Family-based model checking using off-the-shelf model checkers: extended abstract

Model checking provides a convenient way to check whether a given software system is correct with respect to a set of relevant semantic properties. To use a model checker like SPIN [5], the software system must be modelled as a transition system (TS). Afterwards, the model checker can check the correctness of the translated TS by exhaustively exploring all possible transitions.

For families of software systems Classen et al. [1] present a lifted model checker SNIP, where each family is modelled as a Featured TS [2] that has transitions guarded by feature expressions. SNIP is highly specialized and uses heuristics to avoid naïvely iterating through all possible variations; however, the number of configurations is still exponential in size and thus the model checker can only feasibly handle systems of a limited size.

We adapt our previous work on applying variability abstraction to lifted data-flow analysis [3] to the setting of lifted model checking. We present a calculus of variability abstractions that trade precision for speed while preserving correctness [4]. The abstractions work symbiotically with the lifted model checker SNIP, but can also work with the classical and efficient off-the-shelf model checker SPIN without requiring any knowledge of variability. We prove semantically how each abstraction operation in the calculus forms a Galois collection, and therefore is suitable to use in abstract interpretation of Featured TS. Furthermore, we present an equivalent lightweight syntactic transformation tool that works directly on the input text files and does not require explicitly constructing the corresponding Featured TS in memory.

Our results show that there are orders of magnitudes to be gained in performance compared to performing lifted analysis alone; we show how our tool scales better than the existing tools and makes analysing some previously infeasible models feasible. Furthermore, we also show that many models could be verified swiftly using the abstracted analysis without requiring all of the precision that a concrete analysis provides.