Software verification using k-induction

  • Authors:

  • Alastair F. Donaldson;Leopold Haller;Daniel Kroening;Philipp Rümmer

  • Affiliations:

  • Computer Science Department, Oxford University, Oxford, UK;Computer Science Department, Oxford University, Oxford, UK;Computer Science Department, Oxford University, Oxford, UK;Uppsala University, Department of Information Technology, Uppsala, Sweden

  • Venue:
  • SAS'11 Proceedings of the 18th international conference on Static analysis
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

We present combined-case k-induction, a novel technique for verifying software programs. This technique draws on the strengths of the classical inductive-invariant method and a recent application of k-induction to program verification. In previous work, correctness of programs was established by separately proving a base case and inductive step. We present a new k-induction rule that takes an unstructured, reducible control flow graph (CFG), a natural loop occurring in the CFG, and a positive integer k, and constructs a single CFG in which the given loop is eliminated via an unwinding proportional to k. Recursively applying the proof rule eventually yields a loop-free CFG, which can be checked using SAT-/SMT-based techniques. We state soundness of the rule, and investigate its theoretical properties. We then present two implementations of our technique: K-INDUCTOR, a verifier for C programs built on top of the CBMC model checker, and K-BOOGIE, an extension of the Boogie tool. Our experiments, using a large set of benchmarks, demonstrate that our k-induction technique frequently allows program verification to succeed using significantly weaker loop invariants than are required with the standard inductive invariant approach.