Citation Context

...uential code; the correctness of construct-idfg depends on the much weaker condition that a proof argument is preserved. More recently, DFGs have been used for invariant generation in both concurrent =-=[12]-=- and sequential [27] settings. The work of [12] is particularly relevant: it uses data flow graphs to generate numerical invariants for parameterized concurrent programs. These invariants can be used ...

Citation Context

...on between a given thread and its environment, consisting of the remaining threads. Abstracting this interaction finitely has been considered by many, recently by Berdine et al. [4] and Farzan et al. =-=[17]-=-. In particular, the approach of Berdine et al. is very closely related. Similarities include the notion of transferring invariants from a materialized thread to the abstraction of the remaining threa...

Citation Context

...tions can be captured using the technique of [47], in which a universally quantified environment assertion is used to keep track of relationships between a distinguished thread and all other threads. =-=[18]-=- is another technique that, like [10, 47], loses variable correlations in the interests of speed. Unlike [10] and [47], [18] is designed to compute numerical invariants rather than data structure inva...

Citation Context

...idable problem but data-dependence analysis is tractable. In this paper, we expound on the philosophy of Duet. We describe its architecture and describe two different analyses implemented in the tool =-=[4,5]-=-. Finally, we present experimental results demonstrating the efficacy of our tool on a set device drivers. 2 Overview Duet is based on the idea that much of the essential behaviour of a program is cap...

Citation Context

...t scale. Table 2 shows our benchmark programs. Note that, although a relational analysis is a key to proving important numerical properties, it is useful only for specific target programs and queries =-=[3, 10]-=-. Thus, we first identified a set of benchmark programs and their buffer-overrun queries whose proofs require relational information, and compared the performance of the two analyses on these programs...

Citation Context

...blems: constructing a proof space, and checking the adequacy of the proof space. There is some work on automated invariant generation for programs where the number of threads and memory are unbounded =-=[13, 23, 36]-=-. These methods generally differ from ours in that they compute inductive invariants and are not property driven. In [36], starting with a set of candidate invariants (assertions), the approach builds...

Citation Context

...ter-thread predicates with respect to which to abstraction is built. As a consequence of losing asynchrony in the abstraction, many existing model checkers for concurrent software become inapplicable =-=[25, 11, 12]-=-. For a fixed thread count n, the problem can be circumvented by forgoing the replicated nature of the concurrent programs, as done in [10] for boom tool: it proves the ticket algorithm correct up to ...