## Boolean heaps (2005)

### Cached

### Download Links

- [www.informatik.uni-freiburg.de]
- [mtc.epfl.ch]
- [cs.nyu.edu]
- [pub.ist.ac.at]
- DBLP

### Other Repositories/Bibliography

Venue: | In SAS |

Citations: | 38 - 9 self |

### BibTeX

@INPROCEEDINGS{Podelski05booleanheaps,

author = {Andreas Podelski and Thomas Wies},

title = {Boolean heaps},

booktitle = {In SAS},

year = {2005}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. We show that the idea of predicates on heap objects can be cast in the framework of predicate abstraction. This leads to an alternative view on the underlying concepts of three-valued shape analysis by Sagiv, Reps and Wilhelm. Our construction of the abstract post operator is analogous to the corresponding construction for classical predicate abstraction, except that predicates over objects on the heap take the place of state predicates, and boolean heaps (sets of bitvectors) take the place of boolean states (bitvectors). A program is abstracted to a program over boolean heaps. For each command of the program, the corresponding abstract command is effectively constructed by deductive reasoning, namely by the application of the weakest precondition operator and an entailment test. We thus obtain a symbolic framework for shape analysis. 1

### Citations

635 | Systematic design of program analysis frameworks
- Cousot, Cousot
(Show Context)
Citation Context ...fer to the corresponding syntactic operation given in Prop. 2. 6 Heap Predicate Abstraction We systematically construct an abstract post operator by following the framework of abstract interpretation =-=[4]-=-. Hence, we need to provide an abstract domain, as well as an abstraction and meaning function. We propose an abstract domain that is given by a set of state formulas and is parameterized by unary hea... |

604 | Construction of abstract state graphs with pvs
- Graf, Saïdi
- 1997
(Show Context)
Citation Context ...t. We thus obtain a symbolic framework for shape analysis. 1 Introduction The transition graph of a program is formed by its states and the transitions between them. The idea of predicate abstraction =-=[6]-=- (used in a tool such as SLAM [2]) is to abstract a state by its evaluation under a number of given state predicates; each edge between two concrete states in the transition graph gives rise to an edg... |

540 | Parametric shape analysis via 3-valued logic
- Sagiv, Reps, et al.
(Show Context)
Citation Context ...m manipulating pointers, each state is represented by a heap graph. A heap graph is formed by the allocated objects in the heap and pointer links between them. The idea of three-valued shape analysis =-=[13]-=- is to apply to the heap graph the same abstraction that we have applied to the transition graph. One abstracts an object in the heap by its evaluation under a number of heap predicates; edges between... |

396 | Automatic predicate abstraction of C programs
- Ball, Majumdar, et al.
- 2001
(Show Context)
Citation Context ...ework for shape analysis. 1 Introduction The transition graph of a program is formed by its states and the transitions between them. The idea of predicate abstraction [6] (used in a tool such as SLAM =-=[2]-=-) is to abstract a state by its evaluation under a number of given state predicates; each edge between two concrete states in the transition graph gives rise to an edge between the two corresponding a... |

161 | Boolean and cartesian abstraction for model checking C programs
- Ball, Podelski, et al.
(Show Context)
Citation Context ...ction for shape analysis. We solve this problem by combining the core ideas from both frameworks. In particular, we use Cartesian abstraction in a way that is reminiscent of the approach described in =-=[3]-=-. However, we restrict our attention to safety properties, whereas in [1] also liveness properties are considered. 3 Boolean Heap Programs Our analysis proceeds as follows: (1) we choose a set of pred... |

145 | The Pointer Assertion Logic Engine
- Møller, Schwartzbach
- 2001
(Show Context)
Citation Context ...ree-valued logical structures. In our framework we do not depend on an intermediate representation of sets of states in terms of three-valued logical structures. We work exclusively on formulas. PALE =-=[12]-=- is a Hoare-style system for the analysis of pointer programs that is based on weak monadic second order logic over trees. Its degree of automation is restricted, because loops in the program have to ... |

124 | Graph types
- Klarlund, Schwartzbach
- 1993
(Show Context)
Citation Context ...f automation is restricted, because loops in the program have to be manually annotated with loop invariants. Also the class of data structures that PALE is able to handle is restricted to graph types =-=[9]-=-. In our approach we synthesize loop invariants automatically. Furthermore, our analysis is not restricted a priori to a particular class of data structures; which data structures our analysis is able... |

57 |
Shape analysis by predicate abstraction
- Balaban, Pnueli, et al.
(Show Context)
Citation Context ...ration between the abstraction phase and the actual fixed point computation of the analysis. There are several approaches that use classical predicate abstraction for shape analysis; see e.g. [5] and =-=[1]-=-. As discussed in [11], if one wants to gain the same precision with classical predicate abstraction as for the abstract domain proposed in [13] then in general one needs an exponential number of stat... |

51 | Predicate abstraction and canonical abstraction for singly-linked lists
- Manevich, Yahav, et al.
- 2005
(Show Context)
Citation Context ...straction phase and the actual fixed point computation of the analysis. There are several approaches that use classical predicate abstraction for shape analysis; see e.g. [5] and [1]. As discussed in =-=[11]-=-, if one wants to gain the same precision with classical predicate abstraction as for the abstract domain proposed in [13] then in general one needs an exponential number of state predicates compared ... |

51 | Symbolically computing most-precise abstract operations for shape analysis
- Yorsh, Reps, et al.
- 2004
(Show Context)
Citation Context ...e-valued logical structures in [13]; our abstract domain is a fragment of shape analysis constraints. 1 available on the web at http://www.mpi-inf.mpg.de/~wies/papers/ boolean-heaps-extended.pdf 2In =-=[16]-=- a symbolic algorithm is presented that can be used for shape analysis à la [13]. It is based on an assume operation that is implemented using a decision procedure. The assume operation allows inter-p... |

31 | The boundary between decidability and undecidability for transitiveclosure logics
- Immerman, Rabinovich, et al.
- 2004
(Show Context)
Citation Context ...r the entailment tests. There is ongoing research on how to adapt or extend existing theorem provers and decision procedures to the theories that are needed in the context of shape analysis; see e.g. =-=[7, 8]-=-. This is a challenging branch for further research. Another direction for future work is to study refinements of our abstract domain that are even closer to the abstract domain used in three-valued s... |

30 | Logical characterizations of heap abstractions
- Yorsh
- 2003
(Show Context)
Citation Context ...ticular, there is a strong connection between their abstract domain and ours: a translation from three-valued logical structures, as they arise in [13], into formulas in first-order logic is given in =-=[15]-=-. Shape analysis constraints [10] extend this translation to a boolean algebra of state predicates that is isomorphic to the class of three-valued logical structures in [13]; our abstract domain is a ... |

29 | Shape Analysis through Predicate Abstraction and Model Checking
- Dams, Namjoshi
(Show Context)
Citation Context ...ear separation between the abstraction phase and the actual fixed point computation of the analysis. There are several approaches that use classical predicate abstraction for shape analysis; see e.g. =-=[5]-=- and [1]. As discussed in [11], if one wants to gain the same precision with classical predicate abstraction as for the abstract domain proposed in [13] then in general one needs an exponential number... |

21 | Verification via Structure Simulation
- Immerman, Rabinovich, et al.
- 2004
(Show Context)
Citation Context ...r the entailment tests. There is ongoing research on how to adapt or extend existing theorem provers and decision procedures to the theories that are needed in the context of shape analysis; see e.g. =-=[7, 8]-=-. This is a challenging branch for further research. Another direction for future work is to study refinements of our abstract domain that are even closer to the abstract domain used in three-valued s... |

18 | On the boolean algebra of shape analysis constraints
- Kuncak, Rinard
- 2003
(Show Context)
Citation Context ...tion between their abstract domain and ours: a translation from three-valued logical structures, as they arise in [13], into formulas in first-order logic is given in [15]. Shape analysis constraints =-=[10]-=- extend this translation to a boolean algebra of state predicates that is isomorphic to the class of three-valued logical structures in [13]; our abstract domain is a fragment of shape analysis constr... |

3 |
Symbolic Shape Analysis. Diploma thesis, Universität des Saarlandes
- Wies
- 2004
(Show Context)
Citation Context ...n edge between two abstract objects can be encoded into heap predicates on objects. Adding these predicates to the set of abstraction predicates will preserve this information in the abstraction; see =-=[14]-=-. 4General scheme Concrete command: c Unary heap predicates: P = {p1(v), . . . , pn(v)} Boolean heap program: var V : set of bitvectors over P for each p ∈ V do for each pi ∈ P do if p |= hwp # c pi ... |