|
| 1 | +This file contains various features and project ideas for CBMC. Below |
| 2 | +this are the larger feature ideas. Smaller mini project ideas are |
| 3 | +further down. |
| 4 | + |
| 5 | +# CBMC Feature and Project Ideas |
| 6 | + |
| 7 | +The following are features that would be good to add to CBMC. They are |
| 8 | +listed here to gather information on them and also as a starting point |
| 9 | +for contributors who are interested in undertaking a more comprehensive |
| 10 | +project. |
| 11 | + |
| 12 | +## Refinement-Based Slicing |
| 13 | + |
| 14 | +**Task**: Implement refinement-based slicing to improve the slicing |
| 15 | +of CBMC. |
| 16 | + |
| 17 | +**Background**: |
| 18 | +Some patches have been considered for this, but there is not yet |
| 19 | +evidence of performance improvement. See |
| 20 | +https://github.com/diffblue/cbmc/issues/28 |
| 21 | + |
| 22 | +## Refinement-based reduction of partial order constraints |
| 23 | + |
| 24 | +**Task**: Implement refinement-based reduction of partial order |
| 25 | +constraints. |
| 26 | + |
| 27 | +**Background**: |
| 28 | +Some patches have been considered for this, but there needs to also be |
| 29 | +work on the performance. See |
| 30 | +https://github.com/diffblue/cbmc/issues/29 |
| 31 | + |
| 32 | + |
| 33 | +## Advanced goto-diff |
| 34 | + |
| 35 | +**Task**: Improve the goto-diff utility to have both syntactic and |
| 36 | +semantic diff options for goto programs. |
| 37 | + |
| 38 | +**Background**: The current `goto-diff` program performs only syntatic |
| 39 | +diff of goto programs. Extensions to also consider semantic differences |
| 40 | +would be desirable. It would be nice to include: |
| 41 | +* deltacheck's change impact analysis |
| 42 | +* cemc equivalence checker |
| 43 | + |
| 44 | +See also https://github.com/diffblue/cbmc/issues/40 |
| 45 | + |
| 46 | +## Function Summaries |
| 47 | + |
| 48 | +**Task**: Create function summaries that simplify analysis. The main |
| 49 | +goals of the function summaries are: |
| 50 | +* context insensitivity (there is one summary applicable in any |
| 51 | +context the function is called from) |
| 52 | +* transitive closure (effects of all callees are captured in summaries |
| 53 | +of the root caller function) |
| 54 | +* generalised interface (suitable for many different concrete |
| 55 | +summary-computing algorithms) |
| 56 | +* language independent (should work for Java, C, C++, ...) |
| 57 | + |
| 58 | +This also has links to other projects (albeit some may be out of date |
| 59 | +at this stage): |
| 60 | +* test_gen (our summaries should fit to needs of this tests generation |
| 61 | +task) |
| 62 | +* 2ls (their summaries should also be expressible in our summaries) |
| 63 | +* path-symex (summaries must also be usable for path-based symbolic |
| 64 | +execution) |
| 65 | + |
| 66 | +There are also complexities related to over/under-approximation |
| 67 | +for the function summaries. For more details see |
| 68 | +https://github.com/diffblue/cbmc/issues/218 |
| 69 | + |
| 70 | + |
| 71 | +## --cover array |
| 72 | + |
| 73 | +**Task**: Extend the `--cover` option to add coverage goals for each |
| 74 | +possible entry of fixed size arrays. For more details see |
| 75 | +https://github.com/diffblue/cbmc/issues/265 |
| 76 | + |
| 77 | + |
| 78 | +## Connecting Producers and Consumers of Knowledge about Termination |
| 79 | + |
| 80 | +There is very limited knowledge about loop termination conditions |
| 81 | +and this could be improved. For example, the slicing could be |
| 82 | +improved with knoweldge regarding loop termination so that |
| 83 | +irrelevant loops can be more effectively sliced. Similarly, in |
| 84 | +goto-analyze assertions can only be false if reachable, adding |
| 85 | +termination can give crude reachability analysis. |
| 86 | + |
| 87 | +The overall approach could be to have for each loop and/or |
| 88 | +function information: `TERMINATE`, `NON_TERMINATE`, or |
| 89 | +`UNKNOWN_TERMINATION`. |
| 90 | + |
| 91 | +Further details on possible implementations and discussion |
| 92 | +can be found here |
| 93 | +https://github.com/diffblue/cbmc/issues/618 |
| 94 | + |
1 | 95 | # CBMC Mini Project Ideas
|
2 | 96 |
|
3 | 97 | The following projects are short, focussed features that give new CBMC
|
|
0 commit comments