Results 11  20
of
35
Verifying complex properties using symbolic shape analysis
 In Workshop on heap abstraction and verification
, 2007
"... One of the main challenges in the verification of software systems is the analysis of unbounded data structures with dynamic memory allocation, such as linked data structures and arrays. We describe Bohne, a new analysis for verifying data structures. Bohne verifies data structure operations and sho ..."
Abstract

Cited by 11 (6 self)
 Add to MetaCart
One of the main challenges in the verification of software systems is the analysis of unbounded data structures with dynamic memory allocation, such as linked data structures and arrays. We describe Bohne, a new analysis for verifying data structures. Bohne verifies data structure operations and shows that 1) the operations preserve data structure invariants and 2) the operations satisfy their specifications expressed in terms of changes to the set of objects stored in the data structure. During the analysis, Bohne infers loop invariants in the form of disjunctions of universally quantified Boolean combinations of formulas, represented as sets of binary decision diagrams. To synthesize loop invariants of this form, Bohne uses a combination of decision procedures for Monadic SecondOrder Logic over trees, SMTLIB decision procedures (currently CVC Lite), and an automated reasoner within the Isabelle interactive theorem prover. This architecture shows that synthesized loop invariants can serve as a useful communication mechanism between different decision procedures. In addition, Bohne uses field constraint analysis, a combination mechanism that enables the use of uninterpreted function symbols
Verification by network decomposition
 IN 15 TH CONCUR, LNCS 3170
, 2004
"... We describe a new method to verify networks of homogeneous processes which communicate by token passing. Given an arbitrary network graph and an indexed LT L \ X property, we show how to decompose the network graph into multiple constant size networks, thereby reducing one model checking call on a ..."
Abstract

Cited by 9 (1 self)
 Add to MetaCart
We describe a new method to verify networks of homogeneous processes which communicate by token passing. Given an arbitrary network graph and an indexed LT L \ X property, we show how to decompose the network graph into multiple constant size networks, thereby reducing one model checking call on a large network to several calls on small networks. We thus obtain cutoffs for arbitrary classes of networks, adding to previous work by Emerson and Namjoshi on the ring topology. Our results on LT L \ X are complemented by a negative result which precludes the existence of reductions for CT L \ X on general networks.
On Linear Arithmetic with Stars
"... Abstract. We consider an extension of integer linear arithmetic with a star operator that takes closure under vector addition of the set of solutions of linear arithmetic subformula. We show that the satisfiability problem for this language is in NP (and therefore NPcomplete). Our proof uses a gene ..."
Abstract

Cited by 8 (6 self)
 Add to MetaCart
Abstract. We consider an extension of integer linear arithmetic with a star operator that takes closure under vector addition of the set of solutions of linear arithmetic subformula. We show that the satisfiability problem for this language is in NP (and therefore NPcomplete). Our proof uses a generalization of a recent result on sparse solutions of integer linear programming problems. We present two consequences of our result. The first one is an optimal decision procedure for a logic of sets, multisets, and cardinalities that has applications in verification, interactive theorem proving, and description logics. The second is NPcompleteness of the reachability problem for a class of “homogeneous ” transition systems whose transitions are defined using integer linear arithmetic formulas. 1
An overview of the Jahob analysis system: Project goals and current status
 In NSF Next Generation Software Workshop
, 2006
"... We present an overview of the Jahob system for modular analysis of data structure properties. Jahob uses a subset of Java as the implementation language and annotations with formulas in a subset of Isabelle as the specification language. It uses monadic secondorder logic over trees to reason about ..."
Abstract

Cited by 8 (1 self)
 Add to MetaCart
We present an overview of the Jahob system for modular analysis of data structure properties. Jahob uses a subset of Java as the implementation language and annotations with formulas in a subset of Isabelle as the specification language. It uses monadic secondorder logic over trees to reason about reachability in linked data structures, the Isabelle theorem prover and NelsonOppen style theorem provers to reason about highlevel properties and arrays, and a new technique to combine reasoning about constraints on uninterpreted function symbols with other decision procedures. It also incorporates new decision procedures for reasoning about sets with cardinality constraints. The system can infer loop invariants using new symbolic shape analysis. Initial results in the use of our system are promising; we are continuing to develop and evaluate it. 1.
Abstraction Refinement for Quantified Array Assertions
 IN: SAS, SPRINGERVERLAG (2009) 3
, 2009
"... We present an abstraction refinement technique for the verification of universally quantified array assertions such as “all elements in the array are sorted”. Our technique can be seamlessly combined with existing software model checking algorithms. We implemented our technique in the ACSAR softwar ..."
Abstract

Cited by 8 (0 self)
 Add to MetaCart
We present an abstraction refinement technique for the verification of universally quantified array assertions such as “all elements in the array are sorted”. Our technique can be seamlessly combined with existing software model checking algorithms. We implemented our technique in the ACSAR software model checker and successfully verified quantified array assertions for both text book examples and reallife examples taken from the Linux operating system kernel.
Verifying Reference Counting Implementations
"... Reference counting is a widelyused resource management idiom which maintains a count of references to each resource by incrementing the count upon an acquisition, and decrementing upon a release; resources whose counts fall to zero may be recycled. We present an algorithm to verify the correctness ..."
Abstract

Cited by 7 (0 self)
 Add to MetaCart
Reference counting is a widelyused resource management idiom which maintains a count of references to each resource by incrementing the count upon an acquisition, and decrementing upon a release; resources whose counts fall to zero may be recycled. We present an algorithm to verify the correctness of reference counting with minimal user interaction. Our algorithm performs compositional verification through the combination of symbolic temporal case splitting and predicate abstractionbased reachability. Temporal case splitting reduces the verification of an unbounded number of processes and resources to verification of a finite number through the use of Skolem variables. The finite state instances are discharged by symbolic model checking, with an auxiliary invariant correlating reference counts with the number of held references. We have implemented our algorithm in Referee, a reference counting analysis tool for C programs, and applied Referee to two real programs: the memory allocator of an OS kernel and the file interface of the Yaffs file system. In both cases our algorithm proves correct the use of reference counts in less than one minute.
MONOTONIC ABSTRACTION (ON EFFICIENT VERIFICATION OF PARAMETERIZED SYSTEMS)
, 2009
"... We introduce the simple and efficient method of monotonic abstraction to prove safety properties for parameterized systems with linear topologies. A process in the system is a finitestate automaton, where the transitions are guarded by both local and global conditions. Processes may communicate via ..."
Abstract

Cited by 5 (0 self)
 Add to MetaCart
We introduce the simple and efficient method of monotonic abstraction to prove safety properties for parameterized systems with linear topologies. A process in the system is a finitestate automaton, where the transitions are guarded by both local and global conditions. Processes may communicate via broadcast, rendezvous and shared variables over finite domains. The method of monotonic abstraction derives an overapproximation of the induced transition system that allows the use of a simple class of regular expressions as a symbolic representation. Compared to traditional regular model checking methods, the analysis does not require the manipulation of transducers, and hence its simplicity and efficiency. We have implemented a prototype that works well on several mutual exclusion algorithms and cache coherence protocols. 1.
Verification using Satisfiability Checking, Predicate Abstraction, and Craig Interpolation
, 2008
"... not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the sponsoring institutions, the U.S. Government or any other entity. Keywords: Formal methods, model checking, abstraction, refinement, bounded model checking, Boolean satisfiabilit ..."
Abstract

Cited by 3 (1 self)
 Add to MetaCart
not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the sponsoring institutions, the U.S. Government or any other entity. Keywords: Formal methods, model checking, abstraction, refinement, bounded model checking, Boolean satisfiability, nonclausal SAT solvers, DPLL, general matings, unsatisfiable core, craig interpolation, proofs of unsatisfiability, linear diophantine equations, linear modular equations (linear congruences), linear diophantine Automatic verification of hardware and software implementations is crucial for building reliable computer systems. Most verification tools rely on decision procedures to check the satisfiability of various formulas that are generated during the verification process. This thesis develops new techniques for building efficient decision procedures and adds new capabilities to the existing decision procedures for certain logics. Boolean satisfiability (SAT) solvers are used heavily in verification tools as decision procedures for propositional logic. Most stateoftheart SAT solvers are
Unbounded System Verification Using Decision Procedures and Predicate Abstraction
, 2004
"... Designs of hardware and software systems have grown in complexity to meet the demand for improved performance. The complexity of the design often manifests itself in the form of subtle and intricate design flaws and bugs. The cost of these errors can be prohibitive and often dictates the lifetime of ..."
Abstract

Cited by 2 (1 self)
 Add to MetaCart
Designs of hardware and software systems have grown in complexity to meet the demand for improved performance. The complexity of the design often manifests itself in the form of subtle and intricate design flaws and bugs. The cost of these errors can be prohibitive and often dictates the lifetime of a product. Most design teams allocate a substantial amount of their resources in testing and verifying a product. Traditional simulation based testing or verification methods, which exercise the design on a small set of concrete inputs, often fall short of detecting most bugs in a system. Besides, these methods are suitable for finding bugs but cannot guarantee the absence of a bug in the design or the model. Formal verification based methods can ensure that a property holds for all the possible states of the system. Model checking is an approach that has been successful in verifying systems of commercial complexity or in detecting bugs that are hard to find using traditional simulation. The approach is based on systematically traversing the state space of a system and checking a property at each state. However, model checking can’t be directly applied to systems that have very large or unbounded state space. Examples of such systems include microprocessors with large buffer sizes and memories, parameterized cachecoherence and communication protocols and distributed mutual exclusion algorithms. Most previous works have either used general purpose theorem provers with considerable manual guidance or techniques specific to a particular class of systems that often exclude realistic systems discussed above. The lack of automation or the restrictions on the systems that can