Chapter 20. Software Verification

Author(s):  
Daniel Kroening

This chapter covers an application of propositional satisfiability to program analysis. We focus on the discovery of programming flaws in low-level programs, such as embedded software. The loops in the program are unwound together with a property to form a formula, which is then converted into CNF. The method supports low-level programming constructs such as bit-wise operators or pointer arithmetic.

2022 ◽  
Vol 44 (1) ◽  
pp. 1-50
Author(s):  
Omar Inverso ◽  
Ermenegildo Tomasco ◽  
Bernd Fischer ◽  
Salvatore La Torre ◽  
Gennaro Parlato

Bounded verification techniques such as bounded model checking (BMC) have successfully been used for many practical program analysis problems, but concurrency still poses a challenge. Here, we describe a new approach to BMC of sequentially consistent imperative programs that use POSIX threads. We first translate the multi-threaded program into a nondeterministic sequential program that preserves reachability for all round-robin schedules with a given bound on the number of rounds. We then reuse existing high-performance BMC tools as backends for the sequential verification problem. Our translation is carefully designed to introduce very small memory overheads and very few sources of nondeterminism, so it produces tight SAT/SMT formulae, and is thus very effective in practice: Our Lazy-CSeq tool implementing this translation for the C programming language won several gold and silver medals in the concurrency category of the Software Verification Competitions (SV-COMP) 2014–2021 and was able to find errors in programs where all other techniques (including testing) failed. In this article, we give a detailed description of our translation and prove its correctness, sketch its implementation using the CSeq framework, and report on a detailed evaluation and comparison of our approach.


Author(s):  
BISHOKSAN KAFLE ◽  
GRAEME GANGE ◽  
PETER J. STUCKEY ◽  
PETER SCHACHTE ◽  
HARALD SØNDERGAARD

Abstract Precondition inference is a non-trivial problem with important applications in program analysis and verification. We present a novel iterative method for automatically deriving preconditions for the safety and unsafety of programs. Each iteration maintains over-approximations of the set of safe and unsafe initial states, which are used to partition the program’s initial states into those known to be safe, known to be unsafe and unknown. We then construct revised programs with those unknown initial states and iterate the procedure until the approximations are disjoint or some termination criteria are met. An experimental evaluation of the method on a set of software verification benchmarks shows that it can infer precise preconditions (sometimes optimal) that are not possible using previous methods.


2021 ◽  
Vol 43 (3) ◽  
pp. 1-51
Author(s):  
Graeme Gange ◽  
Zequn Ma ◽  
Jorge A. Navas ◽  
Peter Schachte ◽  
Harald Søndergaard ◽  
...  

Zones and Octagons are popular abstract domains for static program analysis. They enable the automated discovery of simple numerical relations that hold between pairs of program variables. Both domains are well understood mathematically but the detailed implementation of static analyses based on these domains poses many interesting algorithmic challenges. In this article, we study the two abstract domains, their implementation and use. Utilizing improved data structures and algorithms for the manipulation of graphs that represent difference-bound constraints, we present fast implementations of both abstract domains, built around a common infrastructure. We compare the performance of these implementations against alternative approaches offering the same precision. We quantify the differences in performance by measuring their speed and precision on standard benchmarks. We also assess, in the context of software verification, the extent to which the improved precision translates to better verification outcomes. Experiments demonstrate that our new implementations improve the state of the art for both Zones and Octagons significantly.


Author(s):  
L. A. Proskuryakova ◽  
E. N. Lobykina

Ensuring the preservation of the country’s labor potential has always been a priority for Russian health care. Analysis of the nutrition of a group of people united by a number of characteristics (gender, age, place of residence, peculiarities of labor activity) is an important direction in the implementation of therapeutic and preventive measures.In order to develop preventive recommendations for rationalization of nutrition, an analysis of the nutrition of men of different ages in Novokuznetsk, whose work activity is characterized by a low level of physical activity, was carried out.A retrospective one-step study of 169 men aged 23–48 years with low physical activity, living for more than 10 years in Novokuznetsk, was conducted. There are two groups: 1 group — up to and including 39 years (89 people) and 2 group–40 years and older (80 people). The actual nutrition of men was evaluated by the computer program “Analysis of the state of human nutrition” (Version 1.2. State Research Institute of Nutrition of the Russian Academy of Sciences 2003–2005).The caloric content of the diet exceeded the standards in group 1 by 1.6 times (by 1333 kcal), in group 2 — by 1.7 times (by 1367 kcal). Increased consumption of total fat in men up to 39 years and 1.4 times, 40 years and older is 1.5 times, and the proportion of saturated fatty acids (SFAS) above the norm by 1.3 times in males up to 39 years and aged 40 years and older, 1.6 times; cholesterol higher than normative values at the age of 39 years 175 mg , aged 40 years and older at 365 mg. Protein consumption in both groups was statistically significantly higher than normal (116 g at 68 g and 113 g at 65 g in group 1 and 2, respectively). There was a deficit of dietary fiber consumption by 12 and 10 g, respectively, in the study groups, with increased use of mono and disaccharides in the diet by 2 or more times. The consumption of mineral substances in men in both groups is statistically significantly exceeded in comparison with the norms of physiological needs (NFN) consumption of sodium (p1<0.001, p2<0.001); potassium (p1=0.001, p2=0.001); calcium (p1<0.02, p2=0.02); phosphorus (p1<0.001, p2<0.001), iron (p1<0.001; p2<0.001), vitamins a in retinol equivalents (p1=0.004, p2<0.001), B2 (p1=0.03, p2=0.02); C (p1=0.04, p2=0.002).The diets of able-bodied men with low levels of physical activity, unbalanced in the direction of excess total caloric intake, amount of proteins and fats, simple carbohydrates, cholesterol, sodium, potassium, phosphorus, calcium, iron, vitamins A, C, B2, which is a serious risk factor for chronic non-infectious diseases (CNID) and should be considered when implementing prevention and treatment programmes in enterprises.


2021 ◽  
Author(s):  
Peter Podlovics ◽  
Csaba Hruska ◽  
Andor Pénzes

GRIN is short for Graph Reduction Intermediate Notation, a modern back end for lazy functional languages. Most of the currently available compilers for such languages share a common flaw: they can only optimize programs on a per-module basis. The GRIN framework allows for interprocedural whole program analysis, enabling optimizing code transformations across functions and modules as well. Some implementations of GRIN already exist, but most of them were developed only for experimentation purposes. Thus, they either compromise on low-level efficiency or contain ad hoc modifications compared to the original specification. Our goal is to provide a full-fledged implementation of GRIN by combining the currently available best technologies like LLVM, and evaluate the framework's effectiveness by measuring how the optimizer improves the performance of certain programs. We also present some improvements to the already existing components of the framework. Some of these improvements include a typed representation for the intermediate language and an interprocedural program optimization, the dead data elimination.


10.29007/q58t ◽  
2018 ◽  
Author(s):  
Stephan Falke ◽  
Carsten Sinz ◽  
Florian Merz

The theory of arrays is widely used in order to model main memory in program analysis, software verification, bounded model checking, symbolic execution, etc. Nonetheless, the basic theory as introduced by McCarthy is not expressive enough for important practical cases since it only supports array updates at single locations. In programs, the memory is often modified using functions such as memset or memcpy/memmove, which modify a user-specified range of locations whose size might not be known statically. In this paper we present an extension of the theory of arrays with set and copy operations which make it possible to reason about such functions. We also discuss further applications of the theory.


2015 ◽  
Vol 15 (4-5) ◽  
pp. 526-542 ◽  
Author(s):  
GRAEME GANGE ◽  
JORGE A. NAVAS ◽  
PETER SCHACHTE ◽  
HARALD SØNDERGAARD ◽  
PETER J. STUCKEY

AbstractMany recent analyses for conventional imperative programs begin by transforming programs into logic programs, capitalising on existing LP analyses and simple LP semantics. We propose using logic programs as an intermediate program representation throughout the compilation process. With restrictions ensuring determinism and single-modedness, a logic program can easily be transformed to machine language or other low-level language, while maintaining the simple semantics that makes it suitable as a language for program analysis and transformation. We present a simple LP language that enforces determinism and single-modedness, and show that it makes a convenient program representation for analysis and transformation.


Sign in / Sign up

Export Citation Format

Share Document