Using 3-valued memory representation for state space reduction in embedded assembly code model checking

Model checking of assembly code is a promising approach to satisfy the demand for verification in nowadays ultra-high reliable embedded systems software. Frequent interaction with its environment, e.g., by sending or reading data over the microcontrollers I/O lines, lies in the nature of embedded systems. Thus, making the long-standing problem of explicit-model checking even worse, namely the state-explosion problem. This paper presents a concept to tackle these difficulties by using a 3-valued logic in the state representation and showing its benefits in terms of state-space savings whenever logic operations are executed by the target microcontroller. To highlight the effectiveness of this approach, termed delayed nondeterminism with look ahead, an embedded program exemplifying typical microcontroller source code is analyzed and the resulting state space sizes are discussed. The introduced abstraction technique is implemented in the MCS-51 simulator component for the [mc]square model checker which is developed by the RWTH Aachen University.