Automated Analysis of Data-Dependent Programs with Dynamic Memory

Abstract

Abstract. We present a new approach for automatic verification of data-dependent programs manipulating dynamic heaps. A heap is encoded by a graph where the nodes represent the cells, and the edges reflect the pointer structure between the cells of the heap. Each cell contains a set of variables which range over the natural numbers. Our method relies on standard backward reachability analysis, where the main idea is to use a simple set of predicates, called signatures, in order to represent bad sets of heaps. Examples of bad heaps are those which contain either garbage, lists which are not well-formed, or lists which are not sorted. We present the results for the case of programs with a single next-selector, and where variables may be compared for (in)equality. This allows us to verify for instance that a program, like bubble sort or insertion sort, returns a list which is well-formed and sorted, or that the merging of two sorted lists is a new sorted list. We report on the result of running a prototype based on the method on a number of programs.

Model Checking of Linearizability of Concurrent List Implementations

“…Our approach is to the best of our knowledge the first sound and complete automated analysis that captures concurrent set implementations. As for the model of the heap, closest to ours is the model of [1], but the work in [1] is on abstraction of sequential heap accessing programs. There is an emerging literature on automata and logics over data words [14,3] and algorithmic analysis of programs accessing data words [2].…”

Monotonic Abstraction Techniques: from Parametric to Software Model Checking

“…Monotonic abstraction is a well-known technique introduced by P. A. Abdulla and collaborators in a series of papers (like for instance [1,3,8,9]); the technique was originally applied in the context of verification of distributed systems, but successively extended also elsewhere (see e.g. [6,7]). The approach has been reformulated in [16,17] within the declarative context of array-based systems [34] in order to apply it to the verification of reliable broadcast algorithms [39] in a fault-tolerant environment.…”

Monotonic Abstraction for Programs with Multiply-Linked Structures

“…As discussed below, various approaches to automated verification of dynamic pointer-linked data structures are currently studied in the literature. One of these approaches is based on using monotonic abstraction and backward reachability [4,2]. This approach has been shown to be very successful in handling systems with complex graph-structured configurations when verifying parameterized systems [3].…”

“…Several different approaches have been proposed for automated verification of programs with dynamic linked data structures. The most-known approaches include works based on monadic second-order logic on graph types [10], 3-valued predicate logic with transitive closure [14], separation logic [12,11,15,6], other kinds of logics [16,9], finite tree automata [5,7], forest automata [8], graph grammars [13], upward-closed sets [4,2], as well as other formalisms.…”

“…This extension has required a new notion of signatures, a new pre-order on them, as well as new operations manipulating them. Not counting [4,2], the other existing works are based on other formalisms than the one used here, and they use a forward reachability computation whereas the present paper uses a backward reachability computation. Apart from that, when comparing the approach followed in this work with the other existing approaches, one of the most attractive features of our method is its simplicity.…”