VCC: A Practical System for Verifying Concurrent C

Cohen, Ernie; Dahlweid, Markus; Hillebrand, Mark; Leinenbach, Dirk; Moskal, Michał; Santen, Thomas; Schulte, Wolfram; Tobies, Stephan

doi:10.1007/978-3-642-03359-9_2

Cited by 413 publications

(279 citation statements)

References 19 publications

Supporting

Mentioning

274

Contrasting

Unclassified

Order By: Relevance

“…1 allows writing state on which θ set depends. 8 So interface specifications need to provide clients with sufficient information to reason about the boundary. For MM , it is not an invariant like R but rather the individual method specifications that facilitate such reasoning (see Sect.…”

Section: Dynamic Boundaries and Second Order Framingmentioning

confidence: 99%

“…The use of ghost state to encode inductive properties without induction has been fruitful in verifications using SMT solvers (e.g., [8,16,40]). Our use of ghost state for frame conditions and separation reasoning was directly inspired by the state-dependent effects of Kassios [18] (who calls them dynamic frames, whence our term "dynamic boundary").…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Dynamic Boundaries: Information Hiding by Second Order Framing with First Order Assertions

Naumann

Banerjee

2010

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract. The hiding of internal invariants creates a mismatch between procedure specifications in an interface and proof obligations on the implementations of those procedures. The mismatch is sound if the invariants depend only on encapsulated state, but encapsulation is problematic in contemporary software due to the many uses of shared mutable objects. The mismatch is formalized here in a proof rule that achieves flexibility via explicit restrictions on client effects, expressed using ghost state and ordinary first order assertions.

show abstract

Section: Dynamic Boundaries and Second Order Framingmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Dynamic Boundaries: Information Hiding by Second Order Framing with First Order Assertions

Naumann

Banerjee

2010

Programming Languages and Systems

View full text Add to dashboard Cite

show abstract

“…We view the scheduler-related functionality of the kernel as an ADT, specify its intended behaviour in Z, and then verify that the implementation refines the high-level ADT. We used four levels of models (two in Z and one in VCC [10]g h o s t code, apart from the C implementation itself), and proved successive refinements between them. Barring a few manual steps, all our refinement conditions were phrased and proved in VCC, using its very useful ghost constructs.…”

Section: Introductionmentioning

confidence: 99%

Refinement-Based Verification of the FreeRTOS Scheduler in VCC

Divakaran

D’Souza

Kushwah

et al. 2015

Formal Methods and Software Engineering

View full text Add to dashboard Cite

Abstract. We describe our experience with verifying the schedulerrelated functionality of FreeRTOS, a popular open-source embedded real-time operating system. We propose a methodology for carrying out refinement-based proofs of functional correctness of abstract data types in the popular code-level verifier VCC. We then apply this methodology to carry out a full machine-checked proof of the functional correctness of the FreeRTOS scheduler. We describe the bugs found during this exercise, the fixes made, and the effort involved.

show abstract

“…1 : 1+x.next.length(), in which another call to length occurs. [4,7,12,17,18,20], in which the problem of verifying a program is encoded as a logical formula, and then handled by automatic theorem provers (typically SMT solvers). Since SMT solvers reason at a purely logical level, many problem aspects such as the program's heap state, and (for permission logics) auxiliary state to track the permissions currently held by a thread, are encoded as mathematical maps (total functions).…”

Section: Introductionmentioning

confidence: 99%

Verification Condition Generation for Permission Logics with Abstract Predicates and Abstraction Functions

Heule

Kassios

Müller

et al. 2013

ECOOP 2013 – Object-Oriented Programming

View full text Add to dashboard Cite

Abstract. Abstract predicates are the primary abstraction mechanism for program logics based on access permissions, such as separation logic and implicit dynamic frames. In addition to abstract predicates, it is useful to also support classical abstraction functions, for instance, to encode side-effect-free methods of the program and use them in specifications. However, combining abstract predicates and abstraction functions in a verification condition generator leads to subtle interactions, which complicate reasoning about heap modifications. Such complications may compromise soundness or cause divergence of the prover in the context of automated verification. In this paper, we present an encoding of abstract predicates and abstraction functions in the verification condition generator Boogie. Our encoding is sound and handles recursion in a way that is suitable for automatic verification using SMT solvers. It is implemented in the automatic verifier Chalice.

show abstract

VCC: A Practical System for Verifying Concurrent C

Cited by 413 publications

References 19 publications

Dynamic Boundaries: Information Hiding by Second Order Framing with First Order Assertions

Dynamic Boundaries: Information Hiding by Second Order Framing with First Order Assertions

Refinement-Based Verification of the FreeRTOS Scheduler in VCC

Verification Condition Generation for Permission Logics with Abstract Predicates and Abstraction Functions

Contact Info

Product

Resources

About