Corral: A Solver for Reachability-Modulo-Theoriesiwls.org/iwls2012/invited/shaz.pdf · Shaz Qadeer...
1
Corral: A Solver for Reachability-Modulo-Theories Shaz Qadeer Microsoft Research 1. ABSTRACT Satisfiability solvers for propositional logic have had tremen- dous impact on hardware modeling and verification. Un- fortunately, propositional logic is insufficient for reasoning about software. Precise models for software executions must cater to complex control flow (e.g., procedure calls, multi- threading) and complex data manipulation (e.g., object hi- erarchies, pointers). To enable precise reasoning about soft- ware executions, we introduce a simple modeling language that includes features such as nondeterministic choice, loops, and (synchronous and asynchronous) procedure calls. We al- low state update to be modeled using two-state predicates that relate the current and next values of program variables, requiring only that satisfiability for these predicates be effi- ciently decidable. For programs in this language, we refer to the problem of deciding whether a particular control location is reachable as the reachability-modulo-theories problem. We will argue that reachability-modulo-theories is a flexi- ble foundation for building a variety of software analyzers, including tools for finding bugs, answering developer ques- tions, and debugging crash dumps. We will describe Corral, a semi-algorithm for the reachability-modulo-theories prob- lem. We have evaluated Corral against other related tools and found that it consistently out-performs its competitors on a variety of benchmarks. 2. SPEAKER BIOGRAPHY Shaz Qadeer is a Senior Researcher in the RiSE group (Research in Software Engineering) at Microsoft. He re- ceived his Ph.D. from the University of California at Berke- ley and worked at Compaq Systems Research Center before joining Microsoft Research. He is interested in automated reasoning, software testing and verification, and languages for parallel and distributed programming. He has spent a significant part of his professional life developing simple and practical methods for reasoning about concurrent pro- grams. You can get more information about his activities at http://research.microsoft.com/en-us/people/qadeer/
Transcript of Corral: A Solver for Reachability-Modulo-Theoriesiwls.org/iwls2012/invited/shaz.pdf · Shaz Qadeer...
Corral: A Solver for Reachability-Modulo-TheoriesShaz QadeerMicrosoft Research
1. ABSTRACTSatisfiability solvers for propositional logic have had tremen-
dous impact on hardware modeling and verification. Un-fortunately, propositional logic is insufficient for reasoningabout software. Precise models for software executions mustcater to complex control flow (e.g., procedure calls, multi-threading) and complex data manipulation (e.g., object hi-erarchies, pointers). To enable precise reasoning about soft-ware executions, we introduce a simple modeling languagethat includes features such as nondeterministic choice, loops,and (synchronous and asynchronous) procedure calls. We al-low state update to be modeled using two-state predicatesthat relate the current and next values of program variables,requiring only that satisfiability for these predicates be effi-ciently decidable. For programs in this language, we refer tothe problem of deciding whether a particular control locationis reachable as the reachability-modulo-theories problem.We will argue that reachability-modulo-theories is a flexi-ble foundation for building a variety of software analyzers,including tools for finding bugs, answering developer ques-tions, and debugging crash dumps. We will describe Corral,a semi-algorithm for the reachability-modulo-theories prob-lem. We have evaluated Corral against other related toolsand found that it consistently out-performs its competitorson a variety of benchmarks.
2. SPEAKER BIOGRAPHY
Shaz Qadeer is a Senior Researcher in the RiSE group(Research in Software Engineering) at Microsoft. He re-ceived his Ph.D. from the University of California at Berke-ley and worked at Compaq Systems Research Center beforejoining Microsoft Research. He is interested in automatedreasoning, software testing and verification, and languagesfor parallel and distributed programming. He has spenta significant part of his professional life developing simpleand practical methods for reasoning about concurrent pro-grams. You can get more information about his activities athttp://research.microsoft.com/en-us/people/qadeer/
![Thread-modular Abstraction Refinement Tom Henzinger Ranjit Jhala Rupak Majumdar [UC Berkeley] Shaz Qadeer [Microsoft Research]](https://static.fdocuments.us/doc/165x107/56649d405503460f94a1aa02/thread-modular-abstraction-refinement-tom-henzinger-ranjit-jhala-rupak-majumdar.jpg)
