Automatic predicate abstraction of C programs

Abstract

Model checking has been widely successful in validating and debugging designs in the hardware and protocol domains. However, state-space explosion limits the applicability of model checking tools, so model checkers typically operate on abstractions of systems. Recently, there has been significant interest in applying model checking to software. For infinite-state systems like software, abstraction is even more critical. Techniques for abstracting software are a prerequisite to making software model checking a reality. We present the first algorithm to automatically construct a predicate abstraction of programs written in an industrial programming language such as C, and its implementation in a tool — C2BP. The C2BP tool is part of the SLAM toolkit, which uses a combination of predicate abstraction, model checking, symbolic reasoning, and iterative refinement to statically check temporal safety properties of programs. Predicate abstraction of software has many applications, including detecting program errors, synthesizing program invariants, and improving the precision of program analyses through predicate sensitivity. We discuss our experience applying the C2BP predicate abstraction tool to a variety of problems, ranging from checking that list-manipulating code preserves heap invariants to finding errors in Windows NT device drivers.

SMT Techniques for Fast Predicate Abstraction

“…SLAM: This category contains a set of 665 predicate abstraction queries generated from Windows device driver verification in SLAM [BMMR01]. In SLAM, predicate abstraction is used to abstract a Boolean program from a C program.…”

“…We are currently investigating exploiting incrementality when computing an abstraction over an monotonically growing set of predicates, which can be useful for creating Boolean programs [BMMR01] incrementally. Another area of future work is to extend a minterm c over P to a larger cube on-the-fly, before starting the search for a new minterm -this could impact the performance of queries (e.g.…”

“…In fact, our experiments reveal that (i) for small cube sizes, the computation times are extremely small, and that (ii) computing the full G P (ϕ) in successive steps slightly increasing the cube size can be done almost as efficiently as computing it directly, if each step is done incrementally from the previous one. Although several approaches have been developed in recent years to compute coarser approximations [GS97,BMMR01,DD01], the process of refining the approximations is not incremental, and can sometimes be the main bottleneck in the verification [BCDR04].…”

Typestate Verification: Abstraction Techniques and Complexity Results

“…Several recent verification approaches [2,15], based on predicate abstraction [14], avoid imprecision (e.g., due to aliasing or infeasible paths) by iteratively refining the abstractions as necessary, but are fundamentally exponential algorithms. These techniques use symbolic and theorem-proving techniques (during verification) to identify a set P of "relevant" predicates, and then use the powerset lattice 2 P →{true,f alse} for abstraction, and then model check the resulting finite state system (and usually iterate with increasingly larger sets of predicates until a satisfactory result is obtained).…”

Proving Liveness by Backwards Reachability

“…The last decade has witnessed impressive progress in the ability of tools to verify properties of hardware and software systems (e.g., [9,16,24]). The success has to a large extent concerned safety properties, e.g., absence of run-time errors, deadlocks, race conditions, etc.…”