/
From Proofs From Proofs

From Proofs - PowerPoint Presentation

phoebe-click
phoebe-click . @phoebe-click
Follow
417 views
Uploaded On 2016-05-12

From Proofs - PPT Presentation

Ranjit Jhala Ken McMillan Array Abstractions From Proofs The Problem Reasoning about Data fori0ini Mi0 forj0jnj assertMj0 All cells from 0 to ID: 317028

upd facts infeasible relevant facts upd relevant infeasible path abstractions scoped constraints paths ssa error axiom proofs proof reasoning

Share:

Link:

Embed:

Download Presentation from below link

Download Presentation The PPT/PDF document "From Proofs" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.


Presentation Transcript

Slide1

From Proofs

Ranjit Jhala Ken McMillan

Array Abstractions

From ProofsSlide2

The Problem: Reasoning about Data

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

All cells from

0

to i equal 0

Prover must know

All cells from 0 to n equal 0

All cells from j to n equal 0Slide3

The Problem: Reasoning about Data

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Eager Analyses [TVLA

]

i

M

i

i+1

n-1

M>

i

= ?

0

i-1

M

<

i

= 0

0

n

-1

M

<

n

= 0

j

M

i

=0

j+1

M

>j

=

0

0

j

-1

M

<j

= 0

What’s the problem ?

n

-

1

Irrelevant to propertySlide4

The Problem: Reasoning about Data

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Eager Analyses [TVLA

]

i

M

i i+1

n-1

M

>

i

= ?

0

i-1

M

<

i

= 0

0

n

-1

M

<

n

= 0

j

M

i

=0

j+1

M

>j

=

0

0

j

-1

M

<j

= 0

Irrelevant to property

n

-

1Slide5

____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

The Problem: Reasoning about Data

Eager Analyses [TVLA]

i

M

i

i+1

n-1

M

>

i

= ?

0

i-1

M

<

i

= 0

0

n

-1

M

<

n

= 0

j

M

i

=0

j+1

M

>j

=

0

0

j

-1

M

<j

= 0

Irrelevant to property

n

-

1

Irrelevant facts cause

State Explosion

In Large Programs

Goal: Lazy

Reasoning about Data

Property Guided [CEGAR]

Relevant facts:

needed to refute

infeasible error paths Slide6

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Eager Analyses [TVLA

]

Property Guided [CEGAR]

Relevant facts:

needed to refute infeasible error paths

Goal: Lazy Reasoning about DataSlide7

Property Guided Reasoning (CEGAR)

C Program

Infeasible:Relevant

Facts

No:

Abstract

Error Path

Yes

Check

Safety

Refine

Assertions

Safe

Error

FeasibleSlide8

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Goal: Lazy Reasoning about Data

i

’ = 0

i

n

j

’=0

j

n

Æ

M[j]

0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

j 

n ÆM[j] = 0 Æ

j’ = j + 1

ProgramSlide9

Goal: Lazy Reasoning about Data

Program

Infeasible Error Path

i

’ = 0

i

= n

j

’=0

j

n

Æ

M[j]

0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

j

 n Æ

M[j]=0 Æ

j’ = j + 1

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

 n Æ

M’=UPD(M,i,0) Æ

i’ = i + 1

i

=

n

j

’=0

j

n

Æ

M[j] = 0

Æ

j

’ = j + 1

j

n

Æ

M[j

]

0Slide10

Goal: Lazy Reasoning about Data

Relevant Facts

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j

’=0

j

 n Æ M[j]

= 0 Æ j’ = j + 1j

 n Æ M[j]

 0

i=0

i=1

M[1] =0

M[1] =0

j=0, M[1] =0

j=1, M[1] =0

i

=0,i=1,

M[1]=0,j=0,j=1Slide11

Relevant Facts

Infeasible Error Path

i

=1

i

=2

M[2] =0

M[2] =0

j=0, M[2] =0

j=1, M[2] =0

i=0,i=1,M[1]=0,

j=0,j=1

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ i’ = i + 1

j

 n

Æ M[j] 

0

j  n Æ

M[j] = 0 Æ j’ = j + 1

i

=

n

j

’=0

j

n

Æ M[j]

= 0 Æ j’ = j + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

j=2, M[2] =0

i

=0

i

=2,

M[2]=0,

j=2

Goal: Lazy Reasoning about Data

Problem

: Lazy Reasoning

D

ivergesSlide12

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

All cells

from

0

to i equal 0

Relevant Facts

All cells from 0 to n equal 0

All cells from j to n equal 0

Solution

Abstractions for

aggregates

Inference of abstractions from inf. paths

Problem

: Lazy Reasoning

D

ivergesSlide13

Plan

Motivation

Abstractions for AggregatesAlgorithm for Abstraction InferencePreliminary Results

DiscussionSlide14

Abstraction: Range Predicates

For all cells

®

from t1

to t2 property p

holds

p

®

p

t

1

p

t

1+1

t

2

RP(t

1

,t

2

,p

) =

p[t

1

/

®

]

Æ

(

t

1

+1=

t

2

Ç

RP(t1+1,t2

,p))Slide15

Range Predicates: Example

For all cells

® from

0 to

i property M[®]=0

holds

M[

®

] =0

0

iRP(0, i, M[®] = 0)

M[

®

] =0Slide16

Range Predicates: Example

For all cells

® from

0 to

n property M[®]¸

0

holds

M[

®]¸0

0

nRP(0, n

, M[®]

¸ 0)

M[

®

]

¸

0Slide17

Range Predicates : Example

Sorted

: For all cells ®

from i to

n: M[®]

·

M[

®

+1] M[®]·

M[®+1]

i…

n

RP(

i, n, M[

®

]

·

M[

®

+1])

M[

®

]

·

M[

®

+1]Slide18

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Verification with Range Predicates

How to

lazily

infer Range Predicates ?All cells from 0

to i equal 0

Relevant FactsAll cells from 0

to n equal 0All cells from

j to n

equal 0

RP (0,

i

, M[

®

] = 0)

RP(0, n, M[

®

] = 0)

RP(j, n, M[

®

] = 0)Slide19

Plan

Motivation

Abstractions for Aggregates: RP

Algorithm for Inferring RPPreliminary ResultsRelated Work and DiscussionSlide20

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j’=0 j 

n Æ M[j]

= 0 Æ j’ = j + 1

j  n

Æ M[j]  0

F1

F

2

F

3

F4

F

5

F

6

F0

F

7

Over values of variables

Relevant Facts

Initial state arbitrarySlide21

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j

’=0

j  n Æ M[j

] = 0 Æ j

’ = j + 1j

 n Æ M[j]

 0

Relevant FactsF

4

F

5

F6

F

0

F7

O

ver values of variables

Relevant Facts

Initial state arbitrary

From Fk-1 exec

Opk yields

Fk

F

2

F

3

F

1Slide22

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j

’=0

j  n Æ M[j

] = 0 Æ j

’ = j + 1j

 n Æ M[j]

 0

Relevant FactsF

4

F

5

F6

F

0

F7

O

ver values of variables

Relevant Facts

Initial state arbitrary

From Fk-1 exec

Opk yields

Fk

F

3

F

1

F

2Slide23

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j’=0 j

 n Æ M[j

] = 0 Æ j

’ = j + 1j 

n Æ M[j] 

0Relevant Facts

F

1

F

4

F5

F

6

F0

F

7

O

ver values of variablesRelevant Facts

Initial state arbitrary

From F

k-1 exec Op

k

yields

F

k

F

2

F

3Slide24

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j

’=0 j

 n Æ M[j

] = 0 Æ j’ = j + 1

j  n Æ M[j]

 0

Relevant Facts

F

1

F5

F

6

F0

F

7

O

ver values of variablesRelevant Facts

Initial state arbitrary

From F

k-1 exec Op

k

yields

F

k

F

3

F

4Slide25

F

3

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

=

n

j’=0

j  n Æ

M[j] = 0 Æ j’ = j + 1

j 

n Æ M[j]  0

Relevant Facts

F

1

F

6F

0

F

7

Over values of variables

Relevant Facts

Initial state arbitrary

From F

k-1 exec Opk yields

F

k

F

4

F

5Slide26

F

3

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i = n j’=0

j

 n Æ M[j

] = 0 Æ j’ = j + 1

j  n

Æ M[j]  0

Relevant Facts

F

1

F0

F

7

Over values of variables

Relevant Facts

Initial state arbitrary

From F

k-1 exec Opk

yields Fk

F

4

F

6

F

5Slide27

F

5

F

3

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1i

= n

j’=0

j  n

Æ M[j] = 0

Æ j’ = j + 1j  n

Æ M[j] 

0

Relevant Facts

F1

F

0

F7

Over values of variables

Relevant Facts

Initial state arbitrary

From F

k-1 exec Op

k yields Fk

F

4

F

6Slide28

F

6

F

5

F

3

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1i

= n

j’=0

j  n Æ

M[j] = 0 Æ j’ = j + 1

j  n

Æ M[j]  0

Relevant Facts

F

1

F0

F

7

Over values of variables

Relevant Facts

Initial state arbitrary

From F

k-1 exec Op

k yields Fk

Final location unreachable

F

4Slide29

F

6

F

5

F

3

F

2

Abstractions from Infeasible Paths

Infeasible Error Path

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1i

= n

j’=0

j  n Æ

M[j] = 0 Æ j’ = j + 1

j  n

Æ M[j]  0

Relevant Facts

F

1

F0

F

7

Over values of variables

Relevant Facts

Initial state arbitrary

From F

k-1 exec Op

k yields Fk

Final location unreachable

F

4

1. Path

!

Constraints

Algorithm [POPL 04]

2. InterpolationSlide30

F

6

F

5

F

3

F

2

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1i

= n

j’=0

j  n Æ

M[j] = 0 Æ j’ = j + 1

j 

n Æ M[j]  0

F

1

F0

F

7

F

4

Relevant Facts

1. Path

!

Constraints

Algorithm [POPL 04]

2. Interpolation

i

1

= 0

i

1

n

Æ

M

1

=

UPD

(M

0

,i

1

,0

)

Æ

i

2

=

i

1

+1

i

3

=

n

j

1

= 0

j

1

n

Æ

M

2

[j

1

] = 0

Æ

j

2

=

j

1

+ 1

j

2

n

Æ

M

2

[j

2

]

0

i

2

n

Æ

M

2

=

UPD

(M

1

,i

2

,0

)

Æ

i

3

=

i

2

+1Slide31

F

6

F

5

F

3

F

2

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

i

’ = 0

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1

i

n

Æ

M’=

UPD

(M,i,0)

Æ

i’ = i + 1i

= n

j’=0

j  n Æ

M[j] = 0 Æ j’ = j + 1

j  n

Æ M[j]  0

F

1

F0

F

7

F

4

Relevant Facts

1. Path

!

Constraints

Algorithm [POPL 04]

2. Interpolation

i

1

= 0

i

1

n

Æ

M

1

=UPD(M

0

,i

1

,0

)

Æ

i

2

=

i

1

+1

i

3

=

n

j

1

= 0

j

1

n

Æ

M

2

[j

1

] = 0

Æ

j

2

=

j

1

+ 1

j

2

n

Æ

M

2

[j

2

]

0

i

2

n

Æ

M

2

=UPD(M

1

,i

2

,0

)

Æ

i

3

=

i

2

+1

0:

1:

2:

3:

4:

5:

6:Slide32

Relevant Facts

Abstractions from Infeasible Paths

O

ver values of variables

2.

Interpolants

Initial state arbitrary

F

k-1

+

Op

k

yields F

k

Final loc. unreachable

1. Path

!

Constraints

Algorithm [POPL 04]

2. Interpolation

1. Path Constraints [SSA]

F

6

F

5

F

3

F

2

F

1

F

0

F

7

F

4

i

1

= 0

i

1

n

Æ

M

1

=UPD(M

0

,i

1

,0

)

Æ

i

2

=

i

1

+1

i

3

=

n

j

1

= 0

j

1

n

Æ

M

2

[j

1

] = 0

Æ

j

2

=

j

1

+ 1

j

2

n

Æ

M

2

[j

2

]

0

i

2

n

Æ

M

2

=UPD(M

1

,i

2

,0

)

Æ

i

3

=

i

2

+1

0:

1:

2:

3:

4:

5:

6:Slide33

F

6

F

5

F

3

F

2

Abstractions from Infeasible Paths

F1

F0

F7F4

1. Path Constraints [SSA]

RP(j

2

,n,M

2

[

®

]=0

)

RP(j

1

,n,M

2

[

®

]=

0

)

RP(0,i

3

,M

2

[®]=

0)

RP(0,i

2,M1[®]=0)

i

1

=0

True

False

RP(0,n,M

2[®]=0)

Relevant Facts

O

ver values of variables

2. Interpolants

Initial state arbitrary

F

k-1 + Op

k yields Fk

Final loc. unreachable

i

1

= 0

i

1

n

Æ

M

1

=UPD(M

0

,i

1

,0

)

Æ

i

2

=

i

1

+1

i

3

=

n

j

1

= 0

j

1

n

Æ

M

2

[j

1

] = 0

Æ

j

2

=

j

1

+ 1

j

2

n

Æ

M

2

[j

2

]

0

i

2

n

Æ

M

2

=UPD(M

1

,i

2

,0

)

Æ

i

3

=

i

2

+1

0:

1:

2:

3:

4:

5:

6:Slide34

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

Relevant Facts

O

ver values of variables

2.

Interpolants

Initial state arbitrary

Fk-1 + Op

k yields FkFinal loc. unreachable

RP(j2,n,M2[®]=0)

RP(j

1,n,M

2

[

®

]=

0

)

RP(0,i

3

,M

2

[

®

]=

0

)

RP(0,i

2

,M

1

]=0)

i

1=0

True

False

RP(0,n,M

2[

®]=0)Slide35

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

2.

Interpolants

RP(j

2

,n,M

2

[®]=0)RP(j

1,n,M2[®]=

0)RP(0,i3,M2[

®]=0)RP(0,i2

,M1[

®]=0)

i

1

=0

True

False

RP(0,n,M

2

[

®

]=0

)

3. Relevant Facts

i

=0,

RP(0,i,M[

®

]=

0

),

RP(0,n,M[

®

]=

0

),

RP(

j,n,M

[®]=0

)

Drop

SSA NameSlide36

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

2.

Interpolants

3. Relevant Facts

???

Drop

SSA NameSlide37

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

3

.

Interpolants

4

. Relevant Facts

2. Scoped Proof of Infeasibility

How to build

Scoped Proof

Using RP ?

[TACAS06]DropSSA Name

???Slide38

Plan

Motivation

Abstractions for Aggregates: RP

Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide39

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

3

.

Interpolants

4

. Relevant Facts

2. Scoped Proof of Infeasibility

How to build

Scoped Proof

Using RP ?

[TACAS06]DropSSA NameSlide40

x

= 0

y

=

x

z

= y

z

0

Roots

= Input Constraints

Vertices

= Axiom Instances

Constraints

x=0

y=x

y=0

z=y

z

=0

Axiom : Transitivity

B=C

A=B

A=C

Proofs of Infeasibility

0

:

1:

2:

3:Slide41

Roots

= Input Constraints

Vertices

= Axiom Instances

Sink

=

False

x=0

y=x

y=0

z=y

z

=0

z

0

False

Axiom :

Disequality

A

B

A=B

False

Proofs of Infeasibility

x

= 0

y

=

x

z

= y

z

0

Constraints

0

:

1:

2:

3:Slide42

Roots

= Input ConstraintsVertices = Axiom InstancesSink = False

x=0

y=x

y=0

z=y

z

=0

z

0

False

Proofs of Infeasibility

x

= 0

y

=

x

z

= y

z

0

Constraints

0

:

1:

2:

3:Slide43

Vertices: p

variables in scope at i

Edges: p

variables in scope at jProofs of Infeasibility

x

y

z

x=0

0:

y=x

1

:

y=0

1

:

z=y

2

:

z

=0

2

:

z

0

3:

False

3:

Scoped

Well-Scoped Proofs

p

Scope

j:

i:

x

= 0

y

=

x

z

= y

z

0

Constraints

0

:

1:

2:

3:Slide44

Roots

= Input ConstraintsVertices = Axiom InstanceSink = False Well-scoped

Proofs of Infeasibility

Scoped

x=0

0

:

y=x

1

:

y=0

1:z=y

2:

z

=0

2

:

z

0

3:

False

3:

x

= 0

y

=

x

z

= y

z

0

Constraints

0

:

1:

2:

3:Slide45

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

3

.

Interpolants

4

. Relevant Facts

2. Scoped Proof of Infeasibility

How to build

Scoped Proof

Using RP ?

[TACAS06]DropSSA NameSlide46

Scoped Proofs Using Range Predicates

1. Path Constraints

2. Scoped Proof of Infeasibility

Apply

axioms

until:

False

deduced

Or no new facts

Scoped Saturation

RP Axioms

Scoped ProverHow to build

Scoped Proof using RP ?Slide47

Range Predicate Axioms

Axioms: High-level reasoning for segmentsCreate (Generalize), Use (Instantiate)

Extend, Shrink, JoinPreserve (after update)

For all cells

®

from

t

1

to t

2

property p holds

p

t

1

p

t

2Slide48

Axiom: Create (Generalize)

p

t

t+1

p

t

Axiom: Generalize

P

RP(t,t+1,P[

®

/t])

hyps

conseqSlide49

Axiom: Use (Instantiate-Left)

p

p

t

1

t

2

t

1

Axiom: Inst-Left

RP(t

1

,t

2

,P

)

P[t

1

/

®

]

hyps

conseqSlide50

Axiom: Extend-Left

p

p

t

1

+1

t

2

t

1

Axiom: Extend-Left

RP(t

1

+1,t

2

,P

)

p

t

1

t

2

P[t

1

/

®

]

RP(t

1

,t

2

,P

)

hyps

conseqSlide51

Axiom: Shrink-Left

t

2

Axiom: Shrink-Left

RP(t

1

,t

2

,P

)

p

t

1

t

2

t

1

+1

t

2

RP(t

1

+1,t

2

,P

)

p

t

1

+1

p

t

1

+1

hyps

conseqSlide52

Axiom: Join

t

3

Axiom: Join

RP(t

1

,t

2

,P

)

p

t

1

t

2

RP(t

2

,t

3

,P)

RP(t

1

,t

3

,P

)

p

t

1

p

t

2

t

3

hyps

conseqSlide53

Axiom: Preserve-Left

Axiom: Preserve-Left

RP(t

1

,t

2

,P

)

a<t

1

RP(t1,t2,P[M’/M])

p

t

1

t

2

a <

UPDATE

p

t

1

t

2

M’=

UPD

(

M,a

,_)

hyps

conseqSlide54

Scoped Proofs Using Range Predicates

Path Constraints

Scoped Proof of Infeasibility

Apply

axioms

until:

False

deduced

Or no new facts

Scoped Saturation

RP Axioms

Scoped ProverSlide55

Path Constraints

0:

1:

2:

3:

4:

5:

6: i1

= 0

i1

n,

M

1

=

UPD

(M

0

,i

1

,0

),

i

2

=

i1+1

i

3 = n j

1 = 0

j1

 n, M2[j

1] = 0, j2

= j1+1

j2  n,

M2[j2]

 0

i2n, M2=

UPD(M1,i2

,0), i3

=i2+1

RP(i1,i

1+1,M1

[®]=0)

1:

M

1

[i

1]=0

1:

0=i

1

0:

i

2

=i

1

+1

1:

RP(0,i

2

,M

1

[

®

]

=0)

1:

i

2

·

i

2

2:

RP(0,i

2

,M

2

[

®

]

=0)

2:

M

2

[i

2

]

=0

2:

RP(0,i

2

+1,M

2

[

®

]

=0)

2:

M

2

=UPD(M

1

,i

2

,0

)=0

2:

i

3

=i

2

+1

2:

RP(0,i

3

,M

2

[

®

]

=0)

2:

n=i

3

3:

RP(0,n,M

2

[

®

]

=0)

3:

j

1

=0

4:

RP(

j

1

,n,M

2

[

®

]

=0)

4:

j

2

=j

1

+1

5:

j

2

n

6:

j

1

+1

n

5:

RP(

j

1

+1,n,M

2

[

®

]

=0)

5:

M

2

[j

2

]

=0

5:

RP(

j

2

,n,M

2

[

®

]

=0)

5:

M

2

[j

2

]

0

6:

False

6:

Example Proof

Generalize

Congruence

Preserve-Right

Update

Extend-Right

Shrink-Left

Instantiate-Left

Disequality

0

:

1:

2:

3:

4:

6:

5:Slide56

Path Constraints

0:

1:

2:

3:

4:

5:

6: i1

= 0

i1

n,

M

1

=

UPD

(M

0

,i

1

,0

),

i

2

=

i1+1

i

3 = n j

1 = 0

j1

 n, M2[j

1] = 0, j2

= j1+1

j2  n,

M2[j2]

 0

i2n, M2=

UPD(M1,i2

,0), i3

=i2+1

RP(i1,i

1+1,M1

[®]=0)

1:

M

1

[i

1]=0

1:

0=i

1

0:

i

2

=i

1

+1

1:

RP(0,i

2

,M

1

[

®

]

=0)

1:

i

2

·

i

2

2:

RP(0,i

2

,M

2

[

®

]

=0)

2:

M

2

[i

2

]

=0

2:

RP(0,i

2

+1,M

2

[

®

]

=0)

2:

M

2

=UPD(M

1

,i

2

,0

)=0

2:

i

3

=i

2

+1

2:

RP(0,i

3

,M

2

[

®

]

=0)

2:

n=i

3

3:

RP(0,n,M

2

[

®

]

=0)

3:

j

1

=0

4:

RP(

j

1

,n,M

2

[

®

]

=0)

4:

j

2

=j

1

+1

5:

j

2

n

6:

j

1

+1

n

5:

RP(

j

1

+1,n,M

2

[

®

]

=0)

5:

M

2

[j

2

]

=0

5:

RP(

j

2

,n,M

2

[

®

]

=0)

5:

M

2

[j

2

]

0

6:

False

6:

Example Proof

0

:

1:

2:

3:

4:

6:

5:Slide57

Constraints

0:

1:

2:

3:

4:

5:

6: i1

= 0

i1

n,

M

1

=

UPD

(M

0

,i

1

,0

),

i

2

=

i1+1

i

3 = n j

1 = 0

j1

 n, M2[j

1] = 0, j2

= j1+1

j2  n,

M2[j2]

 0

i2n, M2=

UPD(M1,i2

,0), i3

=i2+1

0=i1

0:

RP(0,i

2

,M1[®]=0)

1:

RP(0,i

3

,M

2

[

®

]

=0)

2:

RP(0,n,M

2

[

®

]

=0)

3:

RP(

j

1

,n,M

2

[

®

]

=0)

4:

RP(

j

2

,n,M

2

[

®

]

=0)

5:

False

6:

Example Proof

0

:

1:

2:

3:

4:

6:

5:

Interpolants

Relevant Facts

i

=0,

RP(0,i,M[

®

]=

0

),

RP(0,n,M[

®

]=

0

),

RP(

j,n,M

[

®

]=

0

)Slide58

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

3

.

Interpolants

4

. Relevant Facts

2. Scoped Proof of Infeasibility

How to build

Scoped Proof

Using RP ?

[TACAS06]DropSSA Name

RP Axioms

+ SaturationSlide59

Plan

Motivation

Abstractions for Aggregates: RP

Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide60

Abstractions from Infeasible Paths

1. Path Constraints [SSA]

3

.

Interpolants

4

. Relevant Facts

2. Scoped Proof of Infeasibility

[TACAS06]

Drop

SSA Name

RP Axioms+

Saturation

Refine

Slide61

Property Guided Reasoning (CEGAR)

C Program

Infeasible:Relevant

Facts

No:

Abstract

Error Path

Yes

Check

Safety

Refine

Assertions

Safe

Error

FeasibleSlide62

Preliminary Results

Implemented over FOCI Scoped Prover for EUF, Difference, ArraysCompleteness via Language Restriction[TACAS 2006]

Integrated within BLAST CEGAR loop[POPL 2004]

Experimented w/ array dependent programsProve safety properties

Expressiveness of axioms Slide63

Initialize

for(i=0;i!=n;i++)

M[i]=0;

for(j=0;j!=n;j

++)

assert(M[j]==0);

Relevant Facts

RP (0,

i, M[

®] = 0)

RP(0, n, M[®] = 0)RP(j, n, M[®] = 0)Slide64

Find

spot = M_len;

for(i=0;i != M_len;i++) if (spot==M_len&& M[i]!=0)

{spot = i;break;}

for (j=0; j!=spot; j++){ assert(M[j]==0);

Relevant Facts

RP(0,

i

, M[

®] = 0)

RP(0, spot,M[®] = 0)RP(j, spot,M

[®] = 0)Slide65

Vararg

n=0;

while(argv[n] != NULL){

n++;}

for(j=n; n!=0; j--) assert(argv[j]!=NULL);

Relevant Facts

RP(0,n,argv[

®

] != NULL)

RP(0,n,argv[®

] != NULL)RP(0,j,argv[®] = 0)Slide66

Partial-Initialize

k = 0;

for (i=0;i != n; i++)

if (X[i] >= 0)

{Z[k] = i;k++;}for (j=0;j != k; j++)

assert (X[Z[j]] >= 0);

Relevant Facts

RP(0, k, X[Z[

®]] = 0)

RP(j, k, X[Z[®]] = 0)Slide67

Producer-Consumer

head=0;tail=0;

while(1){ if(?){

//produce

buf[head]=data[head]; prod_ctr++; head++; } else {

//consume

if (head!=tail)

assert(buf[tail]==data[head]);

cons_ctr++; tail++ }}

Relevant FactsRP(

tail,head,buf[®]=data[®])Slide68

Results

ProgramTime

PredicatesIterations

initialize

1s187vararg

2s

14

8

copy4s2911copy-prop10s

3817find2s

2012partition8s3714partial-init

5s3212producer45s3941insert

90s7436

scull9s

36

14Slide69

Plan

Motivation

Abstractions for Aggregates: RP

Algorithm for Inferring RPBuilding Scoped Proofs using RPPreliminary ResultsRelated Work and DiscussionSlide70

Related Work

Recursively defined predicates: Nelson [POPL 81]

Eager Shape and Data analyses:Based on Abstract InterpretationTVLA, Separation Logic

Recent Examples:Gopan-Reps-

Sagiv [POPL 05]Beyer-Henzinger-Majumdar-Rybalchenko [PLDI 07]Less eager, using property-derived

Path Programs

Template Invariants

: Bradley-Manna-

Sipma [VMCAI 06]Slide71

Discussion: Benefits

Lazy:

Fewer, relevant facts

tailored to program and property

Extensible:

J

ust

add axioms

Avoids abstract transformers/transfer functions

Plays well with other theories: EUF, Arithmetic, …Bi-directional: Trace-based, information flow forwards/backwardsFuture operations = disjunctions/case-splitsSlide72

Discussion: Drawbacks

Lazy:

Many proofs: “right” proof

!

“right” facts

Short counterexamples yield “wrong” facts

Delay convergence, state-space explosion

e.g. insertion-sort

Future work: Bias solver to find “better” proofs

Proofs that refute multiple paths

Slide73

Conclusions

Techniques for lazy reasoning about data:New abstraction: Range PredicatesInferring RP: Scoped proofs of infeasibility

Result: Lazy (CEGAR) verification Data-sensitive

propertiesArray manipulating programsSlide74

?