Precise interprocedural dataflow analysis via graph reachability
POPL '95 Proceedings of the 22nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
The SLAM project: debugging system software via static analysis
POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Parametric shape analysis via 3-valued logic
ACM Transactions on Programming Languages and Systems (TOPLAS)
Counterexample-guided abstraction refinement for symbolic model checking
Journal of the ACM (JACM)
Proceedings of the 31st ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Modular Verification of Software Components in C
IEEE Transactions on Software Engineering
Testing, abstraction, theorem proving: better together!
Proceedings of the 2006 international symposium on Software testing and analysis
SYNERGY: a new algorithm for property checking
Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering
The software model checker Blast: Applications to software engineering
International Journal on Software Tools for Technology Transfer (STTT)
ISSTA '08 Proceedings of the 2008 international symposium on Software testing and analysis
TACAS '09 Proceedings of the 15th International Conference on Tools and Algorithms for the Construction and Analysis of Systems: Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2009,
Program Analysis with Dynamic Precision Adjustment
ASE '08 Proceedings of the 2008 23rd IEEE/ACM International Conference on Automated Software Engineering
CAV'06 Proceedings of the 18th international conference on Computer Aided Verification
Abstraction refinement via inductive learning
CAV'05 Proceedings of the 17th international conference on Computer Aided Verification
Counterexample driven refinement for abstract interpretation
TACAS'06 Proceedings of the 12th international conference on Tools and Algorithms for the Construction and Analysis of Systems
A decade of software model checking with SLAM
Communications of the ACM
Hi-index | 0.02 |
Shape analysis is a promising technique to prove program properties about recursive data structures. The challenge is to automatically determine the data-structure type, and to supply the shape analysis with the necessary information about the data structure. We present a stepwise approach to the selection of instrumentation predicates for a TVLA-based shape analysis, which takes us a step closer towards the fully automatic verification of data structures. The approach uses two techniques to guide the refinement of shape abstractions: (1) during program exploration, an explicit heap analysis collects sample instances of the heap structures, which are used to identify the data structures that are manipulated by the program; and (2) during abstraction refinement along an infeasible error path, we consider different possible heap abstractions and choose the coarsest one that eliminates the infeasible path. We have implemented this combined approach for automatic shape refinement as an extension of the software model checker BLAST. Example programs from a data-structure library that manipulate doubly-linked lists and trees were successfully verified by our tool.