Scaling Bounded Model Checking by Transforming Programs with Arrays

Jana, Anushri; Khedker, Uday P.; Datar, Advaita; Venkatesh, R.; Niyas, C

doi:10.1007/978-3-319-63139-4_16

Cited by 8 publications

(5 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are also techniques that abstract an array to a fixed number of elements, e.g. k-distinguished cell abstraction [32,33] and k-shrinkability [24,29]. Such abstractions usually reduce array modifying loops with unknown bounds to a known, small bound.…”

Section: Related Workmentioning

confidence: 99%

Quantified Invariants via Syntax-Guided Synthesis

Fedyukovich

Prabhu

Madhukar

et al. 2019

Computer Aided Verification

View full text Add to dashboard Cite

Programs with arrays are ubiquitous. Automated reasoning about arrays necessitates discovering properties about ranges of elements at certain program points. Such properties are formally specified by universally quantified formulas, which are difficult to find, and difficult to prove inductive. In this paper, we propose an algorithm based on an enumerative search that discovers quantified invariants in stages. First, by exploiting the program syntax, it identifies ranges of elements accessed in each loop. Second, it identifies potentially useful facts about individual elements and generalizes them to hypotheses about entire ranges. Finally, by applying recent advances of SMT solving, the algorithm filters out wrong hypotheses. The combination of properties is often enough to prove that the program meets a safety specification. The algorithm has been implemented in a solver for Constrained Horn Clauses, Freq-Horn, and extended to deal with multiple (possibly nested) loops. We show that FreqHorn advances state-of-the-art on a wide range of public array-handling programs.

show abstract

Section: Related Workmentioning

confidence: 99%

Quantified Invariants via Syntax-Guided Synthesis

Fedyukovich

Prabhu

Madhukar

et al. 2019

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…Our motivating examples are based on synthesizing invariants for arrays. However, there are methods for verifying array programs without using loop invariants: Abstraction of the array to a fixed number of elements is used to reduce array modifying loops with unknown bounds to loops with a known, small bound [16,22,25]. An imprecise approach involves abstracting the array so that all array elements appear in a single memory location [4].…”

Section: Related Workmentioning

confidence: 99%

SynRG: Syntax Guided Synthesis of Expressions with Alternating Quantifiers

Polgreen,

Seshia

2020

Preprint

View full text Add to dashboard Cite

Proving properties of systems frequently requires the user to provide hand-written invariants and pre-and post-conditions. A significant body of work exists attempting to automate the generation of loop invariants in code, but the state of the art cannot yet tackle the combination of quantifiers and potentially unbounded data structures. We present SynRG, a synthesis algorithm based on restricting the synthesis problem to generate candidate solutions with quantification over a finite domain, and then generalizing these candidate solutions to the unrestricted domain of the original specification. We give an exemplar of our method that generates invariants with quantifiers over array indices. Our algorithm is, in principle, able to synthesize predicates with arbitrarily many levels of alternating quantification. We report experiments that require invariants with one alternation that are already out of reach of all existing solvers.

show abstract

“…A method that is properly subsumed by our method is [18]. This uses only one distinguished element called a witness element, and transforms a program to a loop free scalar program.…”

Section: Related Workmentioning

confidence: 99%

“…This is, in general, difficult because such programs have huge, at times infinite state space. So while static analysis techniques like array smashing and partitioning [4,5,11,14,16,17] fail due to abstractions that are too coarse, attempts with bounded model checkers or theorem provers that are equipped with array theories [3,8,9,15,18,22,23] tend to fail for lack of scalability or their inability to synthesize the right quantified invariants.…”

Section: Introductionmentioning

confidence: 99%

Property Checking Array Programs Using Loop Shrinking

Sanyal

Venkatesh

Shah

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Most verification tools find it difficult to prove properties of programs containing loops that process arrays of large or unknown size. These methods either fail to abstract the array at the right granularity and are therefore limited in precision or scalability, or they attempt to synthesize an appropriate invariant that is quantified over the elements of the array, a task known to be difficult. In this paper, we present a different approach based on a notion called loop shrinkability, in which an array processing loop is transformed to a loop of much smaller bound that processes only a few non-deterministically chosen elements of the array. The result is a finite state program with a drastically reduced state space that can be analyzed by bounded model checkers. We show that the proposed transformation is an over-approximation, i.e. if the transformed program is correct, so is the original. In addition, when applicable, the method is impervious to the size or existence of the bound of the array. As an assessment of usefulness, we tested a tool based on our method on the ArraysReach category of SV-COMP 2017 benchmarks. After excluding programs with feature not handled by our tool, we could successfully verify 87 of the 93 remaining programs.

show abstract

Scaling Bounded Model Checking by Transforming Programs with Arrays

Cited by 8 publications

References 36 publications

Quantified Invariants via Syntax-Guided Synthesis

Quantified Invariants via Syntax-Guided Synthesis

SynRG: Syntax Guided Synthesis of Expressions with Alternating Quantifiers

Property Checking Array Programs Using Loop Shrinking

Contact Info

Product

Resources

About