continuous verification of large embedded software using
play

Continuous Verification of Large Embedded Software using SMT-Based - PowerPoint PPT Presentation

Continuous Verification of Large Embedded Software using SMT-Based Bounded Model Checking Lucas Cordeiro, Bernd Fischer, Joao Marques-Silva lcc08r@ecs.soton.ac.uk


  1. Continuous Verification of Large Embedded Software using SMT-Based Bounded Model Checking Lucas Cordeiro, Bernd Fischer, Joao Marques-Silva lcc08r@ecs.soton.ac.uk

  2. ������ � ����������������������� � �������������������������������������� � ����������������� ���!������"������ � ����������������#������$���

  3. Continuous Verification • based on Fowler’s continuous integration (CI): build and test full system after each change • complement testing by verification (SMT-based bounded model checking) – assertions – language-specific properties – language-specific properties • exploit existing information – development history (SCM) – test cases • limit change propagation – equivalence checks

  4. Functional Equivalence Checking • determine whether modified functions need to be re-verified – no need to re-verify properties if functions are equivalent – less expensive than re-verifying the function – undecidable due to unbounded memory usage

  5. Functional Equivalence Checking • determine whether modified functions need to be re-verified – no need to re-verify properties if functions are equivalent – less expensive than re-verifying the function – undecidable due to unbounded memory usage • goal: compare input-output relation �������� %�&� ��� ��������' �������� ��&�����( �������� ��&�����( �� ��������)*�+� ��&������*�������( ���� ��&������*��,-������( ������ ��&�����( . �������� %�&� ��� ��������' �� ��������/�+� ������ �������( ���� ������ ������( .

  6. Functional Equivalence Checking • determine whether modified functions need to be re-verified – no need to re-verify properties if functions are equivalent – less expensive than re-verifying the function – undecidable due to unbounded memory usage • goal: compare input-output relation �������� %�&� ��� ��������' �������� ��&�����( �������� ��&�����( – remove variables and returns �� ��������)*�+� ��&������*�������( ���� ��&������*��,-������( ������ ��&�����( . �������� %�&� ��� ��������' �� ��������/�+� ������ �������( ���� ������ ������( .

  7. Functional Equivalence Checking • determine whether modified functions need to be re-verified – no need to re-verify properties if functions are equivalent – less expensive than re-verifying the function – undecidable due to unbounded memory usage • goal: compare input-output relation �������� %�&� ��� ��������' �������� ��&�����( �������� ��&�����( – remove variables and returns �� ��������)*�+� ��&������*�������( ���� – convert the function bodies into SSA ��&������*��,-������( ������ ��&�����( � � inverter = signal . 1 1 � � α = ∧ inverter = − 1 ∗ signal � � �������� %�&� ��� ��������' 1 2 1 � ) � �� ��������/�+� ( � � ∧ inverter = signal ≥ 0 ? inverter : inverter 3 1 1 2 ������ �������( ���� ������ ������( [ ] ( ) α = signal = signal < − signal signal ' ' 0 ? ' : ' . 2 2 1 1 1

  8. Functional Equivalence Checking • determine whether modified functions need to be re-verified – no need to re-verify properties if functions are equivalent – less expensive than re-verifying the function – undecidable due to unbounded memory usage • goal: compare input-output relation – remove variables and returns – convert the function bodies into SSA – show that the input and output variables coincide SSA of function 1 and 2 ( ( ) ) ( ) α ∧ α ∧ signal = signal ' → inverter = signal ' 1 2 1 1 3 2 inputs outputs

  9. Generalizing Test Cases • use existing test cases to reduce the state space – run the unit tests, keep track of inputs – guide model checker to visit states not yet visited • test stubs break the global model into local models – use test case as initial state – generate reachable states on-demand ⇒ reduces the number of paths and variables !��� ����� ������ ����� ������ ��!�� ������ �*������0������( ����!���),+�11��/2++�(

  10. Generalizing Test Cases: Example Simple circular FIFO buffer: ����������� ������3�4##�"0�567( Test case: ���� ����8��� ��� !����' check whether messages are ������0��9� *�!��( ������*������*�+( added to and removed from the . circular buffer ��� ��!�&�8�����!� ���� ��' ������������ �������������������&�����' �����::( �����::( ��� ���;���37�*�',<��,2=<�>=<�==<�?>< ��� ���;���37�*�',<��,2=<�>=<�==<�?>< ������ ������3������,7( ,<��,2=<�>+<�+<��AB.( . ��� �( ����8���?�( ���� ������8�����!� ��� ���' ��� ��*+(��/,+(��::� �� ������/�������0��9���' ������8�����!����;���3�7�( ������3����7�*��( ��� ��*?(��/,+(��::� �����*������:,�@������0��9�( ���������������� ����;���3�7< . ��!�&�8�����!���( . .

  11. Generalizing Test Cases: Example Simple circular FIFO buffer: ����������� ������3�4##�"0�567( BUT: implementation is flawed! ���� ����8��� ��� !����' ������0��9� *�!��( ������*������*�+( The array buffer is of type char[] . ��� ��!�&�8�����!� ���� ��' �����::( �����::( Assign an integer variable ������ ������3������,7( . ���� ������8�����!� ��� ���' �� ������/�������0��9���' ������3����7�*��( �����*������:,�@������0��9�( . .

  12. Generalizing Test Cases: Example Simple circular FIFO buffer: ����������� ������3�4##�"0�567( BUT: implementation is flawed! ���� ����8��� ��� !����' ������0��9� *�!��( ������*������*�+( The array buffer is of type char[] . ��� ��!�&�8�����!� ���� ��' �����::( �����::( Assign an integer variable ������ ������3������,7( . ���� ������8�����!� ��� ���' We can detect the error by �� ������/�������0��9���' assigning a non-deterministic ������3����7�*�������0�����( �����*������:,�@������0��9�( value . . This can lead to false results

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend