Bounded Model Checking (BMC) is a powerful technique for proving unsafety. However, finding deep counterexamples that require a large bound is challenging for BMC. On the other hand, acceleration techniques compute "shortcuts" that "compress" many execution steps into a single one. In this paper, we tightly integrate acceleration techniques into SMT-based bounded model checking. By adding suitable "shortcuts" to the SMT-problem on the fly, our approach can quickly detect deep counterexamples, even when only using small bounds. Moreover, using so-called blocking clauses, our approach can prove safety of examples where BMC diverges. An empirical comparison with other state-of-the-art techniques shows that our approach is highly competitive for proving unsafety, and orthogonal to existing techniques for proving safety.
翻译:有界模型检测(BMC)是证明不安全性质的有力技术。然而,对于需要较大边界的深度反例,有界模型检测的发现过程极具挑战性。另一方面,加速技术通过计算"捷径"将多个执行步骤"压缩"为单个步骤。本文提出将加速技术与基于SMT的有界模型检测紧密集成。通过动态向SMT问题中添加合适的"捷径",我们的方法能够快速检测深度反例,即便仅使用较小边界也能实现。此外,利用所谓的阻塞子句,我们的方法可以证明有界模型检测发散情况下的系统安全性。与现有先进技术的实证比较表明,本方法在证明不安全性质方面极具竞争力,且与现有证明安全性技术具有正交性。