On Reasoning About Finite Sets in Software Model Checking

A number of static checking techniques is based on con-structing and refining an abstract reachability tree (ART) and reasoning about Linear Arithmetics. For example, in BLAST, each program statement is represented as a series of assign-ments of a linear functions to variables, and the procedure of predicate discovery relies on Craig interpolation of linear arithmetics and equality with uninterpreted function symbols. In this paper we propose an approach to extend the domain of mathematical operations a checker described can reason about with the certain operations with finite sets: adding and removing elements, testing whether set contains a particular element, or is empty. It being implemented, the ART doesn’t split at each operation. The tradeoff of it is more complex formulas for a solver to handle and incapability of using set-related operations in loops. We implemented the algorithm, proceeding from the resric-tion of making no modification in LA+EUF interpolation algorithm. We also provide results of the performance evalu-ation of the algorithm proposed and of the other known way to reason about finite sets. Index Terms Software verification and validation 1