Formal Modelling of Concurrent Software Vulnerabilities in Nigerian Critical Infrastructure Control Systems

Critical infrastructure control systems in Nigeria, including power grid management software, water treatment control systems, and fuel pipeline monitoring platforms, are increasingly software-dependent yet remain under-scrutinised from a formal software security perspective. This dissertation provides formal modelling of concurrent software vulnerabilities in Nigerian critical infrastructure control systems, contributing original formal methods theory and applied security engineering to a high-stakes and underexplored domain. A formal methods research approach is employed, combining theoretical development with empirical application. Phase one analyses critical infrastructure software security incidents in Nigeria's South South (NNPC pipelines), South East (Enugu Electricity Distribution Company systems), and North Central (FCT Water Board SCADA) zones through incident report analysis and 18 interviews with control systems engineers. Phase two develops a formal vulnerability model using Communicating Sequential Processes (CSP) and the Failures-Divergences Refinement (FDR) model checker, extending existing concurrent systems modelling to capture race condition, deadlock, and time-of-check-to-time-of-use (TOCTOU) vulnerability classes in industrial control software. Phase three applies the formal model to three anonymised SCADA software modules provided by consenting infrastructure operators, with FDR verification identifying two previously unknown race conditions and one potential deadlock pathway in production control code. The dissertation introduces the Nigerian Critical Infrastructure Vulnerability Ontology (NCIVO) as an original classification artefact and contributes formal verification case studies from African industrial control contexts. Keywords: formal modelling, concurrent vulnerabilities, critical infrastructure, Nigeria, CSP