Skip to main content
SpringerLink
Log in

Making Bounded Model Checking Interprocedural in (Static Analysis) Style

  • Conference paper
  • First Online:
Tools and Methods of Program Analysis (TMPA 2019)

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 1288))

Included in the following conference series:

  • 321 Accesses

Abstract

Bounded model checking (BMC) is one of the most interesting and practical methods of software quality assurance; it converts the program to a logical formula, which is checked for correctness using SAT or SMT solvers. An inherent problem of BMC is how one does interprocedural analysis, which is usually performed using function inlining. However, inlining greatly increases the size and complexity of the resulting formula, making analysis close to impossible to perform in a reasonable time. In this work we propose a method of interprocedural BMC based on ideas from the related area of program static analysis; it works by creating context-sensitive versions of formulae for interesting safety properties, which are considerably smaller than formulae with full inlining. We have implemented a prototype based on our approach in a BMC tool called Borealis, evaluated it on a number of real-world programs and shown our approach to greatly improve analysis performance and precision.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    This is a reduced version of PS definition from [3].

  2. 2.

    The test machine had Intel Core i7-4790 3.6 GHz processor, 32 GB of memory, and Intel 535 SSD storage.

  3. 3.

    This was confirmed by analyzing the full bug reports, which are omitted for brevity.

  4. 4.

    It is important to note that for mptun interprocedural mode finds exactly the same bugs as inlining, while being faster at the same time.

References

  1. Clang static analyzer. http://clang-analyzer.llvm.org/ (2019). Accessed 20 Feb 2019

  2. Aiken, A., Bugrara, S., Dillig, I., Dillig, T., Hackett, B., Hawkins, P.: An overview of the saturn project. In: Proceedings of the 7th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, pp. 43–48. ACM (2007)

    Google Scholar 

  3. Akhin, M., Belyaev, M., Itsykson, V.: Borealis bounded model checker: the coming of age story. Present and Ulterior Software Engineering, pp. 119–137. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-67425-4_8

    Chapter  Google Scholar 

  4. Armando, A., Mantovani, J., Platania, L.: Bounded model checking of software using SMT solvers instead of SAT solvers. In: Valmari, A. (ed.) SPIN 2006. LNCS, vol. 3925, pp. 146–162. Springer, Heidelberg (2006). https://doi.org/10.1007/11691617_9

    Chapter  MATH  Google Scholar 

  5. Ball, T., Rajamani, S.K., Rajamani, S., Ball, T.: SLIC: a specification language for interface checking (of c). Microsoft Research (2002)

    Google Scholar 

  6. Baudin, P., et al.: ACSL: ANSI/ISO C Specification Language. Preliminary Design, version 1.4, 2008, preliminary edn. (2008)

    Google Scholar 

  7. Biere, A., Cimatti, A., Clarke, E., Zhu, Y.: Symbolic model checking without BDDs. In: Cleaveland, W.R. (ed.) TACAS 1999. LNCS, vol. 1579, pp. 193–207. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-49059-0_14

    Chapter  Google Scholar 

  8. Christakis, M., Bird, C.: What developers want and need from program analysis: an empirical study. In: Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering, ASE 2016, pp. 332–343. ACM, New York (2016). https://doi.org/10.1145/2970276.2970347. http://doi.acm.org/10.1145/2970276.2970347

  9. Ivancic, F., et al.: Model checking C programs using f-soft. In: 2005 IEEE International Conference on Computer Design: VLSI in Computers and Processors, ICCD 2005, Proceedings, pp. 297–308. IEEE (2005)

    Google Scholar 

  10. Kroening, D., Tautschnig, M.: CBMC – C bounded model checker. In: Ábrahám, E., Havelund, K. (eds.) TACAS 2014. LNCS, vol. 8413, pp. 389–391. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-54862-8_26

    Chapter  Google Scholar 

  11. Lam, M.S., et al.: Context-sensitive program analysis as database queries. In: Proceedings of the Twenty-fourth ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, PODS 2005, pp. 1–12. ACM, New York(2005). https://doi.org/10.1145/1065167.1065169. http://doi.acm.org/10.1145/1065167.1065169

  12. Landi, W.: Undecidability of static analysis. LOPLAS 1(4), 323–337 (1992)

    Article  Google Scholar 

  13. Lattner, C., Adve, V.: LLVM: a compilation framework for lifelong program analysis & transformation. In: CGO 2004, pp. 75–86 (2004)

    Google Scholar 

  14. Leavens, G.T., Clifton, C.: Lessons from the JML project. In: Meyer, B., Woodcock, J. (eds.) VSTTE 2005. LNCS, vol. 4171, pp. 134–143. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-69149-5_15

    Chapter  Google Scholar 

  15. Merz, F., Falke, S., Sinz, C.: LLBMC: bounded model checking of C and C++ programs using a compiler IR. In: Joshi, R., Müller, P., Podelski, A. (eds.) VSTTE 2012. LNCS, vol. 7152, pp. 146–161. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-27705-4_12

    Chapter  Google Scholar 

  16. Sery, O., Fedyukovich, G., Sharygina, N.: Interpolation-based function summaries in bounded model checking. In: Eder, K., Lourenço, J., Shehory, O. (eds.) HVC 2011. LNCS, vol. 7261, pp. 160–175. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-34188-5_15

    Chapter  Google Scholar 

  17. Sharir, M., Pnueli, A., et al.: Two approaches to interprocedural data flow analysis. New York University. Courant Institute of Mathematical Sciences, Computer Science Department (1978)

    Google Scholar 

  18. Smullyan, R.R.: First-Order Logic, vol. 43. Springer, Heidelberg (2012)

    MATH  Google Scholar 

  19. Steensgaard, B.: Points-to analysis in almost linear time. In: Proceedings of the 23rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 32–41. ACM (1996)

    Google Scholar 

  20. Weiser, M.: Program slicing. In: Proceedings of the 5th International Conference on Software Engineering, pp. 439–449. IEEE Press (1981)

    Google Scholar 

  21. Zhang, X., Mangal, R., Naik, M., Yang, H.: Hybrid top-down and bottom-up interprocedural analysis. SIGPLAN Not. 49(6), 249–258 (2014). https://doi.org/10.1145/2666356.2594328. http://doi.acm.org/10.1145/2666356.2594328

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Saint Petersburg Polytechnic University, St. Petersburg, Russia

    Daniil Stepanov, Marat Akhin & Mikhail Belyaev

  2. Jetbrains Research, St. Petersburg, Russia

    Daniil Stepanov, Marat Akhin & Mikhail Belyaev

Authors
  1. Daniil Stepanov
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Marat Akhin
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mikhail Belyaev
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Daniil Stepanov .

Editor information

Editors and Affiliations

  1. University of Melbourne, Melbourne, VIC, Australia

    Anna Kalenkova

  2. Intelligent Systems Group, UPV/EHU, Donostia, Spain

    Jose A. Lozano

  3. Tomsk Polytechnic University, Tomsk, Russia

    Rostislav Yavorskiy

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Stepanov, D., Akhin, M., Belyaev, M. (2021). Making Bounded Model Checking Interprocedural in (Static Analysis) Style. In: Kalenkova, A., Lozano, J.A., Yavorskiy, R. (eds) Tools and Methods of Program Analysis. TMPA 2019. Communications in Computer and Information Science, vol 1288. Springer, Cham. https://doi.org/10.1007/978-3-030-71472-7_12

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-71472-7_12

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-71471-0

  • Online ISBN: 978-3-030-71472-7

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation