2,734 research outputs found
On Verifying Complex Properties using Symbolic Shape Analysis
One of the main challenges in the verification of software systems is the
analysis of unbounded data structures with dynamic memory allocation, such as
linked data structures and arrays. We describe Bohne, a new analysis for
verifying data structures. Bohne verifies data structure operations and shows
that 1) the operations preserve data structure invariants and 2) the operations
satisfy their specifications expressed in terms of changes to the set of
objects stored in the data structure. During the analysis, Bohne infers loop
invariants in the form of disjunctions of universally quantified Boolean
combinations of formulas. To synthesize loop invariants of this form, Bohne
uses a combination of decision procedures for Monadic Second-Order Logic over
trees, SMT-LIB decision procedures (currently CVC Lite), and an automated
reasoner within the Isabelle interactive theorem prover. This architecture
shows that synthesized loop invariants can serve as a useful communication
mechanism between different decision procedures. Using Bohne, we have verified
operations on data structures such as linked lists with iterators and back
pointers, trees with and without parent pointers, two-level skip lists, array
data structures, and sorted lists. We have deployed Bohne in the Hob and Jahob
data structure analysis systems, enabling us to combine Bohne with analyses of
data structure clients and apply it in the context of larger programs. This
report describes the Bohne algorithm as well as techniques that Bohne uses to
reduce the ammount of annotations and the running time of the analysis
Verification of Timed Automata Using Rewrite Rules and Strategies
ELAN is a powerful language and environment for specifying and prototyping
deduction systems in a language based on rewrite rules controlled by
strategies. Timed automata is a class of continuous real-time models of
reactive systems for which efficient model-checking algorithms have been
devised. In this paper, we show that these algorithms can very easily be
prototyped in the ELAN system. This paper argues through this example that
rewriting based systems relying on rules and strategies are a good framework to
prototype, study and test rather efficiently symbolic model-checking
algorithms, i.e. algorithms which involve combination of graph exploration
rules, deduction rules, constraint solving techniques and decision procedures
- …