software model checking, heuristic functions, algorithm, distance data
State exploration in directed software model checking is guided using a heuristic function to move states near errors to the front of the search queue. Distance heuristic functions rank states based on the number of transitions needed to move the current program state into an error location. Lack of calling context information causes the heuristic function to underestimate the true distance to the error; however, inlining functions at call sites in the control flow graph to capture calling context leads to an exponential growth in the computation. This paper presents a new algorithm that implicitly inlines functions at call sites to compute distance data with unbounded calling context that is polynomial in the number of nodes in the control flow graph. The new algorithm propagates distance data through call sites during a depth-first traversal of the program. We show in a series of benchmark examples that the new heuristic function with unbounded distance data is more efficient than the same heuristic function that inlines functions at their call sites up to a certain depth.
Original Publication Citation
N. Rungta and E. G. Mercer, "An Improved Distance Heuristic Function for Directed Software Model Checking", in Proceedings of Formal Methods in Computer Aided Design (FMCAD), San Jose, USA, pages 6-67, November 26.
BYU ScholarsArchive Citation
Mercer, Eric G. and Rungta, Neha, "An Improved Distance Heuristic Function for Directed Software Model Checking" (2006). All Faculty Publications. 284.
Physical and Mathematical Sciences
© 2006 Institute of Electrical and Electronics Engineers
Copyright Use Information