Not available / text

No description available.

We say a program is data-independent with respect to a data type X if the operations it can perform on values of type X are restricted to just equality testing, although the system may also input, store and move around (via assignment) values of type X within its variables. This property can be exploited to give procedures for the automatic verification, called model checking, of such programs independently of the instance for the type X. This thesis considers data-independent programs with arrays, which are useful for modelling memory systems such as cache protocols. The main question of interest is the following parameterised model-checking problem: whether a program satisfies its specification for all non-empty finite instances of its types. In order to obtain these results, we present a UNITY-like programming language with arrays that is suited to the study of decidability of various modelchecking problems, whilst being useful for prototyping memory systems such as caches. Its semantics are given in terms of transition systems, and we use the modal μ-calculus, a branching-time temporal logic with recursion, as our specification language. We describe a model-checking procedure for programs that use arrays indexed by one data-independent type X and storing values from another Y. This allows us to prove properties about parameterised systems: for example, that memory systems can be verified independently of memory size and data values. This decidability result is shown to extend to data-independent programs with many types and multidimensional arrays which are acyclic, meaning it is not possible to form loops of types in the 'indexed by' relation. Conversely, it is shown that even reachability model-checking problems are undecidable for classes of programs that allow cyclic-array programs. We give practical motivation for these decidability results by demonstrating how one could verify a fault-tolerant interface on a set of unreliable memories, and the cache protocol in the Pentium Pro processor. Significantly, the verifications are performed independently of many of these systems' parameters. These case studies suggest two extensions to the language: an array reset instruction, which sets every element of an array to a particular value, and an array assignment or copy instruction. Both are shown to restrict decidability of model checking problems; however we can obtain some interesting decidability results for arrays with reset by restricting the number of arrays to just one, or by allowing the arrays only to store fixed finite types, such as the booleans.

Photocopy of typescript. / Digitized by Kansas Correctional Industries

Not available / text

Not available / text

Not available / text

Not available / text

This thesis provides a powerful general-purpose proof technique for the verification of systems, whether finite or infinite. It extends the idea of finite local model-checking, which was introduced by Stirling and Walker: rather than traversing the entire state space of a model, as is done for model-checking in the sense of Emerson, Clarke et al. (checking whether a (finite) model satisfies a formula), local model-checking asks whether a particular state satisfies a formula, and only explores the nearby states far enough to answer that question. The technique used was a tableau method, constructing a tableau according to the formula and the local structure of the model. This tableau technique is here generalized to the infinite case by considering sets of states, rather than single states; because the logic used, the propositional modal mu-calculus, separates simple modal and boolean connectives from powerful fix-point operators (which make the logic more expressive than many other temporal logics), it is possible to give a relatively straightforward set of rules for constructing a tableau. Much of the subtlety is removed from the tableau itself, and put into a relation on the state space defined by the tableau-the success of the tableau then depends on the well-foundedness of this relation. This development occupies the second and third chapters: the second considers the modal mu-calculus, and explains its power, while the third develops the tableau technique itself The generalized tableau technique is exhibited on Petri nets, and various standard notions from net theory are shown to play a part in the use of the technique on nets-in particular, the invariant calculus has a major role. The requirement for a finite presentation of tableaux for infinite systems raises the question of the expressive power of the mu-calculus. This is studied in some detail, and it is shown that on reasonably powerful models of computation, such as Petri nets, the mu-calculus can express properties that are not merely undecidable, but not even arithmetical. The concluding chapter discusses some of the many questions still to be answered, such as the incorporation of formal reasoning within the tableau system, and the power required of such reasoning.

Lo, Kwun Kit. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2009. / Includes bibliographical references (leaves 153-161). / Abstracts in English and Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Existing Approaches in Program Understanding --- p.2 / Chapter 1.1.1 --- Localized Program Understanding --- p.2 / Chapter 1.1.2 --- Whole System Analysis --- p.3 / Chapter 1.2 --- Example of Function Execution Probability Reduction of the Call Graph --- p.5 / Chapter 1.3 --- Organization of the Dissertation --- p.7 / Chapter 2 --- Preliminary Study --- p.8 / Chapter 2.1 --- Participants --- p.8 / Chapter 2.2 --- Study Design --- p.8 / Chapter 2.3 --- ispell --- p.10 / Chapter 2.3.1 --- Subject I1 (ispell) --- p.10 / Chapter 2.3.2 --- Subject PG1 (ispell) --- p.12 / Chapter 2.3.3 --- Subject PG2 (ispell) --- p.13 / Chapter 2.3.4 --- Subject I2 (ispell) --- p.14 / Chapter 2.3.5 --- ispell Analysis --- p.15 / Chapter 2.4 --- FreeBSD Kernel Malloc --- p.15 / Chapter 2.4.1 --- Subject I1 (FreeBSD) --- p.16 / Chapter 2.4.2 --- Subject PG1 (FreeBSD) --- p.17 / Chapter 2.4.3 --- Subject PG2 (FreeBSD) --- p.18 / Chapter 2.4.4 --- Subject I2 (FreeBSD) --- p.20 / Chapter 2.4.5 --- FreeBSD Analysis --- p.20 / Chapter 2.5 --- Threats to Validity --- p.21 / Chapter 2.6 --- Summary --- p.22 / Chapter 3 --- Approach --- p.24 / Chapter 3.1 --- Building Branch-Preserving Call Graphs --- p.26 / Chapter 3.1.1 --- Branch Reserving Call Graphs --- p.26 / Chapter 3.1.2 --- Branch-Preserving Call Graphs --- p.28 / Chapter 3.1.3 --- Example of BPCG Building Process --- p.31 / Chapter 3.2 --- System Function Removal --- p.34 / Chapter 3.3 --- Function Rating Calculation --- p.35 / Chapter 3.3.1 --- Rating Algorithm Complexity --- p.38 / Chapter 3.4 --- Building the Colored Call Graph --- p.39 / Chapter 3.5 --- Call Graph Reduction --- p.39 / Chapter 3.5.1 --- Remove-high-fan-in-functions Approach (FEPR-fanin) --- p.39 / Chapter 3.5.2 --- Remove-leaf-nodes Approach (FEPR-leaf) --- p.41 / Chapter 4 --- Validation --- p.42 / Chapter 4.1 --- Measures --- p.43 / Chapter 4.1.1 --- Inclusion Accuracy (IA) --- p.43 / Chapter 4.1.2 --- Reduction Efficiency (RE) --- p.44 / Chapter 4.1.3 --- Stability (S) --- p.45 / Chapter 4.2 --- Analysis of FEPR Techniques --- p.45 / Chapter 4.2.1 --- Settings --- p.45 / Chapter 4.2.2 --- Inclusion Accuracy (IA): --- p.47 / Chapter 4.2.3 --- Reduction Efficiency (RE): --- p.47 / Chapter 4.2.4 --- Stability (S) --- p.48 / Chapter 4.3 --- Ying and Tarr´ةs Approach --- p.48 / Chapter 4.3.1 --- Settings --- p.50 / Chapter 4.3.2 --- Inclusion Accuracy (IA) --- p.50 / Chapter 4.3.3 --- Reduction Efficiency (RE) --- p.51 / Chapter 4.3.4 --- Stability (S) --- p.51 / Chapter 4.4 --- Centrality Measure Approach --- p.52 / Chapter 4.4.1 --- Inclusion Accuracy (IA) --- p.53 / Chapter 4.5 --- Top-down Search Approach --- p.56 / Chapter 4.5.1 --- Reduction Efficiency (RE) --- p.57 / Chapter 4.6 --- Synthesized Analysis --- p.58 / Chapter 4.6.1 --- Inclusion Accuracy (IA) --- p.58 / Chapter 4.6.2 --- Reduction Efficiency (RE) --- p.59 / Chapter 4.6.3 --- Stability (S) --- p.59 / Chapter 4.6.4 --- Threats to Validity --- p.59 / Chapter 4.7 --- Summary --- p.60 / Chapter 5 --- Discussion --- p.62 / Chapter 5.1 --- Flexibility of Analysis --- p.62 / Chapter 5.2 --- "Existence of Function Pointers, GOTOs and Early Exits" --- p.62 / Chapter 5.3 --- Precision of Branch-Preserving Call Graphs --- p.63 / Chapter 5.4 --- Function Ranking and Recommender System --- p.64 / Chapter 5.5 --- Extending the Approach Beyond C --- p.66 / Chapter 6 --- Related Work --- p.67 / Chapter 6.1 --- Existing Approaches in Program Understanding --- p.67 / Chapter 6.1.1 --- Localized Program Understanding --- p.67 / Chapter 6.1.2 --- Whole Program Analysis --- p.69 / Chapter 6.2 --- Branch Prediction and Static Profiling --- p.73 / Chapter 7 --- Conclusions --- p.76 / Chapter A --- Call Graphs in Case Studies --- p.78 / Chapter B --- Source Files for BPCG Builder --- p.85 / Bibliography --- p.153