Counterexample-guided focus

Abstract

The automated inference of quantified invariants is considered one of the next challenges in software verification. The question of the right precision-efficiency tradeoff for the corresponding program analyses here boils down to the question of the right treatment of disjunction below and above the universal quantifier. In the closely related setting of shape analysis one uses the focus operator in order to adapt the treatment of disjunction (and thus the efficiency-precision tradeoff) to the individual program statement. One promising research direction is to design parameterized versions of the focus operator which allow the user to fine-tune the focus operator not only to the individual program statements but also to the specific verification task. We carry this research direction one step further. We fine-tune the focus operator to each individual step of the analysis (for a specific verification task). This fine-tuning must be done automatically. Our idea is to use counterexamples for this purpose. We realize this idea in a tool that automatically infers quantified invariants for the verification of a variety of heap-manipulating programs.

An Efficient Decision Procedure for Imperative Tree Data Structures

“…In addition to Java statements, the example in Fig. 1 contains preconditions and postconditions, written in the notation of the Jahob verification system [12,15,18,19,21].…”

“…Despite the expressive power of the logic, we exhibit a non-deterministic polynomial-time decision procedure for its satisfiability problem, showing that TREX is NP-complete. Our development is directly motivated by our experience with verifying tree data structures in the Jahob verification system [15,19,21] in which we used the MONA decision procedure [11] for MSOL over trees. Although MONA contributed great expressive power to our specification language and, in our experience, works well for programs that manipulate lists, there were many tree-manipulating programs whose verification failed due to MONA running out of resources.…”

A Specialization Calculus for Pruning Disjunctive Predicates to Support Verification

“…The proper treatment of disjunction (to achieve a trade-off between precision and efficiency) is a key concern of existing shape analyses based on separation logic [5,10]. One research direction is to design parameterized heap materialization mechanisms (also known as focus operation) adapted to specific program statements and to specific verification tasks [21,12,20,1,16]. Another direction is to design partially disjunctive abstract domains with join operators that enable the analysis to abstract away information considered to be irrelevant for proving a certain property [7,23,2].…”

Complete instantiation-based interpolation

“…Using our approach we then obtain the first ground interpolation procedure for a theory that supports reasoning about complex shape properties of heapallocated data structures. This interpolation procedure has promising applications in CEGAR-based shape analysis [5,42] and may also provide a new perspective on the construction of shape domains in parametric shape analysis [45].…”