Git Product home page Git Product logo

fv-bmc-llvm's Introduction

FV_modelchecker

Dependencies

llvm documentation

cvc5 documentation

  • Make sure you are in Linux or MacOS (except M1/M2)
  • Install: pip install cvc5
  • Import: import cvc5

Z3 documentation

  • Install: pip install z3-solver
  • Import: from z3 import *

How To Use

BMC for a general Kripke Structure

  1. Create an input model.json, for exmaple
{
"atoms" : ["a", "b", "c", "d"],
"states" : ["0000", "0001", "0010", "0101", "0011", "1111"],
"trans" : {"0000": ["0001"],
	"0001": ["0101","0010"], 
	"0101": ["0011"], 
	"0010":["0011","0000"], 
	"0011":["1111"]}
}
  1. The State Representation "0010" means that a=0, b=0, c=1, d=0 for this State
  2. The Initial State is by default states[0] and the Error State is by default "1111"
  3. The Transition Representation "0001: ["0101","0010"]" means that from State "0001", we can go to Sate "0101" and "0010"
  4. cd src
  5. python3 BMC_general.py [model.json] [limit]
  6. For example, when we run python3 BMC_general.py test/test_model.json 5, the result should be the following, which indicates that a we have a counterexample that reaches the Error State at STEP 4.
Property satisfied within 0 steps
Property satisfied within 1 steps
Property satisfied within 2 steps
Property satisfied within 3 steps
STEP 0: 0000
STEP 1: 0001
STEP 2: 0101
STEP 3: 0011
STEP 4: 1111
Counterexample found at STEP 4

Translator from LLVM IR to Intermediate Model

  1. make, which will generate the executable file named "translate"
  2. llvm-as [test.ll] โ€“o [test.bc]
  3. ./translate [test.bc] > [out.json]
  4. For example, when we run llvm-as test\test2.ll โ€“o test2.bc and ./translate test2.bc > out2.json, we should get a out2.json as output, which is the Interdemia Model that can be further processed by BMC_llvm.py

BMC for LLVM Intermediate Model

  1. python3 BMC_llvm.py [out.json] [limit]
  2. For example, when we run python3 BMC_llvm.py test\out2.json 4, the result should be the following
STEP 0:  x=0; y=2;
STEP 1:  x=7; y=2;
STEP 2:  x=14; y=2;
STEP 3:  x=21; y=2;
Counterexample found at STEP 3

Limitations

  • Can only store each variable once per basic block
  • Only supports basic LLVM instructions: no pointers, structs, or calls
  • Only one LLVM function at a time
  • Only AG properties

fv-bmc-llvm's People

Contributors

marcusm117 avatar gschare avatar

Stargazers

 avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.