204 research outputs found
Ranking Templates for Linear Loops
We present a new method for the constraint-based synthesis of termination
arguments for linear loop programs based on linear ranking templates. Linear
ranking templates are parametrized, well-founded relations such that an
assignment to the parameters gives rise to a ranking function. This approach
generalizes existing methods and enables us to use templates for many different
ranking functions with affine-linear components. We discuss templates for
multiphase, piecewise, and lexicographic ranking functions. Because these
ranking templates require both strict and non-strict inequalities, we use
Motzkin's Transposition Theorem instead of Farkas Lemma to transform the
generated -constraint into an -constraint.Comment: TACAS 201
Network-wide Configuration Synthesis
Computer networks are hard to manage. Given a set of high-level requirements
(e.g., reachability, security), operators have to manually figure out the
individual configuration of potentially hundreds of devices running complex
distributed protocols so that they, collectively, compute a compatible
forwarding state. Not surprisingly, operators often make mistakes which lead to
downtimes. To address this problem, we present a novel synthesis approach that
automatically computes correct network configurations that comply with the
operator's requirements. We capture the behavior of existing routers along with
the distributed protocols they run in stratified Datalog. Our key insight is to
reduce the problem of finding correct input configurations to the task of
synthesizing inputs for a stratified Datalog program. To solve this synthesis
task, we introduce a new algorithm that synthesizes inputs for stratified
Datalog programs. This algorithm is applicable beyond the domain of networks.
We leverage our synthesis algorithm to construct the first network-wide
configuration synthesis system, called SyNET, that support multiple interacting
routing protocols (OSPF and BGP) and static routes. We show that our system is
practical and can infer correct input configurations, in a reasonable amount
time, for networks of realistic size (> 50 routers) that forward packets for
multiple traffic classes.Comment: 24 Pages, short version published in CAV 201
Model checking boot code from AWS data centers
© 2020, The Author(s). This paper describes our experience with symbolic model checking in an industrial setting. We have proved that the initial boot code running in data centers at Amazon Web Services is memory safe, an essential step in establishing the security of any data center. Standard static analysis tools cannot be easily used on boot code without modification owing to issues not commonly found in higher-level code, including memory-mapped device interfaces, byte-level memory access, and linker scripts. This paper describes automated solutions to these issues and their implementation in the C Bounded Model Checker (CBMC). CBMC is now the first source-level static analysis tool to extract the memory layout described in a linker script for use in its analysis
Interprocedural Reachability for Flat Integer Programs
We study programs with integer data, procedure calls and arbitrary call
graphs. We show that, whenever the guards and updates are given by octagonal
relations, the reachability problem along control flow paths within some
language w1* ... wd* over program statements is decidable in Nexptime. To
achieve this upper bound, we combine a program transformation into the same
class of programs but without procedures, with an Np-completeness result for
the reachability problem of procedure-less programs. Besides the program, the
expression w1* ... wd* is also mapped onto an expression of a similar form but
this time over the transformed program statements. Several arguments involving
context-free grammars and their generative process enable us to give tight
bounds on the size of the resulting expression. The currently existing gap
between Np-hard and Nexptime can be closed to Np-complete when a certain
parameter of the analysis is assumed to be constant.Comment: 38 pages, 1 figur
Accelerated test execution using GPUs
As product life-cycles become shorter and the scale and complexity of systems increase, accelerating the execution of large test suites gains importance. Existing research has primarily focussed on techniques that reduce the size of the test suite. By contrast, we propose a technique that accelerates test execution, allowing test suites to run in a fraction of the original time, by parallel execution with a Graphics Processing Unit (GPU).
Program testing, which is in essence execution of the same program with multiple sets of test data, naturally exhibits the kind of data parallelism that can be exploited with GPUs. Our approach simultaneously executes the program with one test case per GPU thread. GPUs have severe limitations, and we discuss these in the context of our approach and define the scope of our applications. We observe speed-ups up to a factor of 27 compared to single-core execution on conventional CPUs with embedded systems benchmark programs
Scaling Bounded Model Checking By Transforming Programs With Arrays
Bounded Model Checking is one the most successful techniques for finding bugs
in program. However, model checkers are resource hungry and are often unable to
verify programs with loops iterating over large arrays.We present a
transformation that enables bounded model checkers to verify a certain class of
array properties. Our technique transforms an array-manipulating (ANSI-C)
program to an array-free and loop-free (ANSI-C) program thereby reducing the
resource requirements of a model checker significantly. Model checking of the
transformed program using an off-the-shelf bounded model checker simulates the
loop iterations efficiently. Thus, our transformed program is a sound
abstraction of the original program and is also precise in a large number of
cases - we formally characterize the class of programs for which it is
guaranteed to be precise. We demonstrate the applicability and usefulness of
our technique on both industry code as well as academic benchmarks
Proving Termination Starting from the End
We present a novel technique for proving program termination which introduces
a new dimension of modularity. Existing techniques use the program to
incrementally construct a termination proof. While the proof keeps changing,
the program remains the same. Our technique goes a step further. We show how to
use the current partial proof to partition the transition relation into those
behaviors known to be terminating from the current proof, and those whose
status (terminating or not) is not known yet. This partition enables a new and
unexplored dimension of incremental reasoning on the program side. In addition,
we show that our approach naturally applies to conditional termination which
searches for a precondition ensuring termination. We further report on a
prototype implementation that advances the state-of-the-art on the grounds of
termination and conditional termination.Comment: 16 page
Assisted coverage closure
Malfunction of safety-critical systems may cause damage to people and the environment. Software within those systems is rigorously designed and verified according to domain specific guidance, such as ISO26262 for automotive safety. This paper describes academic and industrial co-operation in tool development to support one of the most stringent of the requirements --- achieving full code coverage in requirements-driven testing.
We present a verification workflow supported by a tool that integrates the coverage measurement tool RapiCover with the test-vector generator FShell. The tool assists closing the coverage gap by providing the engineer with test vectors that help in debugging coverage-related code quality issues and creating new test cases, as well as justifying the presence of unreachable parts of the code in order to finally achieve full effective coverage according to the required criteria. We illustrate the tool's practical utility on automotive industry benchmarks. It generates 8 times more MC/DC coverage than random search
Quantifier-Free Interpolation of a Theory of Arrays
The use of interpolants in model checking is becoming an enabling technology
to allow fast and robust verification of hardware and software. The application
of encodings based on the theory of arrays, however, is limited by the
impossibility of deriving quantifier- free interpolants in general. In this
paper, we show that it is possible to obtain quantifier-free interpolants for a
Skolemized version of the extensional theory of arrays. We prove this in two
ways: (1) non-constructively, by using the model theoretic notion of
amalgamation, which is known to be equivalent to admit quantifier-free
interpolation for universal theories; and (2) constructively, by designing an
interpolating procedure, based on solving equations between array updates.
(Interestingly, rewriting techniques are used in the key steps of the solver
and its proof of correctness.) To the best of our knowledge, this is the first
successful attempt of computing quantifier- free interpolants for a variant of
the theory of arrays with extensionality
- …