Ranjit Jhala Ken McMillan Array Abstractions From Proofs The Problem Reasoning about Data fori0ini Mi0 forj0jnj assertMj0 All cells from 0 to ID: 317028
Download Presentation The PPT/PDF document "From Proofs" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
From Proofs
Ranjit Jhala Ken McMillan
Array Abstractions
From ProofsSlide2
The Problem: Reasoning about Data
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
All cells from
0
to i equal 0
Prover must know
All cells from 0 to n equal 0
All cells from j to n equal 0Slide3
The Problem: Reasoning about Data
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Eager Analyses [TVLA
]
i
M
i
i+1
n-1
M>
i
= ?
0
i-1
M
<
i
= 0
0
n
-1
M
<
n
= 0
j
M
i
=0
j+1
M
>j
=
0
0
j
-1
M
<j
= 0
What’s the problem ?
n
-
1
Irrelevant to propertySlide4
The Problem: Reasoning about Data
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Eager Analyses [TVLA
]
i
M
i i+1
n-1
M
>
i
= ?
0
i-1
M
<
i
= 0
0
n
-1
M
<
n
= 0
j
M
i
=0
j+1
M
>j
=
0
0
j
-1
M
<j
= 0
Irrelevant to property
n
-
1Slide5
____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
The Problem: Reasoning about Data
Eager Analyses [TVLA]
i
M
i
i+1
n-1
M
>
i
= ?
0
i-1
M
<
i
= 0
0
n
-1
M
<
n
= 0
j
M
i
=0
j+1
M
>j
=
0
0
j
-1
M
<j
= 0
Irrelevant to property
n
-
1
Irrelevant facts cause
State Explosion
In Large Programs
Goal: Lazy
Reasoning about Data
Property Guided [CEGAR]
Relevant facts:
needed to refute
infeasible error paths Slide6
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Eager Analyses [TVLA
]
Property Guided [CEGAR]
Relevant facts:
needed to refute infeasible error paths
Goal: Lazy Reasoning about DataSlide7
Property Guided Reasoning (CEGAR)
C Program
Infeasible:Relevant
Facts
No:
Abstract
Error Path
Yes
Check
Safety
Refine
Assertions
Safe
Error
FeasibleSlide8
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Goal: Lazy Reasoning about Data
i
’ = 0
i
n
j
’=0
j
n
Æ
M[j]
0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
j
n ÆM[j] = 0 Æ
j’ = j + 1
ProgramSlide9
Goal: Lazy Reasoning about Data
Program
Infeasible Error Path
i
’ = 0
i
= n
j
’=0
j
n
Æ
M[j]
0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
j
n Æ
M[j]=0 Æ
j’ = j + 1
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n Æ
M’=UPD(M,i,0) Æ
i’ = i + 1
i
=
n
j
’=0
j
n
Æ
M[j] = 0
Æ
j
’ = j + 1
j
n
Æ
M[j
]
0Slide10
Goal: Lazy Reasoning about Data
Relevant Facts
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j
’=0
j
n Æ M[j]
= 0 Æ j’ = j + 1j
n Æ M[j]
0
i=0
i=1
M[1] =0
M[1] =0
j=0, M[1] =0
j=1, M[1] =0
i
=0,i=1,
M[1]=0,j=0,j=1Slide11
Relevant Facts
Infeasible Error Path
i
=1
i
=2
M[2] =0
M[2] =0
j=0, M[2] =0
j=1, M[2] =0
i=0,i=1,M[1]=0,
j=0,j=1
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ i’ = i + 1
j
n
Æ M[j]
0
j n Æ
M[j] = 0 Æ j’ = j + 1
i
=
n
j
’=0
j
n
Æ M[j]
= 0 Æ j’ = j + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
j=2, M[2] =0
i
=0
i
=2,
M[2]=0,
j=2
…
…
…
Goal: Lazy Reasoning about Data
Problem
: Lazy Reasoning
D
ivergesSlide12
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
All cells
from
0
to i equal 0
Relevant Facts
All cells from 0 to n equal 0
All cells from j to n equal 0
Solution
Abstractions for
aggregates
Inference of abstractions from inf. paths
Problem
: Lazy Reasoning
D
ivergesSlide13
Plan
Motivation
Abstractions for AggregatesAlgorithm for Abstraction InferencePreliminary Results
DiscussionSlide14
Abstraction: Range Predicates
For all cells
®
from t1
to t2 property p
holds
p
®
p
t
1
p
t
1+1
…
t
2
…
RP(t
1
,t
2
,p
) =
p[t
1
/
®
]
Æ
(
t
1
+1=
t
2
Ç
RP(t1+1,t2
,p))Slide15
Range Predicates: Example
For all cells
® from
0 to
i property M[®]=0
holds
M[
®
] =0
0
…
iRP(0, i, M[®] = 0)
M[
®
] =0Slide16
Range Predicates: Example
For all cells
® from
0 to
n property M[®]¸
0
holds
M[
®]¸0
0
…
nRP(0, n
, M[®]
¸ 0)
M[
®
]
¸
0Slide17
Range Predicates : Example
Sorted
: For all cells ®
from i to
n: M[®]
·
M[
®
+1] M[®]·
M[®+1]
i…
n
RP(
i, n, M[
®
]
·
M[
®
+1])
M[
®
]
·
M[
®
+1]Slide18
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Verification with Range Predicates
How to
lazily
infer Range Predicates ?All cells from 0
to i equal 0
Relevant FactsAll cells from 0
to n equal 0All cells from
j to n
equal 0
RP (0,
i
, M[
®
] = 0)
RP(0, n, M[
®
] = 0)
RP(j, n, M[
®
] = 0)Slide19
Plan
Motivation
Abstractions for Aggregates: RP
Algorithm for Inferring RPPreliminary ResultsRelated Work and DiscussionSlide20
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j’=0 j
n Æ M[j]
= 0 Æ j’ = j + 1
j n
Æ M[j] 0
F1
F
2
F
3
F4
F
5
F
6
F0
F
7
Over values of variables
Relevant Facts
Initial state arbitrarySlide21
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j
’=0
j n Æ M[j
] = 0 Æ j
’ = j + 1j
n Æ M[j]
0
Relevant FactsF
4
F
5
F6
F
0
F7
O
ver values of variables
Relevant Facts
Initial state arbitrary
From Fk-1 exec
Opk yields
Fk
F
2
F
3
F
1Slide22
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j
’=0
j n Æ M[j
] = 0 Æ j
’ = j + 1j
n Æ M[j]
0
Relevant FactsF
4
F
5
F6
F
0
F7
O
ver values of variables
Relevant Facts
Initial state arbitrary
From Fk-1 exec
Opk yields
Fk
F
3
F
1
F
2Slide23
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j’=0 j
n Æ M[j
] = 0 Æ j
’ = j + 1j
n Æ M[j]
0Relevant Facts
F
1
F
4
F5
F
6
F0
F
7
O
ver values of variablesRelevant Facts
Initial state arbitrary
From F
k-1 exec Op
k
yields
F
k
F
2
F
3Slide24
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j
’=0 j
n Æ M[j
] = 0 Æ j’ = j + 1
j n Æ M[j]
0
Relevant Facts
F
1
F5
F
6
F0
F
7
O
ver values of variablesRelevant Facts
Initial state arbitrary
From F
k-1 exec Op
k
yields
F
k
F
3
F
4Slide25
F
3
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
=
n
j’=0
j n Æ
M[j] = 0 Æ j’ = j + 1
j
n Æ M[j] 0
Relevant Facts
F
1
F
6F
0
F
7
Over values of variables
Relevant Facts
Initial state arbitrary
From F
k-1 exec Opk yields
F
k
F
4
F
5Slide26
F
3
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i = n j’=0
j
n Æ M[j
] = 0 Æ j’ = j + 1
j n
Æ M[j] 0
Relevant Facts
F
1
F0
F
7
Over values of variables
Relevant Facts
Initial state arbitrary
From F
k-1 exec Opk
yields Fk
F
4
F
6
F
5Slide27
F
5
F
3
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1i
= n
j’=0
j n
Æ M[j] = 0
Æ j’ = j + 1j n
Æ M[j]
0
Relevant Facts
F1
F
0
F7
Over values of variables
Relevant Facts
Initial state arbitrary
From F
k-1 exec Op
k yields Fk
F
4
F
6Slide28
F
6
F
5
F
3
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1i
= n
j’=0
j n Æ
M[j] = 0 Æ j’ = j + 1
j n
Æ M[j] 0
Relevant Facts
F
1
F0
F
7
Over values of variables
Relevant Facts
Initial state arbitrary
From F
k-1 exec Op
k yields Fk
Final location unreachable
F
4Slide29
F
6
F
5
F
3
F
2
Abstractions from Infeasible Paths
Infeasible Error Path
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1i
= n
j’=0
j n Æ
M[j] = 0 Æ j’ = j + 1
j n
Æ M[j] 0
Relevant Facts
F
1
F0
F
7
Over values of variables
Relevant Facts
Initial state arbitrary
From F
k-1 exec Op
k yields Fk
Final location unreachable
F
4
1. Path
!
Constraints
Algorithm [POPL 04]
2. InterpolationSlide30
F
6
F
5
F
3
F
2
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1i
= n
j’=0
j n Æ
M[j] = 0 Æ j’ = j + 1
j
n Æ M[j] 0
F
1
F0
F
7
F
4
Relevant Facts
1. Path
!
Constraints
Algorithm [POPL 04]
2. Interpolation
i
1
= 0
i
1
n
Æ
M
1
=
UPD
(M
0
,i
1
,0
)
Æ
i
2
=
i
1
+1
i
3
=
n
j
1
= 0
j
1
n
Æ
M
2
[j
1
] = 0
Æ
j
2
=
j
1
+ 1
j
2
n
Æ
M
2
[j
2
]
0
i
2
n
Æ
M
2
=
UPD
(M
1
,i
2
,0
)
Æ
i
3
=
i
2
+1Slide31
F
6
F
5
F
3
F
2
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
i
’ = 0
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1
i
n
Æ
M’=
UPD
(M,i,0)
Æ
i’ = i + 1i
= n
j’=0
j n Æ
M[j] = 0 Æ j’ = j + 1
j n
Æ M[j] 0
F
1
F0
F
7
F
4
Relevant Facts
1. Path
!
Constraints
Algorithm [POPL 04]
2. Interpolation
i
1
= 0
i
1
n
Æ
M
1
=UPD(M
0
,i
1
,0
)
Æ
i
2
=
i
1
+1
i
3
=
n
j
1
= 0
j
1
n
Æ
M
2
[j
1
] = 0
Æ
j
2
=
j
1
+ 1
j
2
n
Æ
M
2
[j
2
]
0
i
2
n
Æ
M
2
=UPD(M
1
,i
2
,0
)
Æ
i
3
=
i
2
+1
0:
1:
2:
3:
4:
5:
6:Slide32
Relevant Facts
Abstractions from Infeasible Paths
O
ver values of variables
2.
Interpolants
Initial state arbitrary
F
k-1
+
Op
k
yields F
k
Final loc. unreachable
1. Path
!
Constraints
Algorithm [POPL 04]
2. Interpolation
1. Path Constraints [SSA]
F
6
F
5
F
3
F
2
F
1
F
0
F
7
F
4
i
1
= 0
i
1
n
Æ
M
1
=UPD(M
0
,i
1
,0
)
Æ
i
2
=
i
1
+1
i
3
=
n
j
1
= 0
j
1
n
Æ
M
2
[j
1
] = 0
Æ
j
2
=
j
1
+ 1
j
2
n
Æ
M
2
[j
2
]
0
i
2
n
Æ
M
2
=UPD(M
1
,i
2
,0
)
Æ
i
3
=
i
2
+1
0:
1:
2:
3:
4:
5:
6:Slide33
F
6
F
5
F
3
F
2
Abstractions from Infeasible Paths
F1
F0
F7F4
1. Path Constraints [SSA]
RP(j
2
,n,M
2
[
®
]=0
)
RP(j
1
,n,M
2
[
®
]=
0
)
RP(0,i
3
,M
2
[®]=
0)
RP(0,i
2,M1[®]=0)
i
1
=0
True
False
RP(0,n,M
2[®]=0)
Relevant Facts
O
ver values of variables
2. Interpolants
Initial state arbitrary
F
k-1 + Op
k yields Fk
Final loc. unreachable
i
1
= 0
i
1
n
Æ
M
1
=UPD(M
0
,i
1
,0
)
Æ
i
2
=
i
1
+1
i
3
=
n
j
1
= 0
j
1
n
Æ
M
2
[j
1
] = 0
Æ
j
2
=
j
1
+ 1
j
2
n
Æ
M
2
[j
2
]
0
i
2
n
Æ
M
2
=UPD(M
1
,i
2
,0
)
Æ
i
3
=
i
2
+1
0:
1:
2:
3:
4:
5:
6:Slide34
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
Relevant Facts
O
ver values of variables
2.
Interpolants
Initial state arbitrary
Fk-1 + Op
k yields FkFinal loc. unreachable
RP(j2,n,M2[®]=0)
RP(j
1,n,M
2
[
®
]=
0
)
RP(0,i
3
,M
2
[
®
]=
0
)
RP(0,i
2
,M
1
[®
]=0)
i
1=0
True
False
RP(0,n,M
2[
®]=0)Slide35
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
2.
Interpolants
RP(j
2
,n,M
2
[®]=0)RP(j
1,n,M2[®]=
0)RP(0,i3,M2[
®]=0)RP(0,i2
,M1[
®]=0)
i
1
=0
True
False
RP(0,n,M
2
[
®
]=0
)
3. Relevant Facts
i
=0,
RP(0,i,M[
®
]=
0
),
RP(0,n,M[
®
]=
0
),
RP(
j,n,M
[®]=0
)
Drop
SSA NameSlide36
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
2.
Interpolants
3. Relevant Facts
???
Drop
SSA NameSlide37
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
3
.
Interpolants
4
. Relevant Facts
2. Scoped Proof of Infeasibility
How to build
Scoped Proof
Using RP ?
[TACAS06]DropSSA Name
???Slide38
Plan
Motivation
Abstractions for Aggregates: RP
Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide39
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
3
.
Interpolants
4
. Relevant Facts
2. Scoped Proof of Infeasibility
How to build
Scoped Proof
Using RP ?
[TACAS06]DropSSA NameSlide40
x
= 0
y
=
x
z
= y
z
0
Roots
= Input Constraints
Vertices
= Axiom Instances
Constraints
x=0
y=x
y=0
z=y
z
=0
Axiom : Transitivity
B=C
A=B
A=C
Proofs of Infeasibility
0
:
1:
2:
3:Slide41
Roots
= Input Constraints
Vertices
= Axiom Instances
Sink
=
False
x=0
y=x
y=0
z=y
z
=0
z
0
False
Axiom :
Disequality
A
B
A=B
False
Proofs of Infeasibility
x
= 0
y
=
x
z
= y
z
0
Constraints
0
:
1:
2:
3:Slide42
Roots
= Input ConstraintsVertices = Axiom InstancesSink = False
x=0
y=x
y=0
z=y
z
=0
z
0
False
Proofs of Infeasibility
x
= 0
y
=
x
z
= y
z
0
Constraints
0
:
1:
2:
3:Slide43
Vertices: p
variables in scope at i
Edges: p
variables in scope at jProofs of Infeasibility
x
y
z
x=0
0:
y=x
1
:
y=0
1
:
z=y
2
:
z
=0
2
:
z
0
3:
False
3:
Scoped
Well-Scoped Proofs
…
p
Scope
j:
i:
x
= 0
y
=
x
z
= y
z
0
Constraints
0
:
1:
2:
3:Slide44
Roots
= Input ConstraintsVertices = Axiom InstanceSink = False Well-scoped
Proofs of Infeasibility
Scoped
x=0
0
:
y=x
1
:
y=0
1:z=y
2:
z
=0
2
:
z
0
3:
False
3:
x
= 0
y
=
x
z
= y
z
0
Constraints
0
:
1:
2:
3:Slide45
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
3
.
Interpolants
4
. Relevant Facts
2. Scoped Proof of Infeasibility
How to build
Scoped Proof
Using RP ?
[TACAS06]DropSSA NameSlide46
Scoped Proofs Using Range Predicates
1. Path Constraints
2. Scoped Proof of Infeasibility
Apply
axioms
until:
False
deduced
Or no new facts
Scoped Saturation
RP Axioms
Scoped ProverHow to build
Scoped Proof using RP ?Slide47
Range Predicate Axioms
Axioms: High-level reasoning for segmentsCreate (Generalize), Use (Instantiate)
Extend, Shrink, JoinPreserve (after update)
For all cells
®
from
t
1
to t
2
property p holds
p
t
1
p
…
t
2Slide48
Axiom: Create (Generalize)
p
t
t+1
p
t
Axiom: Generalize
P
RP(t,t+1,P[
®
/t])
hyps
conseqSlide49
Axiom: Use (Instantiate-Left)
p
p
t
1
…
t
2
t
1
Axiom: Inst-Left
RP(t
1
,t
2
,P
)
P[t
1
/
®
]
hyps
conseqSlide50
Axiom: Extend-Left
p
p
t
1
+1
…
t
2
t
1
Axiom: Extend-Left
RP(t
1
+1,t
2
,P
)
p
t
1
…
t
2
P[t
1
/
®
]
RP(t
1
,t
2
,P
)
hyps
conseqSlide51
Axiom: Shrink-Left
…
t
2
Axiom: Shrink-Left
RP(t
1
,t
2
,P
)
p
t
1
…
t
2
t
1
+1
t
2
RP(t
1
+1,t
2
,P
)
p
t
1
+1
p
t
1
+1
hyps
conseqSlide52
Axiom: Join
…
t
3
Axiom: Join
RP(t
1
,t
2
,P
)
p
t
1
…
t
2
RP(t
2
,t
3
,P)
RP(t
1
,t
3
,P
)
p
t
1
p
t
2
…
t
3
hyps
conseqSlide53
Axiom: Preserve-Left
Axiom: Preserve-Left
RP(t
1
,t
2
,P
)
a<t
1
RP(t1,t2,P[M’/M])
p
t
1
…
t
2
a <
UPDATE
p
t
1
…
t
2
M’=
UPD
(
M,a
,_)
hyps
conseqSlide54
Scoped Proofs Using Range Predicates
Path Constraints
Scoped Proof of Infeasibility
Apply
axioms
until:
False
deduced
Or no new facts
Scoped Saturation
RP Axioms
Scoped ProverSlide55
Path Constraints
0:
1:
2:
3:
4:
5:
6: i1
= 0
i1
n,
M
1
=
UPD
(M
0
,i
1
,0
),
i
2
=
i1+1
i
3 = n j
1 = 0
j1
n, M2[j
1] = 0, j2
= j1+1
j2 n,
M2[j2]
0
i2n, M2=
UPD(M1,i2
,0), i3
=i2+1
RP(i1,i
1+1,M1
[®]=0)
1:
M
1
[i
1]=0
1:
0=i
1
0:
i
2
=i
1
+1
1:
RP(0,i
2
,M
1
[
®
]
=0)
1:
i
2
·
i
2
2:
RP(0,i
2
,M
2
[
®
]
=0)
2:
M
2
[i
2
]
=0
2:
RP(0,i
2
+1,M
2
[
®
]
=0)
2:
M
2
=UPD(M
1
,i
2
,0
)=0
2:
i
3
=i
2
+1
2:
RP(0,i
3
,M
2
[
®
]
=0)
2:
n=i
3
3:
RP(0,n,M
2
[
®
]
=0)
3:
j
1
=0
4:
RP(
j
1
,n,M
2
[
®
]
=0)
4:
j
2
=j
1
+1
5:
j
2
n
6:
j
1
+1
n
5:
RP(
j
1
+1,n,M
2
[
®
]
=0)
5:
M
2
[j
2
]
=0
5:
RP(
j
2
,n,M
2
[
®
]
=0)
5:
M
2
[j
2
]
0
6:
False
6:
Example Proof
Generalize
Congruence
Preserve-Right
Update
Extend-Right
Shrink-Left
Instantiate-Left
Disequality
0
:
1:
2:
3:
4:
6:
5:Slide56
Path Constraints
0:
1:
2:
3:
4:
5:
6: i1
= 0
i1
n,
M
1
=
UPD
(M
0
,i
1
,0
),
i
2
=
i1+1
i
3 = n j
1 = 0
j1
n, M2[j
1] = 0, j2
= j1+1
j2 n,
M2[j2]
0
i2n, M2=
UPD(M1,i2
,0), i3
=i2+1
RP(i1,i
1+1,M1
[®]=0)
1:
M
1
[i
1]=0
1:
0=i
1
0:
i
2
=i
1
+1
1:
RP(0,i
2
,M
1
[
®
]
=0)
1:
i
2
·
i
2
2:
RP(0,i
2
,M
2
[
®
]
=0)
2:
M
2
[i
2
]
=0
2:
RP(0,i
2
+1,M
2
[
®
]
=0)
2:
M
2
=UPD(M
1
,i
2
,0
)=0
2:
i
3
=i
2
+1
2:
RP(0,i
3
,M
2
[
®
]
=0)
2:
n=i
3
3:
RP(0,n,M
2
[
®
]
=0)
3:
j
1
=0
4:
RP(
j
1
,n,M
2
[
®
]
=0)
4:
j
2
=j
1
+1
5:
j
2
n
6:
j
1
+1
n
5:
RP(
j
1
+1,n,M
2
[
®
]
=0)
5:
M
2
[j
2
]
=0
5:
RP(
j
2
,n,M
2
[
®
]
=0)
5:
M
2
[j
2
]
0
6:
False
6:
Example Proof
0
:
1:
2:
3:
4:
6:
5:Slide57
Constraints
0:
1:
2:
3:
4:
5:
6: i1
= 0
i1
n,
M
1
=
UPD
(M
0
,i
1
,0
),
i
2
=
i1+1
i
3 = n j
1 = 0
j1
n, M2[j
1] = 0, j2
= j1+1
j2 n,
M2[j2]
0
i2n, M2=
UPD(M1,i2
,0), i3
=i2+1
0=i1
0:
RP(0,i
2
,M1[®]=0)
1:
RP(0,i
3
,M
2
[
®
]
=0)
2:
RP(0,n,M
2
[
®
]
=0)
3:
RP(
j
1
,n,M
2
[
®
]
=0)
4:
RP(
j
2
,n,M
2
[
®
]
=0)
5:
False
6:
Example Proof
0
:
1:
2:
3:
4:
6:
5:
Interpolants
Relevant Facts
i
=0,
RP(0,i,M[
®
]=
0
),
RP(0,n,M[
®
]=
0
),
RP(
j,n,M
[
®
]=
0
)Slide58
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
3
.
Interpolants
4
. Relevant Facts
2. Scoped Proof of Infeasibility
How to build
Scoped Proof
Using RP ?
[TACAS06]DropSSA Name
RP Axioms
+ SaturationSlide59
Plan
Motivation
Abstractions for Aggregates: RP
Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide60
Abstractions from Infeasible Paths
1. Path Constraints [SSA]
3
.
Interpolants
4
. Relevant Facts
2. Scoped Proof of Infeasibility
[TACAS06]
Drop
SSA Name
RP Axioms+
Saturation
Refine
Slide61
Property Guided Reasoning (CEGAR)
C Program
Infeasible:Relevant
Facts
No:
Abstract
Error Path
Yes
Check
Safety
Refine
Assertions
Safe
Error
FeasibleSlide62
Preliminary Results
Implemented over FOCI Scoped Prover for EUF, Difference, ArraysCompleteness via Language Restriction[TACAS 2006]
Integrated within BLAST CEGAR loop[POPL 2004]
Experimented w/ array dependent programsProve safety properties
Expressiveness of axioms Slide63
Initialize
for(i=0;i!=n;i++)
M[i]=0;
for(j=0;j!=n;j
++)
assert(M[j]==0);
Relevant Facts
RP (0,
i, M[
®] = 0)
RP(0, n, M[®] = 0)RP(j, n, M[®] = 0)Slide64
Find
spot = M_len;
for(i=0;i != M_len;i++) if (spot==M_len&& M[i]!=0)
{spot = i;break;}
for (j=0; j!=spot; j++){ assert(M[j]==0);
Relevant Facts
RP(0,
i
, M[
®] = 0)
RP(0, spot,M[®] = 0)RP(j, spot,M
[®] = 0)Slide65
Vararg
n=0;
while(argv[n] != NULL){
n++;}
for(j=n; n!=0; j--) assert(argv[j]!=NULL);
Relevant Facts
RP(0,n,argv[
®
] != NULL)
RP(0,n,argv[®
] != NULL)RP(0,j,argv[®] = 0)Slide66
Partial-Initialize
k = 0;
for (i=0;i != n; i++)
if (X[i] >= 0)
{Z[k] = i;k++;}for (j=0;j != k; j++)
assert (X[Z[j]] >= 0);
Relevant Facts
RP(0, k, X[Z[
®]] = 0)
RP(j, k, X[Z[®]] = 0)Slide67
Producer-Consumer
head=0;tail=0;
while(1){ if(?){
//produce
buf[head]=data[head]; prod_ctr++; head++; } else {
//consume
if (head!=tail)
assert(buf[tail]==data[head]);
cons_ctr++; tail++ }}
Relevant FactsRP(
tail,head,buf[®]=data[®])Slide68
Results
ProgramTime
PredicatesIterations
initialize
1s187vararg
2s
14
8
copy4s2911copy-prop10s
3817find2s
2012partition8s3714partial-init
5s3212producer45s3941insert
90s7436
scull9s
36
14Slide69
Plan
Motivation
Abstractions for Aggregates: RP
Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide70
Related Work
Recursively defined predicates: Nelson [POPL 81]
Eager Shape and Data analyses:Based on Abstract InterpretationTVLA, Separation Logic
Recent Examples:Gopan-Reps-
Sagiv [POPL 05]Beyer-Henzinger-Majumdar-Rybalchenko [PLDI 07]Less eager, using property-derived
Path Programs
Template Invariants
: Bradley-Manna-
Sipma [VMCAI 06]Slide71
Discussion: Benefits
Lazy:
Fewer, relevant facts
tailored to program and property
Extensible:
J
ust
add axioms
Avoids abstract transformers/transfer functions
Plays well with other theories: EUF, Arithmetic, …Bi-directional: Trace-based, information flow forwards/backwardsFuture operations = disjunctions/case-splitsSlide72
Discussion: Drawbacks
Lazy:
Many proofs: “right” proof
!
“right” facts
Short counterexamples yield “wrong” facts
Delay convergence, state-space explosion
e.g. insertion-sort
Future work: Bias solver to find “better” proofs
Proofs that refute multiple paths
Slide73
Conclusions
Techniques for lazy reasoning about data:New abstraction: Range PredicatesInferring RP: Scoped proofs of infeasibility
Result: Lazy (CEGAR) verification Data-sensitive
propertiesArray manipulating programsSlide74
?