Decision Procedures and Verifjcation NAIL094 Petr Kuera Charles - PowerPoint PPT Presentation

An Example Program 15 if (data[i] == cookie) 12 i = i + 1; 13 else 14 Process(data[i]); } for (; i < next; i = i + 1) { 16 } 17 } Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 11 10 1 5 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) { i = i + 1; 6 int next; 7 next = data[i]; 8 if (!(i < next && next < N)) return; 9 8 / 46

An Example Program } 12 i = i + 1; 13 else 14 Process(data[i]); 15 16 11 } 17 } Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 8 / 46 if (data[i] == cookie) for (; i < next; i = i + 1) { 1 5 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) { 10 6 int next; 7 next = data[i]; 8 if (!(i < next && next < N)) return; 9 i = i + 1; N denotes the size of array data

An Example Program } i = i + 1; 13 else 14 Process(data[i]); 15 } 16 17 if (data[i] == cookie) } Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 8 / 46 N denotes the size of array data We want to check that there is no access out of bounds of 12 11 1 { void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 6 for (; i < next; i = i + 1) { int next; 7 next = data[i]; 8 if (!(i < next && next < N)) return; 9 i = i + 1; 10 the array data

Notation Assertion a program instruction which checks a given condition and 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) inputs the condition of the assertion evaluates to true Verifying an assertion means proving that for all aborts if the condition is not satisfjed verifjcation of properties Execution path a (possibly partial) sequence of program instructions automatic test generation, detection of dead code, Symbolic simulation uses symbolic representation of traces (difgerent inputs) Many difgerent traces can correspond to a single path execution path Execution trace a sequence of states that are observed along an executed during an execution of a program 9 / 46

Notation Assertion a program instruction which checks a given condition and 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) inputs the condition of the assertion evaluates to true Verifying an assertion means proving that for all aborts if the condition is not satisfjed verifjcation of properties Execution path a (possibly partial) sequence of program instructions automatic test generation, detection of dead code, Symbolic simulation uses symbolic representation of traces (difgerent inputs) Many difgerent traces can correspond to a single path execution path Execution trace a sequence of states that are observed along an executed during an execution of a program 9 / 46

Notation Assertion a program instruction which checks a given condition and 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) inputs the condition of the assertion evaluates to true Verifying an assertion means proving that for all aborts if the condition is not satisfjed verifjcation of properties Execution path a (possibly partial) sequence of program instructions automatic test generation, detection of dead code, Symbolic simulation uses symbolic representation of traces (difgerent inputs) Many difgerent traces can correspond to a single path execution path Execution trace a sequence of states that are observed along an executed during an execution of a program 9 / 46

Notation Assertion a program instruction which checks a given condition and 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) inputs the condition of the assertion evaluates to true Verifying an assertion means proving that for all aborts if the condition is not satisfjed verifjcation of properties Execution path a (possibly partial) sequence of program instructions automatic test generation, detection of dead code, Symbolic simulation uses symbolic representation of traces (difgerent inputs) Many difgerent traces can correspond to a single path execution path Execution trace a sequence of states that are observed along an executed during an execution of a program 9 / 46

Checking Feasibility of a Single Path data[i] != cookie; Consider the following path 1 Run the for loop once, take the else branch 3 i = 0; 7 next = data[i]; 8 i < next && next < N 9 i = i + 1; 10 i < next; 11 14 17 Process(data[i]); 2 Exit the while loop in the second iteration on line 10 i = i + 1 10 !(i < next) 7 next = data[i]; 8 !(i < next && next < N) Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) } } 1 8 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 { 6 int next; 7 next = data[i]; if (!(i < next && next < N)) 16 i = i + 1; } 15 Process(data[i]); 14 else 13 12 return; if (data[i] == cookie) 11 for(; i < next; i = i + 1) { 10 i = i + 1; 9 10 / 46

Checking Feasibility of a Single Path data[i] != cookie; Consider the following path 1 Run the for loop once, take the else branch 3 i = 0; 7 next = data[i]; 8 i < next && next < N 9 i = i + 1; 10 i < next; 11 14 17 Process(data[i]); 2 Exit the while loop in the second iteration on line 10 i = i + 1 10 !(i < next) 7 next = data[i]; 8 !(i < next && next < N) Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) } } 1 8 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 { 6 int next; 7 next = data[i]; if (!(i < next && next < N)) 16 i = i + 1; } 15 Process(data[i]); 14 else 13 12 return; if (data[i] == cookie) 11 for(; i < next; i = i + 1) { 10 i = i + 1; 9 10 / 46

Checking Feasibility of a Single Path 11 } Consider the following path 1 Run the for loop once, take the else branch 3 i = 0; 7 next = data[i]; 8 i < next && next < N 9 i = i + 1; 10 i < next; data[i] != cookie; 1 14 Process(data[i]); 2 Exit the while loop in the 10 i = i + 1 10 !(i < next) 7 next = data[i]; 8 !(i < next && next < N) Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 17 } 16 } void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 { 6 int next; 7 next = data[i]; 8 if (!(i < next && next < N)) 12 15 Process(data[i]); 14 else 13 i = i + 1; if (data[i] == cookie) return; 11 for(; i < next; i = i + 1) { 10 i = i + 1; 9 10 / 46 second iteration on line 8

Checking Feasibility of a Single Path Branch 14 Process(data[i]); Function call 10 i = i + 1 Assignment 10 !(i < next) 7 data[i] != cookie; next = data[i]; Assignment 8 !(i < next && next < N) Branch Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) Branch 11 Consider the sequence of instruction along this execution path next = data[i]; Record the branching conditions of the conditional statements Line Instruction or condition Kind 3 i = 0; Assignment 7 Assignment Branch 8 i < next && next < N Branch 9 i = i + 1; Assignment 10 i < next; 11 / 46

Checking Feasibility of a Single Path 7 Process(data[i]); Function call 10 i = i + 1 Assignment 10 !(i < next) Branch next = data[i]; Branch Assignment 8 !(i < next && next < N) Branch Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 11 / 46 Is there an input which would lead to out-of-bounds 14 data[i] != cookie; Consider the sequence of instruction along this execution path next = data[i]; Record the branching conditions of the conditional statements Line Instruction or condition Kind 3 i = 0; Assignment 7 Assignment 11 8 i < next && next < N Branch 9 i = i + 1; Assignment 10 i < next; Branch access to array data along this path?

Static Single Assignment (SSA) Rewrite instructions and conditions into the static single use new version of a variable after each write (assignment) Replace assignments with equalities Form a conjunction of all assignments and branch subformulas For simplicity, we assume that the function call Process(data[i]); does not change the value of data[i] Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 12 / 46 assignment representation timestamped versions of variables — x t represents the value of variable x after t assignments Translate SSA into a logical formula ⇒ path constraint

Static Single Assignment (SSA) Rewrite instructions and conditions into the static single use new version of a variable after each write (assignment) Replace assignments with equalities Form a conjunction of all assignments and branch subformulas For simplicity, we assume that the function call Process(data[i]); does not change the value of data[i] Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 12 / 46 assignment representation timestamped versions of variables — x t represents the value of variable x after t assignments Translate SSA into a logical formula ⇒ path constraint

SSA Form of the Execution Trace 10 Branch 14 Process(data 0 [i 2 ]); Function call 10 Assignment Branch 11 7 Assignment 8 Branch Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) Line data 0 [i 2 ] != cookie 0 ; Branch 8 Instruction or condition Kind 3 Assignment 7 Assignment Branch 9 Assignment 10 13 / 46 i 1 = 0; next 1 = data 0 [i 1 ]; i 1 < next 1 && next 1 < N 0 i 2 = i 1 + 1; i 2 < next 1 ; i 3 = i 2 + 1 !(i 3 < next 1 ) next 2 = data 0 [i 3 ]; !(i 3 < next 2 && next 2 < N 0 )

SSA Formula Process(data 0 [i 2 ]); 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) 14 / 46 data 0 [i 2 ] != cookie 0 ; i 1 = 0 ssa ≔ i 1 = 0; ∧ next 1 = data 0 [ i 1 ] next 1 = data 0 [i 1 ]; ∧ ( i 1 < next 1 ∧ next 1 < N 0 ) i 1 < next 1 && next 1 < N 0 i 2 = i 1 + 1; ∧ i 2 = i 1 + 1 i 2 < next 1 ; ∧ i 2 < next 1 ∧ data 0 [ i 2 ] ≠ cookie 0 i 3 = i 2 + 1 ∧ i 3 = i 2 + 1 !(i 3 < next 1 ) next 2 = data 0 [i 3 ]; ∧ ! ( i 3 < next 1 ) !(i 3 < next 2 && next 2 < N 0 ) ∧ next 2 = data 0 [ i 3 ] ∧ ! ( i 3 < next 2 ∧ next 2 < N 0 )

SSA Formula Process(data 0 [i 2 ]); 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) 14 / 46 data 0 [i 2 ] != cookie 0 ; i 1 = 0 ssa ≔ i 1 = 0; ∧ next 1 = data 0 [ i 1 ] next 1 = data 0 [i 1 ]; ∧ ( i 1 < next 1 ∧ next 1 < N 0 ) i 1 < next 1 && next 1 < N 0 i 2 = i 1 + 1; ∧ i 2 = i 1 + 1 i 2 < next 1 ; ∧ i 2 < next 1 ∧ data 0 [ i 2 ] ≠ cookie 0 i 3 = i 2 + 1 ∧ i 3 = i 2 + 1 !(i 3 < next 1 ) next 2 = data 0 [i 3 ]; ∧ ! ( i 3 < next 1 ) !(i 3 < next 2 && next 2 < N 0 ) ∧ next 2 = data 0 [ i 3 ] ∧ ! ( i 3 < next 2 ∧ next 2 < N 0 ) All evaluations of inputs N 0 , data 0 and cookie 0 satisfying for- mula ssa correspond to a trace for the chosen path

Assertion checking 1 Consider path leading to an assertion 2 Take the path constraint of that path 3 Add negation of the assertion to the path constraint Satisfying assignment corresponds to a trace leading to the assertion with its condition violated Problem of verifying corectness of a path in a program is reduced to checking the satisfjability of a formula Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 15 / 46

Assertion checking 1 Consider path leading to an assertion 2 Take the path constraint of that path 3 Add negation of the assertion to the path constraint Satisfying assignment corresponds to a trace leading to the assertion with its condition violated Problem of verifying corectness of a path in a program is reduced to checking the satisfjability of a formula Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 15 / 46

Assertion checking 1 Consider path leading to an assertion 2 Take the path constraint of that path 3 Add negation of the assertion to the path constraint Satisfying assignment corresponds to a trace leading to the assertion with its condition violated Problem of verifying corectness of a path in a program is reduced to checking the satisfjability of a formula Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 15 / 46

Assertion checking 1 Consider path leading to an assertion 2 Take the path constraint of that path 3 Add negation of the assertion to the path constraint Satisfying assignment corresponds to a trace leading to the assertion with its condition violated Problem of verifying corectness of a path in a program is reduced to checking the satisfjability of a formula Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 15 / 46

Assertion checking 1 Consider path leading to an assertion 2 Take the path constraint of that path 3 Add negation of the assertion to the path constraint Satisfying assignment corresponds to a trace leading to the assertion with its condition violated Problem of verifying corectness of a path in a program is reduced to checking the satisfjability of a formula Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 15 / 46

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Assertions — Simple Example 7 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The assertion is violated and we found a bug We get the following constraint Consider excution path which ... 8 1 next = data[i]; int next; 6 { 5 while (true) 4 int i = 0; 3 { 2 void ReadBlocks(int data[], int cookie) 16 / 46 1 executes the assignment on Line 3 and 2 checks if i is within bounds ssa ≔ i 1 = 0 ∧ ¬( 0 ≤ i 1 ∧ i 1 < N 0 ) Formula ssa can be satisfjed by i 1 ≔ 0 , N 0 ≔ 0

Another Execution Path With an Assertion i = i + 1; Consider the following path 3 i = 0; 7 next = data[i]; 8 i < next && next < N 9 i = i + 1; 10 i < next; 11 data[i] == cookie; 12 10 17 i = i + 1; 10 !(i < next) 7 assert(0 <= i && i < N) Second execution of Line is replaced with an assertion that is within bounds Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) } } 1 8 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 { 6 int next; 7 next = data[i]; if (!(i < next && next < N)) 16 i = i + 1; } 15 Process(data[i]); 14 else 13 12 return; if (data[i] == cookie) 11 for(; i < next; i = i + 1) { 10 i = i + 1; 9 17 / 46

Another Execution Path With an Assertion 11 17 } Consider the following path 3 i = 0; 7 next = data[i]; 8 i < next && next < N 9 i = i + 1; 10 i < next; data[i] == cookie; 1 12 i = i + 1; 10 i = i + 1; 10 !(i < next) 7 assert(0 <= i && i < N) Second execution of within bounds Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) } 16 } 15 void ReadBlocks(int data[], int cookie) 2 { 3 int i = 0; 4 while (true) 5 { 6 int next; 7 next = data[i]; 8 if (!(i < next && next < N)) Process(data[i]); 14 else 13 i = i + 1; 12 if (data[i] == cookie) 11 for(; i < next; i = i + 1) { 10 i = i + 1; 9 return; 17 / 46 Line 7 is replaced with an assertion that i is

Considering Execution Path 10 12 i = i + 1; Assignment 10 i = i + 1; Assignment !(i < next) data[i] == cookie; Branch 7 0 <= i && i < N Assertion Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) Branch 11 Line Assignment Instruction or condition Kind 3 i = 0; Assignment 7 next = data[i]; 8 Branch i < next && next < N Branch 9 i = i + 1; Assignment 10 i < next; 18 / 46

Add Timestamps to Variables Branch 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Assertion 7 Branch 10 Assignment 10 Assignment 12 Branch data 0 [i 2 ] == cookie 0 ; Line 11 19 / 46 10 Instruction or condition Kind 3 Assignment 7 Assignment Branch 8 9 Assignment i 1 = 0; next 1 = data 0 [i 1 ]; i 1 < next 1 && next 1 < N 0 i 2 = i 1 + 1; i 2 < next 1 ; i 3 = i 2 + 1; i 4 = i 3 + 1; !(i 4 < next 1 ) 0 <= i 4 && i 4 < N 0

Write as an SSA Formula Negation of the assertion 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The formula has a model e.g. arrays bit vectors with the theory of a combination of the theory of To check satisfjability, we need 20 / 46 i 1 = 0 ssa ≔ ∧ next 1 = data 0 [ i 1 ] ∧ i 1 < next 1 ∧ next 1 < N 0 ∧ i 2 = i 1 + 1 ∧ i 2 < next 1 ∧ data 0 [ i 2 ] = cookie 0 ∧ i 3 = i 2 + 1; ∧ i 4 = i 3 + 1; ∧ ¬ ( i 4 < next 1 ) ∧ ¬ ( 0 <= i 4 ∧ i 4 < N 0 )

Write as an SSA Formula Negation of the assertion 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) The formula has a model e.g. arrays bit vectors with the theory of a combination of the theory of To check satisfjability, we need 20 / 46 i 1 = 0 ssa ≔ ∧ next 1 = data 0 [ i 1 ] ∧ i 1 < next 1 ∧ next 1 < N 0 ∧ i 2 = i 1 + 1 ∧ i 2 < next 1 i 1 ≔ 0 N 0 ≔ 3 ∧ data 0 [ i 2 ] = cookie 0 i 2 ≔ 1 next 1 ≔ 2 ∧ i 3 = i 2 + 1; i 3 ≔ 2 data 0 ≔ { 2 , 6 , 5 } ∧ i 4 = i 3 + 1; i 4 ≔ 3 cookie 0 ≔ 6 ∧ ¬ ( i 4 < next 1 ) ∧ ¬ ( 0 <= i 4 ∧ i 4 < N 0 )

Write as an SSA Formula Negation of the assertion 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) found another bug. The assertion is violated, we The formula has a model e.g. arrays bit vectors with the theory of a combination of the theory of To check satisfjability, we need 20 / 46 i 1 = 0 ssa ≔ ∧ next 1 = data 0 [ i 1 ] ∧ i 1 < next 1 ∧ next 1 < N 0 ∧ i 2 = i 1 + 1 ∧ i 2 < next 1 i 1 ≔ 0 N 0 ≔ 3 ∧ data 0 [ i 2 ] = cookie 0 i 2 ≔ 1 next 1 ≔ 2 ∧ i 3 = i 2 + 1; i 3 ≔ 2 data 0 ≔ { 2 , 6 , 5 } ∧ i 4 = i 3 + 1; i 4 ≔ 3 cookie 0 ≔ 6 ∧ ¬ ( i 4 < next 1 ) ∧ ¬ ( 0 <= i 4 ∧ i 4 < N 0 )

for bounded program with branches Checking Feasibility of All Paths Number of paths can grow exponentially in the number of branches Instead of considering one path at a time, we can generate SSA The whole program, not just a single path SSA is converted to a formula that encodes all possible paths Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 21 / 46

Checking Feasibility of All Paths Number of paths can grow exponentially in the number of branches Instead of considering one path at a time, we can generate SSA The whole program, not just a single path SSA is converted to a formula that encodes all possible paths Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 21 / 46 for bounded program with branches

Checking Feasibility of All Paths Number of paths can grow exponentially in the number of branches Instead of considering one path at a time, we can generate SSA The whole program, not just a single path SSA is converted to a formula that encodes all possible paths Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 21 / 46 for bounded program with branches

Checking Feasibility of All Paths Number of paths can grow exponentially in the number of branches Instead of considering one path at a time, we can generate SSA The whole program, not just a single path SSA is converted to a formula that encodes all possible paths Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 21 / 46 for bounded program with branches

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

SSA for the Whole Program 6 Satisfying assignment corresponds to one trace (of one path) 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Example: for-loop from ReadBlocks unrolled 2 times Assignment of guard variables determines the branches taken 5 Translate to formula as before Conditional statement checking on the guard variable For variables that has been changed in either branch 3 Identify points where the control-fmow reconverges 2 Assign the condition of each if statement to a new variable 22 / 46 1 Unfold loops k times ( k given by the user) γ (for guard) 4 Add φ -instructions setting the correct values of variables If-then-else operator to represent φ instructions

Unfold the For Loop Twice 13 8 9 if(i<next) { 10 if(data[i]==cookie) 11 i=i+1; 12 else Process(data[i]); 7 14 15 i=i+1; 16 } 17 } Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) i=i+1; 6 Original for loop 6 1 for(; i<next; i=i+1){ 2 if(data[i]==cookie) 3 i=i+1; 4 else 5 Process(data[i]); } Process(data[i]); for loop unfolded twice 1 if(i<next){ 2 if(data[i]==cookie) 3 i=i+1; 4 else 5 23 / 46

SSA for All Paths in a Bounded Program 8 } 17 } for loop unfolded twice 1 2 3 4 5 6 7 9 i=i+1; 10 11 12 13 14 15 16 17 Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 16 SSA for the unfolded loop 15 8 1 if(i<next){ 2 if(data[i]==cookie) 3 i=i+1; 4 else 5 Process(data[i]); 6 14 i=i+1; 7 24 / 46 if(data[i]==cookie) Process(data[i]); 13 else 12 i=i+1; 11 if(i<next) { 10 9 γ 1 = ( i 0 < next 0 ); γ 2 = ( data 0 [ i 0 ] == cookie 0 ); i 1 = i 0 + 1; i 2 = γ 2 ? i 1 : i 0 ; // φ i 3 = i 2 + 1; γ 3 = ( i 3 < next 0 ); γ 4 = ( data 0 [ i 3 ] == cookie 0 ); i 4 = i 3 + 1; i 5 = γ 4 ? i 4 : i 3 ; // φ i 6 = i 5 + 1; i 7 = γ 3 ? i 6 : i 3 ; // φ i 8 = γ 1 ? i 7 : i 0 ; // φ

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Under-Approximation vs Over-Approximation Over-approximation 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) If the over-approximation is safe, the original program is safe Detected bugs can be spurious Considers a superset of possible paths Transformation to loop-free program using non-determinism What we have seen What we will see Can declare program safe only up to given bound If it detects a bug, it is real Considers a subset of possible paths Under-approximation Transformation to a loop-free program by unrolling loops 25 / 46

Over-Approximating Transformation 1 For each loop and each program variable x If x is modifjed by the loop, add a nondeterministic assignment to the beginning of the loop 2 After each loop, add an assumption that the negation of the loop condition holds Assumption a program statement assume(c) that aborts any path that does not satisfy c 3 Replace each while loop with an if statement checking the condition of the while statement Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 26 / 46 x = ∗

Over-Approximating Transformation 1 For each loop and each program variable x If x is modifjed by the loop, add a nondeterministic assignment to the beginning of the loop 2 After each loop, add an assumption that the negation of the loop condition holds Assumption a program statement assume(c) that aborts any path that does not satisfy c 3 Replace each while loop with an if statement checking the condition of the while statement Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 26 / 46 x = ∗

Over-Approximating Transformation 1 For each loop and each program variable x If x is modifjed by the loop, add a nondeterministic assignment to the beginning of the loop 2 After each loop, add an assumption that the negation of the loop condition holds Assumption a program statement assume(c) that aborts any path that does not satisfy c 3 Replace each while loop with an if statement checking the condition of the while statement Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) 26 / 46 x = ∗

Over-Approximating Transformation Example j = i; 5 { 6 i = *; 7 j = *; 8 ++i; 9 10 4 } 11 assume(data[i] == ’\n’) 12 13 assert(i == j); Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) if(data[i] != ’\n’) 3 Original program 6 1 int i = 0; 2 int j = 0; 3 4 while(data[i] != ’\n’) 5 { ++i; int j = 0; 7 j = i; 8 } 9 assert(i == j); Transformed program 1 int i = 0; 2 27 / 46

Over-Approximating Transformation Example 9 SSA form Transformed program 2 3 4 5 6 7 8 10 14 11 12 assume( data 0 [ i 4 ]==’\n’); 13 14 assert( i 4 == j 4 ); Petr Kučera (Charles University) Decision Procedures and Verifjcation 2019/20 (10th lecture) assert(i == j); 1 13 assume(data[i] == ’\n’) 1 int i = 0; 2 int j = 0; 3 4 if(data[i] != ’\n’) 5 { 6 i = *; 7 j = *; 9 12 11 } 10 j = i; 28 / 46 ++i; 8 i 1 = 0; j 1 = 0; γ 1 = ( data 0 [ i 1 ] != ’\n’); // i 2 is unrestricted // j 2 is unrestricted i 3 = i 2 + 1; j 3 = i 3 ; i 4 = γ 1 ? i 3 : i 1 ; // φ j 4 = γ 1 ? j 3 : j 1 ; // φ

Over-Approximating Transformation Example 9 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) SSA formula SSA form 14 13 assume( data 0 [ i 4 ]==’\n’); 12 11 10 assert( i 4 == j 4 ); 29 / 46 8 1 7 6 5 2 4 3 i 1 = 0 ssa ≔ i 1 = 0; ∧ j 1 = 0 j 1 = 0; ∧ γ 1 = ( data 0 [ i 1 ] ≠ ’\n’ ) γ 1 = ( data 0 [ i 1 ] != ’\n’); ∧ i 3 = i 2 + 1 ∧ j 3 = i 3 ∧ i 4 = ( γ 1 ? i 3 ∶ i 1 ) i 3 = i 2 + 1; j 3 = i 3 ; ∧ j 4 = ( γ 1 ? j 3 ∶ j 1 ) i 4 = γ 1 ? i 3 : i 1 ; // φ j 4 = γ 1 ? j 3 : j 1 ; // φ ∧ data 0 [ i 4 ] = ’\n’ ∧ i 4 ≠ j 4

Over-Approximating Transformation Example SSA formula 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) 30 / 46 i 1 = 0 ssa ≔ ∧ j 1 = 0 ∧ γ 1 = ( data 0 [ i 1 ] ≠ ’\n’ ) ∧ i 3 = i 2 + 1 ∧ j 3 = i 3 ∧ i 4 = ( γ 1 ? i 3 ∶ i 1 ) ∧ j 4 = ( γ 1 ? j 3 ∶ j 1 ) ∧ data 0 [ i 4 ] = ’\n’ ∧ i 4 ≠ j 4

Over-Approximating Transformation Example SSA formula 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) 30 / 46 i 1 = 0 ssa ≔ ∧ j 1 = 0 Formula ssa is unsatisfjable ∧ γ 1 = ( data 0 [ i 1 ] ≠ ’\n’ ) ∧ i 3 = i 2 + 1 ∧ j 3 = i 3 ∧ i 4 = ( γ 1 ? i 3 ∶ i 1 ) ∧ j 4 = ( γ 1 ? j 3 ∶ j 1 ) ∧ data 0 [ i 4 ] = ’\n’ ∧ i 4 ≠ j 4

Over-Approximating Transformation Example SSA formula 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) ations arbitrary number of loop iter- The assertion holds for an 30 / 46 i 1 = 0 ssa ≔ ∧ j 1 = 0 Formula ssa is unsatisfjable ∧ γ 1 = ( data 0 [ i 1 ] ≠ ’\n’ ) ∧ i 3 = i 2 + 1 ∧ j 3 = i 3 ∧ i 4 = ( γ 1 ? i 3 ∶ i 1 ) ∧ j 4 = ( γ 1 ? j 3 ∶ j 1 ) ∧ data 0 [ i 4 ] = ’\n’ ∧ i 4 ≠ j 4

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46

Checking Over-Approximation of a Program previous iterations of the loop 2019/20 (10th lecture) Decision Procedures and Verifjcation Petr Kučera (Charles University) Loop invariants Further assumptions and assertions In other cases, the abstraction needs to be refjned Abstraction worked, because the assertion does not depend on the Transformation to SSA/formula as before Program is safe for any number of iterations Formula is unsatisfjable In the example: Assumption translated by conjoining its condition to the formula counter Nondeterministic assignment modelled by incrementing variable 31 / 46