Software Verification 2 Automated Verification

1. Software Verification 2Automated Verification Prof. Dr. Holger Schlingloff Institut für Informatik der Humboldt Universität and Fraunhofer Institut für Rechnerarchitektur und Softwaretechnik

2. LTL Model Checking Algorithm

3. Improvements • bitstate hashing • incomplete hashing • partial order techniques

4. CTL model checking • For each LTS/model there is exactly one computation tree • CTL model checking works directly on the model (no need to extract computation sequences) • For all subformulas of a formula and all states of a given model, mark whether the state satisfies the subformula • iteration on formulas according to their inductive definition • if p is an atomic proposition, then pM= I(p) • M={} • (φψ)M = (M-φM +ψ M) • (EXφ)M = {w | w‘ (wRw‘ w‘φM )} • E(φU+ψ)M = {w | there is a path α from w and a w‘ on α such that (w<w‘ w‘ ψM ) w‘‘ (w<w‘‘<w‘ w‘‘ φM )} • A(φU+ψ)M = {w | for all paths α from w there is a w‘ on α such that (w<w‘ w‘ ψM ) w‘‘ (w<w‘‘<w‘ w‘‘ φM )}

5. Actual Calculation • How to calculate (EX ψ)M from ψM? • Inverse image construction • How to calculate E(φU+ψ)M or A(φU+ψ)M from φM and ψM?

7. Inverse reachability calculation

8. Symbolic Representation • Modelchecking algorithm deals with sets of states and with relations (sets of pairs of states) • Need an efficient representation

9. Binary Encoding of Domains • Any variable on a finite domain D can be replaced by log(D) binary variables • similar to encoding of data types by compilers • e.g. var v: {0..15} can be replaced byvar v1,v2,v3,v4: boolean(0=0000, 1= 0001, 2=0010, 3=0011, ..., 15=1111) • State space • still in the order of original domain! • e.g. three int8-variables can have 224=108 states • e.g. array of length 10 with 10-bit values  1030 states • Representation of large sets of states?

10. Representation of Sets

11. Ordered Tree Form • Normal form for propositional formulas • Uses only the connective Ite • Linear ordering on the set of propositions • e.g., most significant bit first • Shannon expansion

12. Truth table and tree form formula Reduction: Replace Ite (v,ψ,ψ) by ψ

13. Abbreviations • Introduce abbreviations • maximally abbreviated

14. Binary Decision Trees (BDTs) • Binary decision tree • Elimination ofisomorphic subtrees(abbreviations)

15. Binary Decision Diagrams (BDDs) • Elimination ofredundant nodes(redundant subformulas) Ite (v,ψ,ψ) by ψ

16. Calculation of BDDs