Model Checking Embedded C Software Using k-Induction and Invariants

Abstract

We present a proof by induction algorithm, which combines k-induction with invariants to model check embedded C software with bounded and unbounded loops. The k-induction algorithm consists of three cases: in the base case, we aim to find a counterexample with up to k loop unwindings; in the forward condition, we check whether loops have been fully unrolled and that the safety property φ holds in all states reachable within k unwindings; and in the inductive step, we check that whenever φ holds for k unwindings, it also holds after the next unwinding of the system. For each step of the k-induction algorithm, we infer invariants using affine constraints (i.e., polyhedral) to specify preand post-conditions. Experimental results show that our approach can handle a wide variety of safety properties in typical embedded software applications from telecommunications, control systems, and medical devices; we demonstrate an improvement of the induction algorithm effectiveness if compared to other approaches.

A guess-and-assume approach to loop fusion for program verification

“…Various methods for static verification use program transformation as a core component. The realm of such analyses spans widely, including safety verification of software [1,6,8,9,17,19,25,26] and hybrid systems [15]; resource-bound analysis [12,13,21,29]; termination analysis [5]; and information-flow analysis [16]. Despite this diversity, we have not noticed any methods that are based on loop fusion or the guess-andassume approach.…”

The JKind Model Checker

“…nuXmv also supports guided reachability and k-liveness. Other tools such as ESBMC-DepthK [25], VVT [4] CPAchecker, [5], CPROVER [7] use similar techniques for reasoning about C programs.…”

SMT-Based Context-Bounded Model Checking for Embedded Systems

“…Novel verification algorithms for proving correctness of (a large set of) C programs, by mathematical induction, in a completely automatic way (i.e., users do not need to provide the loop invariant) were recently proposed [23,24,25,26,27]. Additionally, k -induction based verification was also applied to ensure that (restricted) C programs (1) do not contain violations related to data races [28], considering the Cell BE processor, and (2) do respect time constraints, which are specified during the system design phase [18].…”

“…(RP3) Novel approaches to model check embedded software using k -induction and invariants were proposed and evaluated in the literature, which demonstrate its effectiveness in some real-life embedded-system applications [23,25,26,28]; however, the main challenge still remains open, i.e., to compute and strengthen loop invariants to prove program correctness and timeliness in a more efficient and effective way, in order to be competitive with other model-checking approaches. In particular, invariant-generation algorithms have substantially evolved over the last years, with the goal of discovering inductive invariants of programs [21,22] or continuously refine them during verification [24]; however, there is still a lack of studies for exploiting the combination of different invariant-generation algorithms (e.g., interval analysis, linear inequalities, polynomial equalities and inequalities) and how to strengthen them during verification, in order to ensure system robustness w.r.t.…”