A dead variable analysis for explicit model checking

  • Authors:

  • Micah Lewis;Michael Jones

  • Affiliations:

  • Brigham Young U.;Brigham Young U.

  • Venue:
  • Proceedings of the 2006 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation
  • Year:
  • 2006

Quantified Score

Hi-index 0.01

Visualization

Abstract

Explicit state enumeration model checking for software is a kind of formal verification in which the reachable states of a software artifact are generated using an exhaustive search algorithm. The limiting factor in explicit software model checking is the size of the hash table of visited states used to avoid duplicate work and detect termination. The size of the hash table can be reduced by identifying and ignoring dead variables. We present a new kind of dead variable analysis that combines the usual static dead variable analysis with a specialized data flow analysis and an incomplete forward simulation to identify dead variables based on variable valuations at run time. The analysis is implemented in an explicit model checker for machine code programs on embedded processors. The analysis is most effective for code segments with pointers and nested conditional expressions in which disjoint sets of variables are used in each branch. Results for an ideal synthetic program are quite encouraging while results for three non-synthetic programs are more modest. The results suggest that the run-time portion of the analysis should only be performed on code segments which contain pointer dereferences and nested branches. Segments with these properties can be identified statically. The results also suggest that the analysis will result in a larger reduction using a specialized hash table.