TRACER: A Symbolic Execution Tool for Verification

Recently symbolic execution (SE) [15] has been successfully proven to be an alternative to CEGAR for program verification offering the following benefits among others [12, 18]: (1) it does not explore infeasible paths avoiding expensive refinements, (2) it avoids expensive predicate image computations (e.g., Cartesian and Boolean abstractions [2]), and (3) it can recover from too-specific abstractions as opposed to monotonic refinement schemes often used. Unfortunately, it poses its own challenges: (C1) exponential number of paths, and (C2) infinite-length paths in presence of unbounded loops. We present TRACER, a SE-based verification tool for finite-state safety properties of sequential C programs. Informally, TRACER attempts at building a finite symbolic execution tree which overapproximates the set of all concrete reachable states. If the error location cannot be reached from any symbolic path then the program is reported as safe. Otherwise, either the program may contain a bug or it may not terminate. The most innovative features of TRACER stem from how it tackles (C1) and (C2). In this paper, we describe the main ideas behind TRACER and its implementation as well as our experience in running real benchmarks.