Program Analysis as Model Checking of Abstract Interpretations

Schmidt, David A.; Steffen, Bernhard

doi:10.1007/3-540-49727-7_22

Cited by 82 publications

(50 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The idea of using model checking for static program analysis has first been introduced by Steffen and Schmidt [24], discussing how data flow analysis problems can be expressed in modal µ-calculus. This has later been expanded and further developed in [18,8,19].…”

Section: Syntactic Model Checking and Language Refinementmentioning

confidence: 99%

SMT-Based False Positive Elimination in Static Program Analysis

Junker

Huuck

Fehnker

et al. 2012

Formal Methods and Software Engineering

View full text Add to dashboard Cite

Abstract. Static program analysis for bug detection in large C/C++ projects typically uses a high-level abstraction of the original program under investigation. As a result, so-called false positives are often inevitable, i.e., warnings that are not true bugs. In this work we present a novel abstraction refinement approach to automatically investigate and eliminate such false positives. Central to our approach is to view static analysis as a model checking problem, to iteratively compute infeasible sub-paths of infeasible paths using SMT solvers, and refine our models by adding observer automata to exclude such paths. Based on this new framework we present an implementation of the approach into the static analyzer Goanna and discuss a number of real-life experiments on larger C code projects, demonstrating that we were able to remove most false positives automatically.

show abstract

Section: Syntactic Model Checking and Language Refinementmentioning

confidence: 99%

SMT-Based False Positive Elimination in Static Program Analysis

Junker

Huuck

Fehnker

et al. 2012

Formal Methods and Software Engineering

View full text Add to dashboard Cite

show abstract

“…The idea of static analysis by model checking, in [14] also called syntactic model checking, can be traced back to [31]. Instead of checking the property on the state space of the system, this approach works by exploring control flow and function call graphs of the programs.…”

Section: Static Analysis Via Model Checking and Unomentioning

confidence: 99%

“…The idea to perform static analysis via model checking, as we use it in this paper, was considered for the first time in [30,31]. This has been later developed and served as a framework for several tools.…”

Section: Related Workmentioning

confidence: 99%

Behavioural Analysis of an I2C Linux Driver

Bošnački

Mathijssen

Usenko

2009

Formal Methods for Industrial Critical Systems

View full text Add to dashboard Cite

Abstract. We present an analysis of the behaviour of an I 2 C Linux driver, by means of model checking with the mCRL2 toolset and static analysis with UNO. We have reverse engineered the source code to obtain the structure and interactions of the driver. Based on these results, we have semi-automatically created an mCRL2 model of the behaviour of the driver, on which we have checked mutual exclusion properties. This revealed non-trivial potential errors, like unprotected usage of shared memory variables due to inconsistent locking and disabling/enabling of interrupts. We also applied UNO on the instrumented source code and were able to find the same errors. These defects were confirmed by the developers.

show abstract

“…The approach of automaton-based model checking of push-down systems [15,6,7] has contributed algorithms for program analysis that are conceptually simple and powerful. We have developed incremental versions of these algorithms and shown that this approach leads to incremental dataflow algorithms that are simple yet precise and general.…”

Section: Related Work and Conclusionmentioning

confidence: 99%

Incremental Algorithms for Inter-procedural Analysis of Safety Properties

Conway

Namjoshi

Dams

et al. 2005

Computer Aided Verification

View full text Add to dashboard Cite

Abstract. Automaton-based static program analysis has proved to be an effective tool for bug finding. Current tools generally re-analyze a program from scratch in response to a change in the code, which can result in much duplicated effort. We present an inter-procedural algorithm that analyzes incrementally in response to program changes and present experiments for a null-pointer dereference analysis. It shows a substantial speed-up over re-analysis from scratch, with a manageable amount of disk space used to store information between analysis runs.

show abstract

Program Analysis as Model Checking of Abstract Interpretations

Cited by 82 publications

References 25 publications

SMT-Based False Positive Elimination in Static Program Analysis

SMT-Based False Positive Elimination in Static Program Analysis

Behavioural Analysis of an I2C Linux Driver

Incremental Algorithms for Inter-procedural Analysis of Safety Properties

Contact Info

Product

Resources

About