<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
	>

<channel>
	<title>David Crocker&#039;s Verification Blog</title>
	<atom:link href="http://critical.eschertech.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://critical.eschertech.com</link>
	<description>Formal verification of C/C++ code for critical systems</description>
	<lastBuildDate>Mon, 24 Oct 2011 09:31:25 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
<cloud domain='critical.eschertech.com' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
<image>
		<url>http://0.gravatar.com/blavatar/2d9ea17580af79aa98fdb5a69e5d2f3b?s=96&#038;d=http%3A%2F%2Fs2.wp.com%2Fi%2Fbuttonw-com.png</url>
		<title>David Crocker&#039;s Verification Blog</title>
		<link>http://critical.eschertech.com</link>
	</image>
	<atom:link rel="search" type="application/opensearchdescription+xml" href="http://critical.eschertech.com/osd.xml" title="David Crocker&#039;s Verification Blog" />
	<atom:link rel='hub' href='http://critical.eschertech.com/?pushpress=hub'/>
		<item>
		<title>Escher C Verifier released!</title>
		<link>http://critical.eschertech.com/2011/10/24/escher-c-verifier-released/</link>
		<comments>http://critical.eschertech.com/2011/10/24/escher-c-verifier-released/#comments</comments>
		<pubDate>Mon, 24 Oct 2011 09:29:54 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=604</guid>
		<description><![CDATA[We are pleased to announce that Escher C Verifier is now a released product. This first release is later than planned, but goes beyond our original goal. We found that some of our pilot users had constructs such as function pointers and limited use of &#8216;goto&#8217; in their software, so we decided to support these [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=604&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2011/10/24/escher-c-verifier-released/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Verifying programs that use function pointers</title>
		<link>http://critical.eschertech.com/2011/09/08/verifying-programs-that-use-function-pointers/</link>
		<comments>http://critical.eschertech.com/2011/09/08/verifying-programs-that-use-function-pointers/#comments</comments>
		<pubDate>Thu, 08 Sep 2011 14:03:10 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=565</guid>
		<description><![CDATA[In safety-critical software, function pointers should be used sparingly or not at all. They complicate program flow and can make it very hard to understand what the program is doing. However, when used carefully in the right circumstances, they can actually simplify a program. Typically, function pointers are used in C programs for two different [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=565&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2011/09/08/verifying-programs-that-use-function-pointers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>eCv beta 1 released!</title>
		<link>http://critical.eschertech.com/2010/12/20/ecv-beta-1-released/</link>
		<comments>http://critical.eschertech.com/2010/12/20/ecv-beta-1-released/#comments</comments>
		<pubDate>Mon, 20 Dec 2010 16:44:52 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=527</guid>
		<description><![CDATA[I&#8217;m pleased to announce that we&#8217;ve just released Escher C Verifier beta 1. We&#8217;re intending to keep the beta phase quite short, so barring major problems, full release of eCv should take place in January 2011. We&#8217;ll be releasing a Critical Systems Edition of eCv, and also a Free Edition with reduced functionality &#8211; just like [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=527&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/12/20/ecv-beta-1-released/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Verifying programs that use &#8216;sizeof&#8217;</title>
		<link>http://critical.eschertech.com/2010/12/12/verifying-programs-that-use-sizeof/</link>
		<comments>http://critical.eschertech.com/2010/12/12/verifying-programs-that-use-sizeof/#comments</comments>
		<pubDate>Sun, 12 Dec 2010 16:57:14 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>
		<category><![CDATA[Formal verification of C programs]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=522</guid>
		<description><![CDATA[Consider the following code snippet (based on a real example of critical embedded software), whose purpose is to serialize some data and send it to another piece of hardware: enum errorCode sendData(uint32_t address, const void * data, uint8_t size) pre(size &#60;= data.lim); enum errorCode receiveData(uint32_t address, void * data, uint8_t size) pre(size &#60;= data.lim); struct [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=522&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/12/12/verifying-programs-that-use-sizeof/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>ArC is now eCv!</title>
		<link>http://critical.eschertech.com/2010/09/06/arc-is-now-ecv/</link>
		<comments>http://critical.eschertech.com/2010/09/06/arc-is-now-ecv/#comments</comments>
		<pubDate>Mon, 06 Sep 2010 16:17:51 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=516</guid>
		<description><![CDATA[We&#8217;re now nearing the beta release of our C verification product. We&#8217;ve decided to call the product Escher C Verifier, or eCv for short. While we liked the name ArC (Automated Reasoning about C), there are just too many pieces of software already out there with ARC in the name. The market that we&#8217;re trying [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=516&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/09/06/arc-is-now-ecv/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Dynamic Memory Allocation in Critical Embedded Systems</title>
		<link>http://critical.eschertech.com/2010/07/30/dynamic-memory-allocation-in-critical-embedded-systems/</link>
		<comments>http://critical.eschertech.com/2010/07/30/dynamic-memory-allocation-in-critical-embedded-systems/#comments</comments>
		<pubDate>Fri, 30 Jul 2010 13:49:55 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=509</guid>
		<description><![CDATA[Today I&#8217;m going to talk about why dynamic memory allocation is rarely used in critical embedded systems, and whether using only static allocation is a necessary restriction. I&#8217;m going to assume that maintaining system availability is critical, that there are hard real-time deadlines to be met, and that the system is long-running. Issues we have [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=509&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/07/30/dynamic-memory-allocation-in-critical-embedded-systems/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Verifying pointer arithmetic</title>
		<link>http://critical.eschertech.com/2010/07/16/verifying-pointer-arithmetic/</link>
		<comments>http://critical.eschertech.com/2010/07/16/verifying-pointer-arithmetic/#comments</comments>
		<pubDate>Fri, 16 Jul 2010 17:31:13 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>
		<category><![CDATA[Formal verification of C programs]]></category>
		<category><![CDATA[formal specification]]></category>
		<category><![CDATA[formal verification]]></category>
		<category><![CDATA[pointer arithmetic]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=455</guid>
		<description><![CDATA[Today I&#8217;ll look at whether code that uses pointer arithmetic is any harder to verify than equivalent code that does not use pointer arithmetic. Consider this function for copying an array (or part of an array) into another array (or part of another array): void arrayCopy(const int* src, int* dst, size_t num) { size_t i; [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=455&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/07/16/verifying-pointer-arithmetic/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Run-time checks: Are they worth it?</title>
		<link>http://critical.eschertech.com/2010/07/07/run-time-checks-are-they-worth-it/</link>
		<comments>http://critical.eschertech.com/2010/07/07/run-time-checks-are-they-worth-it/#comments</comments>
		<pubDate>Wed, 07 Jul 2010 16:28:41 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=436</guid>
		<description><![CDATA[One of the criticisms levelled against the use of C in safety-critical software is that the C language does not provide run-time checks automatically. For example, when indexing into an array, there is no check that the index is in bounds. Likewise, when doing integer arithmetic in C, there is no check for arithmetic overflow. [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=436&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/07/07/run-time-checks-are-they-worth-it/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Aliasing and how to control it</title>
		<link>http://critical.eschertech.com/2010/06/22/aliasing-and-how-to-control-it/</link>
		<comments>http://critical.eschertech.com/2010/06/22/aliasing-and-how-to-control-it/#comments</comments>
		<pubDate>Tue, 22 Jun 2010 11:22:53 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>
		<category><![CDATA[Formal verification of C programs]]></category>
		<category><![CDATA[aliasing]]></category>
		<category><![CDATA[formal specification]]></category>
		<category><![CDATA[formal verification]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=420</guid>
		<description><![CDATA[Today I&#8217;ll start by writing a simple function that determines the maximum and minimum of two integers. We want to return two values, and C doesn&#8217;t make that easy unless we declare a struct to hold them. So I&#8217;ll pass two pointers to where I want the results stored instead. Here goes: #include "arc.h" void [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=420&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/06/22/aliasing-and-how-to-control-it/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
		<item>
		<title>Verifying absence of integer overflow</title>
		<link>http://critical.eschertech.com/2010/06/07/verifying-absence-of-integer-overflow/</link>
		<comments>http://critical.eschertech.com/2010/06/07/verifying-absence-of-integer-overflow/#comments</comments>
		<pubDate>Mon, 07 Jun 2010 16:44:39 +0000</pubDate>
		<dc:creator>davidcrocker</dc:creator>
				<category><![CDATA[C and C++ in critical systems]]></category>
		<category><![CDATA[Formal verification of C programs]]></category>
		<category><![CDATA[formal verification]]></category>

		<guid isPermaLink="false">http://critical.eschertech.com/?p=364</guid>
		<description><![CDATA[One class of errors we need to guard against when writing critical software is arithmetic overflow. Before I go into detail, I invite you to consider the following program and decide what it prints: #include &#60;stdio.h&#62; int main(int argc, char *argv[]) { unsigned int x = 42; long y = -10; printf("%s\n", (x &#62; y [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=critical.eschertech.com&amp;blog=11762912&amp;post=364&amp;subd=davidcrocker&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://critical.eschertech.com/2010/06/07/verifying-absence-of-integer-overflow/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
	
		<media:content url="http://1.gravatar.com/avatar/9efed2bd9429eac89f62a336b6d05174?s=96&#38;d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D96&#38;r=G" medium="image">
			<media:title type="html">davidcrocker</media:title>
		</media:content>
	</item>
	</channel>
</rss>
