External Program Model Checking Stefan Edelkamp, Shahid Jabar, Dino Midzic, Daniel Rikowski and Damian Sulewski Computer Science Department University of Dortmund Otto-Hahn Straße 14

- Why software model checking - States in our program model checker StEAM - Externalization Algorithm - Experimental results Motivation - Overview

Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker Formal specification of code manual rewriting Checking a software implementation rather then a formal specification

Formal specification of code manual rewriting Checking a software implementation rather then a formal specification Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker

Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Error trail manual rewriting Checking a software implementation rather then a formal specification Model checker Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker Virtual Machine Compiler Using a virtual machine to explore a model Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

Model checker Virtual Machine Model checker Virtual Machine Assumes an error free virtual machine + Can detect errors in the implementation + User is not required to be familiar with modeling language - Exceeds the available memory - Slows down the exploration Using a virtual machine to explore a model Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Compiler Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

Model checker Virtual Machine Techniques for state space compression - Partial order reduction - Minimal binary state encoding - Abstraction methods - Bit-state hashing - Search heuristics

External model checking - Using virtual memory can slow down the performance significantly - General purpose virtual memory scheme is used - External memory algorithms are more informed about the states - Show remarkable performance in the large-scale analysis of games - Introduced in explicit-state model checker SPIN

=physical memory = VM_memory PC FP SP R0 … FP0 m1m1 s1s1 Obj. file mem. Image(MI) zero ebd move (4,%r2),%r3 … Int a,b,c … Int d=12 Int e=17 Int f=-1 … Code-Section BSS-Section Data-Section a=4 b=6 c=12 BSS-memory =program memory dyn. alloc.regions States in StEAM PC FP SP R0 … FP0 m2m2 s2s2 mn 1 mn 2 mn 3 memory-pool li 1 li 2 li 3 lock-pool PC FP SP R0 … FP0 mnmn snsn

The externalization algorithm - Relaxed the requirement of a constant main memory - Mini-states - Pointer to a full system state on the secondary memory - Its predecessor information - Constant size in contrast to a full state

The externalization algorithm Cache Mini-states Secondary memory Internal memory

The externalization algorithm CacheSecondary memoryMini-states Internal memory

The externalization algorithm CacheSecondary memoryMini-states Internal memory

The externalization algorithm CacheSecondary memoryMini-states Internal memory

The externalization algorithm CacheSecondary memoryMini-states Internal memory

The externalization algorithm - external collapse compression Full state CachesFiles Data - Section BSS - Section Stack Fixed values

Experimental results - first running case study: the Dining Philosophers

Experimental results – Philosophers using most blocked heuristic Internal memory in MB Philosophers

Experimental results – Philosophers using most blocked heuristic Time in seconds Philosophers

Experimental results – Philosophers using most blocked heuristic Time in seconds Philosophers

Experimental results - second running case study: the 8-Puzzle

Experimental results – 8-Puzzle using Breath First Search Time in seconds Moves

Experimental results – 8-Puzzle using Breath First Search Internal memory in MB Moves

Conclusion and future work - StEAM is the first external program model checker - Largest exploration in program model checking - Software still experimental - Can be used for non-deterministic programs - Further information on