Systematic Predicate Abstraction Using Variable Roles

Abstract

Abstract. Heuristics for discovering predicates for abstraction are an essential part of software model checkers. Picking the right predicates affects the runtime of a model checker, or determines if a model checker is able to solve a verification task at all. In this paper we present a method to systematically specify heuristics for generating program-specific abstractions. The heuristics can be used to generate initial abstractions, and to guide abstraction refinement through templates provided for Craig interpolation. We describe the heuristics using variable roles, which allow us to pick domain-specific predicates according to the program under analysis. Variable roles identify typical variable usage patterns and can be computed using lightweight static analysis, for instance with the help of of-the-shelf logical programming engines. We implemented a prototype tool which extracts initial predicates and templates for C programs and passes them to the Eldarica model checker in the form of source code annotations. For evaluation, we defined a set of heuristics, motivated by Eldarica's previous built-in heuristics and typical verification benchmarks from the literature and SV-COMP. We evaluate our approach on a set of more than 500 programs, and observe an overall increase in the number of solved tasks by 11.2%, and significant speedup on certain benchmark families.

Mind the Gap: Bit-vector Interpolation recast over Linear Integer Arithmetic

“…For 17 of these 142 runs, LIA (incorrectly) verified the program to be safe whereas BV found a counter-example. Unexpectantly for trex03 trueunreach-call.i.annot.c from [12], LIA found a counter-example but BV verified safety. This program contains three integers, x1, x2 and x3, which can become negative in the idealised arithmetic employed in LIA, triggering an assertion.…”

“…The model checker is implemented in Python 3.7.2 and uses MathSAT5 [9] for satisfiability checking and interpolation over LIA. The model checker parses a subset of the C language, but is rich enough to handle 312 benchmarks drawn from [2,12]. The model checker was instantiated in one of three ways to use: (1) LIA interpolation [17]; (2) BV interpolation by covering the solutions of an LIA interpolate with columns (recall f 2 of section 2); and (3) BV interpolation by covering the solutions of an LIA interpolate using boxing, gapping and flipping.…”

Bit-Vector Interpolation and Quantifier Elimination by Lazy Reduction

“…d) Verification of C Programs: Since it is difficult to compare interpolation procedures outside of an application, we present results of running the ELDARICA version 2.0-alpha3 model checker 5 on a benchmark set of 551 C programs, using the implementation of our calculus in PRINCESS as interpolation procedure (Table I). The benchmarks are the programs used in [31] for evaluating different predicate generation strategies. The programs use only arithmetic operations, no arrays or heap data structures.…”

The ELDARICA Horn Solver

“…In this case, loop analysis will identify the term x -y as a useful expression (or interpolation template) in invariants, and interpolation abstraction will guide the interpolation process towards expressions that avoid the variables x, y, unless they occur in the context x -y. This approach enables ELDAR-ICA to rank interpolants according to their expected generality, and has been shown to speed up the solving process, as well as to significantly reduce the possibility of divergence [29], [14]. Interpolation templates can also be specified manually by the user to control the derived predicates.…”

“…The development of ELDARICA initially focused on the theory of unbounded linear integer arithmetic (LIA, quantifierfree Presburger arithmetic, but also including Booleans), for which efficient Craig interpolation is well understood. Among the supported theories, linear integer arithmetic in ELDARICA is at this point the most refined and mature, and has been evaluated extensively in previous work [22], [29], [14].…”