Automatic predicate abstraction of C programs

Verification of evolving software via component substitutability analysis

“…Abstraction is one of the principal techniques for reducing the complexity of a verification problem [7,17,18,40]. Abstraction techniques reduce the state space by mapping the set of actual system states to an abstract set of states that preserve the behavior of the actual system.…”

“…However, the computational cost of the predicate abstraction procedure may be too high, making generation of a full set of predicates for a large system infeasible. In practice, the number of computed predicates is bounded [7,11], and model checking is guaranteed to deliver sound results within this bound. The bound limit is increased when errors (if any) are found within the bound and fixed.…”

“…Validation and Refinement 1.Check that CE is a real behavior of C i . This step is done in a manner similar to the counterexample validation techniques employed in software model checkers based on CEGAR[7,11,36].…”

Verifying compiled file system code

“…Our technique is especially designed for software employing complex heap-allocated data structures and provides full counterexample paths for each bug found. While generating counterexamples is often impossible for static analysis techniques due to precision loss in join and widening operations [GR06], traditional software model checking [Hol03] requires the manual construction of models or the use of techniques such as predicate abstraction [BMMR01] which do not work well in the presence of heap-allocated data structures. Hence, symbolic execution [Kin76] is our method of choice over static analysis and model checking for the Linux VFS case study presented in this article.…”

An abstract interpretation toolkit for μCRL

“…For example, variable hiding or pointwise abstraction in which, first, the value of some variables of the specification is considered as unknown, subsequently, extra non-determinism is added to the system when there are predicates over the abstracted variables. Another automated abstraction technique is the so-called predicate abstraction [1] in which only the value of some conditions is retained and propagated over the dependent predicates of the specification. Program slicing [21] is a technique that tries to eliminate all parts of the specification that are not relevant for the current verification.…”