CPROVER Manual TOC

## Build Systems and Libraries

### The Problem

Similar to unit testing, the model checking approach requires the user to clearly define what parts of the program should be tested and what the behavior of these parts is. This requirement has following reasons:

- Despite recent advances, the size of the programs that model checkers can cope with is still restricted.

- Typically, you want to verify your program and not the libraries or the operating that it uses (the correctness of these libraries and the OS us usually addressed separately).

- CBMC and SATABS cannot verify binary libraries.

- CBMC and SATABS does not provide a model for the hardware (e.g., hard disk, input/output devices) the tested program runs on. Since CBMC and SATABS are supposed to examine the behavior of the tested program for all possible inputs and outputs, it is reasonable to model input and output by means of non-deterministic choice.

### Further Reading

Existing software projects usually do not come in a single source file that may simply be passed to a model checker, but is a collection of files held together by a build system. The extraction of models from such a build system using goto-cc is described here. The application of goto-cc to the entire Linux kernel is described here. The problem of architectural parameters (word with, endianness) is explained here.