Bit-State Space Exploration

1
Bit-State Space Exploration

• Its a variation on reachability analysis
• The reachability analysis
• Keeps track of the already explored states
• Performs full state space search
• Most implementations use Hashing to quickly
  access an element on the table of already
  explored states

2
Bit-State Space Exploration

• Hashing function
• Given a hash space table of H slots
• and a Hashing function h(s) for A states
• h(s) points a slot in the hash table without the
  need to search for the states in the whole table

h(s)
3
Bit-State Space Exploration

• In case of collision
• the use of a linked list is a common option
• To minimize collision, two hashing functions are
  used.

S2
S3
S1
h(s)
4
Bit-State Space Exploration

• Say we have two states s1 and s2.
• With only one hash function, these are the
  possibilities
• h(s1) x and h(s2) x
• or
• h(s1) x and h(s2) y

5
Bit-State Space Exploration

• Say now we use two hashing functions h1 and h2.
• The four possibilities are
• h1(s1)x , h1(s2)x , h2(s1)v , h2(s2)w
• h1(s1)x , h1(s2)x , h2(s1)v , h2(s2)v
• h1(s1)x , h1(s2)y , h2(s1)v , h2(s2)w
• h1(s1)x , h1(s2)y , h2(s1)v , h2(s2)v
• Only the green shaded row causes collision. We
  have thus reduced collision risk.

6
Bit-State Space Exploration

• Memory space analysis
• Hash table size (H)
• Pointer size (B)
• Hash table will occupy HxB bytes
• State data will use (SB)xA bytes
• Total memory HxB (SB)xA
• Example
• H 1,000,000, B4 ? Table size 4Mb
• S and A depend on the specification under test

next pointer state data size
7
Bit-State Space Exploration

• Workaround Bit-state space exploration
• By using a depth search algorithm, there is no
  need any more for storing the visited states, so
• M HxB (SB)xA ?M H, or H/8,
• where M is the total amount of memory used for
  the hash table.
• Constraints
• Collision avoidance is a matter of probability of
  occurrence
• has to use depth search algorithm
• only goes until maximum depth is reached

Because one state now can be represented by only
one bit reached (1), or not (0)
8
Bit-State Space Exploration

• Example 2 (Even better than previous)
• if M 1,000,000, H8,000,000
• previous example 4Mb 106 states only for the
  hashing table
• this example 4Mb 32x 106 states, and no need
  for extra storage for the states data

9
Bit-state Space exploration

• How it works
• Storing the state data in a stack as it goes
• Go until any of the following conditions...

G.S.1
Depth-first
G.S.1.1
G.S.1.2
G.S.1.3
G.S.1.1.1
G.S.1.1.2
G.S.1.1.3
G.S. Global State
10
Bit-state Space exploration

• a)
• b)

No new state or possible action Simply backtrack
in the stack
G.S.i
G.S.i
No new state or possible action backtrack and go
the next on the right
G.S.j (already visited)
G.S.k
11
Bit-state Space exploration

• c)
• d) Problem encountered
• e.g. Unspecified reception, or deadlock
• reads the whole stack, creates an MSC
• adds a report to the list of reports with the MSC
• backtrack and go again.
• Rem For each new visited state (hash table bit
  0), sets the hash table to 1.

Maximum depth Simply backtrack
G.S.i
12
Bit-state Space exploration

• In the TAU Validator Bit-State space exploration
  tool, the results are like
• No of reports No of reports generated
• Generated states No of global states generated
• Truncated paths No of states cut by the maximum
  depth constraint
• Unique system states No of unique global states
  from the generated ones
• Size of hash table The size of the hash table
  (H)
• No of bits set in hash table No of bits in the
  hash table set to 1 (visited)
• Collision risk the risk of having two states
  colliding in the same slot
• Max Depth the maximum depth set for this
  bit-state exploration
• Current depth the depth after the execution
  (should be -1 if went ok)
• Min state size and Max state size (limit sizes
  of states, used by h(s))
• Symbol coverage The percentage of the SDL
  symbols covered