Verifying multi-threaded software using SMT-based context-bounded model checking

We describe and evaluate three approaches to model check multi-threaded software with shared variables and locks using bounded model checking based on Satisfiability Modulo Theories (SMT) and our modelling of the synchronization primitives of the Pthread library. In the lazy approach, we generate all possible interleavings and call the SMT solver on each of them individually, until we either find a bug, or have systematically explored all interleavings. In the schedule recording approach, we encode all possible interleavings into one single formula and then exploit the high speed of the SMT solvers. In the underapproximation and widening approach, we reduce the state space by abstracting the number of interleavings from the proofs of unsatisfiability generated by the SMT solvers. In all three approaches, we bound the number of context switches allowed among threads in order to reduce the number of interleavings explored. We implemented these approaches in ESBMC, our SMT-based bounded model checker for ANSI-C programs. Our experiments show that ESBMC can analyze larger problems and substantially reduce the verification time compared to state-of-the-art techniques that use iterative context-bounding algorithms or counter-example guided abstraction refinement

Towards A Semiformal Development Methodology for Embedded Systems

In recent days, the amount of functions has increased significantly in embedded products so that systems development methodologies play an important role to ensure the product’s quality, cost, and time. Furthermore, this complexity coupled with constantly evolving specifications, has led to propose a semiformal development methodology to support the building of embedded real-time systems. A platform-based design approach has been used to balance costs and time-to-market in relation to performance and functionality constraints. We performed three expressive case studies and we concluded that the proposed methodology significantly reduces design time and improves software modularity and reliability

SMT-Based Bounded Model Checking for Multi-threaded Software in Embedded Systems

The transition from single-core to multi-core processors has made multi-threaded software an important subject over the last years in computer-aided verification. Model checkers have been successfully applied to discover subtle errors, but they suffer from combinatorial state space explosion when verifying multi-threaded software. In our previous work, we have extended the encodings from SMT-based bounded model checking (BMC) to provide more accurate support for program verification and to use different background theories and solvers in order to improve scalability and precision in a completely automatic way. We now focus on extending this work to support an SMT-based BMC formulation of multi-threaded software which allows the state space to be reduced by abstracting the number of state variables and interleavings from the proof of unsatisfiability generated by the SMT solvers. The core idea of our approach aims to extract the proof objects produced by the SMT solvers in order to control the number of interleavings and to remove logic that is not relevant to a given property. This work aims to develop a new algorithmic method and corresponding tools based on SMT to verify embedded software in multi-core systems

SMT-Based Bounded Model Checking of Fixed-Point Digital Controllers

Digital controllers have several advantages with respect to their flexibility and design's simplicity. However, they are subject to problems that are not faced by analog controllers. In particular, these problems are related to the finite word-length implementation that might lead to overflows, limit cycles, and time constraints in fixed-point processors. This paper proposes a new method to detect design's errors in digital controllers using a state-of-the art bounded model checker based on satisfiability modulo theories. The experiments with digital controllers for a ball and beam plant demonstrate that the proposed method can be very effective in finding errors in digital controllers than other existing approaches based on traditional simulations tools