Path-Sensitive Program Veri cation in Polynomial Time

In this paper, we present a new algorithm for program veri cation that runs in polynomial time and space. We are interested in checking that a program satis es a given temporal safety property. Our insight is that by accurately modeling only those branches in a program for which the propertyrelated behaviour of the program di ers along the arms of the branch, we can design an algorithm that is accurate enough for veri cation without paying the exponential cost of full path-sensitive analysis. We have implemented this \abstract simulation" algorithm as part of an error detection tool called ESP. We present the results of applying ESP to the problem of verifying le I/O behaviour of gcc (140 KLOC). We are able to prove that all of the 646 calls to fprintf in gcc are guaranteed to print to valid, opened les at runtime. Our results show that abstract simulation scales to large programs and is accurate enough to verify meaningful properties.