Model Checking Boolean Programs

The reliability of software is crucial to the functioning of today’s world, which heavily depends on computer systems. Given the ever increasing complexity of software, bugs are subtle and thus hard to find with manual inspection. A more promising approach is to use a formal method such as model checking, which employs exhaustive state-space search to ensure the correctness of the software. However, existing tools typically feature two flaws: either they have insufficient capacity to handle large programs or they report many false positives. A successful approach to push the boundaries of model checking is predicate abstraction (-refinement). With this method, an abstraction of a program in a high-level programming language is constructed using predicates and represented as a Boolean program. It is analyzed by a dedicated checker to determine if an error state is reachable. Boolean program verification remains, despite the reduced state space, the bottleneck within the automated abstraction-refinement loop. This thesis introduces techniques for efficient reachability analysis of sequential and concurrent Boolean programs. We improve on known summarization algorithms for sequential Boolean programs and propose over-approximations of procedure calls. For non-recursive concurrent Boolean programs with bounded thread creation, we first introduce a transformation to a representation based on thread-state counters, which exploits the symmetry inherent in replicated programs. In a second step, we combine this representation with a method to locate thread creating cycles in order to allow an unbounded number of threads. The algorithms are implemented in BOOM, a model checking platform for Boolean programs. It is the first tool which implements a summarizing reachability engine that entirely relies on a satisfiability solver for (quantified) Boolean formulæ. The concurrent variant of BOOM is implemented using binary decision diagrams and includes partial order reduction methods. BOOM has been used in combination with the SATABS software model checker to verify safety properties of Linux device drivers. BOOM is, to the best of our knowledge, the first efficient model checker for non-recursive concurrent Boolean programs.