Our growing dependence on increasingly complex computer and software systems necessitates the development of formalisms, techniques, and tools for assessing functional properties of these systems. One such technique that has emerged in the last twenty years is model checking, which systematically (and automatically) checks whether a model of a given system satisfies a desired property such as deadlock freedom, invariants, and request-response properties. This automated technique for verification and debugging has developed into a mature and widely used approach with many applications. Principles of Model Checking offers a comprehensive introduction to model checking that is not only a text suitable for classroom use but also a valuable reference for researchers and practitioners in the field. The book begins with the basic principles for modeling concurrent and communicating systems, introduces different classes of properties (including safety and liveness), presents the notion of fairness, and provides automata-based algorithms for these properties. It introduces the temporal logics LTL and CTL, compares them, and covers algorithms for verifying these logics, discussing real-time systems as well as systems subject to random phenomena. Separate chapters treat such efficiency-improving techniques as abstraction and symbolic manipulation. The book includes an extensive set of examples (most of which run through several chapters) and a complete set of basic results accompanied by detailed proofs. Each chapter concludes with a summary, bibliographic notes, and an extensive list of exercises of both practical and theoretical nature.

/pdf/principles-of-model-checking-249iimickz.pdf

Principles of Model Checking

SPIN is an efficient verification system for models of distributed software systems. It has been used to detect design errors in applications ranging from high-level descriptions of distributed algorithms to detailed code for controlling telephone exchanges. The paper gives an overview of the design and structure of the verifier, reviews its theoretical foundation, and gives an overview of significant practical applications.

/pdf/the-model-checker-spin-1bgo4jtefp.pdf

The model checker SPIN

The majority of the work carried out in the formal methods community throughout the last three decades has (for good reasons) been devoted to special languages designed to make it easier to experiment with mechanized formal methods such as theorem provers and model checkers. In this paper, we give arguments for why we believe it is time for the formal methods community to shift some of its attention towards the analysis of programs written in modern programming languages. In keeping with this philosophy, we have developed a verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing. Part of this work has consisted of building a new Java Virtual Machine that interprets Java bytecode. JPF uses state compression to handle large states, and partial order reduction, slicing, abstraction and run-time analysis techniques to reduce the state space. JPF has been applied to a real-time avionics operating system developed at Honeywell, illustrating an intricate error, and to a model of a spacecraft controller, illustrating the combination of abstraction, run-time analysis and slicing with model checking.

/pdf/model-checking-programs-292m6fh3ut.pdf

Model checking programs

Verification by state-space exploration, also often referred to as "model checking", is an effective method for analyzing the correctness of concurrent reactive systems (e.g., communication protocols). Unfortunately, existing model-checking techniques are restricted to the verification of properties of models, i.e., abstractions, of concurrent systems.In this paper, we discuss how model checking can be extended to deal directly with "actual" descriptions of concurrent systems, e.g., implementations of communication protocols written in programming languages such as C or C++. We then introduce a new search technique that is suitable for exploring the state spaces of such systems. This algorithm has been implemented in VeriSoft, a tool for systematically exploring the state spaces of systems composed of several concurrent processes executing arbitrary C code. As an example of application, we describe how VeriSoft successfully discovered an error in a 2500-line C program controlling robots operating in an unpredictable environment.

Model checking for programming languages using VeriSoft

We present a new approach to partial-order reduction for model checking software. This approach is based on initially exploring an arbitrary interleaving of the various concurrent processes/threads, and dynamically tracking interactions between these to identify backtracking points where alternative paths in the state space need to be explored. We present examples of multi-threaded programs where our new dynamic partial-order reduction technique significantly reduces the search space, even though traditional partial-order algorithms are helpless.

/pdf/dynamic-partial-order-reduction-for-model-checking-software-1ioo5wzpfm.pdf

Dynamic partial-order reduction for model checking software

Concurrent systems and semantics.- Using partial orders to tackle state explosion.- Persistent sets.- Sleep sets.- Verification of safety properties.- Model checking.- Experiments.- Conclusions.

Partial-Order Methods for the Verification of Concurrent Systems: An Approach to the State-Explosion Problem

An object-oriented framework for temporal data models.- An architecture for supporting interoperability among temporal databases.- Extended update functionality in temporal databases.- On transaction management in temporal databases.- Implementation options for time-series data.- Expressive power of temporal relational query languages and temporal completeness.- Transitioning temporal support in TSQL2 to SQL3.- Valid time and transaction time proposals: Language design aspects.- Point-based temporal extensions of SQL and their efficient implementation.- Applicability of temporal data models to query multilevel security databases: A case study.- An architecture and construction of a business event manager.- Discovering unexpected patterns in temporal data using temporal logic.- Querying the uncertain position of moving objects.- Temporal database bibliography update.- The consensus glossary of temporal database concepts - February 1998 version.- A glossary of time granularity concepts.

Temporal Databases: Research and Practice

1 Introduction.- 2 Preliminaries.- 3 The Design of RML.- 4 Examples.- 5 Implementation Overview.- 6 Reducing Nondeterminism.- 7 Compiling Pattern Matching.- 8 Compiling Continuations.- 9 Simulating Tailcalls in C.- 10 Performance Evaluation.- 11. Concluding Remarks.- A. The Definition of RML.

Compiling Natural Semantics

Incremental computation concerns the re-computation of output after a change in the input. Incremental algorithms, also called dynamic or on-line algorithms, process a change in the input by identifying the "affected output", that is, the part of the previous output that is no longer "correct", and "updating" it.
This thesis presents results--upper bound results, lower bound results, and experimental results--for several incremental computation problems. The common theme in all these results is that the complexity of an algorithm or problem is analyzed in terms of a parameter $\Vert\delta\Vert$ that measures the size of the change in the input and output. An incremental algorithm is said to be bounded if the time it takes to update the output depends only on the size of the change in the input and output (i.e., $\Vert\delta\Vert),$ and not on the size of the entire current input. A problem is said to be bounded (unbounded) if it has (does not have) a bounded incremental algorithm. The results in this thesis, summarized below, illustrate a complexity hierarchy for incremental computation from this point of view.
We present $O(\Vert\delta\Vert\log\Vert\delta\Vert)$ incremental algorithms for several shortest-path problems and a generalization of the shortest-path problem, establishing that these problems are polynomially bounded.
We present an $O(2\sp{\Vert\delta\Vert})$ incremental algorithm for the circuit value annotation problem, which matches a previous $\Omega(2\sp{\Vert\delta\Vert})$ lower bound for this problem and establishes that the circuit value annotation problem is exponentially bounded. We also present experimental results that show that our algorithm, in spite of a worst-case complexity of $\Theta(2\sp{\Vert\delta\Vert}),$ appears to work well in practice.
We present lower bounds showing that a number of problems, including graph reachability, dataflow analysis, and algebraic path problems, are unbounded with respect to a model of computation called the sparsely-aliasing pointer machine model.
We present an $O(\Vert\delta\Vert\log\ n)$ incremental algorithm for the reachability problem in reducible flowgraphs, and an algorithm for maintaining the dominator tree of a reducible flowgraph.

Bounded incremental computation

Communication mechanisms used in practice.- Terminology.- to store-and-forward routing.- The routing number.- Offline routing protocols.- Oblivious routing protocols.- Adaptive routing protocols.- Compact routing protocols.- to wormhole routing.- Oblivious routing protocols.- Protocols for all-optical networks.- Summary and future directions.

J. Van Leeuwen

Papers

Partial-Order Methods for the Verification of Concurrent Systems: An Approach to the State-Explosion Problem

Temporal Databases: Research and Practice

Compiling Natural Semantics

Bounded incremental computation

Universal Routing Strategies for Interconnection Networks