CPA-BAM-Slicing: Block-Abstraction Memoization and Slicing with Region-Based Dependency Analysis

Abstract

Our submission to SV-COMP'18 is a composite tool based on software verification framework CPAchecker and static analysis platform Frama-C. The base verifier uses a combination of predicate and explicit value analysis with block-abstraction memoization as the CPA-BAM-BnB tool presented at SV-COMP'17. In this submission we augment the verifier on reachability verification tasks with a slicer that is able to remove those statements that are irrelevant to the reachability of error locations in the analysed program. The slicer is based on contextsensitive flow-insensitive separation analysis with typed polymorphic regions and simple dependency analysis with transitive closures. The resulting analysis preserves reachability modulo possible non-termination while removing enough irrelevant code to achieve considerable speedup of the main analysis. The slicer is implemented as a Frama-C plugin.

Directed Model Checking for Fast Abstract Reachability Analysis

“…We successfully apply TOUR to BAM, which uses two different abstract domains (i.e., predicate domain and explicitvalue domain) [6] because TOUR is independent of abstract domains. The predicate domain is a widely used abstract domain for ARMC of C programs [3], [15], [38]- [43]. The predicate domain presents an abstract data state formula as a set of predicates over program variables.…”