Abstract:Open environmental software systems are often time-sensitive, as they need to respond to other entities within the systems and/or in the environments promptly. The timing requirements are therefore an essential part of the system correctness. Scenario-based specifications (SBS) such as message sequence charts and UML interaction models play an important role in specifying open environmental software systems since they intuitively model interactions between different entities. While modelling these systems, the timing requirements can be specified as timing constraints. In this paper, we study the problem of checking the timing consistency of SBS with timing constraints. Although this problem can be transformed into a reachability analysis problem, checking its reachability can still be time-consuming. Therefore, we propose a novel SAT and linear programming (LP) collaborative timing analysis approach named Tassat for the bounded timing analysis of SBS. Instead of using depth-first traversal algorithms, Tassat encodes the structures of the SBS into propositional formulas and adopts SAT solvers to find candidate paths. The timing analysis of candidate paths is then transformed to LP problems, where the irreducible infeasible set of the infeasible paths can be utilized to filter out candidate paths for checking. In addition, we propose an enhanced version of the approach that extends the bounded analysis results to the entire models if the infeasible path segments do not contain intermediate loops. The enhanced algorithm can prove that the given SBS satisfy the required properties on any bound condition. The experimental results show that Tassat is effective and has better performance than existing tools in terms of both time consumption and memory footprint.

A Static Analysis Tool with Optimizations for Reachability Determination

A Constraint-Pattern Based Method for Reachability Determination

TsmartGP: a tool for finding memory defects with pointer analysis

An Empirical Study on Implicit Constraints in Smart Contract Static Analysis

Control Flow-Guided SMT Solving for Program Verification

SmartFast: an accurate and robust formal analysis tool for Ethereum smart contracts

Efficient Static Timing Analysis Using a Unified Framework for False Paths and Multi-Cycle Paths

Towards an Efficient Path-Oriented Tool for Bounded Reachability Analysis of Linear Hybrid Systems using Linear Programming

Leveraging Control Flow Knowledge in SMT Solving of Program Verification

Boosting Symbolic Execution Via Constraint Solving Time Prediction (experience Paper)

Necessity and Capability of Flow, Context, Field and Quasi Path Sensitive Points-to Analysis

Static Analysis for Fast and Accurate Design Space Exploration of Caches

Scalable reachability analysis via automated dynamic netlist-based hint generation

Symbolic Execution of Complex Program Driven by Machine Learning Based Constraint Solving

Loop Transparency for Scalable Dynamic Symbolic Execution

TapChecker: A Lightweight SMT-Based Conflict Analysis for Trigger-Action Programming

Scalable and Extensible Static Memory Safety Analysis with Summary over Access Path

Improving timing analysis effectiveness for scenario-based specifications by combining SAT and LP techniques

DT-Solver: Automated Theorem Proving with Dynamic-Tree Sampling Guided by Proof-level Value Function

Machine Learning Steered Symbolic Execution Framework for Complex Software Code

Accelerating JavaScript Static Analysis via Dynamic Shortcuts (Extended Version)