Bounded Model Checking with CaS

• Bounded Model Checking with Code-as-Specification (CaS) is a verification paradigm that uses executable C code as both the reference and candidate implementation, ensuring behavioral equivalence within defined execution bounds.
• CBMC employs a multi-stage pipeline—including inlining, loop unwinding, SSA transformation, and bit-precise SMT encoding—to generate verification conditions and detect counterexamples efficiently.
• This approach is integral for regression analysis, test generation, and security auditing, particularly in safety-critical systems where precise behavior validation is essential.

Bounded Model Checking with “Code-as-Specification” (CaS) is a software verification paradigm in which an executable fragment of C code serves as the reference model (“the spec”), and another fragment implements the (candidate) target (“the impl”), with automated machinery checking that spec and impl produce identical observable results on all possible executions up to a user-supplied resource bound. The C Bounded Model Checker (CBMC) implements this paradigm at high precision by inlining both spec and impl into a single verification harness, symbolically executing the unwound, loop-free program, encoding all behaviors as bit-precise logical formulas, and using a SAT/SMT solver to check for behavioral divergences. If a counterexample input exists within the bound, CBMC produces it; if none exists, equivalence is proven for all executions up to the bound. This approach is widely utilized in software equivalence checking, regression analysis, test input generation, and synthesis, particularly in safety- and security-critical codebases (Kroening et al., 2023).

1. Formalization of Code-as-Specification in CBMC

Let $f_{\mathrm{spec}}(\vec x)$ and $f_{\mathrm{imp}}(\vec x)$ be two C functions of identical type signature. The central property checked is

$$\forall\, \vec x .\quad f_{\mathrm{imp}}(\vec x) = f_{\mathrm{spec}}(\vec x)$$

for all input vectors $\vec x$ and all executions where loops are executed at most $k$ times (the “unwinding bound”).

CBMC realizes this via an inlined C test harness:

T x0 = nondet_T(), ..., x_{n-1}=nondet_T(); __CPROVER_assume(preconditions on inputs); out_spec = f_spec(x0, ..., x_{n-1}); out_imp = f_imp(x0, ..., x_{n-1}); assert(out_spec == out_imp);

Execution proceeds by symbolically considering all (bounded) paths, with the assertion transformed into a verification condition (VCC). CBMC then attempts to find an assignment to the nondeterministic inputs (“nondet”) that falsifies the assertion, i.e., produces a behavioral divergence between spec and impl (Kroening et al., 2023).

2. Pipeline: From C Code to Bit-Precise SMT

The verification process in CBMC follows a multi-stage translation pipeline:

1. Inlining and Loop Unwinding: Both spec and impl are inlined into a harness; all loops are unrolled up to bound $k$.
2. SSA (Static Single-Assignment) Form: Each variable assignment is uniquely indexed; all “GOTO”-level control flow is made explicit.
3. Encoding to Logic: Every SSA-level assignment, assertion, branch, and pointer operation is translated to a bit-vector formula or equivalent propositional constraints.

Typical encodings include:

• Assignments: At program point $i$, $g_i \Longrightarrow x^{(i)} = E(e)$, where $g_i$ is the guard and $E(e)$ is the bit-vector encoding.
• Conditionals: Directed via guards: $g_{i+1} = g_i \wedge B(b)$, $g_{j+1} = g_i \wedge \neg B(b)$, where $B(b)$ encodes a Boolean test.
• Memory Operations: Pointer dereferences and stores are modeled bit-precisely, e.g., $$g_i \Longrightarrow (p^{(i)} \in \mathit{dom}(M^{(i)}) \wedge r^{(i)} = M^{(i)}[p^{(i)}])$$ for loads.
• Loop Unwinding: A loop such as while(cond) { ... } is replaced by $k$ nested conditionals, with an extra “unwinding assertion” enforcing that further iterations do not occur beyond $k$.

Table 1: CBMC Encoding Elements

C Construct	SSA/Constraint Encoding	Purpose
Assignment	$g_i \Longrightarrow x^{(i)} = E(e)$	Bit-precise dataflow modeling
Conditional	$g_{i+1} = g_i \wedge B(b)$	Explicit control flow
Loop (bound $k$)	$k$ inlined bodies + unwinding assertion	Bounded unrolling of loops
Pointer Load	$$g_i \Longrightarrow (p^{(i)} \in \mathit{dom}(M^{(i)}))$$	Memory soundness

All constraints for spec, impl, and harness are conjoined, and the negation of the assertion $out_{\mathrm{spec}} = out_{\mathrm{imp}}$ is included, yielding the overall formula

$$F(\vec x) = \Phi_{\mathrm{spec}}(\vec x) \wedge \Phi_{\mathrm{imp}}(\vec x) \wedge (out_{\mathrm{spec}} \ne out_{\mathrm{imp}})$$

(Kroening et al., 2023).

3. Handling Nondeterminism, Assertions, and Environmental Modeling

• Nondeterminism: Realized in code by nondet_*() calls, introduced as fresh unconstrained SSA variables. Constraints from __CPROVER_assume(...) are enforced to restrict found counterexamples.
• Assertions: All C-level assert(expr) become VCCs at the SSA level, conjoined and tested collectively.
• Environment Models: System/library functions such as malloc, pthread_*, or I/O are stubbed out either as non-deterministic returns or as sound over-approximations, permitting analysis of real-world code without full implementations.

This modeling enables CaS analyses that interact meaningfully with operating systems, memory allocation, and concurrent code—provided sufficient harnessing and stubbing is performed (Kroening et al., 2023).

4. Concrete Worked Example

Consider testing a reference absolute value function against a buggy implementation:

// spec.c int spec_abs(int x) { if(x<0) return -x; else return x; } // impl.c int impl_abs(int x) { if(x<0) return -x + 1; // Off-by-one bug else return x; } // harness.c int __CPROVER_start() { int x = nondet_int(); int y1 = spec_abs(x); int y2 = impl_abs(x); assert(y1 == y2); return 0; }

Invoking CBMC:

cbmc --function __CPROVER_start --unwind 0 harness.c spec.c impl.c

CBMC translates and encodes all paths, generating formulas that capture both implementations. For $x=-1$, $y_1=1$, $y_2=2$, so assertion $y_1==y_2$ fails. The SAT solver finds $x=-1$ as a counterexample and CBMC reports the failure, displaying the diverging outputs and problematic input (Kroening et al., 2023).

5. Performance Analysis and Practical Limitations

• Bit-Precision: All integer and floating-point computations are bit-precise, enabling precise bug characterization but resulting in large formulas (dozens to hundreds of SAT bits per operation).
• Loop Unwinding Overhead: Deep or nested loops incur a blowup of $O(k)$ in formula size per loop body; thus, large $k$ or heavy control-flow code is computationally demanding.
• Scalability Features: CBMC incorporates slicing, constant propagation, and aggressive simplification before formula generation, supporting codebases comprising thousands of lines and unwinding bounds in the low hundreds.
• Boundedness: The main limitation arises for unbounded loops or data-dependent loop counts exceeding $k$. CBMC can verify only the absence of counterexamples up to $k$, not unbounded correctness.
• Manual Modeling Requirement: Harnesses, environment stubs, and assumes often require manual intervention in large codebases, trading off full automation for precise and actionable bug reports.

A plausible implication is that for highly concurrent or complex interactive codebases, verification harnesses and environment models may limit overall automation but do not compromise the bit-precise accuracy of counterexamples when present (Kroening et al., 2023).

6. Applications and Impact in Software Engineering

CBMC’s CaS support enables:

• Equivalence Checking: Proving or refuting correspondence between two different but purportedly equivalent algorithms or optimized code fragments.
• Regression Analysis: Demonstrating that code refactorings or patches do not change externally observable behavior.
• Test Generation: By producing counterexample inputs, CBMC supports highly targeted regression and conformance test suites.
• Bug Finding and Security Auditing: Sound bug discovery—including off-by-one, undefined behavior, and memory model violations—by comparison against a trusted reference model.

CBMC is widely used for kernel, systems, and compiler-level software verification and ships as part of several Linux distributions. Its workflow has been adopted in industrial and open-source verification, and it powers multiple commercial and research verification and test generation tools (Kroening et al., 2023).

7. Summary

Bounded Model Checking with Code-as-Specification in CBMC constitutes a minimalistic yet expressive paradigm: writing “golden” reference and target C algorithms, linking them in a harness, and employing CBMC’s automated pipeline—loop unwinding, SSA, bit-precise encoding, and SAT/SMT solving—to prove equivalence or extract concrete counterexamples within bounded executions. Its capacity for precise counterexample extraction and robust encoding underpins its influence in modern software verification practice (Kroening et al., 2023).