Newest papers

Function Contracts for Bounded Model Checking of C Programs

Weiqi Wang, Marie Farrell, Liping Zhao, Lucas Carvalho Cordeiro · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26089 · cited by 0 works (OpenAlex) · open-access PDF

German

Bounded-Modell-Synthese ist ein Werkzeug, das ein Programm in eine einzige Formel entwirft, so dass eine Funktion, die eine Schleife hält, den Lösegerät bei jeder Anrufstelle eine neue Kopie dieser Schleife kostet. Funktionskontrakte brechen dieses Coupling. Überprüfen Sie den Körper einmal gegen seinen Vertrag, dann ersetzen Sie jeden Anruf durch einen Stub abgeleitet von ihm. CBMC unterstützt dies durch dynamische Rahmenbedingungenprüfung, die auf industrieller Ebene angewendet werden, aber ohne formalen Bericht darüber, warum der Austausch laut ist und keine Charakterisierung dessen, was die Rahmenprüfung kostet. Wir präsentieren den Funktionskontraktrahmen für ESBMC. Die Synthese der Klausel, beide Phasen, und die erste zählt die Durchsetzung

Machine translation (Meta M2M100); the English original follows.

Abstract

Bounded model checking unrolls a program into a single formula, so a function holding a loop costs the solver a fresh copy of that loop at every call site. Function contracts break that coupling. Verify the body once against its contract, then replace each call by a stub derived from it. CBMC supports this through dynamic frame condition checking, applied at industrial scale, but with no formal account of why the replacement is sound and no characterisation of what the frame check costs. We present the function-contract framework for ESBMC. The clause syntax, both phases, and the first assigns enforcement the tool has had are all introduced here. Its technical core is an observational frame rule: snapshot the locations the contract does not permit the function to write, then compare them at exit. The encoding emits a number of verification conditions set by how many globals the program has, not by how many writes the body performs, while dynamic frame condition checking grows with the write count. That is a property of the encoding rather than a timing, so it moves with neither the machine nor the solver. The rule itself is the classical one; what we add is its bounded form inside a BMC encoding, with the pipeline's algebraic skeleton machine-checked in Lean 4 and the limits of that model stated. We evaluate on synthetic sweeps, SV-COMP tasks, an ANSSI X.509 parser, the FreeRTOS heap_1 allocator, and the ML-KEM reference implementation whose CBMC contracts we reuse unchanged. At the coefficient count FIPS-203 mandates, neither tool finishes on the monolithic route inside ten minutes, and both finish on the modular one. The framework is merged into ESBMC master. Contracts are what is left when unrolling runs out of room.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Bounded function, Computer science, Model checking, Frame (networking), Reuse, Programming language

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange