## Survey on Directed Model Checking (2009)

### Cached

### Download Links

Citations: | 7 - 1 self |

### BibTeX

@MISC{Edelkamp09surveyon,

author = {Stefan Edelkamp and Anton Wijs and Husain Aljazzar},

title = {Survey on Directed Model Checking},

year = {2009}

}

### OpenURL

### Abstract

Abstract. This article surveys and gives historical accounts to the algorithmic essentials of directed model checking, a promising bug-hunting technique to mitigate the state explosion problem. In the enumeration process, successor selection is prioritized. We discuss existing guidance and methods to automatically generate them by exploiting system abstractions. We extend the algorithms to feature partial-order reduction and show how liveness problems can be adapted by lifting the search space. For deterministic, finite domains we instantiate the algorithms to directed symbolic, external and distributed search. For real-time domains we discuss the adaption of the algorithms to timed automata and for probabilistic domains we show the application to counterexample generation. Last but not least, we explain how directed model checking helps to accelerate finding solutions to scheduling problems. 1

### Citations

2402 | Model checking
- Clarke, Schlingloff
- 2001
(Show Context)
Citation Context .... Testing if a system works as intended becomes increasingly difficult. Formal verification aims to overcome this problem. The process of fully-automatic verification is referred to as model checking =-=[27,63]-=-. Given a formal model of a system and a property specification in some form of temporal logic [45], the task is to validate, whether the specification is satisfied. If not, a model checker returns a ... |

1963 | A theory of timed automata
- Alur, Dill
- 1994
(Show Context)
Citation Context ...Cl), defined by ψ := x ✁ c | x − y ✁ c | ψ ∧ ψ | ¬ ψ with x, y ∈ Cl, c ∈ ZZ, and ✁ ∈ {<, ≤}. This restriction to simple constraints on clocks, and constraints on differences between clocks is used in =-=[8]-=- to show that model checking TAs is decidable. Common model checkers use symbolic semantics based on zones. A zone Z is a maximal set of clock valuations satisfying a constraint from Ψ(Cl). A symbolic... |

1877 |
Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...t, s ′ ) ∈ T } 7 8 Succ ← Succ \ Closed; Open ← Open ∪ Succ return true Fig. 2. General Model Checking Algorithm. Abstraction directed model checking [81] combines model checking based on abstraction =-=[26,74,29]-=- and directed model checking as follows. An initial model checking run is performed on the abstract model. If the property holds, then the model checker returns true. If not, in a directed model check... |

1108 | Temporal and Modal Logic
- Emerson
- 1990
(Show Context)
Citation Context ...ercome this problem. The process of fully-automatic verification is referred to as model checking [27,63]. Given a formal model of a system and a property specification in some form of temporal logic =-=[45]-=-, the task is to validate, whether the specification is satisfied. If not, a model checker returns a counterexample for the system’s flawed behavior, helping the designer to debug the model. The major... |

821 |
A note on two problems in connection with graphs”. Numerische Mathematik, 1:260–271
- Dijkstra
- 1959
(Show Context)
Citation Context ... is called monotone, if for (s, a) ∈ C and (s ′ , b) ∈ C and (s, t, s ′ ) ∈ T , we have a ≼ b. The selection strategy in Dijkstra’s algorithm only considers settled states and monotone cost relations =-=[34]-=-. If it is not monotone, different approaches have been suggested. The main observation is that a cost update has to be executed more than once for a transition. It can be shown that BFS settles at le... |

622 | Model checking and abstraction
- Clarke, Grumberg, et al.
- 1994
(Show Context)
Citation Context ...any homomorphic abstraction as an admissible estimate, where a homomorphic abstraction is an over-approximation, for which each path in the concrete space induces a corresponding path in the abstract =-=[26,74]-=-. Abstractions may contract states into one and merge edges accordingly. More precisely, if we contract states s1 and t1 t2 t1 t2 s2 and there are transitions s1 → s3, s2 → s3 or transitions s3 → s1, ... |

583 |
An automata-theoretic approach to automatic program verification
- Vardi, Wolper
- 1986
(Show Context)
Citation Context ...be used to check ω-regular properties, which properly include propositional LTL [45]. We assume that the reader is familiar with the automaton-based approach to model checking of ω-regular properties =-=[106]-=-. We extend our state space model with a Büchi fairness constraint F ⊆ S to M = (S, T , I, L, F) and restrict the discussion below to the search of a fair lasso-shaped path in M. See also [63,27]. Nes... |

578 |
Introduction to the Numerical Solution of Markov Chains
- Stewart
- 1994
(Show Context)
Citation Context ...this context, systems are usually described as Markov models. The mostly used models are discrete-time Markov chains (DTMCs), continuoustime Markov chains (CTMCs) and Markov Decision Processes (MDPs) =-=[102]-=-. These models can be considered as a labelled transition system extended by transition probabilities. More concretely, in each state a probability distribution describes the probability of firing a p... |

440 |
The SPIN Model Checker, Primer and Reference Manual
- Holzmann
- 2004
(Show Context)
Citation Context .... Testing if a system works as intended becomes increasingly difficult. Formal verification aims to overcome this problem. The process of fully-automatic verification is referred to as model checking =-=[27,63]-=-. Given a formal model of a system and a property specification in some form of temporal logic [45], the task is to validate, whether the specification is satisfied. If not, a model checker returns a ... |

412 | Depth-first iterative-deepening: An optimal admissible tree search
- Korf
- 1985
(Show Context)
Citation Context ... In some cases U = δ(I, B) is already known, the only task is to generate a counterexample matching it. If U is not known, one may adjust U interactively. Automated strategies are iterative-deepening =-=[67]-=- (increasing U by the smallest amount possible), branch-and-bound [69] (decreasing U to the largest value smaller than the latest cost value obtained), or refined threshold determination [107] (an exp... |

412 |
Computer-Aided Verification of Coordinating Processes: The AutomataTheoretic Approach
- Kurshan
- 1994
(Show Context)
Citation Context ...any homomorphic abstraction as an admissible estimate, where a homomorphic abstraction is an over-approximation, for which each path in the concrete space induces a corresponding path in the abstract =-=[26,74]-=-. Abstractions may contract states into one and merge edges accordingly. More precisely, if we contract states s1 and t1 t2 t1 t2 s2 and there are transitions s1 → s3, s2 → s3 or transitions s3 → s1, ... |

325 |
On a routing problem
- Bellman
- 1958
(Show Context)
Citation Context ... shown that BFS settles at least one unsettled state on an optimal path π ∗ in the Open list, such that after |π ∗ | iterations of ModelCheck without re-initializing C the bad state on π ∗ is settled =-=[15]-=-. In k-best first search [49] we select the k least-cost elements from Open and compute their set of successors in common. The algorithm is complete but the counterexample might not be optimal. k-beam... |

290 | Partial-order methods for the verification of concurrent systems. Lecture notes in computer science
- Godefroid
- 1996
(Show Context)
Citation Context ...select a state as the starting point for further SCC decomposition [108]. The approach by [50] extends to other least fixed point computations. 6 Partial Order Reduction Partial order reduction (POR) =-=[52, 80, 104]-=- is one of the most important statespace reduction techniques in explicit state model checking. In this section we discuss how POR can be combined with directed model checking. The only essential diff... |

245 | A logic for reasoning about time and reliability
- Hansson, Jonsson
- 1994
(Show Context)
Citation Context ...n describes the probability of firing a particular transition as the next step of the system. Dependability requirements on such models are usually formulated in a stochastic temporal logic like PCTL =-=[60]-=- in the discrete-time case or CSL [9,10] in the continuous-time case. Model checking of PCTL or CSL formulae relies mainly on numerical methods to solve linear equation systems [102,60,9,10]. A weakne... |

223 |
Efficient model checking in fragments of the propositional mu-calculus
- Emerson, Lei
- 1986
(Show Context)
Citation Context ...eads from sl to sl in π ′ loop also lead from s′ l to s′ l and hits a fair state in between. Standard algorithms in BDD-based model checking, which are typically variants of the Emerson-Lei algorithm =-=[46]-=-, perform a nested fixed point computation, which makes application of heuristics difficult. The idea of using hints has been extended to nested fixed points [20], though with less success than in [87... |

194 | Interpolation and sat-based model checking
- McMillan
- 2003
(Show Context)
Citation Context ...formulation roughly squares the size of the state space, performance of BDD-based symbolic model checking is improved for some examples [96,95]. The method has been applied to SAT-based interpolation =-=[78]-=-, to external distributed explicitstate directed model checking [37], and, independently, to regular model checking [22]. The heuristics should distinguish whether a loop start has been guessed or not... |

189 | Combining partial order reductions with on-the-fly model checking
- Peled
- 1996
(Show Context)
Citation Context ...appropriate translation of the property into a Büchi automaton [98,95] or dedicated algorithms [70]. 116 Partial Order Reduction inria-00406552, version 1 - 22 Jul 2009 Partial order reduction (POR) =-=[104,52,80]-=- is one of the most important statespace reduction techniques in explicit state model checking. In this section we discuss how POR can be combined with directed model checking. The only essential diff... |

128 | Model-Checking algorithms for Continuous-Time Markov Chains
- Baier, Haverkort, et al.
- 2003
(Show Context)
Citation Context ...a particular transition as the next step of the system. Dependability requirements on such models are usually formulated in a stochastic temporal logic like PCTL [60] in the discrete-time case or CSL =-=[9,10]-=- in the continuous-time case. Model checking of PCTL or CSL formulae relies mainly on numerical methods to solve linear equation systems [102,60,9,10]. A weakness of these methods is their inability t... |

127 | Memory efficient algorithms for verification of temporal properties - Courcoubetis, Vardi, et al. - 1992 |

124 | Abstract regular model checking
- Bouajjani, Habermehl, et al.
(Show Context)
Citation Context ...r some examples [96,95]. The method has been applied to SAT-based interpolation [78], to external distributed explicitstate directed model checking [37], and, independently, to regular model checking =-=[22]-=-. The heuristics should distinguish whether a loop start has been guessed or not. If not (step 1), we are effectively in the outer part of a nested search and should seek for promising loop starts. On... |

92 | Timed automata: Semantics, algorithms and tools
- Bengston, Yi
- 2004
(Show Context)
Citation Context ... denoted s ⊆ s ′ , if l = l ′ and v |= Z ⇒ v |= Z ′ . Necessary operations can be effectively realized, using a canonical representation of zones as weighted graph, known as Difference Bound Matrices =-=[16]-=-. Due to the nature of delay, it is possible to reach any reachable state by an alternation of delays and edge transitions (by inserting zero delays or merging successive delays). The length of a coun... |

71 | Algebra and Algorithms for QoS Path Computation and Hop-by-Hop Routing in the Internet
- Sobrinho
- 2001
(Show Context)
Citation Context ...oth of them are either prefixed or appended by a common, third, path. It has been shown that isotonicity is both necessary and sufficient for a generalized Dijkstra’s algorithm to yield optimal paths =-=[101]-=-. 4inria-00406552, version 1 - 22 Jul 2009 The finite state machine (FSM) distance heuristic is based on projecting the system state to the program counter. The abstract state spaces are analyzed pri... |

70 | Directed explicit-state model checking in the validation of communication protocols
- Edelkamp, Leue, et al.
- 2004
(Show Context)
Citation Context ...mploys frontier splitting to keep BDDs small and selects the part of the frontier to be expanded next based on BDD size [50]. Explicit-State Directed Model Checking Edelkamp, Leue, and Lluch-Lafuente =-=[39]-=- coined the term directed model checking and implemented a guided variant of the explicit-state model checker SPIN [63]. In HSF-SPIN, safety violation checking is handled by replacing standard search ... |

70 | On nested depth first search
- Holzmann, Peled, et al.
- 1996
(Show Context)
Citation Context ...so-shaped path in M. See also [63,27]. Nested Depth-First Search The most popular algorithm to search for fair lassoshaped paths in explicit-state model checking is probably nested depth-first search =-=[28,65]-=-. A first DFS finds all reachable states. When backtracking from a fair state it starts a second DFS that tries to close a fair cycle by hitting a state on the stack of the first DFS. When that happen... |

66 | Iterative broadening
- Ginsberg, Harvey
- 1992
(Show Context)
Citation Context ...n that are not among the k best ones. In this case, completeness is sacrificed to search for errors in larger models. By iteratively performing k-beam search with larger k we get iterative-broadening =-=[51]-=-, by which we gain back completeness. Guided Forward Reachability All exploration variants of the general model checking algorithm that we have seen so far are blind in the sense, that they do not inc... |

64 |
High-density reachability analysis
- Ravi, Somenzi
- 1995
(Show Context)
Citation Context ...ting an element of DFS into the default BFS exploration mode can help to alleviate that problem. When the BDD holding the current search frontier becomes too large, high-density reachability analysis =-=[85]-=- prunes away states that require relatively more BDD nodes to represent than the other states, i.e., to increase the ratio of states per BDD node. When the search frontier becomes empty the whole set ... |

63 | Flexible abstraction heuristics for optimal sequential planning
- Helmert, Haslum, et al.
- 2007
(Show Context)
Citation Context ... most visible books like “Model Checking” [27] and surveys like “25 Years of Model Checking” [53]. The currently envisioned future of directed model checking includes the design of refined heuristics =-=[62,61]-=-, relevance analysis to detect helpful and useless transitions [109], local search alternatives such as randomized guided search [90]. large-scale disk-based search with refined delayed duplicate elim... |

62 | Validation with guided search of the state space - Yang, Dill - 1998 |

61 |
The Harpy Speech Recognition System
- Lowerre
- 1976
(Show Context)
Citation Context ...functional model checking can be very useful for finding schedules. Examples of such algorithms are nearest neighbour heuristic, which follows a single trace based on cumulated costs, and beam search =-=[77,89]-=-, which follows up to β traces, using cumulated costs and estimations. In functional model checking, if such searches do not return a counterexample, it is no guarantee that the property holds. In ‘ba... |

59 | Partial-order reduction in symbolic state space exploration
- Alur, Brayton, et al.
- 1997
(Show Context)
Citation Context ...m (state space) because of closing cycles during the search. The classical versions of the cycle proviso in standard model checking are closely dependent on the search order - usually DFS [52] or BFS =-=[7]-=-. Because of that they are not applicable in directed model checking. The proviso that we use to make POR compatible with directed model checking is inspired by the general search order proviso presen... |

59 |
Model-checking continuous-time markov chains
- Aziz, Sanwal, et al.
- 2000
(Show Context)
Citation Context ...a particular transition as the next step of the system. Dependability requirements on such models are usually formulated in a stochastic temporal logic like PCTL [60] in the discrete-time case or CSL =-=[9,10]-=- in the continuous-time case. Model checking of PCTL or CSL formulae relies mainly on numerical methods to solve linear equation systems [102,60,9,10]. A weakness of these methods is their inability t... |

57 | Scheduling a steel plant with timed automata
- Fehnker
- 1999
(Show Context)
Citation Context ...tools Spin, Cadp and Uppaal Cora. In recent years, model checkers have been applied to solving combinatorial optimization problems. In particular, scheduling problems have been considered often, e.g. =-=[1,13,14,24,25,48,92,103,110,111,112]-=-. The approach here is to interpret the problem as a reachability problem, where the question is, in a system where transitions have costs, what the minimal necessary cost is to reach a state in B, wh... |

54 | Efficient memory-bounded search methods
- Russell
- 1992
(Show Context)
Citation Context ...U to the largest value smaller than the latest cost value obtained), or refined threshold determination [107] (an exponential or binary search compromise between the two). In memory-limited A* search =-=[91]-=-, full duplicate elimination in the Closedlist is sacrificed in order to gain space. U can control the memory needs. If the cost-updates do not preserve monotonicity, the cost values of some states in... |

45 | Artificial intelligence - Shapiro - 1992 |

44 | Planning as Search
- Korf
- 1987
(Show Context)
Citation Context ...nd it tends to take up most space. In Fig. 4 we show a pseudo-code implementation of frontier search that has shown significant improvements in solving action planning and sequence alignment problems =-=[68]-=-. The assumption here is that not the entire set of states needs to be stored completely for detecting an error. How many layers are sufficient for full duplicate detection in general is dependent on ... |

42 | Liveness checking as safety checking
- Biere, Artho, et al.
- 2002
(Show Context)
Citation Context ...kes the algorithms in Sect. 4 available for all ω-regular properties. Here, we consider the state-recording translation that reformulates the problem of finding a fair lasso as a reachability problem =-=[18,96,97,95]-=-. The translation extends the original model with a copy for each state variable and a number of flags. It splits the search for a fair lasso into 3 steps: (1) non-deterministically guess and record a... |

41 | Breadth-first heuristic search
- Zhou, Hansen
(Show Context)
Citation Context ...nd frontier search often results in a smaller search frontier than best-first branchand-bound frontier search. In AI literature, the according search strategy is called breadth-first heuristic search =-=[114]-=-. In beam-stack-search this strategy has been extended to feature partial state selection [115]. For such memory-limited frontier search, (divide-and-conquer) solution reconstruction is needed, for wh... |

40 |
Optimal scheduling using priced timed automata
- Behrmann, Larsen, et al.
- 2005
(Show Context)
Citation Context ...tools Spin, Cadp and Uppaal Cora. In recent years, model checkers have been applied to solving combinatorial optimization problems. In particular, scheduling problems have been considered often, e.g. =-=[1,13,14,24,25,48,92,103,110,111,112]-=-. The approach here is to interpret the problem as a reachability problem, where the question is, in a system where transitions have costs, what the minimal necessary cost is to reach a state in B, wh... |

40 | Efficient decision procedures for model checking of linear time logic properties
- Bloem, Ravi, et al.
- 1999
(Show Context)
Citation Context ...variants of the Emerson-Lei algorithm [46], perform a nested fixed point computation, which makes application of heuristics difficult. The idea of using hints has been extended to nested fixed points =-=[20]-=-, though with less success than in [87]. CTL is covered in [21]. In the context of an SCC enumeration algorithm a prioritization was used based on the distance of states to the origin and on the numbe... |

40 | OBDDs in heuristic search
- Edelkamp, el
- 1998
(Show Context)
Citation Context ... s ′ . We use the shorthand notation s t → s ′ . When analyzing safety properties we additionally assume a set of bad states B ⊆ S. inria-00406552, version 1 - 22 Jul 2009 Cost algebras Cost algebras =-=[38]-=- generalize edge weights to more general cost structures. A cost algebra is defined as 〈A, ×, ≼, 0, 1〉, such that 〈A, ×, 1〉, is a monoid, ≼ is a total order, 0 = ⊓A and 1 = ⊔A, and A is isotone1 . Int... |

38 | Symbolic pattern databases in heuristic search planning
- Edelkamp
- 2002
(Show Context)
Citation Context ...ad states are stored with each state in a hash table. For a better time-space trade-off it is possible to fully traverse the abstract state space symbolically, yielding symbolic abstraction databases =-=[36]-=-. 5Model Checking Problem Abstraction Directed Model Checking Abstraction Abstract Model Checking Problem Abstract Model Checking Failure Directed Model Checking Success Success Failure inria-0040655... |

37 | O.: Scheduling with timed automata
- Abdeddaim, Asarin, et al.
(Show Context)
Citation Context ...n used to select the best (the least) amongst values. Consider for example, the following instances of cost algebras: 〈IR + ∪{+∞}, +, ≤, +∞, 0〉 (optimization), 〈IR + ∪{+∞}, min, ≥, 0, +∞〉 (max/min), 〈=-=[0, 1]-=-, ·, ≥, 0, 1〉 (probabilistic), or 〈[0, 1], min, ≥, 0, 1〉 (fuzzy). Not all algebras are isotone, e.g. take A ⊆ IR × IR with (a, c) × (b, d) = (min{a, b}, c + d) and (a, c) ≼ (b, d) if a > b or c < d if... |

34 | Efficient guiding towards cost-optimality in UPPAAL
- Behrmann, Fehnker, et al.
- 2001
(Show Context)
Citation Context ...bles called clocks to capture delays and timing constraints. Directed model checking for TAs was developed parallel to directed model checking for finite systems, and was coined guided model checking =-=[13]-=-. These techniques have been successfully applied to several case studies and were implemented in the directed model checker for timed automata MCTA [71,73] and added to the existing model checker UPP... |

34 | Unifying the causal graph and additive heuristics
- Helmert, Geffner
- 2008
(Show Context)
Citation Context ... most visible books like “Model Checking” [27] and surveys like “25 Years of Model Checking” [53]. The currently envisioned future of directed model checking includes the design of refined heuristics =-=[62,61]-=-, relevance analysis to detect helpful and useless transitions [109], local search alternatives such as randomized guided search [90]. large-scale disk-based search with refined delayed duplicate elim... |

32 | Symbolic guided search for CTL model checking
- Bloem, Ravi, et al.
- 2000
(Show Context)
Citation Context ...xed point computation, which makes application of heuristics difficult. The idea of using hints has been extended to nested fixed points [20], though with less success than in [87]. CTL is covered in =-=[21]-=-. In the context of an SCC enumeration algorithm a prioritization was used based on the distance of states to the origin and on the number of fairness constraints they fulfill to select a state as the... |

29 | The Design of a Multicore Extension of the SPIN Model Checker - Holzmann, Bosnacki |

29 |
Viewing scheduling as an opportunistic problem-solving process
- Ow, Smith
- 1988
(Show Context)
Citation Context ...tion, with beam search, we can also counter this problem by increasing β, but of course, the penalty of this is less pruning. Beam search (BS) has been applied to a whole range of scheduling problems =-=[31,93,100,103,111,112]-=-. Two variants of BS are considered most classic: detailed and priority BS. Both versions use a beam width, to indicate the maximum number of states which may be expanded in each level of M. Detailed ... |

25 |
Hints to accelerate symbolic traversal
- Ravi, Somenzi
- 1999
(Show Context)
Citation Context ...o bring the states back in that have been pruned away. As this step frequently exhausts the available resources, [86] suggests some alternatives, e.g., storing the pruned states in a separate BDD. In =-=[87]-=- user-supplied hints are used to restrict the transition relation such that parts of the state space are avoided at first that are presumed to lead to a blowup and only added towards the end of the tr... |

23 | Efficient reduction of finite state model checking to reachability analysis
- Schuppan, Biere
(Show Context)
Citation Context ...kes the algorithms in Sect. 4 available for all ω-regular properties. Here, we consider the state-recording translation that reformulates the problem of finding a fair lasso as a reachability problem =-=[18,96,97,95]-=-. The translation extends the original model with a copy for each state variable and a number of flags. It splits the search for a fair lasso into 3 steps: (1) non-deterministically guess and record a... |

23 | A result on the computational complexity of heuristic estimates for the A∗ algorithm
- Valtorta
- 1984
(Show Context)
Citation Context ...mal solution and can be omitted. It is not difficult to see that such abstraction heuristics are consistent. Unfortunately, re-computing the heuristic estimate from scratch cannot speed-up the search =-=[105]-=-. A solution is to completely evaluate the abstract space prior to the search in the concrete space. For a model M with abstraction ˆ M, an abstraction database [83,41] is a lookup table indexed by ˆs... |