Having a BLAST with SLAM

Size: px
Start display at page:

Download "Having a BLAST with SLAM"

Transcription

1 Having a BLAST with SLAM Meeting, CSCI 555, Fall 20 Announcements Homework 0 due Sat Questions? Move Tue office hours to -5pm 2

2 Software Model Checking via Counterexample Guided Abstraction Refinement There are easily dozens of papers. We will skim. SLAM Overview/Review Input: Program and Specification ( procedures Standard C Program (pointers, Specification = Partial Correctness ( typestate ) Given as a finite state machine I use s correctly, not I am a webserver Output: Verified or Counterexample Verified = program does not violate spec Can come with proof! Counterexample = concrete bug instance A path through the program that violates the spec 2

3 SLAM Overview Input: Program and Specification ( procedures Standard C Program (pointers, Specification = Partial Correctness ( typestate ) Given as a finite state machine I use s correctly, not I am a webserver Output: Verified or Counterexample Verified = program does not violate spec Can come with proof! Counterexample = concrete bug instance A path through the program that violates the spec 5 Take-Home Message SLAM is a software model checker. It abstracts C programs to boolean programs and model-checks the boolean programs. No errors in the boolean program implies no errors in the original. An error in the boolean program may be a real bug. Or SLAM may refine the abstraction and start again. 6

4 Property : Double Locking un un An attempt to re-acquire an acquired or release a released will cause a dead. Calls to and un must alternate. 7 Property 2: Drop Root Privilege [Chen-Wagner-Dean 02] User applications must not run with root privilege When execv is called, must have suid 0 8

5 Property : IRP Handler IRP accessible MPR start NP synch not pending returned CallDriver MPR2 MPR NP MPR completion Skip prop completion no prop completion SKIP CallDriver SKIP2 PPC N/A CallDriver CallDriver Complete request CallDriver IPC DC N/A synch return child status return not Pend MPR2 MPR CallDriver start P synch not pending returned MPR NP MPR completion Mark Pending Skip prop completion no prop completion CallDriver SKIP SKIP2 PPC N/A CallDriver CallDriver Complete request IPC CallDriver DC return Pending [Fahndrich] 9 Example SLAM Input : do{ : q->data = new; un : while(new!= old); 5: un return; un un 0 5

6 SLAM in a Nutshell SLAM(Program p, Spec s) = Program q = incorporate_spec(p,s); // slic PredicateSet abs = { ; while true do BooleanProgram b = abstract(q,abs); // c2bp match model_check(b) with // bebop No_Error! print( no bug ); exit(0) Counterexample(c)! if is_valid_path(c, p) then // newton print( real bug ); exit() else abs à abs [ new_preds(c) // newton done Incorporating Specs : do{ : q->data = new; un : while(new!= old); 5: un return; Ideas? un 0 un ERR #2 6

7 Incorporating Specs : do{ : q->data = new; un : while(new!= old); 5: un return; un 0 un ERR : do{ if L= goto ERR; else L=; : q->data = new; if L=0 goto ERR; else L=0; : while(new!= old); 5: if L=0 goto ERR; else L=0; return; ERR: abort(); Original program violates spec iff new program reaches ERR # Program As Labeled Transition System State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa : do{ : q->data = new; un : while(new!= old); 5: un return; 7

8 The Safety Verification Problem Error (e.g., states with PC = Err) Safe States (never reach Error) Initial Is there a path from an initial to an error state? Problem? Infinite state graph (old=, old=2, old= ) Solution? Set of states ' logical formula 5 Representing [Sets of States] as Formulas [F] states satisfying F {s s ² F F FO formula over program vars [F ] Å [F 2 ] F Æ F 2 [F ] [ [F 2 ] [F] [F ] µ [F 2 ] 6 i.e. F Æ F 2 unsatisfiable 8

9 Representing [Sets of States] as Formulas [F] states satisfying F {s s ² F F FO formula over program vars [F ] Å [F 2 ] F Æ F 2 [F ] [ [F 2 ] F Ç F 2 [F] F [F ] µ [F 2 ] F ) F 2 7 i.e. F Æ F 2 unsatisfiable Idea : Predicate Abstraction Predicates on program state: (i.e., =true) old = new States satisfying same predicates are equivalent Merged into one abstract state Why? Num of abstract states is finite Thus model-checking the abstraction will be feasible! 8 9

10 Abstract States and Transitions State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa Theorem Prover old=new old=new 9 Abstraction State c Transition c 2 pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa A A Theorem Prover 2 old=new Existential Lifting (i.e., A!A 2 iff 9c 2A. 9c 2 2A 2. c!c 2 ) old=new 20 0

11 Abstraction State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa Theorem Prover old=new old=new 2 Analyze Abstraction Analyze finite graph Over Approximate Safe ) System Safe No false negatives Problem Spurious counterexamples false positives 22

12 Idea 2: Counterexample-Guided Refinement Solution Use spurious counterexamples to refine abstraction! 2 Idea 2: Counterexample-Guided Refinement Solution Use spurious counterexamples to refine abstraction!. Add predicates to distinguish states across cut 2. Build refined abstraction Imprecision due to merge 2 2

13 Iterative Abstraction-Refinement Solution Use spurious counterexamples to refine abstraction! [Kurshan et al 9] [Clarke et al 00] [Ball-Rajamani 0]. Add predicates to distinguish states across cut 2. Build refined abstraction eliminates counterexample. Repeat search until real counterexample or system proved safe 25 Problem: Abstraction is Expensive Why? Reachable Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Observe Fraction of state space reachable #Preds ~ 00 s, #States ~ 2 00, #Reach ~ 000 s 26

14 Solution: Only Abstract Reachable States Safe Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Build abstraction during search 27 Solution2: Don t Refine Error-Free Regions Error Free Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Don t refine error-free regions 28

15 29 Key Idea for Solutions? 0 5

16 Key Idea: Initial 2 Unroll Abstraction. Pick tree-node (=abs. state) 2. Add children (=abs. successors). On re-visiting abs. state, cut-off 5 Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Error Free 2 6

17 Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix 8 - Learn new predicates - Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un Predicates: LOCK 7

18 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un () old = new q=q->next 2 LOCK 2 Predicates: LOCK 5 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un [q!=null] 2 LOCK LOCK 2 Predicates: LOCK 6 8

19 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un q->data = new () un new++ 2 LOCK LOCK 2 Predicates: LOCK 7 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK [new==old] Predicates: LOCK 8 9

20 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK 5 un() 2 Predicates: LOCK 5 9 Analyze Counterexample : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK () old = new q=q->next [q!=null] q->data = new () un new++ [new==old] 5 5 un() 2 Predicates: LOCK 0 20

21 Analyze Counterexample : do{ : q->data = new; un :while(new!= old); 5:un 2 5 Predicates: LOCK old = new 2 LOCK LOCK new++ [new==old] 5 Inconsistent new == old Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un Predicates: LOCK, new == old 2 2

22 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 () old = new q=q->next 2 Predicates: LOCK, new == old Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old q->data = new () un new++ 2 Predicates: LOCK, new == old 22

23 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old [new==old] 2 Predicates: LOCK, new == old 5 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old [new!=old] 2 Predicates: LOCK, new == old, new == old 6 2

24 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old LOCK, new==old 2 SAFE, new = old LOCK, new=old 5, new == old 5 2 Predicates: LOCK, new == old, new==old 7 Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates 8 - Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions 8 2

25 Two Handwaves : do{ : q->data = new; un LOCK, new==old 2 Q. How to compute successors? :while(new!= old); 5:un Q. How to find predicates 5? 5, new == old 2 Predicates: LOCK, new==old old LOCK, new==old, new = old Refinement q->data = new () un new++ LOCK, new=old, new==old SAFE 9 Two Handwaves : do{ : q->data = new; un LOCK, new==old 2 Q. How to compute successors? :while(new!= old); 5:un LOCK, new==old, new = old q->data = new () un new++ LOCK, new=old SAFE 5 2 Predicates: LOCK, new == old, new == old 5, new==old 50 25

26 Weakest Preconditions WP(P,OP) Weakest formula P s.t. if P is true before OP then P is true after OP OP [WP(P, OP)] [P] 5 Weakest Preconditions More on this later in the semester! WP(P,OP) Weakest formula P s.t. if P is true before OP then P is true after OP OP [WP(P, OP)] [P] P[e/x] new+ = old Assign x = e P new = old new = new

27 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old, new == old OP For each p Check if p is true (or false) after OP Q: When is p true after OP? - If WP(p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F ) WP(p, OP) F? Predicates: LOCK, new == old 5 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old OP For each p Check if p is true (or false) after OP Q: When is p false after OP? - If WP( p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F ) WP( p, OP) F? Predicates: LOCK, new == old 5 27

28 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un Predicate: new == old True? False? LOCK, new==old LOCK, new == old OP For each p Check if p is true (or false) after OP Q: When is p false after OP? - If WP( p, OP) is true before OP! - We know F is true before OP (LOCK, new==old) ) (new + = old) (LOCK, new==old) ) (new + old) - Thm. Pvr. Query: F ) WP( p, OP) NO YES F? 55 Advanced SLAM/BLAST Too Many Predicates - Use Predicates Locally Counter-Examples - Craig Interpolants Procedures - Summaries Concurrency - Thread-Context Reasoning 56 28

29 SLAM Summary ) Instrument Program With Safety Policy 2) Predicates = { ) Abstract Program With Predicates Use Weakest Preconditions and Theorem Prover Calls ) Model-Check Resulting Boolean Program Use Symbolic Model Checking 5) Error State Not Reachable? Original Program Has No Errors: Done! 6) Check Counterexample Feasibility Use Symbolic Execution 7) Counterexample Is Feasible? Real Bug: Done! 8) Counterexample Is Not Feasible? ) Find New Predicates (Refine Abstraction)" 2) Goto Line 57 Bonus: SLAM/BLAST Weakness : F() { 2: int x=0; : : x++; 5: while (x 88); ( 77 < (x 6: if 7: 8: Preds = {, Path = 2567 [x=0, x+ 88, x+<77] Preds = {x=0, Path = 2567 [x=0, x+ 88, x+<77] Preds = {x=0, x+=88 Path = [x=0, x+2 88, x+2<77] Preds = {x=0,x+=88,x+2=88 Path = Result: the predicates count the loop iterations 58 29

30 For Next Time Post about today s class and reading 59 0

Having a BLAST with SLAM

Having a BLAST with SLAM Having a BLAST with SLAM # #2 Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement There are easily two dozen SLAM/BLAST/MAGIC papers; I will skim. #3 SLAM Overview INPUT: Program

More information

Having a BLAST with SLAM

Having a BLAST with SLAM Having a BLAST with SLAM # #2 Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement There are easily two dozen SLAM/BLAST/MAGIC papers; I will skim. #3 SLAM Overview INPUT: Program

More information

Having a BLAST with SLAM

Having a BLAST with SLAM Announcements Having a BLAST with SLAM Meetings -, CSCI 7, Fall 00 Moodle problems? Blog problems? Looked at the syllabus on the website? in program analysis Microsoft uses and distributes the Static Driver

More information

Scalable Program Verification by Lazy Abstraction

Scalable Program Verification by Lazy Abstraction Scalable Program Verification by Lazy Abstraction Ranjit Jhala U.C. Berkeley ars, July, 997 Lost contact due to real-time priority inversion bug ars, December, 999 Crashed due to uninitialized variable

More information

Software Model Checking with Abstraction Refinement

Software Model Checking with Abstraction Refinement Software Model Checking with Abstraction Refinement Computer Science and Artificial Intelligence Laboratory MIT Armando Solar-Lezama With slides from Thomas Henzinger, Ranjit Jhala and Rupak Majumdar.

More information

CS 510/13. Predicate Abstraction

CS 510/13. Predicate Abstraction CS 50/3 Predicate Abstraction Predicate Abstraction Extract a finite state model from an infinite state system Used to prove assertions or safety properties Successfully applied for verification of C programs

More information

Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement. Having a BLAST with SLAM. Combining Strengths. SLAM Overview SLAM

Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement. Having a BLAST with SLAM. Combining Strengths. SLAM Overview SLAM Hving BLAST with SLAM Topic: Softwre Model Checking vi Counter-Exmple Guided Abstrction Refinement There re esily two dozen SLAM/BLAST/MAGIC ppers; I will skim. # # Theorem Proving Combining Strengths

More information

Software Model Checking. Xiangyu Zhang

Software Model Checking. Xiangyu Zhang Software Model Checking Xiangyu Zhang Symbolic Software Model Checking CS510 S o f t w a r e E n g i n e e r i n g Symbolic analysis explicitly explores individual paths, encodes and resolves path conditions

More information

Double Header. Two Lectures. Flying Boxes. Some Key Players: Model Checking Software Model Checking SLAM and BLAST

Double Header. Two Lectures. Flying Boxes. Some Key Players: Model Checking Software Model Checking SLAM and BLAST Model Checking #1 Double Header Two Lectures Model Checking Software Model Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation

More information

Predicate Abstraction Daniel Kroening 1

Predicate Abstraction Daniel Kroening 1 Predicate Abstraction 20.1.2005 Daniel Kroening 1 Motivation Software has too many state variables State Space Explosion Graf/Saïdi 97: Predicate Abstraction Idea: Only keep track of predicates on data

More information

Counterexample Guided Abstraction Refinement in Blast

Counterexample Guided Abstraction Refinement in Blast Counterexample Guided Abstraction Refinement in Blast Reading: Checking Memory Safety with Blast 17-654/17-754 Analysis of Software Artifacts Jonathan Aldrich 1 How would you analyze this? * means something

More information

Static Program Analysis

Static Program Analysis Static Program Analysis Thomas Noll Software Modeling and Verification Group RWTH Aachen University https://moves.rwth-aachen.de/teaching/ws-1617/spa/ Schedule of Lectures Jan 17/19: Interprocedural DFA

More information

No model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine

No model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine No model may be available Programmer Software Abstractions Tests Coverage Code Abhik Roychoudhury CS 5219 National University of Singapore Testing Debug Today s lecture Abstract model (Boolean pgm.) Desirable

More information

On Reasoning about Finite Sets in Software Checking

On Reasoning about Finite Sets in Software Checking On Reasoning about Finite Sets in Software Model Checking Pavel Shved Institute for System Programming, RAS SYRCoSE 2 June 2010 Static Program Verification Static Verification checking programs against

More information

Verifying Multithreaded Software with Impact

Verifying Multithreaded Software with Impact Verifying Multithreaded Software with Impact Björn Wachter, Daniel Kroening and Joël Ouaknine University of Oxford Intro Multi-threading C/C++ with POSIX/WIN 32 threads event processing, device drivers,

More information

Predicate Refinement Heuristics in Program Verification with CEGAR

Predicate Refinement Heuristics in Program Verification with CEGAR Predicate Refinement Heuristics in Program Verification with CEGAR Tachio Terauchi (JAIST) Part of this is joint work with Hiroshi Unno (U. Tsukuba) 1 Predicate Abstraction with CEGAR Iteratively generate

More information

Software Model Checking. From Programs to Kripke Structures

Software Model Checking. From Programs to Kripke Structures Software Model Checking (in (in C or or Java) Java) Model Model Extraction 1: int x = 2; int y = 2; 2: while (y

More information

Proofs from Tests. Nels E. Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons, SaiDeep Tetali, Aditya V. Thakur

Proofs from Tests. Nels E. Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons, SaiDeep Tetali, Aditya V. Thakur 1 Proofs from Tests Nels E. Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons, SaiDeep Tetali, Aditya V. Thakur Abstract We present an algorithm DASH to check if a program P satisfies a safety

More information

4/24/18. Overview. Program Static Analysis. Has anyone done static analysis? What is static analysis? Why static analysis?

4/24/18. Overview. Program Static Analysis. Has anyone done static analysis? What is static analysis? Why static analysis? Overview Program Static Analysis Program static analysis Abstract interpretation Static analysis techniques 2 What is static analysis? The analysis to understand computer software without executing programs

More information

F-Soft: Software Verification Platform

F-Soft: Software Verification Platform F-Soft: Software Verification Platform F. Ivančić, Z. Yang, M.K. Ganai, A. Gupta, I. Shlyakhter, and P. Ashar NEC Laboratories America, 4 Independence Way, Suite 200, Princeton, NJ 08540 fsoft@nec-labs.com

More information

Model Checking with Abstract State Matching

Model Checking with Abstract State Matching Model Checking with Abstract State Matching Corina Păsăreanu QSS, NASA Ames Research Center Joint work with Saswat Anand (Georgia Institute of Technology) Radek Pelánek (Masaryk University) Willem Visser

More information

Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification

Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification Aws Albarghouthi 1, Yi Li 1, Arie Gurfinkel 2, and Marsha Chechik 1 1 Department of Computer Science, University of Toronto,

More information

Using Counterexample Analysis to Minimize the Number of Predicates for Predicate Abstraction

Using Counterexample Analysis to Minimize the Number of Predicates for Predicate Abstraction Using Counterexample Analysis to Minimize the Number of Predicates for Predicate Abstraction Thanyapat Sakunkonchak, Satoshi Komatsu, and Masahiro Fujita VLSI Design and Education Center, The University

More information

Software Model Checking with SLAM

Software Model Checking with SLAM Software Model Checking with SLAM Thomas Ball Software Reliability Research MSR Redmond Sriram K. Rajamani Reliable Software Engineering MSR Bangalore http://research.microsoft.com/slam/ People behind

More information

More on Verification and Model Checking

More on Verification and Model Checking More on Verification and Model Checking Wednesday Oct 07, 2015 Philipp Rümmer Uppsala University Philipp.Ruemmer@it.uu.se 1/60 Course fair! 2/60 Exam st October 21, 8:00 13:00 If you want to participate,

More information

Formal Systems Tutorial Hybrid System Modeling, Program Analysis

Formal Systems Tutorial Hybrid System Modeling, Program Analysis Formal Systems Tutorial Hybrid System Modeling, Program Analysis Department of Computer Science & Engineering, Indian Institute of Technology, Kharagpur 1. There are three taps in the system, namely Tap-1

More information

Outline. Introduction SDV Motivation Model vs Real Implementation SLIC SDVRP SLAM-2 Comparisons Conclusions

Outline. Introduction SDV Motivation Model vs Real Implementation SLIC SDVRP SLAM-2 Comparisons Conclusions Outline Introduction SDV Motivation Model vs Real Implementation SIC SDVRP SAM-2 Comparisons Conclusions SDV Research Platform Academic release of SDV (Static Driver Verifier), based on the code that ships

More information

CS 267: Automated Verification. Lecture 13: Bounded Model Checking. Instructor: Tevfik Bultan

CS 267: Automated Verification. Lecture 13: Bounded Model Checking. Instructor: Tevfik Bultan CS 267: Automated Verification Lecture 13: Bounded Model Checking Instructor: Tevfik Bultan Remember Symbolic Model Checking Represent sets of states and the transition relation as Boolean logic formulas

More information

Program Static Analysis. Overview

Program Static Analysis. Overview Program Static Analysis Overview Program static analysis Abstract interpretation Data flow analysis Intra-procedural Inter-procedural 2 1 What is static analysis? The analysis to understand computer software

More information

The software model checker BLAST

The software model checker BLAST Int J Softw Tools Technol Transfer (2007) 9:505 525 DOI 10.1007/s10009-007-0044-z SPECIAL SECTION FASE 04/ 05 The software model checker BLAST Applications to software engineering Dirk Beyer Thomas A.

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember: just do the counterexample guided abstraction refinement part of DPLL(T). If you notice any other errors, those are good

More information

Sliced Path Prefixes: An Effective Method to Enable Refinement Selection

Sliced Path Prefixes: An Effective Method to Enable Refinement Selection FORTE '15 Sliced Path Prefixes: An Effective Method to Enable Refinement Selection Dirk Beyer, Stefan Löwe, Philipp Wendler SoSy-Lab Software Systems We want Refinement Selection!!! Because straight-forward

More information

TRACER: A Symbolic Execution Tool for Verification

TRACER: A Symbolic Execution Tool for Verification TRACER: A Symbolic Execution Tool for Verification Joxan Jaffar, Vijayaraghavan Murali, Jorge A. Navas, and Andrew E. Santosa 3 National University of Singapore The University of Melbourne 3 University

More information

Proofs from Tests. Sriram K. Rajamani. Nels E. Beckman. Aditya V. Nori. Robert J. Simmons.

Proofs from Tests. Sriram K. Rajamani. Nels E. Beckman. Aditya V. Nori. Robert J. Simmons. Proofs from Tests Nels E. Beckman Carnegie Mellon University nbeckman@cs.cmu.edu Aditya V. Nori Microsoft Research India adityan@microsoft.com Robert J. Simmons Carnegie Mellon University rjsimmon@cs.cmu.edu

More information

Finite State Verification. CSCE Lecture 14-02/25/2016

Finite State Verification. CSCE Lecture 14-02/25/2016 Finite State Verification CSCE 747 - Lecture 14-02/25/2016 So, You Want to Perform Verification... You have a property that you want your program to obey. Great! Let s write some tests! Does testing guarantee

More information

Towards a Software Model Checker for ML. Naoki Kobayashi Tohoku University

Towards a Software Model Checker for ML. Naoki Kobayashi Tohoku University Towards a Software Model Checker for ML Naoki Kobayashi Tohoku University Joint work with: Ryosuke Sato and Hiroshi Unno (Tohoku University) in collaboration with Luke Ong (Oxford), Naoshi Tabuchi and

More information

Introduction. Preliminaries. Original IC3. Tree-IC3. IC3 on Control Flow Automata. Conclusion

Introduction. Preliminaries. Original IC3. Tree-IC3. IC3 on Control Flow Automata. Conclusion .. Introduction Preliminaries Original IC3 Tree-IC3 IC3 on Control Flow Automata Conclusion 2 of 22 Lifting IC3 to Control Flow Automata Tim Lange tim.lange@cs.rwth-aachen.de Introduction Preliminaries

More information

Symbolic Evaluation/Execution

Symbolic Evaluation/Execution Symbolic Evaluation/Execution Reading Assignment *R.W. Floyd, "Assigning Meaning to Programs, Symposium on Applied Mathematics, 1967, pp. 19-32 (Appeared as volume 19 of Mathematical Aspects of Computer

More information

Automatically Validating Temporal Safety Properties of Interfaces

Automatically Validating Temporal Safety Properties of Interfaces Automatically Validating Temporal Safety Properties of Interfaces Thomas Ball and Sriram K. Rajamani Software Productivity Tools Microsoft Research http://www.research.microsoft.com/slam/ Abstract. We

More information

Finite State Verification. CSCE Lecture 21-03/28/2017

Finite State Verification. CSCE Lecture 21-03/28/2017 Finite State Verification CSCE 747 - Lecture 21-03/28/2017 So, You Want to Perform Verification... You have a property that you want your program to obey. Great! Let s write some tests! Does testing guarantee

More information

Bounded Model Checking Of C Programs: CBMC Tool Overview

Bounded Model Checking Of C Programs: CBMC Tool Overview Workshop on Formal Verification and Analysis Tools, CFDVS, IIT-Bombay - Feb 21,2017 Bounded Model Checking Of C Programs: CBMC Tool Overview Prateek Saxena CBMC Developed and Maintained by Dr Daniel Kröning

More information

Reasoning about programs

Reasoning about programs Reasoning about programs Last time Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in

More information

Last time. Reasoning about programs. Coming up. Project Final Presentations. This Thursday, Nov 30: 4 th in-class exercise

Last time. Reasoning about programs. Coming up. Project Final Presentations. This Thursday, Nov 30: 4 th in-class exercise Last time Reasoning about programs Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in

More information

Permissive Interfaces

Permissive Interfaces Permissive Interfaces Thomas A. Henzinger Ranjit Jhala Rupak Majumdar EPFL, Switzerland UC Berkeley UC Los Angeles Abstract A modular program analysis considers components independently and provides succinct

More information

Introduction to Axiomatic Semantics

Introduction to Axiomatic Semantics Introduction to Axiomatic Semantics Meeting 10, CSCI 5535, Spring 2009 Announcements Homework 3 due tonight Homework 2 is graded 13 (mean), 14 (median), out of 21 total, but Graduate class: final project

More information

Program Verification. Aarti Gupta

Program Verification. Aarti Gupta Program Verification Aarti Gupta 1 Agenda Famous bugs Common bugs Testing (from lecture 6) Reasoning about programs Techniques for program verification 2 Famous Bugs The first bug: A moth in a relay (1945)

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember that you can t just define a meaning function in terms of itself you must use some fixed point machinery. #2 #3 Observations

More information

Interpolation-based Software Verification with Wolverine

Interpolation-based Software Verification with Wolverine Interpolation-based Software Verification with Wolverine Daniel Kroening 1 and Georg Weissenbacher 2 1 Computer Science Department, Oxford University 2 Department of Electrical Engineering, Princeton University

More information

Part II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs?

Part II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs? Part II. Hoare Logic and Program Verification Part II. Hoare Logic and Program Verification Dilian Gurov Props: Models: Specs: Method: Tool: safety of data manipulation source code logic assertions Hoare

More information

Reading Assignment. Symbolic Evaluation/Execution. Move from Dynamic Analysis to Static Analysis. Move from Dynamic Analysis to Static Analysis

Reading Assignment. Symbolic Evaluation/Execution. Move from Dynamic Analysis to Static Analysis. Move from Dynamic Analysis to Static Analysis Reading Assignment Symbolic Evaluation/Execution *R.W. Floyd, "Assigning Meaning to Programs, Symposium on Applied Mathematics, 1967, pp. 19-32 (Appeared as volume 19 of Mathematical Aspects of Computer

More information

Lecture 2: Symbolic Model Checking With SAT

Lecture 2: Symbolic Model Checking With SAT Lecture 2: Symbolic Model Checking With SAT Edmund M. Clarke, Jr. School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 (Joint work over several years with: A. Biere, A. Cimatti, Y.

More information

Reachability Analysis for Annotated Code

Reachability Analysis for Annotated Code Mikoláš Janota 1 Radu Grigore 1 Micha l Moskal 2 1 Systems Research Group, University College Dublin, Ireland 2 Institute of Computer Science University of Wroc law, Poland SAVCBS 07 IST-15905 Why Annotated

More information

Model Checking with Automata An Overview

Model Checking with Automata An Overview Model Checking with Automata An Overview Vanessa D Carson Control and Dynamical Systems, Caltech Doyle Group Presentation, 05/02/2008 VC 1 Contents Motivation Overview Software Verification Techniques

More information

TVLA: A SYSTEM FOR GENERATING ABSTRACT INTERPRETERS*

TVLA: A SYSTEM FOR GENERATING ABSTRACT INTERPRETERS* TVLA: A SYSTEM FOR GENERATING ABSTRACT INTERPRETERS* Tal Lev-Ami, Roman Manevich, and Mooly Sagiv Tel Aviv University {tla@trivnet.com, {rumster,msagiv}@post.tau.ac.il} Abstract TVLA (Three-Valued-Logic

More information

Verifying Temporal Properties via Dynamic Program Execution. Zhenhua Duan Xidian University, China

Verifying Temporal Properties via Dynamic Program Execution. Zhenhua Duan Xidian University, China Verifying Temporal Properties via Dynamic Program Execution Zhenhua Duan Xidian University, China Main Points Background & Motivation MSVL and Compiler PPTL Unified Program Verification Tool Demo Conclusion

More information

Abstract Interpretation

Abstract Interpretation Abstract Interpretation Ranjit Jhala, UC San Diego April 22, 2013 Fundamental Challenge of Program Analysis How to infer (loop) invariants? Fundamental Challenge of Program Analysis Key issue for any analysis

More information

PROGRAM ANALYSIS & SYNTHESIS

PROGRAM ANALYSIS & SYNTHESIS Lecture 02 Structural Operational Semantics (SOS) PROGRAM ANALYSIS & SYNTHESIS EranYahav 1 Previously static analysis over-approximation of program behavior abstract interpretation abstraction, transformers,

More information

Abstraction Learning

Abstraction Learning Abstraction Learning Joxan Jaffar National University of Singapore joxan@comp.nus.edu.sg Jorge Navas National University of Singapore navas@comp.nus.edu.sg Andrew E. Santosa National University of Singapore

More information

Tree Interpolation in Vampire

Tree Interpolation in Vampire Tree Interpolation in Vampire Régis Blanc 1, Ashutosh Gupta 2, Laura Kovács 3, and Bernhard Kragl 4 1 EPFL 2 IST Austria 3 Chalmers 4 TU Vienna Abstract. We describe new extensions of the Vampire theorem

More information

Finite Model Generation for Isabelle/HOL Using a SAT Solver

Finite Model Generation for Isabelle/HOL Using a SAT Solver Finite Model Generation for / Using a SAT Solver Tjark Weber webertj@in.tum.de Technische Universität München Winterhütte, März 2004 Finite Model Generation for / p.1/21 is a generic proof assistant: Highly

More information

Verifiable Hierarchical Protocols with Network Invariants on Parametric Systems

Verifiable Hierarchical Protocols with Network Invariants on Parametric Systems Verifiable Hierarchical Protocols with Network Invariants on Parametric Systems Opeoluwa Matthews, Jesse Bingham, Daniel Sorin http://people.duke.edu/~om26/ FMCAD 2016 - Mountain View, CA Problem Statement

More information

Type Theory meets Effects. Greg Morrisett

Type Theory meets Effects. Greg Morrisett Type Theory meets Effects Greg Morrisett A Famous Phrase: Well typed programs won t go wrong. 1. Describe abstract machine: M ::= 2. Give transition relation: M 1 M 2

More information

Checking Memory Safety with Blast

Checking Memory Safety with Blast Checking Memory Safety with Blast Dirk Beyer 1 Thomas A. Henzinger 12 Ranjit Jhala 3 Rupak Majumdar 4 1 EPFL, Switzerland 2 University of California, Berkeley 3 University of California, San Diego 4 University

More information

SYNERGY : A New Algorithm for Property Checking

SYNERGY : A New Algorithm for Property Checking SYNERGY : A New Algorithm for Property Checking Bhargav S. Gulavani Thomas A. Henzinger Yamini Kannan Aditya V. Nori Sriram K. Rajamani bhargav@cse.iitb.ernet.in tah@epfl.ch yaminik@microsoft.com adityan@microsoft.com

More information

Lazy Abstraction with Interpolants

Lazy Abstraction with Interpolants Lazy Abstraction with Interpolants Kenneth L. McMillan Cadence Berkeley Labs Abstract. We describe a model checker for infinite-state sequential programs, based on Craig interpolation and the lazy abstraction

More information

Verifying Concurrent Programs

Verifying Concurrent Programs Verifying Concurrent Programs Daniel Kroening 8 May 1 June 01 Outline Shared-Variable Concurrency Predicate Abstraction for Concurrent Programs Boolean Programs with Bounded Replication Boolean Programs

More information

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,

More information

Areas related to SW verif. Trends in Software Validation. Your Expertise. Research Trends High level. Research Trends - Ex 2. Research Trends Ex 1

Areas related to SW verif. Trends in Software Validation. Your Expertise. Research Trends High level. Research Trends - Ex 2. Research Trends Ex 1 Areas related to SW verif. Trends in Software Validation Abhik Roychoudhury CS 6214 Formal Methods Model based techniques Proof construction techniques Program Analysis Static Analysis Abstract Interpretation

More information

Seminar in Software Engineering Presented by Dima Pavlov, November 2010

Seminar in Software Engineering Presented by Dima Pavlov, November 2010 Seminar in Software Engineering-236800 Presented by Dima Pavlov, November 2010 1. Introduction 2. Overview CBMC and SAT 3. CBMC Loop Unwinding 4. Running CBMC 5. Lets Compare 6. How does it work? 7. Conclusions

More information

The Pointer Assertion Logic Engine

The Pointer Assertion Logic Engine The Pointer Assertion Logic Engine [PLDI 01] Anders Mφller Michael I. Schwartzbach Presented by K. Vikram Cornell University Introduction Pointer manipulation is hard Find bugs, optimize code General Approach

More information

Basic Verification Strategy

Basic Verification Strategy ormal Verification Basic Verification Strategy compare behavior to intent System Model of system behavior intent Verifier results Intent Usually, originates with requirements, refined through design and

More information

Unbounded Symbolic Execution for Program Verification

Unbounded Symbolic Execution for Program Verification Unbounded Symbolic Execution for Program Verification JOXAN JAFFAR 1, JORGE A. NAVAS 1, AND ANDREW E. SANTOSA 2 1 National University of Singapore 2 University of Sydney, Australia {joxan,navas}@comp.nus.edu.sg,

More information

Research Collection. Formal background and algorithms. Other Conference Item. ETH Library. Author(s): Biere, Armin. Publication Date: 2001

Research Collection. Formal background and algorithms. Other Conference Item. ETH Library. Author(s): Biere, Armin. Publication Date: 2001 Research Collection Other Conference Item Formal background and algorithms Author(s): Biere, Armin Publication Date: 2001 Permanent Link: https://doi.org/10.3929/ethz-a-004239730 Rights / License: In Copyright

More information

Automatic Software Verification

Automatic Software Verification Automatic Software Verification Instructor: Mooly Sagiv TA: Oded Padon Slides from Eran Yahav and the Noun Project, Wikipedia Course Requirements Summarize one lecture 10% one lecture notes 45% homework

More information

An Eclipse Plug-in for Model Checking

An Eclipse Plug-in for Model Checking An Eclipse Plug-in for Model Checking Dirk Beyer, Thomas A. Henzinger, Ranjit Jhala Electrical Engineering and Computer Sciences University of California, Berkeley, USA Rupak Majumdar Computer Science

More information

Automated Debugging with Error Invariants

Automated Debugging with Error Invariants Automated Debugging with Error Invariants Thomas Wies New York University joint work with Jürgen Christ, Evren Ermis (Freiburg University), Martin Schäf (SRI), Daniel Schwartz-Narbonne (NYU) Faulty Shell

More information

Symbolic and Concolic Execution of Programs

Symbolic and Concolic Execution of Programs Symbolic and Concolic Execution of Programs Information Security, CS 526 Omar Chowdhury 10/7/2015 Information Security, CS 526 1 Reading for this lecture Symbolic execution and program testing - James

More information

Predicate Abstraction of ANSI C Programs using SAT Λ

Predicate Abstraction of ANSI C Programs using SAT Λ Predicate Abstraction of ANSI C Programs using SAT Λ Edmund Clarke and Daniel Kroening and Natalia Sharygina and Karen Yorav School of Computer Science Carnegie Mellon University, Pittsburgh, PA, USA Software

More information

Abstraction Refinement for Quantified Array Assertions

Abstraction Refinement for Quantified Array Assertions Abstraction Refinement for Quantified Array Assertions Mohamed Nassim Seghir 1,, Andreas Podelski 1, and Thomas Wies 1,2 1 University of Freiburg, Germany 2 EPFL, Switzerland Abstract. We present an abstraction

More information

Program Verification (6EC version only)

Program Verification (6EC version only) Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language

More information

Predicate Abstraction and Refinement Techniques for Verifying Verilog

Predicate Abstraction and Refinement Techniques for Verifying Verilog Predicate Abstraction and Refinement Techniques for Verifying Verilog Edmund Clarke Himanshu Jain Daniel Kroening June 25, 2004 CMU-CS-04-139 School of Computer Science Carnegie Mellon University Pittsburgh,

More information

A Survey of Automated Techniques for Formal Software Verification

A Survey of Automated Techniques for Formal Software Verification TRANSACTIONS ON CAD 1 A Survey of Automated Techniques for Formal Software Verification Vijay D Silva Daniel Kroening Georg Weissenbacher Abstract The quality and the correctness of software is often the

More information

Program verification. Generalities about software Verification Model Checking. September 20, 2016

Program verification. Generalities about software Verification Model Checking. September 20, 2016 Program verification Generalities about software Verification Model Checking Laure Gonnord David Monniaux September 20, 2016 1 / 43 The teaching staff Laure Gonnord, associate professor, LIP laboratory,

More information

4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271

4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271 Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing

More information

On Reasoning About Finite Sets in Software Model Checking

On Reasoning About Finite Sets in Software Model Checking On Reasoning About Finite Sets in Software Model Checking Pavel Shved Institute for System Programming, RAS email: shved@ispras.ru Abstract A number of static checking techniques is based on constructing

More information

Model Checking Embedded C Software using k-induction and Invariants

Model Checking Embedded C Software using k-induction and Invariants FEDERAL UNIVERSITY OF RORAIMA and FEDERAL UNIVESITY OF AMAZONAS Model Checking Embedded C Software using k-induction and Invariants Herbert Rocha, Hussama Ismail, Lucas Cordeiro and Raimundo Barreto Agenda

More information

SAT Solver. CS 680 Formal Methods Jeremy Johnson

SAT Solver. CS 680 Formal Methods Jeremy Johnson SAT Solver CS 680 Formal Methods Jeremy Johnson Disjunctive Normal Form A Boolean expression is a Boolean function Any Boolean function can be written as a Boolean expression s x 0 x 1 f Disjunctive normal

More information

Overview. Discrete Event Systems - Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for?

Overview. Discrete Event Systems - Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for? Computer Engineering and Networks Overview Discrete Event Systems - Verification of Finite Automata Lothar Thiele Introduction Binary Decision Diagrams Representation of Boolean Functions Comparing two

More information

Softwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24

Softwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24 Softwaretechnik Program verification Albert-Ludwigs-Universität Freiburg June 28, 2012 Softwaretechnik June 28, 2012 1 / 24 Road Map Program verification Automatic program verification Programs with loops

More information

Typestate Verification: Abstraction Techniques and Complexity Results

Typestate Verification: Abstraction Techniques and Complexity Results Typestate Verification: Abstraction Techniques and Complexity Results J. Field a,d. Goyal a,1,g. Ramalingam a,e. Yahav b a IBM T.J. Watson Research Center. b School of Computer Science, Tel-Aviv University,

More information

Compiler Construction 2016/2017 Loop Optimizations

Compiler Construction 2016/2017 Loop Optimizations Compiler Construction 2016/2017 Loop Optimizations Peter Thiemann January 16, 2017 Outline 1 Loops 2 Dominators 3 Loop-Invariant Computations 4 Induction Variables 5 Array-Bounds Checks 6 Loop Unrolling

More information

Hoare Logic: Proving Programs Correct

Hoare Logic: Proving Programs Correct Hoare Logic: Proving Programs Correct 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich Reading: C.A.R. Hoare, An Axiomatic Basis for Computer Programming Some presentation ideas from a lecture

More information

Runtime Checking for Program Verification Systems

Runtime Checking for Program Verification Systems Runtime Checking for Program Verification Systems Karen Zee, Viktor Kuncak, and Martin Rinard MIT CSAIL Tuesday, March 13, 2007 Workshop on Runtime Verification 1 Background Jahob program verification

More information

Part II: Atomicity for Software Model Checking. Analysis of concurrent programs is difficult (1) Transaction. The theory of movers (Lipton 75)

Part II: Atomicity for Software Model Checking. Analysis of concurrent programs is difficult (1) Transaction. The theory of movers (Lipton 75) Part II: Atomicity for Software Model Checking Class Account { int balance; static int MIN = 0, MAX = 00; bool synchronized deposit(int n) { int t = balance + n; if (t > MAX) return false; bool synchronized

More information

Automated Theorem Proving and Proof Checking

Automated Theorem Proving and Proof Checking Automated Theorem Proving and Proof Checking #1 #2 Cunning Theorem-Proving Plan There are full-semester courses on automated deduction; we will elide details. Logic Syntax Theories Satisfiability Procedures

More information

Boolean Functions (Formulas) and Propositional Logic

Boolean Functions (Formulas) and Propositional Logic EECS 219C: Computer-Aided Verification Boolean Satisfiability Solving Part I: Basics Sanjit A. Seshia EECS, UC Berkeley Boolean Functions (Formulas) and Propositional Logic Variables: x 1, x 2, x 3,, x

More information

Subsumer-First: Steering Symbolic Reachability Analysis

Subsumer-First: Steering Symbolic Reachability Analysis Subsumer-First: Steering Symbolic Reachability Analysis Andrey Rybalchenko 1 and Rishabh Singh 2 1 Max Planck Institute for Software Systems (MPI-SWS) 2 Massachusetts Institue of Technology (MIT) Abstract.

More information

Handling Loops in Bounded Model Checking of C Programs via k-induction

Handling Loops in Bounded Model Checking of C Programs via k-induction Software Tools for Technology Transfer manuscript No. (will be inserted by the editor) Handling Loops in Bounded Model Checking of C Programs via k-induction Mikhail Y. R. Gadelha, Hussama I. Ismail, and

More information

HW/SW Codesign. WCET Analysis

HW/SW Codesign. WCET Analysis HW/SW Codesign WCET Analysis 29 November 2017 Andres Gomez gomeza@tik.ee.ethz.ch 1 Outline Today s exercise is one long question with several parts: Basic blocks of a program Static value analysis WCET

More information

Synchronizing the Asynchronous

Synchronizing the Asynchronous Synchronizing the Asynchronous Bernhard Kragl IST Austria Shaz Qadeer Microsoft Thomas A. Henzinger IST Austria Concurrency is Ubiquitous Asynchronous Concurrency is Ubiquitous Asynchronous programs are

More information