BDD-Based Software Model Checking with CPAchecker

Abstract

Abstract. In symbolic software model checking, most approaches use predicates as symbolic representation of the state space, and SMT solvers for computations on the state space; BDDs are sometimes used as auxiliary data structure. The representation of software state spaces by BDDs was not yet thoroughly investigated, although BDDs are successful in hardware verification. The reason for this is that BDDs do not efficiently support all operations that are needed in software verification. In this work, we evaluate the use of a pure BDD representation of integer variable values, and focus on a particular class of programs: event-conditionaction systems with limited operations. A symbolic representation using BDDs seems appropriate for this particular class of programs. We implement a program analysis based on BDDs and experimentally compare three symbolic techniques to verify reachability properties of ECA programs. The results show that BDDs are efficient, which yields the insight that BDDs could be used selectively for some variables (to be determined by a pre-analysis), even in general software model checking.

Domain Types: Abstract-Domain Selection Based on Variable Usage

“…The configurations Explicit and BDD-IntBool perform worse, because they represent the variables of domain type Eq using the explicit-value domain. The performance result is in line with the results of a recent paper on BDD-based software model checking [15].…”

“…Abstract domains can be based on explicit representations (e.g., hash tables for integers, memory graphs for the heap) and symbolic representations (predicates, binary decision diagrams (BDD)). For example, using an explicitvalue domain [14] was efficient on many benchmarks from the recent competition on software verification [9], while using a BDD domain [15] was more efficient on eventcondition-action (ECA) systems that involve only simple operations over integers in an ECA competition [30]. In the context of product-line verification, it has been shown that BDD-encodings of feature variables improve verification performance [5,24].…”

Strategies for product-line verification: Case studies and experiments

“…Because feature variables are boolean, they can be efficiently checked for equivalence, and joined using disjunction, by binary decision diagrams (BDDs). We refer to previous work for details on encoding feature-variables in BDDs [10], [30] and on BDD-based software model checking [6].…”

“…We used the explicit-state verification algorithms in CPACHECKER [5] and JAVA PATHFINDER [29], and we encode feature variables in BDDs. Encoding of feature variables in BDDs [10], [30] and BDD-based software model checking of event-condition-action systems [6] have been described before.…”

The RERS challenge: towards controllable and scalable benchmark synthesis

“…First of all, RERS has facilitated a number of scientific advances by challenge participants. Some examples are presented in[1,7,10,11,[15][16][17]30,34,37,44,45,47,48,50,51,56,57,59,[69][70][71].…”