Masaryk University, Faculty of Informatics PhD Thesis Automating Software Development with Explicit Model Checking Author: Supervisor: Petr Bauch Jiˇr´ı Barnat Signature: Signature: Brno, 2015 a i Acknowledgements The idea to combine explicit and symbolic approaches to model checking was bestowed upon me by my thesis supervisor, Jiˇr´ıBarnat, for which I will remain forever grateful to him. We have been discussing the topic at length on numerous occasions, always arriving at a new inspiration for further progress. Each of my earlier doubts was shattered and every found obstacle overcome by his help. My previous supervisor, LuboˇsBrim, introduced the idea of analysing requirements without models, which gave me my first experience with autonomous scientific work: an invaluable experience. Yet even greater influence on me had his course on the Dijkstra's method. There was the first spark, my falling for the formal methods. Equally grateful I am to all members of the ParaDiSe and Sybila laboratories, both present and past, for creating an atmosphere which was as friendly as it was inspiring. Finally, I would like to give credit to students that helped me implement some of the ideas I had { Vojtˇech Havel and Jan Tuˇsil{ since their coding skills surpass mine I was able to learn from them as much as they learnt from me. ii a iii Summary In the last decade it became a common practice to formalise software requirements to improve the clarity of users' expectations. This thesis builds on the fact that functional requirements can be expressed in temporal logic and we propose new means of verifying the requirements themselves and the compliance to those requirements throughout the development process. The goal is the automation of some of the verification processes currently employed in software development. The tool is the automata-based, explicit-state model checking. With respect to requirements, we propose new techniques that automatically detect flaws and suggest improvements of given requirements. Specifically, we describe and experimentally evaluate approaches to consistency and redundancy checking that identify all inconsistencies and pinpoint their exact source (the smallest inconsistent set). We further report on the experience obtained from employing the consistency and redundancy checking in an industrial environment. To complete the sanity checking we also describe a semi-automatic completeness evaluation that can assess the coverage of user requirements and suggest missing properties the user might have wanted to formulate. The usefulness of our completeness evaluation is demonstrated in a case study of an aeroplane control system. With respect to compliance to requirements, we propose extending the explicit model checking to scale to more realistic programs. Automatic verification of programs and computer systems with data non-determinism (e.g. reading from user input) represents a significant and well-motivated challenge. The case of Simulink diagrams is especially difficult, because there the inputs are read iteratively and the number of input variables is in theory unbounded. The case of parallel programs is difficult in a different way, because then also the control flow non- trivially complicates the verification process. We apply the techniques of explicit-state model checking to account for the control aspects of verified programs and use set-based reduction of the data flow, thus handling the two sources of non-determinism separately. We evaluate a number of representation of sets in scalability with respect to the range of input variables. Explicit (enumerating) sets are very fast for small ranges but fail to scale. Symbolic sets, represented as first-order formulae in the bit-vector theory and compared using satisfiability modulo theory solvers, scale well to arbitrary (though still bounded) range of input variables. Binary decision diagrams dominate in both space and time complexities, but only if we limit the scope to linear arithmetic and a relatively small number of variables. We build the theory of set-based reduction using first-order formulae in the bit-vector theory to encode the sets of variable evaluations representing program data. These repre- sentations are tested for emptiness and equality (state matching) during the verification and we harness modern satisfiability modulo theories solvers to implement these tests. We de- sign two methods of implementing the state matching, one using quantifiers and one which is quantifier-free, and we provide both analytical and experimental comparison. Further ex- periments evaluate the efficiency of the set-based reduction showing the classical, explicit approach to fail to scale with the size of data domains. Finally, we report on the development of a generic framework for automatic verification of linear temporal logic specifications for programs in LLVM bitcode. To evaluate the framework we compare our method with state-of-the-art tools on a set of unmodified C programs. iv Abstract This thesis builds on the fact that functional requirements can be expressed in temporal logic and we propose new means of verifying the requirements themselves and the compliance to those requirements throughout the development process. The goal is the automation of some of the verification processes currently employed in software development. The tool is the automata-based, explicit-state model checking. With respect to requirements, we propose new techniques that automatically detect flaws and suggest improvements of given require- ments. Specifically, we describe and experimentally evaluate approaches to consistency and redundancy checking that identify all inconsistencies and pinpoint their exact source (the smallest inconsistent set). With respect to compliance to requirements, we propose extending the explicit model checking to scale to more realistic programs. We apply the techniques of explicit-state model checking to account for the control aspects of verified programs and use set-based reduction of the data flow, thus handling the two sources of non-determinism separately. We build the theory of set-based reduction using first-order formulae in the bit- vector theory to encode the sets of variable evaluations representing program data. These representations are tested for emptiness and equality (state matching) during the verification and we harness modern satisfiability modulo theories solvers to implement these tests. Our experiments evaluate the efficiency of the set-based reduction showing the classical, explicit approach to fail to scale with the size of data domains. v Contents 1 Introduction1 1.1 Software Development Cycle............................1 1.2 Model Checking...................................4 1.3 Sanity Checking..................................7 1.4 Case Study: Simulink Diagrams..........................7 1.5 Contribution....................................9 1.5.1 Model-Free Sanity Checking........................ 10 1.5.2 Control Explicit|Data Symbolic Model Checking........... 10 1.5.3 Verification Platform............................ 11 1.5.4 Thesis Content............................... 12 1.5.5 Author's Other Publications....................... 14 2 Related Work 17 2.1 Control Explicit|Data Symbolic Model Checking............... 17 2.1.1 Symbolic Representations......................... 18 2.1.2 Bit-Precise LTL Model Checking of Parallel Programs with Inputs.. 19 2.1.3 State Space Reduction by Control-Flow Aggregation.......... 21 2.1.4 Combinations of Explicit and Symbolic Approaches.......... 22 2.2 Model-free Sanity Checking............................ 22 2.3 Verification of Simulink Diagrams......................... 24 2.4 LTL Verification of Parallel LLVM Programs.................. 26 3 Preliminaries 29 3.1 First-Order Theory of Bit-Vectors........................ 29 3.2 Control Flow Graphs................................ 31 3.3 LTL Model Checking................................ 34 3.3.1 Explicit-State Model Checking...................... 35 3.4 Sanity Checking.................................. 37 4 Checking Sanity of Software Requirements 39 4.1 Consistency and Redundancy........................... 39 4.1.1 Implementation of Consistency Checking................ 42 4.2 Completeness of Requirements.......................... 45 4.3 Sanity Checking Experiments........................... 48 4.3.1 Generated Requirements.......................... 48 4.3.2 Case Study: Aeroplane Control System................. 49 vi 4.3.3 Industrial Evaluation............................ 54 4.4 Closing Remarks.................................. 55 4.4.1 Alternative LTL to B¨uchi Translation.................. 57 5 Control Explicit|Data Symbolic Model Checking 59 5.1 Set-Based Reduction................................ 59 5.2 Symbolic Representation.............................. 65 5.3 Storing and Searching............................... 70 5.3.1 Linear Storage............................... 71 5.3.2 Explicating Variables............................ 71 5.3.3 Witness-Based Matching Resolution................... 72 5.4 Model Checking Algorithm............................ 73 5.4.1 Counterexamples.............................. 77 5.4.2 Deadlocks.................................. 78 5.4.3 Witnesses.................................. 78 6 Verification of Simulink Designs 81 6.1 Theory of Simulink Verification.......................... 81 6.1.1 Verification with Explicit Sets....................... 83 6.1.2 SAT-Based Verification.......................... 84 6.1.3 Hybrid Representation..........................