SMT-Based Bounded Model Checking for Embedded ANSI-C Software….pdfVIP

SMT-Based Bounded Model Checking for Embedded ANSI-C Software Lucas Cordeiro Bernd Fischer Joao Marques-Silva University of Southampton University of Southampton University College Dublin lcc08r@ecs.soton.ac.uk b.fischer@ecs.soton.ac.uk jpms@ucd.ie Abstract solving the verification conditions generated from the BMC instances [2], [3], [4], [5]. In SMT, predicates Propositional bounded model checking has been from various (decidable) theories are not encoded by applied successfully to verify embedded software but propositional variables as in SAT, but remain in the is limited by the increasing propositional formula size problem formulation. These theories are handled by and the loss of structure during the translation. These dedicated decision procedures. Thus, in SMT-based limitations can be reduced by encoding word-level BMC, is a quantifier-free formula in a decidable information in theories richer than propositional logic subset of first-order logic which is then checked for and using SMT solvers for the generated verification satisfiability by an SMT solver. conditions. Here, we investigate the application of dif- In order to reason about embedded software accu- ferent SMT solvers to the verification of embedded soft- rately, an SMT-based BMC must consider a number ware written in ANSI-C. We have extended the encod- of issues that are not easily mapped into the theories ings from previous SMT-based bounded model checkers supported by SMT solvers. In p