Astrée: verification of absence of run-time error

Everybody knows about failure problems in software: it is an admitted fact that most large software do contain bugs. The cost of such bugs can be very high for our society and many methods have been proposed to try to reduce these failures. While merely reducing the number of bugs may be economically sound in many areas, in critical software (such as found in power plants or aeronautics), no failure can be accepted. In order to achieve an unfailing critical software, industrials follow very strict production patterns and must also certify the absence of errors through state-of-the-art verification. When old verification methodologies became intractable in time and cost due to the growth of code size, the Abstract Interpretation Team2 of École Normale Supérieure started developing Astrée (Blanchet et al., 2002). The object of Astrée is the automatic discovery of all potential errors of a certain class for critical software. As most critical software don’t (or won’t) have any error, the main challenge was to be exhaustive and very selective, that is yielding few or no false alarms on the software, so as to reduce the cost of verifying those alarms. In this paper, we show how Astrée is based on sound approximations of the semantics of C programs, tailored to be very accurate on a class of embedded