Programs with lists are counter automata

Abstract

We address the problem of verifying programs manipulating one-selector linked data structures. We propose and study in detail an application of counter automata as an accurate abstract model for this problem. We let control states of the counter automata correspond to abstract heap graphs where list segments without sharing are collapsed, and use counters to keep track of the number of elements in these segments. As a significant theoretical result, we show that the obtained counter automata are bisimilar to the original programs. Moreover, from a practical point of view, our translation allows one to apply efficient automatic analysis techniques and tools developed for counter automata (integer programs) in order to verify both safety as well as termination of list-manipulating programs. As another This work is a full and revised version of the extended abstract [10] published in Proceedings of CAV'06. Form Methods Syst Des (2011) 38: 158-192 159 theoretical contribution, we prove that if the control of the generated counter automata does not contain nested loops (i.e., these automata are flat), both safety and termination are decidable for the original programs. Subsequently, we generalise our counter-automata-based model to keep track of ordering properties over lists storing ordered data. Finally, we show effectiveness of our approach by verifying automatically safety as well as termination of several sorting programs.

Abstract acceleration in linear relation analysis

“…Programs with lists [15] proposes a translation of programs manipulating lists to counter automata. This translation is made by making abstraction of lists by some "list segments", all the elements of which having the same behaviour.…”

A Verification Toolkit for Numerical Transition Systems

“…We next give an experimentally compare FLATA and ELDARICA on six sets of examples extracted automatically from different sources: (a) C programs with arrays provided as examples of divergence in predicate abstraction [9], (b) INTS extracted from programs with singly-linked lists by the L2CA tool [1], (c) INTS extracted from VHDL models of circuits following the method of [10], (d) verification conditions for programs with arrays, expressed in the SIL logic of [2] and translated to INTS, (e) C programs provided as benchmarks in the NECLA static analysis suite, and (f) C programs with asynchronous procedure calls translated into INTS using the approach of [5] (the examples with extension .optim are obtained via an optimized translation method). Experiments were ran on an Intel R Core TM 2 Duo @ 2.66GHz with 3GB RAM.…”

“…var i,j : Int l0 : havoc(i ); assume(i >= 0) l1 : havoc(j ); assume(j >= 0) l2 : var x: Int = i ; var y: Int = j l3 : while (x != 0) { l4 : x = x − 1; l5 : [10], programs with singly-linked lists [1], trees [6], and integer arrays [2]. Consider the program in Figure 1(a).…”

Statically Inferring Complex Heap, Array, and Numeric Invariants

“…In [10,3,17], an initial transformation converts pointer-manipulating programs into integer programs to allow integer analysis to check the desired properties. These "reduction-based approaches" uses various integer analyzers on the resulting program.…”

“…These "reduction-based approaches" uses various integer analyzers on the resulting program. For proving simple properties of singly linked lists, it was shown in [3] that there is no loss of precision; however, the approach may lose precision in cases where the heap and integers interact in complicated ways. The main problem with the approach is that the proof of the integer program cannot use any quantification.…”