Abstract:One of the main challenges in the verification of software systems is the analysis of unbounded data structures with dynamic memory allocation, such as linked data structures and arrays. We describe Bohne, a new analysis for verifying data structures. Bohne verifies data structure operations and shows that 1) the operations preserve data structure invariants and 2) the operations satisfy their specifications expressed in terms of changes to the set of objects stored in the data structure. During the analysis, Bohne infers loop invariants in the form of disjunctions of universally quantified Boolean combinations of formulas. To synthesize loop invariants of this form, Bohne uses a combination of decision procedures for Monadic Second-Order Logic over trees, SMT-LIB decision procedures (currently CVC Lite), and an automated reasoner within the Isabelle interactive theorem prover. This architecture shows that synthesized loop invariants can serve as a useful communication mechanism between different decision procedures. Using Bohne, we have verified operations on data structures such as linked lists with iterators and back pointers, trees with and without parent pointers, two-level skip lists, array data structures, and sorted lists. We have deployed Bohne in the Hob and Jahob data structure analysis systems, enabling us to combine Bohne with analyses of data structure clients and apply it in the context of larger programs. This report describes the Bohne algorithm as well as techniques that Bohne uses to reduce the ammount of annotations and the running time of the analysis.

Automated Verification of Tree-Manipulating Programs Using Constrained Horn Clauses

Ultimate TreeAutomizer (CHC-COMP Tool Description)

Bottoms Up for CHCs: Novel Transformation of Linear Constrained Horn Clauses to Software Verification

Unifying Model Execution and Deductive Verification with Interaction Trees in Isabelle/HOL

ADCL: Acceleration Driven Clause Learning for Constrained Horn Clauses

Catamorphic Abstractions for Constrained Horn Clause Satisfiability

An encoding of array verification problems into array-free Horn clauses

On Verifying Complex Properties using Symbolic Shape Analysis

Constraint-based automatic verification of abstract models of multithreaded programs

Verifying Programs Using Abstraction and Theorem Proving.

A lightweight approach to nontermination inference using Constrained Horn Clauses

Runtime Verification Through Forward Chaining

RustHorn: CHC-based Verification for Rust Programs (full version)

Linear-Logic Based Analysis of Constraint Handling Rules with Disjunction

Constraint-based verification of abstract models of multitreaded programs

Automated Induction for Complex Data Structures

Structural temporal logic for mechanized program verification

Shape Neutral Analysis of Graph-based Data-structures

Accelerating Software Model Checking Based on Program Backbone.

Finite Countermodel Based Verification for Program Transformation (A Case Study)