Journal ArticleDOI
Model checking programs
Willem Visser,Klaus Havelund,Guillaume Brat,Seungjoon Park +3 more
- Vol. 10, Iss: 2, pp 203-232
TLDR
A verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing, and uses state compression to handle big states and partial order and symmetry reduction, slicing, abstraction, and runtime analysis techniques to reduce the state space.Abstract:
The majority of the work carried out in the formal methods community throughout the last three decades has (for good reasons) been devoted to special languages designed to make it easier to experiment with mechanized formal methods such as theorem provers and model checkers. In this paper, we give arguments for why we believe it is time for the formal methods community to shift some of its attention towards the analysis of programs written in modern programming languages. In keeping with this philosophy, we have developed a verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing. Part of this work has consisted of building a new Java Virtual Machine that interprets Java bytecode. JPF uses state compression to handle large states, and partial order reduction, slicing, abstraction and run-time analysis techniques to reduce the state space. JPF has been applied to a real-time avionics operating system developed at Honeywell, illustrating an intricate error, and to a model of a spacecraft controller, illustrating the combination of abstraction, run-time analysis and slicing with model checking.read more
Citations
More filters
Proceedings ArticleDOI
KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs
TL;DR: A new symbolic execution tool, KLEE, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs, and significantly beat the coverage of the developers' own hand-written test suite is presented.
Tools and Algorithms for the Construction and Analysis of Systems. Proc. TACAS 2009
Stefan Kowalewski,Anna Philippou +1 more
TL;DR: This paper presents a meta-modelling framework for modeling and testing the robustness of the modeled systems and some of the techniques used in this framework have been developed and tested in the field.
Proceedings ArticleDOI
Extended static checking for Java
TL;DR: The Extended Static Checker for Java (ESC/Java) is introduced, an experimental compile-time program checker that finds common programming errors and provides programmers with a simple annotation language with which programmer design decisions can be expressed formally.
Journal ArticleDOI
EXE: Automatically Generating Inputs of Death
TL;DR: This article presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP.
References
More filters
Journal ArticleDOI
A deadlock detection tool for concurrent Java programs
TL;DR: An abstract formal model is generated from the Java source using the Java2Spin translator, expressed in the PROMELA language, and the SPIN tool is used to perform its formal analysis.
Journal Article
Generating finite-state abstractions of reactive systems using decision procedures
Michael Colón,Tomás E. Uribe +1 more
TL;DR: In this paper, the authors present an algorithm that uses decision procedures to generate finite-state abstractions of possibly infinite-state systems, compositionally abstracting the transitions of the system, relative to a given, fixed set of assertions.
Journal ArticleDOI
Automating software feature verification
TL;DR: A significant part of the call processing software for Lucent's new PathStar™ Access Server was checked with formal verification techniques, allowing near-interactive probing of feature requirements and quick confirmation (or rejection) of the validity of tentative software fixes.
Book ChapterDOI
dSPIN: A Dynamic Extension of SPIN
TL;DR: A number of language extensions along with their implementation in SPIN are presented, finding out that an important expressibility gain can be achieved with at most a small loss of performance.