[Paper Review] Explicit-Value Analysis Based on CEGAR and Interpolation

Dirk Beyer, Stefan Löwe|arXiv (Cornell University)|Dec 28, 2012

Software Testing and Debugging Techniques26 references3 citations

TL;DR

This paper presents a novel integration of CEGAR, interpolation, and abstraction into explicit-value program analysis, enabling dynamic precision adjustment by refining only necessary variables. The approach achieves competitive performance and precision—outperforming state-of-the-art tools like cpa-memo in the SV-COMP’12 competition—by combining explicit-value tracking with predicate analysis and refinement guided by infeasible counterexamples.

ABSTRACT

Abstraction, counterexample-guided refinement, and interpolation are techniques that are essential to the success of predicate-based program analysis. These techniques have not yet been applied together to explicit-value program analysis. We present an approach that integrates abstraction and interpolation-based refinement into an explicit-value analysis, i.e., a program analysis that tracks explicit values for a specified set of variables (the precision). The algorithm uses an abstract reachability graph as central data structure and a path-sensitive dynamic approach for precision adjustment. We evaluate our algorithm on the benchmark set of the Competition on Software Verification 2012 (SV-COMP'12) to show that our new approach is highly competitive. In addition, we show that combining our new approach with an auxiliary predicate analysis scores significantly higher than the SV-COMP'12 winner.

Motivation & Objective

• To bridge the gap between powerful predicate-based analysis and simpler explicit-value analysis by integrating abstraction, CEGAR, and interpolation.
• To enable dynamic, adaptive precision in explicit-value analysis by refining only the variables necessary to eliminate infeasible error paths.
• To improve verification performance and precision without relying on complex SMT solvers during abstraction refinement.
• To combine explicit-value analysis with predicate analysis for complementary benefits in precision and scalability.
• To demonstrate that a lightweight explicit-value analysis enhanced with refinement techniques can rival or surpass leading symbolic model checkers.

Proposed method

• Uses an abstract reachability graph as the central data structure to represent program states during analysis.
• Applies CEGAR with path-sensitive dynamic precision adjustment, starting with minimal tracking and refining based on infeasible error paths.
• Employs interpolation in the explicit-value domain to extract minimal sets of variables whose tracking eliminates infeasible paths.
• Combines explicit-value analysis with auxiliary predicate analysis to balance precision and performance.
• Leverages infeasible counterexamples to guide abstraction refinement, avoiding unnecessary tracking of irrelevant variables.
• Uses SMT solvers only for feasibility checks and interpolation, not for core abstraction computation.

Experimental results

Research questions

• RQ1 Can CEGAR and interpolation be effectively applied to explicit-value analysis to improve precision and scalability?
• RQ2 Can a lightweight explicit-value analysis, enhanced with abstraction and refinement, achieve performance competitive with SMT-based predicate abstraction?
• RQ3 Does combining explicit-value analysis with predicate analysis yield better verification results than either method alone?
• RQ4 Can interpolation in the explicit-value domain identify minimal, sufficient sets of tracked variables to eliminate infeasible error paths?
• RQ5 How does the proposed approach compare in practice to state-of-the-art tools in industrial-scale verification benchmarks?

Key findings

• The proposed approach solved 211 out of 280 instances in the SV-COMP’12 benchmark set, achieving a score of 318, outperforming the SV-COMP’12 winner cpa-memo.
• The combination of explicit-value analysis with predicate analysis (cpa-expl itp -pred) solved more instances and achieved a higher score than standalone predicate analysis (cpa-pred) or explicit-value analysis (cpa-expl itp ).
• The method consumed significantly less verification time than Blast and SATabs, while solving more instances and achieving a better score.
• The approach demonstrated that CEGAR and interpolation can be effectively adapted to explicit-value analysis, enabling dynamic precision adjustment without heavy SMT usage.
• The combination with predicate analysis significantly improved results, showing that complementary strengths of both analysis types enhance overall verification effectiveness.
• The method achieved high precision, as evidenced by a much higher score than cpa-memo despite only a modest difference in solved instances, indicating fewer incorrect results.