3 research outputs found
Invariant Synthesis for Incomplete Verification Engines
We propose a framework for synthesizing inductive invariants for incomplete
verification engines, which soundly reduce logical problems in undecidable
theories to decidable theories. Our framework is based on the counter-example
guided inductive synthesis principle (CEGIS) and allows verification engines to
communicate non-provability information to guide invariant synthesis. We show
precisely how the verification engine can compute such non-provability
information and how to build effective learning algorithms when invariants are
expressed as Boolean combinations of a fixed set of predicates. Moreover, we
evaluate our framework in two verification settings, one in which verification
engines need to handle quantified formulas and one in which verification
engines have to reason about heap properties expressed in an expressive but
undecidable separation logic. Our experiments show that our invariant synthesis
framework based on non-provability information can both effectively synthesize
inductive invariants and adequately strengthen contracts across a large suite
of programs
T2: Temporal Property Verification
We present the open-source tool T2, the first public release
from the TERMINATOR project. T2 has been extended over the past
decade to support automatic temporal-logic proving techniques and to
handle a general class of user-provided liveness and safety properties.
Input can be provided in a native format and in C, via the support of
the LLVM compiler framework. We briefly discuss T2’s architecture, its
underlying techniques, and conclude with an experimental illustration of
its competitiveness and directions for future extensions
Reasoning in the Bernays-Schönfinkel-Ramsey Fragment of Separation Logic
Separation Logic (SL) is a well-known assertion language used in Hoare-style
modular proof systems for programs with dynamically allocated data structures.
In this paper we investigate the fragment of first-order SL restricted to the
Bernays-Schoenfinkel-Ramsey quantifier prefix , where the
quantified variables range over the set of memory locations. When this set is
uninterpreted (has no associated theory) the fragment is PSPACE-complete, which
matches the complexity of the quantifier-free fragment. However, SL becomes
undecidable when the quantifier prefix belongs to
instead, or when the memory locations are interpreted as integers with linear
arithmetic constraints, thus setting a sharp boundary for decidability within
SL. We have implemented a decision procedure for the decidable fragment of
SL as a specialized solver inside a DPLL() architecture,
within the CVC4 SMT solver. The evaluation of our implementation was carried
out using two sets of verification conditions, produced by (i) unfolding
inductive predicates, and (ii) a weakest precondition-based verification
condition generator. Experimental data shows that automated quantifier
instantiation has little overhead, compared to manual model-based
instantiation