Craig Interpolation for Integer Arithmetic, Uninterpreted Functions, and the Theory of Arrays Angelo Brillout 1 Daniel Kroening 2 ome Leroux 3 J´ erˆ ummer 4 Thomas Wahl 2 Philipp R¨ 1 ETH Zurich 2 University of Oxford 3 Laboratoire Bordelais de Recherche en Informatique 4 Uppsala University SVARM, April 2nd, 2011 1 / 25
Motivation: inference of invariants Generic verification problem (“safety”) { pre } while (*) Body { post } Standard approach: loop rule using invariant pre ⇒ φ φ ⇒ post { φ } Body { φ } { pre } while (*) Body { post } How to compute φ automatically? 2 / 25
✦ From intermediate assertions to invariants { pre } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 1 { pre } Body { ψ 1 } { ψ 1 } Body { post } [McMillan, 2003] 3 / 25
From intermediate assertions to invariants { pre } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 1 { pre } Body { ψ 1 } { ψ 1 } Body { post } [ ψ 1 ⇒ pre ] pre is invariant ✦ [McMillan, 2003] 3 / 25
From intermediate assertions to invariants { pre } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 1 { pre } Body { ψ 1 } { ψ 1 } Body { post } [ ψ 1 ⇒ pre ] [otherwise] pre is invariant ✦ [McMillan, 2003] 3 / 25
From intermediate assertions to invariants { pre ∨ ψ 1 } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 2 { pre ∨ ψ 1 } Body { ψ 2 } { ψ 2 } Body { post } [ ψ 1 ⇒ pre ] [otherwise] pre is invariant ✦ [McMillan, 2003] 3 / 25
From intermediate assertions to invariants { pre ∨ ψ 1 } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 2 { pre ∨ ψ 1 } Body { ψ 2 } { ψ 2 } Body { post } [ ψ 2 ⇒ pre ∨ ψ 1 ] [otherwise] pre ∨ ψ 1 is invariant ✦ [McMillan, 2003] 3 / 25
From intermediate assertions to invariants { pre ∨ ψ 1 } Body ; Body { post } ? Bounded model checking problem ✦ Compute intermediate assertion ψ 2 { pre ∨ ψ 1 } Body { ψ 2 } { ψ 2 } Body { post } . . . [ ψ 2 ⇒ pre ∨ ψ 1 ] pre ∨ ψ 1 is invariant ✦ [McMillan, 2003] 3 / 25
❼ ❼ How to compute intermediate assertions? VC generation pre ( s 0 ) { pre } → Body ( s 0 , s 1 ) Body; → Body ( s 1 , s 2 ) Body → post ( s 2 ) { post } 4 / 25
How to compute intermediate assertions? VC generation pre ( s 0 ) { pre } → Body ( s 0 , s 1 ) Body; → Body ( s 1 , s 2 ) Body → post ( s 2 ) { post } Theorem (Craig, 1957) Suppose A ⇒ C is a valid implication. Then there is a formula I (an interpolant) such that ❼ A ⇒ I and I ⇒ C are valid, ❼ every non-logical symbol of I occurs in both A and C. 4 / 25
How to compute intermediate assertions? VC generation A ( s 0 , s 1 ) { pre } pre ( s 0 ) → Body ( s 0 , s 1 ) Body; I ( s 1 ) → Body ( s 1 , s 2 ) Body { post } → post ( s 2 ) C ( s 1 , s 2 ) Theorem (Craig, 1957) Suppose A ⇒ C is a valid implication. Then there is a formula I (an interpolant) such that ❼ A ⇒ I and I ⇒ C are valid, ❼ every non-logical symbol of I occurs in both A and C. 4 / 25
How to compute intermediate assertions? VC generation A ( s 0 , s 1 ) { pre } pre ( s 0 ) → Body ( s 0 , s 1 ) Body; I ( s 1 ) → Body ( s 1 , s 2 ) Body { post } → post ( s 2 ) C ( s 1 , s 2 ) Theorem (Craig, 1957) Suppose A ⇒ C is a valid implication. Then there is a formula I (an interpolant) such that ❼ A ⇒ I and I ⇒ C are valid, ❼ every non-logical symbol of I occurs in both A and C. Interpolant I can be computed from proofs of A ⇒ C 4 / 25
Interpolation + theories Interpolation procedures need to support the program logic: i n t a [ ] , i ; max = a [ 0 ] ; f o r ( i = 1; i < n ; ++i ) i f ( a [ i ] > max) max = a [ i ] ; a s s e r t (max > = a [ i / 2 ] ) ; E.g., combined use of linear integer arithmetic and arrays 5 / 25
Theories investigated by us ❼ Quantifier-free Presburger Arithmetic (PA) [IJCAR, 2010] (linear integer arithmetic) [LPAR, 2010] + ❼ Quantifiers (Q) [VERIFY, 2010] [VMCAI, 2011] ❼ Uninterpreted predicates (UP) ❼ Uninterpreted functions (UF) ❼ Arrays (AR) 6 / 25
Theories investigated by us ❼ Quantifier-free Presburger Arithmetic (PA) [IJCAR, 2010] (linear integer arithmetic) [LPAR, 2010] + ❼ Quantifiers (Q) [VERIFY, 2010] [VMCAI, 2011] ❼ Uninterpreted predicates (UP) ❼ Uninterpreted functions (UF) ❼ Arrays (AR) 6 / 25
Interpolation outline Implication A ⇒ C Theorem prover Model Proof of A ⇒ C Proof lifting Interpolating proof of A ⇒ C Craig interpolant A ⇒ I ⇒ C 7 / 25
Interpolation outline Implication A ⇒ C Theorem prover Model Proof of A ⇒ C Proof lifting Interpolating proof of A ⇒ C Craig interpolant A ⇒ I ⇒ C 7 / 25
Underlying calculus for Presburger Arithmetic ❼ Gentzen-style sequent calculus for PA [LPAR, 2008] Calculus rules Possible procedures Linear combination, Omega eq. elimination, Equalities fresh constants Smith decomposition Omega test, Linear combination, Simplex + Gomory cuts Inequalities rounding, ineq. splitting + branch-and-bound Standard Gentzen propositional rules Prop. logic 8 / 25
Interpolation outline QFPA implication A ⇒ C Theorem prover Model Proof of A ⇒ C Proof lifting Interpolating proof of A ⇒ C Craig interpolant A ⇒ I ⇒ C 9 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ 3 ⊢ ∆ 3 Γ 2 ⊢ ∆ 2 Γ 1 ⊢ ∆ 1 . . . . A ⊢ C 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ 3 ⊢ ∆ 3 � Γ 2 ⊢ ∆ 2 annotation of � � Γ 1 ⊢ ∆ 1 � formulae with labels . � . . . A ⊢ C 10 / 25
Basic idea of proof lifting A ⇒ I ⇒ C Interpolation problem: ∗ . . . . Γ 3 ⊢ ∆ 3 � Γ 2 ⊢ ∆ 2 annotation of � � Γ 1 ⊢ ∆ 1 � formulae with labels . . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ 3 ⊢ ∆ 3 Γ 2 ⊢ ∆ 2 � annotation of � � 1 ⊢ ∆ ∗ Γ ∗ � formulae with labels . 1 . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ 3 ⊢ ∆ 3 Γ ∗ 2 ⊢ ∆ ∗ � 2 annotation of � � 1 ⊢ ∆ ∗ Γ ∗ � formulae with labels 1 . � . . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 Γ ∗ 2 ⊢ ∆ ∗ � 2 annotation of � � Γ ∗ 1 ⊢ ∆ ∗ � 1 formulae with labels . � . . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 Γ ∗ 2 ⊢ ∆ ∗ � � 2 annotation of propagation of � � � � Γ ∗ 1 ⊢ ∆ ∗ � � 1 formulae with labels . interpolants � . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 ▸ I 3 Γ ∗ 2 ⊢ ∆ ∗ � � 2 annotation of propagation of � � � � Γ ∗ 1 ⊢ ∆ ∗ � � 1 formulae with labels . interpolants � . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 ▸ I 3 Γ ∗ 2 ⊢ ∆ ∗ 2 ▸ I 2 � � annotation of propagation of � � � � Γ ∗ 1 ⊢ ∆ ∗ � � 1 formulae with labels . interpolants � . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 ▸ I 3 Γ ∗ 2 ⊢ ∆ ∗ 2 ▸ I 2 � � annotation of propagation of � � � � Γ ∗ 1 ⊢ ∆ ∗ 1 ▸ I 1 � � formulae with labels . interpolants � . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R 10 / 25
Basic idea of proof lifting Interpolation problem: A ⇒ I ⇒ C ∗ . . . . Γ ∗ 3 ⊢ ∆ ∗ 3 ▸ I 3 Γ ∗ 2 ⊢ ∆ ∗ 2 ▸ I 2 � � annotation of propagation of � � � � Γ ∗ 1 ⊢ ∆ ∗ 1 ▸ I 1 � � formulae with labels . interpolants � . � . . ⌊ A ⌋ L ⊢ ⌊ C ⌋ R ▸ I 10 / 25
Properties of the interpolating calculus Lemma (Soundness) The annotation at the root of a closed proof is a valid interpolant. Lemma (Completeness) Every proof can be lifted to an interpolating proof. This implies: completeness for PA. Generality Applicable to various procedures: ❼ Simplex + cuts (cf. [Griggio, Le, Sebastiani, 2011]) ❼ Omega test 11 / 25
Properties of the interpolating calculus Lemma (Soundness) The annotation at the root of a closed proof is a valid interpolant. Lemma (Completeness) Every proof can be lifted to an interpolating proof. This implies: completeness for PA. Generality Applicable to various procedures: ❼ Simplex + cuts (cf. [Griggio, Le, Sebastiani, 2011]) ❼ Omega test Can be generalised to further theories . . . 11 / 25
Recommend
More recommend
