110 research outputs found
Bounded Model Checking of State-Space Digital Systems: The Impact of Finite Word-Length Effects on the Implementation of Fixed-Point Digital Controllers Based on State-Space Modeling
The extensive use of digital controllers demands a growing effort to prevent
design errors that appear due to finite-word length (FWL) effects. However,
there is still a gap, regarding verification tools and methodologies to check
implementation aspects of control systems. Thus, the present paper describes an
approach, which employs bounded model checking (BMC) techniques, to verify
fixed-point digital controllers represented by state-space equations. The
experimental results demonstrate the sensitivity of such systems to FWL effects
and the effectiveness of the proposed approach to detect them. To the best of
my knowledge, this is the first contribution tackling formal verification
through BMC of fixed-point state-space digital controllers.Comment: International Symposium on the Foundations of Software Engineering
201
Context-Bounded Analysis For Concurrent Programs With Dynamic Creation of Threads
Context-bounded analysis has been shown to be both efficient and effective at
finding bugs in concurrent programs. According to its original definition,
context-bounded analysis explores all behaviors of a concurrent program up to
some fixed number of context switches between threads. This definition is
inadequate for programs that create threads dynamically because bounding the
number of context switches in a computation also bounds the number of threads
involved in the computation. In this paper, we propose a more general
definition of context-bounded analysis useful for programs with dynamic thread
creation. The idea is to bound the number of context switches for each thread
instead of bounding the number of switches of all threads. We consider several
variants based on this new definition, and we establish decidability and
complexity results for the analysis induced by them
Scaling Bounded Model Checking By Transforming Programs With Arrays
Bounded Model Checking is one the most successful techniques for finding bugs
in program. However, model checkers are resource hungry and are often unable to
verify programs with loops iterating over large arrays.We present a
transformation that enables bounded model checkers to verify a certain class of
array properties. Our technique transforms an array-manipulating (ANSI-C)
program to an array-free and loop-free (ANSI-C) program thereby reducing the
resource requirements of a model checker significantly. Model checking of the
transformed program using an off-the-shelf bounded model checker simulates the
loop iterations efficiently. Thus, our transformed program is a sound
abstraction of the original program and is also precise in a large number of
cases - we formally characterize the class of programs for which it is
guaranteed to be precise. We demonstrate the applicability and usefulness of
our technique on both industry code as well as academic benchmarks
Model Checking Boot Code from AWS Data Centers
This paper describes our experience with symbolic model checking in an industrial setting. We have proved that the initial boot code running in data centers at Amazon Web Services is memory safe, an essential step in establishing the security of any data center. Standard static analysis tools cannot be easily used on boot code without modification owing to issues not commonly found in higher-level code, including memory-mapped device interfaces, byte-level memory access, and linker scripts. This paper describes automated solutions to these issues and their implementation in the C Bounded Model Checker (CBMC). CBMC is now the first source-level static analysis tool to extract the memory layout described in a linker script for use in its analysis
Quantifier-Free Interpolation of a Theory of Arrays
The use of interpolants in model checking is becoming an enabling technology
to allow fast and robust verification of hardware and software. The application
of encodings based on the theory of arrays, however, is limited by the
impossibility of deriving quantifier- free interpolants in general. In this
paper, we show that it is possible to obtain quantifier-free interpolants for a
Skolemized version of the extensional theory of arrays. We prove this in two
ways: (1) non-constructively, by using the model theoretic notion of
amalgamation, which is known to be equivalent to admit quantifier-free
interpolation for universal theories; and (2) constructively, by designing an
interpolating procedure, based on solving equations between array updates.
(Interestingly, rewriting techniques are used in the key steps of the solver
and its proof of correctness.) To the best of our knowledge, this is the first
successful attempt of computing quantifier- free interpolants for a variant of
the theory of arrays with extensionality
Software Model Checking with Explicit Scheduler and Symbolic Threads
In many practical application domains, the software is organized into a set
of threads, whose activation is exclusive and controlled by a cooperative
scheduling policy: threads execute, without any interruption, until they either
terminate or yield the control explicitly to the scheduler. The formal
verification of such software poses significant challenges. On the one side,
each thread may have infinite state space, and might call for abstraction. On
the other side, the scheduling policy is often important for correctness, and
an approach based on abstracting the scheduler may result in loss of precision
and false positives. Unfortunately, the translation of the problem into a
purely sequential software model checking problem turns out to be highly
inefficient for the available technologies. We propose a software model
checking technique that exploits the intrinsic structure of these programs.
Each thread is translated into a separate sequential program and explored
symbolically with lazy abstraction, while the overall verification is
orchestrated by the direct execution of the scheduler. The approach is
optimized by filtering the exploration of the scheduler with the integration of
partial-order reduction. The technique, called ESST (Explicit Scheduler,
Symbolic Threads) has been implemented and experimentally evaluated on a
significant set of benchmarks. The results demonstrate that ESST technique is
way more effective than software model checking applied to the sequentialized
programs, and that partial-order reduction can lead to further performance
improvements.Comment: 40 pages, 10 figures, accepted for publication in journal of logical
methods in computer scienc
Symbolic Computation via Program Transformation
Symbolic computation is an important approach in automated program analysis.
Most state-of-the-art tools perform symbolic computation as interpreters and
directly maintain symbolic data. In this paper, we show that it is feasible,
and in fact practical, to use a compiler-based strategy instead. Using compiler
tooling, we propose and implement a transformation which takes a standard
program and outputs a program that performs semantically equivalent, but
partially symbolic, computation. The transformed program maintains symbolic
values internally and operates directly on them hence the program can be
processed by a tool without support for symbolic manipulation.
The main motivation for the transformation is in symbolic verification, but
there are many other possible use-cases, including test generation and concolic
testing. Moreover using the transformation simplifies tools, since the symbolic
computation is handled by the program directly. We have implemented the
transformation at the level of LLVM bitcode. The paper includes an experimental
evaluation, based on an explicit-state software model checker as a verification
backend
On the Generation of Positivstellensatz Witnesses in Degenerate Cases
One can reduce the problem of proving that a polynomial is nonnegative, or
more generally of proving that a system of polynomial inequalities has no
solutions, to finding polynomials that are sums of squares of polynomials and
satisfy some linear equality (Positivstellensatz). This produces a witness for
the desired property, from which it is reasonably easy to obtain a formal proof
of the property suitable for a proof assistant such as Coq. The problem of
finding a witness reduces to a feasibility problem in semidefinite programming,
for which there exist numerical solvers. Unfortunately, this problem is in
general not strictly feasible, meaning the solution can be a convex set with
empty interior, in which case the numerical optimization method fails.
Previously published methods thus assumed strict feasibility; we propose a
workaround for this difficulty. We implemented our method and illustrate its
use with examples, including extractions of proofs to Coq.Comment: To appear in ITP 201
How to Compute Worst-Case Execution Time by Optimization Modulo Theory and a Clever Encoding of Program Semantics
International audienceIn systems with hard real-time constraints, it is necessary to compute upper bounds on the worst-case execution time (WCET) of programs; the closer the bound to the real WCET, the better. This is especially the case of synchronous reactive control loops with a fixed clock; the WCET of the loop body must not exceed the clock period. We compute the WCET (or at least a close upper bound thereof) as the solution of an optimization modulo theory problem that takes into account the semantics of the program, in contrast to other methods that compute the longest path whether or not it is feasible according to these semantics. Optimization modulo theory extends satisfiability modulo theory (SMT) to maximization problems. Immediate encodings of WCET problems into SMT yield formulas intractable for all current production-grade solvers; this is inherent to the DPLL(T) approach to SMT implemented in these solvers. By conjoining some appropriate "cuts" to these formulas, we considerably reduce the computation time of the SMT-solver. We experimented our approach on a variety of control programs, using the OTAWA analyzer both as baseline and as underlying microarchitectural analysis for our analysis, and show notable improvement on the WCET bound on a variety of benchmarks and control programs
- …