More effective interpolations in software model checking

Abstract

An approach to CEGAR-based model checking which has proved to be successful on large models employs Craig interpolation to efficiently construct parsimonious abstractions. Following this design, we introduce new applications, universal safety interpolant and existential error interpolant, of Craig interpolation that can systematically reduce the program state space to be explored for safety verification. Whenever the universal safety interpolant is implied by the current path, all paths emanating from that location are guaranteed to be safe. Dually whenever the existential error interpolant is implied by the current path, there is guaranteed to be an unsafe path from the location. We show how these interpolants are computed and applied in safety verification. We have implemented our approach in a tool named INTERPCHECKER by building on an open source software model checker. Experiments on a large number of benchmark programs show that both the interpolations and the auxiliary optimization strategies are effective in improving scalability of software model checking.

InterpChecker: Reducing State Space via Interpolations

“…If Π is not spurious, we conclude that the program is unsafe. Otherwise, by update S-Interp, update E-Interp, and update R-Interp [5], the S-Interp, E-Interp, and R-Interp of locations involved in Π are updated, respectively. Subsequently, we reversely track the current path for other possibilities and treat a new current state s : (l, c, p) in the same way until the program is reported as unsafe or there are no more states to be explored.…”

Statically Verifying Continuous Integration Configurations

“…In order to learn both the set of code feature extractors and a model of configuration correctness, our system uses a refinement loop as shown in Fig 7, which is inspired by counterexample guided abstraction refinement (CEGAR) (Clarke et al 2000). The CEGAR loop has been used for various model checking tasks (Ball et al 2011;Beyer and Löwe 2013;Tian et al 2017). A similar loop is also widely used in program synthesis (Jha and Seshia 2014;Solar Lezama 2008).…”