A strength of model :hecking is its ability to automate the detection of subtle system errors and produce traces that exhibit those (rrors. Given the highcomputational cost of model checking most researchers advocate the use of aggressive property-preserving abstractions. Unfortunately, the more aggressively a system is abstracted the more infeasible i)ehavior it will have. Thus, while abstraction enables efficient model checking it also threatens the usefulness of model checking as a defect detection tool, since it may be difficnlt to determine whether a counter-example is feas ble and hence worth developer time to analyze. We have explored several stJategies for addressing this problem by extending an explicit-state model checker, Java PathFinder (JPF), t,) search for and analyze counter-examples in tile presen,:e of abstractions. We demonstrate that these techniques; effectively preserve the defect detection ability of model checking in tile presence of aggressive abstraction by aIJplying them to check properties of several abstracted mu] _i-threaded Java programs. These new capabilities are n( ,t specific to JPF and can be easily adapted to other model checking frame-This paper is an expanded version ,}f [29].

We extend recent approaches for calculating the probability of program behaviors, to allow model counting for complex data structures with numeric fields. We use symbolic execution with lazy initialization to compute the input structures leading to the occurrence of a target event, while keeping a symbolic representation of the constraints on the numeric data. Off-the-shelf model counting tools are used to count the solutions for numerical constraints and field bounds encoding data structure invariants are used to reduce the search space. The technique is implemented in the Symbolic PathFinder tool and evaluated on several complex data structures. Results show that the technique is much faster than an enumeration-based method that uses the Korat tool and also highlight the benefits of using the field bounds to speed up the analysis.