Lecture Notes in Computer Science 3472

560 Therese Berg and Harald Raffelt
19.3 Model Checking
In the last few years model checking has become a powerful and promising approach
to automatic verification of systems. In general a model checker is a
tool which checks whether a given structure M (called model) satisfies a certain
logical constraint φ (called property). Typically models are represented by
finite automata-like structures and properties are described in temporal logic.
In contrast to conventional logics in temporal logics it is possible to describe
temporal dependencies like one action must take place before another one. The
model checker either confirms that the properties hold or reports that they are
not satisfied by the model. Some model checkers can produce a path in the
model which does not satisfy the property, a so called counterexample. Counterexamples
can be understood as a reason for the unsatisfied property. Besides
from providing models and properties no further user interaction is necessary for
the entire model checking process. Because of its push-button approach model
checking is a powerful verification tool even in large environments like hardware
verification.
In Section 19.3.1 we give a brief introduction to models used to describe
systems for model checking purposes and in Section 19.3.2 some common formalisms
to describe properties of systems are provided. In Section 19.3.3 a common
automata-theoretic model-checking algorithm is presented in detail.
19.3.1 Models
Model-checking typically depends on a discrete model of a system which describes
the system behavior. Usually these models are graph structures where
nodes represent the states of the system and edges represent transitions between
the states. For model checking purposes these structures are typically finite, but
model checking infinite structures is also possible [BCMS01]. These graphs without
any further annotation are not expressive enough to provide an interesting
description of the system. Two approaches are in common use: Kripke structures,
where the nodes are annotated with so called atomic propositions, and
labeled transition systems where the edges are annotated with so called actions.
These two descriptions can be combined into so called Kripke transition systems
[MOSS99].
In the following we present an introduction into Kripke structures. An introduction
into labeled transition systems can be found in Section 22.
Definition 19.5. A Kripke structure (KS) overasetAP of atomic propositions
is a triple (S, R, I ), where
• S is a set of states,
• R ⊆ S × S is a transitions relation and,
• I : S → 2 AP is a labeling function
Each proposition describes a basic local property of the systems states. To
each state of the system a set of atomic propositions is assigned by the labeling