Efficient SAT-based bounded model checking for software verification

Abstract

This paper discusses our methodology for formal analysis and automatic verification of software programs. It is currently applicable to a large subset of the C programming language that includes bounded recursion. We consider reachability properties, in particular whether certain assertions or basic blocks are reachable in the source code. We perform this analysis via a translation to a Boolean representation based on modeling basic blocks. The program is then analyzed by a back-end SAT-based bounded model checker, where each unrolling is mapped to one step in a block-wise execution of the program. The main contributions of this paper are as follows: 1) This paper is the first to use the block-based unrollings with SAT-based bounded model checking. This allows us to take advantage of SAT-based learning inherent to the best performing bounded model checkers. 2) We also present various heuristics used in the SAT-based bounded model checking customized for models automatically generated from software, allowing a more efficient analysis. 3) We have implemented our methodology into a prototype tool called F-Soft and applied it on various case studies. We present experimental results based on eight case studies including a C-based implementation of a network protocol, and compare the performance gains using the proposed heuristics.

Practical lock/unlock pairing for concurrent programs

“…Automated program abstraction and refinement are difficult, and the iterative process may not converge. In practice, automated abstract model checking methods are limited to small or special-purpose programs [12,13].…”

Efficient Modeling of Concurrent Systems in BMC

“…TCMBC approach requires full inlining of functions and unwinding of loops like CBMC. This CBMC-based approach, therefore, is not scalable to large piece of code or code with reactive behavior, as shown previously [29].…”

“…For brevity, we highlight the essentials in building a thread model (EFSM) from a C thread (using the F-Soft framework [29]) under the assumption of a bounded heap and a bounded stack. First we obtain a simplified CFG by creating an explicit memory model for (finite) data structures and heap memory, where indirect memory accesses through pointers are converted to direct accesses by using auxiliary variables.…”

“…We perform source-to-source transformations to directly use a model builder (F-Soft [29]) for sequential programs and obtain sound abstraction. Token: We introduce a global Boolean variable, a token T K, to signify that the thread with the token can execute a shared access operation and commit its current shared state to be visible to the future transitions.…”

ExpliSAT: Guiding SAT-Based Software Verification with Explicit States

“…Other symbolic methods were introduced by NEC [15] and SLAM [2]. Symbolic model checking handles non-deterministic data efficiently, whereas explicit-state model checking handles non-deterministic scheduling of concurrent processes easily using partial order reduction [14].…”