Monotonic Abstraction for Programs with Dynamic Memory Heaps

Abstract

Abstract. We propose a new approach for automatic verification of programs with dynamic heap manipulation. The method is based on symbolic (backward) reachability analysis using upward-closed sets of heaps w.r.t. an appropriate preorder on graphs. These sets are represented by a finite set of minimal graph patterns corresponding to a set of bad configurations. We define an abstract semantics for the programs which is monotonic w.r.t. the preorder. Moreover, we prove that our analysis always terminates by showing that the preorder is a well-quasi ordering. Our results are presented for the case of programs with 1-next selector. We provide experimental results showing the effectiveness of our approach.

Shape Analysis of Low-Level C with Overlapping Structures

“…Approaches based on regular model checking [5], symbolic backwards reachability analysis [1], or decision procedures such as [6] seem not to have dealt with the analysis of low-level system code, much less with overlapping records. There are a number of approaches that make use of numeric reasoning to deal with pointer arithmetic.…”

Monotonic Abstraction for Programs With Multiply-Linked Structures

“…As discussed below, various approaches to automated verification of dynamic pointer-linked data structures are currently studied in the literature. One of these approaches is based on using monotonic abstraction and backward reachability [4,2]. This approach has been shown to be very successful in handling systems with complex graph-structured configurations when verifying parameterized systems [3].…”

“…Several different approaches have been proposed for automated verification of programs with dynamic linked data structures. The most-known approaches include works based on monadic second-order logic on graph types [10], 3-valued predicate logic with transitive closure [14], separation logic [12,11,15,6], other kinds of logics [16,9], finite tree automata [5,7], forest automata [8], graph grammars [13], upward-closed sets [4,2], as well as other formalisms.…”

“…This extension has required a new notion of signatures, a new pre-order on them, as well as new operations manipulating them. Not counting [4,2], the other existing works are based on other formalisms than the one used here, and they use a forward reachability computation whereas the present paper uses a backward reachability computation. Apart from that, when comparing the approach followed in this work with the other existing approaches, one of the most attractive features of our method is its simplicity.…”

Constrained Monotonic Abstraction: A CEGAR for Parameterized Verification

“…Monotonic abstraction has shown to be useful in the verification of heap manipulating programs [1] and parameterized systems such as mutual exclusion and cache coherence protocols [3,5]. In most of the benchmark examples for these classes, monotonic abstraction can generate abstract transition systems that are safe w.r.t to the desired properties (e.g.…”