# Software verification based on linear programming

## Abstract

We introduce a new software verification method based on plain linear programming. The problematic is being given a software S and a property *P*, to find whether there exists a path (i.e. a test sequence) of *S* satisfying *P*, or a proof that *P* is impossible to satisfy. The software S is modelized as a set of communicating automata which in turn is translated into a system of linear equations in positive numbers. Property *P* is then translated as extra linear equations added to this system.

We define the extended notion of flow-path (which includes the notion of path) permitting the automata to carry flows of data rather than undividable tokens. By applying linear programming in a sophisticated way to the linear system, it is possible, in time polynomial in the size of (*S;P*), either to display a flow-path of *S* satisfying *P* or to prove that *P* is impossible to satisfy.

The existence of a flow-path does not always imply the existence of a path, as it can be non-integer valued. Yet, on all our modelized examples, the study of the flow-path solution always permitted either to display a path satisfying *P* or to underscore a reason proving *P* to be impossible to satisfy.

The first part of this document introduces the theoretical background of our method. The second part sums up results of the use of our method on some systems of industrial size.

## Keywords

software concurrent program distributed system formal verification validation simulation test case generation proof linear programming integer programming## References

- [Abr95]J-R. Abrial.
*The B-book*. Cambridge University Press, 1995.Google Scholar - [CA95]James C. Corbett and Georges S. Avrunin. Using integer programming to verify general safety and liveness properties. Technical report, University of Hawaii at Manoa, 1995.Google Scholar
- [CC77]P. Cousot and R. Cousot. Abstract interpretation: A unified lattice model for static analysis of programs by construction of approximation of fixed points. In
*Proceedings of the 4th ACM Symposium on Principles of Programming Languages, Los Angeles*, pages 238–252, New York, NY, 1977. ACM.Google Scholar - [CHP92]J.M. Couvreur, S. Haddad, and J.F. Peyre. parametrized resolution of families of linear systems.
*RAIRO Recherche Operationnelle*, 26:183–206, 1992.zbMATHMathSciNetGoogle Scholar - [DDL99]S. Dellacherie, S. Devulder, and J-L. Lambert. (technical version) software verification based on linear programming. Technical report, GREYC, university de Caen, 1999.Google Scholar
- [Del99a]S. Dellacherie. A case study: specification and verification of an access control system using the lpv technology. Technical report, GREYC, University de Caen, 1999.Google Scholar
- [Del99b]S. Dellacherie.
*Verification logicielle base sur la programmation linaire*. PhD thesis, University de Caen, 1999. To appear.Google Scholar - [Dev98]S. Devulder. A comparison of lpv with other validation methods. Technical report, GREYC, University de Caen, 1998.Google Scholar
- [Dev99]S. Devulder.
*Un modle de preuve de logiciels fond sur la programmation linaire*. PhD thesis, Universit de Caen, 1999. To appear.Google Scholar - [ES92]J. Esparza and M. Silva. A polynomial-time algorithm to decide liveness of bounded free choice nets.
*Theoretical Computer Science*, 102:185–205, 1992.zbMATHCrossRefMathSciNetGoogle Scholar - [faq]
- [GH93]J.V. Guttag and J.J. Horning.
*Larch: languages and tools for formal specification*. Springer-Verlag, 1993.Google Scholar - [Hol97]G.J. Holtzmann. The model checker spin.
*IEEE Transactions on Software Engineering*, 23(5), May 1997.Google Scholar - [JPO95]Laeta Jategaonkar Jagadeesan, Carlos Puchol, and James E. Von Olnhausen. Safety property verification of esterel programs and applications to telecommunications software. In
*Seventh Conference on Computer-aided verification*, 1995.Google Scholar - [Kur92]R. P. Kurshan. Automata-theoretic verification of coordinating processes. Technical report, ATT Bell Laboratories, 1992.Google Scholar
- [LM89]J.B. Lasserre and F. Mahey. Using linear programming in petri net analysis.
*RAIRO Recherche Operationnelle*, 23:43–50, 1989.zbMATHMathSciNetGoogle Scholar - [McM93]K.L. McMillan.
*Symbolic Model Checking*. Kluwer Academic Publishers, 1993.Google Scholar - [ORR+96]S. Owre, S. Rajan, J.M. Rushby, N. Shankar, and M. Srivas. Pvs: Combining specification, proof checking, and model checking. In LNCS, volume 1102, pages 411–414. Springer Verlag, 1996.Google Scholar