Cell Morphing: From Array Programs to Array-Free Horn Clauses

Monniaux, David; Gonnord, Laure

doi:10.1007/978-3-662-53413-7_18

Cited by 40 publications

(64 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The resulting constraints are easier to solve using a back end solver such as Z3 [13]. This technique and its variants appear in [22,23] and in [15], where the term skolem constants is used instead of distinguished cells. We experimented with VAPHOR, a tool based on [23].…”

Section: Related Workmentioning

confidence: 99%

“…This technique and its variants appear in [22,23] and in [15], where the term skolem constants is used instead of distinguished cells. We experimented with VAPHOR, a tool based on [23]. By way of comparison, we present two examples, one with a ∃ property and the other with a ∀ property.…”

Section: Related Workmentioning

confidence: 99%

“…This is, in general, difficult because such programs have huge, at times infinite state space. So while static analysis techniques like array smashing and partitioning [4,5,11,14,16,17] fail due to abstractions that are too coarse, attempts with bounded model checkers or theorem provers that are equipped with array theories [3,8,9,15,18,22,23] tend to fail for lack of scalability or their inability to synthesize the right quantified invariants.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Property Checking Array Programs Using Loop Shrinking

Sanyal

Venkatesh

Shah

2018

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. Most verification tools find it difficult to prove properties of programs containing loops that process arrays of large or unknown size. These methods either fail to abstract the array at the right granularity and are therefore limited in precision or scalability, or they attempt to synthesize an appropriate invariant that is quantified over the elements of the array, a task known to be difficult. In this paper, we present a different approach based on a notion called loop shrinkability, in which an array processing loop is transformed to a loop of much smaller bound that processes only a few non-deterministically chosen elements of the array. The result is a finite state program with a drastically reduced state space that can be analyzed by bounded model checkers. We show that the proposed transformation is an over-approximation, i.e. if the transformed program is correct, so is the original. In addition, when applicable, the method is impervious to the size or existence of the bound of the array. As an assessment of usefulness, we tested a tool based on our method on the ArraysReach category of SV-COMP 2017 benchmarks. After excluding programs with feature not handled by our tool, we could successfully verify 87 of the 93 remaining programs.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Property Checking Array Programs Using Loop Shrinking

Sanyal

Venkatesh

Shah

2018

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…The main method builds up two lists of Node objects (line [16][17][18][19][20][21][22][23] and then increments elements in an array at positions determined by the data in the first list. Our goal is to prove that the array access in line 25 is always within bounds.…”

Section: Verification Examplementioning

confidence: 99%

“…[4], in which a Horn solver is guided by constraining the form of the proof, enabling it to find suitable (quantified) invariants even in challenging cases. A related technique for approximation of array behavior was recently presented in [23]. A number of abstract interpretation methods have domains that represent universally quantified facts [9,13].…”

Section: Related Workmentioning

confidence: 99%

Quantified Heap Invariants for Object-Oriented Programs

Kahsai

Kersten

Rümmer

et al.

EPiC Series in Computing

View full text Add to dashboard Cite

Heap and data structures represent one of the biggest challenges when applying model checking to the analysis of software programs: in order to verify (unbounded) safety of a program, it is typically necessary to formulate quantified inductive invariants that state properties about an unbounded number of heap locations. Methods like Craig interpolation, which are commonly used to infer invariants in model checking, are often ineffective when a heap is involved. To address this challenge, we introduce a set of new proof and program transformation rules for verifying object-oriented programs with the help of space invariants, which (implicitly) give rise to quantified invariants. Leveraging advances in Horn solving, we show how space invariants can be derived fully automatically, and how the framework can be used to effectively verify safety of Java programs.

show abstract

Quantifiers on Demand

Gurfinkel

Shoham

Vizel

2018

Automated Technology for Verification and Analysis

View full text Add to dashboard Cite

Automated program verification is a difficult problem. It is undecidable even for transition systems over Linear Integer Arithmetic (LIA). Extending the transition system with theory of Arrays, further complicates the problem by requiring inference and reasoning with universally quantified formulas. In this paper, we present a new algorithm, QUIC3, that extends IC3 to infer universally quantified invariants over the combined theory of LIA and Arrays. Unlike other approaches that use either IC3 or an SMT solver as a black box, QUIC3 carefully manages quantified generalization (to construct quantified invariants) and quantifier instantiation (to detect convergence in the presence of quantifiers). While QUIC3 is not guaranteed to converge, it is guaranteed to make progress by exploring longer and longer executions. We have implemented QUIC3 within the Constrained Horn Clause solver engine of Z3 and experimented with it by applying QUIC3 to verifying a variety of public benchmarks of array manipulating C programs.

show abstract

Cell Morphing: From Array Programs to Array-Free Horn Clauses

Cited by 40 publications

References 31 publications

Property Checking Array Programs Using Loop Shrinking

Property Checking Array Programs Using Loop Shrinking

Quantified Heap Invariants for Object-Oriented Programs

Quantifiers on Demand

Contact Info

Product

Resources

About