Chapter 20. Software Verification

2021 ◽  
Author(s):  
Daniel Kroening
Keyword(s):  
Program Analysis ◽  
Software Verification ◽  
Embedded Software ◽  
Propositional Satisfiability ◽  
Low Level

This chapter covers an application of propositional satisfiability to program analysis. We focus on the discovery of programming flaws in low-level programs, such as embedded software. The loops in the program are unwound together with a property to form a formula, which is then converted into CNF. The method supports low-level programming constructs such as bit-wise operators or pointer arithmetic.

Bounded Verification of Multi-threaded Programs via Lazy Sequentialization

2022 ◽  
Vol 44 (1) ◽  
pp. 1-50
Author(s):  
Omar Inverso ◽  
Ermenegildo Tomasco ◽  
Bernd Fischer ◽  
Salvatore La Torre ◽  
Gennaro Parlato
Keyword(s):  
Program Analysis ◽  
High Performance ◽  
Software Verification ◽  
Bounded Model Checking ◽  
New Approach ◽  
C Programming Language ◽  
C Programming ◽  
Verification Problem ◽  
Practical Program ◽  
Verification Techniques

Bounded verification techniques such as bounded model checking (BMC) have successfully been used for many practical program analysis problems, but concurrency still poses a challenge. Here, we describe a new approach to BMC of sequentially consistent imperative programs that use POSIX threads. We first translate the multi-threaded program into a nondeterministic sequential program that preserves reachability for all round-robin schedules with a given bound on the number of rounds. We then reuse existing high-performance BMC tools as backends for the sequential verification problem. Our translation is carefully designed to introduce very small memory overheads and very few sources of nondeterminism, so it produces tight SAT/SMT formulae, and is thus very effective in practice: Our Lazy-CSeq tool implementing this translation for the C programming language won several gold and silver medals in the concurrency category of the Software Verification Competitions (SV-COMP) 2014–2021 and was able to find errors in programs where all other techniques (including testing) failed. In this article, we give a detailed description of our translation and prove its correctness, sketch its implementation using the CSeq framework, and report on a detailed evaluation and comparison of our approach.

scholarly journals Transformation-Enabled Precondition Inference

2021 ◽  
pp. 1-17
Author(s):  
BISHOKSAN KAFLE ◽  
GRAEME GANGE ◽  
PETER J. STUCKEY ◽  
PETER SCHACHTE ◽  
HARALD SØNDERGAARD
Keyword(s):  
Iterative Method ◽  
Program Analysis ◽  
Experimental Evaluation ◽  
Software Verification ◽  
Termination Criteria ◽  
Initial States

Abstract Precondition inference is a non-trivial problem with important applications in program analysis and verification. We present a novel iterative method for automatically deriving preconditions for the safety and unsafety of programs. Each iteration maintains over-approximations of the set of safe and unsafe initial states, which are used to partition the program’s initial states into those known to be safe, known to be unsafe and unknown. We then construct revised programs with those unknown initial states and iterate the procedure until the approximations are disjoint or some termination criteria are met. An experimental evaluation of the method on a set of software verification benchmarks shows that it can infer precise preconditions (sometimes optimal) that are not possible using previous methods.

A Fresh Look at Zones and Octagons

2021 ◽  
Vol 43 (3) ◽  
pp. 1-51
Author(s):  
Graeme Gange ◽  
Zequn Ma ◽  
Jorge A. Navas ◽  
Peter Schachte ◽  
Harald Søndergaard ◽  
...  
Keyword(s):  
Data Structures ◽  
Program Analysis ◽  
Software Verification ◽  
State Of The Art ◽  
The State ◽  
Bound Constraints ◽  
Data Structures And Algorithms ◽  
Alternative Approaches ◽  
Abstract Domains ◽  
Automated Discovery

Zones and Octagons are popular abstract domains for static program analysis. They enable the automated discovery of simple numerical relations that hold between pairs of program variables. Both domains are well understood mathematically but the detailed implementation of static analyses based on these domains poses many interesting algorithmic challenges. In this article, we study the two abstract domains, their implementation and use. Utilizing improved data structures and algorithms for the manipulation of graphs that represent difference-bound constraints, we present fast implementations of both abstract domains, built around a common infrastructure. We compare the performance of these implementations against alternative approaches offering the same precision. We quantify the differences in performance by measuring their speed and precision on standard benchmarks. We also assess, in the context of software verification, the extent to which the improved precision translates to better verification outcomes. Experiments demonstrate that our new implementations improve the state of the art for both Zones and Octagons significantly.

Assessment of nutrition of working-age men with a low level of physical activity

2020 ◽  
pp. 117-122
Author(s):  
L. A. Proskuryakova ◽  
E. N. Lobykina
Keyword(s):  
Physical Activity ◽  
Program Analysis ◽  
Saturated Fatty Acids ◽  
Study Groups ◽  
Normative Values ◽  
Caloric Content ◽  
Work Activity ◽  
Low Level ◽  
Simple Carbohydrates ◽  
Group 1

Ensuring the preservation of the country’s labor potential has always been a priority for Russian health care. Analysis of the nutrition of a group of people united by a number of characteristics (gender, age, place of residence, peculiarities of labor activity) is an important direction in the implementation of therapeutic and preventive measures.In order to develop preventive recommendations for rationalization of nutrition, an analysis of the nutrition of men of different ages in Novokuznetsk, whose work activity is characterized by a low level of physical activity, was carried out.A retrospective one-step study of 169 men aged 23–48 years with low physical activity, living for more than 10 years in Novokuznetsk, was conducted. There are two groups: 1 group — up to and including 39 years (89 people) and 2 group–40 years and older (80 people). The actual nutrition of men was evaluated by the computer program “Analysis of the state of human nutrition” (Version 1.2. State Research Institute of Nutrition of the Russian Academy of Sciences 2003–2005).The caloric content of the diet exceeded the standards in group 1 by 1.6 times (by 1333 kcal), in group 2 — by 1.7 times (by 1367 kcal). Increased consumption of total fat in men up to 39 years and 1.4 times, 40 years and older is 1.5 times, and the proportion of saturated fatty acids (SFAS) above the norm by 1.3 times in males up to 39 years and aged 40 years and older, 1.6 times; cholesterol higher than normative values at the age of 39 years 175 mg , aged 40 years and older at 365 mg. Protein consumption in both groups was statistically significantly higher than normal (116 g at 68 g and 113 g at 65 g in group 1 and 2, respectively). There was a deficit of dietary fiber consumption by 12 and 10 g, respectively, in the study groups, with increased use of mono and disaccharides in the diet by 2 or more times. The consumption of mineral substances in men in both groups is statistically significantly exceeded in comparison with the norms of physiological needs (NFN) consumption of sodium (p1<0.001, p2<0.001); potassium (p1=0.001, p2=0.001); calcium (p1<0.02, p2=0.02); phosphorus (p1<0.001, p2<0.001), iron (p1<0.001; p2<0.001), vitamins a in retinol equivalents (p1=0.004, p2<0.001), B2 (p1=0.03, p2=0.02); C (p1=0.04, p2=0.002).The diets of able-bodied men with low levels of physical activity, unbalanced in the direction of excess total caloric intake, amount of proteins and fats, simple carbohydrates, cholesterol, sodium, potassium, phosphorus, calcium, iron, vitamins A, C, B2, which is a serious risk factor for chronic non-infectious diseases (CNID) and should be considered when implementing prevention and treatment programmes in enterprises.

scholarly journals A Modern Look at GRIN, an Optimizing Functional Language Back End

2021 ◽  
Author(s):  
Peter Podlovics ◽  
Csaba Hruska ◽  
Andor Pénzes
Keyword(s):  
Program Analysis ◽  
Ad Hoc ◽  
Functional Languages ◽  
Functional Language ◽  
Program Optimization ◽  
Graph Reduction ◽  
Code Transformations ◽  
Low Level ◽  
Intermediate Language ◽  
The Dead

GRIN is short for Graph Reduction Intermediate Notation, a modern back end for lazy functional languages. Most of the currently available compilers for such languages share a common flaw: they can only optimize programs on a per-module basis. The GRIN framework allows for interprocedural whole program analysis, enabling optimizing code transformations across functions and modules as well. Some implementations of GRIN already exist, but most of them were developed only for experimentation purposes. Thus, they either compromise on low-level efficiency or contain ad hoc modifications compared to the original specification. Our goal is to provide a full-fledged implementation of GRIN by combining the currently available best technologies like LLVM, and evaluate the framework's effectiveness by measuring how the optimizer improves the performance of certain programs. We also present some improvements to the already existing components of the framework. Some of these improvements include a typed representation for the intermediate language and an interprocedural program optimization, the dead data elimination.

scholarly journals A Theory of Arrays with set and copy Operations

10.29007/q58t ◽  
2018 ◽  
Author(s):  
Stephan Falke ◽  
Carsten Sinz ◽  
Florian Merz
Keyword(s):  
Model Checking ◽  
Program Analysis ◽  
Software Verification ◽  
Symbolic Execution ◽  
Bounded Model Checking ◽  
Main Memory ◽  
Basic Theory ◽  
Analysis Software

The theory of arrays is widely used in order to model main memory in program analysis, software verification, bounded model checking, symbolic execution, etc. Nonetheless, the basic theory as introduced by McCarthy is not expressive enough for important practical cases since it only supports array updates at single locations. In programs, the memory is often modified using functions such as memset or memcpy/memmove, which modify a user-specified range of locations whose size might not be known statically. In this paper we present an extension of the theory of arrays with set and copy operations which make it possible to reason about such functions. We also discuss further applications of the theory.

scholarly journals Violation Witnesses and Result Validation for Multi-Threaded Programs

2020 ◽  
pp. 449-470
Author(s):  
Dirk Beyer ◽  
Karlheinz Friedberger
Keyword(s):  
Program Analysis ◽  
Software Verification ◽  
Large Set ◽  
Standard Format ◽  
Exchange Format ◽  
Program Traces ◽  
Verification Tools ◽  
Reference Implementation ◽  
Validation Of Results

Abstract Invariants and error traces are important results of a program analysis, and therefore, a standardized exchange format for verification witnesses is used by many program analyzers to store and share those results. This way, information about program traces and variable assignments can be shared across tools, e.g., to validate verification results, or provided to users, e.g., to visualize and explore the results in order to fix bugs or understand the reason for a program’s correctness. The standard format for correctness and violation witnesses that was used by SV-COMP for several years was only applicable to sequential (single-threaded) programs. To enable the validation of results for multi-threaded programs, we extend the existing standard exchange format by adding information about thread management and thread interleaving. We contribute a reference implementation of a validator for violation witnesses in the new format, which we implemented as component of the software-verification framework "Image missing" . We experimentally evaluate the format and validator on a large set of violation witnesses. The outcome is promising: several verification tools already produce violation witnesses that help validating the verification results, and our witness validator can re-verify most of the produced witnesses.

Sign in / Sign up

Export Citation Format

Share Document