SMT-based model checking for recursive programs

Komuravelli, Anvesh; Gurfinkel, Arie; Chaki, Sagar

doi:10.1007/s10703-016-0249-4

Cited by 106 publications

(54 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…F* [Swamy et al 2011] requires local annotations as described in § 2, Mochi [Unno et al 2013] requires no annotations but may diverge, and does not support uninterpreted functions which precludes all of our benchmarks. Similarly, existing Horn Solvers like µZ3 may diverge, while Eldarica [Rümmer et al 2015], HSF [Grebenshchikov et al 2012], and Spacer [Komuravelli et al 2016] do not support uninterpreted functions.…”

Section: Comparison With Other Toolsmentioning

confidence: 99%

Local refinement typing

Cosman

Jhala

2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We introduce the Fusion algorithm for local refinement type inference, yielding a new SMT-based method for verifying programs with polymorphic data types and higher-order functions. Fusion is concise as the programmer need only write signatures for (externally exported) top-level functions and places with cyclic (recursive) dependencies, after which Fusion can predictably synthesize the most precise refinement types for all intermediate terms (expressible in the decidable refinement logic), thereby checking the program without false alarms. We have implemented Fusion and evaluated it on the benchmarks from the LiqidHaskell suite totalling about 12KLOC. Fusion checks an existing safety benchmark suite using about half as many templates as previously required and nearly 2× faster. In a new set of theorem proving benchmarks Fusion is both 10 − 50× faster and, by synthesizing the most precise types, avoids false alarms to make verification possible.

show abstract

Section: Comparison With Other Toolsmentioning

confidence: 99%

Local refinement typing

Cosman

Jhala

2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…For example, giving this clauses to a CHC-solver SPACER [13], we get that the system is satisfiable, and the the safe inductive invariant is…”

Section: Constrained Horn Clausesmentioning

confidence: 99%

“…In principle, any verification engine that digests CHC clauses could be used to discharge the VCs. Currently, SEAHORN employs several SMT-based model checking engines based on PDR/IC3 [16], including SPACER [13], [17] and GPDR [18]. Complementary, SEAHORN uses the abstract interpretation-based analyzer IKOS (Inference Kernel for Open Static Analyzers) [19] for providing numerical invariants.…”

Section: Seahorn Verification Frameworkmentioning

confidence: 99%

Algorithmic Logic-Based Verification with SeaHorn

Gurfinkel

2015

2015 17th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC)

Self Cite

View full text Add to dashboard Cite

In this tutorial, I will present SEAHORN, a software verification framework. The key distinguishing feature of SEA-HORN is its modular design that separates the concerns of the syntax of the programming language, its operational semantics, and the verification semantics. SEAHORN encompasses several novelties: it (a) encodes verification conditions using an efficient yet precise inter-procedural technique, (b) provides flexibility in the verification semantics to allow different levels of precision, (c) leverages the state-of-the-art in software model checking and abstract interpretation for verification, and (d) uses Horn-clauses as an intermediate language to represent verification conditions which simplifies interfacing with multiple verification tools based on Horn-clauses. SEAHORN provides users with a powerful verification tool and provides researchers with an extensible and customizable framework for experimenting with new software verification techniques.

show abstract

“…Further techniques for solving Horn clauses were developed in [26]. Horn clauses are also used as a format for verification problems supported by the SMT solver Z3 [23], generalising the IC3 algorithm; several recent papers propose optimisations of the algorithm by integrating abstraction [29] and under-approximations [28].…”

Section: Related Workmentioning

confidence: 99%

On recursion-free Horn clauses and Craig interpolation

Rümmer

Hojjat

Kunčak

2014

Form Methods Syst Des

View full text Add to dashboard Cite

One of the main challenges in software verification is efficient and precise analysis of programs with procedures and loops. Interpolation methods remain among the most promising techniques for such verification. To accommodate the demands of various programming language features, over the past years several extended forms of interpolation have been introduced. We give a precise ontology of such extended interpolation methods, and investigate the relationship between interpolation and fragments of constrained recursionfree Horn clauses. We also introduce a new notion of interpolation, disjunctive interpolation, which solves a more general class of problems in one step compared to previous notions of interpolants, such as tree interpolants or inductive sequences of interpolants. We present algorithms and complexity for construction of interpolants, as well as the corresponding decision problems for recursion-free Horn fragments. Finally, we give an extensive empirical evaluation using a solver for (recursive) Horn problems, in particular comparing the performance of tree interpolation and disjunctive interpolation for constraints modelling software verification tasks.

show abstract

SMT-based model checking for recursive programs

Cited by 106 publications

References 27 publications

Local refinement typing

Local refinement typing

Algorithmic Logic-Based Verification with SeaHorn

On recursion-free Horn clauses and Craig interpolation

Contact Info

Product

Resources

About