Model Checking

ion. Although symbolic model checking and partial-order reduction techniques attempt to battle the so-called state explosion problem, the size of systems that can be analysed using model checking remains relatively limited: even astronomical numbers such as 10100 reachable states are generated by systems with a few hundred bits, which is a far cry from real hardware or software systems. Model checking must therefore be performed on rather abstract models. Ideally, model checking is applied concurrently with system design, and particularly in its early stages when systems are modelled at a high level of abstraction, because the payoff of finding bugs at that stage is highest whereas the costs are low. For example, Lilius and Porres [83] describe a tool for model checking UML state machine diagrams [13], and model checking for similar high-level system descriptions is described in [5, 49]. When the model is too big to be analysed or even infinite, a smaller, more abstract model has to be found such that the validity of the property over the abstract model implies its validity over the concrete model. The relationship between the abstract and the concrete models can be formalised by an abstraction function or relation, and either needs to be verified using interactive theorem proving or ensured by construction of the abstract model using techniques of abstract interpretation [32]. Relevant papers on this subject include [25, 85, 34, 84, 93]. A particular convenient way of presenting abstraction functions is in the form of predicate abstractions that introduce boolean variables for atomic propositions. In conjunction with the presentation of abstract systems as verification diagrams, this form of abstraction can be presented in a form that is directly understood by the system designer and can be used to (interactively) analyze systems of arbitrary complexity [36, 86, 104, 70].model using techniques of abstract interpretation [32]. Relevant papers on this subject include [25, 85, 34, 84, 93]. A particular convenient way of presenting abstraction functions is in the form of predicate abstractions that introduce boolean variables for atomic propositions. In conjunction with the presentation of abstract systems as verification diagrams, this form of abstraction can be presented in a form that is directly understood by the system designer and can be used to (interactively) analyze systems of arbitrary complexity [36, 86, 104, 70]. Symmetry reductions. Replication of identical components induces symmetry in the models of reactive systems, and it is clearly wasteful to search all permutations of symmetric transitions. More formally, a boolean function f (b1; : : : ; bn ) is said to be invariant under a permutation of its arguments if f (b1; : : : ; bn) = f ( (b1); : : : ; (bn )), and invariant under a group G of permutations if it is invariant under all permutations in the group. If the transition relation of a system is invariant under a permutation group one can check the quotient of the transition system modulo the associated equivalence relation and obtain a system that can be much smaller [107, 22, 66, 67]. Parameterized systems where, for example, the number of processes is a parameter of the system description, can be regarded as a special instance of symmetry. It may be possible to perform standard model checking in order to analyse models for fixed parameter values and then establish correctness for arbitrary parameter values by induction. For example, Browne et al. [14] suggested to model check a two-process system, and to establish a bisimulation relation between two-process and n-process systems, ensuring that formulas expressed in a suitable logic cannot distinguish between these systems. This approach has been extended in [78, 116] to use a finite-state process I that acts as an invariant, requiring to show that the composition of I with another process of the parameterized system does not add any new computations. Because I is finitestate, this can be accomplished using (a variation of) standard model checking. Related techniques are described in [43, 52]. Infinite-state systems. The extension of model checking techniques to infinite-state systems has been a particularly hot research topic during recent years [20, 46, 47, 94]. See Esparza’s contribution to this volume for more details. Compositional verification. Instead of verifying a system composed from several processes as a whole, it may be preferable to establish properties of its subcomponents and combine these in order to derive properties of the entire system [37]. One problem that arises with this approach is that subcomponents are designed to make assumptions about the behavior of their environment, and that every subcomponent is part of every other’s environment. One should therefore expect cyclic assumptions between different processes. Pnueli et al. [100, 8] require a well-founded dependency between assumptions, avoiding the problem of circular reasoning. However, depending on the computational model and the type of the property to be checked, cyclic assumptions can be tolerated because it is possible to perform induction on the number of computation steps [1, 21, 90]. Model checking algorithms for modular verification include [68, 56]. Real-time systems. Whereas temporal logics such as PTL and CTL only formalize the relative ordering of states and events, some systems require assertions about quantitative aspects of time, and adequate formal models such as timed automata [2] or timed transition systems [59] and logics [4] have been proposed. Algorithms for the reachability and model checking problems include [3, 61, 60]. In general, the complexity for the verification of real-time and hybrid systems is much higher than for untimed systems, and tools such as KRONOS [118], UPPAAL [80] or HYTECH [58] are restricted to relatively small systems.