Software Verification using Predicate Abstraction and Iterative Refinement: Part 1
|
|
- Roderick Berry
- 5 years ago
- Views:
Transcription
1 using Predicate Abstraction and Iterative Refinement: Part Bug Catching: Automated Program Verification and Testing Sagar Chaki November 28, 2011
2 Outline Overview of Model Checking Creating Models from C Code: Predicate Abstraction Eliminating spurious behaviors from the model: Abstraction Refinement Concluding remarks : research directions, tools etc. 2
3 Model Checking Algorithm for answering queries about behaviors of state machines Given a state machine M and a query φ does M φ? Standard formulation: M is a Kripke structure φ is a temporal logic formula Computational Tree Logic (CTL) Linear Temporal Logic (LTL) Discovered independently by Clarke & Emerson and Queille & Sifakis in the early 1980 s 3
4 Scalability of Model Checking Explicit statespace exploration: early 1980s Tens of thousands of states Symbolic statespace exploration: millions of states Binary Decision Diagrams (BDD) : early 1990 s Bounded Model Checking: late 1990 s Based on propositional satisfiability (SAT) techlogy Abstraction and compositional reasoning to effectively infinite statespaces (particularly for software) 4
5 Models of C Code { x=0 y=0 x=1 y=0 ; } else { + 1; + 1 x=0 y=0 x=1 y=0 } ; x=0 y=1 x=1 y=1 Program: Syntax Control Flow Graph Model: Semantics Infinite State 5
6 Existential Abstraction Partition concrete statespace into abstract states Each abstract state S corresponds to a set of concrete states s We write α(s) to mean the abstract state corresponding to s We define γ(s) = { s S = α(s) } Fix the transitions existentially S S s γ (S). s γ (S ). s s S S s γ (S). s γ (S ). s s Existential Abstraction is conservative [ClarkeGrumbergLong94] Strong & sometimes t computable Weak: computable If a ACTL* property holds on the abstraction, it also holds on the program LTL is a subset of ACTL* However, the converse is t true: a property that fails on the abstraction may still hold on the program Existential abstraction can be viewed as a form of abstract interpretation 6
7 Example of Existential Abstraction Abstract Initial State Concrete Initial State 6 Concrete State Abstract State 3 Concrete Transition Abstractly Reachable but Concretely Unreachable Abstract Transition Abstractly and Concretely Unreachable 7
8 Example of Existential Abstraction Concrete State Abstract State Concrete Transition Abstractly Reachable but Concretely Unreachable p Abstract Transition Abstractly and Concretely Unreachable G( p) 8
9 Predicate Abstraction + 1 Partition the statespace based on values of a finite set of predicates on program variables 9
10 Predicate Abstraction φ = G( ERROR) + 1 ERROR P P States where y 0 P ( y == 0 ) States where y = 0 10
11 Predicate Abstraction Call SAT Checker + 1 ERROR P P States where y 0 P ( y == 0 ) States where y = 0 11
12 Predicate Abstraction SAT Checker Query: x=0 y=1 y 0 x = 0 x = x + 1 x=0 y=1 y = y y 0 SAT Checker Answer: SAT and here s a solution x=0, y=1, x =0, y =1 P States where y 0 P ( y == 0 ) 12
13 Predicate Abstraction SAT Checker Query: x=1 y=1 y 0 x 0 x = x + 1 x=1 y=1 y = y y 0 SAT Checker Answer: SAT and here s a solution x=1, y=1, x =1, y =1 P States where y 0 P ( y == 0 ) 13
14 Predicate Abstraction SAT Checker Query: y 0 x = x + 1 x=1 y=1 y = x+1 y 0 SAT Checker Answer: x=1 y=2 SAT and here s a solution P x=1, y=1, x =1, y =2 States where y 0 P ( y == 0 ) 14
15 Predicate Abstraction SAT Checker Query: y 0 x = x + 1 x=1 y=1 y = x y 0 SAT Checker Answer: x=1 y=1 P SAT and here s a solution x=1, y=1, x =1, y =1 States where y 0 P ( y == 0 ) 15
16 Predicate Abstraction No predicates about x + 1 ERROR P P States where y 0 P ( y == 0 ) States where y = 0 16
17 Imprecision due to Predicate Abstraction Counterexamples generated by model checking the abstract model may be spurious, i.e., t concretely realizable Need to refine the abstraction iteratively by changing the set of predicates Can infer new set of predicates by analyzing the spurious counterexample Lot of research in doing this effectively Counterexample Guided Abstraction Refinement (CEGAR) A.K.A. Iterative Abstraction Refinement A.K.A. Iterative Refinement 17
18 Model Checking + 1 ERROR P P φ = G( ERROR) P ( y == 0 ) 18
19 Model Checking + 1 ERROR P P φ = G( ERROR) P ( y == 0 ) 19
20 Model Checking ERROR P P P ( y == 0 ) 20
21 Counterexample Validation Simulate counterexample symbolically Call SAT Checker to determine if the post-condition is satisfiable In our case, Counterexample is spurious New set of predicates {x==0,y==0} 21
22 Counterexample Validation SAT Checker Query: x 0 y = x y = 0 SAT Checker Answer: UNSAT and here s an UNSAT core {x 0, y = x, y = 0} Used to derive new predicate (x=0) Different heuristics used in practice 22
23 Predicate Abstraction: 2 nd Iteration + 1 P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 23
24 Predicate Abstraction: 2 nd Iteration + 1 ERROR ERROR P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 24
25 Predicate Abstraction: 2 nd Iteration + 1 ERROR ERROR P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 25
26 Predicate Abstraction: 2 nd Iteration + 1 ERROR ERROR P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 26
27 Predicate Abstraction: 2 nd Iteration + 1 ERROR ERROR P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 27
28 Predicate Abstraction: 2 nd Iteration + 1 ERROR ERROR P Q P P Q P Q P Q x 0 y 0 P ( x == 0 ) Q ( y == 0 ) X = 0 y = 0 28
29 Model Checking: 2 nd Iteration + 1 ERROR ERROR SUCCESS P Q P P Q P Q P Q φ = G( ERROR) P ( x == 0 ) Q ( y == 0 ) 29
30 Iterative Refinement: Summary Choose an initial set of predicate, and proceed iteratively as follows: 1. Abstraction: Construct an abstract model M of the program using the predicate abstraction 2. Verification: Model check M. If model checking succeeds, exit with success. Otherwise, get counterexample CE.. 3. Validation: Check CE for validity. If CE is valid, exit with failure. 4. Refinement: Otherwise, update the set of predicates and repeat from Step 1. 30
31 Iterative Refinement Program Initial Predicates Better Predicates Predicate Abstraction Abstract Model SAT Checker Model Checking No Candidate Counterexample Yes System OK Localization Reduction, Kurshan, Bell Labs Counterexampleguided Abstraction Refinement for Symbolic Model Checking, Clarke et al., CMU Predicate Refinement No Counterexample Valid? Yes Problem Found Software Model Checking, SLAM Project, Microsoft, Ball & Rajamani 31
32 Predicate Abstraction: Optimizations 1. Construct transitions on-the-fly 2. Different set of predicates at different control locations P ( x == 0 ) P ( x == 0 ) + 1 P ( x == 0 ) Q ( y == 0 ) 3. Avoid exponential number of theorem-prover calls 32
33 Research Areas Finding good predicates Technically as hard as finding good loop invariants Complexity is linear in LOC but exponential in number of predicates Combining with static analysis Alias analysis, invariant detection, constant propagation Inexpensive, and may make subsequent model checking more efficient Bounded model checking 33
34 Software Model Checking Tools Iterative Refinement SLAM, BLAST, MAGIC, Copper, SATABS, Bounded Model Checking Others CBMC, Engines: MOPED, BEBOP, BOPPO, Next lecture Following lecture Java: Java PathFiner, Bandera, BOGOR, C: CMC, CPAChecker, 34
35 Bibliography Existential Abstraction: Edmund M. Clarke, Orna Grumberg, David E. Long: Model Checking and Abstraction. ACM Trans. Program. Lang. Syst. 16(5): (1994) Predicate Abstraction: Construction of abstract state graphs with PVS, S. Graf, H. Saidi, Proceedings of Computer Aided Verification (CAV), 1997 Abstraction Refinement for C: Automatically Validating Temporal Safety Properties of Interfaces, T. Ball, S. Rajamani, Proceedings of the SPIN Workshop, 2001 Software Model Checking Techlogy Transfer: SLAM and Static Driver Verifier: Techlogy Transfer of Formal Methods inside Microsoft, T. Ball, B. Cook, V. Levin, S. Rajamani, Proceedings of Intergrated Formal Methods,
36
Double Header. Model Checking. Model Checking. Overarching Plan. Take-Home Message. Spoiler Space. Topic: (Generic) Model Checking
Double Header Model Checking #1 Two Lectures Model Checking SoftwareModel Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation
More informationModel Checking: An Introduction
Model Checking: An Introduction Meeting 3, CSCI 5535, Spring 2013 Announcements Homework 0 ( Preliminaries ) out, due Friday Saturday This Week Dive into research motivating CSCI 5535 Next Week Begin foundations
More informationCounterexample-Guided Abstraction Refinement
Counterexample-Guided Abstraction Refinement Edmund Clarke Orna Grumberg Somesh Jha Yuan Lu Helmut Veith Seminal Papers in Verification (Reading Group) June 2012 O. Rezine () Verification Reading Group
More informationAbstractions and Decision Procedures for Effective Software Model Checking
Abstractions and Decision Procedures for Effective Software Model Checking Prof. Natasha Sharygina The University of Lugano, Carnegie Mellon University Microsoft Summer School, Moscow, July 2011 Lecture
More informationModel Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies
Model Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies Tom Henzinger EPFL Three Verification Communities Model checking: -automatic, but inefficient
More information3-Valued Abstraction-Refinement
3-Valued Abstraction-Refinement Sharon Shoham Academic College of Tel-Aviv Yaffo 1 Model Checking An efficient procedure that receives: A finite-state model describing a system A temporal logic formula
More informationPredicate Abstraction: A Tutorial
Predicate Abstraction: A Tutorial Predicate Abstraction Daniel Kroening May 28 2012 Outline Introduction Existential Abstraction Predicate Abstraction for Software Counterexample-Guided Abstraction Refinement
More informationIC3 and Beyond: Incremental, Inductive Verification
IC3 and Beyond: Incremental, Inductive Verification Aaron R. Bradley ECEE, CU Boulder & Summit Middle School IC3 and Beyond: Incremental, Inductive Verification 1/62 Induction Foundation of verification
More informationSAT-Based Verification with IC3: Foundations and Demands
SAT-Based Verification with IC3: Foundations and Demands Aaron R. Bradley ECEE, CU Boulder & Summit Middle School SAT-Based Verification with IC3:Foundations and Demands 1/55 Induction Foundation of verification
More informationModel Checking. Boris Feigin March 9, University College London
b.feigin@cs.ucl.ac.uk University College London March 9, 2005 Outline 1 2 Techniques Symbolic 3 Software 4 Vs. Deductive Verification Summary Further Reading In a nutshell... Model checking is a collection
More informationUnderstanding IC3. Aaron R. Bradley. ECEE, CU Boulder & Summit Middle School. Understanding IC3 1/55
Understanding IC3 Aaron R. Bradley ECEE, CU Boulder & Summit Middle School Understanding IC3 1/55 Further Reading This presentation is based on Bradley, A. R. Understanding IC3. In SAT, June 2012. http://theory.stanford.edu/~arbrad
More informationLecture 2: Symbolic Model Checking With SAT
Lecture 2: Symbolic Model Checking With SAT Edmund M. Clarke, Jr. School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 (Joint work over several years with: A. Biere, A. Cimatti, Y.
More informationLecture 2: Model Checking My 30 Year Quest to Conquer the State Explosion Problem
Lecture 2: Model Checking My 30 Year Quest to Conquer the State Explosion Problem Edmund M. Clarke School of Computer Science Carnegie Mellon University Intel Pentium FDIV Bug Try 4195835 4195835 / 3145727
More informationMODEL CHECKING. Arie Gurfinkel
1 MODEL CHECKING Arie Gurfinkel 2 Overview Kripke structures as models of computation CTL, LTL and property patterns CTL model-checking and counterexample generation State of the Art Model-Checkers 3 SW/HW
More informationInformation Flow Analysis via Path Condition Refinement
Information Flow Analysis via Path Condition Refinement Mana Taghdiri, Gregor Snelting, Carsten Sinz Karlsruhe Institute of Technology, Germany FAST September 16, 2010 KIT University of the State of Baden-Wuerttemberg
More informationModel Checking. Temporal Logic. Fifth International Symposium in Programming, volume. of concurrent systems in CESAR. In Proceedings of the
Sérgio Campos, Edmund Why? Advantages: No proofs Fast Counter-examples No problem with partial specifications can easily express many concurrency properties Main Disadvantage: State Explosion Problem Too
More informationApplications of Craig Interpolants in Model Checking
Applications of Craig Interpolants in Model Checking K. L. McMillan Cadence Berkeley Labs Abstract. A Craig interpolant for a mutually inconsistent pair of formulas (A, B) is a formula that is (1) implied
More informationState-Space Exploration. Stavros Tripakis University of California, Berkeley
EE 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Fall 2014 State-Space Exploration Stavros Tripakis University of California, Berkeley Stavros Tripakis (UC Berkeley) EE
More informationLearning Abstractions for Model Checking
Learning Abstractions for Model Checking Anubhav Gupta June 2006 CMU-CS-06-131 School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 Submitted in partial fulfillment of the requirements
More informationSymbolic Trajectory Evaluation (STE): Orna Grumberg Technion, Israel
Symbolic Trajectory Evaluation (STE): Automatic Refinement and Vacuity Detection Orna Grumberg Technion, Israel Marktoberdort 2007 1 Agenda Model checking Symbolic Trajectory Evaluation Basic Concepts
More informationStatic Program Analysis
Static Program Analysis Lecture 16: Abstract Interpretation VI (Counterexample-Guided Abstraction Refinement) Thomas Noll Lehrstuhl für Informatik 2 (Software Modeling and Verification) noll@cs.rwth-aachen.de
More informationInterpolant-based Transition Relation Approximation
Interpolant-based Transition Relation Approximation Ranjit Jhala and K. L. McMillan 1 University of California, San Diego 2 Cadence Berkeley Labs Abstract. In predicate abstraction, exact image computation
More informationAutomata-Theoretic Model Checking of Reactive Systems
Automata-Theoretic Model Checking of Reactive Systems Radu Iosif Verimag/CNRS (Grenoble, France) Thanks to Tom Henzinger (IST, Austria), Barbara Jobstmann (CNRS, Grenoble) and Doron Peled (Bar-Ilan University,
More informationFormal Verification Techniques. Riccardo Sisto, Politecnico di Torino
Formal Verification Techniques Riccardo Sisto, Politecnico di Torino State exploration State Exploration and Theorem Proving Exhaustive exploration => result is certain (correctness or noncorrectness proof)
More informationA Brief Introduction to Model Checking
A Brief Introduction to Model Checking Jan. 18, LIX Page 1 Model Checking A technique for verifying finite state concurrent systems; a benefit on this restriction: largely automatic; a problem to fight:
More informationSoftware Verification with Abstraction-Based Methods
Software Verification with Abstraction-Based Methods Ákos Hajdu PhD student Department of Measurement and Information Systems, Budapest University of Technology and Economics MTA-BME Lendület Cyber-Physical
More informationVerification using Satisfiability Checking, Predicate Abstraction, and Craig Interpolation. Himanshu Jain THESIS ORAL TALK
Verification using Satisfiability Checking, Predicate Abstraction, and Craig Interpolation Himanshu Jain THESIS ORAL TALK 1 Computer Systems are Pervasive Computer Systems = Software + Hardware Software/Hardware
More informationPLEASE DO NOT REMOVE THIS PAGE
Thank you for downloading this document from the RMIT ResearchR Repository Citation: Liu, H, Wang, D, Huimin, L and Chen, T 2009, 'On the integration of metamorphic testing and model checking', in Hans
More informationRelative Completeness of Abstraction Refinement for Software Model Checking
Relative Completeness of Abstraction Refinement for Software Model Checking Thomas Ball 1, Andreas Podelski 2, and Sriram K. Rajamani 1 1 Microsoft Research 2 Max-Planck-Institut für Informatik Abstract.
More informationRanking Abstraction as Companion to Predicate Abstraction
Ranking Abstraction as Companion to Predicate Abstraction Ittai Balaban 1, Amir Pnueli 1,2, and Lenore D. Zuck 3 1 New York University, New York {balaban, amir}@cs.nyu.edu 2 Weizmann Institute of Science
More informationCEGAR:Counterexample-Guided Abstraction Refinement
CEGAR: Counterexample-guided Abstraction Refinement Sayan Mitra ECE/CS 584: Embedded System Verification November 13, 2012 Outline Finite State Systems: Abstraction Refinement CEGAR Validation Refinment
More informationFormal Verification. Lecture 1: Introduction to Model Checking and Temporal Logic¹
Formal Verification Lecture 1: Introduction to Model Checking and Temporal Logic¹ Jacques Fleuriot jdf@inf.ed.ac.uk ¹Acknowledgement: Adapted from original material by Paul Jackson, including some additions
More informationPredicate Abstraction via Symbolic Decision Procedures
Predicate Abstraction via Symbolic Decision Procedures Shuvendu K. Lahiri Thomas Ball Byron Cook May 26, 2005 Technical Report MSR-TR-2005-53 Microsoft Research Microsoft Corporation One Microsoft Way
More informationIntroduction. Pedro Cabalar. Department of Computer Science University of Corunna, SPAIN 2013/2014
Introduction Pedro Cabalar Department of Computer Science University of Corunna, SPAIN cabalar@udc.es 2013/2014 P. Cabalar ( Department Introduction of Computer Science University of Corunna, SPAIN2013/2014
More informationCS 267: Automated Verification. Lecture 1: Brief Introduction. Transition Systems. Temporal Logic LTL. Instructor: Tevfik Bultan
CS 267: Automated Verification Lecture 1: Brief Introduction. Transition Systems. Temporal Logic LTL. Instructor: Tevfik Bultan What do these people have in common? 2013 Leslie Lamport 2007 Clarke, Edmund
More informationScalable and Accurate Verification of Data Flow Systems. Cesare Tinelli The University of Iowa
Scalable and Accurate Verification of Data Flow Systems Cesare Tinelli The University of Iowa Overview AFOSR Supported Research Collaborations NYU (project partner) Chalmers University (research collaborator)
More informationReasoning about Strategies: From module checking to strategy logic
Reasoning about Strategies: From module checking to strategy logic based on joint works with Fabio Mogavero, Giuseppe Perelli, Luigi Sauro, and Moshe Y. Vardi Luxembourg September 23, 2013 Reasoning about
More informationEECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization
EECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Discrete Systems Lecture: State-Space Exploration Stavros Tripakis University of California, Berkeley Stavros Tripakis:
More informationModel checking the basic modalities of CTL with Description Logic
Model checking the basic modalities of CTL with Description Logic Shoham Ben-David Richard Trefler Grant Weddell David R. Cheriton School of Computer Science University of Waterloo Abstract. Model checking
More informationLecture Notes on Software Model Checking
15-414: Bug Catching: Automated Program Verification Lecture Notes on Software Model Checking Matt Fredrikson André Platzer Carnegie Mellon University Lecture 19 1 Introduction So far we ve focused on
More informationAutomated Compositional Analysis for Checking Component Substitutability
Automated Compositional Analysis for Checking Component Substitutability Nishant Sinha December 2007 Electrical and Computer Engineering Department Carnegie Mellon University Pittsburgh, PA 15213 Thesis
More informationAlan Bundy. Automated Reasoning LTL Model Checking
Automated Reasoning LTL Model Checking Alan Bundy Lecture 9, page 1 Introduction So far we have looked at theorem proving Powerful, especially where good sets of rewrite rules or decision procedures have
More informationFormal Verification of Mobile Network Protocols
Dipartimento di Informatica, Università di Pisa, Italy milazzo@di.unipi.it Pisa April 26, 2005 Introduction Modelling Systems Specifications Examples Algorithms Introduction Design validation ensuring
More informationAbstraction in Program Analysis & Model Checking. Abstraction in Model Checking. Motivations & Results
On Completeness in Abstract Model Checking from the Viewpoint of Abstract Interpretation Abstraction in Program Analysis & Model Checking Abstract interpretation has been successfully applied in: static
More informationFinite-State Model Checking
EECS 219C: Computer-Aided Verification Intro. to Model Checking: Models and Properties Sanjit A. Seshia EECS, UC Berkeley Finite-State Model Checking G(p X q) Temporal logic q p FSM Model Checker Yes,
More informationAlgorithmic Verification of Stability of Hybrid Systems
Algorithmic Verification of Stability of Hybrid Systems Pavithra Prabhakar Kansas State University University of Kansas February 24, 2017 1 Cyber-Physical Systems (CPS) Systems in which software "cyber"
More informationSAT-based Model Checking: Interpolation, IC3, and Beyond
SAT-based Model Checking: Interpolation, IC3, and Beyond Orna GRUMBERG a, Sharon SHOHAM b and Yakir VIZEL a a Computer Science Department, Technion, Haifa, Israel b School of Computer Science, Academic
More informationProbabilistic Model Checking Michaelmas Term Dr. Dave Parker. Department of Computer Science University of Oxford
Probabilistic Model Checking Michaelmas Term 2011 Dr. Dave Parker Department of Computer Science University of Oxford Probabilistic model checking System Probabilistic model e.g. Markov chain Result 0.5
More informationSoftware Verification
Software Verification Grégoire Sutre LaBRI, University of Bordeaux, CNRS, France Summer School on Verification Technology, Systems & Applications September 2008 Grégoire Sutre Software Verification VTSA
More informationCounterexample-Guided Abstraction Refinement for Symbolic Model Checking
Counterexample-Guided Abstraction Refinement for Symbolic Model Checking EDMUND CLARKE Carnegie Mellon University, Pittsburgh, Pennsylvania ORNA GRUMBERG The Technion, Haifa, Israel SOMESH JHA YUAN LU
More informationThe Software Model Checker BLAST
The Software Model Checker BLAST http://mtc.epfl.ch/software-tools/blast/ BLAST 2.0 Team: Dirk Beyer, Tom Henzinger, Ranjit Jhala, and Rupak Majumdar Guest Lecture in Viktor Kuncak s Verification Class,
More informationBounded Model Checking with SAT/SMT. Edmund M. Clarke School of Computer Science Carnegie Mellon University 1/39
Bounded Model Checking with SAT/SMT Edmund M. Clarke School of Computer Science Carnegie Mellon University 1/39 Recap: Symbolic Model Checking with BDDs Method used by most industrial strength model checkers:
More informationAn Interpolating Theorem Prover
An Interpolating Theorem Prover K.L. McMillan Cadence Berkeley Labs Abstract. We present a method of deriving Craig interpolants from proofs in the quantifier-free theory of linear inequality and uninterpreted
More informationBinary Decision Diagrams and Symbolic Model Checking
Binary Decision Diagrams and Symbolic Model Checking Randy Bryant Ed Clarke Ken McMillan Allen Emerson CMU CMU Cadence U Texas http://www.cs.cmu.edu/~bryant Binary Decision Diagrams Restricted Form of
More informationAlgorithmic verification
Algorithmic verification Ahmed Rezine IDA, Linköpings Universitet Hösttermin 2018 Outline Overview Model checking Symbolic execution Outline Overview Model checking Symbolic execution Program verification
More informationRelational Interfaces and Refinement Calculus for Compositional System Reasoning
Relational Interfaces and Refinement Calculus for Compositional System Reasoning Viorel Preoteasa Joint work with Stavros Tripakis and Iulia Dragomir 1 Overview Motivation General refinement Relational
More informationCOMPRESSED STATE SPACE REPRESENTATIONS - BINARY DECISION DIAGRAMS
QUALITATIVE ANALYIS METHODS, OVERVIEW NET REDUCTION STRUCTURAL PROPERTIES COMPRESSED STATE SPACE REPRESENTATIONS - BINARY DECISION DIAGRAMS LINEAR PROGRAMMING place / transition invariants state equation
More informationComputation Tree Logic (CTL) & Basic Model Checking Algorithms
Computation Tree Logic (CTL) & Basic Model Checking Algorithms Martin Fränzle Carl von Ossietzky Universität Dpt. of Computing Science Res. Grp. Hybride Systeme Oldenburg, Germany 02917: CTL & Model Checking
More informationCS357: CTL Model Checking (two lectures worth) David Dill
CS357: CTL Model Checking (two lectures worth) David Dill 1 CTL CTL = Computation Tree Logic It is a propositional temporal logic temporal logic extended to properties of events over time. CTL is a branching
More informationCIS 842: Specification and Verification of Reactive Systems. Lecture Specifications: Specification Patterns
CIS 842: Specification and Verification of Reactive Systems Lecture Specifications: Specification Patterns Copyright 2001-2002, Matt Dwyer, John Hatcliff, Robby. The syllabus and all lectures for this
More informationAn Informal introduction to Formal Verification
An Informal introduction to Formal Verification Osman Hasan National University of Sciences and Technology (NUST), Islamabad, Pakistan O. Hasan Formal Verification 2 Agenda q Formal Verification Methods,
More informationAn Introduction to Temporal Logics
An Introduction to Temporal Logics c 2001,2004 M. Lawford Outline Motivation: Dining Philosophers Safety, Liveness, Fairness & Justice Kripke structures, LTS, SELTS, and Paths Linear Temporal Logic Branching
More informationAlternating Time Temporal Logics*
Alternating Time Temporal Logics* Sophie Pinchinat Visiting Research Fellow at RSISE Marie Curie Outgoing International Fellowship * @article{alur2002, title={alternating-time Temporal Logic}, author={alur,
More informationThe State Explosion Problem
The State Explosion Problem Martin Kot August 16, 2003 1 Introduction One from main approaches to checking correctness of a concurrent system are state space methods. They are suitable for automatic analysis
More informationIMITATOR: A Tool for Synthesizing Constraints on Timing Bounds of Timed Automata
ICTAC 09 IMITATOR: A Tool for Synthesizing Constraints on Timing Bounds of Timed Automata Étienne ANDRÉ Laboratoire Spécification et Vérification LSV, ENS de Cachan & CNRS Étienne ANDRÉ (LSV) ICTAC 09
More informationModel Checking via Automatic Abstraction
LTL Generalized Model Checking Revisited Patrice Godefroid Nir Piterman Microsoft Research Imperial College Page 1 January 2009 Model Checking via Automatic Abstraction Implemented in software model checkers
More informationTesting with model checkers: A survey
COMPETENCE NETWORK SOFTNET AUSTRIA Testing with model checkers: A survey SNA-TR-2007-P2-04 Gordon Fraser, Franz Wotawa, Paul E. Ammann SNA TECHNICAL REPORT NOVEMBER 2007 Competence Network Softnet Austria,
More informationUndergraduate work. Symbolic Model Checking Using Additive Decomposition by. Himanshu Jain. Joint work with Supratik Chakraborty
Undergraduate work Symbolic Model Checking Using Additive Decomposition by Himanshu Jain Joint work with Supratik Chakraborty Organization of the Talk Basics Motivation Related work Decomposition scheme
More informationor simply: IC3 A Simplified Description
Incremental Construction of Inductive Clauses for Indubitable Correctness or simply: IC3 A Simplified Description Based on SAT-Based Model Checking without Unrolling Aaron Bradley, VMCAI 2011 Efficient
More informationEFFICIENT PREDICATE ABSTRACTION OF PROGRAM SUMMARIES
EFFICIENT PREDICATE ABSTRACTION OF PROGRAM SUMMARIES Arie Gurfinkel, Sagar Chaki and Samir Sapra Carnegie Mellon Uni In NFM11 Presented by Nimrod Partush OUTLINE Introduction Predicate Abstraction CEGAR
More informationModel Checking I. What are LTL and CTL? dack. and. dreq. and. q0bar
Model Checking I What are LTL and CTL? q0 or and dack dreq q0bar and 1 View circuit as a transition system (dreq, q0, dack) (dreq, q0, dack ) q0 = dreq and dack = dreq & (q0 + ( q0 & dack)) q0 or and D
More informationCounterexample-Driven Model Checking
Counterexample-Driven Model Checking (Extended Abstract) Natarajan Shankar and Maria Sorea SRI International Computer Science Laboratory 333 Ravenswood Avenue Menlo Park, CA 94025, USA {shankar, sorea}@csl.sri.com
More informationTutorial 1: Modern SMT Solvers and Verification
University of Illinois at Urbana-Champaign Tutorial 1: Modern SMT Solvers and Verification Sayan Mitra Electrical & Computer Engineering Coordinated Science Laboratory University of Illinois at Urbana
More informationDynamic Component Substitutability Analysis
Dynamic Component Substitutability Analysis Natasha Sharygina Sagar Chaki Edmund Clarke Nishant Sinha nys chaki@sei.cmu.edu emc natalie nishants@cs.cmu.edu Carnegie Mellon University Abstract. This paper
More informationModel Checking I. What are LTL and CTL? dack. and. dreq. and. q0bar
Model Checking I What are LTL and CTL? and dack q0 or D dreq D q0bar and 1 View circuit as a transition system (dreq, q0, dack) (dreq, q0, dack ) q0 = dreq dack = dreq and (q0 or (not q0 and dack)) q0
More information- Introduction to propositional, predicate and higher order logics
Lecture 1: Deductive Verification of Reactive Systems - Introduction to propositional, predicate and higher order logics - Deductive Invariance Proofs Cristina Seceleanu MRTC, MdH E-mail: cristina.seceleanu@mdh.se
More informationSanjit A. Seshia EECS, UC Berkeley
EECS 219C: Computer-Aided Verification Explicit-State Model Checking: Additional Material Sanjit A. Seshia EECS, UC Berkeley Acknowledgments: G. Holzmann Checking if M satisfies : Steps 1. Compute Buchi
More informationSAT in Formal Hardware Verification
SAT in Formal Hardware Verification Armin Biere Institute for Formal Models and Verification Johannes Kepler University Linz, Austria Invited Talk SAT 05 St. Andrews, Scotland 20. June 2005 Overview Hardware
More informationComplexity and algorithms for monomial and clausal predicate abstraction
Complexity and algorithms for monomial and clausal predicate abstraction Shuvendu K. Lahiri and Shaz Qadeer Microsoft Research Abstract. In this paper, we investigate the asymptotic complexity of various
More informationIC3, PDR, and Friends
IC3, PDR, and Friends Arie Gurfinkel Department of Electrical and Computer Engineering University of Waterloo arie.gurfinkel@uwaterloo.ca Abstract. We describe the IC3/PDR algorithms and their various
More informationarxiv: v1 [cs.lo] 29 May 2014
Under consideration for publication in Theory and Practice of Logic Programming 1 arxiv:1405.7739v1 [cs.lo] 29 May 2014 (Quantified) Horn Constraint Solving for Program Verification and Synthesis Andrey
More informationOn Model Checking for Visibly Pushdown Automata
Japan Institute of Advanced Industrial Science and Technology Research Center for Specification and Verification LATA 2012 On Model Checking for Visibly Pushdown Automata Nguyen Van Tang and Hitoshi Ohsaki
More informationLearning to Verify Branching Time Properties
Learning to Verify Branching Time Properties Abhay Vardhan and Mahesh Viswanathan Dept. of Computer Science, Univ. of Illinois at Urbana-Champaign, USA Abstract. We present a new model checking algorithm
More informationVinter: A Vampire-Based Tool for Interpolation
Vinter: A Vampire-Based Tool for Interpolation Kryštof Hoder 1, Andreas Holzer 2, Laura Kovács 2, and Andrei Voronkov 1 1 University of Manchester 2 TU Vienna Abstract. This paper describes the Vinter
More informationModel Checking with CTL. Presented by Jason Simas
Model Checking with CTL Presented by Jason Simas Model Checking with CTL Based Upon: Logic in Computer Science. Huth and Ryan. 2000. (148-215) Model Checking. Clarke, Grumberg and Peled. 1999. (1-26) Content
More informationLecture Notes on Emptiness Checking, LTL Büchi Automata
15-414: Bug Catching: Automated Program Verification Lecture Notes on Emptiness Checking, LTL Büchi Automata Matt Fredrikson André Platzer Carnegie Mellon University Lecture 18 1 Introduction We ve seen
More informationAutomata, Logic and Games: Theory and Application
Automata, Logic and Games: Theory and Application 1. Büchi Automata and S1S Luke Ong University of Oxford TACL Summer School University of Salerno, 14-19 June 2015 Luke Ong Büchi Automata & S1S 14-19 June
More informationProgress on the State Explosion Problem in Model Checking
Progress on the State Explosion Problem in Model Checking Edmund Clarke 1, Orna Grumberg 2, Somesh Jha 3,YuanLu 4, and Helmut Veith 5 1 School of Computer Science, Carnegie Mellon University, USA edmundclarke@cscmuedu
More informationPredicate Abstraction in Protocol Verification
Predicate Abstraction in Protocol Verification Edgar Pek, Nikola Bogunović Faculty of Electrical Engineering and Computing Zagreb, Croatia E-mail: {edgar.pek, nikola.bogunovic}@fer.hr Abstract This paper
More informationCounterexample-GuidedAbstraction Refinement
Counterexample-GuidedAbstraction Refinement Edmund Clarke 1, Orna Grumberg 2, Somesh Jha 1, Yuan Lu 1, and Helmut Veith 1,3 1 Carnegie Mellon University, Pittsburgh, USA 2 Technion, Haifa, Israel 3 Vienna
More informationA brief history of model checking. Ken McMillan Cadence Berkeley Labs
A brief history of model checking Ken McMillan Cadence Berkeley Labs mcmillan@cadence.com Outline Part I -- Introduction to model checking Automatic formal verification of finite-state systems Applications
More informationVerification. Arijit Mondal. Dept. of Computer Science & Engineering Indian Institute of Technology Patna
IIT Patna 1 Verification Arijit Mondal Dept. of Computer Science & Engineering Indian Institute of Technology Patna arijit@iitp.ac.in Introduction The goal of verification To ensure 100% correct in functionality
More informationAbstract Interpretation and Static Analysis
/ 1 Abstract Interpretation and Static Analysis David Schmidt Kansas State University www.cis.ksu.edu/~schmidt Welcome! / 2 / 3 Four parts 1. Introduction to static analysis what it is and how to apply
More informationDetecting Spurious Counterexamples Efficiently in Abstract Model Checking
Detecting Spurious Counterexamples Efficiently in Abstract Model Checking Cong Tian and Zhenhua Duan ICTT and ISN Laboratory, Xidian University, Xi an, 710071, P.R. China {ctian, zhhduan}@mail.xidian.edu.cn
More informationOverview. Discrete Event Systems Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for?
Computer Engineering and Networks Overview Discrete Event Systems Verification of Finite Automata Lothar Thiele Introduction Binary Decision Diagrams Representation of Boolean Functions Comparing two circuits
More informationReducing CTL-live Model Checking to Semantic Entailment in First-Order Logic (Version 1)
1 Reducing CTL-live Model Checking to Semantic Entailment in First-Order Logic (Version 1) Amirhossein Vakili and Nancy A. Day Cheriton School of Computer Science University of Waterloo Waterloo, Ontario,
More informationNon-Monotonic Refinement of Control Abstraction for Concurrent Programs
Non-Monotonic Refinement of Control Abstraction for Concurrent Programs Ashutosh Gupta, Corneliu Popeea, and Andrey Rybalchenko Technische Universität München Abstract. Verification based on abstraction
More informationAn Introduction to Hybrid Systems Modeling
CS620, IIT BOMBAY An Introduction to Hybrid Systems Modeling Ashutosh Trivedi Department of Computer Science and Engineering, IIT Bombay CS620: New Trends in IT: Modeling and Verification of Cyber-Physical
More informationIntroduction to SMT Solving And Infinite Bounded Model Checking
Introduction to SMT Solving And Infinite Bounded Model Checking John Rushby Computer Science Laboratory SRI International Menlo Park, California, USA John Rushby, SR I Introduction to SMT and Infinite
More informationFormal Inductive Synthesis -- Theory and Applications
Formal Inductive Synthesis -- Theory and Applications Sanjit A. Seshia EECS Department UC Berkeley Acknowledgments to several Ph.D. students, postdoctoral researchers, and collaborators, and to the students
More information