SAT-Based Software Certification

Abstract

Abstract. We formalize a notion of witnesses for satisfaction of linear temporal logic specifications by infinite state programs. We show how such witnesses may be constructed via predicate abstraction, and validated by generating verification conditions and proving them. We propose the use of SAT-based theorem provers and resolution proofs in proving these verification conditions. In addition to yielding extremely compact proofs, a SAT-based approach overcomes several limitations of conventional theorem provers when applied to the verification of programs written in real-life programming languages. We also formalize a notion of witnesses of simulation conformance between infinite state programs and finite state machine specifications. We present algorithms to construct simulation witnesses of minimal size by solving pseudo-Boolean constraints. We present experimental results on several non-trivial benchmarks which suggest that a SAT-based approach can yield extremely compact proofs, in some cases by a factor of over 10 5 , when compared to existing non-SAT-based theorem provers.

Software model checking without source code

“…AIR is also adoptable for the purpose of using certifying model checking [23] for proof carrying code (PCC) [25]. Certifying model checking in combination with abstraction has been used [24,8] to construct invariants and ranking functions for the purpose of certifying source code. By generating source code from binaries, AIR enables us to leverage the above technology for the PCC-style certification of binaries.…”

Certified Binaries for Software Components

“…We will not go into a detailed proof of Fact 1, since it requires careful formalization of the semantics of C and ϕ. In addition, proofs of theorems that capture the same idea are presented elsewhere [Necula 1996, Chaki 2006. Indeed, if such a certificate (RF , Π) exists, by the soundness of the proof system used to construct Π, we know that VC (RF ) is valid, and hence, by Fact 1, C |= ϕ.…”

“…If VC (RF3 ) is valid, the resolution proof produced by ZChaff serves as Π. The use of SAT enables us to obtain extremely compact proofs in practice [Chaki 2006]. Finally, the certificate (RF , Π) along with the binary is produced as the end result-the certified binary for Spec.…”

“…Copper emits the ranking function as a set of triples of the form ((l, I), s, r) where: (1) I is an invariant (i.e., the concretization of a predicate valuation V such that (l, V ) is a reachable state of M ), 6 (2) s is a state of the Büchi automaton corresponding to the policy, and (3) r is a rank. The procedure for constructing an appropriate ranking function has been presented elsewhere, so we do not describe it further here [Chaki 2006]. …”

“…In recent years, CMC has been augmented with iterative abstraction-refinement to enable the certification of C source code [Henzinger 2002a, Chaki 2006]. …”