A Dataflow Analysis to Improve SAT-Based Bounded Program Verification

Parrino, Bruno Cuervo; Galeotti, Juan Pablo; Garbervetsky, Diego; Frias, Marcelo F.

doi:10.1007/978-3-642-24690-6_11

Cited by 5 publications

(3 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Slicing is commonly used to reduce the size of BMC instances by removing variables that are syntactically irrelevant to a property (e.g., [19], [18]). It is also known as 'cone of influence' reduction, where the set of relevant variables expands with the size of the slice, diminishing its effectiveness (e.g., despite slicing, CBMC and ESBMC frequently run out of time/memory).…”

Section: E Evaluation Of Blitz Featuresmentioning

confidence: 99%

BLITZ: Compositional bounded model checking for real-world programs

Cho

D’Silva

Song

2013

2013 28th IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

Abstract-Bounded Model Checking (BMC) for software is a precise bug-finding technique that builds upon the efficiency of modern SAT and SMT solvers. BMC currently does not scale to large programs because the size of the generated formulae exceeds the capacity of existing solvers. We present a new, compositional and property-sensitive algorithm that enables BMC to automatically find bugs in large programs. A novel feature of our technique is to decompose the behaviour of a program into a sequence of BMC instances and use a combination of satisfying assignments and unsatisfiability proofs to propagate information across instances. A second novelty is to use the control-and data-flow of the program as well as information from proofs to prune the set of variables and procedures considered and hence, generate smaller instances. Our tool BLITZ outperforms existing tools and scales to programs with over 100,000 lines of code. BLITZ automatically and efficiently discovers bugs in widely deployed software including new vulnerabilities in Internet infrastructure software.

show abstract

Section: E Evaluation Of Blitz Featuresmentioning

confidence: 99%

BLITZ: Compositional bounded model checking for real-world programs

Cho

D’Silva

Song

2013

2013 28th IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

show abstract

“…There is extensive work on increasing the verification capabilities of TACO . More recently, a framework for test input generation using the TACO infrastructure was proposed .…”

Section: Discussionmentioning

confidence: 99%

Practical JFSL verification using TACO

Chicote¹,

Ciolek²,

Galeotti

2013

Softw Pract Exp

View full text Add to dashboard Cite

SUMMARYTranslation of Annotated COde (TACO) is a SAT‐based tool for bounded verification of Java programs. One challenge many formal tools share is to provide a practical interface for a non‐proficient user. In this article, we present an Eclipse plug‐in for the static verifier TACO. This plug‐in allows a user to walk a counterexample trace mimicking a debugging session. TacoPlug (our plug‐in) uses and extends TACO to provide a better debugging experience. TacoPlug interface allows the user to verify an annotated software using the TACO verifier. If TACO finds a violation to the specification, TacoPlug presents it in terms of the annotated source code. TacoPlug features several views of the error trace to facilitate fault understanding. It resembles any software debugger, but the debugging occurs statically without executing the program. Furthermore, should a dynamic analysis be required, TacoPlug presents the user with a unit test case generated by TACO based on the detected violation. We show the usability of our tool by means of a motivational example taken from a real‐life software error. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

“…[11] introduces an adaptation of the Lazy Initialization mechanism of Symbolic Java PathFinder, that makes use of tight bounds. [18] introduces a dataflow analysis that allows propagating tight bounds to all the states of a program, starting with bounds for the initial state (as those calculated by TACO and our approach). FAJITA [1] is a version of TACO especially tailored for automated test generation.…”

Section: Related Workmentioning

confidence: 99%

Efficient Tight Field Bounds Computation Based on Shape Predicates

Rosner

Aguirre

Frias

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Tight field bounds contribute to verifying the correctness of object oriented programs in bounded scenarios, by restricting the values that fields can take to feasible cases only, during automated analysis. Tight field bounds are computed from formal class specifications. Their computation is costly, and existing approaches use a cluster of computers to obtain the bounds, from declarative (JML) formal specifications. In this article we address the question of whether the language in which class specifications are expressed may a↵ect the e ciency with which tight field bounds can be computed. We introduce a novel technique that generates tight field bounds from data structure descriptions provided in terms of shape predicates, expressed using separation logic. Our technique enables us to compute tight field bounds faster on a single workstation, than the alternative approaches which use a cluster, in wall-clock time terms. Although the computed tight bounds di↵er in the canonical ordering in which data structure nodes are labeled, our computed tight field bounds are also e↵ective. We incorporate the field bounds computed with our technique into a state-of-the-art SAT based analysis tool, and show that, for various case studies, our field bounds allow us to handle scopes in bounded exhaustive analysis comparable to those corresponding to bounds computed with previous techniques.

show abstract

A Dataflow Analysis to Improve SAT-Based Bounded Program Verification

Cited by 5 publications

References 20 publications

BLITZ: Compositional bounded model checking for real-world programs

BLITZ: Compositional bounded model checking for real-world programs

Practical JFSL verification using TACO

Efficient Tight Field Bounds Computation Based on Shape Predicates

Contact Info

Product

Resources

About