Symmetry and induction in model checking

Abstract

Model checking is a technique for determining whether a finite state-transition system satisfies a specification expressed in temporal logic. It has been used successfully to verify a number of highly complex circuit and protocol designs. A major hurdle in using this approach to verify realistic designs is the state explosion problem. This problem tends to occur when the number of state variables is very large. In this paper we discuss two techniques for handling this problem. The first technique is based on exploiting symmetry in the state-transition graph. We show how to construct a reduced quotient graph that satisfies the same temporal properties as the original graph. The second technique applies to systems that can have an arbitrary number of processes. In this case induction at the process level can be used to avoid the state explosion problem. An invariant process can frequently be found whose correctness implies the correctness of the system. We describe several methods for finding such an invariant process when one exists.

This research was sponsored in part by the Avionics Laboratory, Wright Research and Development Center, Aeronautical Systems Division (AFSC), U.S. Air Force, Wright-Patterson AFB, Ohio 45433-6543 under Contract F33615-90-C-1465, ARPA Order No. 7597 and in part by the National Science Foundation under Grant no. CCR-8722633 and in part by the Semiconductor Research Corporation under Contract 92-DJ-294.

The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the U.S. government.