Regular Model Checking

Abstract

We present regular model checking, a framework for algorithmic verification of infinite-state systems with, e.g., queues, stacks, integers, or a parameterized linear topology. States are represented by strings over a finite alphabet and the transition relation by a regular length-preserving relation on strings. Major problems in the verification of parameterized and infinite-state systems are to compute the set of states that are reachable from some set of initial states, and to compute the transitive closure of the transition relation. We present two complementary techniques for these problems. One is a direct automata-theoretic construction, and the other is based on widening. Both techniques are incomplete in general, but we give sufficient conditions under which they work. We also present a method for verifying ω-regular properties of parameterized systems, by computation of the transitive closure of a transition relation.

Symbolic String Verification: An Automata-Based Approach

“…Finally, the use of automata as a symbolic representation for verification has been investigated in other contexts (e.g., [5]). In this paper we focus on verification of string manipulation operations in PHP programs.…”

Regular Hedge Model Checking

“…Regular Model Checking has been proposed as a general and uniform framework to analyse infinite-state systems [21,28,12,7]. In this framework, configurations are represented by words or trees, sets of configurations by regular finite word/tree automata, and the transitions of the system by a regular relation described by a word/tree transducer.…”

“…A central problem in regular model checking is to compute the transitive closure of a regular relation given by a finite-state transducer. Such a representation allows to compute the set of reachable configurations of a system (thus enabling verification of safety properties) as well as to detect loops between configurations if the transformations are structure preserving (thus enabling verification of liveness properties) [12,6]. However, computing the transitive closure of a transducer is not possible in general since the transition relation of any Turing machine can be represented by a regular word transducer.…”

“…(1) First in the case of regular word model checking where configurations are encoded as words. These works have been successfully applied to reason about linear parametrized systems (i.e., parametrized systems where the processes are arranged in a linear topology) [12,23,19,13,25,3,4], as well as systems that operate on linear unbounded data structures such as lists, integers, reals, and even hybrid automata [5,11,6], and programs with pointers [9]. (2) Then in the case of regular tree model checking where configurations are represented by trees of arbitrary sizes (but fixed arities).…”

“…There are several works on efficient computation of transitive closures for word transducers [12,19,25,5,11,6,4] and tree transducers [17,2,1]. However, these works only consider trees where the arities are fixed, whereas our framework allows to consider ranked as well as unranked trees.…”