CS 267  Automated Verification  Winter 2016
Instructor:
Tevfik Bultan
Office: Eng. I 2123
Office Hours: Tuesday/Thursday 12:0012:50
Class Times:
Tuesday/Thursday 1:002:50 Location: PHELP 3526
Course Topics
This course will cover automated verification techniques focusing
mainly on model checking and for software verification.
The tentative list of topics include:
 Safety and liveness properties, temporal logics
 Binary Decision Diagrams (BDDs) and symbolic model checkers
 Model checking using automata on infinite words, explicit
state model checkers
 SATsolvers and bounded verification
 Software model checking
 Predicate abstraction
 Counterexample guided abstraction refinement
 Infinite state model checking
 Verification using SMTsolvers
 Modular verification
 Dynamic symbolic execution
 Probablistic program analysis
 Quantitative information flow
Course Work
There will be several homeworks, possibly a final, and the
students will be required to do a course project.
The papers related to the
topics discussed in the class will be given as reading assignments.
Recommended Text
The following book is a good reference for model checking
techniques:
Model Checking,
E. M. Clarke, Orna Grumberg, Doron Peled,
ISBN 0262032708, 2000.
Related Tools
Specification Checkers
Program Checkers

JPF/SPF: Java Path Finder/Symbolic Path Finder: An explicit state model checker
and a symbolic execution tool for Java

CBMC: C Bounded Model Checker: A SATbased bounded model checker for C

SLAM/Static Driver Verifier: A software model checker for C
that uses counterexample guided abstraction refinement

CREST: An automated testing tool for C that uses
dynamic symbolic execution

PEX: An automated testing tool for .NET applications
that uses dynamic symbolic execution

Spec#: A designbycontract extenstion to C# and its verifier

Dafny: A language and program verifier for functional correctness

JSA: A string analysis tool for Java

Stranger: An automatabased string analysis tool for PHP
Symbolic Manipulators and Satisfiability Solvers

CUDD: A BDD package

MONA: A symbolic automata package

zChaff: A SAT solver

picoSAT: A SAT solver

Z3: An SMT (SatisfiabilityModulaTheories) solver

ABC: Automatabased Model Counter: an automatabased model counting constraint solver.