Building Your Own Software Model Checker Using the Bogor Extensible Model Checking Framework

Towards Support for Software Model Checking: Improving the Efficiency of Formal Specifications

Advances in Software Engineering ◽

10.1155/2011/869182 ◽

2011 ◽

Vol 2011 ◽

pp. 1-13 ◽

Cited By ~ 2

Author(s):

Salamah Salamah ◽

Ann Q. Gates ◽

Steve Roach ◽

Matthew Engskow

Keyword(s):

Model Checking ◽

Spin Model ◽

Software Systems ◽

Formal Specifications ◽

Model Checker ◽

Software Model Checking ◽

Software Model ◽

Property Specification ◽

Büchi Automaton ◽

Spin Model Checker

The Property Specification (Prospec) tool uses patterns and scopes defined by Dwyer et al., to generate formal specifications in Linear Temporal Logic (LTL) and other languages. The work presented in this paper provides improved LTL specifications for patterns and scopes over those originally provided by Prospec. This improvement comes in the efficiency of the LTL formulas as measured in terms of the number of states in the Büchi automaton generated for the formula. Minimizing the size of the Büchi automata for an LTL specification provides a significant improvement for model checking software systems using such tools as the highly acclaimed Spin model checker.

Download Full-text

Program Verification via Craig Interpolation for Presburger Arithmetic with Arrays

10.29007/zfkw ◽

2018 ◽

Author(s):

Angelo Brillout ◽

Daniel Kroening ◽

Philipp Rümmer ◽

Thomas Wahl

Keyword(s):

Model Checking ◽

Program Verification ◽

Model Checker ◽

Craig Interpolation ◽

Presburger Arithmetic ◽

C Programs ◽

Full Theory ◽

Software Model ◽

Interpolation Procedure ◽

Versatile Tool

Craig interpolation has become a versatile tool in formal verification, in particular for generating intermediate assertions in safety analysis and model checking. In this paper, we present a novel interpolation procedure for the theory of arrays, extending an interpolating calculus for the full theory of quantifier-free Presburger arithmetic, which will be presented at IJCAR this year. We investigate the use of this procedure in a software model checker for C programs. A distinguishing feature of the model checker is its ability to faithfully model machine arithmetic with an encoding into Presburger arithmetic with uninterpreted predicates. The interpolation procedure allows the synthesis of quantified invariants about arrays. This paper presents work in progress; we include initial experiments to demonstrate the potential of our method.

Download Full-text

ATL Strategic Reasoning Meets Correlated Equilibrium

Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence ◽

10.24963/ijcai.2017/153 ◽

2017 ◽

Author(s):

Xiaowei Huang ◽

Ji Ruan

Keyword(s):

Model Checking ◽

Correlated Equilibrium ◽

Model Checker ◽

Strategic Reasoning ◽

Rational Agents ◽

Software Model ◽

Utilitarian Value ◽

Total Rewards ◽

Joint Strategy ◽

Car Accident

This paper is motivated by analysing a Google self-driving car accident, i.e., the car hit a bus, with the framework and the tools of strategic reasoning by model checking. First of all, we find that existing ATL model checking may find a solution to the accident with {\it irrational} joint strategy of the bus and the car. This leads to a restriction of treating both the bus and the car as rational agents, by which their joint strategy is an equilibrium of certain solution concepts. Second, we find that a randomly-selected joint strategy from the set of equilibria may result in the collision of the two agents, i.e., the accident. Based on these, we suggest taking Correlated Equilibrium (CE) as agents' joint stratgey and optimising over the utilitarian value which is the expected sum of the agents' total rewards. The language ATL is extended with two new modalities to express the existence of an CE and a unique CE, respectively. We implement the extension into a software model checker and use the tool to analyse the examples in the paper. We also study the complexity of the model checking problems.

Download Full-text

Efficient Bounded Model Checking of Heap-Manipulating Programs using Tight Field Bounds

Fundamental Approaches to Software Engineering - Lecture Notes in Computer Science ◽

10.1007/978-3-030-71500-7_11 ◽

2021 ◽

pp. 218-239

Author(s):

Pablo Ponzio ◽

Ariel Godio ◽

Nicolás Rosner ◽

Marcelo Arroyo ◽

Nazareno Aguirre ◽

...

Keyword(s):

Model Checking ◽

Data Structures ◽

Efficient Algorithm ◽

Bounded Model Checking ◽

Model Checker ◽

Data Types ◽

Dynamic Data Structures ◽

Dynamic Data ◽

Software Model ◽

Improve Model

AbstractSoftware model checkers are able to exhaustively explore different bounded program executions arising from various sources of non-determinism. These tools provide statements to produce non-deterministic values for certain variables, thus forcing the corresponding model checker to consider all possible values for these during verification. While these statements offer an effective way of verifying programs handling basic data types and simple structured types, they are inappropriate as a mechanism for nondeterministic generation of pointers, favoring the use of insertion routines to produce dynamic data structures when verifying, via model checking, programs handling such data types.We present a technique to improve model checking of programs handling heap-allocated data types, by taming the explosion of candidate structures that can be built when non-deterministically initializing heap object fields. The technique exploits precomputed relational bounds, that disregard values deemed invalid by the structure’s type invariant, thus reducing the state space to be explored by the model checker. Precomputing the relational bounds is a challenging costly task too, for which we also present an efficient algorithm, based on incremental SAT solving.We implement our approach on top of the bounded model checker, and show that, for a number of data structures implementations, we can handle significantly larger input structures and detect faults that is unable to detect.

Download Full-text

Gazer-Theta: LLVM-based Verifier Portfolio with BMC/CEGAR (Competition Contribution)

Tools and Algorithms for the Construction and Analysis of Systems - Lecture Notes in Computer Science ◽

10.1007/978-3-030-72013-1_27 ◽

2021 ◽

pp. 433-437

Author(s):

Zsófia Ádám ◽

Gyula Sallai ◽

Ákos Hajdu

Keyword(s):

Model Checking ◽

Predicate Abstraction ◽

Model Checker ◽

Software Model Checking ◽

Abstraction Refinement ◽

Value Analysis ◽

C Programs ◽

Software Model

AbstractGazer-Theta is a software model checking toolchain including various analyses for state reachability. The frontend, namely Gazer, supports C programs through an LLVM-based transformation and optimization pipeline. Gazer includes an integrated bounded model checker (BMC) and can also employ the Theta backend, a generic verification framework based on abstraction-refinement (CEGAR). On SV-COMP 2021, a portfolio of BMC, explicit-value analysis, and predicate abstraction is applied sequentially in this order.

Download Full-text

Verification and Strategy Synthesis for Coalition Announcement Logic

Journal of Logic Language and Information ◽

10.1007/s10849-021-09339-6 ◽

2021 ◽

Author(s):

Natasha Alechina ◽

Hans van Ditmarsch ◽

Rustam Galimullin ◽

Tuo Wang

Keyword(s):

Model Checking ◽

Proof Of Concept ◽

Model Checker ◽

Complete Model ◽

Concept Model ◽

The Family ◽

Winning Strategies ◽

Epistemic Goals

AbstractCoalition announcement logic (CAL) is one of the family of the logics of quantified announcements. It allows us to reason about what a coalition of agents can achieve by making announcements in the setting where the anti-coalition may have an announcement of their own to preclude the former from reaching its epistemic goals. In this paper, we describe a PSPACE-complete model checking algorithm for CAL that produces winning strategies for coalitions. The algorithm is implemented in a proof-of-concept model checker.

Download Full-text