Automatically Disproving Fair Termination of Higher-Order Functional Programs Keiichi Watanabe , Ryosuke Sato Takeshi Tsukada, Naoki Kobayashi The University of Tokyo September 20 th , 2016 ICFP 2016 at Nara 1
2 Our Goal Automated method for disproving fair-termination of higher-order functional programs cf. Prove Fair-termination [Murase+ POPL16] includes LTL properties Verification of 𝝏 -regular properties can be reduced to that of fair-termination [Vardi APAL91]
3 Outline • Termination & Fair-Termination • Importance of Fair-Termination • Our Method • Implementation and Experiments • Related Work • Conclusion
4 Outline • Termination & Fair-Termination • Importance of Fair-Termination • Our Method • Implementation and Experiments • Related Work • Conclusion
5 Plain Termination Program 𝑄 is terminating ⇔ Every execution eventually terminates main main Terminating Not Terminating
6 Fair-Termination Program 𝑄 is fair-terminating ⇔ Every fair execution eventually terminates An example of fairness in this talk: If A occurs infinitely often, so does B Fair-Terminating Not Fair-Terminating
7 Outline • Termination & Fair-Termination • Importance of Fair-Termination • Our Method • Implementation and Experiments • Related Work • Conclusion
8 Termination assuming Randomness let rand_int () = * int Terminating, assuming let rec rand_pos () = randomness of * int let x = rand_int () in if 0 < x then x else rand_pos () let main = rand_pos ()
9 Termination assuming Randomness let rand_int () = * int Terminating, assuming let rec rand_pos () = randomness of * int let x = rand_int () in if 0 < x then x Q. else rand_pos () How to incorporate randomness with let main = rand_pos () termination verification?
10 Termination assuming Randomness let rand_int () = let r = * int in if 0 < r then ( event B; r) Insert event expressions else ( event A; r) let rec rand_pos () = let x = rand_int () in if 0 < x then x else rand_pos () let main = rand_pos ()
11 Termination assuming Randomness let rand_int () = If * int never returns a positive integer, let r = * int in execution is unfair if 0 < r then A → A → A → A →… ( event B; r) else ( event A; r) let rec rand_pos () = let x = rand_int () in if 0 < x then Termination assuming x else randomness rand_pos () → Fair-termination let main = rand_pos ()
12 Our Goal (Again) Automated method for disproving fair-termination of higher-order functional programs cf. Prove Fair-termination [Murase+ POPL16] includes LTL properties Verification of 𝝏 -regular properties can be reduced to that of fair-termination [Vardi APAL91]
13 Our Goal (Again) Automated method for disproving fair-termination of higher-order functional programs Proving the existence of fair infinite executions includes LTL properties Verification of 𝝏 -regular properties can be reduced to that of fair-termination [Vardi APAL91]
14 Outline • Termination & Fair-Termination • Importance of Fair-Termination • Our Method • Overview of Method • Step 1, Step 2, Step 3 • Properties of Our Method • Implementation and Experiments • Related Work • Conclusion
15 Overview of Method Fairness Functional Constraint Program Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Model Checking Discovery Tree Tree Generating Automaton Program Counterexample Step 2 ： Higher-Order reject Model Checking An extension of a method for accept disproving plain termination Fair infinite executions exist! [Kuwahara+ CAV15]
16 Overview of Method Computation Tree Fairness Functional Fair infinite Constraint Program paths exist Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Model Checking Discovery Tree Tree Generating Automaton Program Counterexample Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
17 Overview of Method Computation Tree Fairness Functional Fair infinite Constraint Program paths exist Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Model Checking Discovery Abstracted Tree Tree Tree Generating Automaton Program Counterexample Accepted by the automaton Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
18 Overview of Method Computation Tree Fairness Functional Fair infinite Constraint Program paths exist Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Sufficient condition Model Checking Discovery Abstracted Tree Tree Tree Generating Automaton Program Counterexample Accepted by the automaton Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
19 Overview of Method Abstracted Tree Fairness Functional Constraint Program Decide whether the automaton Step 1: Reduction to Step 3: accepts the Predicates Predicate Higher-Order abstracted tree Model Checking Discovery Tree Tree Generating Automaton Program Counterexample Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
20 Overview of Method Refine abstraction by Fairness Functional Constraint using counterexamples Program Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Model Checking Discovery Tree Tree Generating Automaton Program Counterexample Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
21 Overview of Method Fairness Functional Constraint Program Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Model Checking Discovery Tree Tree Generating Automaton Program Counterexample Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
22 Overview of Method Computation Tree Fairness Functional Fair infinite Constraint Program paths exist Step 1: Reduction to Step 3: Predicates Predicate Higher-Order Sufficient condition Model Checking Discovery Abstracted Tree Tree Tree Generating Automaton Program Counterexample Accepted by the automaton Step 2 ： Higher-Order reject Model Checking accept Fair infinite executions exist!
23 Two Branching Nodes in Abstracted Trees [Kuwahara+ CAV15] ∃ -node • Represents inherent non-determinism in programs • e.g. random integer, inputs • We should check if there exists a fair infinite branch ∀ -node • Represents non-determinism introduced by abstraction • We should check if every branch is fair and infinite
24 Two Branching Nodes in Abstracted Trees [Kuwahara+ CAV15] 𝑄 Abstract by 𝒚 = 𝟏, 𝟏 < 𝒛 𝐸 let f x = let y = x+1 in let f b x=0 = if 0 < y then if b x=0 then ∀ (B(g true)) event B; g y else else ∀ (B(g true), A(g false)) event A; g y in ∃ (f true, f false) in f * int Tree ( 𝐸 ) Computation tree of 𝑄 * ∃ x=0 ¬ (x=0) ・・・ ・・・ ∀ ∀ if if if if ¬ (0<y) 0<y 0<y B A B A A B B
25 ∃ - node: Inherent Non-Determinism 𝑄 Abstract by 𝒚 = 𝟏, 𝟏 < 𝒛 𝐸 let f x = let y = x+1 in let f b x=0 = if 0 < y then if b x=0 then ∀ (B(g true)) event B; g y else else ∀ (B(g true), A(g false)) event A; g y in ∃ (f true, f false) in f * int merged Tree ( 𝐸 ) Computation tree of 𝑄 ∃ x=-1 * x=0 ¬ (x=0) x=0 ・・・ ・・・ x=-2 x=1 ∀ ∀ if if if if ¬ (0<y) 0<y 0<y B A B A A B B
26 ∃ - node: Inherent Non-Determinism 𝑄 Abstract by 𝒚 = 𝟏, 𝟏 < 𝒛 𝐸 let f x = let y = x+1 in let f b x=0 = if 0 < y then if b x=0 then ∀ (B(g true)) event B; g y else else Check if either branch is ∀ (B(g true), A(g false)) event A; g y in ∃ (f true, f false) in f * int fair and infinite Tree ( 𝐸 ) Computation tree of 𝑄 ∃ x=-1 * x=0 ¬ (x=0) x=0 ・・・ ・・・ x=-2 x=1 ∀ ∀ if if if if ¬ (0<y) 0<y 0<y B A B A A B B
27 Non-Determinism ∀ - node: introduced by Abstraction 𝑄 Abstract by 𝒚 = 𝟏, 𝟏 < 𝒛 𝐸 let f x = let y = x+1 in let f b x=0 = if 0 < y then if b x=0 then ∀ (B(g true)) event B; g y else else ∀ (B(g true), A(g false)) event A; g y in ∃ (f true, f false) in f * int Tree ( 𝐸 ) Computation tree of 𝑄 * ∃ x=0 ¬ (x=0) ・・・ ・・・ else ∀ then ∀ if if if if ¬ (0<y) else 0<y then 0<y B A A B A B B
28 Non-Determinism ∀ - node: introduced by Abstraction 𝑄 Abstract by 𝒚 = 𝟏, 𝟏 < 𝒛 𝐸 let f x = let y = x+1 in let f b x=0 = if 0 < y then if b x=0 then ∀ (B(g true)) event B; g y else else ∀ (B(g true), A(g false)) event A; g y in ∃ (f true, f false) in f * int Check if both branches are Tree ( 𝐸 ) Computation tree of 𝑄 fair and infinite * ∃ x=0 ¬ (x=0) ・・・ ・・・ else ∀ then ∀ if if if if ¬ (0<y) else 0<y then 0<y B A A B A B B
29 Parity Tree Automaton 𝐵 𝐷 If Tree ( 𝐸 ) is accepted by 𝐵 𝐷 , 𝑄 is NOT fair-terminating Tree ( 𝐸 ) is accepted by 𝐵 𝐷 if ∃ • ∃ -node ¬ (x=0) x=0 Some branches have fair infinite paths ∀ ∀ ¬ (0<y) 0<y 0<y • ∀ -node A B B All branches have fair infinite paths
Recommend
More recommend
