Explicit State Model Checking with Hopper

Abstract

Abstract. The Murϕ-based Hopper tool is a general purpose explicit model checker. Hopper leverages Murϕ's class structure to implement new algorithms. Hopper differs from Murϕ in that it includes in its distribution published parallel and disk based algorithms, as well as several new algorithms. For example, Hopper includes parallel dynamic partitioning, cooperative parallel search for LTL violations and property-based guided search (parallel or sequential). We discuss Hopper in general and present a recently implemented randomized guided search algorithm. In multiple parallel guided searches, randomization increases the expected average time to find an error but decreases the expected minimum time to find an error.The Hopper 1 tool leverages the Murϕ architecture to implement parallel, disk-based and heuristic model checking algorithms. The common theme in the algorithms implemented in Hopper is that they do not use abstraction. Instead, Hopper explores fundamental algorithms for reducing time and space capacity limitations in state generation and storage. Our intention is that algorithms implemented in Hopper can be combined with well-known abstraction techniques. The algorithms studied in Hopper are generic enough to be implemented in any state enumeration context-including software model checking. The current release of Hopper contains parallel and disk based algorithms published by Dill and Stern [1, 2] and heuristic search using the heuristic proposed by Edelkamp [3]. Hopper also includes parallel and guided search algorithms developed by the BYU model checking research group [4][5][6]. Hopper is a testbed for ideas that will be incorporated in our forthcoming C/C++ model checker built as an extension of the GNU debugger (GDB). The Hopper distribution includes a suite of 177 benchmark verification problems for Murϕ. This paper describes the architecture and algorithms implemented in Hopper along with a new randomized guided algorithm we have recently implemented. Randomization increases the variance (and the mean) of the search effort required to find a property violation. Search effort is measured by the number of transitions taken. In some problems, increasing the variance (even at the expense of increasing the mean) decreases the expected minimum number of transitions taken in error discovery using in parallel searches.

Hardness for Explicit State Software Model Checking Benchmarks

“…There are two other parameterized subjects that have a low observed R-DFS error density: Airline with parameters (20,2) and Piper with parameters (2,16,8). These are interesting subjects because other parameterized versions of these models have a high observed R-DFS error density.…”

Deep Random Search for Efficient Model Checking of Timed Automata

“…This is a subject for future work. Experimental results for a guided-search algorithm, where randomization is used to select a successor among the first n elements in a priority queue, showed that X follows a normal distribution [10]. Increasing n was shown to increase both the variance and the mean of X. Randomization improved the search performance because the probability of observing a small value of X increased logarithmically with the variance, provided the mean remained unchanged.…”

“…random walk) in model checking and reported on its benefits, including [14,7,18,10,15]. To the best of our knowledge, DRS is the first complete Las Vegas algorithm to be proposed for the problem.…”

Time-Efficient Model Checking with Magnetic Disk

“…To avoid extensive duplication of previous work, older blocks are occasionally loaded for comparison. We have reimplemented and profiled the Mono and Local algorithms in Hopper [4]. Both algorithms were profiled on a collection of five model checking problems.…”