F. Model checking software at compile time(6)

Software has been under scrutiny by the verification community from various angles in the recent past. There are two major algorithmic approaches to ensure the correctness of and to eliminate bugs from such systems: software model checking and static analy

whereσL∈ΣLandσA∈ΣA.

Givenan(attributed)treeTandanodel,apatternde- nesasetofnodesinthesubtreerootedinl.Thepattern de nesthenodelitself, theemptyset,andpatternσAandσLchildrenlabeledσAorσLrespectively.Thepatterns↓and↓ standforthechildrenanddescendantsofl,/and∪forconcatenationandunion.Finally,patternP[Q] ltersallnodessatisfyingQ.

Thistreequerylanguageisthedownward,recursivefragmentofthelanguagede nedin[2].Wereferthereadertothispaperforformalsemanticsandadiscussiononex-pressiveness.Theonlydifferenceisthatweallowfortwotypesoflabels,whichhowever,doesnotaddexpressivity.Givenanatomicpropositionp,weassociateatreepat-ternPwithit.WelabeleverynodelthatmatchesP,intheASTTwithrespecttotherootnodeofT,withp.InthecasethatlisnotinCFGT,welabelitsclosestancestorinTwhichisinCFGT.

Example1Takeasanexampleanatomicpropositiondeclx,usedtolabeldeclarationsofvariablex.Thispropo-sitionisassociatedwithpattern↓ Decl[Var:x],i.e.itmatchesallnodes(descendantsoftherootnode)intheASTlabeledDecl,thathaveachildlabeledVar:x.ThosenodeswillthenbelabeledwithdeclxintheCFG.

Figure1.Modelcheckingapproachforstati-callyanalysingC/C++code.

3.3TranslationtoNuSMV

alabelisevaluatedtotrueiffithasbeenalabelintheoriginallabeledCFG.

CTLfisthesetofCTLpropertiesinNuSMVsyntax.InthesubsequentSection4wewillgiveanexampleoftheactualNuSMVcodewhichisasyntacticexpressionoftheabovemodel.

Inordertocheckourgeneratedmodelautomaticallywithrespecttothede nedproperties,wedevelopedatrans-lationtotheNuSMVmodelchecker.InthissectionwesketchhowtotranslatealabeledCFGandaCTLformulaintoasimpleNuSMVmodel.

ForagivenC/C++functionfwetranslatethecorre-spondinglabeledCFG(Lf,Ef,µf)intoasimpleNuSMVmodel,NuSMVf=(varf, f,Deff,CTLf),where varfisoneenumeratedtypevariableinNuSMVoverthesetoftypesl∈Lf.Enumeratedtypevariablesareimplementedef cientlyinNuSMVandguaranteeamuchsmallerstatespacethan,e.g.,usingonebooleanvariableforeachcontrollocation.