On improving efficiency of model checking through systematically ...

asynchronous reader/writer algorithm can be verified using our approach.
Unfortunately, Uppaal could not finish the verification on the Fischer’s protocol
and Subway system before memory resource was exhausted. These
results are unsatisfactory since we aim at the verification on such complex
systems.
We now try to answer the first research question of this thesis, which
asked: “What are the practical benefits of combining Nbac and PMC/Uppaal
using such systematic approach ”.
Frankly, the practical benefits of using Nbac abstract models in verification
done by Uppaal 1 are not clear, since those abstract models are unverifiable.
Although we could successfully verify the tiny example and the
asynchronous reader/writer algorithm, no conclusions can be drawn about
efficiency of the verification due to the fact that these two systems are quite
small and thus the differences in performance between verification using the
combination approach and using only Uppaal are insignificant.
The unsatisfactory experimental results bring us to the second research
question of this thesis, which asked “How can we drive Nbac to generate the
right abstract model to achieve the best efficiency in terms of accuracy of
verification results and the scalability of systems that can be verified ”.
To answer the second question, efforts have been made to determine the
reasons for large state space created from Nbac abstract models. Remind
that an Nbac abstract model contains an automaton specifying an execution
loop around the good location(s) if the system does not violate the safety
property. Taking into account that fact, we measured the memory usage to
estimate the size of state space and the way the consumption of memory
resource grew after every iterations. It turned out that the memory usage
increased very quickly when we incremented the number of iterations.
After analyzing a model and its simulation, we believe that the reasons
for the state space explosion of model checking using our combination approach
are the following:
1. The infinite characteristic of the model. This is caused by the presence
of unbounded Integer variables in the model.
2. The way Uppaal treats such infinite model in verification. The infinite
model makes Uppaal search until it reaches the bounded Integer
value. In complicated systems like the Subway system, memory resource
is exhausted before Uppaal can reach that boundary and give
a conclusive result.
1 PMC was not involved in our experiments
59