Model checking of safety properties

Orna Kupferman*, Moshe Y. Vardi

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

443 Scopus citations


Of special interest in formal verification are safety properties, which assert that the system always stays within some allowed region. Proof rules for the verification of safety properties have been developed in the proof-based approach to verification, making verification of safety properties simpler than verification of general properties. In this paper we consider model checking of safety properties. A computation that violates a general linear property reaches a bad cycle, which witnesses the violation of the property. Accordingly, current methods and tools for model checking of linear properties are based on a search for bad cycles. A symbolic implementation of such a search involves the calculation of a nested fixed-point expression over the system's state space, and is often infeasible. Every computation that violates a safety property has a finite prefix along which the property is violated. We use this fact in order to base model checking of safety properties on a search for finite bad prefixes. Such a search can be performed using a simple forward or backward symbolic reachability check. A naive methodology that is based on such a search involves a construction of an automaton (or a tableau) that is doubly exponential in the property. We present an analysis of safety properties that enables us to prevent the doubly-exponential blow up and to use the same automaton used for model checking of general properties, replacing the search for bad cycles by a search for bad prefixes.

Original languageAmerican English
Pages (from-to)291-314
Number of pages24
JournalFormal Methods in System Design
Issue number3
StatePublished - Nov 2001

Bibliographical note

Funding Information:
This research is supported by BSF grant 9800096. M.Y. Vardi is supported in part by NSF grant CCR-9700061 and by a grant from the Intel Corporation. The second author is grateful to Avner Landver for stimulating discussions.


  • Automata
  • Model checking
  • Safety properties


Dive into the research topics of 'Model checking of safety properties'. Together they form a unique fingerprint.

Cite this