92 research outputs found
A Framework to Synergize Partial Order Reduction with State Interpolation
We address the problem of reasoning about interleavings in safety
verification of concurrent programs. In the literature, there are two prominent
techniques for pruning the search space. First, there are well-investigated
trace-based methods, collectively known as "Partial Order Reduction (POR)",
which operate by weakening the concept of a trace by abstracting the total
order of its transitions into a partial order. Second, there is state-based
interpolation where a collection of formulas can be generalized by taking into
account the property to be verified. Our main contribution is a framework that
synergistically combines POR with state interpolation so that the sum is more
than its parts
Efficient Generation of Craig Interpolants in Satisfiability Modulo Theories
The problem of computing Craig Interpolants has recently received a lot of
interest. In this paper, we address the problem of efficient generation of
interpolants for some important fragments of first order logic, which are
amenable for effective decision procedures, called Satisfiability Modulo Theory
solvers.
We make the following contributions.
First, we provide interpolation procedures for several basic theories of
interest: the theories of linear arithmetic over the rationals, difference
logic over rationals and integers, and UTVPI over rationals and integers.
Second, we define a novel approach to interpolate combinations of theories,
that applies to the Delayed Theory Combination approach.
Efficiency is ensured by the fact that the proposed interpolation algorithms
extend state of the art algorithms for Satisfiability Modulo Theories. Our
experimental evaluation shows that the MathSAT SMT solver can produce
interpolants with minor overhead in search, and much more efficiently than
other competitor solvers.Comment: submitted to ACM Transactions on Computational Logic (TOCL
Generalised Interpolation by Solving Recursion-Free Horn Clauses
In this paper we present InterHorn, a solver for recursion-free Horn clauses.
The main application domain of InterHorn lies in solving interpolation problems
arising in software verification. We show how a range of interpolation
problems, including path, transition, nested, state/transition and well-founded
interpolation can be handled directly by InterHorn. By detailing these
interpolation problems and their Horn clause representations, we hope to
encourage the emergence of a common back-end interpolation interface useful for
diverse verification tools.Comment: In Proceedings HCVS 2014, arXiv:1412.082
A Survey of Symbolic Execution Techniques
Many security and software testing applications require checking whether
certain properties of a program hold for any possible usage scenario. For
instance, a tool for identifying software vulnerabilities may need to rule out
the existence of any backdoor to bypass a program's authentication. One
approach would be to test the program using different, possibly random inputs.
As the backdoor may only be hit for very specific program workloads, automated
exploration of the space of possible inputs is of the essence. Symbolic
execution provides an elegant solution to the problem, by systematically
exploring many possible execution paths at the same time without necessarily
requiring concrete inputs. Rather than taking on fully specified input values,
the technique abstractly represents them as symbols, resorting to constraint
solvers to construct actual instances that would cause property violations.
Symbolic execution has been incubated in dozens of tools developed over the
last four decades, leading to major practical breakthroughs in a number of
prominent software reliability applications. The goal of this survey is to
provide an overview of the main ideas, challenges, and solutions developed in
the area, distilling them for a broad audience.
The present survey has been accepted for publication at ACM Computing
Surveys. If you are considering citing this survey, we would appreciate if you
could use the following BibTeX entry: http://goo.gl/Hf5FvcComment: This is the authors pre-print copy. If you are considering citing
this survey, we would appreciate if you could use the following BibTeX entry:
http://goo.gl/Hf5Fv
Benchmarking Symbolic Execution Using Constraint Problems -- Initial Results
Symbolic execution is a powerful technique for bug finding and program
testing. It is successful in finding bugs in real-world code. The core
reasoning techniques use constraint solving, path exploration, and search,
which are also the same techniques used in solving combinatorial problems,
e.g., finite-domain constraint satisfaction problems (CSPs). We propose CSP
instances as more challenging benchmarks to evaluate the effectiveness of the
core techniques in symbolic execution. We transform CSP benchmarks into C
programs suitable for testing the reasoning capabilities of symbolic execution
tools. From a single CSP P, we transform P depending on transformation choice
into different C programs. Preliminary testing with the KLEE, Tracer-X, and
LLBMC tools show substantial runtime differences from transformation and solver
choice. Our C benchmarks are effective in showing the limitations of existing
symbolic execution tools. The motivation for this work is we believe that
benchmarks of this form can spur the development and engineering of improved
core reasoning in symbolic execution engines
- …