Falsification via Barrier Certificates

Barrier certificates enable a deductive approach to safety verification by characterizing an over-approximation of the reachable state space via their level sets. Dual to verification, falsification approaches often rely on a smart search by simulating the system for different operating conditions in the search of an unsafe behavior. While falsification approaches are effective in discovering shallow bugs, they fail to uncover deep counterexamples due to “plateaus” in the search space. For this purpose, we present two characterizations of barrier certificates to provide a deductive approach to falsification. We show these two characterizations are incomparable, i.e, for a fixed template one may falsify the system using one kind but not the other. Finally, we demonstrate the effectiveness of the proposed approaches in our case studies.