  Software model checking, as an undecidable problem, has three possible
outcomes: (1) the program satisfies the specification, (2) the program does not
satisfy the specification, and (3) the model checker fails. The third outcome
usually manifests itself in a space-out, time-out, or one component of the
verification tool giving up; in all of these failing cases, significant
computation is performed by the verification tool before the failure, but no
result is reported. We propose to reformulate the model-checking problem as
follows, in order to have the verification tool report a summary of the
performed work even in case of failure: given a program and a specification,
the model checker returns a condition P ---usually a state predicate--- such
that the program satisfies the specification under the condition P ---that is,
as long as the program does not leave states in which P is satisfied. We are of
course interested in model checkers that return conditions P that are as weak
as possible. Instead of outcome (1), the model checker will return P = true;
instead of (2), the condition P will return the part of the state space that
satisfies the specification; and in case (3), the condition P can summarize the
work that has been performed by the model checker before space-out, time-out,
or giving up. If complete verification is necessary, then a different
verification method or tool may be used to focus on the states that violate the
condition. We give such conditions as input to a conditional model checker,
such that the verification problem is restricted to the part of the state space
that satisfies the condition. Our experiments show that repeated application of
conditional model checkers, using different conditions, can significantly
improve the verification results, state-space coverage, and performance.
