An experience with two symbolic execution-based approaches to formal verification of Ada tasking programs

Two different approaches that use symbolic execution were used to prove partial correctness and general safety properties of Ada programs. One approach is based on interleaving the task components while the other is based on verifying the tasks in isolation and then performing cooperation proofs. Both approaches extend past efforts by incorporating tasking proof rules into the symbolic executor, allowing Ada programs with tasking to be formally verified. The limitations of each approach are presented, along with each approach's advantages and disadvantages. In particular, the difficulty of dealing with communication statements in a loop structure is addressed in detail.<>