CS 267  Automated Verification  Winter 2014
Instructor:
Tevfik Bultan
Office: Eng. I 2123
Office Hours: Monday/Wednesday 10:0010:50
Class Times:
Monday/Wednesday 11:0012:50 Location: PHELP 2510
Course Topics
This course will cover automated verification techniques focusing
mainly on model checking and for software verification.
The tentative list of topics include:
 Safety and liveness properties, temporal logics
 Binary Decision Diagrams (BDDs) and symbolic model checkers
 Model checking using automata on infinite words, explicit
state model checkers
 SATsolvers and bounded verification
 Software model checking
 Predicate abstraction
 Counterexample guided abstraction refinement
 Infinite state model checking
 Verification using SMTsolvers
 Modular verification
 Dynamic symbolic execution
Course Work
There will be several homework assignments and a final exam.
The papers related to the
topics discussed in the class will be given as reading assignments.
Announcements
 267 Final will be on March 20th from 123:00 in Phelps 2510.
 There will be two makeup lectures during the finals week:
Monday, March 17th, and Wednesday, March 19th at 11:00,
PHELP 2510.
 The classes on Monday, January 13th, and Wednesday, January 15th
are cancelled.
Recommended Text
The following book is a good reference for model checking
techniques:
Model Checking,
E. M. Clarke, Orna Grumberg, Doron Peled,
ISBN 0262032708, 2000.
Related Tools
Specification Checkers
Program Checkers

JPF: A model checker for Java

CBMC: A SATbased bounded model checker for C

SLAM/Static Driver Verifier: A software model checker for C
that uses counterexample guided abstraction refinement

BLAST: A software model checker for C
that uses counterexample guided abstraction refinement

CREST: An automated testing tool for C that uses
dynamic symbolic execution

CHESS: A model checker for concurrent programs

PEX: An automated testing tool for .NET applications
that uses dynamic symbolic execution

Spec#: A designbycontract extenstion to C# and its verifier

JSA: A string analysis tool for Java

Stranger: An automatabsaed string analysis tool for PHP
Symbolic Manipulators and Satisfiability Solvers

CUDD: A BDD package

MONA: A symbolic automata package

zChaff: A SAT solver

Z3: An SMT solver