[Paper Review] On Verifying Complex Properties using Symbolic Shape Analysis

Thomas Wies, Viktor Kunčak+3 more|ArXiv.org|Sep 18, 2006

Protein Structure and Dynamics56 references21 citations

TL;DR

Bohne is a symbolic shape analysis algorithm that verifies complex data structure invariants by synthesizing disjunctive, universally quantified loop invariants using a combination of decision procedures for monadic second-order logic over trees, SMT solvers (CVC Lite), and Isabelle's theorem prover. It enables precise verification of safety, consistency, and contract properties in dynamic data structures like linked lists, trees, and arrays, with performance improvements via caching and quantifier instantiation.

ABSTRACT

One of the main challenges in the verification of software systems is the analysis of unbounded data structures with dynamic memory allocation, such as linked data structures and arrays. We describe Bohne, a new analysis for verifying data structures. Bohne verifies data structure operations and shows that 1) the operations preserve data structure invariants and 2) the operations satisfy their specifications expressed in terms of changes to the set of objects stored in the data structure. During the analysis, Bohne infers loop invariants in the form of disjunctions of universally quantified Boolean combinations of formulas. To synthesize loop invariants of this form, Bohne uses a combination of decision procedures for Monadic Second-Order Logic over trees, SMT-LIB decision procedures (currently CVC Lite), and an automated reasoner within the Isabelle interactive theorem prover. This architecture shows that synthesized loop invariants can serve as a useful communication mechanism between different decision procedures. Using Bohne, we have verified operations on data structures such as linked lists with iterators and back pointers, trees with and without parent pointers, two-level skip lists, array data structures, and sorted lists. We have deployed Bohne in the Hob and Jahob data structure analysis systems, enabling us to combine Bohne with analyses of data structure clients and apply it in the context of larger programs. This report describes the Bohne algorithm as well as techniques that Bohne uses to reduce the ammount of annotations and the running time of the analysis.

Motivation & Objective

• To address the challenge of verifying complex invariants in unbounded, heap-allocated data structures such as linked lists and dynamically allocated arrays.
• To enable verification of both shape properties (e.g., reachability, tree structure) and functional properties (e.g., sortedness, array invariants) in a unified framework.
• To reduce the need for manual annotations by automatically inferring precise loop invariants using decision procedures and semantic caching.
• To improve scalability and automation in program verification by integrating multiple decision procedures through synthesized invariants.
• To demonstrate the effectiveness of combining monadic second-order logic, SMT solving, and theorem proving for verifying complex data structure operations.

Proposed method

• Bohne uses a symbolic shape analysis that partitions heap-allocated objects using unary predicates to represent structural and functional properties.
• It synthesizes loop invariants as disjunctions of universally quantified Boolean combinations of formulas, represented as sets of binary decision diagrams.
• The algorithm combines decision procedures for monadic second-order logic over trees with SMT solvers (CVC Lite) and Isabelle’s automated reasoner to infer invariants.
• Field constraint analysis enables the use of uninterpreted function symbols within monadic second-order logic formulas, preserving completeness in key cases.
• Semantic caching and propagation of precondition conjuncts reduce redundant decision procedure calls and improve performance.
• Quantifier instantiation is performed contextually, based on prior loop iterations, to maintain precision while reducing computational cost.

Experimental results

Research questions

• RQ1 Can a symbolic shape analysis algorithm automatically infer complex, disjunctive loop invariants that combine reachability and functional properties in data structures?
• RQ2 How can decision procedures for monadic second-order logic and SMT be effectively coordinated to verify data structure invariants without manual annotations?
• RQ3 To what extent can semantic caching and context-sensitive quantifier instantiation reduce the number of decision procedure calls in shape analysis?
• RQ4 Can a unified analysis framework verify both structural invariants (e.g., tree shape) and functional invariants (e.g., sortedness) in the same verification process?
• RQ5 How does the integration of Isabelle’s theorem prover with external decision procedures improve the communication and precision of synthesized invariants?

Key findings

• Bohne successfully verified complex properties in diverse data structures, including singly- and doubly-linked lists, two-level skip lists, trees with and without parent pointers, sorted lists, and arrays.
• The analysis achieved a 72% reduction in decision procedure calls for List.reverse (371 total, 22% cache hits), demonstrating the effectiveness of caching.
• Disabling semantic caching slowed down the analysis by 1.3 to 1.5 times, indicating its significant performance impact.
• Disabling quantifier instantiation increased running time by 1.2 to 3.6 times, showing its critical role in scalability.
• For Tree.add, the analysis required 983 decision procedure calls (91% of total time) and ran in 81 seconds, highlighting the cost of complex invariants.
• The framework reduced the need for manual annotations and enabled verification of procedure contracts, such as changes to the set of elements stored in a data structure.