Predator: A Practical Tool for Checking Manipulation of Dynamic Data Structures Using Separation Logic

Abstract

Predator is a new open source tool for verification of sequential C programs with dynamic linked data structures. The tool is based on separation logic with inductive predicates although it uses a graph description of heaps. Predator currently handles various forms of lists, including singly-linked as well as doubly-linked lists that may be circular, hierarchically nested and that may have various additional pointer links. Predator is implemented as a gcc plug-in and it is capable of handling lists in the form they appear in real system code, especially the Linux kernel, including a limited support of pointer arithmetic. Collaboration on further development of Predator is welcome. This work was supported by the Czech Science Foundation (project P103/10/0306), the Czech Ministry of Education (projects COST OC10009 and MSM 0021630528), and the BUT FIT project FITS -11-1. An extended version of the paper is available as the technical report [6].

CPAlien: Shape Analyzer for CPAChecker

“…CPALIEN is an offspring of the successful Predator shape analyzer [1]. Predator implements a sound shape analysis of programs manipulating list-like data structures of various kinds.…”

Model checking for symbolic-heap separation logic with inductive predicates

“…Given a program annotated with separation logic assertions, one can try to prove statically that each assertion holds at the appropriate program point; a long line of research in this area has resulted in a number of tools that are capable of doing this automatically at least some of the time for industrial code (see e.g. [7,8,14,16,19,24,28]). Alternatively, one might also try to test dynamically whether properties hold: simply execute the program and check whether each assertion is satisfied by the actual memory state of the program at that point (this is sometimes known as run-time verification).…”

“…However, the logic itself has attracted considerable recent interest amongst the verification community. The aforementioned automated program verification tools based on separation logic [7,8,14,16,19,24,28] are all based on symbolic heaps, and increasingly targeted at verifying specifications involving user-defined rather than hard-coded predicates. Indeed, there are now even tools capable of automatically generating the definitions of inductive predicates needed for analysis [11,25].…”

Automating Separation Logic Using SMT

“…The frame rule makes separation logic attractive for developers of program verification tools [6,8,19,21,36]. However, the logic also poses a challenge to automation: it is a non-classical logic that requires specialized symbolic execution engines for encoding the behavior of programs, and specialized theorem provers for discharging the generated proof obligations.…”