DROPS

Document

Sound Static Program Analysis in Modern Software Engineering (Dagstuhl Seminar 25421)

Authors: Pietro Ferrara, Liana Hadarean, Jorge A. Navas, Caterina Urban, and Greta Dolcetti

Published in: Dagstuhl Reports, Volume 15, Issue 10 (2026)

Abstract

This report documents the program and the outcomes of Dagstuhl Seminar 25421 "Sound Static Program Analysis in Modern Software Engineering". Sound Static Program Analysis (SSPA) has historically been effective in proving the absence of runtime errors and security vulnerabilities, notably in safety-critical embedded software. However, it has seen limited adoption in desktop applications until its revival for Web application security (e.g., to prove the absence of SQL injection vulnerabilities). Modern software development, characterized by architectures like microservices, serverless computing, and the increasing use of scripting languages, presents challenges to SSPA due to the integration of multiple languages and complex semantics, while also posing new problems related to soundness, precision, and scalability stemming from the machine learning revolution in code development. Despite these new opportunities for SSPA to offer structured feedback and address serious flaws often overlooked by the shallow analyses currently favored by the industry, there has not been a significant resurgence in its industrial application. This Dagstuhl Seminar aimed to bridge the SSPA and software engineering communities to extend existing theories to these new trends, foster integration with modern practices like DevOps, and discuss the formal methods challenges arising from contemporary software architectures.

Cite as

Pietro Ferrara, Liana Hadarean, Jorge A. Navas, Caterina Urban, and Greta Dolcetti. Sound Static Program Analysis in Modern Software Engineering (Dagstuhl Seminar 25421). In Dagstuhl Reports, Volume 15, Issue 10, pp. 37-74, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026)

Copy BibTex To Clipboard

@Article{ferrara_et_al:DagRep.15.10.37,
  author =	{Ferrara, Pietro and Hadarean, Liana and Navas, Jorge A. and Urban, Caterina and Dolcetti, Greta},
  title =	{{Sound Static Program Analysis in Modern Software Engineering (Dagstuhl Seminar 25421)}},
  pages =	{37--74},
  journal =	{Dagstuhl Reports},
  ISSN =	{2192-5283},
  year =	{2026},
  volume =	{15},
  number =	{10},
  editor =	{Ferrara, Pietro and Hadarean, Liana and Navas, Jorge A. and Urban, Caterina and Dolcetti, Greta},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/DagRep.15.10.37},
  URN =		{urn:nbn:de:0030-drops-254154},
  doi =		{10.4230/DagRep.15.10.37},
  annote =	{Keywords: Abstract interpretation, Formal methods, Software engineering, Software verification, Sound static program analysis}
}

Document

DOI: 10.4230/LIPIcs.ECOOP.2024.43

Inductive Predicate Synthesis Modulo Programs

Authors: Scott Wesley, Maria Christakis, Jorge A. Navas, Richard Trefler, Valentin Wüstholz, and Arie Gurfinkel

Published in: LIPIcs, Volume 313, 38th European Conference on Object-Oriented Programming (ECOOP 2024)

Abstract

A growing trend in program analysis is to encode verification conditions within the language of the input program. This simplifies the design of analysis tools by utilizing off-the-shelf verifiers, but makes communication with the underlying solver more challenging. Essentially, the analysis tools operates at the level of input programs, whereas the solver operates at the level of problem encodings. To bridge this gap, the verifier must pass along proof-rules from the analysis tool to the solver. For example, an analysis tool for concurrent programs built on an inductive program verifier might need to declare Owicki-Gries style proof-rules for the underlying solver. Each such proof-rule further specifies how a program should be verified, meaning that the problem of passing proof-rules is a form of invariant synthesis. Similarly, many program analysis tasks reduce to the synthesis of pure, loop-free Boolean functions (i.e., predicates), relative to a program. From this observation, we propose Inductive Predicate Synthesis Modulo Programs (IPS-MP) which extends high-level languages with minimal synthesis features to guide analysis. In IPS-MP, unknown predicates appear under assume and assert statements, acting as specifications modulo the program semantics. Existing synthesis solvers are inefficient at IPS-MP as they target more general problems. In this paper, we show that IPS-MP admits an efficient solution in the Boolean case, despite being generally undecidable. Moreover, we show that IPS-MP reduces to the satisfiability of constrained Horn clauses, which is less general than existing synthesis problems, yet expressive enough to encode verification tasks. We provide reductions from challenging verification tasks - such as parameterized model checking - to IPS-MP. We realize these reductions with an efficient IPS-MP-solver based on SeaHorn, and describe a real-world application to smart-contract verification.

Cite as

Scott Wesley, Maria Christakis, Jorge A. Navas, Richard Trefler, Valentin Wüstholz, and Arie Gurfinkel. Inductive Predicate Synthesis Modulo Programs. In 38th European Conference on Object-Oriented Programming (ECOOP 2024). Leibniz International Proceedings in Informatics (LIPIcs), Volume 313, pp. 43:1-43:30, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2024)

Copy BibTex To Clipboard

@InProceedings{wesley_et_al:LIPIcs.ECOOP.2024.43,
  author =	{Wesley, Scott and Christakis, Maria and Navas, Jorge A. and Trefler, Richard and W\"{u}stholz, Valentin and Gurfinkel, Arie},
  title =	{{Inductive Predicate Synthesis Modulo Programs}},
  booktitle =	{38th European Conference on Object-Oriented Programming (ECOOP 2024)},
  pages =	{43:1--43:30},
  series =	{Leibniz International Proceedings in Informatics (LIPIcs)},
  ISBN =	{978-3-95977-341-6},
  ISSN =	{1868-8969},
  year =	{2024},
  volume =	{313},
  editor =	{Aldrich, Jonathan and Salvaneschi, Guido},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2024.43},
  URN =		{urn:nbn:de:0030-drops-208926},
  doi =		{10.4230/LIPIcs.ECOOP.2024.43},
  annote =	{Keywords: Software Verification, Invariant Synthesis, Model-Checking}
}

Search Results

Documents authored by Navas, Jorge A.

Sound Static Program Analysis in Modern Software Engineering (Dagstuhl Seminar 25421)

Abstract

Cite as

Inductive Predicate Synthesis Modulo Programs

Abstract

Cite as

Thanks for your feedback!

Could not send message