Using First-Order Theorem Provers in the Jahob Data Structure Verification System

Abstract

Abstract. This paper presents our integration of efficient resolution-based theorem provers into the Jahob data structure verification system. Our experimental results show that this approach enables Jahob to automatically verify the correctness of a range of complex dynamically instantiable data structures, including data structures such as hash tables and search trees, without the need for interactive theorem proving or techniques tailored to individual data structures. Our primary technical results include: (1) a translation from higher-order logic to first-order logic that enables the application of resolution-based theorem provers and (2) a proof that eliminating type (sort) information in formulas is both sound and complete, even in the presence of a generic equality operator. Our experimental results show that the elimination of type information dramatically decreases the time required to prove the resulting formulas. These techniques enabled us to verify complex correctness properties of Java programs such as a mutable set implemented as an imperative linked list, a finite map implemented as a functional ordered tree, a hash table with a mutable array, and a simple library system example that uses these container data structures. Our system verifies (in a matter of minutes) that data structure operations correctly update the finite map, that they preserve data structure invariants (such as ordering of elements, membership in appropriate hash table buckets, or relationships between sets and relations), and that there are no run-time errors such as null dereferences or array out of bounds accesses.

Translating Higher-Order Clauses to First-Order Clauses

“…SPASS ran with SOS enabled and splitting disabled. 4 Although SOS makes SPASS incomplete, it greatly improves SPASS's success rate for our problems by making the proof search more goal-directed. Vampire ran with its CASC option, which is highly effective.…”

“…Bouillaguet et al [4] have developed a translation from higher-order logic to first-order logic. They eliminate type information and have proved this to be sound and complete.…”

Correct Code Containing Containers

“…There are two important, complementary areas in this domain: certifying user code that uses containers while assuming that their implementation complies with their specification (what we are doing) and certifying that an implementation of containers indeed complies with its specifications. On the one hand, Bouillaguet et al [7] focus on verifying that a container's implementation indeed complies with its specifications. They use resolution based first-order theorem provers to verify that the invariants of data structures such as sets and maps are preserved when considering operations on their encodings as arrays and trees.…”

Shape Analysis of Low-Level C with Overlapping Structures

“…Approaches based on regular model checking [5], symbolic backwards reachability analysis [1], or decision procedures such as [6] seem not to have dealt with the analysis of low-level system code, much less with overlapping records. There are a number of approaches that make use of numeric reasoning to deal with pointer arithmetic.…”