Spring 2006
CS 498: Software Model-Checking
2:00-3:15 Wed and Fri
1131 Siebel Ctr.
Verified software is one of the grand challenges of computer science.
As the complexity of software increases and as systems pervade our
day-to-day activities, verification of systems ranging from cell
phones to medical equipment to aircraft software to secure programs,
has become a vibrant and important field.
We will study various approaches to analyse and verify software,
with emphasis on automatic techniques.
We will entirely avoid techniques where substantial human help is
required (such as manual theorem proving).
The course will concentrate on mainly three verification paradigms:
(a) dataflow analysis techniques (fast, scalable, but coarse analysis)
(b) explicit software verification techniques (eg. SPIN, JPF) and
(c) techniques where the system is abstracted into a tractable model
which is then algorithmically/symbolically verified (eg. SLAM).
We will also discuss various specification languages that can formally
describe properties of software and decision procedures to verify them.
Specific topics will include:
dataflow analysis, flow sensitive/insensitive analysis,
control-flow abstraction, abstract interpretation,
predicate abstraction using theorem proving, finite and pushdown
models, state-space exploration, symbolic techniques, abstraction
refinement, abstraction of data structures and shape analysis,
symbolic evaluation, reactive systems, and analysis of concurrent
software.
Basis of tools such as SMV, SPIN, SLAM, Bandera, Java Path Finder, Zing
and TVLA will be covered.
[ This course will have little overlap with CS 476 (Software
verification) and CS 477 (Formal Software Dev Methods). ]
This course requires mathematical maturity, and some knowledge of
automata theory (CS 273) and basic propositional logic.
See here for a similar course offered
in Spring last year and an
overview of its content.
References:
Principles of Program Analysis, by Nielson, Nielson, and Hankin
Model Checking, by Clarke, Grumberg, and Peled
Lectures
Lecture#1 (Wed, Jan 18): Introduction, motivation, and
review of research
Lecture#2 (Fri, Jan 20): The control flow graph of a program; a simple
while-programing language syntax
Lecture#3 (Wed, Jan 25): Dataflow analysis I: Available expression
analysis, recursive equations, least and greatest fixed
points, Tarski-Knaster theorem.
Lecture#4 (Fri, Jan 27): Dataflow analysis II: Reaching definitions,
Very busy expressions, Live variable analysis.
Lecture#5 (Wed, Feb 1): Finite state reachability games, solving games,
determinacy, and checking emptiness of pushdown
automata. (Slides)
Lecture#6 (Fri, Feb 3): Regularity of reachable configurations of
a pushdown automaton; regularity of pre*(L)
where L is regular; model-checking algorithms
for pushdown systems.
Ref: Efficient Algorithms for Model Checking Pushdown Systems,
by Esparza, Hansel, Rossmanith, and Schwoon.
Lecture#7 (Wed, Feb 8): Interprocedural dataflow analysis
Ref:
Precise Interprocedural Dataflow Analysis via Graph Reachability,
by Thomas Reps, Susan Horwitz, Mooly Sagiv
Homework 1:: Due Feb 17
Lecture#8 (Fri, Feb 10): Recap of Interprocedural dataflow analysis,
Finding bad programming practices in code for security violations.
Ref: MOPS: MOdelchecking Programs for Security properties,
by Hao Chen and David Wagner. (See ACM CCS 2002 paper on the page)
Lecture#9 (Wed, Feb 15): Binary decision diagrams; OBDDs, canonicity
Lecture Slides
Ref:
Graph based algorithms for Boolean Function Manipulation,
by Randal Bryant.
Lecture#10 (Fri, Feb 17): Model-checking using BDDs; binary operations;
checking reachability
Lecture#11 (Wed, Feb 22): Computation Tree Logic (CTL), explicit
model checking of CTL
Lecture#12 (Fri, Feb 24): Symbolic model checking of CTL using BDDs,
fixed-point formulations, mu-calculus
and model-checking the mu-calculus
Homework 2:: Due Mar 8
Lecture#13 (Wed, Mar 1): The notion of reactive systems; Linear-time Temporal Logic (LTL): syntax and semantics using infinite words; Buchi automata
Ref:
Linear-time temporal logic and Buchi automata
-- Madhavan Mukund..
Lecture#14 (Fri, Mar 3): Generalized Buchi automata; emptiness checking; translating LTL to Buchi automata; model-checking LTL.
Lecture#15 (Wed, Mar 8): Predicate abstraction and SLAM
Lecture#16 (Fri, Mar 10): Predicate abstraction theory: Graf and Saidi
Lecture#17 (Wed, Mar 15): Predicate abstraction theory contd: Graf and Saidi
Lecture#18 (Fri, Mar 17): Revisiting SLAM: abstraction, symbolic evaluation and refinement
Lecture#19 (Wed, Mar 29): Bounded model checking using SAT.
Lecture#20 (Fri, Mar 31): The internals of a SAT solver
Lecture#21 (Wed, Apr 5): Shape analysis for analyzing heaps
Shape Analysis -- analyzing dynamic data with pointers -- Reps, Sagiv, Wilhelm
See the papers:
Static Program Analysis via 3-valued logic CAV'04 invited talk
Parametric
Shape Analysis via a 3-valued logic,
TOPLAS'02 (has all details)
See talk:
Static Program Analysis via 3-valued logic, CAV'04 invited talk.
Lecture#22 (Fri, Apr 7): Shape analysis for analyzing heaps (contd.)
Lecture#23 (Wed, Apr 12): Pointer analysis: flow-insensitive; interprocedural.
See Points-to Analysis in Almost Linear Time, by Bjarne Steensgard, POPL 1996.
Lecture#24 (Fri, Apr 14): Checking concurrent programs with recursion;
decidability of bounded context-switching programs.
Lecture#25 (Wed, Apr 19): Atomicity in concurrent programs;
transactions; checking atomicity using transactional types.
Lecture#26 (Fri, Apr 21): Concurrency theory: Petri nets, unfoldings,
modeling control of concurrent programs using nets, atomicity.
Presentation (Wed, Apr 26) by Ralf Sasse : Static checking using theorem proving: ESC/Java2
See
ESC/Java2 paper CASSIS 2004
Simplify theorem prover HPL technical report
original ESC/Java paper
User manual
Full program verification alternative using JML, KeY