11,181 research outputs found
Summary-Based Inter-Procedural Analysis via Modular Trace Refinement
We propose a generalisation of trace refinement for the verification of inter-procedural programs. Our method is a top-down modular, summary-based approach, and analyses inter-procedural programs by building function summaries on-demand and improving the summaries each time a function is analysed. Our method is sound, and complete relative to the existence of a modular Hoare proof for a non-recursive program. We have implemented a prototype analyser that demonstrates the main features of our approach and yields promising results
Soft Contract Verification
Behavioral software contracts are a widely used mechanism for governing the
flow of values between components. However, run-time monitoring and enforcement
of contracts imposes significant overhead and delays discovery of faulty
components to run-time.
To overcome these issues, we present soft contract verification, which aims
to statically prove either complete or partial contract correctness of
components, written in an untyped, higher-order language with first-class
contracts. Our approach uses higher-order symbolic execution, leveraging
contracts as a source of symbolic values including unknown behavioral values,
and employs an updatable heap of contract invariants to reason about
flow-sensitive facts. We prove the symbolic execution soundly approximates the
dynamic semantics and that verified programs can't be blamed.
The approach is able to analyze first-class contracts, recursive data
structures, unknown functions, and control-flow-sensitive refinements of
values, which are all idiomatic in dynamic languages. It makes effective use of
an off-the-shelf solver to decide problems without heavy encodings. The
approach is competitive with a wide range of existing tools---including type
systems, flow analyzers, and model checkers---on their own benchmarks.Comment: ICFP '14, September 1-6, 2014, Gothenburg, Swede
SMT-based Model Checking for Recursive Programs
We present an SMT-based symbolic model checking algorithm for safety
verification of recursive programs. The algorithm is modular and analyzes
procedures individually. Unlike other SMT-based approaches, it maintains both
"over-" and "under-approximations" of procedure summaries. Under-approximations
are used to analyze procedure calls without inlining. Over-approximations are
used to block infeasible counterexamples and detect convergence to a proof. We
show that for programs and properties over a decidable theory, the algorithm is
guaranteed to find a counterexample, if one exists. However, efficiency depends
on an oracle for quantifier elimination (QE). For Boolean Programs, the
algorithm is a polynomial decision procedure, matching the worst-case bounds of
the best BDD-based algorithms. For Linear Arithmetic (integers and rationals),
we give an efficient instantiation of the algorithm by applying QE "lazily". We
use existing interpolation techniques to over-approximate QE and introduce
"Model Based Projection" to under-approximate QE. Empirical evaluation on
SV-COMP benchmarks shows that our algorithm improves significantly on the
state-of-the-art.Comment: originally published as part of the proceedings of CAV 2014; fixed
typos, better wording at some place
Synthesizing Modular Invariants for Synchronous Code
In this paper, we explore different techniques to synthesize modular
invariants for synchronous code encoded as Horn clauses. Modular invariants are
a set of formulas that characterizes the validity of predicates. They are very
useful for different aspects of analysis, synthesis, testing and program
transformation. We describe two techniques to generate modular invariants for
code written in the synchronous dataflow language Lustre. The first technique
directly encodes the synchronous code in a modular fashion. While in the second
technique, we synthesize modular invariants starting from a monolithic
invariant. Both techniques, take advantage of analysis techniques based on
property-directed reachability. We also describe a technique to minimize the
synthesized invariants.Comment: In Proceedings HCVS 2014, arXiv:1412.082
A Modular Toolkit for Distributed Interactions
We discuss the design, architecture, and implementation of a toolkit which
supports some theories for distributed interactions. The main design principles
of our architecture are flexibility and modularity. Our main goal is to provide
an easily extensible workbench to encompass current algorithms and incorporate
future developments of the theories. With the help of some examples, we
illustrate the main features of our toolkit.Comment: In Proceedings PLACES 2010, arXiv:1110.385
- …