Efficient encoding for bounded model checking of timed automata

Abstract

Bounded model checking (BMC) of timed automata has been successfully applied to verify concurrent real‐time systems, but its scalability is still limited by the large bound required to find counter‐example, the efficiency of the decision procedure which is employed to solve the BMC formula, as well as the large search space for solving satisfiability of the resulting formula. In this paper, we present a systemic encoding scheme to attack all the above three problems. To attack the first problem, we first encode a discrete action followed by a time delay as a composed transition to cut the BMC steps which are used to characterize the time elapse. Then we take advantage of the local time semantics to allow more independent actions to be executed in parallel, which further reduces the required number of BMC steps and hence also the formula size. To employ a more efficient decision procedure, we also translate the linear arithmetic encoding of timed automata to a difference logic formula which can be solved more efficient by a satisfiability modulo theory solver. To address the last problem, we employ explicit‐state partial order reduction idea of only executing some of the enabled transitions to add additional constrains to eliminate some redundant multi‐step executions, thus restricting the search space. Experimental results show that our encoding performs significantly better than previous encodings. © 2017 Institute of Electrical Engineers of Japan. Published by John Wiley & Sons, Inc.

SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses

“…This should be based on explicit-state model checking that maintains all state transitions. To minimize the search space, researchers should con-sider context-bounded model checking, which uses abstraction techniques and partial-order reduction algorithms [53], [86].…”

Symbolic Representation of Time Petri Nets for Efficient Bounded Model Checking

“…Thus, tools based on this approach such as TINA [4] and Romeo [5] are suffered from a complex and space consuming problem. Representing the state space symbolically such as [6]- [8] is considered promising. These studies applied SAT-based bounded model checking [9] to the verification of Timed Automata.…”

“…a) E-mail: t-yokoga@cse.oka-pu.ac.jp DOI: 10.1587/transinf.2019EDL8086 constraints in difference logic (DL) [12] in a similar manner to [8], and an efficient satisfiability solving algorithm for formulas described in DL [13] could be applicable.…”