SymbolicModelCheckingforLargeSoftwareSpecifications.ppt

Symbolic Model Checking for Large Software Specifications David Notkin (notkin@cs.washington.edu) Dept. of Computer Science Engineering University of Washington April 2001 William Chan (1972-1999) Other Collaborators Richard Anderson Paul Beame Steve Burns Francesmary Modugno David Jones (Boeing) Jon D. Reese William Warner (Boeing) Motivation How to increase confidence in correctness of safety-critical software? Existing techniques are limited to some degree Inspection Syntactic check Simulation/testing Theorem proving Symbolic model checking successful for industrial hardware Effective also for software? Many people’s conjecture: No Temporal-Logic Model Checking [Clarke Emerson 81] Some properties expressible in temporal logics Error states not reached (invariant) Ex: AG ?Err ? Today’s focus Eventually ack for each request (liveness) AG (Req ? AF Ack) Always possible to restart machine (possibility) AG EF Restart Two Approaches to Model Checking Explicit Conventional state-space search: depth-first, breadth-first, etc. Needs substantial manual abstraction and state reduction Symbolic Can search huge state spaces (e.g. 1020) Practical for many industrial hardware circuits Provably bad for certain arithmetic operations Not believed to work well for software Software Experts Say “The time and space complexity of the symbolic approach is affected…by the regularity of specification. Software requirements specifications lack this necessary regular structure…” [Heimdahl Leveson 96] And say… “[Symbolic model checking] works well for hardware designs with regular logical structures…However, it is less likely to achieve similar reductions in software specifications whose logical structures are less regular.” [Cheung Kramer 99] Model Checking Co-Inventor Says “…[symbolic model checkers] are often able to exploit the regularity…in many hardware designs. Because software typically lacks this regularity, [symbolic] model checking seems much less helpful for software ve