An Incremental Approach to Scope-Bounded Checking Using a Lightweight Formal Method

Abstract

Abstract. We present a novel approach to optimize scope-bounded checking programs using a relational constraint solver. Given a program and its correctness specification, the traditional approach translates a bounded code segment of the entire program into a declarative formula and uses a constraint solver to search for any correctness violations. Scalability is a key issue with such approaches since for non-trivial programs the formulas are complex and represent a heavy workload that can choke the solvers. Our insight is that bounded code segments, which can be viewed as a set of (possible) execution paths, naturally lend to incremental checking through a partitioning of the set, where each partition represents a sub-set of paths. The partitions can be checked independently, and thus the problem of scope-bounded checking for the given program reduces to several sub-problems, where each sub-problem requires the constraint solver to check a less complex formula, thereby likely reducing the solver's overall workload. Experimental results show that our approach provides significant speed-ups over the traditional approach.

BLITZ: Compositional bounded model checking for real-world programs

“…One strategy partitions a program into multiple subprograms at the outset (each with a subset of paths), and solve all of them in parallel [20]. Though amendable to a parallel architecture, it may generate a prohibitively large number of subprograms.…”

Optimizing Incremental Scope-Bounded Checking with Data-Flow Analysis

“…The implementation and correctness proofs for the gothrough-sub() and bypass-sub() functions have been discussed in our previous work [33].…”

“…While the JAlloy tool interfaced with the Alloy Analyzer for translation of the constraints to boolean logic, Forge employs the Kodkod model finder for faster translation. Our earlier work [33] proposed algorithms for splitting the computation graph into sub-graphs and solving them incrementally. Sub-graphs are constructed by transforming branch statements into assume statements.…”

“…Recently, we introduced an incremental approach based on the program's control-flow to increase the efficiency and effectiveness of scope-bounded checking [33]. The key idea is to partition the set of executions of the bounded code fragment into a number of subsets and encode each subset into a sub-formula.…”

“…Our previous work [33] introduces splitting strategies to embody the sliding rule. However, this work uses solely the program's control-flow to define the strategies, and is therefore limited to the syntactical structure of the program and fails to exploit the program semantics.…”