skip to main content
research-article

Automatic predicate abstraction of C programs

Published: 18 March 2012 Publication History

Abstract

Model checking has been widely successful in validating and debugging designs in the hardware and protocol domains. However, state-space explosion limits the applicability of model checking tools, so model checkers typically operate on abstractions of systems.
Recently, there has been significant interest in applying model checking to software. For infinite-state systems like software, abstraction is even more critical. Techniques for abstracting software are a prerequisite to making software model checking a reality.
We present the first algorithm to automatically construct a predicate abstraction of programs written in am industrial programming language such as C, and its implementation in a tool -- C2BP. The C2BP tool is part of the SLAM toolkit, which uses a combination of predicate abstraction, model checking, symbolic reasoning, and iterative refinement to statically check temporal safety properties of programs.
Predicate abstraction of software has many applications, including detecting program errors, synthesizing program invariants, and improving the precision of program analyses through predicate sensitivity. We discuss our experience applying the C2BP predicate abstraction tool to a variety of problems, ranging from checking that list-manipulating code preserves heap invariants to finding errors in Windows NT device drivers.

References

[1]
G. Ammons and J. R. Larus. Improving data-flow analysis with path profiles. In PLDI 98: Programming Language Design and Implementation, pages 72--84. ACM, 1998.
[2]
T. Ball, S. Chaki, and S. K. Rajamani. Parameterized verification of multithreaded software libraries. In TACAS 01: Tools and Algorithms/or Construction and Analysis of Systems, LNCS 2031. Springer-Verlag, 2001.
[3]
T. Ball, T. Millstein, and S. K. Rajamani. Polymorphic predicate abstraction. Technical Report MSR Technical Report 2001-10, Microsoft Research, 2000.
[4]
T. Ball, A. Podelski, and S. K. Rajamani. Boolean and cartesian abstractions for model checking C programs. In TA GAS OI: Tools and Algorithms for Construction and Analysis of Systems, LNCS 2031. Springer-Verlag, 2001.
[5]
T. Ball and S. K. Rajamani. Bebop: A symbolic model checker for Boolean programs. In SPIN 00: SPIN Workshop, IJNCS 1885, pages 113--130. Springer-Verlag, 2000.
[6]
T. Ball and S. K. Rajamani. Automatically validating temporal safety properties of interfaces. In SPIN 2001: SPIN Workshop, LNCS 2057, May 2001.
[7]
D. Blei and et al. Vampyre: A proof generating theorem prover -- http://www.eecs.berkeley.edu/" rupak/vampyre.
[8]
R. Bodik and S. Anik. Path-sensitive value-flow analysis. in POPL 98: Principles o/Programming Languages, pages 237--251. ACM, 1998.
[9]
R. Bryant. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers, C-35(8):677--691, 1986.
[10]
J. Corbett, M. Dwyer, J. Hatcliff, C. Pasareanu, Robby, S. Laubach, and H. Zheng. Bandera : Extracting finitestate models from Java source code. In ICSE'00: Software Engineering, 2000.
[11]
P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for the static analysis of programs by construction or approximation of fixpoints. In POPL'77: Principles of Programming Languages, pages 238--252. ACM, 1977.
[12]
M. Das. Unification-based pointer analysis with directional assignments. In PLDI'00: Programming Language Design and Implementation, pages 35--46. ACM, 2000.
[13]
S. Das, D. L. Dill, and S. Park. Experience with predicate abstraction. In CAV 00: Computer-Aided Verification, LNCS 1633, pages 160--171. Springer-Verlag, 1999.
[14]
R. DeLine and M. F~hndrich. Enforcing high-level protocols in low-level software. In PLDI'01: Programming Language Design and Implementation. ACM, 2001.
[15]
D. Detlefs, G. Nelson, and J. Saxe. Simplify theorem prover - http://research.compaq.com/src/esc/simplify.html.
[16]
E. Dijkstra. A Discipline of Programming. Prentice-Hall, 1976.
[17]
M. Dwyer, J. Hatcliff, R. Joehanes, S. Laubach, C. Pasareanu, Robby, W. Visser, and H. Zheng. Tool-supported program abstraction for finite-state verification. In ICSE'01: Software Engineering (to appear), 2001.
[18]
C. Flanagan, R. Joshi, and K. R. M. Leino. Annotation inference for modular checkers. Information Processing Letters (to appear), 2001.
[19]
S. Graf and H. Saídi. Construction of abstract state graphs with PVS. In CAV'97: Computer-aided Verification, LNCS 1254, pages 72--83. Springer-Verlag, 1997.
[20]
D. Gries. The Science of Programming. Springer-Verlag, 1981.
[21]
N. Heintze. Set-based analysis of ML programs. In LFP'94: LISP and Functional Programming, pages 306--317. ACM, 1994.
[22]
S. Ishtiaq and P. O'Hearn. BI as an assertion language for mutable data structures. In POPL'01: Principles of Programming Languages, pages 14--26. ACM, 2001.
[23]
L. Lamport. Proving the correctness of multiprocess programs. IEEE Transactions on Software Engineering, SE-3(2):125--143, 1977.
[24]
W. Landi, B. G. Ryder, and S. Zhang. Interprocedural side effect analysis with pointer aliasing. In PLDI'93: Programming Language Design and Implementation, pages 56--67. ACM, 1993.
[25]
J. M. Morris. A general axiom of assignment. In Theoretical Foundations of Programming Methodology, Lecture Notes of an International Summer School, pages 25--34. D. Reidel Publishing Company, 1982.
[26]
G. Necula. Proof carrying code. In POPL'97: Principles of Programming Languages, pages 106--119. ACM, 1997.
[27]
G. Nelson. Techniques for program verification. Technical Report CSL81-10, Xerox Palo Alto Research Center, 1981.
[28]
T. Reps, S. Horwitz, and M. Sagiv. Precise interprocedural dataflow analysis via graph reachability. In POPL'95: Principles of Programming Languages, pages 49--61. ACM, 1995.
[29]
J. C. Reynolds. Intuitionistic reasoning about shared mutable data structure. In Millenial Perspectives in Computer Science, pages 303--321. Palgrave, 2001.
[30]
M. Sagiv, T. Reps, and R. Wilhelm. Parametric shape analysis via 3-valued logic. In POPL'99: Principles of Programming Languages, pages 105--118. ACM, 1999.
[31]
M. Sharir and A. Pnueli. Two approaches to iaterprocedural data dalow analysis. In Program Flow Analysis: Theory and Applications, pages 189--233. Prentice-Hall, 1981.
[32]
N. Suzuki and K. Ishihata. Implementation of an array bound checker. In POPL'77: Principles of Programming Languages, pages 132--143. ACM, 1977.
[33]
Z. Xu, B. P. Miller, and T. Reps. Safety checking of machine code. In PLDI'00: Programming Language Design and Implementation, pages 70--82. ACM 2000.

Cited By

View all
  • (2024)Simplification Method of CPN Model Based on Data Abstraction2024 27th International Conference on Computer Supported Cooperative Work in Design (CSCWD)10.1109/CSCWD61410.2024.10580591(2800-2805)Online publication date: 8-May-2024
  • (2023)An evaluation of approaches to model checking real-time task schedulability analysisInternational Journal on Software Tools for Technology Transfer (STTT)10.1007/s10009-022-00693-925:1(115-128)Online publication date: 1-Feb-2023

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM SIGPLAN Notices
ACM SIGPLAN Notices  Volume 47, Issue 4a
Supplemental issue
April 2012
85 pages
ISSN:0362-1340
EISSN:1558-1160
DOI:10.1145/2442776
Issue’s Table of Contents

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 18 March 2012
Published in SIGPLAN Volume 47, Issue 4a

Check for updates

Qualifiers

  • Research-article

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)5
  • Downloads (Last 6 weeks)0
Reflects downloads up to 14 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Simplification Method of CPN Model Based on Data Abstraction2024 27th International Conference on Computer Supported Cooperative Work in Design (CSCWD)10.1109/CSCWD61410.2024.10580591(2800-2805)Online publication date: 8-May-2024
  • (2023)An evaluation of approaches to model checking real-time task schedulability analysisInternational Journal on Software Tools for Technology Transfer (STTT)10.1007/s10009-022-00693-925:1(115-128)Online publication date: 1-Feb-2023

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media