364,812 research outputs found
Bounded Model Checking for Probabilistic Programs
In this paper we investigate the applicability of standard model checking
approaches to verifying properties in probabilistic programming. As the
operational model for a standard probabilistic program is a potentially
infinite parametric Markov decision process, no direct adaption of existing
techniques is possible. Therefore, we propose an on-the-fly approach where the
operational model is successively created and verified via a step-wise
execution of the program. This approach enables to take key features of many
probabilistic programs into account: nondeterminism and conditioning. We
discuss the restrictions and demonstrate the scalability on several benchmarks
SMT-based Model Checking for Recursive Programs
We present an SMT-based symbolic model checking algorithm for safety
verification of recursive programs. The algorithm is modular and analyzes
procedures individually. Unlike other SMT-based approaches, it maintains both
"over-" and "under-approximations" of procedure summaries. Under-approximations
are used to analyze procedure calls without inlining. Over-approximations are
used to block infeasible counterexamples and detect convergence to a proof. We
show that for programs and properties over a decidable theory, the algorithm is
guaranteed to find a counterexample, if one exists. However, efficiency depends
on an oracle for quantifier elimination (QE). For Boolean Programs, the
algorithm is a polynomial decision procedure, matching the worst-case bounds of
the best BDD-based algorithms. For Linear Arithmetic (integers and rationals),
we give an efficient instantiation of the algorithm by applying QE "lazily". We
use existing interpolation techniques to over-approximate QE and introduce
"Model Based Projection" to under-approximate QE. Empirical evaluation on
SV-COMP benchmarks shows that our algorithm improves significantly on the
state-of-the-art.Comment: originally published as part of the proceedings of CAV 2014; fixed
typos, better wording at some place
Model checking Branching-Time Properties of Multi-Pushdown Systems is Hard
We address the model checking problem for shared memory concurrent programs
modeled as multi-pushdown systems. We consider here boolean programs with a
finite number of threads and recursive procedures. It is well-known that the
model checking problem is undecidable for this class of programs. In this
paper, we investigate the decidability and the complexity of this problem under
the assumption of bounded context-switching defined by Qadeer and Rehof, and of
phase-boundedness proposed by La Torre et al. On the model checking of such
systems against temporal logics and in particular branching time logics such as
the modal -calculus or CTL has received little attention. It is known that
parity games, which are closely related to the modal -calculus, are
decidable for the class of bounded-phase systems (and hence for bounded-context
switching as well), but with non-elementary complexity (Seth). A natural
question is whether this high complexity is inevitable and what are the ways to
get around it. This paper addresses these questions and unfortunately, and
somewhat surprisingly, it shows that branching model checking for MPDSs is
inherently an hard problem with no easy solution. We show that parity games on
MPDS under phase-bounding restriction is non-elementary. Our main result shows
that model checking a context bounded MPDS against a simple fragment of
CTL, consisting of formulas that whose temporal operators come from the set
{\EF, \EX}, has a non-elementary lower bound
Scaling Bounded Model Checking By Transforming Programs With Arrays
Bounded Model Checking is one the most successful techniques for finding bugs
in program. However, model checkers are resource hungry and are often unable to
verify programs with loops iterating over large arrays.We present a
transformation that enables bounded model checkers to verify a certain class of
array properties. Our technique transforms an array-manipulating (ANSI-C)
program to an array-free and loop-free (ANSI-C) program thereby reducing the
resource requirements of a model checker significantly. Model checking of the
transformed program using an off-the-shelf bounded model checker simulates the
loop iterations efficiently. Thus, our transformed program is a sound
abstraction of the original program and is also precise in a large number of
cases - we formally characterize the class of programs for which it is
guaranteed to be precise. We demonstrate the applicability and usefulness of
our technique on both industry code as well as academic benchmarks
Synthesis of Parametric Programs using Genetic Programming and Model Checking
Formal methods apply algorithms based on mathematical principles to enhance
the reliability of systems. It would only be natural to try to progress from
verification, model checking or testing a system against its formal
specification into constructing it automatically. Classical algorithmic
synthesis theory provides interesting algorithms but also alarming high
complexity and undecidability results. The use of genetic programming, in
combination with model checking and testing, provides a powerful heuristic to
synthesize programs. The method is not completely automatic, as it is fine
tuned by a user that sets up the specification and parameters. It also does not
guarantee to always succeed and converge towards a solution that satisfies all
the required properties. However, we applied it successfully on quite
nontrivial examples and managed to find solutions to hard programming
challenges, as well as to improve and to correct code. We describe here several
versions of our method for synthesizing sequential and concurrent systems.Comment: In Proceedings INFINITY 2013, arXiv:1402.661
Enriched MU-Calculi Module Checking
The model checking problem for open systems has been intensively studied in
the literature, for both finite-state (module checking) and infinite-state
(pushdown module checking) systems, with respect to Ctl and Ctl*. In this
paper, we further investigate this problem with respect to the \mu-calculus
enriched with nominals and graded modalities (hybrid graded Mu-calculus), in
both the finite-state and infinite-state settings. Using an automata-theoretic
approach, we show that hybrid graded \mu-calculus module checking is solvable
in exponential time, while hybrid graded \mu-calculus pushdown module checking
is solvable in double-exponential time. These results are also tight since they
match the known lower bounds for Ctl. We also investigate the module checking
problem with respect to the hybrid graded \mu-calculus enriched with inverse
programs (Fully enriched \mu-calculus): by showing a reduction from the domino
problem, we show its undecidability. We conclude with a short overview of the
model checking problem for the Fully enriched Mu-calculus and the fragments
obtained by dropping at least one of the additional constructs
- …