Proving that systems code eventually does something good

In recent years we have seen great progress made in the area of automatic source-level static analysis tools. However, all of today’s program verification tools are limited to properties that guarantee the absence of bad events (called safety properties). Until now no formal software analysis tool has provided support for automatically proving properties that ensure that good events eventually happen (called liveness properties), i.e. no tool has supported proving the absence of liveness bugs. In this paper we present such an automatic tool, called VIVO, which handles both safety and liveness properties of large systems written in C. The tool attempts to prove properties of programs; failed proofs result in counterexamples which are presented back to the user. We have used the tool to automatically prove critical liveness properties of Windows device drivers. Furthermore, we have found several previously unknown liveness bugs.