Compositional Safety Refutation Techniques

One of the most successful techniques for refuting safety properties is to find counterexamples by bounded model checking. However, for large programs, bounded model checking instances often exceed the limits of resources available. Generating such counterexamples in a modular way could speed up refutation, but it is challenging because of the inherently non-compositional nature of these counterexamples. We start from the monolithic safety verification problem and present a step-by-step derivation of the compositional safety refutation problem. We give three algorithms that solve this problem, discuss their properties with respect to efficiency and completeness, and evaluate them experimentally.

[1]  Mark Lillibridge,et al.  Extended static checking for Java , 2002, PLDI '02.

[2]  K. Rustan M. Leino,et al.  Dafny: An Automatic Program Verifier for Functional Correctness , 2010, LPAR.

[3]  Edmund M. Clarke,et al.  Compositional model checking , 1989, [1989] Proceedings. Fourth Annual Symposium on Logic in Computer Science.

[4]  Daniel Kroening,et al.  Synthesising Interprocedural Bit-Precise Termination Proofs (T) , 2015, 2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE).

[5]  Jochen Hoenicke,et al.  Termination Analysis by Learning Terminating Programs , 2014, CAV.

[6]  Grigory Fedyukovich,et al.  Interpolation-Based Function Summaries in Bounded Model Checking , 2011, Haifa Verification Conference.

[7]  Peter Schrammel.  Challenges in Decomposing Encodings of Verification Problems , 2016, HCVS@ETAPS.

[8]  Daniel Kroening,et al.  A Tool for Checking ANSI-C Programs , 2004, TACAS.

[9]  Patrice Godefroid,et al.  Compositional dynamic test generation , 2007, POPL '07.

[10]  Daniel Kroening,et al.  Danger Invariants , 2015, ArXiv.

[11]  Thomas A. Henzinger,et al.  Automating Modular Verification , 1999, CONCUR.

[12]  Jörg Brauer,et al.  Inferring Definite Counterexamples through Under-Approximation , 2012, NASA Formal Methods.

[13]  Sriram Sankaranarayanan,et al.  Static Analysis in Disjunctive Numerical Domains , 2006, SAS.

[14]  Mark Harman,et al.  An overview of program slicing , 2001, Softw. Focus.

[15]  Daniel Kroening,et al.  Successful Use of Incremental BMC in the Automotive Industry , 2015, FMICS.

[16]  Edmund M. Clarke,et al.  Counterexample-guided abstraction refinement , 2003, 10th International Symposium on Temporal Representation and Reasoning, 2003 and Fourth International Conference on Temporal Logic. Proceedings..

[17]  Daniel Kroening,et al.  Safety Verification and Refutation by k-Invariants and k-Induction , 2015, SAS.

[18]  Daniel Kroening,et al.  2LS for Program Analysis - (Competition Contribution) , 2016, TACAS.

[19]  Antoine Miné,et al.  Inferring Sufficient Conditions with Backward Polyhedral Under-Approximations , 2012, NSAD@SAS.

[20]  Daniel Kroening,et al.  Synthesising Interprocedural Bit-Precise Termination Proofs , 2015 .

[21]  Sumit Gulwani,et al.  Program analysis as constraint solving , 2008, PLDI '08.

[22]  Nikolaj Bjørner,et al.  Compositional verification of procedural programs using horn clauses over integers and arrays , 2015, 2015 Formal Methods in Computer-Aided Design (FMCAD).

[23]  Sumit Gulwani,et al.  Proving Conditional Termination , 2008, CAV.

[24]  Marsha Chechik,et al.  Whale: An Interpolation-Based Algorithm for Inter-procedural Verification , 2012, VMCAI.

[25]  Kedar S. Namjoshi,et al.  On the completeness of compositional reasoning methods , 2010, TOCL.

[26]  Shuvendu K. Lahiri,et al.  Statically Validating Must Summaries for Incremental Compositional Dynamic Test Generation , 2011, SAS.