SMT-based Model Checking for Recursive Programs (1405.4028v2)

Abstract: We present an SMT-based symbolic model checking algorithm for safety verification of recursive programs. The algorithm is modular and analyzes procedures individually. Unlike other SMT-based approaches, it maintains both "over-" and "under-approximations" of procedure summaries. Under-approximations are used to analyze procedure calls without inlining. Over-approximations are used to block infeasible counterexamples and detect convergence to a proof. We show that for programs and properties over a decidable theory, the algorithm is guaranteed to find a counterexample, if one exists. However, efficiency depends on an oracle for quantifier elimination (QE). For Boolean Programs, the algorithm is a polynomial decision procedure, matching the worst-case bounds of the best BDD-based algorithms. For Linear Arithmetic (integers and rationals), we give an efficient instantiation of the algorithm by applying QE "lazily". We use existing interpolation techniques to over-approximate QE and introduce "Model Based Projection" to under-approximate QE. Empirical evaluation on SV-COMP benchmarks shows that our algorithm improves significantly on the state-of-the-art.

• The paper presents RecMC, an SMT-based algorithm that simultaneously uses over- and under-approximations to verify the safety of recursive programs.
• It improves efficiency by avoiding procedure inlining and achieving polynomial complexity for Boolean Programs compared to exponential alternatives.
• Empirical evaluations using SV-COMP benchmarks and the Spacer tool demonstrate RecMC’s superior performance and clear termination guarantees.

SMT-based Model Checking for Recursive Programs

The paper commemorates the development of RecMC, an SMT-based symbolic model checking algorithm specifically designed for the safety verification of recursive programs. As a notable contribution to the domain of formal verification, RecMC utilizes Satisfiability Modulo Theories (SMT) technology to craft a robust approach applicable across a broad array of decidable theories, such as Linear Rational Arithmetic (LRA) and Linear Integer Arithmetic (LIA).

A point of deviation from traditional methods lies in RecMC's dual approximation strategies. The algorithm effectively maintains both over- and under-approximations of procedure summaries, termed summary facts and reachability facts, respectively. These approximations enable procedure analysis without the cumbersome process of procedure inlining, thereby preserving efficiency. Summary facts block spurious counterexamples, ensuring safety claims, while reachability facts foster efficient exploration of viable execution paths.

Empirical evaluation underlined RecMC's competence, where the method showed marked improvements over established benchmarks from SV-COMP, an annual competition in software verification. The key advantage exhibited by RecMC stems from its polynomial computational complexity for Boolean Programs, a significant achievement in contrast to alternatives that exhibit exponential worst-case complexity. The empirical success of the approach is further corroborated by its implementation within the Spacer tool, leveraging the capabilities of the Z3 SMT solver, which exhibited superior verification outcomes compared to legacy approaches such as GPDR.

The theoretical landscape is rigorously supported by clear termination guarantees. The co-semidecision nature of RecMC ensures that the algorithm will conclusively find a counterexample should one exist. This forms a contrast to some algorithms within the domain, such as GPDR, which do not consistently offer such assurances across all types of recursive program structures.

Moreover, the paper introduces Model Based Projection (MBP), a novel approach to tackle the inherent challenge presented by quantifier elimination (QE) in theories susceptible to exponential growth in formula size due to quantifier accumulation. This methodology, when applied to both LRA and LIA, provides a pragmatic and efficient alternative to naive QE, ensuring the algorithm’s scalability and practical application in real-world scenarios.

The implications of this work stretch beyond academic pursuit, providing a tangible mechanism to enhance the verification of programs with recursive elements without sacrificing computational feasibility. The robust handling of recursive state transitions and its verification offers significant leverage towards ensuring reliability and correctness in complex software systems, particularly those employing recursive processes inherent in service-oriented architectures and concurrent systems.

Despite these achievements, the field of SMT-based verification continues to present ripe opportunities for advancing theoretical understanding and practical capability. Future explorations may benefit from extending RecMC's principles to additional theories such as uninterpreted functions, arrays, or extending its interaction with classical abstraction methodologies. The convergence of model checking with abstraction techniques could unlock new pathways in not just verifying, but also synthesizing more resilient software systems.

In summary, the paper delivers a comprehensive and meticulously grounded contribution to the field of software verification, advancing SMT-based methodologies for proving safety properties in recursive programs with notable theoretical insights, empirical validation, and potential for broad application across diverse computational domains.