Abstractions from proofs

Abstract

The success of model checking for large programs depends crucially on the ability to efficiently construct parsimonious abstractions. A predicate abstraction is parsimonious if at each control location, it specifies only relationships between current values of variables, and only those which are required for proving correctness. Previous methods for automatically refining predicate abstractions until sufficient precision is obtained do not systematically construct parsimonious abstractions: predicates usually contain symbolic variables, and are added heuristically and often uniformly to many or all control locations at once. We use Craig interpolation to efficiently construct, from a given abstract error trace which cannot be concretized, a parsominous abstraction that removes the trace. At each location of the trace, we infer the relevant predicates as an interpolant between the two formulas that define the past and the future segment of the trace. Each interpolant is a relationship between current values of program variables, and is relevant only at that particular program location. It can be found by a linear scan of the proof of infeasibility of the trace.We develop our method for programs with arithmetic and pointer expressions, and call-by-value function calls. For function calls, Craig interpolation offers a systematic way of generating relevant predicates that contain only the local variables of the function and the values of the formal parameters when the function was called.We have extended our model checker BLAST with predicate discovery by Craig interpolation, and applied it successfully to C programs with more than 130,000 lines of code, which was not possible with approaches that build less parsimonious abstractions.

Improving lazy abstraction for SCR specifications through constraint relaxation

“…In particular, lazy abstraction with abstraction refinement based on interpolation was used for automatically generating tests leading to the reachable locations of a program, with successful applications in device drivers and security critical programs [41]. Other related and successful approaches are those by Henzinger et al [38] and…”

Counterexample-Guided Precondition Inference

“…In the next phase of the algorithm, the two formulas ψ E and ψ F are used to guide the inference of new predicates from states (ϕ k 's and ϕ k 's) belonging to the error trace π E (first loop, lines [17][18][19][20][21] The procedure ExtractNewPreds is applied to the states of π E and π F , i.e., the ϕ k 's and ϕ k 's of each trace. These states are obtained via a backward analysis of π E and π F during the initial phase of the algorithm (lines 4 and 5).…”

“…It is based on a system of inference rules in the spirit of [23], where an interpolation procedure [19] is used to find predicates, followed by the application of a system of inference rules to deduce range predicates. In [23], the interpolant provides a concise description of the cause of infeasibility of traces, thus the base formula is already minimal.…”

Kratos – A Software Model Checker for SystemC

“…If the counterexample is spurious, that is the formula representing it is unsatisfiable, then the counterexample is passed to the refiner. The refiner tries to refine the precision by discovering new predicates that need to be kept track by using the unsatisfiable core or interpolation based techniques as described in [14].…”