Craig vs. Newton in software model checking

Dietsch, Daniel; Heizmann, Matthias; Musa, Betim; Nutz, Alexander; Podelski, Andreas

doi:10.1145/3106237.3106307

Cited by 11 publications

(12 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ultimate Automizer. Ultimate Automizer (or UAutomizer) is a software model checker that uses an automata-based verification approach [33], [34], [35]. We used version 0.1.23.…”

Section: B Program Analyzersmentioning

confidence: 99%

Differentially testing soundness and precision of program analyzers

Klinger

Christakis

Wüstholz³

2019

Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

In the last decades, numerous program analyzers have been developed both by academia and industry. Despite their abundance however, there is currently no systematic way of comparing the effectiveness of different analyzers on arbitrary code. In this paper, we present the first automated technique for differentially testing soundness and precision of program analyzers. We used our technique to compare six mature, state-ofthe art analyzers on tens of thousands of automatically generated benchmarks. Our technique detected soundness and precision issues in most analyzers, and we evaluated the implications of these issues to both designers and users of program analyzers.

show abstract

“…Ultimate Automizer. Ultimate Automizer (or UAutomizer) is a software model checker that uses an automata-based verification approach [33], [34], [35]. We used version 0.1.23.…”

Section: B Program Analyzersmentioning

confidence: 99%

Differentially testing soundness and precision of program analyzers

Klinger

Christakis

Wüstholz³

2019

Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

show abstract

“…SMT solvers for which by Ultimate provides an interface include SMTInterpol [4], Z3 [18], CVC4 [2], and MathSat [5]. In cases when a solver does not support interpolation in the given constraint theory, but can produce unsatisfiable cores, Newton-style interpolation [8] can be used to obtain interpolants.…”

Section: Approachmentioning

confidence: 99%

Ultimate TreeAutomizer (CHC-COMP Tool Description)

Dietsch

Heizmann

Hoenicke

et al. 2019

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

We present Ultimate TreeAutomizer, a solver for satisfiability of sets of constrained Horn clauses. Constrained Horn clauses (CHC) are a fragment of first order logic with attractive properties in terms of expressiveness and accessibility to algorithmic solving. Ultimate TreeAutomizer is based on the techniques of trace abstraction, tree automata and tree interpolation. This paper serves as a tool description for TreeAutomizer in CHC-COMP 2019.

show abstract

“…These interpolants are "good enough" to ensure that in the refinement step all (spurious) error traces of the path program are ruled out. Trace focused techniques (Craig interpolation, symbolic execution with unsatisfiable cores [4]). These techniques consider only the trace.…”

Section: Verification Approachmentioning

confidence: 99%

“…Several SMT solvers have implemented algorithms for Craig interpolation and we use these as a black box. Furthermore, Ultimate provides an algorithm [4] to construct an abstraction of the trace from an unsatisfiable core provided by an SMT solver. Afterwards, two sequences of predicates, one with the sp predicate transformer, the other with the wp predicate transformer, are constructed via symbolic execution.…”

Section: Path Program Focused Techniques (Abstract Interpretationmentioning

confidence: 99%

Ultimate Automizer and the Search for Perfect Interpolants

Heizmann

Chen

Dietsch

et al. 2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Ultimate Automizer is a software verifier that generalizes proofs for traces to proofs for larger parts for the program. In recent years the portfolio of proof producers that are available to Ultimate has grown continuously. This is not only because more trace analysis algorithms have been implemented in Ultimate but also due to the continuous progress in the SMT community. In this paper we explain how Ultimate Automizer dynamically selects trace analysis algorithms and how the tool decides when proofs for traces are "good" enough for using them in the abstraction refinement. Verification ApproachUltimate Automizer (in the following called Automizer) is a software verifier that is able to check safety and liveness properties. The tool implements an automata-based [6] instance of the CEGAR scheme. In each iteration, we pick a trace (which is a sequence of statements) that leads from the initial location to the error location and check whether the trace is feasible (i.e., corresponds to an execution) or infeasible. If the trace is feasible, we report an error to the user; otherwise we compute a sequence of predicates along the trace as a proof of the trace's infeasibility. We call such a sequence of predicates a sequence of interpolants since each predicate "interpolates" between the set of reachable states and the set of states from which we cannot reach the error. In the refinement step of the CEGAR loop, we try to find all traces whose infeasibility can be shown with the given predicates and subtract these traces from the set of (potentially spurious) error traces that have not yet been analyzed. We use automata to represent sets of traces; hence the subtraction is implemented as an automata operation. The major difference to a classical CEGAR-based predicate abstraction is that we never have to do any logical reasoning (e.g., SMT solver calls) that involves predicates of different CEGAR iterations.We use this paper to explain how our tool obtains the interpolants that are used in the refinement step. The Ultimate program analysis framework

show abstract

Craig vs. Newton in software model checking

Cited by 11 publications

References 34 publications

Differentially testing soundness and precision of program analyzers

Differentially testing soundness and precision of program analyzers

Ultimate TreeAutomizer (CHC-COMP Tool Description)

Ultimate Automizer and the Search for Perfect Interpolants

Contact Info

Product

Resources

About