In order to facilitate automated reasoning about large Boolean combinations of nonlinear arithmetic constraints involving transcendental functions, we provide a tight integration of recent SAT solving techniques with interval-based arithmetic constraint solving. Our approach deviates substantially from lazy theorem proving approaches in that it directly controls arithmetic constraint propagation from the SAT solver rather than delegating arithmetic decisions to a subordinate solver. Through this tight integration, all the algorithmic enhancements that were instrumental to the enormous performance gains recently achieved in propositional SAT solving carry over smoothly to the rich domain of non-linear arithmetic constraints. As a consequence, our approach is able to handle large constraint systems with extremely complex Boolean structure, involving Boolean combinations of multiple thousand arithmetic constraints over some thousands of variables.

Abstract. The analysis of hybrid systems exhibiting probabilistic behaviour is notoriously difficult. To enable mechanised analysis of such systems, we extend the reasoning power of arithmetic satisfiability-modulotheory solving (SMT) by a comprehensive treatment of randomized (a.k.a. stochastic) quantification over discrete variables within the mixed Booleanarithmetic constraint system. This provides the technological basis for a fully symbolic analysis of probabilistic hybrid automata. Generalizing SMT-based bounded model-checking of hybrid automata [2, 11], stochastic SMT permits the direct and fully symbolic analysis of probabilistic bounded reachability problems of probabilistic hybrid automata without resorting to approximation by intermediate finite-state abstractions.

No abstract

This article presents novel results on automated test generation for hybrid control systems. In contrast to test automation techniques for purely discrete controllers this involves the generation of both discrete and real-valued, potentially time-continuous, input data to the system under test. To this end, the test automation techniques introduced here are allocated in two-layers: The upper layer contains a symbolic test case generator constructing test cases as paths through an abstracted representation of the transition graph specifying the system under test. Different test strategies designed to pursue various quality objectives lead to different selections of symbolic test cases. Symbolic test cases are transformed into feasible, i. e., executable, test cases by constructing concrete sequences of input data, allowing the execution of the pre-planned transition sequence. The input data construction is performed by the lower layer consisting of a constraint solver. This component applies interval analysis techniques identifying the domains from where to pick the appropriate test data. The well known complexity problems of the various paving algorithms used in interval analysis are circumvented by three main concepts: First, sequences of constraints, each element representing a conjunct of a larger * Work of the authors situated at Oldenburg has been partly supported by the German Research Council (DFG) as part of the Transregional Collaborative Research Center "Automatic Verification and Analysis of Complex Systems" (SFB/TR 14 AVACS, http://www.avacs.org). † Partly supported by the Deutsche Forschungsgemeinschaft DFG as part of the priority programme SPP 1064 on Software Specification -Integration of Software Specification Techniques for Applications in Engineering (SPP 1064, HY-BRIS, http://www.tzi.de/agbs/projects/hybris). This is the extended version of an article to appear in the Proceedings of the SOQUA'06, November 6, 2006, Portland, OR, USA. global constraint, are processed separately, thereby keeping the dimension of the local constraint problems involved at an acceptable level. Second, interval vectors containing the global solution set are contracted using forward-backward interval constraint propagation. Third, both symbolic test case generator and constraint solver learn to avoid symbolic transition sequences whose prefixes are already known to be infeasible and to avoid interval solutions for local constraints which are known to be in conflict with other local constraints to be satisfied for the same symbolic test case, respectively.

Abstract. Program analysis is on the brink of mainstream usage in embedded systems development. Formal verification of behavioural requirements, finding runtime errors and test case generation are some of the most common applications of automated verification tools based on bounded model checking (BMC). Existing industrial tools for embedded software use an off-the-shelf bounded model checker and apply it iteratively to verify the program with an increasing number of unwindings. This approach unnecessarily wastes time repeating work that has already been done and fails to exploit the power of incremental SAT solving. This article reports on the extension of the software model checker CBMC to support incremental BMC and its successful integration with the industrial embedded software verification tool BTC EMBEDDEDTESTER. We present an extensive evaluation over large industrial embedded programs, mainly from the automotive industry. We show that incremental BMC cuts runtimes by one order of magnitude in comparison to the standard non-incremental approach, enabling the application of formal verification to large and complex embedded software. We furthermore report promising results on analysing programs with arbitrary loop structure using incremental BMC, demonstrating its applicability and potential to verify general software beyond the embedded domain.