Reachability checking in complex and concurrent software systems using intelligent search methods

Software system verification is an efficient technique for ensuring the correctness of a software product, especially in safety-critical systems in which a small bug may have disastrous consequences. The goal of software verification is to ensure that the product fulfills the requirements. Studies show that the cost of finding and fixing errors in design time is less than finding and fixing them after implementation. One of the most efficient formal verification techniques is model checking. Model checking is an automated approach to verify different properties on formal models and before implementation. In model checking techniques, a model should be designed along with the essential properties of the system to be checked. These properties are usually specified through temporal logic. Both the formal model and the properties are fed into a model checker as its input. Then, the model checker generates all reachable state (state space) automatically. By searching the state space, model checkers verify the property. One of the main problems of model checking techniques is that in complex systems, the state space is too large or even infinitely grows. This problem is called the state space explosion. State space explosion problem usually occurs due to computational resource limitations, and it prevents model checker from working correctly. In this paper, we propose an efficient approach to verify reachability properties in complex systems. The proposed method avoid state space explosion by partially and intelligently exploring state space. To do so, a small model of the system is generated, and the state space is explored entirely. Then, the reachability property is checked on the state space to find the goal state. After finding the goal states, all paths from the initial state leading to the goal state are labeled to distinguish between paths that are leading to the goal state and those who are not. The labeled paths are fed to the ensemble machine learning algorithm to detect logical relations among paths and also the existing knowledge in the state space. The acquired knowledge is used to partially and intelligently explore the state space of the main model for reachability analysis. This main model is larger and more complex than the smaller one. The machine learning algorithm used in the proposed solution is based on decision trees with sampling and replacement. In this learning method, after building T decision trees, T predictive models are also generated. Finally, using a voting mechanism, labels of paths in the state space of the main model is determined. This learning technique misbehaves in the cases in which at least half of the predictive models are wrong. This technique is better learned in comparison with the individual learning mechanisms. It also can detect more complicated relations in the state space. The proposed approach is implemented in GROOVE, which is an open-source toolset for designing and model checking of graph transformation systems. Our experiments show a better performance in terms of speed and memory usage in comparison with the other approaches. Our approach uses 42% less memory on average in comparison with the existing methods. It also generates 20% shorter witnesses, on average.