A composite model checking toolset for analyzing software systems

Abstract

point, and to provide deterministic re-execution, we provide I/O logging to capture external inputs from the initial execution that we will replay later upon re-execution. Future DirectionsSo far we have focused our efforts on solving the most challenging research problems of providing a full set of debugging movement commands that operate efficiently in both the forward and a backwards directions. We have tested this extensively and are exceptionally pleased with its performance, but we have not yet unleashed it upon our students for general use in debugging their programs. This is the ultimate test: whether students find the backward movements helpful in more quickly locating the causes of bugs in their programs. We are currently working on user interface level issues in preparation for this next level of evaluation.Model checking has proved to be a successful technique for verifying hardware systems. Given a transition system and a temporal property, model checking procedures exhaustively search the state space of the input transition system to find out if it satisfies the given temporal property. Recently, model checking has been used for analyzing software specifications with encouraging results [CAB + 98]. The state-space of a software specification can be explored using model checking procedures to verify or falsify (by generating counter-example behaviors) its properties. The success of model checking has been partially due to Binary Decision Diagrams (BDDs) -a data structure that can encode boolean functions in a highly compact format. The main idea in BDD based model checking is to represent sets of system states and transitions as boolean formulas, and manipulate them efficiently using BDDs [McM93]. BDD data structure supports the operations required for model checking: intersection, union, complement, equivalence checking and existential quantifier elimination (used to compute preand post-conditions). This type of model checking is called symbolic since the system states are represented implicitly by BDDs during the state space search.In recent years new symbolic representations have been proposed. For example, HyTech, a symbolic model checker for hybrid systems, encodes real domains using linear constraints on reals [AHI-I96]. Recently, we proposed a model checker for integer based systems, which uses Presburger arithmetic (integer arithmetic without multiplication) constraints as its underlying state representation [BGP97]. Using constraint representations one can verify systems with infinite variable domains (which is not possible using finite representations such as BDDs).Our goal in this project is to develop a toolset which combines various symbolic representations in a single composite model checker. In the composite model checking approach each variable in the input system is mapped to a symbolic representation type [BGL98]. (For example, boolean and enumerated variables can be mapped to BDD representation, and integers can be mapped to Presburger constraint representation.) Then, each atomic ...