Nested Interpolants. Matthias Heizmann Jochen Hoenicke Andreas Podelski POPL University of Freiburg, Germany
|
|
- Hugo Williamson
- 5 years ago
- Views:
Transcription
1 Nested Interpolants Matthias Heizmann Jochen Hoenicke Andreas Podelski University of Freiburg, Germany POPL 2010
2
3 Result Interpolant-based software model checking for recursive programs avoid construction of an abstract program Hoare logic nested words
4 Software model checking Thomas Ball, Sriram K. Rajamani: The SLAM project: debugging system software via static analysis. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Grégoire Sutre Lazy abstraction. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Kenneth L. McMillan Abstractions from proofs. (POPL 2004) theorem model proving checking program abstract program invariant
5 Software model checking Thomas Ball, Sriram K. Rajamani: The SLAM project: debugging system software via static analysis. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Grégoire Sutre Lazy abstraction. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Kenneth L. McMillan Abstractions from proofs. (POPL 2004) theorem model proving checking program abstract program invariant Bottleneck: Construction of abstract program
6 Recent approaches: Avoid construction of abstract program Franjo Ivancic, Ilya Shlyakhter, Aarti Gupta, Malay K. Ganai Model checking C programs using F-SOFT (ICCD 2005) Kenneth L. McMillan Lazy abstraction with interpolants (CAV 2006) Nels Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons Proofs from tests (ISSTA 2008) Bhargav S. Gulavani, Supratik Chakraborty, Aditya V. Nori, Sriram K. Rajamani Automatically refining abstract interpretations (TACAS 2008)
7 One idea: Use interpolants to avoid construction of the abstract program theorem model proving checking program abstract program invariant interpolating theorem prover
8 One idea: Use interpolants to avoid construction of the abstract program theorem model proving checking program abstract program invariant interpolating theorem prover Ranjit Jhala, Kenneth L. McMillan A practical and complete approach to predicate refinement (TACAS 2006) Kenneth L. McMillan Lazy abstraction with interpolants (CAV 2006) Quantified invariant generation using an interpolating saturation prover (TACAS 2008) Open: Interpolants in interprocedural analysis
9 Interprocedural static analysis - motivation Recursive Programs?
10 Interprocedural static analysis - motivation Modularity! Recursive Programs?
11 Interprocedural static analysis - motivation Modularity! Recursive Programs? Interprocedural analysis, a classical topic in programming languages Micha Sharir, Amir Pnueli Two approaches to interprocedural data flow analysis (1981) Thomas W. Reps, Susan Horwitz, Shmuel Sagiv Precise interprocedural dataflow analysis via graph reachability (POPL 1995) Shaz Qadeer, Sriram K. Rajamani, Jakob Rehof Summarizing procedures in concurrent programs (POPL 2004)
12 Interpolants Interpolant - for a proof Given: Proof A B Interpolation: A I B.... automatically generated by SMT solver (Craig interpolation)
13 Interpolants Interpolant - for a proof Given: Proof A B Interpolation: A I B.... automatically generated by SMT solver (Craig interpolation) Interpolant - for an execution traces Given: Infeasible trace st 1... st i st i+1... st n Interpolation: post( true, st 1... st i ) I wp( st i+1... st n, false )... can be new formula, not contained in program
14 Inductive interpolants Construct sequence of interpolants I 0... I n inductively post( I i, st i ) I i+1 suitable Hoare annotation to prove infeasibility of program slice
15 Inductive interpolants Construct sequence of interpolants I 0... I n inductively post( I i, st i ) I i+1 suitable Hoare annotation to prove infeasibility of program slice What if execution trace contains procedure calls?
16 Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution?
17 Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution? state with a stack? locality of interpolant is lost
18 Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution? state with a stack? locality of interpolant is lost only local valuations? call/return dependency lost, sequence of interpolants is not a proof
19 Our gordian knot How can we keep track of the call/return dependency in a sequence of states without a stack?
20
21 Nested words Idea: Add call/return dependency explicitly to the word Rajeev Alur Marrying words and trees (PODS 2007) Rajeev Alur, P. Madhusudan Adding nesting structure to words (DLT 2006, J. ACM 56(3) 2009) Rajeev Alur, Swarat Chaudhuri Temporal reasoning for procedural programs (VMCAI 2010)
22 Nested words Idea: Add call/return dependency explicitly to the word Rajeev Alur Marrying words and trees (PODS 2007) Rajeev Alur, P. Madhusudan Adding nesting structure to words (DLT 2006, J. ACM 56(3) 2009) Rajeev Alur, Swarat Chaudhuri Temporal reasoning for procedural programs (VMCAI 2010)
23 Nested interpolants What is a sequence of interpolants for an interprocedural execution? Idea: Define sequence interpolants with respect to nested trace
24 Nested interpolants What is a sequence of interpolants for an interprocedural execution? Idea: Define sequence interpolants with respect to nested trace ( ) post I i, I k, return I i+1
25 Control flow as nested word automata procedure m(x) returns (res) l 0: if x>100 x<=100 l0 l 1: res:=x-10 else l2 xm:=x+11 x>100 l 2: x m := x+11 l3 l 3: l4 xm:=resm return m l3 l1 l 4: x m := res m l5 l 5: l6 res:=resm res:=x-10 l 6: res := res m l 7: assert (x<=101 -> res=91) return m McCarthy 91 function l7 return m l5 x 101 res 91 lerr nested word automaton
26 Floyd-Hoare proof as nested word automata procedure m(x) returns (res) { } l 0: if x>100 l 1: {x 101} res:=x-10 else {x 100} l 2: x m := x+11 l 3: {xm 111} {resm 101} l 4: x m := res m l 5: l 6: {xm 101} {resm = 91} res := res m {res = 91 (x 101 res = x 10)} l 7: assert (x<=101 -> res=91) return m McCarthy 91 function x 100 xm 111 resm 101 xm 101 resm = 91 x<=100 xm:=x+11 xm:=resm return m xm 101 res:=resm return m xm 111 res = 91 x 101 res = x 10 nested word automaton x>100 res:=x-10 x 101
27 Floyd-Hoare proof as nested word automata procedure m(x) returns (res) { } l 0: if x>100 l 1: {x 101} res:=x-10 else {x 100} l 2: x m := x+11 l 3: {xm 111} {resm 101} l 4: x m := res m l 5: l 6: {xm 101} {resm = 91} res := res m {res = 91 (x 101 res = x 10)} l 7: assert (x<=101 -> res=91) return m McCarthy 91 function x 100 xm 111 resm 101 xm 101 resm = 91 x<=100 xm:=x+11 xm:=resm return m xm 101 res:=resm return m xm 111 res = 91 x 101 res = x 10 nested word automaton x>100 res:=x-10 x 101 e.g. post ( x 100, x m:=x+11 ) x m 111
28 Constructing a proof of correctness Compute sequence of nested interpolants x<=100 ϕ0 : x I0 : I1 : x 100 xm:=x+11 ϕ1 : x 1 m =x ϕ2 : x 2 =x 1 m I2 : xm 111 I3 : x>100 ϕ3 : x 2 >100 I4 : res:=x-10 ϕ4 : res 4 =x 2 10 return m ϕ5 : res 5 m =res 4 I6 : resm 101 I5 : res x 10 xm:=resm ϕ6 : x 6 m =res 5 m ϕ7 : x 7 =x 6 m I7 : xm 101 I8 : x>100 ϕ8 : x 7 >100 I9 : x 101 res:=x-10 ϕ9 : res 9 =x 7 10 return m ϕ10 : res 10 m =res 9 I11 : resm = 91 I10 : x 101 res = x 10 res:=resm ϕ11 : res 11 =res m 10 I12 : res = 91 x 101 res 91) ϕ12 : x res I13 : infeasible nested trace π SSA of π sequence of interpolants for π
29 Constructing a proof of correctness Nested interpolant automaton I0 : q0 I1 : x 100 x<=100 q1 x<=100 xm:=x+11 x<=100 I2 : xm 111 I3 : q2 q3 x>100 I4 : q4 res:=x-10 I6 : resm 101 I5 : res x 10 q6 return m q2 q5 xm:=resm I7 : xm 101 I8 : q7 q8 x>100 I9 : x 101 return m q2 q9 res:=x-10 I11 : resm = 91 I10 : x 101 res = x 10 q11 return m q7 q10 res:=resm I12 : res = 91 q12 return m q7 x 101 res 91) I13 : sequence of interpolants for π q13 nested interpolant automaton
30 Constructing a proof of correctness Nested interpolant automaton I0 : x<=100 I1 : x 100 q0 x<=100 q1 x<=100 xm:=x+11 I2 : xm 111 I3 : x>100 xm:=x+11 q2 x<=100 q3 x>100 I4 : q4 res:=x-10 res:=x-10 I6 : resm 101 return m I5 : res x 10 q6 return m q2 q5 xm:=resm xm:=resm I7 : xm 101 I8 : q7 q8 x>100 x>100 I9 : x 101 return m q2 q9 res:=x-10 res:=x-10 I11 : resm = 91 return m I10 : x 101 res = x 10 q11 return m q7 q10 res:=resm I12 : res = 91 res:=resm q12 return m q7 x 101 res 91) x 101 res 91) I13 : sequence of interpolants for π q13 nested interpolant automaton
31 Constructing a proof of correctness CEGAR recursive program P start with A such that L(A) L(A Σ ) return refined abstraction A := A A I where A I is a nested interpolant automaton such that π L(A I ) no L(A) L(A P ) =? π L(A Σ )? no yes return nested error trace π such that π L(A) L(A P ) yes P is correct P is incorrect
32 Conclusion Interpolant-based software model checking for recursive programs avoid construction of an abstract program Hoare logic nested words
Refinement of Trace Abstraction
Refinement of Trace Abstraction Matthias Heizmann, Jochen Hoenicke, and Andreas Podelski University of Freiburg, Germany Abstract. We present a new counterexample-guided abstraction refinement scheme.
More informationNested Interpolants. Matthias Heizmann Jochen Hoenicke Andreas Podelski. Abstract. 1. Introduction. University of Freiburg, Germany
c ACM 2010. This is the author s version of the work. t is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in Principles of Programming
More informationNon-Monotonic Refinement of Control Abstraction for Concurrent Programs
Non-Monotonic Refinement of Control Abstraction for Concurrent Programs Ashutosh Gupta, Corneliu Popeea, and Andrey Rybalchenko Technische Universität München Abstract. Verification based on abstraction
More informationTemporal Reasoning for Procedural Programs
Temporal Reasoning for Procedural Programs Rajeev Alur 1 and Swarat Chaudhuri 2 1 University of Pennsylvania, USA 2 Pennsylvania State University, USA Abstract. While temporal verification of programs
More informationModel Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies
Model Checking, Theorem Proving, and Abstract Interpretation: The Convergence of Formal Verification Technologies Tom Henzinger EPFL Three Verification Communities Model checking: -automatic, but inefficient
More informationA Termination Checker for Isabelle Hoare Logic
A Termination Checker for Isabelle Hoare Logic Jia Meng 1, Lawrence C. Paulson 2, and Gerwin Klein 3 1 National ICT Australia jia.meng@nicta.com.au 2 Computer Laboratory, University of Cambridge lp15@cam.ac.uk
More informationComplexity and algorithms for monomial and clausal predicate abstraction
Complexity and algorithms for monomial and clausal predicate abstraction Shuvendu K. Lahiri and Shaz Qadeer Microsoft Research Abstract. In this paper, we investigate the asymptotic complexity of various
More informationDouble Header. Model Checking. Model Checking. Overarching Plan. Take-Home Message. Spoiler Space. Topic: (Generic) Model Checking
Double Header Model Checking #1 Two Lectures Model Checking SoftwareModel Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation
More informationarxiv: v1 [cs.lo] 29 May 2014
Under consideration for publication in Theory and Practice of Logic Programming 1 arxiv:1405.7739v1 [cs.lo] 29 May 2014 (Quantified) Horn Constraint Solving for Program Verification and Synthesis Andrey
More informationSimplifying Loop Invariant Generation Using Splitter Predicates
Simplifying Loop Invariant Generation Using Splitter Predicates Rahul Sharma, Isil Dillig, Thomas Dillig, and Alex Aiken Department of Computer Science Stanford University {sharmar,isil,tdillig,aiken}@cs.stanford.edu
More informationSimplifying Loop Invariant Generation Using Splitter Predicates
Simplifying Loop Invariant Generation Using Splitter Predicates Rahul Sharma, Isil Dillig, Thomas Dillig, and Alex Aiken Department of Computer Science Stanford University {sharmar,isil,tdillig,aiken}@cs.stanford.edu
More informationApplications of Craig Interpolants in Model Checking
Applications of Craig Interpolants in Model Checking K. L. McMillan Cadence Berkeley Labs Abstract. A Craig interpolant for a mutually inconsistent pair of formulas (A, B) is a formula that is (1) implied
More informationTransition Predicate Abstraction and Fair Termination
Transition Predicate Abstraction and Fair Termination Andreas Podelski Andrey Rybalchenko Max-Planck-Institut für Informatik Saarbrücken, Germany ABSTRACT Predicate abstraction is the basis of many program
More informationVerification of Recursive Programs. Andreas Podelski February 8, 2012
Verification of Recursive Programs Andreas Podelski February 8, 2012 1 m(x) = x 10 if x > 100 m(m(x + 11)) if x 100 2 procedure m(x) returns (res) `0: if x>100 `1: res:=x-10 else `2: x m := x+11 `3: res
More informationIC3 and Beyond: Incremental, Inductive Verification
IC3 and Beyond: Incremental, Inductive Verification Aaron R. Bradley ECEE, CU Boulder & Summit Middle School IC3 and Beyond: Incremental, Inductive Verification 1/62 Induction Foundation of verification
More informationInterpolant-based Transition Relation Approximation
Interpolant-based Transition Relation Approximation Ranjit Jhala and K. L. McMillan 1 University of California, San Diego 2 Cadence Berkeley Labs Abstract. In predicate abstraction, exact image computation
More informationInterpolation and Symbol Elimination in Vampire
Interpolation and Symbol Elimination in Vampire Kryštof Hoder 1, Laura Kovács 2, and Andrei Voronkov 1 1 University of Manchester 2 TU Vienna Abstract. It has recently been shown that proofs in which some
More informationVinter: A Vampire-Based Tool for Interpolation
Vinter: A Vampire-Based Tool for Interpolation Kryštof Hoder 1, Andreas Holzer 2, Laura Kovács 2, and Andrei Voronkov 1 1 University of Manchester 2 TU Vienna Abstract. This paper describes the Vinter
More informationAlgorithmic Analysis of Array-Accessing Programs
Algorithmic Analysis of Array-Accessing Programs Rajeev Alur Pavol Černý Scott Weinstein University of Pennsylvania {alur,cernyp,weinstein}@cis.upenn.edu Abstract For programs whose data variables range
More informationFloyd-Hoare Style Program Verification
Floyd-Hoare Style Program Verification Deepak D Souza Department of Computer Science and Automation Indian Institute of Science, Bangalore. 9 Feb 2017 Outline of this talk 1 Overview 2 Hoare Triples 3
More informationThe Software Model Checker BLAST
The Software Model Checker BLAST http://mtc.epfl.ch/software-tools/blast/ BLAST 2.0 Team: Dirk Beyer, Tom Henzinger, Ranjit Jhala, and Rupak Majumdar Guest Lecture in Viktor Kuncak s Verification Class,
More informationSAT-Based Verification with IC3: Foundations and Demands
SAT-Based Verification with IC3: Foundations and Demands Aaron R. Bradley ECEE, CU Boulder & Summit Middle School SAT-Based Verification with IC3:Foundations and Demands 1/55 Induction Foundation of verification
More informationConstraint Solving for Program Verification: Theory and Practice by Example
Constraint Solving for Program Verification: Theory and Practice by Example Andrey Rybalchenko Technische Universität München Abstract. Program verification relies on the construction of auxiliary assertions
More informationAutomata-Theoretic Model Checking of Reactive Systems
Automata-Theoretic Model Checking of Reactive Systems Radu Iosif Verimag/CNRS (Grenoble, France) Thanks to Tom Henzinger (IST, Austria), Barbara Jobstmann (CNRS, Grenoble) and Doron Peled (Bar-Ilan University,
More informationLecture 17: Software Engineering Research
Softwaretechnik / Software-Engineering Lecture 17: Software Engineering Research 2015-07-16 17 2015-07-16 main Prof. Dr. Andreas Podelski, Dr. Bernd Westphal Albert-Ludwigs-Universität Freiburg, Germany
More informationModel Checking: An Introduction
Model Checking: An Introduction Meeting 3, CSCI 5535, Spring 2013 Announcements Homework 0 ( Preliminaries ) out, due Friday Saturday This Week Dive into research motivating CSCI 5535 Next Week Begin foundations
More informationConstraint Solving for Program Verification: Theory and Practice by Example
Constraint Solving for Program Verification: Theory and Practice by Example Andrey Rybalchenko Technische Universität München Abstract. Program verification relies on the construction of auxiliary assertions
More informationInterpolation. Seminar Slides. Betim Musa. 27 th June Albert-Ludwigs-Universität Freiburg
Interpolation Seminar Slides Albert-Ludwigs-Universität Freiburg Betim Musa 27 th June 2015 Motivation program add(int a, int b) { var x,i : int; l 0 assume(b 0); l 1 x := a; l 2 i := 0; while(i < b) {
More informationA Practical and Complete Approach to Predicate Refinement
A Practical and Complete Approach to Predicate Refinement Ranjit Jhala and K.L. McMillan 1 University of California, San Diego 2 Cadence Berkeley Labs Abstract. Predicate abstraction is a method of synthesizing
More informationEFFICIENT PREDICATE ABSTRACTION OF PROGRAM SUMMARIES
EFFICIENT PREDICATE ABSTRACTION OF PROGRAM SUMMARIES Arie Gurfinkel, Sagar Chaki and Samir Sapra Carnegie Mellon Uni In NFM11 Presented by Nimrod Partush OUTLINE Introduction Predicate Abstraction CEGAR
More informationComputer-Aided Program Design
Computer-Aided Program Design Spring 2015, Rice University Unit 3 Swarat Chaudhuri February 5, 2015 Temporal logic Propositional logic is a good language for describing properties of program states. However,
More informationUnderstanding IC3. Aaron R. Bradley. ECEE, CU Boulder & Summit Middle School. Understanding IC3 1/55
Understanding IC3 Aaron R. Bradley ECEE, CU Boulder & Summit Middle School Understanding IC3 1/55 Further Reading This presentation is based on Bradley, A. R. Understanding IC3. In SAT, June 2012. http://theory.stanford.edu/~arbrad
More informationSoftware Verification using Predicate Abstraction and Iterative Refinement: Part 1
using Predicate Abstraction and Iterative Refinement: Part 1 15-414 Bug Catching: Automated Program Verification and Testing Sagar Chaki November 28, 2011 Outline Overview of Model Checking Creating Models
More informationBeyond Quantifier-Free Interpolation in Extensions of Presburger Arithmetic
Beyond Quantifier-Free Interpolation in Extensions of Presburger Arithmetic Angelo Brillout, 1 Daniel Kroening, 2 Philipp Rümmer, 3 Thomas Wahl 2 1 ETH Zurich 2 Oxford University 3 Uppsala University Deduction
More informationAbstractions and Decision Procedures for Effective Software Model Checking
Abstractions and Decision Procedures for Effective Software Model Checking Prof. Natasha Sharygina The University of Lugano, Carnegie Mellon University Microsoft Summer School, Moscow, July 2011 Lecture
More informationCompositional Safety Verification with Max-SMT
Compositional Safety Verification with Max-SMT Marc Brockschmidt, Daniel Larraz, Albert Oliveras, Enric Rodríguez-Carbonell and Albert Rubio Microsoft Research, Cambridge Universitat Politècnica de Catalunya
More informationRelative Completeness of Abstraction Refinement for Software Model Checking
Relative Completeness of Abstraction Refinement for Software Model Checking Thomas Ball 1, Andreas Podelski 2, and Sriram K. Rajamani 1 1 Microsoft Research 2 Max-Planck-Institut für Informatik Abstract.
More informationAn Interpolating Theorem Prover
An Interpolating Theorem Prover K.L. McMillan Cadence Berkeley Labs Abstract. We present a method of deriving Craig interpolants from proofs in the quantifier-free theory of linear inequality and uninterpreted
More informationInformation Flow Analysis via Path Condition Refinement
Information Flow Analysis via Path Condition Refinement Mana Taghdiri, Gregor Snelting, Carsten Sinz Karlsruhe Institute of Technology, Germany FAST September 16, 2010 KIT University of the State of Baden-Wuerttemberg
More informationReducing Concurrent Analysis Under a Context Bound to Sequential Analysis
Reducing Concurrent Analysis Under a Context Bound to Sequential Analysis Akash Lal and Thomas Reps University of Wisconsin; Madison, WI; USA. {akash, reps}@cs.wisc.edu Abstract. This paper addresses the
More informationPredicate Abstraction: A Tutorial
Predicate Abstraction: A Tutorial Predicate Abstraction Daniel Kroening May 28 2012 Outline Introduction Existential Abstraction Predicate Abstraction for Software Counterexample-Guided Abstraction Refinement
More informationSymbolic Computation and Theorem Proving in Program Analysis
Symbolic Computation and Theorem Proving in Program Analysis Laura Kovács Chalmers Outline Part 1: Weakest Precondition for Program Analysis and Verification Part 2: Polynomial Invariant Generation (TACAS
More informationDeductive Verification
Deductive Verification Mooly Sagiv Slides from Zvonimir Rakamaric First-Order Logic A formal notation for mathematics, with expressions involving Propositional symbols Predicates Functions and constant
More informationNon-linear Interpolant Generation and Its Application to Program Verification
Non-linear Interpolant Generation and Its Application to Program Verification Naijun Zhan State Key Laboratory of Computer Science, Institute of Software, CAS Joint work with Liyun Dai, Ting Gan, Bow-Yaw
More informationLinear Arithmetic with Stars
Linear Arithmetic with Stars Ruzica Piskac and Viktor Kuncak School of Computer and Communication Sciences, EPFL, Switzerland Abstract. We consider an extension of integer linear arithmetic with a star
More informationTransition Predicate Abstraction and Fair Termination
Transition Predicate Abstraction and Fair Termination ANDREAS PODELSKI Max-Planck-Institut für Informatik, Saarbrücken and ANDREY RYBALCHENKO Ecole Polytechnique Fédérale de Lausanne Max-Planck-Institut
More informationAutomatic Verification of Parameterized Data Structures
Automatic Verification of Parameterized Data Structures Jyotirmoy V. Deshmukh, E. Allen Emerson and Prateek Gupta The University of Texas at Austin The University of Texas at Austin 1 Outline Motivation
More informationInductive Data Flow Graphs
Inductive Data Flow Graphs Azadeh Farzan University of Toronto Zachary Kincaid Andreas Podelski University of Freiburg Abstract The correctness of a sequential program can be shown by the annotation of
More informationHorn Clauses and Beyond for Relational and Temporal Program Verification
First-Order Fixpoint Constraints Horn Clauses and Beyond for Relational and Temporal Program Verification Hiroshi Unno (University of Tsukuba, Japan) part of this is joint work with Tachio Terauchi, Eric
More informationPredicate Abstraction via Symbolic Decision Procedures
Predicate Abstraction via Symbolic Decision Procedures Shuvendu K. Lahiri Thomas Ball Byron Cook May 26, 2005 Technical Report MSR-TR-2005-53 Microsoft Research Microsoft Corporation One Microsoft Way
More informationProving Safety with Trace Automata and Bounded Model Checking
Proving Safety with Trace Automata and Bounded Model Checking Daniel Kroening 1, Matt Lewis 1, and Georg Weissenbacher 2 1 University of Oxford 2 Vienna University of Technology Abstract. Loop under-approximation
More informationAutomata-based Verification - III
COMP30172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20: email: howard.barringer@manchester.ac.uk March 2009 Third Topic Infinite Word Automata Motivation Büchi Automata
More informationFormal Verification Techniques. Riccardo Sisto, Politecnico di Torino
Formal Verification Techniques Riccardo Sisto, Politecnico di Torino State exploration State Exploration and Theorem Proving Exhaustive exploration => result is certain (correctness or noncorrectness proof)
More informationAnalyzing Asynchronous Programs with Preemption
Foundations of Software Technology and Theoretical Computer Science (Bangalore) 2008. Editors: R. Hariharan, M. Mukund, V. Vinay; pp 37-48 Analyzing Asynchronous Programs with Preemption Mohamed Faouzi
More informationHoare Logic I. Introduction to Deductive Program Verification. Simple Imperative Programming Language. Hoare Logic. Meaning of Hoare Triples
Hoare Logic I Introduction to Deductive Program Verification Işıl Dillig Program Spec Deductive verifier FOL formula Theorem prover valid contingent Example specs: safety (no crashes), absence of arithmetic
More informationMulti-Pushdown Systems with Budgets
Multi-Pushdown Systems with Budgets Parosh Aziz Abdulla, Mohamed Faouzi Atig, Othmane Rezine, and Jari Stenman Uppsala University, Sweden Abstract. We address the verification problem for concurrent programs
More informationThe Impact of Craig s Interpolation Theorem. in Computer Science
The Impact of Craig s Interpolation Theorem in Computer Science Cesare Tinelli tinelli@cs.uiowa.edu The University of Iowa Berkeley, May 2007 p.1/28 The Role of Logic in Computer Science Mathematical logic
More informationIC3 Software Model Checking on Control Flow Automata
IC3 Software Model Checking on Control Flow Automata Tim Lange RWTH Aachen University, Germany tim.lange@cs.rwth-aachen.de Martin R. Neuhäußer Siemens AG, Germany martin.neuhaeusser@siemens.com Thomas
More informationThe TLA + proof system
The TLA + proof system Stephan Merz Kaustuv Chaudhuri, Damien Doligez, Leslie Lamport INRIA Nancy & INRIA-MSR Joint Centre, France Amir Pnueli Memorial Symposium New York University, May 8, 2010 Stephan
More informationOn Linear Arithmetic with Stars
On Linear Arithmetic with Stars Ruzica Piskac and Viktor Kuncak LARA - I&C - EPFL Abstract. We consider an extension of integer linear arithmetic with a star operator that takes closure under vector addition
More informationSpring 2014 Program Analysis and Verification. Lecture 6: Axiomatic Semantics III. Roman Manevich Ben-Gurion University
Spring 2014 Program Analysis and Verification Lecture 6: Axiomatic Semantics III Roman Manevich Ben-Gurion University Syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis Techniques
More informationProofs That Count. Andreas Podelski. Abstract. 1. Introduction. University of Toronto. University of Freiburg
Proofs That Count Azadeh Farzan University of Toronto Zachary Kincaid Andreas Podelski University of Freiburg Abstract Counting arguments are among the most basic proof methods in mathematics. Within the
More informationSpring 2015 Program Analysis and Verification. Lecture 6: Axiomatic Semantics III. Roman Manevich Ben-Gurion University
Spring 2015 Program Analysis and Verification Lecture 6: Axiomatic Semantics III Roman Manevich Ben-Gurion University Tentative syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis
More informationSoftware Verification
Software Verification Grégoire Sutre LaBRI, University of Bordeaux, CNRS, France Summer School on Verification Technology, Systems & Applications September 2008 Grégoire Sutre Software Verification VTSA
More informationExplain: A Tool for Performing Abductive Inference
Explain: A Tool for Performing Abductive Inference Isil Dillig and Thomas Dillig {idillig, tdillig}@cs.wm.edu Computer Science Department, College of William & Mary Abstract. This paper describes a tool
More informationCompositional May-Must Program Analysis: Unleashing the Power of Alternation
Compositional May-Must Program Analysis: Unleashing the Power of Alternation Patrice Godefroid Microsoft Research Redmond pg@microsoft.com Aditya V. Nori Microsoft Research India adityan@microsoft.com
More informationInterpolants from Z3 proofs
1 Interpolants from Z3 proofs Kenneth L. McMillan Microsoft Research Abstract Interpolating provers have a number of applications in formal verification, including abstraction refinement and invariant
More informationReasoning about Threads with Bounded Lock Chains
Reasoning about Threads with Bounded Lock Chains Vineet Kahlon, NEC Laboratories America, USA Abstract. The problem of model checking threads interacting purely via the standard synchronization primitives
More informationSoftware Verification with Abstraction-Based Methods
Software Verification with Abstraction-Based Methods Ákos Hajdu PhD student Department of Measurement and Information Systems, Budapest University of Technology and Economics MTA-BME Lendület Cyber-Physical
More informationAutomata-based Verification - III
CS3172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20/22: email: howard.barringer@manchester.ac.uk March 2005 Third Topic Infinite Word Automata Motivation Büchi Automata
More informationFMCAD 2013 Parameter Synthesis with IC3
FMCAD 2013 Parameter Synthesis with IC3 A. Cimatti, A. Griggio, S. Mover, S. Tonetta FBK, Trento, Italy Motivations and Contributions Parametric descriptions of systems arise in many domains E.g. software,
More informationSolving Constrained Horn Clauses using Interpolation
Solving Constrained Horn Clauses using Interpolation MSR-TR-2013-6 Kenneth L. McMillan Micrsoft Research Andrey Rybalchenko Technische Universität München Abstract We present an interpolation-based method
More informationLogical Abduction and its Applications in Program Verification. Isil Dillig MSR Cambridge
Logical Abduction and its Applications in Program Verification? Isil Dillig MSR Cambridge What is Abduction? Abduction: Opposite of deduction 2 / 21 What is Abduction? Abduction: Opposite of deduction
More informationRanking Abstraction as Companion to Predicate Abstraction
Ranking Abstraction as Companion to Predicate Abstraction Ittai Balaban 1, Amir Pnueli 1,2, and Lenore D. Zuck 3 1 New York University, New York {balaban, amir}@cs.nyu.edu 2 Weizmann Institute of Science
More informationSpring 2015 Program Analysis and Verification. Lecture 4: Axiomatic Semantics I. Roman Manevich Ben-Gurion University
Spring 2015 Program Analysis and Verification Lecture 4: Axiomatic Semantics I Roman Manevich Ben-Gurion University Agenda Basic concepts of correctness Axiomatic semantics (pages 175-183) Hoare Logic
More informationLemma Localization: A Practical Method for Downsizing SMT-Interpolants
Lemma Localization: A Practical Method for Downsizing SMT-Interpolants Florian Pigorsch, and Christoph Scholl University of Freiburg, Department of Computer Science, 7911 Freiburg im Breisgau, Germany
More informationRefining Interface Alphabets for Compositional Verification
Refining Interface Alphabets for Compositional Verification Mihaela Gheorghiu 1, Dimitra Giannakopoulou 2, and Corina S. Păsăreanu 2 1 Department of Computer Science, University of Toronto, Toronto, ON
More informationLearning Universally Quantified Invariants of Linear Data Structures
Learning Universally Quantified Invariants of Linear Data Structures Pranav Garg 1, Christof Löding 2, P. Madhusudan 1, and Daniel Neider 2 1 University of Illinois at Urbana-Champaign 2 RWTH Aachen University
More informationGeneralized Property Directed Reachability
Generalized Property Directed Reachability Kryštof Hoder (1) and Nikolaj Bjørner (2) (1) The University of Manchester (2) Microsoft Research, Redmond Abstract. The IC3 algorithm was recently introduced
More informationParameterised Pushdown Systems with Non-Atomic Writes
Parameterised Pushdown Systems with Non-Atomic Writes Matthew Hague Oxford University, Department of Computer Science, and Laboratoire d Informatique Gaspard-Monge, Université Paris-Est Abstract We consider
More informationarxiv:cs.se/ v1 8 Feb 2005
Testing Systems of Concurrent Black-boxes an Automata-Theoretic and Decompositional Approach Gaoyan Xie and Zhe Dang arxiv:cs.se/0502040 v1 8 Feb 2005 School of Electrical Engineering and Computer Science
More informationSpring 2016 Program Analysis and Verification. Lecture 3: Axiomatic Semantics I. Roman Manevich Ben-Gurion University
Spring 2016 Program Analysis and Verification Lecture 3: Axiomatic Semantics I Roman Manevich Ben-Gurion University Warm-up exercises 1. Define program state: 2. Define structural semantics configurations:
More informationA Short Introduction to Hoare Logic
A Short Introduction to Hoare Logic Supratik Chakraborty I.I.T. Bombay June 23, 2008 Supratik Chakraborty (I.I.T. Bombay) A Short Introduction to Hoare Logic June 23, 2008 1 / 34 Motivation Assertion checking
More informationMay/Must Abstraction-Based Software Model Checking For Sound Verification and Falsification
May/Must Abstraction-Based Software Model Checking For Sound Verification and Falsification Patrice GODEFROID Microsoft Research Abstract. Three-valued models, in which properties of a system are either
More informationAutomatic Generation of Polynomial Invariants for System Verification
Automatic Generation of Polynomial Invariants for System Verification Enric Rodríguez-Carbonell Technical University of Catalonia Talk at EPFL Nov. 2006 p.1/60 Plan of the Talk Introduction Need for program
More informationProgram verification. 18 October 2017
Program verification 18 October 2017 Example revisited // assume(n>2); void partition(int a[], int n) { int pivot = a[0]; int lo = 1, hi = n-1; while (lo
More informationEfficient Craig Interpolation for Linear Diophantine (Dis)Equations and Linear Modular Equations
Efficient Craig Interpolation for Linear Diophantine (Dis)Equations and Linear Modular Equations Himanshu Jain 1, Edmund Clarke 1, and Orna Grumberg 2 1 School of Computer Science, Carnegie Mellon University
More informationFormal Methods for Java
Formal Methods for Java Lecture 20: Sequent Calculus Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg January 15, 2013 Jochen Hoenicke (Software Engineering) Formal Methods for Java
More informationDetecting Spurious Counterexamples Efficiently in Abstract Model Checking
Detecting Spurious Counterexamples Efficiently in Abstract Model Checking Cong Tian and Zhenhua Duan ICTT and ISN Laboratory, Xidian University, Xi an, 710071, P.R. China {ctian, zhhduan}@mail.xidian.edu.cn
More informationTeaching vs. Learning, and Course Wrap-Up
Teaching vs. Learning, and Course Wrap-Up Sanjit A. Seshia EECS 219C EECS Department UC Berkeley Teaching vs. Learning Learning: Examples Concept Teaching: Concept Examples Given a concept, give a good
More informationCS 267: Automated Verification. Lecture 1: Brief Introduction. Transition Systems. Temporal Logic LTL. Instructor: Tevfik Bultan
CS 267: Automated Verification Lecture 1: Brief Introduction. Transition Systems. Temporal Logic LTL. Instructor: Tevfik Bultan What do these people have in common? 2013 Leslie Lamport 2007 Clarke, Edmund
More informationPLEASE DO NOT REMOVE THIS PAGE
Thank you for downloading this document from the RMIT ResearchR Repository Citation: Liu, H, Wang, D, Huimin, L and Chen, T 2009, 'On the integration of metamorphic testing and model checking', in Hans
More informationFormal Methods for Java
Formal Methods for Java Lecture 12: Soundness of Sequent Calculus Jochen Hoenicke Software Engineering Albert-Ludwigs-University Freiburg June 12, 2017 Jochen Hoenicke (Software Engineering) Formal Methods
More informationREPORTS of SFB/TR 14 AVACS
AVACS Automatic Verification and Analysis of Complex Systems REPORTS of SFB/TR 14 AVACS Editors: Board of SFB/TR 14 AVACS On Probabilistic CEGAR by Holger Hermanns, Björn Wachter, Lijun Zhang AVACS Technical
More informationExploring Interpolants
Exploring Interpolants Philipp Rümmer, Pavle Subotić Department of Information Technology, Uppsala University, Sweden Abstract Craig Interpolation is a standard method to construct and refine abstractions
More informationJoin Algorithms for the Theory of Uninterpreted Functions
Join Algorithms for the Theory of Uninterpreted Functions Sumit Gulwani 1, Ashish Tiwari 2, and George C. Necula 1 1 University of California, Berkeley, CA 94720, {gulwani,necula}@cs.berkeley.edu 2 SRI
More informationCombining Relational Learning with SMT Solvers using CEGAR
Combining Relational Learning with SMT Solvers using CEGAR Arun Chaganty 1, Akash Lal 2, Aditya V. Nori 2, and Sriram K. Rajamani 2 1 Stanford / chaganty@stanford.com 2 Microsoft Research, India / {akashl,
More informationReasoning About Imperative Programs. COS 441 Slides 10b
Reasoning About Imperative Programs COS 441 Slides 10b Last time Hoare Logic: { P } C { Q } Agenda If P is true in the initial state s. And C in state s evaluates to s. Then Q must be true in s. Program
More informationProofs of Correctness: Introduction to Axiomatic Verification
Proofs of Correctness: Introduction to Axiomatic Verification Introduction Weak correctness predicate Assignment statements Sequencing Selection statements Iteration 1 Introduction What is Axiomatic Verification?
More information