2011 26th IEEE/ACM International Conference on Automated Software Engineering (ASE 2011) (2009)
Auckland, New Zealand
Nov. 16, 2009 to Nov. 20, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ASE.2009.63
Propositional bounded model checking has been applied successfully to verify embedded software but is limited by the increasing propositional formula size and the loss of structure during the translation. These limitations can be reduced by encoding word-level information in theories richer than propositional logic and using SMT solvers for the generated verification conditions. Here, we investigate the application of different SMT solvers to the verification of embedded software written in ANSI-C. We have extended the encodings from previous SMT-based bounded model checkers to provide more accurate support for variables of finite bit width, bit-vector operations, arrays, structures, unions and pointers. We have integrated the CVC3, Boolector, and Z3 solvers with the CBMC front-end and evaluated them using both standard software model checking benchmarks and typical embedded software applications from telecommunications, control systems, and medical devices. The experiments show that our approach can analyze larger problems and substantially reduce the verification time.
Bounded Model Checking, Satisfiability Modulo Theories, Embedded ANSI-C Software
Lucas Cordeiro, Joao Marques-Silva, Bernd Fischer, "SMT-Based Bounded Model Checking for Embedded ANSI-C Software", 2011 26th IEEE/ACM International Conference on Automated Software Engineering (ASE 2011), vol. 00, no. , pp. 137-148, 2009, doi:10.1109/ASE.2009.63