SMT-based model checking for recursive programs
We present an SMT-based symbolic model checking algorithm for safety verification of
recursive programs. The algorithm is modular and analyzes procedures individually. Unlike …
recursive programs. The algorithm is modular and analyzes procedures individually. Unlike …
Local reasoning about the presence of bugs: Incorrectness separation logic
There has been a large body of work on local reasoning for proving the absence of bugs, but
none for proving their presence. We present a new formal framework for local reasoning …
none for proving their presence. We present a new formal framework for local reasoning …
A unifying view on SMT-based software verification
After many years of successful development of new approaches for software verification,
there is a need to consolidate the knowledge about the different abstract domains and …
there is a need to consolidate the knowledge about the different abstract domains and …
Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification
In this paper, we present Ufo, a framework and a tool for verifying (and finding bugs in)
sequential C programs. The framework is built on top of the LLVM compiler infrastructure …
sequential C programs. The framework is built on top of the LLVM compiler infrastructure …
Beautiful interpolants
We describe a compositional approach to Craig interpolation based on the heuristic that
simpler proofs of special cases are more likely to generalize. The method produces simple …
simpler proofs of special cases are more likely to generalize. The method produces simple …
Automatic abstraction in SMT-based unbounded software model checking
Software model checkers based on under-approximations and SMT solvers are very
successful at verifying safety (ie, reachability) properties. They combine two key ideas–(a) …
successful at verifying safety (ie, reachability) properties. They combine two key ideas–(a) …
Polynomial reachability witnesses via Stellensätze
We consider the fundamental problem of reachability analysis over imperative programs
with real variables. Previous works that tackle reachability are either unable to handle …
with real variables. Previous works that tackle reachability are either unable to handle …
Maximal specification synthesis
Many problems in program analysis, verification, and synthesis require inferring
specifications of unknown procedures. Motivated by a broad range of applications, we …
specifications of unknown procedures. Motivated by a broad range of applications, we …
[PDF][PDF] Program Verification as Satisfiability Modulo Theories.
A key driver of SMT over the past decade has been an interchange format, SMT-LIB, and a
growing set of benchmarks sharing this common format. SMT-LIB captures very well an …
growing set of benchmarks sharing this common format. SMT-LIB captures very well an …
Living with uncertainty in the age of runtime models
Uncertainty can be defined as the difference between information that is represented in an
executing system and the information that is both measurable and available about the …
executing system and the information that is both measurable and available about the …