Putting static analysis to work for verification

Lev-AmiTal,; RepsThomas,; SagivMooly,; WilhelmReinhard,

doi:10.1145/347636.348031

Cited by 16 publications

(20 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Notice that for this i i !~i i ĩi i ĩ!i ( iii ill i~i ~ii bug, the approach in [23] would not find the bug for heap bounds of less than four records. The experiments show that our approach does work in practice for non-trivial data structures, and with time and space requirements which are as good as or better than those fbr the previous more specialized versions [24,14] and related approaches with similar goals [31,23,13,17]. …”

Section: Implementation and Evaluationmentioning

confidence: 84%

“…The goals of the shape analyzer TVLA [32,38,31] are closest to ours but its approach is radically different. Rather than encoding programs in logic, TVLA performs fixpoint iterations on abstract descriptions of the store.…”

Section: Related Workmentioning

confidence: 99%

“…In [38,31], abstractions of the data contained in the heap records can be tracked by specifying suitable instrumentation predicates. As an example, a predicate dle(x, y) is used to represent "the data in x is less than or equal to the data in y'.…”

Section: Data Abstractionsmentioning

confidence: 99%

“…We also inelude the concat operation on lists with tail pointers from Section 1. We have tried bubblesort as in [31] but with various degrees of abstraction of the data: In bubblesort_simple, the record values are abstracted away so only null pointer dereferenees are checked for; in bubblesort_boolean, the values are abstracted to booleans which in the post-condition are checked to be properly sorted; and in bubblesort_full, the data abstraction technique from Section 6 is used as in [31] to conclude that the resulting lists are sorted. We also use data abstractions in orderedreverse to show that reverse switches the order of a sorted list.…”

Section: Implementation and Evaluationmentioning

confidence: 99%

“…The verification time seems insignificant compared to the time required to design a given data type and specify the invariants, however, it is useful in the design cycle that verification is efficient. The code for the bubblesort examples (excluding annotations) is taken from [31]. Interestingly, PALE discovered a minor bug (a null-pointer dereference) even though the code had allegedly been verified by TVLA, which spent 245 seconds compared to 4 seconds for PALE.…”

Section: Implementation and Evaluationmentioning

confidence: 99%

See 4 more Smart Citations

The pointer assertion logic engine

Möller

Schwartzbach

2001

Proceedings of the ACM SIGPLAN 2001 Conference on Programming Language Design and Implementation

141

View full text Add to dashboard Cite

We present a new framework for verifying partial specifications of programs in order to catch type and memory errors and check data structure invariants. Our technique can verify a large class of data structures, namely all those that can be expressed as graph types. Earlier versions were restricted to simple special cases such as lists or trees. Even so, our current implementation is as fast as the previous specialized tools.Programs are annotated with partial specifications expressed in Pointer Assertion Logic, a new notation for expressing properties of the program store. We work in the logical tradition by encoding the programs and partial specifications as formulas in monadic second-order logic. Validity of these formulas is checked by the MONA tool, which also can provide explicit counterexamples to invalid formulas.To make verification decidable, the technique requires explicit loop and function call invariants. In return, the technique is highly modular: every statement of a given program is analyzed only once.The main target applications are safety-critical data-type algorithms, where the cost of annotating a program with invariants is justified by the value of being able to automatically verify complex properties of the program.

show abstract

Section: Implementation and Evaluationmentioning

confidence: 84%

Section: Related Workmentioning

confidence: 99%

Section: Data Abstractionsmentioning

confidence: 99%

Section: Implementation and Evaluationmentioning

confidence: 99%

Section: Implementation and Evaluationmentioning

confidence: 99%

See 3 more Smart Citations

The pointer assertion logic engine

Möller

Schwartzbach

2001

Proceedings of the ACM SIGPLAN 2001 Conference on Programming Language Design and Implementation

141

View full text Add to dashboard Cite

show abstract

Abstraction Refinement via Inductive Learning

Loginov¹,

Reps²,

Sagiv

2005

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

We present an approach to automatically creating abstractions for use in program analysis. As in some previous work [12, 4, 13, 18, 5, 2, 8], the approach involves the successive refinement of the abstraction in use. Unlike previous work, the work presented in this paper is aimed at programs that manipulate pointers and heap-allocated data structures. However, while we demonstrate our approach on shape-analysis problems, the approach is applicable in any program-analysis setting that uses first-order logic. The paper presents an abstraction-refinement method for use in static analyses based on 3-valued logic [21], where the semantics of statements and the query of interest are expressed using logical formulas. In this setting, a memory configuration is modeled by a logical structure; an individual of the structure's universe either models a single memory element or, in the case of a summary individual, it models a collection of memory elements. Summary individuals are used to ensure that abstract descriptors have an a priori bounded size, which guarantees that a fixed-point is always reached. However, the constraint of working with limited-size descriptors implies a loss of information about the store. Intuitively, certain properties of concrete individuals are lost due to abstraction, which groups together multiple individuals into summary individuals: a property can be true for some concrete individuals of the group, but false for other individuals. The TVLA system is a tool for creating such analyses [1]. With the method proposed in this paper, refinement is performed by introducing new instrumentation relations (defined via logical formulas over core relations, which capture the basic properties of memory configurations). Instrumentation relations record auxiliary information in a logical structure, thus providing a mechanism to fine-tune an abstraction: an instrumentation relation captures a property that an individual memory cell may or may not possess. In general, the introduction of additional instrumentation relations refines an abstraction into one that is prepared to track finer distinctions among stores. The choice of instrumentation relations is crucial to the precision, as well as the cost, of the analysis. Until now, TVLA users have been faced with the task of identifying an instrumentation-relation set that gives them a definite answer to the query, but does not make the cost prohibitive. This was arguably the key remaining challenge in the TVLA user-model. The contributions of this work can be summarized as follows:

show abstract

Simulating Reachability Using First-Order Logic with Applications to Verification of Linked Data Structures

Lev-Ami¹,

Immerman²,

Reps³

et al. 2005

Automated Deduction – CADE-20

View full text Add to dashboard Cite

This paper shows how to harness existing theorem provers for first-order logic to automatically verify safety properties of imperative programs that perform dynamic storage allocation and destructive updating of pointer-valued structure fields. One of the main obstacles is specifying and proving the (absence) of reachability properties among dynamically allocated cells.The main technical contributions are methods for simulating reachability in a conservative way using first-order formulas-the formulas describe a superset of the set of program states that would be specified if one had a precise way to express reachability. These methods are employed for semiautomatic program verification (i.e., using programmer-supplied loop invariants) on programs such as mark-and-sweep garbage collection and destructive reversal of a singly linked list. (The mark-andsweep example has been previously reported as being beyond the capabilities of ESC/Java.

show abstract

Putting static analysis to work for verification

Cited by 16 publications

References 26 publications

The pointer assertion logic engine

The pointer assertion logic engine

Abstraction Refinement via Inductive Learning

Simulating Reachability Using First-Order Logic with Applications to Verification of Linked Data Structures

Contact Info

Product

Resources

About