SoftwareModelCheckingWhereItIs,andWhereItsHeaded.ppt

Outline Introduction to Model Checking (MC) Software MC Success Stories Research Directions Partial-order reduction Heuristic search MC + symbolic execution Concrete (little abstraction) MC of Java, C, machine code Heap abstractions Environment modeling Introduction to Model Checking Model Checking (MC): systematic exploration of the possible behaviors of a system to determine whether the system satisfies a specified property. If property is not satisfied, the model checker provides a counter-example: a path in the state space that violates the property. Abstraction: approximations that reduce the cost of MC. Abstraction may cause false alarms (spurious counterexamples). Unsound abstractions may cause missed errors. MC is path-sensitive. Traditional static analysis isn’t. Explicit-State MC and Symbolic MC Explicit-State MC: states are manipulated individually. Symbolic MC: sets of states are represented by logical formulas. The set of successors of a set Φ of states is computed by manipulating Φ and the formula representing the system’s transition relation. Symbolic MC using OBDDs (an efficient representation of boolean formulas) is dominant in hardware verification. OBDDs are not as widely used in software verification. Hard to combine with partial-order reduction. Harder to model dynamic memory allocation. Use symbolic execution and constraints instead. Outline Introduction to Model Checking (MC) Software MC Success Stories Research Directions Partial-order reduction Heuristic search MC + symbolic execution Concrete (little abstraction) MC of Java, C, machine code Heap abstractions Environment modeling Success Story for MC with Abstraction: Static Driver Verifier (formerly SLAM) [Ball, Rajamani, et al., 2000-2005] Applied to all drivers developed by Microsoft. Released in Windows Device-Driver Development Kit, 2005. Predicate abstraction [Graf and Saidi 1997]: The data state of a C program CP is abstracted by the values of a set of predicates; e.g., start with