CBMC: Bounded Model Checking for ANSI-C

75 Pages·2010·0.71 MB·English

CBMC: Bounded Model Checking for ANSI-C
Version 1.0, 2010
Outline
Preliminaries
BMC Basics
Completeness
Solving the Decision Problem
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 2
Preliminaries
(cid:73) We aim at the analysis of programs given in a commodity
programming language such as C, C++, or Java
(cid:73) As the first step, we transform the program into a control
flow graph (CFG)
C/C++ parse parse
CFG
Source tree
frontend
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 3
if
0≤t≤79
switch
case 0
t/206=0
case 1
t/206=1
case 2
t/206=2
case 3
t/206=3
default
Example: SHS
if ( (0 <=t)&&(t<=79))
switch(t/20)
{
case0:
TEMP2=((BANDC)OR(˜BANDD));
TEMP3=(K1);
break;
case1:
TEMP2=((BXORCXORD));
TEMP3=(K2);
break;
case2:
TEMP2=((BANDC)OR(BANDD)OR(CANDD));
TEMP3=(K3);
break;
case3:
TEMP2=(BXORCXORD);
TEMP3=(K4);
break;
default:
assert(0);
}
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 4
Example: SHS
if
if ( (0 <=t)&&(t<=79))
0≤t≤79
switch(t/20)
{
case0: switch
TEMP2=((BANDC)OR(˜BANDD));
TEMP3=(K1);
break;
case 0
case1:
TEMP2=((BXORCXORD)); t/206=0
TEMP3=(K2);
break; case 1
case2: t/206=1
TEMP2=((BANDC)OR(BANDD)OR(CANDD));
TEMP3=(K3); case 2
break;
t/206=2
case3:
TEMP2=(BXORCXORD); case 3
TEMP3=(K4);
break; t/206=3
default: default
assert(0);
}
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 4
Bounded Program Analysis
Goal: check properties of the form AGp,
say assertions.
Idea: follow paths through the CFG to an assertion,
and build a formula that corresponds to the path
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 5
0 ≤ t ≤ 79
∧ t/20 (cid:54)= 0
∧ t/20 = 1
∧ TEMP2 = B⊕C ⊕D
∧ TEMP3 = K 2
Example
if
0≤t≤79
switch
case 0
t/206=0
case 1
t/206=1
case 2
t/206=2
case 3
t/206=3
default
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 6
0 ≤ t ≤ 79
∧ t/20 (cid:54)= 0
∧ t/20 = 1
∧ TEMP2 = B⊕C ⊕D
∧ TEMP3 = K 2
Example
if
0≤t≤79
switch
case 0
t/206=0
case 1
t/206=1
case 2
t/206=2
case 3
t/206=3
default
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 6
Example
if
0≤t≤79
switch
case 0
t/206=0 0 ≤ t ≤ 79
case 1 ∧ t/20 (cid:54)= 0
t/206=1 ∧ t/20 = 1
case 2 ∧ TEMP2 = B⊕C ⊕D
t/206=2 ∧ TEMP3 = K 2
case 3
t/206=3
default
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 6
Example
We pass
0 ≤ t ≤ 79
∧ t/20 (cid:54)= 0
∧ t/20 = 1
∧ TEMP2 = B⊕C ⊕D
∧ TEMP3 = K 2
to a decision procedure, and obtain a satisfying assignment,
say:
t (cid:55)→ 21, B (cid:55)→ 0, C (cid:55)→ 0, D (cid:55)→ 0, K 2 (cid:55)→ 10,
TEMP2 (cid:55)→ 0, TEMP3 (cid:55)→ 10
(cid:52) It provides the values of any inputs on the path.
CBMC:BoundedModelCheckingforANSI-C–http://www.cprover.org/ 7