Predicate abstraction for software verification

Abstract

Software verification is an important and difficult problem. Many static checking techniques for software require annotations from the programmer in the form of method specifications and loop invariants. This annotation overhead, particularly of loop invariants, is a significant hurdle in the acceptance of static checking. We reduce the annotation burden by inferring loop invariants automatically.Our method is based on predicate abstraction, an abstract interpretation technique in which the abstract domain is constructed from a given set of predicates over program variables. A novel feature of our approach is that it infers universally-quantified loop invariants, which are crucial for verifying programs that manipulate unbounded data such as arrays. We present heuristics for generating appropriate predicates for each loop automatically; the programmer can specify additional predicates as well. We also present an efficient algorithm for computing the abstraction of a set of states in terms of a collection of predicates.Experiments on a 44KLOC program show that our approach can automatically infer the necessary predicates and invariants for all but 31 of the 396 routines that contain loops.

Goal-Directed Invariant Synthesis for Model Checking Modulo Theories

“…To do this, we can decompose k into two disjoint sub-sequences i and j such that k = i ∪ j according to some criteria: if the conjunction of Σ I (i) literals occurring in θ is maximal, we get a candidate invariant by returning the corresponding ∃ I -formula (9). This is quite feasible in many concrete cases.…”

“…Even worse, in some cases the analysis may not detect a fix-point, thereby causing non-termination. In order to avoid visiting irrelevant parts of the symbolic state space during backward reachability, techniques for analyzing pre-images and guessing invariants have been devised (see, e.g., [5,15,9,4,13] to name a few). The success of these techniques depend crucially on the heuristics used to guess the invariants.…”

SMT Techniques for Fast Predicate Abstraction

“…For example, Clarke et al [CKSY04], and Lahiri and Bryant [LBC03,LB04] perform predicate abstraction by Boolean quantifier elimination using SAT solvers for propositional and first-order logic respectively. The idea of using SMT solvers for predicate abstraction has also been explored repeatedly [DDP99,SS99,FQ02,BCLZ04], but differently from what we do here, in particular, concerning incrementality. The recent symbolic decision procedure approach of [LBC05] is a specialized method for predicate abstraction based on saturating a set of predicates; however, it imposes restrictions on the underlying theories, it requires an expensive transformation of the queries to a logically equivalent conjunctive normal form, and combination methods for non-convex theories would need to be devised for it.…”

Verification by Abstraction

“…The practicality of these abstraction techniques has been demonstrated on several large examples. Flanagan and Qadeer [FQ02] have applied predicate abstraction to a large (44KLOC) file system program and automatically derived over 90% of the loop invariants. Predicate abstraction has also been used in the SLAM project [BMMR01] at Microsoft to find bugs in device driver routines.…”