Abstract:Software model checking is a challenging problem, and generating relevant invariants is a key factor in proving the safety properties of a program. Program invariants can be obtained by various approaches, including lightweight procedures based on data-flow analysis and intensive techniques using Craig interpolation. Although data-flow analysis runs efficiently, it often produces invariants that are too weak to prove the properties. By contrast, interpolation-based approaches build strong invariants from interpolants, but they might not scale well due to expensive interpolation procedures. Invariants can also be injected into model-checking algorithms to assist the analysis. Invariant injection has been studied for many well-known approaches, including k-induction, predicate abstraction, and symbolic execution. We propose an augmented interpolation-based verification algorithm that injects external invariants into interpolation-based model checking (McMillan, 2003), a hardware model-checking algorithm recently adopted for software verification. The auxiliary invariants help prune unreachable states in Craig interpolants and confine the analysis to the reachable parts of a program. We implemented the proposed technique in the verification framework CPAchecker and evaluated it against mature SMT-based methods in CPAchecker as well as other state-of-the-art software verifiers. We found that injecting invariants reduces the number of interpolation queries needed to prove safety properties and improves the run-time efficiency. Consequently, the proposed invariant-injection approach verified difficult tasks that none of its plain version (i.e., without invariants), the invariant generator, or any compared tools could solve.

Property-specific sequential invariant extraction for SAT-based unbounded model checking

Invariant Checking for SMT-based Systems with Quantifiers

An Efficient Sequential Equivalence Checking Framework Using Boolean Satisfiability

Efficient Software Product-Line Model Checking Using Induction and a SAT Solver

Model Checking in Bits and Pieces

Model Checking Embedded C Software using k-Induction and Invariants (extended version)

An Effective Model Extraction Method with State Space Compression for Model Checking SystemC TLM Designs

Structural Invariants for Parametric Verification of Systems with Almost Linear Architectures

SMT-Based Model Checking of Industrial Simulink Models

Augmenting Interpolation-Based Model Checking with Auxiliary Invariants (Extended Version)

Enhance SAT Conflict Analysis for Model Checking

High-Level Bounded Model Checking Using Wu's Method

VERIS: an Efficient Model Checker for Synchronous VHDL Designs

Abstraction-based model checking programs

Optimizing the SAT Decision Ordering of Bounded Model Checking by Structural Information

Regular Model Checking Upside-Down: An Invariant-Based Approach

Safety model checking with complementary approximations

Improve Model Checking Efficiency Using Specific Knowledge about the System

LLM Meets Bounded Model Checking: Neuro-symbolic Loop Invariant Inference

Model Checking C Programs with Loops via k-Induction and Invariants

Model-Checking Linear-Time Properties of Quantum Systems