Linear Encodings of Bounded LTL Model Checking

Abstract

Abstract. We consider the problem of bounded model checking (BMC) for linear temporal logic (LTL). We present several efficient encodings that have size linear in the bound. Furthermore, we show how the encodings can be extended to LTL with past operators (PLTL). The generalised encoding is still of linear size, but cannot detect minimal length counterexamples. By using the virtual unrolling technique minimal length counterexamples can be captured, however, the size of the encoding is quadratic in the specification. We also extend virtual unrolling to Büchi automata, enabling them to accept minimal length counterexamples.Our BMC encodings can be made incremental in order to benefit from incremental SAT technology. With fairly small modifications the incremental encoding can be further enhanced with a termination check, allowing us to prove properties with BMC.An analysis of the liveness-to-safety transformation reveals many similarities to the BMC encodings in this paper. We conduct experiments to determine the advantage of employing dedicated BMC encodings for PLTL over combining more general but potentially less efficient approaches with BMC: the liveness-to-safety transformation with invariant checking and Büchi automata with fair cycle detection.Experiments clearly show that our new encodings improve performance of BMC considerably, particularly in the case of the incremental encoding, and that they are very competitive for finding bugs. Dedicated encodings seem to have an advantage over using more general methods with BMC. Using the liveness-to-safety translation with BDD-based invariant checking results in an efficient method to find shortest counterexamples that complements the BMC-based approach. For proving complex properties BDD-based methods still tend to perform better.

Checking EMTLK Properties of Timed Interpreted Systems Via Bounded Model Checking

“…Analogously as for TGPP we apply the BMC method for the HLTLK formulae H(¬ϕ 4 ) and H(¬ϕ 5 ), and for the models M ϕ 4 and M ϕ 5 respectively. Checking that the TTCP does not satisfy the properties ϕ 4 and ϕ 5 is done by feeding a SAT solver with the propositional formulae generated in the way explained in Sect.…”

Model Checking and the State Explosion Problem

“…The above method of bounding the counterexample length is of limited value due to the difficulty of solving the quantified Boolean formula (2). Another way of using BMC to prove properties (i.e., not merely for bug-finding) is k-induction [22].…”

“…More efficient translations are given in [15,16,2]; these translations have the benefit of having size linear in k (the unrolling depth) for the U operator, compared to size cubic in k (or quadratic in k, if certain optimizations [6] are used) for the translations in Definitions 10 and 11. We use the same formula M k as the original encoding (defined in Equation 3 on page 22) to constrain the path to be a valid prefix.…”

Towards a Notion of Unsatisfiable Cores for LTL

“…As there are only finitely many states, step 2 guarantees termination. For other methods to prove properties in BMC see, e.g., [7].…”