Nec Laboratories America, Inc.

Nec Corporation

Malay K Ganai

Aarti Gupta

Pranav N Ashar

Franjo Ivancic

Zijiang Yang

Srihari Cadambi

Sriram Sankaranarayanan

Chao Wang

Sudipta Kundu

Ilya Shlyakhter

Sicun Gao

Aleksandr Zaks

Himanshu Jain

Lintao Zhang

Weihong Li

A computer implemented testing methodology employing a scenario-driven modeling of specific instances of bug patterns that commonly occur in concurrent programs which encodes these instances in an SMT-based symbolic analysis. Such modeling and encoding advantageously allow the symbolic analysis framework to focus on real bugs, thereby allowing effective utilization of resources. Experimentation determined a number of previously unknown bugs in public benchmarks and advantageously scenario-specific modeling and encoding improves the scalability of symbolic technique and, therefore, improves overall quality of concurrency testing.

Scenario driven concurrency bugs: model and check

A method for symbolic model checking for sequential systems using a combination of state-based and state-less approaches. A state-based method is used to compute frontier states by building transition relations on-the-fly using control flow information of the system, and performing successive image computations until a memory bound is reached, and efficiently storing only the new frontier states as disjunctive partitions of Boolean and Arithmetic expressions. A stateless method is used to check reachability of given goal states from a heuristically chosen set of frontier states until depth/time bound is reached. These two methods are alternated until one of the following occurs: all frontier states are explored, all goal states are reached, all computing resources are exhausted. Even though we do not store the entire reachable state set, we guarantee a complete coverage for terminating programs without the need to compute a fixed-point.

System and method for model checking by interleaving stateless and state-based methods

A system and method for solving a decision problem having Boolean combinations of linear and non-linear operations includes translating the non-linear real operations using a COordinate Rotation DIgital Computer (CORDIC) method programmed on a computer device into linear operations maintaining a given accuracy. Linear and translated linear operations are combined into a formula. Satisfiability of the formula is solved using a decision procedure for Boolean combinations of linear operations over integers and reals.

Efficient decision method for real non-linear arithmetic constraints

A system and method for deciding the satisfiability of a non-linear real decision problem is disclosed. Linear and non-linear constraints associated with the problem are separated. The feasibility of the linear constraints is determined using a linear solver. The feasibility of the non-linear constraints is determined using a non-linear solver which employs interval constraint propagation. The interval solutions obtained from the non-linear solver are validated using the linear solver. If the solutions cannot be validated, linear constraints are learned to refine a search space associated with the problem. The learned constraints and the non-linear constraints are iteratively solved using the non-linear solver until either a feasible solution is obtained or no solution is possible.

Integrating interval constraint propagation with nonlinear real arithmetic

Methods and systems for verifying the precision of a program that utilizes floating point operations are disclosed. Interval and affine arithmetic can be employed to build a model of the program including floating point operations and variables that are expressed as reals and integers, thereby permitting accurate determination of precision loss using a model checker. Abstract interpretation can be also employed to simplify the model. In addition, counterexample-guided abstraction refinement can be used to refine the values of parametric error constants introduced in the model.

Systems and methods for model checking the precision of programs employing floating-point operations

A system and method for determining satisfiability of a bounded model checking instance by restricting the decision variable ordering of the SAT solver to a sequence wherein a set of control state variables is given higher priority over the rest variables appearing in the formula. The order for control state variables is chosen based on an increasing order of the control path distance of corresponding control states from the target control state. The order of the control variables is fixed, while that of the rest is determined by the SAT search. Such a decision variable ordering strategy leads to improved performance of SAT solver by early detection and pruning of the infeasible path segments that are closer to target control state.

DPLL-based SAT solver using with application-aware branching

A system and method for bounded model checking of computer programs includes decomposing a program having at least one reachable property node for bounded model checking (BMC) into sub-problems by employing a tunneling and slicing-based (TSR) BMC reduction method. The sub-problems of the TSR method are partitioned in a distributed environment, where the distributed environment includes at least one master processing unit and at least one client unit. The sub-problems are solved by each client independently of other clients to reduce communication overhead and provide scalability.

Parallelizing bounded model checking using tunnels over a distributed framework

Methods and systems for generating verification conditions and verifying the correctness of a concurrent system of program threads are described. The methods and systems determine and employ mutually atomic transactions to reduce verification problem sizes and state space for concurrent systems. The embodiments provide both an adequate and an optimal set of token-passing constraints for a bounded unrolling of threads.

Methods and systems for reducing verification conditions for concurrent programs using mutually atomic transactions

Systems and methods are disclosed for deciding a satisfiability problem with linear and non-linear operations by:

Efficient decision procedure for bounded integer non-linear operations using SMT(LIA)

A system and method is disclosed for formal verification of software programs that advantageously bounds the ranges of values that a variable in the software can take during runtime.

Software verification using range analysis

A computer implemented method for modeling and verifying concurrent systems which uses Satisfiability-Modulo Theory (SMT)-based Bounded Model Checking (BMC) to detect violations of safety properties such as data races. A particularly distinguishing aspect of our inventive method is that we do not introduce wait-cycles in our symbolic models for the individual threads, which are typically required for considering an interleaved execution of the threads. These wait-cycles are detrimental to the performance of BMC. Instead, we first create independent models for the different threads, and add inter-model constraints lazily, incrementally, and on-the-fly during BMC unrolling to capture the sequential consistency and synchronization semantics. We show that our constraints provide a sound and complete modeling with respect to the considered semantics. One benefit of our lazy modeling method is the reduction in the size of the BMC problem instances, thereby, improving the verification performance in both runtime and memory.

Modeling and verification of concurrent systems using SMT-based BMC

A system and method for bounded model checking of computer programs includes providing a program having at least one reachable property node. The program is decomposed for bounded model checking (BMC) into subproblems by creating a tunnel based on disjunctive control paths through the program. A reduced BMC sub-problem obtained using BMC unrolling, while using path constraints imposed by the at least one tunnel. For the reachable property node, determining a quantifier-free formula (QFP) in a decidable subset of first order logic. Satisfiability of the QFP is checked, independently and individually, to determine whether the QFP is satisfiable for the subproblem. The decomposing is continued until the a BMC bound is reached.

System and method for tunneling and slicing based BMC decomposition

A system and method is disclosed for formal verification of software programs that advantageously improves performance of an abstraction-refinement loop in the verification system.

Software verification

An accelerated High-Level Bounded Model Checking method that efficiently extracts high-level information from the model, uses that extracted information to obtain an improved verification model, and applies relevant information on-the-fly to simplify the BMC-problem instances.

Accelerating high-level bounded model checking

Verification friendly models for SAT-based formal verification are generated from a given high-level design wherein during construction the following guidelines are enforced: 1) No re-use of functional units and registers; 2) Minimize the use of muxes and sharing; 3) Reduce the number of control steps; 4) Avoid pipelines; 5) Chose functional units from 'verification friendly' library; 6) Re-use operations; 7) Perform property-preserving slicing; 8) Support 'assume' and &#x201c;assert&#x201d; in the language specification; and 8) Use external memory modules instead of register arrays.

Growing community of inventors

Plainsboro, NJ, United States of America

Malay K Ganai