Unbounded Symbolic Execution for Program Verification

Abstract

Abstract. Symbolic execution with interpolation is emerging as an alternative to CEGAR for software verification. The performance of both methods relies critically on interpolation in order to obtain the most general abstraction of the current symbolic or abstract state which can be shown to remain error-free. CEGAR naturally handles unbounded loops because it is based on abstract interpretation. In contrast, symbolic execution requires a special extension for such loops. In this paper, we present such an extension. Its main characteristic is that it performs eager subsumption, that is, it always attempts to perform abstraction in order to avoid exploring other symbolic states. It balances this primary desire for more abstraction with the secondary desire to maintain the strongest loop invariant, for earlier detection of infeasible paths, which entails less abstraction. Occasionally certain abstractions are not permitted because of the reachability of error states; this is the underlying mechanism which then causes selective unrolling, that is, the unrolling of a loop along relevant paths only.

TRACER: A Symbolic Execution Tool for Verification

“…Preliminary versions of TRACER [12,13] computed interpolants based on strongest postconditions (sp). Given two formulas A (symbolic path) and B (last guard where infeasibility is detected) such that A ∧ B is unsat, an interpolant was obtained by ∃x · A where x are A-local variables (i.e., variables occurring only in A).…”

“…Notice that the generation of invariants is dynamic in the sense that loop unrolls will expose new constraints producing new invariant candidates. For lack of space, we refer readers to [12] for technical details. Here, we illustrate how TRACER handles unbounded loops through the classical example described in Fig 4(a).…”

“…Also, our path invariant technique via widening is closely related to the widening "up to" S ( ∇ S ) used in [9], where S contains the constraints inferred by the refinement phase. However, they use it to enhance CEGAR while SE poses different challenges (see [12] Sec.1, Ex.3). Finally, we would like to emphasize that abstraction in TRACER differs from CEGAR in a fundamental way.…”

“…Recently symbolic execution (SE) [15] has been successfully proven to be an alternative to CEGAR for program verification offering the following benefits among others [12,18]: (1) it does not explore infeasible paths avoiding expensive refinements, (2) it avoids expensive predicate image computations (e.g., Cartesian and Boolean abstractions [2]), and (3) it can recover from too-specific abstractions as opposed to monotonic refinement schemes often used. Unfortunately, it poses its own challenges: (C1) exponential number of paths, and (C2) infinite-length paths in presence of unbounded loops.…”

“…Lazy means that the tool starts from a coarsely abstracted model and then refines it while eager is its dual, starting with the concrete model and then removing irrelevant facts. CEGAR-based tools [1,4,7,10,21] are the best examples of lazy approaches while SE-based tools [12,18] are for eager methods. Special mention is required for hybrid approaches such as YOGI [20], CPA-CHECKER [3], and KRATOS [5].…”