Wanwei Liu

Demand-driven memory leak detection based on flow- and context-sensitive pointer analysis

We present a demand-driven approach to memory leak detection algorithm based on flow- and context-sensitive pointer analysis. The detection algorithm firstly assumes the presence of a memory leak at some program point and then runs a backward analysis to see if this assumption can be disproved. Our algorithm computes the memory abstraction of programs based on points-to graph resulting from flow- and context-sensitive pointer analysis. We have implemented the algorithm in the SUIF2 compiler infrastructure and used the implementation to analyze a set of C benchmark programs. The experimental results show that the approach has better precision with satisfied scalability as expected.

Estimating the Soft Error Vulnerability of Register Files via Interprocedural Data Flow Analysis

Subsequently to the wall of performance and power consumption, the dependability of computing, caused by soft errors, has become a growing design concern. Since Register Files (RFs) are accessed very frequently and cannot be well protected, soft errors occurred in them is one of the top reasons for affecting the reliability of programs. To access the soft errors vulnerability of RFs, this paper presents a static estimating method via interprocedural data flow analysis. Adopting a previous method, the vulnerability of a register is firstly decomposed into intrinsic and conditional basic block vulnerabilities. Under the prerequisite of context sensitivity, we focus on the computation the post conditions of basic blocks, which can be viewed as the living probability of the target register in the future usage. Finally, the program reliability can be calculated quantitatively under the occurrence of soft errors in RFs. Experimental results from the MiBench benchmarks indicate that our method is more accurate, and compatible with the AVF methods. We also reveal that the reliability of a program has a connection with its structure, such as the RVF factors, which suggests adopting the application specified protected mechanisms for tolerating soft errors occurred in RFs.

Symbolic Model Checking APSL

PSL is a kind of temporal logic which uses SEREs as additional formula constructs. We present a variant of PSL, namely APSL, which replaces SEREs with finite automata. APSL and PSL are of the exactly same expressiveness. In this paper, we extend the LTL symbolic model checking algorithm to that of APSL, and present a tableau based APSL verification approach. Moreover, we show how to implement this algorithm via the BDD based symbolic approach.

Symbolic model checking APSL

Property specification language (PSL) is a specification language which has been accepted as an industrial standard. In PSL, SEREs are used as additional formula constructs. In this paper, we present a variant of PSL, namely APSL, which replaces SEREs with finite automata. APSL and PSL are of the exactly same expressiveness. Then, we extend the LTL symbolic model checking algorithm to that of APSL, and then present a tableau based APSL verification technique, which can be easily implemented via the BDD based symbolic approach. Moreover, we implement an extension of NuSMV, and this adapted version supports symbolic model checking of APSL. Experimental results show that this variant of PSL can be efficiently verified. Henceforth, symbolic model checking PSL can be carried out by a transformation from PSL to APSL and symbolic model checking APSL.

Runtime Verification by Convergent Formula Progression

Runtime verification is a dynamic verification technique widely used in practice. In this paper we revisit the runtime verification technique with formula progression, which verifies the execution trace step by step by progressing the desired property written in temporal logic. The previous work did not discuss explicitly the bound for the sizes of expanded formulas, while the successive invoking of formula progression is likely to cause divergence. In this paper, we present the convergent formula progression by introducing a novel fix-point reduction technique, and prove it guarantees the sizes of expanded formulas be always convergent. To the best of our knowledge, this is the first work discussing the convergence of formula progression. Furthermore, we implement the new runtime verification framework, and experiments show the efficiency of our proposed strategy.

Counterexample-Preserving Reduction for Symbolic Model Checking

The cost of LTL model checking is highly sensitive to the length of the formula under verification. We observe that, under some specific conditions, the input LTL formula can be reduced to an easier-to-handle one before model checking. In our reduction, these two formulae need not to be logically equivalent, but they share the same counterexample set w.r.t the model. In the case that the model is symbolically represented, the condition enabling such reduction can be detected with a lightweight effort (e.g., with SAT-solving). In this paper, we tentatively name such technique “Counterexample-Preserving Reduction” (CePRe, for short), and the proposed technique is experimentally evaluated by adapting NuSMV.

Bounded Model Checking of ETL Cooperating with Finite and Looping Automata Connectives

As a complementary technique of the BDD-based approach, bounded model checking (BMC) has been successfully applied to LTL symbolic model checking. However, the expressiveness of LTL is rather limited, and some important properties cannot be captured by such logic. In this paper, we present a semantic BMC encoding approach to deal with the mixture of and . Since such kind of temporal logic involves both finite and looping automata as connectives, all regular properties can be succinctly specified with it. The presented algorithm is integrated into the model checker ENuSMV, and the approach is evaluated via conducting a series of imperial experiments.

YOGAR-CBMC: CBMC with Scheduling Constraint Based Abstraction Refinement

This paper presents the Yogar-CBMC tool for verification of multi-threaded C programs. It employs a scheduling constraint based abstraction refinement method for bounded model checking of concurrent programs. To obtain effective refinement constraints, we have proposed the notion of Event Order Graph (EOG), and have devised two graph-based algorithms over EOG for counterexample validation and refinement generation. The experiments in SV-COMP 2017 show the promising results of our tool.

Scheduling constraint based abstraction refinement for weak memory models

Scheduling constraint based abstraction refinement (SCAR) is one of the most efficient methods for verifying programs under sequential consistency (SC). However, most multi-processor architectures implement weak memory models (WMMs) in order to improve the performance of a program. Due to the nondeterministic execution of those memory operations by the same thread, the behavior of a program under WMMs is much more complex than that under SC, which significantly increases the verification complexity. This paper elegantly extends the SCAR method to WMMs such as TSO and PSO. To capture the order requirements of an abstraction counterexample under WMMs, we have enriched the event order graph (EOG) of a counterexample such that it is competent for both SC and WMMs. We have also proposed a unified EOG generation method which can always obtain a minimal EOG efficiently. Experimental results on a large set of multi-threaded C programs show promising results of our method. It significantly outperforms state-of-the-art tools, and the time and memory it required to verify a program under TSO and PSO are roughly comparable to that under SC.

Optimizing Monitor Code Based on Patterns in Runtime Verification

For runtime verification techniques, the most important part that limits its usage is how to reduce the influence of monitors. An important indicator is the amount of software codes after monitor instrumentation. The application of RV is hindered from the size-explosion problem of monitor construction. Namely, the state number of the monitor obtained is doubly exponential in the size of the input specification. This paper puts forward the method of processing parametric properties by utilizing monitor patterns and taking usage of arrays or functions, thereby greatly reducing the amount of monitor codes of the target system. It can improve the application of RV techniques in resource limited and safety critical systems, such as embedded control systems in transport or aerospace areas. Finally, the validity of the method is verified by constructing specific Benchmarks.