ESBMC 5.0: an industrial-strength C model checker

Abstract

ESBMC is a mature, permissively licensed opensource context-bounded model checker for the verification of single-and multi-threaded C programs. It can verify both safety (e.g., bounds check, pointer safety, overflow) and userdefined (as asserts in the program) properties automatically. ESBMC provides C++ and Python APIs to access internal data structures, allowing inspection and extension at any stage of the verification process. We discuss improvements over previous versions of ESBMC, including the description of new front-and back-ends, IEEE floating-point support, and an improved k-induction algorithm. A demonstration is available at https://www.youtube.com/watch?v=N_qmN-cazvM.

ESBMC v6.0: Verifying C Programs Using k-Induction and Invariant Inference

“…Typical k-inductionbased verifiers use iterative deepening and repeatedly unwind the program to produce the verification results; its incremental nature means that it always finds the smallest falsification [2]. In SV-COMP'19, we have implemented a new interval-invariant generator that runs as a pre-processing step in ESBMC [4]. In this implementation, invariants based on intervals are automatically introduced in the program as assumptions and, although the implementation has some limitations in keeping track of the relations between variables (i.e., our abstract domain is non-relational), it significantly strengthens the k -induction algorithm results; in particular, we have observed that the use of invariants increases the number of correct proofs by about 7% over the SV-COMP benchmarks.…”

ESBMC: Scalable and Precise Test Generation based on the Floating-Point Theory

“…ESBMC runs with an improved SMT backend for test-case generation, which includes a floating-point encoding layer that converts all floating-point operations into bit-vector operations (a process called bit-blasting) when encoding the program into an SMT formula. Previous ESBMC versions [8] were only able to encode and verify programs using a fixed-point representation for floating-points. This particular encoding is a valid approximation since fixed-points are used in a large number of applications in the embedded world; however, it restricted ESBMC from verifying the broad set of programs that relied on processors that implement floating-point arithmetic.…”

Automated formal verification of stand-alone solar photovoltaic systems

“…Particularly, the total number of panels in series (N P Smin ) and parallel (N P P min ) are given by (12) and (13), respectively. With the check performed by (14) and (15), V system is the DC voltage of the bus, normally 12, 24 or 48 V.…”

“…ESBMC (or Efficient SMT-based Bounded Model Checker) is an open source, permissively licensed (Apache 2), cross platform bounded model checking for C and C++ programs [12], which supports the verification of LTL properties with bounded traces [36]. ESBMC's verification flow can be summarized in three stages: (i) a front-end that can read and compile C/C++ code, where the formal specification of the system to be verified is first handled; (ii) preprocessing steps to deal with the representation of the code, control flow and unwinding of loops, and the model simplification, thereby aiming to reduce the verification effort; and finally (iii) the SMT solving stage, where all the constraints and properties of the system to be verified are encoded into SMT and checked for satisfiability.…”