LLBMC: bounded model checking of C and C++ programs using a compiler IR

  • Authors:
  • Florian Merz;Stephan Falke;Carsten Sinz

  • Affiliations:
  • Institute for Theoretical Computer Science, Karlsruhe Institute of Technology (KIT), Germany;Institute for Theoretical Computer Science, Karlsruhe Institute of Technology (KIT), Germany;Institute for Theoretical Computer Science, Karlsruhe Institute of Technology (KIT), Germany

  • Venue:
  • VSTTE'12 Proceedings of the 4th international conference on Verified Software: theories, tools, experiments
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Bounded model checking (BMC) of C and C++ programs is challenging due to the complex and intricate syntax and semantics of these programming languages. The BMC tool LLBMC presented in this paper thus uses the LLVM compiler framework in order to translate C and C++ programs into LLVM's intermediate representation. The resulting code is then converted into a logical representation and simplified using rewrite rules. The simplified formula is finally passed to an SMT solver. In contrast to many other tools, LLBMC uses a flat, bit-precise memory model. It can thus precisely model, e.g., memory-based re-interpret casts as used in C and static/dynamic casts as used in C++. An empirical evaluation shows that LLBMC compares favorable to the related BMC tools CBMC and ESBMC.