185 research outputs found
A Navigation Logic for Recursive Programs with Dynamic Thread Creation
Dynamic Pushdown Networks (DPNs) are a model for multithreaded programs with
recursion and dynamic creation of threads. In this paper, we propose a temporal
logic called NTL for reasoning about the call- and return- as well as thread
creation behaviour of DPNs. Using tree automata techniques, we investigate the
model checking problem for the novel logic and show that its complexity is not
higher than that of LTL model checking against pushdown systems despite a more
expressive logic and a more powerful system model. The same holds true for the
satisfiability problem when compared to the satisfiability problem for a
related logic for reasoning about the call- and return-behaviour of pushdown
systems. Overall, this novel logic offers a promising approach for the
verification of recursive programs with dynamic thread creation
LNCS
We present a formal framework for repairing infinite-state, imperative, sequential programs, with (possibly recursive) procedures and multiple assertions; the framework can generate repaired programs by modifying the original erroneous program in multiple program locations, and can ensure the readability of the repaired program using user-defined expression templates; the framework also generates a set of inductive assertions that serve as a proof of correctness of the repaired program. As a step toward integrating programmer intent and intuition in automated program repair, we present a cost-aware formulation - given a cost function associated with permissible statement modifications, the goal is to ensure that the total program modification cost does not exceed a given repair budget. As part of our predicate abstractionbased solution framework, we present a sound and complete algorithm for repair of Boolean programs. We have developed a prototype tool based on SMT solving and used it successfully to repair diverse errors in benchmark C programs
Quadtrees as an Abstract Domain
Quadtrees have proved popular in computer graphics and spatial databases as a way of representing regions in two dimensional space. This hierarchical data-structure is flexible enough to support non-convex and even disconnected regions, therefore it is natural to ask whether this datastructure can form the basis of an abstract domain. This paper explores this question and suggests that quadtrees offer a new approach to weakly relational domains whilst their hierarchical structure naturally lends itself to representation with boolean functions
Automated Synthesis of Enforcing Mechanisms for Security Properties in a Timed Setting
AbstractIn [Martinelli, F. and I. Matteucci, Modeling security automata with process algebras and related results (2006), presented at the 6th International Workshop on Issues in the Theory of Security (WITS '06) - Informal proceedings; Martinelli, F. and I. Matteucci, Through modeling to synthesis of security automata (2006), accepted to STM06. To appeare in ENTCS] we have presented an approach for enforcing security properties. It is based on the automatic synthesis of controller programs that are able to detect and eventually prevent possible wrong action performed by an external agent. Here, we extend this approach also to a timed setting. Under certain assumptions, we are also able to enforce several information flow properties. We show how to deal with parameterized systems
Polynomial Interrupt Timed Automata
Interrupt Timed Automata (ITA) form a subclass of stopwatch automata where
reachability and some variants of timed model checking are decidable even in
presence of parameters. They are well suited to model and analyze real-time
operating systems. Here we extend ITA with polynomial guards and updates,
leading to the class of polynomial ITA (PolITA). We prove the decidability of
the reachability and model checking of a timed version of CTL by an adaptation
of the cylindrical decomposition method for the first-order theory of reals.
Compared to previous approaches, our procedure handles parameters and clocks in
a unified way. Moreover, we show that PolITA are incomparable with stopwatch
automata. Finally additional features are introduced while preserving
decidability
Program transformations using temporal logic side conditions
This paper describes an approach to program optimisation based on transformations, where temporal logic is used to specify side conditions, and strategies are created which expand the repertoire of transformations and provide a suitable level of abstraction. We demonstrate the power of this approach by developing a set of optimisations using our transformation language and showing how the transformations can be converted into a form which makes it easier to apply them, while maintaining trust in the resulting optimising steps. The approach is illustrated through a transformational case study where we apply several optimisations to a small program
Characterising Probabilistic Processes Logically
In this paper we work on (bi)simulation semantics of processes that exhibit
both nondeterministic and probabilistic behaviour. We propose a probabilistic
extension of the modal mu-calculus and show how to derive characteristic
formulae for various simulation-like preorders over finite-state processes
without divergence. In addition, we show that even without the fixpoint
operators this probabilistic mu-calculus can be used to characterise these
behavioural relations in the sense that two states are equivalent if and only
if they satisfy the same set of formulae.Comment: 18 page
Accelerated Data-Flow Analysis
Acceleration in symbolic verification consists in computing the exact effect
of some control-flow loops in order to speed up the iterative fix-point
computation of reachable states. Even if no termination guarantee is provided
in theory, successful results were obtained in practice by different tools
implementing this framework. In this paper, the acceleration framework is
extended to data-flow analysis. Compared to a classical
widening/narrowing-based abstract interpretation, the loss of precision is
controlled here by the choice of the abstract domain and does not depend on the
way the abstract value is computed. Our approach is geared towards precision,
but we don't loose efficiency on the way. Indeed, we provide a cubic-time
acceleration-based algorithm for solving interval constraints with full
multiplication
- …