@@ -30,10 +30,15 @@ verification algorithm. Incremental goto checkers keep the state of the
30
30
analysis and can be queried by the goto verifier repeatedly to return
31
31
their results incrementally. A query to an incremental goto checker
32
32
either returns when a violated property has been found or the
33
- verification algorithm has terminated. If a violated property has been
34
- found then additional information (e.g. a trace) can be retrieved
35
- from the incremental goto checker (if it supports that).
36
- See \ref incremental_goto_checkert.
33
+ verification algorithm has terminated. See \ref incremental_goto_checkert.
34
+ Incremental goto checkers can provide additional functionality by implementing
35
+ the respective interfaces:
36
+ * \ref goto_trace_providert : If a violated property has been
37
+ found then a trace can be retrieved from the incremental goto checker.
38
+ * \ref fault_localization_providert : If a violated property has been
39
+ found then a likely fault location can be determined.
40
+ * \ref witness_providert : A witness can be output (for violated
41
+ and proved properties).
37
42
38
43
The combination of these three concepts enables:
39
44
* _ Verification algorithms can be used interchangeably._
@@ -53,7 +58,7 @@ The combination of these three concepts enables:
53
58
There are the following variants of goto verifiers at the moment:
54
59
* \ref stop_on_fail_verifiert : Checks all properties, but terminates
55
60
as soon as the first violated property is found and reports this violation.
56
- A trace ends at a violated property.
61
+ A trace ends at a violated property. Witnesses are output.
57
62
* \ref all_properties_verifier_with_trace_storaget : Determines the status of
58
63
all properties and outputs results when the verification algorithm has
59
64
terminated. A trace ends at a violated property.
@@ -68,16 +73,36 @@ There are the following variants of goto verifiers at the moment:
68
73
verification algorithm has terminated.
69
74
The reporting uses 'goals' rather than 'property' terminology. I.e.
70
75
a failing property means 'success' and a passing property 'failed'.
76
+ * \ref stop_on_fail_verifier_with_fault_localizationt : Same as
77
+ \ref stop_on_fail_verifiert, but also finds and reports
78
+ the most likely fault location. Requires an incremental goto checker
79
+ that provides fault localization.
80
+ * \ref all_properties_verifier_with_fault_localizationt : Same as
81
+ \ref all_properties_verifier_with_trace_storaget, but also finds and reports
82
+ the most likely fault location. Requires an incremental goto checker
83
+ that provides fault localization.
71
84
72
85
There are the following variants of incremental goto checkers at the moment:
73
86
* \ref multi_path_symex_checkert : The default mode of goto-symex. It explores
74
87
all paths and applies aggressive path merging to generate a formula
75
88
(aka 'equation') that is passed to the SAT/SMT solver. It supports
76
89
determining the status of all properties, but not adding new properties
77
- after the first invocation.
90
+ after the first invocation. It provides traces, fault localization and witness
91
+ output.
78
92
* \ref multi_path_symex_only_checkert : Same as \ref multi_path_symex_checkert,
79
93
but does not call the SAT/SMT solver. It can only decide the status of
80
94
properties by the simplifications that goto-symex performs.
95
+ * \ref single_path_symex_checkert : Activated with option ` --paths ` . It
96
+ explores paths one by one and generates a formula (aka 'equation') for each
97
+ path and passes it to the SAT/SMT solver. It supports
98
+ determining the status of all properties, but not adding new properties
99
+ after the first invocation. It provides traces and witness output.
100
+ * \ref single_path_symex_only_checkert : Same as
101
+ \ref single_path_symex_checkert,
102
+ but does not call the SAT/SMT solver. It can only decide the status of
103
+ properties by the simplifications that goto-symex performs.
81
104
* There are variants for Java that perform a Java-specific preprocessing:
82
105
\ref java_multi_path_symex_checkert,
83
- \ref java_multi_path_symex_only_checkert
106
+ \ref java_multi_path_symex_only_checkert,
107
+ \ref java_single_path_symex_checkert,
108
+ \ref java_single_path_symex_only_checkert
0 commit comments