Automatically Refining Partial Specifications for Program Verification

Abstract

When citing this source, please use the final published version as above.This document was downloaded from http://tees.openrepository.com/tees/handle/10149/141501 Please do not use this version for citation purposes.All items in TeesRep are protected by copyright, with all rights reserved, unless otherwise indicated. Abstract. Automatically verifying heap-manipulating programs is a challenging task, especially when dealing with complex data structures with strong invariants, such as sorted lists and AVL/red-black trees. The verification process can greatly benefit from human assistance through specification annotations, but this process requires intellectual effort from users and is error-prone. In this paper, we propose a new approach to program verification that allows users to provide only partial specification to methods. Our approach will then refine the given annotation into a more complete specification by discovering missing constraints. The discovered constraints may involve both numerical and multi-set properties that could be later confirmed or revised by users. We further augment our approach by requiring only partial specification to be given for primary methods. Specifications for loops and auxiliary methods can then be systematically discovered by our augmented mechanism, with the help of information propagated from the primary methods. Our work is aimed at verifying beyond shape properties, with the eventual goal of analysing full functional properties for pointer-based data structures. Initial experiments have confirmed that we can automatically refine partial specifications with non-trivial constraints, thus making it easier for users to handle specifications with richer properties.

Automated verification of the FreeRTOS scheduler in Hip/Sleek

“…Another direction that we want to pursuit is related with inference and scalability. Although the specifications written so far have been supplied by us, recent developments [25,26,28,27] in Hip/Sleek will allow the automatic inference of properties, making our approach more scalable.…”

Automated Specification Discovery via User-Defined Predicates

“…Our earlier work [20] gives a restricted form of abduction focusing on discovering pure information with the assumption that either complete or partial shape information is available. Our bi-abduction algorithm presented here generalises it to cater for full specification discovery scenarios, whereby, we do not have the hints to guide the analysis anymore due to the absence of shape information in pre/post-conditions; but at the same time we can have more freedom as to what missing information to discover.…”

“…Compared with these works, our approach can discover specifications with stronger invariants such as sortedness and bag-related properties, which have not been addressed in the previous works. The analyses [6,19,20] can all handle shape and numerical information over a combined domain, but require user given preconditions for the program whereas here we compute the whole specification at once. Recently, Rival and Chang [23] propose an inductive predicate to summarise call stacks along with heap structures in a context of a whole-program analysis.…”

Automated specification inference in a combined domain via user-defined predicates

“…However, these previous analyses mainly deal with predesignated data structure properties with fixed numerical templates, such as pointer safety for lists and list length information. To analyse a wider range of properties of heap-manipulating programs with flexibility, our previous work [34] offers a template-based approach, whereby users supply shape templates in pre-/post-conditions of procedures, and then the analysis infers the missing pure information to complete the given templates. While that approach simplifies fix-point computation to a single domain, one serious limitation is that it relies on users to supply the pre-/post-shape templates.…”