Symbolic Model Checking Research Articles

Preface: Volume 23, Issue 2

This volume contains the proceedings of the First International Workshop on Symbolic Model Checking (SMC'99), held in Trento, Italy, on July 6, 1999, as part of the Second Federated Logic Conference (FLoC'99).Symbolic model checking is a formal technique for the verification of finite-state concurrent systems. Symbolic model checkers (e.g. SMV, VIS) have been used to verify industrial systems, ranging from hardware to communication protocols to safety critical plants and procedures. Symbolic model checking is the core technique for several industrial verification tools, and is applied in technology transfer projects. The aim of the SMC'99 workshop is to bring together active developers and users of symbolic model checkers, compare state of the art model checking techniques (e.g. compositional reasoning, abstraction, partitioning), discuss experimental results and experience reports, and promising directions for future research.Nine contributions (out of twenty-two submissions) were selected for presentation by the program committee. The workshop program is completed by two keynote invited lectures, given by Ken McMillan (Cadence Labs, USA) on Compositional Reasoning and Abstraction, and Fabio Somenzi (University of Colorado, USA) on Symbolic State ExplorationThanks are due to a number of people who helped to organize and plan the workshop. Among this group are the Program Committee members: Adnan Aziz(University of Texas at Austin, USA)Armin Biere(Verysys)Sergio Campos(Federal University of Minas Gerais, Brazil)Alessandro Cimatti(IRST, Italy)Edmund Clarke(Carnegie Mellon University, USA)Danny Geist(IBM Haifa, Israel)Fausto Giunchiglia(IRST, Italy)Orna Grumberg(Technion, Israel)Markus Kaltenbach(Siemens, Germany)Carl Pixley(Motorola, USA)The following people helped in the evaluation of the submissions: Yael Abarbanel-Vinov, Neta Aizenbud-Reshef, Shoham Ben-David, Doron Bustan, Jorge Cuellar, David Deharbe, Cindy Eisner, Ranan Fraer, Edelweis Garcez, Leonid Gluhovsky, Marcelo Glusman, Jae-Young Jang, Shmuel Katz, Sharon Keidar, Monika Maidl, Robi Malik, Anamaria Martins Moreira, Shiri Moran, Peter Päppinghaus, Marco Roveri, Peter Warkentin, Karen Yorav, Jun Yuan, Yunshan Zhu.We would like to thank IBM Haifa Research Laboratory for the financial support to SMC'99. Carola Dori, Morena Carli, Marco Roveri and Adolfo Villafiorita helped in several matters related to the local organization. Finally, we are grateful to Michael Mislove for his constat support during the preparation of this electronic volume.Alessandro Cimatti and Orna Grumberg, Guest Editors

Formal Verification based on Boolean Expression Diagrams

This dissertation examines the use of a new data structure called Boolean Expression Diagrams (BEDs) in the area of formal verification. The recently developed data structure allows fast and efficient manipulation of Boolean formulae. Many problems in formal verification can be cast as problems on Boolean formulae. We chose a number of such problems and show how to solve them using BEDs.Equivalence checking of combinational circuits is a formal verification problem which translates into tautology checking of Boolean formulae. Using BEDs we are able to preserve much of the structure of the circuits within the Boolean formulae. We show how to exploit the structural information in the verification process.Sometimes combinational circuits are specified in a hierarchical or modular way. We present a method for verifying equivalence between two such circuits. The method builds on cut propagation. Assuming that the two circuits are given identical inputs, we propagate this knowledge through the circuits from the inputs to the outputs. The result is the knowledge of how the outputs of the two circuits correspond, e.g., are the outputs of the two circuits pairwise equivalent? The circuits and the movements of cuts can be described using Boolean formulae.Symbolic model checking is a technique for verifying temporal specifications of finite state machines. It is well known how finite state machines and the evaluation of the temporal specifications can be expressed using Boolean formulae. We show how to do these manipulations using BEDs. We concentrate on examples which are hard for standard symbolic model checking methods.Determining whether a formula is satisfiability is a problem which occurs in verification of combinational circuits and in symbolic model checking. Often satisfiability checking is associated with detecting errors. We examine how satisfiability checking can be done using the BED data structure.Finally, we take a look at how it is possible to extend the BED data structure. Among other operations, we introduce an operator for computing minimal p-cuts in fault trees. A fault tree is a Boolean formula expressing whether a system fails based on the condition (“failure” or “working”) of each of the components. A minimal p-cut is a representation of the most likely reasons for system failure. This method can be used to calculate approximately the probability of system failure given the failure probabilities of each of the components.As part of this research, we have developed a BED package. The appendix describes the package from a user's point of view.

Approximate Symbolic Model Checking using Overlapping Projections

Symbolic Model Checking extends the scope of verification algorithms that can be handled automatically, by using symbolic representations rather than explicitly searching the entire state space of the model. However even the most sophisticated symbolic methods cannot be directly applied to many of today's large designs because of the state explosion problem. Approximate symbolic model checking is an attempt to trade off accuracy with the capacity to deal with bigger designs. This paper explores the idea of using overlapping projections as the underlying approximation scheme. The idea is evaluated by applying it to several modules from the I/O unit in the Stanford FLASH Multiprocessor, and some larger circuits in ISCAS89 benchmark suite.

Formal Verification based on Boolean Expression Diagrams

This dissertation examines the use of a new data structure called Boolean Expression Diagrams (BEDs) in the area of formal verification. The recently developed data structure allows fast and efficient manipulation of Boolean formulae. Many problems in formal verification can be cast as problems on Boolean formulae. We chose a number of such problems and show how to solve them using BEDs.Equivalence checking of combinational circuits is a formal verification problem which translates into tautology checking of Boolean formulae. Using BEDs we are able to preserve much of the structure of the circuits within the Boolean formulae. We show how to exploit the structural information in the verification process.Sometimes combinational circuits are specified in a hierarchical or modular way. We present a method for verifying equivalence between two such circuits. The method builds on cut propagation. Assuming that the two circuits are given identical inputs, we propagate this knowledge through the circuits from the inputs to the outputs. The result is the knowledge of how the outputs of the two circuits correspond, e.g., are the outputs of the two circuits pairwise equivalent? The circuits and the movements of cuts can be described using Boolean formulae.Symbolic model checking is a technique for verifying temporal specifications of finite state machines. It is well known how finite state machines and the evaluation of the temporal specifications can be expressed using Boolean formulae. We show how to do these manipulations using BEDs. We concentrate on examples which are hard for standard symbolic model checking methods.Determining whether a formula is satisfiability is a problem which occurs in verification of combinational circuits and in symbolic model checking. Often satisfiability checking is associated with detecting errors. We examine how satisfiability checking can be done using the BED data structure.Finally, we take a look at how it is possible to extend the BED data structure. Among other operations, we introduce an operator for computing minimal p-cuts in fault trees. A fault tree is a Boolean formula expressing whether a system fails based on the condition (“failure” or “working”) of each of the components. A minimal p-cut is a representation of the most likely reasons for system failure. This method can be used to calculate approximately the probability of system failure given the failure probabilities of each of the components.As part of this research, we have developed a BED package. The appendix describes the package from a user's point of view.

Combining Local and Global Model Checking

The verification process of reactive systems in local model checking [1,7] and in explicit state model checking is[13,15] on-the-fly. Therefore only those states of a system have to be traversed that are necessary to prove a property. In addition, if the property does not hold, than often only a small subset of the state space has to be traversed to produce a counterexample. Global model checking [6,23] and, in particular, symbolic model checking [4,22] can utilize compact representations of the state space, e.g. BDDs [3], to handle much larger designs than what is possible with local and explicit model checking. We present a new model checking algorithm for LTL that combines both approaches. In essence, it is a generalization of the tableau construction of [1] that enables the use of BDDs but still is on-the-fly.

Model Checking Semi-Continuous Time Models Using BDDs

The verification of timed systems is extremely important, but also extremely difficult. Several methods have been proposed to assist in this task, including extensions to symbolic model checking. One possible use of model checking to analyze timed systems is by modeling passage of time as the number of taken transitions and applying quantitative algorithms to determine the timing parameters of the system. The advantage of this method is its simplicity and efficiency. In this paper we extend this technique in two ways. First, we present new quantitative algorithms that are more efficient than their predecessors. The new algorithms determine the number of occurrences of events in all paths between a set of starting states and a set of final states. We then use these algorithms to introduce a new model of time, in which the passage of time is dissociated from the occurrence of events. With this new model it is possible to verify systems that were previously thought to require dense time models. We use the new method to verify two such examples previously analyzed by the HyTech tool: a steam boiler example and a fuel injection controller.

Regular Model Checking using Widening Techniques

In this paper, we consider symbolic model checking of safety properties of linear parametrized systems. Sets of configurations are represented by regular languages and actions by regular relations. Since the verification problem amounts to the computation of the reachability set, we focus on the computation of R∗(φ) for a regular relation R and a regular language φ. We present a technique called regular widening that allows, when it terminates, the computation of either the reachability set R∗(φ) of a system or the transitive closure R∗ of a regular relation. We show that our method can be uniformly applied to several parametrized systems. Furthermore, we show that it is powerful enough to simulate some existing methods that compute either R∗ or R∗(φ) for each R (resp. φ) belonging to a subclass of regular relations (resp. belonging to a subclass of regular languages).

Automatic verification of safety interlock systems for industrial processes

Abstract The safety interlock system (SIS) is one of the most important protective measurements in industrial processes that provide automatic actions to correct an abnormal plant event. This paper considers the use of formal techniques based on symbolic model checking and computation tree logic (CTL) in the specification to automatically verify the SIS for industrial processes. It addresses the problem of modelling industrial processes and presenting the SIS in CTL. It shows how symbolic model checking can be used efficiently in the verification of a SIS. A transferring system for a penicillin process is used as a case study.

Exploiting the real power of unit propagation lookahead

Abstract Abstract One of the best SAT solvers for random 3-SAT formulae, SATZ, is based on a heuristic called unit propagation lookahead (UPL). Unfortunately, it does not perform so well on specific structured instances, especially on the ones coming from an area where a huge interest for SAT has emerged in recent years: symbolic model checking (SMC). We claim that all the power of this heuristic is not used in SATZ, and that UPL can be extended to solve some real world structured problems, where the major competitors are using intelligent backtracking or specific deduction rules. We introduce a preprocessing technique that can be applied to simplify instances containing equivalent literals. This technique is based on UPL, so it can be easily added to any solver using this heuristic. We compare our approach to the new extension of SATZ for equivalency reasoning (EqSATZ) and another approach, the Stalmarck method, which is mainly used in SMC. The author would like to thank Yacine Boufkhad for his insights about C-SAT and 2-simplify, Mamoun Filali-Amine for pointing out the Stalmark method, Chu-Min Li for his discussions about EqSATZ and his implementation of the implied literal propagation in SATZ, Laurent Simon for his SAT-Ex web site, Miroslav Velev for his remarks on the early version of the paper and the referees for their helpful comments. This research was funded by an ARC Large Grant at The University of Newcastle.

Can American Checkers be Solved by Means of Symbolic Model Checking?

Symbolic model checking has become a successful technique for verifying large finite state systems up to more than 1020 states. The key idea of this method is that extremely large sets can often be efficiently represented with propositional formulas. Most tools implement these formulas by means of binary decision diagrams (BDDs), which have therefore become a key data structure in modern VLSI CAD systems.Some board games like American checkers have a state space whose size is well within the range of state space sizes that have been tackled by symbolic model checking. Moreover, the question whether there is a winning strategy in these games can be reduced to two simple μcalculus formulas. Hence, the entire problem to solve such games can be reduced to simple μcalculus model checking problems.In this paper, we show how to model American checkers as a finite state system by means of BDDs. We moreover specify the existence of winning strategies for both players by simple μ-calculus formulas. Further still, we report on our experimental results with our own model checking tool, and we describe some powerful improvements that we have found in trying to solve the game.

Symbolic model checking with rich assertional languages

The paper shows that, by an appropriate choice of a rich assertional language, it is possible to extend the utility of symbolic model checking beyond the realm of BDD-represented finite-state systems into the domain of infinite-state systems, leading to a powerful technique for uniform verification of unbounded (parameterized) process networks. The main contributions of the paper are a formulation of a general framework for symbolic model checking of infinite-state systems, a demonstration that many individual examples of uniformly verified parameterized designs that appear in the literature are special cases of our general approach, verifying the correctness of the Futurebus+ design for all single-bus configurations, and extending the technique to tree architectures.

Automatic Support for Verification of Secure Transactions in Distributed Environment using Symbolic Model Checking

Electronic commerce needs the aid of software tools to check the validity of business processes in order to fully automate the exchange of information through the network. Symbolic model checking has been used to formally verify specifications of secure transactions in a system for business-to-business applications. The fundamental principles behind symbolic model checking are presented along with techniques used to model mutual exclusion of processes and atomic transactions. The computational resources required to check the example process are presented, and the faults are detected through symbolic verification.

Symbolic model checking for self-stabilizing algorithms

A distributed system is said to be self-stabilizing if it converges to safe states regardless of its initial state. In this paper we present our results of using symbolic model checking to verify distributed algorithms against the self-stabilizing property. In general, the most difficult problem with model checking is state explosion; it is especially serious in verifying the self-stabilizing property, since it requires the examination of all possible initial states. So far applying model checking to self-stabilizing algorithms has not been successful due to the problem of state explosion. In order to overcome this difficulty, we propose to use symbolic model checking for this purpose. Symbolic model checking is a verification method which uses Ordered Binary Decision Diagrams (OBDDs) to compactly represent state spaces. Unlike other model checking techniques, this method has the advantage that most of its computations do not depend on the initial states. We show how to verify the correctness of algorithms by means of SMV, a well-known symbolic model checker. By applying the proposed approach to several algorithms in the literature, we demonstrate empirically that the state spaces of self-stabilizing algorithms can be represented by OBDDs very efficiently. Through these case studies, we also demonstrate the usefulness of the proposed approach in detecting errors.

Optimizing symbolic model checking for statecharts

Symbolic model checking based on binary decision diagrams is a powerful formal verification technique for reactive systems. In this paper, we present various optimizations for improving the time and space efficiency of symbolic modal checking for systems specified as statecharts. We used these techniques in our analyses of the models of a collision avoidance system and a fault-tolerant electrical power distribution (EPD) system, both used on commercial aircraft. The techniques together reduce the time and space requirements by orders of magnitude, making feasible some analysis that was previously intractable. We also elaborate on the results of verifying the EPD model. The analysis disclosed subtle modeling and logical flaws not found by simulation.

Verification of Large State/Event Systems Using Compositionality and Dependency Analysis

A state/event model is a concurrent version of Mealy machines used for describing embedded reactive systems. This paper introduces a technique that uses compositionality and dependency analysis to significantly improve the efficiency of symbolic model checking of state/event models. It makes possible automated verification of large industrial designs with the use of only modest resources (less than 5 minutes on a standard PC for a model with 1421 concurrent machines). The results of the paper are being implemented in the next version of the commercial tool visualSTATETM.

Conformant Planning via Symbolic Model Checking

We tackle the problem of planning in nondeterministic domains, by presenting a new approach to conformant planning. Conformant planning is the problem of finding a sequence of actions that is guaranteed to achieve the goal despite the nondeterminism of the domain. Our approach is based on the representation of the planning domain as a finite state automaton. We use Symbolic Model Checking techniques, in particular Binary Decision Diagrams, to compactly represent and efficiently search the automaton. In this paper we make the following contributions. First, we present a general planning algorithm for conformant planning, which applies to fully nondeterministic domains, with uncertainty in the initial condition and in action effects. The algorithm is based on a breadth-first, backward search, and returns conformant plans of minimal length, if a solution to the planning problem exists, otherwise it terminates concluding that the problem admits no conformant solution. Second, we provide a symbolic representation of the search space based on Binary Decision Diagrams (BDDs), which is the basis for search techniques derived from symbolic model checking. The symbolic representation makes it possible to analyze potentially large sets of states and transitions in a single computation step, thus providing for an efficient implementation. Third, we present CMBP (Conformant Model Based Planner), an efficient implementation of the data structures and algorithm described above, directly based on BDD manipulations, which allows for a compact representation of the search layers and an efficient implementation of the search steps. Finally, we present an experimental comparison of our approach with the state-of-the-art conformant planners CGP, QBFPLAN and GPT. Our analysis includes all the planning problems from the distribution packages of these systems, plus other problems defined to stress a number of specific factors. Our approach appears to be the most effective: CMBP is strictly more expressive than QBFPLAN and CGP and, in all the problems where a comparison is possible, CMBP outperforms its competitors, sometimes by orders of magnitude.

Embedded software verification in hardware–software codesign

Abstract Concurrent Embedded Real-Time Software (CERTS) is intrinsically different from traditional, sequential, independent, and temporally unconstrained software. The verification of software is more complex than hardware due to inherent flexibilities (dynamic behavior) that incur a multitude of possible system states. The verification of CERTS is all the more difficult due to its concurrency and embeddedness. The work presented here shows how the complexity of CERTS verification can be reduced significantly through answering common engineering questions such as when, where, and how one must verify embedded software. First, a new Schedule-Verify-Map strategy is proposed to answer the when question. Second, verification under system concurrency is proposed to answer the where question. Finally, a complete symbolic model checking procedure is proposed for CERTS verification. Several application examples illustrate the usefulness of our technique in increasing verification scalability.

Finite state verification (abstract only)

Ever since formal verification was first proposed in the late sixties, the idea of being able to definitively determine if a program meets its specifications has been an appealing, but elusive, goal. Although verification systems based on theorem proving have improved considerably over the years, they are still inherently undecidable and require significant guidance from mathematically astute users. The human effort required for formal verification is so significant that it is usually only applied to the most critical software components. Alternative approaches to theorem proving based verification have also been under development for some time. These approaches usually restrict the problem domain in some way, such as focusing on hardware descriptions, communication protocols, or a limited specification language. These restrictions allow the problem to be solved by using reasoning algorithms that are guaranteed to terminate and by representing the problem with a finite state model, and thus these approaches have been called finite state verification. Systems based on these approaches are starting to be effectively applied to interesting software systems and there is increasing optimism that such approaches will become widely applicable. In this presentation, I will overview some of the different approaches to finite state verification. In particular I will describe symbolic model checking, integer necessary constraints, and incremental data flow analysis approaches. The strengths and weaknesses of these approaches will be described. In addition, I will outline the major challenges that must be addressed before finite state verification will become a common tool for the typical well-trained software engineer.

Design and verification of a coordination protocol for cooperating systems

This paper proposes an approach to producing a verified design of a complex intelligent system. The system is modeled using a hierarchical structure based on a coordination protocol. The coordination protocol and the system architecture are described using a state machine representation. The Clarke-McMillan Symbolic Model Checker based on branching time temporal logic is used to verify some of the desired formal properties of the protocol such as completeness, boundedness and termination. This work shows that the model checker helps to bring the automatic verification of complex intelligent systems closer to a practical proposition.

A methodology for hardware verification using compositional model checking

A methodology for system-level hardware verification based on compositional model checking is described. This methodology relies on a simple set of proof techniques, and a domain specific strategy for applying them. The goal of this strategy is to reduce the verification of a large system to finite state subgoals that are tractable in both size and number. These subgoals are then discharged by model checking. The proof strategy uses proof techniques for design refinement, temporal case splitting, data-type reduction and the exploitation of symmetry. Uninterpreted functions can be used to abstract operations on data. A proof system supporting this approach generates verification subgoals to be discharged by the SMV symbolic model checker. Application of the methodology is illustrated using an implementation of Tomasulo's algorithm, a packet buffering device and a cache coherence protocol as examples.