Folie 1

1
External Program Model Checking
Stefan Edelkamp, Shahid Jabar, Dino Midzic,
Daniel Rikowski and Damian Sulewski
Computer Science Department University of
Dortmund Otto-Hahn Straße 14
2
Motivation - Overview
- Why software model checking
- States in our program model checker StEAM
- Externalization Algorithm
- Experimental results
3
Checking a software implementation rather then a
formal specification
manual rewriting
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Formal specification of code
Model checker
4
Checking a software implementation rather then a
formal specification
manual rewriting
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Formal specification of code
Model checker
5
Checking a software implementation rather then a
formal specification
manual rewriting
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Error trail
Model checker
6
Using a virtual machine to explore a model
Model checker
Compiler
Virtual Machine
Int main(int argc, char argv) int a
0 int b 7 int c b / a
Int main(int argc, char argv) int a
0 int b 7 int c b / a
7
Using a virtual machine to explore a model
Can detect errors in the implementation
User is not required to be familiar with
modeling language
- Exceeds the available memory
- Slows down the exploration
Assumes an error free virtual machine
8
Techniques for state space compression
- Partial order reduction
- Minimal binary state encoding
- Abstraction methods
- Bit-state hashing
- Search heuristics
9
External model checking
- Using virtual memory can slow down the
performance significantly
- General purpose virtual memory scheme is used
- External memory algorithms are more informed
about the states
- Show remarkable performance in the large-scale
analysis of games
- Introduced in explicit-state model checker SPIN
10
States in StEAM
11
The externalization algorithm
- Relaxed the requirement of a constant main
memory
- Mini-states
- Pointer to a full system state on the secondary
memory
- Its predecessor information
- Constant size in contrast to a full state
12
The externalization algorithm
13
The externalization algorithm
Cache
Secondary memory
Mini-states
14
The externalization algorithm
Cache
Secondary memory
Mini-states
15
The externalization algorithm
Cache
Secondary memory
Mini-states
16
The externalization algorithm
Cache
Secondary memory
Mini-states
17
The externalization algorithm - external collapse
compression
Data - Section
BSS - Section
Stack
Fixed values
18
Experimental results
- first running case study the Dining
Philosophers
19
Experimental results Philosophers using most
blocked heuristic
Internal memory in MB
Philosophers
20
Experimental results Philosophers using most
blocked heuristic
Time in seconds
Philosophers
21
Experimental results Philosophers using most
blocked heuristic
Time in seconds
Philosophers
22
Experimental results
- second running case study the 8-Puzzle
7
6
8
5
3
4
2
1
23
Experimental results 8-Puzzle using Breath
First Search
Time in seconds
Moves
24
Experimental results 8-Puzzle using Breath
First Search
Internal memory in MB
Moves
25
Conclusion and future work
- StEAM is the first external program model
checker
- Largest exploration in program model checking
- Software still experimental
- Can be used for non-deterministic programs