The quality and the correctness of software are often the greatest concern in electronic systems. Formal verification tools can provide a guarantee that a design is free of specific flaws. This paper surveys algorithms that perform automatic static analysis of software to detect programming errors or prove their absence. The three techniques considered are static analysis with abstract domains, model checking, and bounded model checking. A short tutorial on these techniques is provided, highlighting their differences when applied to practical problems. This paper also surveys tools implementing these techniques and describes their merits and shortcomings.

/pdf/a-survey-of-automated-techniques-for-formal-software-1dfddyp6ry.pdf

A Survey of Automated Techniques for Formal Software Verification

We present regular model checking, a framework for algorithmic verification of infinite-state systems with, e.g., queues, stacks, integers, or a parameterized linear topology. States are represented by strings over a finite alphabet and the transition relation by a regular length-preserving relation on strings. Major problems in the verification of parameterized and infinite-state systems are to compute the set of states that are reachable from some set of initial states, and to compute the transitive closure of the transition relation. We present two complementary techniques for these problems. One is a direct automata-theoretic construction, and the other is based on widening. Both techniques are incomplete in general, but we give sufficient conditions under which they work. We also present a method for verifying ω-regular properties of parameterized systems, by computation of the transitive closure of a transition relation.

Regular model checking

Keynote Paper A Survey of Automated Techniques for Formal Software Verification

The paper presents a method for the automatic verification of a certain class of parameterized systems. These are bounded-data systems consisting of N processes (N being the parameter), where each process is finite-state. First, we show that if we use the standard deductive inv rule for proving invariance properties, then all the generated verification conditions can be automatically resolved by finite-state (BDD-based) methods with no need for interactive theorem proving.Next, we show how to use model-checking techniques over finite (and small) instances of the parameterized system in order to derive candidates for invariant assertions. Combining this automatic computation of invariants with the previously mentioned resolution of the VCs (verification conditions) yields a (necessarily) incomplete but fully automatic sound method for verifying bounded-data parameterized systems. The generated invariants can be transferred to the VC-validation phase without ever been examined by the user, which explains why we refer to them as "invisible".We illustrate the method on a non-trivial example of a cache protocol, provided by Steve German.

/pdf/automatic-deductive-verification-with-invisible-invariants-2zkb0mv38p.pdf

Automatic Deductive Verification with Invisible Invariants

Regular Model Checking

Symbolic model checking with rich assertional languages

The paper shows that, by an appropriate choice of a rich assertional language, it is possible to extend the utility of symbolic model checking beyond the realm of BDD-represented finite-state systems into the domain of infinite-state systems, leading to a powerful technique for uniform verification of unbounded (parameterized) process networks.

/pdf/symbolic-model-checking-with-rich-ssertional-languages-rq994lu2ip.pdf

Symbolic Model Checking with Rich ssertional Languages

We propose a method for proving refinement between programs, based on augmenting the program by ghost (auxiliary) variables and statements that assign values to these variables. We show that, in many cases, this augmentation can replace the need for an explicit refinement mapping from the variables of one system to the private variables of the other system. A novel feature of the proposed methodology is that the expressions assigned to the ghost variables may depend on the future. This may replace the need for prophecy variables that are defined by a decreasing induction and require some version of finite-image hypothesis. We believe that proving refinement by program augmentation leads to a more natural style of refinement and is easier to design and comprehend. Allowing future-dependent expressions in a program requires extensions to the temporal methodology for proving properties of programs. These extensions are explained and discussed in the paper.

M. Marcus

Papers

Symbolic model checking with rich assertional languages

Symbolic Model Checking with Rich ssertional Languages

Using Ghost Variables to Prove Refinement