SMT-Based Bounded Model Checking for Embedded ANSI-C Software for - PowerPoint PPT Presentation

SMT-Based Bounded Model Checking for Embedded ANSI-C Software for Embedded ANSI-C Software Lucas Cordeiro, Bernd Fischer, Joao Marques-Silva b.fischer@ecs.soton.ac.uk

Bounded Model Checking (BMC) Basic Idea: check negation of given property up to given depth property ¬ ϕ 0 ¬ ϕ 1 ¬ ϕ k -1 ¬ ϕ k ¬ ϕ 2 ∨ ∨ ∨ ∨ . . . transition M 0 M 1 M 2 M k -1 M k system bound counterexample trace counterexample trace • transition system M unrolled k times – for programs: unroll loops, unfold arrays, … • translated into verification condition ψ such that ψ satisfiable iff ϕ ϕ has counterexample of max. depth k ψ ψ ψ ϕ ϕ • has been applied successfully to verify (embedded) software

SAT-based CBMC [D. Kroening] implements BMC for ANSI-C/C++ programs using SAT-solvers: unroll program k times C/C++ parse IRep source tree tree verification SAT BMC conditions solver scan and typecheck and properties properties parse parse convert to SSA convert to SSA check satisfiability using a SAT solver

SAT-based CBMC [D. Kroening] implements BMC for ANSI-C/C++ programs using SAT-solvers: unroll program k times C/C++ parse IRep source tree tree verification SAT BMC conditions solver scan and typecheck and properties properties parse parse convert to SSA convert to SSA check satisfiability using a SAT solver ⇒ conversion to propositional form ⇒ ⇒ ⇒ Problems (due to bit-blasting ): • complex expressions lead to large propositional formulae Encoding of x == a + b • high-level information is lost • represent x, a, b by n independent propositional variables each • represent addition by logical circuit • represent equality by equivalences on propositional variables

Objective of this work Exploit SMT to improve BMC of embedded software • exploit background theories of SMT solvers • provide suitable encodings for – pointers – bit operations – unions – arithmetic over- and underflow • build an SMT-based BMC tool for full ANSI-C – build on top of CBMC front-end – use several third-party SMT solvers as back-ends • evaluate ESBMC over embedded software applications

Satisfiability Modulo Theories (1) SMT decides the satisfiability of first-order logic formulae using the combination of different background theories ( ⇒ building-in operators). Theory Example x 1 =x 2 ∧ ¬ (x 1 =x 3 ) � ¬ (x 1 =x 3 ) x 1 =x 2 ∧ ¬ (x 1 =x 3 ) � ¬ (x 1 =x 3 ) Equality Equality Bit-vectors (b >> i) & 1 = 1 Linear arithmetic (4y 1 + 3y 2 ≥ 4) ∨ (y 2 – 3y 3 ≤ 3) (j = k ∧ a[k]=2) � a[j]=2 Arrays (j ≤ k ∧ a[j]=2) � a[i] < 3 Combined theories

Satisfiability Modulo Theories (2) • Given – a decidable � -theory T – a quantifier-free formula ϕ ϕ is T -satisfiable iff T ∪ { ϕ } is satisfiable, i.e., there exists a ϕ ϕ ϕ structure that satisfies both formula and sentences of T • Given • Given – a set Γ ∪ { ϕ } of first-order formulae over T Γ ( Γ ⊧ ⊧ T ϕ ) iff every model of T ∪ Γ ⊧ ⊧ ϕ is a T -consequence of Γ ϕ ϕ ϕ Γ Γ is also a model of ϕ • Checking Γ ⊧ ⊧ ⊧ ⊧ T ϕ can be reduced in the usual way to checking the T-satisfiability of Γ ∪ {¬ ϕ }

Software BMC using ESBMC ��� �������� • program modelled as state transition system ��� ����������� – state : program counter and program variables �� ������ – derived from control-flow graph ������� ���� – checked safety properties give extra nodes ��������� ������ ������������ • program unrolled up to given bounds � – number of loop iterations – size of arrays – size of arrays • unrolled program optimized to reduce blow-up – constant folding crucial – forward substitutions

Software BMC using ESBMC ��� �������� • program modelled as state transition system ��� ����������� – state : program counter and program variables �� ������ – derived from control-flow graph ������� ���� – checked safety properties give extra nodes ��������� ������ ������������ • program unrolled up to given bounds � – number of loop iterations – size of arrays – size of arrays • unrolled program optimized to reduce blow-up – constant folding � � ��� � ���� crucial � � ��� � ������� � ���� – forward substitutions � � ��� � � � ��� � ��������� � ���� • front-end converts unrolled and � � ��� � ��� � ��� � optimized program into SSA � � ��� �� ���� � ������

Software BMC using ESBMC ��� �������� • program modelled as state transition system ��� ����������� – state : program counter and program variables �� ������ – derived from control-flow graph ������� ���� – checked safety properties give extra nodes ��������� ������ ������������ • program unrolled up to given bounds � – number of loop iterations – size of arrays – size of arrays • unrolled program optimized to reduce blow-up � ( ) � g : = x = 0 – constant folding 1 1 � � ( ) ∧ a : = store a , i , 0 � � crucial 1 0 0 � � – forward substitutions C : = ∧ a : = a � 2 0 � ( ) � ∧ a : = store a , 2 + i , 1 � 3 2 0 • front-end converts unrolled and � � � � ∧ a : = ite ( g , a , a ) 4 1 1 3 optimized program into SSA � � i ≥ 0 ∧ i < 2 0 0 � � ∧ 2 + i ≥ 0 ∧ 2 + i < 2 � � • extraction of constraints C and properties P 0 0 P : = � � ∧ 1 + i ≥ 0 ∧ 1 + i < 2 � 0 0 � ( ) – specific to selected SMT solver, uses theories � � ∧ select a , i + 1 = 1 4 0 • satisfiability check of C ∧ ¬ P

Encoding of Numeric Types • SMT solvers typically provide different encodings for numbers: – abstract domains ( � � � , � � � � � ) – fixed-width bit vectors ( ������������ , …) � “internalized bit-blasting” • verification results can depend on encodings valid in abstract domains such as � such as � � or � � � � or � � � � � � � � � (a > 0) ∧ (b > 0) ⇒ ⇒ ⇒ ⇒ (a + b > 0) ⇒ ⇒ ⇒ ⇒ doesn’t hold for bitvectors, due to possible overflows – majority of VCs solved faster if numeric types are modelled by abstract domains but possible loss of precision – ESBMC supports both encodings

Encoding Numeric Types as Bitvectors Bitvector encodings need to handle • type casts and implicit conversions – arithmetic conversions implemented using word-level functions (part of the bitvector theory: extractBits, …) � different conversions for every pair of types � uses type information provided by front-end – conversion to / from bool via if-then-else operator – conversion to / from bool via if-then-else operator • arithmetic over- / underflow – standard requires modulo-arithmetic for unsigned integers – define error literals to detect over- / underflow for other types res_ok ⇔ ¬ overflow(x, y) ∧ ¬ underflow(x, y) � similar to conversions • floating-point numbers – approximated by fixed-point numbers, integral part only – represented by fixed-width bitvector

Encoding of Structured Datatypes • arrays and records / tuples typically handled directly by SMT-solver • pointers modelled as tuples – p.o ≙ representation of underlying object Store object at – p.i ≙ index (if pointer used as array base) position 0 � ����� !"�� �����#����� � �� ����� !"�� � �����#����� ��� �������� ��� �������� ∧ � �� ����� !"�� � ������� ∧ ��� ������������$�� ���� ∧ � �� ����� �� ������ Store index at �� ������ ∧ � �� ����� !"�� � ��� � ���� '�� position 1 ������� ∧ � �� ���� � Update index ���� ∧ � �� ����� !"�� � ������ � ���� ��������� ∧ � �� �����"�� � ��� � ��� � � ������ �$���������� ∧ � �� ����� !"�� � ������"%"&��� �� ������� �