ThesoftwaremodelcheckerBLAST.PDFVIP

Int J Softw Tools Technol Transfer (2007) 9:505–525 DOI 10.1007/s10009-007-0044-z SPECIAL SECTION FASE’04/05 The software model checker BLAST Applications to software engineering Dirk Beyer · Thomas A. Henzinger · Ranjit Jhala · Rupak Majumdar Published online: 13 September 2007 ? Springer-Verlag 2007 Abstract Blast is an automatic veri?cation tool for cause such executions. Our experiments show that Blast checking temporal safety properties of C programs. Given a can provide automated, precise, and scalable analysis for C program and a temporal safety property, Blast either sta- C programs. tically proves that the program satis?es the safety property, or provides an execution path that exhibits a violation of the Keywords Model checking · Software veri?cation · property (or, since the problem is undecidable, does not ter- Software speci?cation · Memory safety · Test-case minate). Blast constructs, explores, and re?nes abstractions generation of the program state space based on lazy predicate abstrac- tion and interpolation-based predicate discovery. This paper gives an introduction to Blast and demonstrates, through two case studies, how it can be applied to program veri?ca- 1 Introduction tion and test-case generation. In the ?rst case study, we use Blast to statically prove memory safety for C programs. Model checking is an algorithmic technique to verify a sys- We use CCured, a type-based memory-safety analyzer, to tem description against a speci?cation [20,22,75]. Given a annotate a program with run-time assertions that check for system description and a logical speci?cation, the model- safe memory operations. Then, we use Blast to remove as checking algorithm either proves that the system description many of the run-time checks as possible (by proving that satis?es the speci?cation, or reports a counterexample that these checks never fail), and to generate execution scenarios violates the speci?cation. Software model checking, the ap- that