Model checking C programs using F-Soft

Abstract

Abstract-With the success of formal verification techniques like equivalence checking and model checking for hardware designs, there has been growing interest in applying such techniques for formal analysis and automatic verification of software programs. This paper provides a brief tutorial on model checking of C programs. The essential approach is to model the semantics of C programs in the form of finite state systems by using suitable abstractions. The use of abstractions is key, both for modeling programs as finite state systems and for reducing the model sizes in order to manage verification complexity. We provide illustrative details of a verification platform called F-SOFT, which provides a range of abstractions for modeling software, and uses customized SAT-based and BDD-based model checking techniques targeted for software.

Trace-Driven Verification of Multithreaded Programs

“…Besides the basic types, we also allow assert(C) for checking assertions, exit for signaling the termination of a thread, and the synchronization primitives. fork(t) and join(t) allow a thread to dispatch and wait for the completion of another Thread t. Given a program written in a full-fledged programming languages like C, one can use pre-processing [21] to simplify its executed traces into the basic statements described above.…”

Symbolic Model Checking of Concurrent Programs Using Partial Orders and On-the-Fly Transactions

“…In this section we briefly describe how, using the F-Soft machinery, we first obtain a circuit-based model of each thread, under the assumption of bounded data and bounded control (recursion) (see [ISGG05] for more details). We begin with full-fledged C and apply a series of source-to-source transformations to simplify complex C expressions into smaller but equivalent subsets of C .…”

“…Building upon the F-Soft framework [ISGG05] for translating sequential programs with bounded data and bounded recursion into circuits, we first obtain a finite model for each individual thread wherein each variable of the thread is represented in terms of a vector of binary-valued latches and a boolean next-state function (or relation) for each latch. Then using a scheduler, we compose the circuits for the individual threads into one single circuit for the entire concurrent program.…”

SLR: Path-Sensitive Analysis through Infeasible-Path Detection and Syntactic Language Refinement

“…We have implemented the SLR technique inside the F-Soft C program verifier [14] to check array, pointer, and C string usage. The analyzer is context sensitive, by using call strings to track contexts.…”

“…The F-Soft tool checks C programs for invalid pointer accesses, buffer overflows, memory leaks, incorrect usage of APIs, and arbitrary safety properties specified by a user [14]. We use the techniques described in the paper to improve the path-insensitive analysis used inside the F-Soft tool to obtain the effects of path-sensitive analysis.…”