Subsumer-First: Steering Symbolic Reachability Analysis

Abstract

Abstract. Symbolic reachability analysis provides a basis for the verification of software systems by offering algorithmic support for the exploration of the program state space when searching for proofs or counterexamples. The choice of exploration strategy employed by the analysis has direct impact on its success, whereas the ability to find short counterexamples quickly and-as a complementary task-to efficiently perform the exhaustive state space traversal are of utmost importance for the majority of verification efforts. Existing exploration strategies can optimize only one of these objectives which leads to a sub-optimal reachability analysis, e.g., breadth-first search may sacrifice the exploration efficiency and chaotic iteration can miss minimal counterexamples. In this paper we present subsumer-first, a new approach for steering symbolic reachability analysis that targets both minimal counterexample discovery and efficiency of exhaustive exploration. Our approach leverages the result of fixpoint checks performed during symbolic reachability analysis to bias the exploration strategy towards its objectives, and does not require any additional computation. We demonstrate how the subsumer-first approach can be applied to improve efficiency of software verification tools based on predicate abstraction. Our experimental evaluation indicates the practical usefulness of the approach: we observe significant efficiency improvements (median value 40%) on difficult verification benchmarks from the transportation domain.

Statically-directed dynamic automated test generation

“…By contrast our loop exploration heuristic is focused on finding the vulnerable path through a single iteration; in our experience any sufficiently large number of iterations is then enough to demonstrate the overflow. Rybalchenko and Singh [40] propose subsumer-first heuristic to steer symbolic reachability analysis of benchmarks from the transportation domain. Their heuristic is very intuitive: it prefers larger (according to subsumption ordering) states, greedily trying to get to a state large enough to contain the error state.…”