Composite model-checking

Abstract

There has been a surge of progress in automated verification methods based on state exploration. In areas like hardware design, these technologies are rapidly augmenting key phases of testing and validation. To date, one of the most successful of these methods has been symbolic model-checking, in which large finite-state machines are encoded into compact data structures such as Binary Decision Diagrams (BDDs), and are then checked for safety and liveness properties. However, these techniques have not realized the same success on software systems. One limitation is their inability to deal with infinite-state programs, even those with a single unbounded integer. A second problem is that of finding efficient representations for various variable types. We recently proposed a model-checker for integer-based systems that uses arithmetic constraints as the underlying state representation. While this approach easily verified some subtle, infinite-state concurrency problems, it proved inefficient in its treatment of boolean and (unordered) enumerated types-which are not efficiently representable using arithmetic constraints. In this article we present a new technique that combines the strengths of both BDD and arithmetic constraint representations. Our composite model merges multiple type-specific symbolic representations in a single model-checker. A system's transitions and fixpoint computations are encoded using both BDD (for boolean and enumerated types) and arithmetic constraint (for integers) representations, where the choice depends on the variable types. Our composite model-checking strategy can be extended to other symbolic representations provided that they support operations such as intersection, union, complement, equivaPages 3-50. lence checking, and relational image computation. We also present conservative approximation techniques for composite representations to address the undecidability of model-checking on infinite-state systems. We demonstrate the effectiveness of our approach by analyzing two example software specifications which include a mixture of booleans, integers, and enumerated types. One of them is a requirements specification for the control software of a nuclear reactor's cooling system, and the other one is a transport protocol specification.

Domain Types: Abstract-Domain Selection Based on Variable Usage

“…The two symbolic domains BDDs and Presburger formulas have been previously used as representation for boolean and integer variables [19]. The approach was evaluated on two systems, a control software for a nuclear reactor's cooling system and a simplified transport-protocol specification.…”

Implementing a Multi-valued Symbolic Model Checker

“…Note that the Í fixpoint is somewhat unusual because it includes an additional conjunct, Í . This additional term preserves a "strong until" semantics for states that have no outgoing T transitions [4].…”

“…Symbolic model checkers for boolean logic [7,4] are naturally extended to the multivalued case. The model checker presented here is a symbolic version of the multi-valued model checker described in [6].…”

Action Language Verifier

“…It combines different symbolic representations using the composite model checking approach [3]. Our current implementation of the Composite Symbolic Library uses two basic symbolic representations: BDDs for boolean logic formulas and polyhedral representation for Presburger arithmetic formulas.…”

“…The idea of computing an approximation to the set of reachable states by a forward fixpoint computation, and then using this result to prune the iterates of the backward fixpoint computations has been used in [11]. However, our use of these techniques in the context of composite symbolic representation is unique and extends our previous work on composite symbolic representation [3].…”