Function Summarization-Based Bounded Model Checking

Abstract

It is often the case that software needs to be verified against various specifications. During this process, the same parts of the program have to be modeled/verified multiple times, forcing the model checker to duplicate actions. To reduce the overall verification effort, this chapter describes a technique for extracting function summaries after a successful verification run with respect to some assertion, and then using them during subsequent verification runs of the other assertions. A well-known mechanism to compute over-approximations, called Craig interpolation, is used to create function summaries. A summary preserves the most relevant information used to prove a specific assertion, and thus tends to be a good substitute for the functions that were examined in the previous verification runs. As a side effect of the over-approximation, spurious behaviors might be introduced. In order to eliminate them, counterexample-guided refinement of the function summaries is used. This chapter discusses the theory and implementation of the interpolation-based summarization tool FunFrog, and compares it with several state-of-the-art software model checking tools. Our experiments demonstrate the feasibility of the technique and confirm its advantages with large programs. The chapter is based on the research previously published in [SFS11] and [SFS12a].