Model checking programs

Abstract

Abstract. The majority of work carried out in the formal methods community throughout the last three decades has (for good reasons) been devoted to special languages designed to make it easier to experiment with mechanized formal methods such as theorem provers, proof checkers and model checkers. In this paper we will attempt to give convincing arguments for why we believe it is time for the formal methods community to shift some of its attention towards the analysis of programs written in modern programming languages. In keeping with this philosophy we have developed a verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing. Part of this work has consisted of building a new Java Virtual Machine that interprets Java bytecode. JPF uses state compression to handle big states, and partial order and symmetry reduction, slicing, abstraction, and runtime analysis techniques to reduce the state space. JPF has been applied to a real-time avionics operating system developed at Honeywell, illustrating an intricate error, and to a model of a spacecraft controller, illustrating the combination of abstraction, runtime analysis, and slicing with model checking.

Efficient Testing of Concurrent Programs with Abstraction-Guided Symbolic Execution

“…Model checking is a formal approach for systematically exploring all possible behaviors of a concurrent software system [9,17,25,3]. The state space explosion problem renders it intractable in verifying medium to large-sized programs.…”

“…Explicit state model checking enumerates all possible thread schedules and input data values of a program in order to check for errors [9,25]. Whereas symbolic execution techniques substitute certain data values with symbolic values while all other values are concrete [11,24,16].…”

“…Certain thread interleavings, data input values, or combinations of both often cause errors in the system. Systematic verification techniques such as explicit state model checking and symbolic execution are extensively used to detect errors in such systems [9,25,7,11,16].…”

Interactive Testing with HOL-TestGen

“…To perform white box tests in the style of Pathfinder [11], SpecExplorer [8], or Korat [4], it is necessary to make the program paths explicit in the program representation and amenable to the rules of the operational semantics. Therefore, a pre-processing step is necessary that unfolds all WHILE -loops up to a certain limit, the unwind-factor k. This principle can also be applied in a language extension with procedure calls such as IMPP, also available in the Isabelle distribution.…”

“…In Sec. 5, we will exploit the underlying generality of Isabelle for a different testing technique in the style of Pathfinder [11], SpecExplorer [8], and Korat [4]. The approach is based on a suitable semantic presentation of a programming language (a "logical embedding"), which can be used to both derive semantic constraints underlying a test as well as solving them in an integrated way.…”