Past‐Free[ze] reachability analysis: reaching further with DAG‐directed exhaustive state‐space analysis

Abstract

International audienceModel-checking enables the automated formal verification of software systems through the explicit enumeration of all the reachable states. While this technique has been successfully applied to industrial systems, it suffers from the state-space explosion problem because of the exponential growth in the number of states with respect to the number of interacting components. In this paper, we present a new reachability analysis algorithm, named Past-Free[ze], that reduces the state-space explosion problem by freeing parts of the state-space from memory. This algorithm relies on the explicit isolation of the acyclic parts of the system before analysis. The parallel composition of these parts drives the reachability analysis, the core of all model-checkers. During the execution, the past states of the system are freed from memory making room for more future states. To enable counter-example construction, the past states can be stored on external storage. To show the effectiveness of the approach, the algorithm was implemented in the OBP Observation Engine and was evaluated both on a synthetic benchmark and on realistic case studies from automotive and aerospace domains. The benchmark, composed of 50 test cases, shows that in average, 75% of the state-space can be dropped from memory thus enabling the exploration of up to 14 times more states than traditional approaches. Moreover, in some cases, the reachability analysis time can be reduced by up to 25%. In realistic settings, the use of Past-Free[ze] enabled the exploration of a state-space 4.5 times larger on the automotive case study, where almost 50% of the states are freed from memory. Moreover, this approach offers the possibility of analyzing an arbitrary number of interactions between the environment and the system-under-verification; for instance, in the case of the aerospace example, 1000 pilot/system interactions could be analyzed unraveling an 80 GB state-space using only 10 GB of memor

Partially Bounded Context-Aware Verification

“…The model-checking procedure then analyses this verification context in conjunction with the system (system in the figure). Since the DAG guide is acyclic, both the recursive state-space decomposition and the PastFree[ze] algorithms used by the Context-aware Verification approach, can be applied [26].…”

“…Retraction and extension sequences can be initiated, interrupted and inverted at any time. This system raises a number of interesting issues during verification, some of which have already been subject to studies via model-checking [4,15,24,26,29].…”

“…A more detailed description of this case study can be found in [6]. The Fiacre implementation of the physical and software parts matches the one proposed and studied via the CaV approach [24,26]. Environment Capabilities and System Closure.…”

“…3.5) arbitrarily to 30 interactions allows the analysis to successfully terminate for 16 of these. To prove completeness, an option is to perform an analysis of the induced clusters of states, as discussed in [26]. In this case, a cyclic behaviour is detected after 16 to 20 interactions depending on the considered failure.…”

“…Each context and the open system are the inputs to a verification task. From there, if one or several tasks do not scale, CaV offers different automated context-driven techniques for further problem decomposition [13] and for efficient memory management during reachability [26].…”