HSF(C): A Software Verifier Based on Horn Clauses

Abstract

Abstract. HSF(C) is a tool that automates verification of safety and liveness properties for C programs. This paper describes the verification approach taken by HSF(C) and provides instructions on how to install and use the tool. Verification ApproachHSF(C) is a tool for verification of C programs based on predicate abstraction and refinement following the counterexample-guided abstraction refinement (CEGAR) paradigm [4]. There are a number of successful tools [1,7,5,10,2] based on abstraction refinement. We give here a brief description of our verification algorithm; interested readers can find more details about the underlying theory behind our implementation in [10,6].The algorithm used in HSF(C) is a generalization of the CEGAR scheme that deals with Horn-like clauses instead of transition systems/programs with procedures. We use Horn clauses to represent both the program to be verified and the proof rule used for verification, i.e., safety checking for programs with procedures. The proof rule lists premises for program safety and requires auxiliary assertions that represent inductive invariants. Given Horn clauses as input, our algorithm proceeds in three steps.1. With a fixed set of predicates, initially empty, we find a solution for the auxiliary assertions. At this step we perform logical inference and rely on abstraction to ensure termination in the presence of recursion and to ensure efficiency in the presence of large sets of clauses. 2. We check whether the computed solution satisfies program safety. If so, the verification succeeds and the algorithm returns "safe". 3. We check whether the logical inference performed in the first step in the setting without any abstraction yields a solution that still violates program safety. If the violation is still present then we return "unsafe" and the inference tree as an error path that reaches the error location. Otherwise, we use the obtained solution to refine the abstraction function and go back to the first step.

Minimal-Model-Guided Approaches to Solving Polynomial Constraints and Extensions

“…The second benchmark suite consists of 36 examples of SMT(NIA) generated by the QArmc-Hsf(c) tool [38], a predicate-abstraction-based model checker with a special focus on liveness properties. In these problems all variables are integer, and monomi- Table 2 and follow the same format as in Table 1.…”

Abstraction refinement guided by a learnt probabilistic model

“…Our work builds on a large amount of research for automatically finding good program abstraction, such as CEGAR [4, 7-9, 20, 45], parametric static analysis with parameter search algorithms [29,40,55,56], and static analysis based on Datalog or Horn solvers [6,16,17,49,53]. The novelty of our work lies in the use of adding a bias in this abstraction search using a probabilistic model, which predicts the behaviour of the static analysis under different abstractions.…”

Linux Driver Verification

“…Due to the progress in SMT solving, formula-based symbolic representations of abstract states are nowadays effective and efficient. Microsoft's Sdv and Slam [1], and several current research tools are based on predicate abstraction [5,8,12,18]. Several tool implementations integrate the concepts of counterexample-guided abstract refinement (CEGAR) [11], various kinds of shape analysis, abstract reachability trees [5], lazy abstraction [21], interpolation [20], and large-block encoding [4,9].…”