Understanding Counterexamples with explain
Alex Groce, Daniel Kroening, and Flavio Lerda
Computer Science Department, Carnegie Mellon University
Pittsburgh, PA 15213
Abstract. The counterexamples produced by model checkers are often
lengthy and difficult to understand. In practical verification, showing the
existence of a (potential) bug is not enough: the error must be under-
stood, determined to not be a result of faulty specification or assump-
tions, and, finally, located and corrected. The explain tool uses distance
metrics on program executions to provide automated assistance in under-
standing and localizing errors in ANSI-C programs. explain is integrated
with CBMC, a bounded model checker for the C language, and features
a GUI front-end that presents error explanations to the user.
1 Introduction
In an ideal world, given a detailed error trace, a programmer would always be
able to quickly identify and correct the faulty portion of the code or specification.
Practical experience, however, indicates that this is not the case. Understanding
a counterexample often requires as much effort as preparing a program for model
checking. As software model checking has become more concerned with practical
applicability, the need for automated assistance in understanding counterexam-
ples has been recognized [2, 6]. The explain tool provides users with assistance
in focusing on the relevant portions of source code and in understanding the
causal dependencies involved in an error.
CBMC [7] is a tool for verifying ANSI-C programs. CBMC is a bounded
model checker (BMC) [3]: it produces from a C program a Boolean formula
satisfiable by executions of the program that violate its specification (counterex-
amples). The model checker supports pointer constructs, dynamic memory allo-
cation, recursion, and the float and double data types. CBMC also features a
graphical user interface designed to resemble an IDE (Integrated Development
Environment) that allows users to interactively step through counterexample
traces.
explain uses the same bounded model checking engine to further analyze
counterexample traces produced by CBMC. In particular, explain uses distance
metrics on program executions [5], in a manner inspired by the counterfactual
theory of causality [8], to provide a number of automatic analyses:
–Given a counterexample execution, explain can automatically produce an
execution that is as similar as possible to the failing run but does not violate
the specification.
