System and method for tunneling and slicing based BMC decomposition
View Patent ↗A system and method for bounded model checking of computer programs includes providing a program having at least one reachable property node. The program is decomposed for bounded model checking (BMC) into subproblems by creating a tunnel based on disjunctive control paths through the program. A reduced BMC sub-problem obtained using BMC unrolling, while using path constraints imposed by the at least one tunnel. For the reachable property node, determining a quantifier-free formula (QFP) in a decidable subset of first order logic. Satisfiability of the QFP is checked, independently and individually, to determine whether the QFP is satisfiable for the subproblem. The decomposing is continued until the a BMC bound is reached.
1. A method for bounded model checking of computer programs, comprising:
providing a program having at least one reachable property node, wherein the program is stored on a computer-readable storage medium;
decomposing the program for bounded model checking (BMC) into subproblems by:
creating at least one tunnel based on disjunctive control paths through the program;
obtaining a reduced BMC sub-problem using BMC unrolling, while using path constraints imposed by the at least one tunnel;
for the reachable property node, determining a quantifier-free formula (QFP) in a decidable subset of first order logic; and
checking satisfiability of the QFP, independently and individually, to determine whether the QFP is satisfiable for the subproblem; and
continuing the decomposing until the a BMC bound is reached.
2. The method as recited in claim 1 , wherein creating includes performing forward and backward slicing on an unrolled control flow graph (CFG) to obtain a disjoint set of control paths which pass through partitioned tunnel-posts at a partition depth.
3. The method as recited in claim 1 , wherein checking satisfiability is performed using a satisfiability modulo theory (SMT) solver.
4. The method as recited in claim 1 , further comprising, if the QFP formula is satisfiable, determining a counter-example (CEX); and if all BMC sub-problems are unsatisfiable, increasing unrolled depth and repeating the decomposing step.
5. The method as recited in claim 1 , further comprising applying flow constraints to the at least one tunnel to further constrain the subproblem.
6. The method as recited in claim 1 , further comprising computing bounded control state reachability to a bounded model checking bound to determine if the at least one reachable property node exists.
7. The method as recited in claim 1 , wherein each subproblem is independent such that each subproblem can be scheduled and solved independently of all other subproblems.
8. The method as recited in claim 1 , further comprising partitioning the at least one tunnel into a set of smaller tunnels based on disjunctive control paths and solving each of the set as subproblems.
9. A method for bounded model checking of computer programs, comprising:
providing a program having at least one reachable property node, wherein the program is stored on a computer-readable storage medium;
decomposing the program for bounded model checking (BMC) into subproblems by:
creating at least one tunnel based on disjunctive control paths through the program by performing forward and backward slicing on an unrolled control flow graph (CFG) to obtain a disjoint set of control paths which pass through partitioned tunnel-posts at a partition depth;
obtaining a reduced BMC sub-problem using BMC unrolling, while using path constraints imposed by the at least one tunnel;
for the reachable property node, determining a quantifier-free formula (QFP) in a decidable subset of first order logic; and
checking satisfiability of the QFP, independently and individually, to determine whether the QFP is satisfiable for the subproblem using a satisfiability modulo theory (SMT) solver; and
continuing the decomposing until the a BMC bound is reached.
10. The method as recited in claim 9 , further comprising, if the QFP formula is satisfiable, determining a counter-example (CEX); and if all BMC sub-problems are unsatisfiable, increasing unrolled depth and repeating the decomposing step.
11. The method as recited in claim 9 , further comprising applying flow constraints to the at least one tunnel to further constrain the subproblem.
12. The method as recited in claim 9 , further comprising computing bounded control state reachability to a bounded model checking bound to determine if the at least one reachable property node exists.
13. The method as recited in claim 9 , wherein each subproblem is independent such that each subproblem can be scheduled and solved independently of all other subproblems.
14. The method as recited in claim 9 , further comprising partitioning the at least one tunnel into a set of smaller tunnels based on disjunctive control paths and solving each of the set as subproblems.