Abstract Regular Tree Model Checking of Complex Dynamic Data Structures

Abstract

Abstract. We consider the verification of non-recursive C programs manipulating dynamic linked data structures with possibly several next pointer selectors and with finite domain non-pointer data. We aim at checking basic memory consistency properties (no null pointer assignments, etc.) and shape invariants whose violation can be expressed in an existential fragment of a first order logic over graphs. We formalise this fragment as a logic for specifying bad memory patterns whose formulae may be translated to testers written in C that can be attached to the program, thus reducing the verification problem considered to checking reachability of an error control line. We encode configurations of programs, which are essentially shape graphs, in an original way as extended tree automata and we represent program statements by tree transducers. Then, we use the abstract regular tree model checking framework for a fully automated verification. The method has been implemented and successfully applied on several case studies.

Towards Model-Checking Programs with Lists

“…For instance, in [9], the authors verify safety properties on programs manipulating singly-linked lists using abstract regular model-checking. They have extended their work to programs with more complex data structures [10]. In [8], the authors also propose a translation towards counter systems very similar to the one of [5].…”

An Efficient Decision Procedure for Imperative Tree Data Structures

“…However, this work does not state the complexity of the reasoning task and the presented automata constructions appear to require running time beyond NP. Regular tree model checking with abstraction has yielded excellent results so far [3] and continues to improve, but has so far not resulted in a logic whose complexity is in NP, which we believe to be an important milestone.…”

Equational Abstraction Refinement for Certified Tree Regular Model Checking

“…The transition relation of the system is represented by a set of rewriting rules. Contrary to specific approaches that are dedicated to specific applications, TRMC is generic and expressive enough to describe a broad class of communication protocols [5], various C programs [16] with complex data structures, multi-threaded programs [34], cryptographic protocols [26,28,6], and Java [13].…”

“…An obstacle is that this set is in general neither regular nor computable in a finite time. Most existing solutions rely on computing the transitive closure of the transition relation of the systems through heuristic-based semi-algorithms [31,5], or on the computation of some regular abstraction of the set of reachable states [19,16]. While the first approach is precise, it is acknowledged to be ineffective on complex systems.…”

“…The first abstraction-based technique for TRMC, Abstract Tree Regular Model Checking (ATRMC), was proposed by Bouajjani et al [17,15,16]. ATRMC computes sequences of automata by successive applications of the rewriting relation to the automaton representing the initial set of states.…”