Having a BLAST with SLAM
|
|
- Joella Little
- 6 years ago
- Views:
Transcription
1 Having a BLAST with SLAM Meeting, CSCI 555, Fall 20 Announcements Homework 0 due Sat Questions? Move Tue office hours to -5pm 2
2 Software Model Checking via Counterexample Guided Abstraction Refinement There are easily dozens of papers. We will skim. SLAM Overview/Review Input: Program and Specification ( procedures Standard C Program (pointers, Specification = Partial Correctness ( typestate ) Given as a finite state machine I use s correctly, not I am a webserver Output: Verified or Counterexample Verified = program does not violate spec Can come with proof! Counterexample = concrete bug instance A path through the program that violates the spec 2
3 SLAM Overview Input: Program and Specification ( procedures Standard C Program (pointers, Specification = Partial Correctness ( typestate ) Given as a finite state machine I use s correctly, not I am a webserver Output: Verified or Counterexample Verified = program does not violate spec Can come with proof! Counterexample = concrete bug instance A path through the program that violates the spec 5 Take-Home Message SLAM is a software model checker. It abstracts C programs to boolean programs and model-checks the boolean programs. No errors in the boolean program implies no errors in the original. An error in the boolean program may be a real bug. Or SLAM may refine the abstraction and start again. 6
4 Property : Double Locking un un An attempt to re-acquire an acquired or release a released will cause a dead. Calls to and un must alternate. 7 Property 2: Drop Root Privilege [Chen-Wagner-Dean 02] User applications must not run with root privilege When execv is called, must have suid 0 8
5 Property : IRP Handler IRP accessible MPR start NP synch not pending returned CallDriver MPR2 MPR NP MPR completion Skip prop completion no prop completion SKIP CallDriver SKIP2 PPC N/A CallDriver CallDriver Complete request CallDriver IPC DC N/A synch return child status return not Pend MPR2 MPR CallDriver start P synch not pending returned MPR NP MPR completion Mark Pending Skip prop completion no prop completion CallDriver SKIP SKIP2 PPC N/A CallDriver CallDriver Complete request IPC CallDriver DC return Pending [Fahndrich] 9 Example SLAM Input : do{ : q->data = new; un : while(new!= old); 5: un return; un un 0 5
6 SLAM in a Nutshell SLAM(Program p, Spec s) = Program q = incorporate_spec(p,s); // slic PredicateSet abs = { ; while true do BooleanProgram b = abstract(q,abs); // c2bp match model_check(b) with // bebop No_Error! print( no bug ); exit(0) Counterexample(c)! if is_valid_path(c, p) then // newton print( real bug ); exit() else abs à abs [ new_preds(c) // newton done Incorporating Specs : do{ : q->data = new; un : while(new!= old); 5: un return; Ideas? un 0 un ERR #2 6
7 Incorporating Specs : do{ : q->data = new; un : while(new!= old); 5: un return; un 0 un ERR : do{ if L= goto ERR; else L=; : q->data = new; if L=0 goto ERR; else L=0; : while(new!= old); 5: if L=0 goto ERR; else L=0; return; ERR: abort(); Original program violates spec iff new program reaches ERR # Program As Labeled Transition System State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa : do{ : q->data = new; un : while(new!= old); 5: un return; 7
8 The Safety Verification Problem Error (e.g., states with PC = Err) Safe States (never reach Error) Initial Is there a path from an initial to an error state? Problem? Infinite state graph (old=, old=2, old= ) Solution? Set of states ' logical formula 5 Representing [Sets of States] as Formulas [F] states satisfying F {s s ² F F FO formula over program vars [F ] Å [F 2 ] F Æ F 2 [F ] [ [F 2 ] [F] [F ] µ [F 2 ] 6 i.e. F Æ F 2 unsatisfiable 8
9 Representing [Sets of States] as Formulas [F] states satisfying F {s s ² F F FO formula over program vars [F ] Å [F 2 ] F Æ F 2 [F ] [ [F 2 ] F Ç F 2 [F] F [F ] µ [F 2 ] F ) F 2 7 i.e. F Æ F 2 unsatisfiable Idea : Predicate Abstraction Predicates on program state: (i.e., =true) old = new States satisfying same predicates are equivalent Merged into one abstract state Why? Num of abstract states is finite Thus model-checking the abstraction will be feasible! 8 9
10 Abstract States and Transitions State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa Theorem Prover old=new old=new 9 Abstraction State c Transition c 2 pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa A A Theorem Prover 2 old=new Existential Lifting (i.e., A!A 2 iff 9c 2A. 9c 2 2A 2. c!c 2 ) old=new 20 0
11 Abstraction State Transition pc old new 5 q 5 0xa : un new++; : pc old new 6 q 5 0xa Theorem Prover old=new old=new 2 Analyze Abstraction Analyze finite graph Over Approximate Safe ) System Safe No false negatives Problem Spurious counterexamples false positives 22
12 Idea 2: Counterexample-Guided Refinement Solution Use spurious counterexamples to refine abstraction! 2 Idea 2: Counterexample-Guided Refinement Solution Use spurious counterexamples to refine abstraction!. Add predicates to distinguish states across cut 2. Build refined abstraction Imprecision due to merge 2 2
13 Iterative Abstraction-Refinement Solution Use spurious counterexamples to refine abstraction! [Kurshan et al 9] [Clarke et al 00] [Ball-Rajamani 0]. Add predicates to distinguish states across cut 2. Build refined abstraction eliminates counterexample. Repeat search until real counterexample or system proved safe 25 Problem: Abstraction is Expensive Why? Reachable Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Observe Fraction of state space reachable #Preds ~ 00 s, #States ~ 2 00, #Reach ~ 000 s 26
14 Solution: Only Abstract Reachable States Safe Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Build abstraction during search 27 Solution2: Don t Refine Error-Free Regions Error Free Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Don t refine error-free regions 28
15 29 Key Idea for Solutions? 0 5
16 Key Idea: Initial 2 Unroll Abstraction. Pick tree-node (=abs. state) 2. Add children (=abs. successors). On re-visiting abs. state, cut-off 5 Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Error Free 2 6
17 Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix 8 - Learn new predicates - Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un Predicates: LOCK 7
18 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un () old = new q=q->next 2 LOCK 2 Predicates: LOCK 5 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un [q!=null] 2 LOCK LOCK 2 Predicates: LOCK 6 8
19 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un q->data = new () un new++ 2 LOCK LOCK 2 Predicates: LOCK 7 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK [new==old] Predicates: LOCK 8 9
20 Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK 5 un() 2 Predicates: LOCK 5 9 Analyze Counterexample : do{ : q->data = new; un :while(new!= old); 5:un 2 LOCK LOCK () old = new q=q->next [q!=null] q->data = new () un new++ [new==old] 5 5 un() 2 Predicates: LOCK 0 20
21 Analyze Counterexample : do{ : q->data = new; un :while(new!= old); 5:un 2 5 Predicates: LOCK old = new 2 LOCK LOCK new++ [new==old] 5 Inconsistent new == old Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un Predicates: LOCK, new == old 2 2
22 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 () old = new q=q->next 2 Predicates: LOCK, new == old Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old q->data = new () un new++ 2 Predicates: LOCK, new == old 22
23 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old [new==old] 2 Predicates: LOCK, new == old 5 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old 2 LOCK, new==old, new = old [new!=old] 2 Predicates: LOCK, new == old, new == old 6 2
24 Repeat Build-and-Search : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old LOCK, new==old 2 SAFE, new = old LOCK, new=old 5, new == old 5 2 Predicates: LOCK, new == old, new==old 7 Key Idea: Initial Unroll Abstraction. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors). On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates 8 - Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions 8 2
25 Two Handwaves : do{ : q->data = new; un LOCK, new==old 2 Q. How to compute successors? :while(new!= old); 5:un Q. How to find predicates 5? 5, new == old 2 Predicates: LOCK, new==old old LOCK, new==old, new = old Refinement q->data = new () un new++ LOCK, new=old, new==old SAFE 9 Two Handwaves : do{ : q->data = new; un LOCK, new==old 2 Q. How to compute successors? :while(new!= old); 5:un LOCK, new==old, new = old q->data = new () un new++ LOCK, new=old SAFE 5 2 Predicates: LOCK, new == old, new == old 5, new==old 50 25
26 Weakest Preconditions WP(P,OP) Weakest formula P s.t. if P is true before OP then P is true after OP OP [WP(P, OP)] [P] 5 Weakest Preconditions More on this later in the semester! WP(P,OP) Weakest formula P s.t. if P is true before OP then P is true after OP OP [WP(P, OP)] [P] P[e/x] new+ = old Assign x = e P new = old new = new
27 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old, new == old OP For each p Check if p is true (or false) after OP Q: When is p true after OP? - If WP(p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F ) WP(p, OP) F? Predicates: LOCK, new == old 5 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un LOCK, new==old OP For each p Check if p is true (or false) after OP Q: When is p false after OP? - If WP( p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F ) WP( p, OP) F? Predicates: LOCK, new == old 5 27
28 How to compute successor? : do{ : q->data = new; un :while(new!= old); 5:un Predicate: new == old True? False? LOCK, new==old LOCK, new == old OP For each p Check if p is true (or false) after OP Q: When is p false after OP? - If WP( p, OP) is true before OP! - We know F is true before OP (LOCK, new==old) ) (new + = old) (LOCK, new==old) ) (new + old) - Thm. Pvr. Query: F ) WP( p, OP) NO YES F? 55 Advanced SLAM/BLAST Too Many Predicates - Use Predicates Locally Counter-Examples - Craig Interpolants Procedures - Summaries Concurrency - Thread-Context Reasoning 56 28
29 SLAM Summary ) Instrument Program With Safety Policy 2) Predicates = { ) Abstract Program With Predicates Use Weakest Preconditions and Theorem Prover Calls ) Model-Check Resulting Boolean Program Use Symbolic Model Checking 5) Error State Not Reachable? Original Program Has No Errors: Done! 6) Check Counterexample Feasibility Use Symbolic Execution 7) Counterexample Is Feasible? Real Bug: Done! 8) Counterexample Is Not Feasible? ) Find New Predicates (Refine Abstraction)" 2) Goto Line 57 Bonus: SLAM/BLAST Weakness : F() { 2: int x=0; : : x++; 5: while (x 88); ( 77 < (x 6: if 7: 8: Preds = {, Path = 2567 [x=0, x+ 88, x+<77] Preds = {x=0, Path = 2567 [x=0, x+ 88, x+<77] Preds = {x=0, x+=88 Path = [x=0, x+2 88, x+2<77] Preds = {x=0,x+=88,x+2=88 Path = Result: the predicates count the loop iterations 58 29
30 For Next Time Post about today s class and reading 59 0
Having a BLAST with SLAM
Having a BLAST with SLAM # #2 Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement There are easily two dozen SLAM/BLAST/MAGIC papers; I will skim. #3 SLAM Overview INPUT: Program
More informationHaving a BLAST with SLAM
Having a BLAST with SLAM # #2 Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement There are easily two dozen SLAM/BLAST/MAGIC papers; I will skim. #3 SLAM Overview INPUT: Program
More informationHaving a BLAST with SLAM
Announcements Having a BLAST with SLAM Meetings -, CSCI 7, Fall 00 Moodle problems? Blog problems? Looked at the syllabus on the website? in program analysis Microsoft uses and distributes the Static Driver
More informationScalable Program Verification by Lazy Abstraction
Scalable Program Verification by Lazy Abstraction Ranjit Jhala U.C. Berkeley ars, July, 997 Lost contact due to real-time priority inversion bug ars, December, 999 Crashed due to uninitialized variable
More informationSoftware Model Checking with Abstraction Refinement
Software Model Checking with Abstraction Refinement Computer Science and Artificial Intelligence Laboratory MIT Armando Solar-Lezama With slides from Thomas Henzinger, Ranjit Jhala and Rupak Majumdar.
More informationCS 510/13. Predicate Abstraction
CS 50/3 Predicate Abstraction Predicate Abstraction Extract a finite state model from an infinite state system Used to prove assertions or safety properties Successfully applied for verification of C programs
More informationTopic: Software Model Checking via Counter-Example Guided Abstraction Refinement. Having a BLAST with SLAM. Combining Strengths. SLAM Overview SLAM
Hving BLAST with SLAM Topic: Softwre Model Checking vi Counter-Exmple Guided Abstrction Refinement There re esily two dozen SLAM/BLAST/MAGIC ppers; I will skim. # # Theorem Proving Combining Strengths
More informationSoftware Model Checking. Xiangyu Zhang
Software Model Checking Xiangyu Zhang Symbolic Software Model Checking CS510 S o f t w a r e E n g i n e e r i n g Symbolic analysis explicitly explores individual paths, encodes and resolves path conditions
More informationDouble Header. Two Lectures. Flying Boxes. Some Key Players: Model Checking Software Model Checking SLAM and BLAST
Model Checking #1 Double Header Two Lectures Model Checking Software Model Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation
More informationPredicate Abstraction Daniel Kroening 1
Predicate Abstraction 20.1.2005 Daniel Kroening 1 Motivation Software has too many state variables State Space Explosion Graf/Saïdi 97: Predicate Abstraction Idea: Only keep track of predicates on data
More informationCounterexample Guided Abstraction Refinement in Blast
Counterexample Guided Abstraction Refinement in Blast Reading: Checking Memory Safety with Blast 17-654/17-754 Analysis of Software Artifacts Jonathan Aldrich 1 How would you analyze this? * means something
More informationStatic Program Analysis
Static Program Analysis Thomas Noll Software Modeling and Verification Group RWTH Aachen University https://moves.rwth-aachen.de/teaching/ws-1617/spa/ Schedule of Lectures Jan 17/19: Interprocedural DFA
More informationNo model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine
No model may be available Programmer Software Abstractions Tests Coverage Code Abhik Roychoudhury CS 5219 National University of Singapore Testing Debug Today s lecture Abstract model (Boolean pgm.) Desirable
More informationOn Reasoning about Finite Sets in Software Checking
On Reasoning about Finite Sets in Software Model Checking Pavel Shved Institute for System Programming, RAS SYRCoSE 2 June 2010 Static Program Verification Static Verification checking programs against
More informationVerifying Multithreaded Software with Impact
Verifying Multithreaded Software with Impact Björn Wachter, Daniel Kroening and Joël Ouaknine University of Oxford Intro Multi-threading C/C++ with POSIX/WIN 32 threads event processing, device drivers,
More informationPredicate Refinement Heuristics in Program Verification with CEGAR
Predicate Refinement Heuristics in Program Verification with CEGAR Tachio Terauchi (JAIST) Part of this is joint work with Hiroshi Unno (U. Tsukuba) 1 Predicate Abstraction with CEGAR Iteratively generate
More informationSoftware Model Checking. From Programs to Kripke Structures
Software Model Checking (in (in C or or Java) Java) Model Model Extraction 1: int x = 2; int y = 2; 2: while (y
More informationProofs from Tests. Nels E. Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons, SaiDeep Tetali, Aditya V. Thakur
1 Proofs from Tests Nels E. Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons, SaiDeep Tetali, Aditya V. Thakur Abstract We present an algorithm DASH to check if a program P satisfies a safety
More information4/24/18. Overview. Program Static Analysis. Has anyone done static analysis? What is static analysis? Why static analysis?
Overview Program Static Analysis Program static analysis Abstract interpretation Static analysis techniques 2 What is static analysis? The analysis to understand computer software without executing programs
More informationF-Soft: Software Verification Platform
F-Soft: Software Verification Platform F. Ivančić, Z. Yang, M.K. Ganai, A. Gupta, I. Shlyakhter, and P. Ashar NEC Laboratories America, 4 Independence Way, Suite 200, Princeton, NJ 08540 fsoft@nec-labs.com
More informationModel Checking with Abstract State Matching
Model Checking with Abstract State Matching Corina Păsăreanu QSS, NASA Ames Research Center Joint work with Saswat Anand (Georgia Institute of Technology) Radek Pelánek (Masaryk University) Willem Visser
More informationUfo: A Framework for Abstraction- and Interpolation-Based Software Verification
Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification Aws Albarghouthi 1, Yi Li 1, Arie Gurfinkel 2, and Marsha Chechik 1 1 Department of Computer Science, University of Toronto,
More informationUsing Counterexample Analysis to Minimize the Number of Predicates for Predicate Abstraction
Using Counterexample Analysis to Minimize the Number of Predicates for Predicate Abstraction Thanyapat Sakunkonchak, Satoshi Komatsu, and Masahiro Fujita VLSI Design and Education Center, The University
More informationSoftware Model Checking with SLAM
Software Model Checking with SLAM Thomas Ball Software Reliability Research MSR Redmond Sriram K. Rajamani Reliable Software Engineering MSR Bangalore http://research.microsoft.com/slam/ People behind
More informationMore on Verification and Model Checking
More on Verification and Model Checking Wednesday Oct 07, 2015 Philipp Rümmer Uppsala University Philipp.Ruemmer@it.uu.se 1/60 Course fair! 2/60 Exam st October 21, 8:00 13:00 If you want to participate,
More informationFormal Systems Tutorial Hybrid System Modeling, Program Analysis
Formal Systems Tutorial Hybrid System Modeling, Program Analysis Department of Computer Science & Engineering, Indian Institute of Technology, Kharagpur 1. There are three taps in the system, namely Tap-1
More informationOutline. Introduction SDV Motivation Model vs Real Implementation SLIC SDVRP SLAM-2 Comparisons Conclusions
Outline Introduction SDV Motivation Model vs Real Implementation SIC SDVRP SAM-2 Comparisons Conclusions SDV Research Platform Academic release of SDV (Static Driver Verifier), based on the code that ships
More informationCS 267: Automated Verification. Lecture 13: Bounded Model Checking. Instructor: Tevfik Bultan
CS 267: Automated Verification Lecture 13: Bounded Model Checking Instructor: Tevfik Bultan Remember Symbolic Model Checking Represent sets of states and the transition relation as Boolean logic formulas
More informationProgram Static Analysis. Overview
Program Static Analysis Overview Program static analysis Abstract interpretation Data flow analysis Intra-procedural Inter-procedural 2 1 What is static analysis? The analysis to understand computer software
More informationThe software model checker BLAST
Int J Softw Tools Technol Transfer (2007) 9:505 525 DOI 10.1007/s10009-007-0044-z SPECIAL SECTION FASE 04/ 05 The software model checker BLAST Applications to software engineering Dirk Beyer Thomas A.
More informationIntroduction to Axiomatic Semantics (1/2)
#1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember: just do the counterexample guided abstraction refinement part of DPLL(T). If you notice any other errors, those are good
More informationSliced Path Prefixes: An Effective Method to Enable Refinement Selection
FORTE '15 Sliced Path Prefixes: An Effective Method to Enable Refinement Selection Dirk Beyer, Stefan Löwe, Philipp Wendler SoSy-Lab Software Systems We want Refinement Selection!!! Because straight-forward
More informationTRACER: A Symbolic Execution Tool for Verification
TRACER: A Symbolic Execution Tool for Verification Joxan Jaffar, Vijayaraghavan Murali, Jorge A. Navas, and Andrew E. Santosa 3 National University of Singapore The University of Melbourne 3 University
More informationProofs from Tests. Sriram K. Rajamani. Nels E. Beckman. Aditya V. Nori. Robert J. Simmons.
Proofs from Tests Nels E. Beckman Carnegie Mellon University nbeckman@cs.cmu.edu Aditya V. Nori Microsoft Research India adityan@microsoft.com Robert J. Simmons Carnegie Mellon University rjsimmon@cs.cmu.edu
More informationFinite State Verification. CSCE Lecture 14-02/25/2016
Finite State Verification CSCE 747 - Lecture 14-02/25/2016 So, You Want to Perform Verification... You have a property that you want your program to obey. Great! Let s write some tests! Does testing guarantee
More informationTowards a Software Model Checker for ML. Naoki Kobayashi Tohoku University
Towards a Software Model Checker for ML Naoki Kobayashi Tohoku University Joint work with: Ryosuke Sato and Hiroshi Unno (Tohoku University) in collaboration with Luke Ong (Oxford), Naoshi Tabuchi and
More informationIntroduction. Preliminaries. Original IC3. Tree-IC3. IC3 on Control Flow Automata. Conclusion
.. Introduction Preliminaries Original IC3 Tree-IC3 IC3 on Control Flow Automata Conclusion 2 of 22 Lifting IC3 to Control Flow Automata Tim Lange tim.lange@cs.rwth-aachen.de Introduction Preliminaries
More informationSymbolic Evaluation/Execution
Symbolic Evaluation/Execution Reading Assignment *R.W. Floyd, "Assigning Meaning to Programs, Symposium on Applied Mathematics, 1967, pp. 19-32 (Appeared as volume 19 of Mathematical Aspects of Computer
More informationAutomatically Validating Temporal Safety Properties of Interfaces
Automatically Validating Temporal Safety Properties of Interfaces Thomas Ball and Sriram K. Rajamani Software Productivity Tools Microsoft Research http://www.research.microsoft.com/slam/ Abstract. We
More informationFinite State Verification. CSCE Lecture 21-03/28/2017
Finite State Verification CSCE 747 - Lecture 21-03/28/2017 So, You Want to Perform Verification... You have a property that you want your program to obey. Great! Let s write some tests! Does testing guarantee
More informationBounded Model Checking Of C Programs: CBMC Tool Overview
Workshop on Formal Verification and Analysis Tools, CFDVS, IIT-Bombay - Feb 21,2017 Bounded Model Checking Of C Programs: CBMC Tool Overview Prateek Saxena CBMC Developed and Maintained by Dr Daniel Kröning
More informationReasoning about programs
Reasoning about programs Last time Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in
More informationLast time. Reasoning about programs. Coming up. Project Final Presentations. This Thursday, Nov 30: 4 th in-class exercise
Last time Reasoning about programs Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in
More informationPermissive Interfaces
Permissive Interfaces Thomas A. Henzinger Ranjit Jhala Rupak Majumdar EPFL, Switzerland UC Berkeley UC Los Angeles Abstract A modular program analysis considers components independently and provides succinct
More informationIntroduction to Axiomatic Semantics
Introduction to Axiomatic Semantics Meeting 10, CSCI 5535, Spring 2009 Announcements Homework 3 due tonight Homework 2 is graded 13 (mean), 14 (median), out of 21 total, but Graduate class: final project
More informationProgram Verification. Aarti Gupta
Program Verification Aarti Gupta 1 Agenda Famous bugs Common bugs Testing (from lecture 6) Reasoning about programs Techniques for program verification 2 Famous Bugs The first bug: A moth in a relay (1945)
More informationIntroduction to Axiomatic Semantics (1/2)
#1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember that you can t just define a meaning function in terms of itself you must use some fixed point machinery. #2 #3 Observations
More informationInterpolation-based Software Verification with Wolverine
Interpolation-based Software Verification with Wolverine Daniel Kroening 1 and Georg Weissenbacher 2 1 Computer Science Department, Oxford University 2 Department of Electrical Engineering, Princeton University
More informationPart II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs?
Part II. Hoare Logic and Program Verification Part II. Hoare Logic and Program Verification Dilian Gurov Props: Models: Specs: Method: Tool: safety of data manipulation source code logic assertions Hoare
More informationReading Assignment. Symbolic Evaluation/Execution. Move from Dynamic Analysis to Static Analysis. Move from Dynamic Analysis to Static Analysis
Reading Assignment Symbolic Evaluation/Execution *R.W. Floyd, "Assigning Meaning to Programs, Symposium on Applied Mathematics, 1967, pp. 19-32 (Appeared as volume 19 of Mathematical Aspects of Computer
More informationLecture 2: Symbolic Model Checking With SAT
Lecture 2: Symbolic Model Checking With SAT Edmund M. Clarke, Jr. School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 (Joint work over several years with: A. Biere, A. Cimatti, Y.
More informationReachability Analysis for Annotated Code
Mikoláš Janota 1 Radu Grigore 1 Micha l Moskal 2 1 Systems Research Group, University College Dublin, Ireland 2 Institute of Computer Science University of Wroc law, Poland SAVCBS 07 IST-15905 Why Annotated
More informationModel Checking with Automata An Overview
Model Checking with Automata An Overview Vanessa D Carson Control and Dynamical Systems, Caltech Doyle Group Presentation, 05/02/2008 VC 1 Contents Motivation Overview Software Verification Techniques
More informationTVLA: A SYSTEM FOR GENERATING ABSTRACT INTERPRETERS*
TVLA: A SYSTEM FOR GENERATING ABSTRACT INTERPRETERS* Tal Lev-Ami, Roman Manevich, and Mooly Sagiv Tel Aviv University {tla@trivnet.com, {rumster,msagiv}@post.tau.ac.il} Abstract TVLA (Three-Valued-Logic
More informationVerifying Temporal Properties via Dynamic Program Execution. Zhenhua Duan Xidian University, China
Verifying Temporal Properties via Dynamic Program Execution Zhenhua Duan Xidian University, China Main Points Background & Motivation MSVL and Compiler PPTL Unified Program Verification Tool Demo Conclusion
More informationAbstract Interpretation
Abstract Interpretation Ranjit Jhala, UC San Diego April 22, 2013 Fundamental Challenge of Program Analysis How to infer (loop) invariants? Fundamental Challenge of Program Analysis Key issue for any analysis
More informationPROGRAM ANALYSIS & SYNTHESIS
Lecture 02 Structural Operational Semantics (SOS) PROGRAM ANALYSIS & SYNTHESIS EranYahav 1 Previously static analysis over-approximation of program behavior abstract interpretation abstraction, transformers,
More informationAbstraction Learning
Abstraction Learning Joxan Jaffar National University of Singapore joxan@comp.nus.edu.sg Jorge Navas National University of Singapore navas@comp.nus.edu.sg Andrew E. Santosa National University of Singapore
More informationTree Interpolation in Vampire
Tree Interpolation in Vampire Régis Blanc 1, Ashutosh Gupta 2, Laura Kovács 3, and Bernhard Kragl 4 1 EPFL 2 IST Austria 3 Chalmers 4 TU Vienna Abstract. We describe new extensions of the Vampire theorem
More informationFinite Model Generation for Isabelle/HOL Using a SAT Solver
Finite Model Generation for / Using a SAT Solver Tjark Weber webertj@in.tum.de Technische Universität München Winterhütte, März 2004 Finite Model Generation for / p.1/21 is a generic proof assistant: Highly
More informationVerifiable Hierarchical Protocols with Network Invariants on Parametric Systems
Verifiable Hierarchical Protocols with Network Invariants on Parametric Systems Opeoluwa Matthews, Jesse Bingham, Daniel Sorin http://people.duke.edu/~om26/ FMCAD 2016 - Mountain View, CA Problem Statement
More informationType Theory meets Effects. Greg Morrisett
Type Theory meets Effects Greg Morrisett A Famous Phrase: Well typed programs won t go wrong. 1. Describe abstract machine: M ::= 2. Give transition relation: M 1 M 2
More informationChecking Memory Safety with Blast
Checking Memory Safety with Blast Dirk Beyer 1 Thomas A. Henzinger 12 Ranjit Jhala 3 Rupak Majumdar 4 1 EPFL, Switzerland 2 University of California, Berkeley 3 University of California, San Diego 4 University
More informationSYNERGY : A New Algorithm for Property Checking
SYNERGY : A New Algorithm for Property Checking Bhargav S. Gulavani Thomas A. Henzinger Yamini Kannan Aditya V. Nori Sriram K. Rajamani bhargav@cse.iitb.ernet.in tah@epfl.ch yaminik@microsoft.com adityan@microsoft.com
More informationLazy Abstraction with Interpolants
Lazy Abstraction with Interpolants Kenneth L. McMillan Cadence Berkeley Labs Abstract. We describe a model checker for infinite-state sequential programs, based on Craig interpolation and the lazy abstraction
More informationVerifying Concurrent Programs
Verifying Concurrent Programs Daniel Kroening 8 May 1 June 01 Outline Shared-Variable Concurrency Predicate Abstraction for Concurrent Programs Boolean Programs with Bounded Replication Boolean Programs
More informationSystem Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements
System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,
More informationAreas related to SW verif. Trends in Software Validation. Your Expertise. Research Trends High level. Research Trends - Ex 2. Research Trends Ex 1
Areas related to SW verif. Trends in Software Validation Abhik Roychoudhury CS 6214 Formal Methods Model based techniques Proof construction techniques Program Analysis Static Analysis Abstract Interpretation
More informationSeminar in Software Engineering Presented by Dima Pavlov, November 2010
Seminar in Software Engineering-236800 Presented by Dima Pavlov, November 2010 1. Introduction 2. Overview CBMC and SAT 3. CBMC Loop Unwinding 4. Running CBMC 5. Lets Compare 6. How does it work? 7. Conclusions
More informationThe Pointer Assertion Logic Engine
The Pointer Assertion Logic Engine [PLDI 01] Anders Mφller Michael I. Schwartzbach Presented by K. Vikram Cornell University Introduction Pointer manipulation is hard Find bugs, optimize code General Approach
More informationBasic Verification Strategy
ormal Verification Basic Verification Strategy compare behavior to intent System Model of system behavior intent Verifier results Intent Usually, originates with requirements, refined through design and
More informationUnbounded Symbolic Execution for Program Verification
Unbounded Symbolic Execution for Program Verification JOXAN JAFFAR 1, JORGE A. NAVAS 1, AND ANDREW E. SANTOSA 2 1 National University of Singapore 2 University of Sydney, Australia {joxan,navas}@comp.nus.edu.sg,
More informationResearch Collection. Formal background and algorithms. Other Conference Item. ETH Library. Author(s): Biere, Armin. Publication Date: 2001
Research Collection Other Conference Item Formal background and algorithms Author(s): Biere, Armin Publication Date: 2001 Permanent Link: https://doi.org/10.3929/ethz-a-004239730 Rights / License: In Copyright
More informationAutomatic Software Verification
Automatic Software Verification Instructor: Mooly Sagiv TA: Oded Padon Slides from Eran Yahav and the Noun Project, Wikipedia Course Requirements Summarize one lecture 10% one lecture notes 45% homework
More informationAn Eclipse Plug-in for Model Checking
An Eclipse Plug-in for Model Checking Dirk Beyer, Thomas A. Henzinger, Ranjit Jhala Electrical Engineering and Computer Sciences University of California, Berkeley, USA Rupak Majumdar Computer Science
More informationAutomated Debugging with Error Invariants
Automated Debugging with Error Invariants Thomas Wies New York University joint work with Jürgen Christ, Evren Ermis (Freiburg University), Martin Schäf (SRI), Daniel Schwartz-Narbonne (NYU) Faulty Shell
More informationSymbolic and Concolic Execution of Programs
Symbolic and Concolic Execution of Programs Information Security, CS 526 Omar Chowdhury 10/7/2015 Information Security, CS 526 1 Reading for this lecture Symbolic execution and program testing - James
More informationPredicate Abstraction of ANSI C Programs using SAT Λ
Predicate Abstraction of ANSI C Programs using SAT Λ Edmund Clarke and Daniel Kroening and Natalia Sharygina and Karen Yorav School of Computer Science Carnegie Mellon University, Pittsburgh, PA, USA Software
More informationAbstraction Refinement for Quantified Array Assertions
Abstraction Refinement for Quantified Array Assertions Mohamed Nassim Seghir 1,, Andreas Podelski 1, and Thomas Wies 1,2 1 University of Freiburg, Germany 2 EPFL, Switzerland Abstract. We present an abstraction
More informationProgram Verification (6EC version only)
Program Verification (6EC version only) Erik Poll Digital Security Radboud University Nijmegen Overview Program Verification using Verification Condition Generators JML a formal specification language
More informationPredicate Abstraction and Refinement Techniques for Verifying Verilog
Predicate Abstraction and Refinement Techniques for Verifying Verilog Edmund Clarke Himanshu Jain Daniel Kroening June 25, 2004 CMU-CS-04-139 School of Computer Science Carnegie Mellon University Pittsburgh,
More informationA Survey of Automated Techniques for Formal Software Verification
TRANSACTIONS ON CAD 1 A Survey of Automated Techniques for Formal Software Verification Vijay D Silva Daniel Kroening Georg Weissenbacher Abstract The quality and the correctness of software is often the
More informationProgram verification. Generalities about software Verification Model Checking. September 20, 2016
Program verification Generalities about software Verification Model Checking Laure Gonnord David Monniaux September 20, 2016 1 / 43 The teaching staff Laure Gonnord, associate professor, LIP laboratory,
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationOn Reasoning About Finite Sets in Software Model Checking
On Reasoning About Finite Sets in Software Model Checking Pavel Shved Institute for System Programming, RAS email: shved@ispras.ru Abstract A number of static checking techniques is based on constructing
More informationModel Checking Embedded C Software using k-induction and Invariants
FEDERAL UNIVERSITY OF RORAIMA and FEDERAL UNIVESITY OF AMAZONAS Model Checking Embedded C Software using k-induction and Invariants Herbert Rocha, Hussama Ismail, Lucas Cordeiro and Raimundo Barreto Agenda
More informationSAT Solver. CS 680 Formal Methods Jeremy Johnson
SAT Solver CS 680 Formal Methods Jeremy Johnson Disjunctive Normal Form A Boolean expression is a Boolean function Any Boolean function can be written as a Boolean expression s x 0 x 1 f Disjunctive normal
More informationOverview. Discrete Event Systems - Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for?
Computer Engineering and Networks Overview Discrete Event Systems - Verification of Finite Automata Lothar Thiele Introduction Binary Decision Diagrams Representation of Boolean Functions Comparing two
More informationSoftwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24
Softwaretechnik Program verification Albert-Ludwigs-Universität Freiburg June 28, 2012 Softwaretechnik June 28, 2012 1 / 24 Road Map Program verification Automatic program verification Programs with loops
More informationTypestate Verification: Abstraction Techniques and Complexity Results
Typestate Verification: Abstraction Techniques and Complexity Results J. Field a,d. Goyal a,1,g. Ramalingam a,e. Yahav b a IBM T.J. Watson Research Center. b School of Computer Science, Tel-Aviv University,
More informationCompiler Construction 2016/2017 Loop Optimizations
Compiler Construction 2016/2017 Loop Optimizations Peter Thiemann January 16, 2017 Outline 1 Loops 2 Dominators 3 Loop-Invariant Computations 4 Induction Variables 5 Array-Bounds Checks 6 Loop Unrolling
More informationHoare Logic: Proving Programs Correct
Hoare Logic: Proving Programs Correct 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich Reading: C.A.R. Hoare, An Axiomatic Basis for Computer Programming Some presentation ideas from a lecture
More informationRuntime Checking for Program Verification Systems
Runtime Checking for Program Verification Systems Karen Zee, Viktor Kuncak, and Martin Rinard MIT CSAIL Tuesday, March 13, 2007 Workshop on Runtime Verification 1 Background Jahob program verification
More informationPart II: Atomicity for Software Model Checking. Analysis of concurrent programs is difficult (1) Transaction. The theory of movers (Lipton 75)
Part II: Atomicity for Software Model Checking Class Account { int balance; static int MIN = 0, MAX = 00; bool synchronized deposit(int n) { int t = balance + n; if (t > MAX) return false; bool synchronized
More informationAutomated Theorem Proving and Proof Checking
Automated Theorem Proving and Proof Checking #1 #2 Cunning Theorem-Proving Plan There are full-semester courses on automated deduction; we will elide details. Logic Syntax Theories Satisfiability Procedures
More informationBoolean Functions (Formulas) and Propositional Logic
EECS 219C: Computer-Aided Verification Boolean Satisfiability Solving Part I: Basics Sanjit A. Seshia EECS, UC Berkeley Boolean Functions (Formulas) and Propositional Logic Variables: x 1, x 2, x 3,, x
More informationSubsumer-First: Steering Symbolic Reachability Analysis
Subsumer-First: Steering Symbolic Reachability Analysis Andrey Rybalchenko 1 and Rishabh Singh 2 1 Max Planck Institute for Software Systems (MPI-SWS) 2 Massachusetts Institue of Technology (MIT) Abstract.
More informationHandling Loops in Bounded Model Checking of C Programs via k-induction
Software Tools for Technology Transfer manuscript No. (will be inserted by the editor) Handling Loops in Bounded Model Checking of C Programs via k-induction Mikhail Y. R. Gadelha, Hussama I. Ismail, and
More informationHW/SW Codesign. WCET Analysis
HW/SW Codesign WCET Analysis 29 November 2017 Andres Gomez gomeza@tik.ee.ethz.ch 1 Outline Today s exercise is one long question with several parts: Basic blocks of a program Static value analysis WCET
More informationSynchronizing the Asynchronous
Synchronizing the Asynchronous Bernhard Kragl IST Austria Shaz Qadeer Microsoft Thomas A. Henzinger IST Austria Concurrency is Ubiquitous Asynchronous Concurrency is Ubiquitous Asynchronous programs are
More information