Depth-First Heuristic Search for Software Model Checking

Abstract

Software modelcheckers, such as Java PathFinder (JPF), can be used to detect failures in software. However, the state space explosion is a serious problem because the size of the state space of complex software is very large. Various heuristic search algorithms, which explore the state space in the order of the given priority function, have been proposed to solve this problem. However, they are not compatible with linear temporal logic (LTL) verification algorithms. This paper proposes an algorithm called depth-first heuristic search (DFHS), which performs depth-first search but backtracks at states that unlikely lead to an error. The likelihood is evaluated using cut-off functions defined by the user. We enhanced the search engine of JPF to implement DFHS and LTL search. Experimental results show that DFHS performs better than current algorithms for both safety and LTL properties of programs in many cases.