Heuristic Model Checking for Java Programs

Abstract

Two recent areas of interest in software model checking are checking programs written in standard programming languages [1],[5] and using heuristics to guide the exploration of an explicit-state model checker [3]. Model checking real programs has the drawback that programs often contain a larger degree of detail than designs and hence are more dificult to check (due to the more acute stateexplosion problem); however the large amount of detail in a program allows more precise heuristics for narrowing down the search space when using a model checker for error-detection. This paper describes the addition of support for heuristic (or directed) search strategies to Java PathFinder (JPF), an explicit state model checker for Java bytecode that uses a custom-made Java Virtual Machine (JVM) [5].

The primary benefits of heuristic search are: discovery of errors that a depth- first search fails to find, and shorter (and thus easier to understand and correct) counterexample paths. In JPF a number of pre-defined heuristics are provided, but a user can also write their own by using an interface to the JVM. The rest of the paper is structured as follows: in section 2 we illustrate JPFs heuristic capabilities by showing two novel predefined heuristics as well as a simple userde fined heuristic, in section 3 we give results of using JPF with heuristics and in section 4 be briefly sketch some future work.