## Indexed Predicate Discovery for Unbounded System Verification (2004)

### Cached

### Download Links

- [www.cs.cmu.edu]
- [www.ece.cmu.edu]
- [www.cs.cmu.edu]
- [research.microsoft.com]
- DBLP

### Other Repositories/Bibliography

Venue: | IN CAV’04 |

Citations: | 52 - 8 self |

### BibTeX

@INPROCEEDINGS{Lahiri04indexedpredicate,

author = {Shuvendu K. Lahiri and Randal E. Bryant},

title = {Indexed Predicate Discovery for Unbounded System Verification},

booktitle = {IN CAV’04},

year = {2004},

pages = {135--147},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

Predicate abstraction has been proved effective for verifying several infinite-state systems. In predicate abstraction, an abstract system is automatically constructed given a set of predicates. Predicate abstraction coupled with automatic predicate discovery provides for a completely automatic verification scheme. For systems with unbounded integer state variables (e.g. software), counterexample guided predicate discovery has been successful in identifying the necessary predicates. For

### Citations

2004 |
Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...e and software systems, where the state variables can assume arbitrarily large sets of values. Predicate abstraction, which is a special instance of the more general theory of abstract interpretations=-=[9]-=-, automatically constructs a finite-state abstract system from a potentially infinite state concrete system, given a set of predicates (where a predicate describes some property of the concrete system... |

663 | Counterexampleguided abstraction refinement
- Clarke, Grumberg, et al.
- 2000
(Show Context)
Citation Context ...#, # or ). The simplicity of the predicates make them amenable to automatic predicate discovery schemes [2, 6, 17]. All these methods use the framework of counterexample-guided abstraction refinement =-=[19, 8]-=- to add new predicates which eliminate spurious counterexample traces over the abstract system. Automatic predicate discovery coupled with the automatic abstraction provided by predicate abstraction m... |

648 | Construction of abstract state graphs with PVS
- Graf, Säıdi
- 1997
(Show Context)
Citation Context ...f two systems: (i) a version of the Bakery mutual exclusion protocol, and (ii) a directory-based cache coherence protocol with unbounded FIFO channels per client. 1 Introduction Predicate abstraction =-=[15]-=- has emerged as a successful technique for analyzing infinitestate systems. The infinite-state systems consist of both hardware and software systems, where the state variables can assume arbitrarily l... |

486 | Lazy abstraction
- Henzinger, Jhala, et al.
- 2002
(Show Context)
Citation Context ...e quantified invariants, it suffices to use simple atomic predicates (predicates do not contain #, # or ). The simplicity of the predicates make them amenable to automatic predicate discovery schemes =-=[2, 6, 17]-=-. All these methods use the framework of counterexample-guided abstraction refinement [19, 8] to add new predicates which eliminate spurious counterexample traces over the abstract system. Automatic p... |

448 |
Guarded commands, nondeterminacy and formal derivation of programs
- Dijkstra
- 1975
(Show Context)
Citation Context ...ided refinement framework. In this work, we look at a technique to generate the set of predicates iteratively. Our idea is based on generating predicates by computing the weakest liberal preconditions=-=[11]-=-, similar to Namjoshi and Kurshan [27] and Lakhnech et al. [23]. Our method differs from [27] in that we simply use the technique as a heuristic for discovering useful indexed predicates. We rely on p... |

437 |
Computer-Aided Verification of Coordinating Processes : The Automata-Theoretic Approach
- Kurshan
- 1995
(Show Context)
Citation Context ...#, # or ). The simplicity of the predicates make them amenable to automatic predicate discovery schemes [2, 6, 17]. All these methods use the framework of counterexample-guided abstraction refinement =-=[19, 8]-=- to add new predicates which eliminate spurious counterexample traces over the abstract system. Automatic predicate discovery coupled with the automatic abstraction provided by predicate abstraction m... |

425 | Automatic predicate abstraction of C programs
- Ball, Majumdar, et al.
- 2001
(Show Context)
Citation Context ...e quantified invariants, it suffices to use simple atomic predicates (predicates do not contain #, # or ). The simplicity of the predicates make them amenable to automatic predicate discovery schemes =-=[2, 6, 17]-=-. All these methods use the framework of counterexample-guided abstraction refinement [19, 8] to add new predicates which eliminate spurious counterexample traces over the abstract system. Automatic p... |

223 |
A New Solution of Dijkstra's Concurrent Programming Problem
- Lamport
- 1974
(Show Context)
Citation Context ...ques for infinite-state systems. We describe the use of the predicate inference scheme for verifying the safety properties of two protocols: (i) A version of the N-process Bakery algorithm by Lamport =-=[24]-=-, where the reads and writes are atomic and (ii) A extension of the cache-coherence protocol devised by Steven German of IBM [14], where each client communicates to the central process using unbounded... |

151 | Modeling and verifying systems using a logic of counter arithmetic with lambda expressions and uninterpreted functions
- Bryant, Lahiri, et al.
- 2002
(Show Context)
Citation Context ... as buffers and memories of arbitrary size and systems with arbitrary number of identical, concurrent processes, the system model must support state variables that are mutable functions or predicates =-=[25, 10, 5]-=-. For example, a memory can be represented as a function mapping an address to the data stored at an address, while a buffer can be represented as a function mapping an integer index to the value stor... |

142 | Regular model checking
- Bouajjani, Jonsson, et al.
- 2000
(Show Context)
Citation Context ...he proof to be discharged by symbolic model checkers. The proof of safety of the Bakery protocol required non-trivial lemmas in the compositional model checking framework [26]. Regular model checking =-=[18, 4]-=- uses regular languages to represent parameterized systems and computes the closure for the regular relations to construct the reachable state space. In general, the method is not guaranteed to be com... |

107 | Symbolic model checking with rich assertional languages
- Kesten, Maler, et al.
(Show Context)
Citation Context ...he proof to be discharged by symbolic model checkers. The proof of safety of the Bakery protocol required non-trivial lemmas in the compositional model checking framework [26]. Regular model checking =-=[18, 4]-=- uses regular languages to represent parameterized systems and computes the closure for the regular relations to construct the reachable state space. In general, the method is not guaranteed to be com... |

102 |
Predicate abstraction for software verification
- Flanagan, Qadeer
- 2002
(Show Context)
Citation Context ...matically [10], but it has not been successful for many of the systems that we consider. Our earlier work [21, 20] and the work by Flanagan and Qadeer (in the context of unbounded arrays in software) =-=[13]-=- overcome this problem by allowing the predicates to include free variables from a set of index variables X . We call these predicates as indexed predicates. The predicate abstraction engine construct... |

94 | Verification of an implementation of Tomasulo’s algorithm by compositional model checking
- McMillan
- 1998
(Show Context)
Citation Context ... as buffers and memories of arbitrary size and systems with arbitrary number of identical, concurrent processes, the system model must support state variables that are mutable functions or predicates =-=[25, 10, 5]-=-. For example, a memory can be represented as a function mapping an address to the data stored at an address, while a buffer can be represented as a function mapping an integer index to the value stor... |

82 | Automatic deductive verification with invisible invariants
- Pnueli, Ruah, et al.
- 2001
(Show Context)
Citation Context ...lly constructing predicates in [20]. In contrast, in this work the protocols are verified almost automatically with minimal intervention from the user. Related Work The method of invisible invariants =-=[28, 1]-=- uses heuristics for constructing universally quantified invariants for parameterized systems automatically. The method computes the set of reachable states for finite (and small) instances of the par... |

74 | Parameterized verification with automatically computed inductive assertions
- Arons, Pnueli, et al.
- 2001
(Show Context)
Citation Context ...lly constructing predicates in [20]. In contrast, in this work the protocols are verified almost automatically with minimal intervention from the user. Related Work The method of invisible invariants =-=[28, 1]-=- uses heuristics for constructing universally quantified invariants for parameterized systems automatically. The method computes the set of reachable states for finite (and small) instances of the par... |

67 |
Syntactic Program Transformations for Automatic Abstraction
- Namjoshi, Kurshan
- 2000
(Show Context)
Citation Context ...k, we look at a technique to generate the set of predicates iteratively. Our idea is based on generating predicates by computing the weakest liberal preconditions[11], similar to Namjoshi and Kurshan =-=[27]-=- and Lakhnech et al. [23]. Our method differs from [27] in that we simply use the technique as a heuristic for discovering useful indexed predicates. We rely on predicate abstraction to construct inva... |

60 | A symbolic approach to predicate abstraction
- Lahiri, Bryant, et al.
- 2003
(Show Context)
Citation Context ...tifier instantiation heuristic can be found in [22]. The method has sufficed for all the examples we have seen so far. The predicate abstraction is carried out efficiently by using Boolean techniques =-=[21]-=-. The inductive invariant is then used to prove the property of interest by the decision procedure inside UCLID. If the assertion holds, then the property is proved. We have used this method to verify... |

53 | Counter-example based predicate discovery in predicate abstraction
- Das, Dill
(Show Context)
Citation Context ... as buffers and memories of arbitrary size and systems with arbitrary number of identical, concurrent processes, the system model must support state variables that are mutable functions or predicates =-=[25, 10, 5]-=-. For example, a memory can be represented as a function mapping an address to the data stored at an address, while a buffer can be represented as a function mapping an integer index to the value stor... |

47 | Modeling and verification of out-of-order microprocessors in UCLID
- Lahiri, Seshia, et al.
- 2002
(Show Context)
Citation Context ...ystem handled by the method is restricted; it can't be applied to the extension of the cache-coherence protocol we consider in this paper or an out-of-order processor that is considered in our method =-=[22]-=-. McMillan uses compositional model checking [25] with various built in abstractions and symmetry reduction to reduce an infinite-state system to a finite state version, which can be model checked usi... |

35 | Constructing quantified invariants via predicate abstraction
- Lahiri, Bryant
- 2004
(Show Context)
Citation Context ...ts of properties about the system. Recent work attempts to discover quantified predicates automatically [10], but it has not been successful for many of the systems that we consider. Our earlier work =-=[21, 20]-=- and the work by Flanagan and Qadeer (in the context of unbounded arrays in software) [13] overcome this problem by allowing the predicates to include free variables from a set of index variables X . ... |

31 | Predicate abstraction of ansi-c programs using sat
- Clarke, Kroening, et al.
(Show Context)
Citation Context ...trongest inductive invariant that can be expressed with these predicates. This process can be made efficient by using symbolic and Boolean techniques based on incremental SAT and BDD-based algorithms =-=[21, 7]-=-. Thus, predicate abstraction can construct complex invariants given a set of predicates. # This research was supported in part by the Semiconductor Research Corporation, Contract RID 1029.001. For sy... |

30 | Incremental verification by abstraction
- Lakhnech, Bensalem, et al.
- 2001
(Show Context)
Citation Context ... to generate the set of predicates iteratively. Our idea is based on generating predicates by computing the weakest liberal preconditions[11], similar to Namjoshi and Kurshan [27] and Lakhnech et al. =-=[23]-=-. Our method differs from [27] in that we simply use the technique as a heuristic for discovering useful indexed predicates. We rely on predicate abstraction to construct invariants using these predic... |

28 | Exact and efficient verification of parameterized cache coherence protocols
- EMERSON, KAHLON
(Show Context)
Citation Context ...n our framework) are few such examples. Even though the Bakery algorithm can be verified in this framework, it requires user ingenuity to encode the protocol in a regular language. Emerson and Kahlon =-=[12]-=- have verified the version of German's cache coherence protocol with single entry channels by reducing it to a snoopy protocol, which can in turn be verified automatically by considering finite instan... |

25 | Induction in compositional model checking
- MCMILLAN, QADEER, et al.
- 2000
(Show Context)
Citation Context ...iary lemmas or to decompose the proof to be discharged by symbolic model checkers. The proof of safety of the Bakery protocol required non-trivial lemmas in the compositional model checking framework =-=[26]-=-. Regular model checking [18, 4] uses regular languages to represent parameterized systems and computes the closure for the regular relations to construct the reachable state space. In general, the me... |

21 |
Parameterized verification of a cache coherence protocol: Safety and liveness
- Baukus, Lakhnech, et al.
- 2002
(Show Context)
Citation Context ...s user ingenuity. It can't be easily extended to verify other unbounded systems including the Bakery algorithm or the out-of-order processors. Predicate abstraction with locally quantified predicates =-=[10, 3]-=- require complex quantified predicates to construct the inductive assertions, as mentioned in the introduction. These predicates are often as complex as invariants themselves. The method in [3] verifi... |

16 | The decision problem for standard classes
- Gurevich
- 1976
(Show Context)
Citation Context ...antified inductive invariant that can be constructed from the set of predicates. Since there is no complete way for handling quantifiers in first order logic with equality and uninterpreted functions =-=[16]-=-, we resort to sound quantifier instantiation techniques to compute an overapproximation of the abstract state space. The quantifier instantiation method uses heuristics to choose a finite set of term... |