Assume-Guarantee Model Checking

We present assume-guarantee model checking, a novel technique for verifying correctness properties of loosely-coupled multithreaded software systems. Assume-guarantee model checking verifies each thread of a multithreaded system separately by constraining the actions of other threads with an automatically inferred environment assumption. Separate verification of each thread allows the enumeration of the local state of only one thread at a time, thereby yieldig significant savings in the time and space needed for model checking. Suppose G is the size of the global store, L the size of the local store per thread, and n the number of threads. If each thread is finite-state (without a stack), the naive model checking algorithm is O(n.G.L) whereas assume-guarantee model checking is O(n.G.L.(n + L)). If each thread has a stack, the reachability problem is undecidable. However, assume-guarantee model checking terminates in time O(n.G.L.F ) where F is the number of stack symbols.