Time Series Expert TSE-AX is used to build a univariate ARIMA model with or without an intervention analysis. The characteristics of TSE-AX are summarized and, more especially, its automatic ARIMA modeling method. The motivation to take part to the M3-Competition is also outlined. The methodology is described mainly in three technical appendices: (A) choice of differences and of a transformation, use of intervention analysis; (B) available specification procedures; (C) adequacy, model checking and new specification. The problems raised by outliers are discussed, in particular how close they are from the forecast origin. Several series that are difficult to deal with from that point of view are mentioned and one of them is shown. In the last section, we comment on contextual information, the idea of an e-M Competition, prediction intervals and the possible use of other forecasting methods within Time Series Expert.

Last time we reported on Romeo, analyses with this tool were mostly based on translations to other tools. This new version provides an integrated TCTL model-checker and has gained in expressivity with the addition of parameters. Although there exists other tools to compute the state-space of stopwatch models, Romeo is the first one that performs TCTL model-checking on stopwatch models. Moreover, it is the first tool that performs TCTL model-checking on timed parametric models. Indeed, Romeo now features an efficient model-checking of time Petri nets using the Uppaal DBM Library, the model-checking of stopwatch Petri nets and parametric stopwatch Petri nets using the Parma Polyhedra Library and a graphical editor and simulator of these models. Furthermore, its audience has increased leading to several industrial contracts. This paper reports on these recent developments of Romeo.

Formal methods are being applied to the development of software of various applications at Philips Healthcare. In particular, the Analytical Software Design (ASD) method is being used as a formal technology for developing defect-free control software of highly sophisticated X-ray machines. In this paper we analyze the effects of applying ASD in the development of various control software units. We compare the quality of these units with other units developed in traditional development methods. The results indicate that applying ASD as a formal technology for developing control software results in better quality code.

We report on a fruitful combination of applying academic experience with formal modelling and verification techniques to an industrial case study. The goal of the case study was to investigate a priori, i.e. before implementation, the effects of adding a lightweight and easy-to-use publish/subscribe (event) notification service to thinkteam r ○ —an asynchronous and dispersed groupware system which was developed by think3. Researchers from the Formal Methods and Tools (FM&T) group of ISTI–CNR—with a longstanding experience in research on the development and application of formal methods, notations, and software tools for the specification, design, and verification of complex computer systems— therefore teamed up with think3—a global provider of integrated product development solutions that provides mechanical design and Product Data Management (PDM) software catering the product management needs of design processes in the manufacturing industry. The technical details of this joint re...

relevant case study: the IEEE 802.3 (CSMA/CD) protocol. We also discuss two contrasting approaches to the implementation of probabilistic model checking, namely those based on numerical computation and those based on discrete-event simulation. Using results from the two tools PRISM and APMC, we summarise the advantages, disadvantages and trade-offs associated with these techniques.

A detailed generic model of the control design process is introduced and discussed. It is used for surveying different formal approaches in the context of PLC programming. The survey focuses on formal methods for verification and validation (V&V). The varying works in this area are categorized using three criteria: the general approach (A) to the task (model based, constraint based or without a model), the formalism (F) (Petri net, automata, etc.,) used to state the formal description, and the method (M) (model-checking, reachability analysis, etc.,) used to analyze the properties. Based on these three criteria (A-F-M) a three letter code for V&V approaches is introduced. Some works from the multitude of V&V research are presented and categorized using this new system

Formal hardware veri cation has recently attracted considerable interest. The need for \correct" designs in safety-critical applications, coupled with the major cost associated with products delivered late, are two of the main factors behind this. In addition, as the complexity o f t h e designs increase, an ever smaller percentage of the possible behaviors of the designs will be simulated. Hence, the con dence in the designs obtained by s i m ulation is rapidly diminishing. This paper provides an introduction to the topic by describing three of the main approaches to formal hardware veri cation: theorem-proving, model checking, and symbolic simulation. We outline the underlying theory behind each approach, we illustrate the approaches by applying them to simple examples, and we discuss their strengths and weaknesses. We conclude the paper by describing current on-going work on combining the approaches to achieve m ulti-level veri cation approaches.

What is the background of this tutorial? During the last decade, the integrative research area of systems biology has constantly been gaining more importance. Experimental and computational approaches are combined to investigate biological systems systematically. To understand biology on its system level, the structural and dynamic properties of regulatory networks in biological systems have to be represented by a model describing the involved species and their interactions. Petri net theory offers the possibility to construct and analyse such models and to represent their structural and dynamic properties by various techniques.

Who should read this tutorial? This tutorial addresses scientists who are looking for an easy and intuitive way to translate a biological system into a Petri net model at an arbitrarily chosen level of abstraction with the option of representing time and space-dependent processes. The tutorial is equally suitable for experimental and theory oriented bio-scientists. The examples given in the tutorial can be used by the interested reader to model her/his biological system.

What can I learn? The tutorial offers an introduction to the Petri net formalism, how to construct a model of a biological system, analyse its structure and dynamic behaviour regarding time-dependent behaviour, which is shown by several intuitive examples. At the end of the tutorial, you will be able to model a biological system on your own using Petri nets. You will also know how to analyse the structure of your model, how to interpret the results and how to perform simulation studies to investigate the time-dependent dynamic behaviour. Also, we also provide a chapter about model checking, which might be helpful to evaluate your model by verifying specified properties that you are interested in. We also show how to use the two Petri net tools Snoopy [19] and Charlie [8]. Based on these instruments you will be able to enhance your knowledge about the modelled biological system and to draw new conclusions from that.

Why should I use Petri nets? The graphical notation and construction of Petri nets allow you to easily and intuitively construct models of biological systems and to characterise the structure, behavioural properties related to the structure and time-dependent dynamic behaviour of a model by several related techniques. Petri nets can describe concurrent and parallel processes, as well as communication and synchronisation in bipartite systems regardless of the abstraction level in a comprehensive and mathematically correct model [12]. Time, as well as space aspects, can be modelled by a Petri net. Several specialised Petri net classes are available to describe dierent scenarios and to consider dierent simulative approaches. Therefore, the kinetics of the qualitative Petri net model can be considered as stochastic, continuous or as a mixture of both (hybrid) [12]. In silico experiments with Petri net models, permit to analyse a biological system systematically by applying structural as well as dynamic analysing techniques to investigate perturbations. From the obtained results new insights can be achieved by the biological system. Thereby, you can increase your understanding, reveal gaps in knowledge, and detect missing and essential components. Based on a valid model it is possible to predict the system behaviour. This might be helpful to investigate pathological states and their molecular basis aimed at identifying potential targets to develop therapeutical intervention strategies. The Petri net formalism offers quite a few advantages over other and more broadly used modelling frameworks. The different Petri net classes are interconvertible with each other without changing the qualitative structure. Due to the graphical visualisation of molecular networks by Petri nets, a bioscientist can intuitively understand the modelled mechanisms. The user does not have to deal with many dierent representations of a molecular network which do not obviously correspond to each other like a biological cartoon, the structure of the biological network, the mathematical equations (stochastic, continuous, etc.) and the implementation of the equations. Besides, the transformation of a molecular network represented by a Petri net into e.g. ODE equations is unique, but not vice versa [24]. Several reliable analysis tools have been developing to investigate qualitative and quantitative properties of Petri nets by structural analysis, simulation of the time-dependent dynamic behaviour and model checking.

What is the scheme of this tutorial? First of all, you will learn all the basics about the Petri net formalism motivated by small biological examples that are easy to understand. Next, you will see how to analyse the structure of a model and how to interpret the obtained results and their biological meaning. Afterwards, you will learn how to perform simulations with your model. We also offer a chapter about model checking, where you can learn how to verify specific properties of your model. Then, we introduce the two Petri net tools Snoopy [19] and Charlie [8]. All sections, where theoretical concepts are explained, are divided into an informal and a formal part. We start with an informal introduction, where we explain the basics and the biological relations. Subsequently and to be complete, we give the formal definitions and a small help on \how to read" the definitions at the end of the section.

What tools do I need? Several tools are available to model biological systems, simulate their time-dependent dynamic behaviour and analyse their structure. Here, we use the Petri net editor Snoopy [19] to model biological systems and simulate/animate their time-dependent dynamic behaviour. Charlie [8] is used to analyse the Petri net structure. Both software tools were developed at the chair of Data Structures and Software Dependability at the Brandenburg University of Technology Cottbus and are freely available for non-commercial use. You can download them at http://www-dssz.informatik. tu-cottbus.de/DSSZ/Software/Software [1].