Unlike safety properties which require the absence of a "bad" program trace, k-safety properties stipulate the absence of a "bad" interaction between k traces. Examples of k-safety properties include transitivity, associativity, anti-symmetry, and monotonicity. This paper presents a sound and relatively complete calculus, called Cartesian Hoare Logic (CHL), for verifying k-safety properties. Our program logic is designed with automation and scalability in mind, allowing us to formulate a verification algorithm that automates reasoning in CHL. We have implemented our verification algorithm in a fully automated tool called DESCARTES, which can be used to analyze any k-safety property of Java programs. We have used DESCARTES to analyze user-defined relational operators and demonstrate that DESCARTES is effective at verifying (or finding violations of) multiple k-safety properties.
Cartesian Hoare logic REF (CHL) extends standard Hoare logic to reason about k-safety properties of relational traces (the input/output pairs of a program).
Cartesian hoare logic for verifying k-safety properties
PLDI 2016
Computer Science