1. External Program Model Checking Stefan Edelkamp, Shahid Jabar, Dino Midzic, Daniel Rikowski and Damian Sulewski Computer Science Department University of Dortmund Otto-Hahn Straße 14

2. - Why software model checking - States in our program model checker StEAM - Externalization Algorithm - Experimental results Motivation - Overview

3. Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker Formal specification of code manual rewriting Checking a software implementation rather then a formal specification

4. Formal specification of code manual rewriting Checking a software implementation rather then a formal specification Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker

5. Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Error trail manual rewriting Checking a software implementation rather then a formal specification Model checker Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

6. Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Model checker Virtual Machine Compiler Using a virtual machine to explore a model Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

7. Model checker Virtual Machine Model checker Virtual Machine Assumes an error free virtual machine + Can detect errors in the implementation + User is not required to be familiar with modeling language - Exceeds the available memory - Slows down the exploration Using a virtual machine to explore a model Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; } Compiler Int main(int argc, char ** argv) { int a = 0; int b = 7; int c = b / a; }

8. Model checker Virtual Machine Techniques for state space compression - Partial order reduction - Minimal binary state encoding - Abstraction methods - Bit-state hashing - Search heuristics

9. External model checking - Using virtual memory can slow down the performance significantly - General purpose virtual memory scheme is used - External memory algorithms are more informed about the states - Show remarkable performance in the large-scale analysis of games - Introduced in explicit-state model checker SPIN

10. =physical memory = VM_memory PC FP SP R0 … FP0 m1m1 s1s1 Obj. file mem. Image(MI) ------------------------ zero ebd move (4,%r2),%r3 … ------------------------ Int a,b,c … ------------------------ Int d=12 Int e=17 Int f=-1 … ------------------------ Code-Section BSS-Section Data-Section a=4 b=6 c=12 BSS-memory =program memory dyn. alloc.regions States in StEAM PC FP SP R0 … FP0 m2m2 s2s2 mn 1 mn 2 mn 3 memory-pool li 1 li 2 li 3 lock-pool PC FP SP R0 … FP0 mnmn snsn

11. The externalization algorithm - Relaxed the requirement of a constant main memory - Mini-states - Pointer to a full system state on the secondary memory - Its predecessor information - Constant size in contrast to a full state

12. The externalization algorithm Cache Mini-states Secondary memory Internal memory

13. The externalization algorithm CacheSecondary memoryMini-states Internal memory

14. The externalization algorithm CacheSecondary memoryMini-states Internal memory

15. The externalization algorithm CacheSecondary memoryMini-states Internal memory

16. The externalization algorithm CacheSecondary memoryMini-states Internal memory

17. The externalization algorithm - external collapse compression Full state CachesFiles Data - Section BSS - Section Stack Fixed values

18. Experimental results - first running case study: the Dining Philosophers

19. Experimental results – Philosophers using most blocked heuristic Internal memory in MB Philosophers

20. Experimental results – Philosophers using most blocked heuristic Time in seconds Philosophers

21. Experimental results – Philosophers using most blocked heuristic Time in seconds Philosophers

22. 8 7 6 5 4 3 2 1 Experimental results - second running case study: the 8-Puzzle

23. Experimental results – 8-Puzzle using Breath First Search Time in seconds Moves

24. Experimental results – 8-Puzzle using Breath First Search Internal memory in MB Moves

25. Conclusion and future work - StEAM is the first external program model checker - Largest exploration in program model checking - Software still experimental - Can be used for non-deterministic programs - Further information on http://bugfinder.sourceforge.net