6 Modeling Heuristics
6.1 Nondeterministic Choice
Blast uses the special variable __BLAST_NONDET to implement
nondeterministic choice. Thus,
if (__BLAST_NONDET) {
// then branch
} else {
// else branch
}
is treated as a nondeterministic if statement whose either branch
may be taken. This is sometimes useful in modeling nondeterministic
choice in specification functions or in models of library functions.
6.2 Stubs and Drivers
Blast is essentially a whole program analysis.
If there are calls in your code to library functions, it expects to
see the body of the function.
If the body of a function is not present, Blast optimistically assumes
that the function has no effect on the variables of the program other
than the one in which the return value is copied.
Sometimes we are interested in the effect of library functions, but not in
their detailed implementation.
For example, we may be interested in knowing that malloc returns
either a null pointer or a non-null pointer, without knowing exactly
how memory allocation works.
This is useful for scalability: we are abstracting unnecessary details
of the library.
Sometimes this is necessary as well: certain system services are written
in assembly and not amenable to our analysis.
Blast expects in these cases that the user provides stubs for useful
library functions.
Each stub function is basically a piece of C code, possibly with the use
of __BLAST_NONDET to allow nondeterministic choice.
6.3 Syntax of Seed Predicates
You can input initial predicates on the command line using the
option -pred. This section gives the syntax for input predicates.
The format of the predicate file is a list of predicates, separated
by semicolons.
Each predicate is a valid boolean expression in C syntax.
However, we change variable names to also reflect the scope of the variable.
So the variable x in function foo is written x@foo.
The detailed syntax can be seen in the file inputparse.mly in the directory
psrc.
Notice that if the same syntactic name is used for multiple variables in different scopes
then Cil renames the local variables.
In this case, one has to look at the names produced by Cil
to use the appropriate variable in the predicates.