Skip to main content
SpringerLink
Log in

Inferring specifications to detect errors in code

  • Published:
Automated Software Engineering Aims and scope Submit manuscript

Abstract

A new technique is presented to statically check a given procedure against a user-provided property. The method requires no annotations; it automatically infers a context-dependent specification for each procedure call, so that only as much information about a procedure is used as is needed to analyze its caller. Specifications are inferred iteratively. Empty specifications are initially used to over-approximate the effects of all procedure calls; these are later refined in response to spurious counterexamples. When the analysis terminates, any remaining counterexample is guaranteed to be valid. However, since the heap is finitized, the absence of a counterexample does not guarantee the validity of the given property in general.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16
Fig. 17
Fig. 18
Fig. 19

Similar content being viewed by others

Notes

  1. Special cases, e.g. updating arrays which are passed as parameters, can be easily added to this algorithm.

References

  • Balaban, I., Pnueli, A., Zuck, L.: Shape analysis by predicate abstraction. In: Proc. of VMCAI (2005)

  • Ball, T., Rajamani, S.: Bebop: A symbolic model checker for boolean programs. In: SPIN 2000 Workshop on Model Checking of Software, pp. 113–130 (2000)

  • Ball, T., Rajamani, S.: Automatically validating temporal safety properties of interfaces. In: SPIN Workshop on Model Checking of Software, pp. 103–122 (2001)

  • Ball, T., Rajamani, S.K.: Generating abstract explanations of spurious counterexamples in C programs, MSR-TR-2002-09, pp. 113–130 (2002)

  • Chaki, S., Clarke, E., Groce, A., Jha, S., Veith, H.: Modular verification of software components in C. In: International Conference on Software Engineering (2003)

  • Chase, D.R., Wegman, M., Zadeck, F.: Analysis of pointers and structures. In: Proc. Programming Languages Design and Implementation (1990)

  • Clarke, E., Grumberg, O., Jha, S., Lu, Y., Veith, H.: Counterexample-guided abstraction refinement. In: Proc. International Conference on Computer-Aided Verification, pp. 154–169 (2000)

  • Corbett, J.C., Dwyer, M.B., Hatcliff, J., Laubach, S., Pasareanu, C.S., Robby, Zheng, H.: Bandera: extracting finite-state models from java source code. In: Proc. International Conference on Software Engineering (2000)

  • Cormen, T.H., Leiserson, C.E., Rivest, R.L.: Introduction to Algorithms. MIT Press (1990)

  • Detlefs, D.L., Nelson, G., Saxe, J.B.: A theorem prover for program checking. Research Report 178, Compaq SRC (2002)

  • Dijkstra, E.W.: A Discipline of Programming. Prentice Hall, Englewood Cliffs, NJ (1976)

  • Ernst, M.D., Cockrell, J., Griswold, W.G., Notkin, D.: Dynamically discovering likely program invariants to support program evolution. IEEE Trans. Softw. Eng. 27(2), (2001)

  • Flanagan, C.: Software model checking via iterative abstraction refinement of constraint logic queries. In: Workshop on Constraint Programming and Constraints for Verification (2004)

  • Flanagan, C., Joshi, R., Ou, X., Saxe, J.B.: Theorem proving using lazy proff explication. In: International Conference on Computer Aided Verification (2003)

  • Flanagan, C., Leino, K., Lillibridge, M., Nelson, G., Saxe, J., Stata, R.: Extended static checking for java. In: Proc. Conference on Programming Language Design and Implementation, pp. 234–245 (2002)

  • Graf, S., Saidi, H.: Construction of abstract state graphs via PVS. In: Proc. International Conference on Computer Aided Verification, pp. 72–83 (1997)

  • Hatcliff, J., Dwyer, M.: Slicing software for model construction. In: Proc. ACM Workshop of Partial Evaluation and Program Manipulation (1999)

  • Henzinger, T.A., Jhala, R., Majumdar, R., Necula, G., Sutre, G., Weimer, W.: Temporal-safety proofs for systems code. In: Proc. International Conference on Computer-Aided Verification, pp. 526–538 (2002)

  • Holzmann, G.J.: The model checker SPIN. IEEE Trans. Softw. Eng. 23(5), 279–294 (1997)

    Google Scholar 

  • Jackson, D., Schechter, I., Shlyakhter, I.: Alcoa: the alloy constraint analyzer. In: Proc. International Conference on Software Engineering (2000)

  • Jackson, D., Shlyakhter, I., Sridharan, M.: A micromodularity mechanism. In: Proc. ACM SIGSOFT Conference on Foundations of Software Engineering (2001)

  • Jaffar, J., Maher, M.J.: Constraint logic programing: a survey. J. Log. Program. 19(20), 503–581 (1994)

    Google Scholar 

  • Jeannet, B., Loginov, A., Reps, T., Sagiv, M.: A relational approach to interprocedural shape analysis. In: Proc. of SAS (2004)

  • McMillan, K.: Symbolic Model Checking. Kluwer Academic Publishers (1993)

  • Moskewicz, M., Madigan, C., Zhao, Y., Zhang, L., Malik, S.: Chaff: engineering an efficient SAT solver. In: Design Automation Conference (2001)

  • Plaisted, D.A., Greenbaum, S.: A structure-preserving clause form translation. J. Symb. Comput. 2, 293–304 (1986)

    Google Scholar 

  • Sagiv, M., Reps, T., Wilhelm, R.: Solving shape-analysis problems in languages with destructive updating. ACM Trans. Program. Lang. Syst. 20(1), 1–50 (1998)

    Google Scholar 

  • Sagiv, M., Reps, T., Wilhelm, R.: Parametric shape analysis via 3-valued logic. ACM Trans. Program. Lang. Syst. 24(3), 217–298 (2002)

    Google Scholar 

  • Shlyakhter, I.: Declarative symbolic pure logic model checking. Ph.D Thesis, Electrical Engineering and Computer Science Department, MIT (2005)

  • Shlyakhter, I., Seater, R., Jackson, D., Sridharan, M., Taghdiri, M.: Debugging declarative models using unsatisfiable core. Autom. Softw. Engine. (2003)

  • Sitaraman, M., Gandi, D.P., Kuchlin, W., Sinz, C., Weide, B.W.: The humane bugfinder: modular static analysis using a SAT solver. Technical Report RSRG-03-05, Dept. of Computer Science, Clemson Univ. (2003)

  • Taghdiri, M.: Inferring specifications to detect errors in code. Autom. Softw. Engin. (2004)

  • Vaziri, M.: Finding bugs in software with a constraint solver. Ph.D Thesis, Electrical Engineering and Computer Science Department, MIT (2004)

  • Visser, W., Brat, G., Havelund, K., Park, S.: Model checking programs. In: Proc. IEEE International Conference on Automated Software Engineering (2000)

  • Xie, Y., Aiken, A.: Scalable error detection using boolean satisfiability. In: Proc. Symposium on Principles of Programming Languages, pp. 351–363 (2005)

  • Zhang, L., Malik, S.: Validating SAT solvers using an independent resolution-based checker: practical implementations and other applications. In: Design, Automation and Test in Europe(DATE) (2003)

Download references

Acknowledgments

We are grateful to Mandana Vaziri for helping us to use her algorithm, and for her advice and useful discussions, and to Sharad Malik and Zhaohui Fu for their help for using ZChaff. We would also like to thank the anonymous referees for comments that helped us significantly improve our paper. This work is supported by the National Science Foundation under Grant No. 0086154 and Grant No. 0325283.

Author information

Authors and Affiliations

  1. Computer Science and AI Lab, Massachusetts Institute of Technology, Cambridge, MA, 02139, USA

    Mana Taghdiri & Daniel Jackson

Authors
  1. Mana Taghdiri
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Daniel Jackson
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mana Taghdiri.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Taghdiri, M., Jackson, D. Inferring specifications to detect errors in code. Autom Softw Eng 14, 87–121 (2007). https://doi.org/10.1007/s10515-006-0005-x

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10515-006-0005-x

Keywords

Search

Navigation