SMT-based bounded model checking for embedded ANSI-C software
SMT-based bounded model checking for embedded ANSI-C software
Propositional bounded model checking has been applied successfully to verify embedded software but remains limited by increasing propositional formula sizes and the loss of high-level information during the translation preventing potential optimizations to reduce the state space to be explored. These limitations can be overcome by encoding high-level information in theories richer than propositional logic and using SMT solvers for the generated verification conditions. Here, we propose the application of different background theories and SMT solvers to the verification of embedded software written in ANSI-C in order to improve scalability and precision in a completely automatic way. We have modified and extended the encodings from previous SMT-based bounded model checkers to provide more accurate support for variables of finite bit width, bit-vector operations, arrays, structures, unions and pointers. We have integrated the CVC3, Boolector, and Z3 solvers with the CBMC front-end and evaluated them using both standard software model checking benchmarks and typical embedded software applications from telecommunications, control systems, and medical devices. The experiments show that our ESBMC model checker can analyze larger problems than existing tools and substantially reduce the verification time.
software engineering, formal methods, veri?cation, model checking
957-974
Cordeiro, Lucas
fc7cb054-f39e-4013-9faa-a471bd006596
Fischer, Bernd
0c9575e6-d099-47f1-b3a2-2dbc93c53d18
Marques-Silva, Joao
f992f61f-cedd-4897-9f73-1a3ac7ebb35c
July 2012
Cordeiro, Lucas
fc7cb054-f39e-4013-9faa-a471bd006596
Fischer, Bernd
0c9575e6-d099-47f1-b3a2-2dbc93c53d18
Marques-Silva, Joao
f992f61f-cedd-4897-9f73-1a3ac7ebb35c
Cordeiro, Lucas, Fischer, Bernd and Marques-Silva, Joao
(2012)
SMT-based bounded model checking for embedded ANSI-C software.
IEEE Transactions on Software Engineering, 38 (4), .
(doi:10.1109/TSE.2011.59).
Abstract
Propositional bounded model checking has been applied successfully to verify embedded software but remains limited by increasing propositional formula sizes and the loss of high-level information during the translation preventing potential optimizations to reduce the state space to be explored. These limitations can be overcome by encoding high-level information in theories richer than propositional logic and using SMT solvers for the generated verification conditions. Here, we propose the application of different background theories and SMT solvers to the verification of embedded software written in ANSI-C in order to improve scalability and precision in a completely automatic way. We have modified and extended the encodings from previous SMT-based bounded model checkers to provide more accurate support for variables of finite bit width, bit-vector operations, arrays, structures, unions and pointers. We have integrated the CVC3, Boolector, and Z3 solvers with the CBMC front-end and evaluated them using both standard software model checking benchmarks and typical embedded software applications from telecommunications, control systems, and medical devices. The experiments show that our ESBMC model checker can analyze larger problems than existing tools and substantially reduce the verification time.
Text
ieee_tse.pdf
- Accepted Manuscript
More information
e-pub ahead of print date: 23 June 2011
Published date: July 2012
Keywords:
software engineering, formal methods, veri?cation, model checking
Organisations:
Electronic & Software Systems
Identifiers
Local EPrints ID: 272291
URI: http://eprints.soton.ac.uk/id/eprint/272291
PURE UUID: 615c43a1-175f-411d-a91d-c9e8f4789dc3
Catalogue record
Date deposited: 17 May 2011 12:05
Last modified: 14 Mar 2024 09:58
Export record
Altmetrics
Contributors
Author:
Lucas Cordeiro
Author:
Bernd Fischer
Author:
Joao Marques-Silva
Download statistics
Downloads from ePrints over the past year. Other digital versions may also be available to download e.g. from the publisher's website.
View more statistics