From Under-approximations to Over-approximations and Back
3Current approaches to software model checking can be divided into over-approximation-driven (OD) and under-approximation-driven (UD). OD approaches maintain an abstraction of the transition relation of a program and use abstract reachability to build an inductive invariant (or find a counterexample). At the other extreme, UD approaches attempt to construct inductive invariants by generalizing from finite paths through the control-flow graph of the program. In this talk, I will present UFO, a framework that unifies OD and UD approaches in order to leverage both of their advantages. UFO is parameterized by the degree to which over- and under-approximations drive the analysis. At one extreme, UFO is a novel interpolation-based (UD) algorithm that generates interpolants to label (i.e., refine) multiple program paths using only a single SMT solver query. At the other extreme, UFO uses an abstract domain to drive the analysis, while using interpolants to strengthen the abstraction. UFO has been implemented in the LLVM compile infrustructure. Our experimental results demonstrate the utility of our algorithm and the benefits of combining UD and OD approaches when applied to benchmakrs from the Competition on Software Verification.