FDCC: a Combined Approach for Solving Constraints over Finite Domains and Arrays ebastien Bardin (1) , Arnaud Gotlieb (2) S´ (1) CEA LIST (Paris, France) (2) INRIA (Rennes, France) - Certus V&V Center, Simula (Oslo, Norway) CPAIOR 2012 Bardin, S., Gotlieb, A. 1/ 19
Overview Goal : an efficient CP(FD) approach for array+FD constraints go beyond standard filtering-based techniques ( element ) motivation = software verification Approach : combine global symbolic deduction mechanisms with local filtering in order to achieve better deductive power than both technique taken in isolation Results : an original “greybox” combination for array+FD constraints ◮ identify which information should be shared ◮ propose ways of taming communication cost a prototype and encouraging experiments (random instances) ◮ greater solving power (beats perfect blackbox combination) ◮ low overhead easy to adapt for any CP(FD) solver (small API) Bardin, S., Gotlieb, A. 2/ 19
Motivations int foo (int a, int b, int c) // precondition(a,b,c) int tmp, result; tmp = a+b; if (tmp <= c) result = tmp; else result = c; return result; // postcondition(a,b,c,result) Find input exercising each program paths “if”-path : ( a , b , c ) | = a + b ≤ c iff foo(a,b,c) goes through if-path “else”-path : ( a , b , c ) | = a + b > c iff foo(a,b,c) goes through else-path Bardin, S., Gotlieb, A. 3/ 19
Motivations int foo (int a, int b, int c) // precondition(a,b,c) int tmp, result; tmp = a+b; if (tmp <= c) result = tmp; else result = c; return result; // postcondition(a,b,c,result) Find input satisfying precondition Φ pre , but not postcondition Ψ post “if”-path Φ pre ( a , b , c ) ∧ a + b ≤ c ∧ ¬ Ψ post ( a , b , c , a + b ) “else”-path Φ pre ( a , b , c ) ∧ a + b > c ∧ ¬ Ψ post ( a , b , c , c ) Bardin, S., Gotlieb, A. 3/ 19
Motivations int foo (int a, int b, int c) // precondition(a,b,c) int tmp, result; tmp = a+b; Applications : if (tmp <= c) test coverage result = tmp; else result = c; bug finding return result; // postcondition(a,b,c,result) Find input satisfying precondition Φ pre , but not postcondition Ψ post “if”-path Φ pre ( a , b , c ) ∧ a + b ≤ c ∧ ¬ Ψ post ( a , b , c , a + b ) “else”-path Φ pre ( a , b , c ) ∧ a + b > c ∧ ¬ Ψ post ( a , b , c , c ) Bardin, S., Gotlieb, A. 3/ 19
Motivations (2) Constraint resolution becomes prominent in formal verification especially software verification Underlies several approaches, either for test generation or invariant computation [abstract model checking, bounded model checking] [symbolic execution, weakest precondition calculus] Verification reduces to solving Verification Conditions (VCs) Bardin, S., Gotlieb, A. 4/ 19
Motivations (2) Constraint resolution becomes prominent in formal verification especially software verification Underlies several approaches, either for test generation or invariant computation [abstract model checking, bounded model checking] [symbolic execution, weakest precondition calculus] Verification reduces to solving Verification Conditions (VCs) We consider quantifier-free conjunctive fragments interesting by themselves [symbolic execution, test data generation] basic block of solvers handling disjunctions and quantifications Bardin, S., Gotlieb, A. 4/ 19
CP(FD) and Verification Most verification techniques are based on SMT Yet, CP(FD) is a natural and interesting alternative since basic data types naturally range over finite domains Potentially interesting for bounded (non-linear) integer arithmetic modular arithmetic [Gotlieb-Leconte-Marre 10] bitvectors [Bardin-Herrmann-Perroud 10] floating-point arithmetic [Botella-Gotlieb-Michel 06] A few CP-based verification tools exist [+ encouraging case-studies] Inka [Gotlieb-Botella-Rueher 00] , GATeL [Marre-Blanc 05] Osmose [Bardin-Herrmann 08] , Jaut [Charreteur-Botella-Gotlieb 09] Bardin, S., Gotlieb, A. 5/ 19
CP(FD) and Verification Most verification techniques are based on SMT Yet, CP(FD) is a natural and interesting alternative since basic data types naturally range over finite domains Potentially interesting for bounded (non-linear) integer arithmetic modular arithmetic [Gotlieb-Leconte-Marre 10] bitvectors [Bardin-Herrmann-Perroud 10] floating-point arithmetic [Botella-Gotlieb-Michel 06] A few CP-based verification tools exist [+ encouraging case-studies] Inka [Gotlieb-Botella-Rueher 00] , GATeL [Marre-Blanc 05] Osmose [Bardin-Herrmann 08] , Jaut [Charreteur-Botella-Gotlieb 09] But CP(FD) lacks an efficient handling of array constraints Bardin, S., Gotlieb, A. 5/ 19
The theory of arrays The standard theory of arrays is defined by three sorts : arrays A , elements of arrays E , indexes I function select ( T , i ) : A × I �→ E function store ( T , i , e ) : A × I × E �→ A = and � = over E and I Semantics (read-over-write) (FC) i = j − → select ( T , i ) = select ( T , j ) (RoW-1) i = j − → select ( store ( T , i , e ) , j ) = e (RoW-2) i � = j − → select ( store ( T , i , e ) , j ) = select ( T , j ) Bardin, S., Gotlieb, A. 6/ 19
The theory of arrays (2) Why does array theory matter so much in verification ? for modelling arrays and vectors [of course !] basis for more advanced containers ◮ maps, hash tables ◮ memory heap A few remarks about the theory no constraint on array size or domains of indexes / elements [need to combine with constraints on E and I ] no equality / disequality between arrays yet, difficult to solve [NP-hard for the ∧ -fragment] Bardin, S., Gotlieb, A. 7/ 19
CP and arrays : local filtering arrays represented by pairs ( index , element ) [explicit arrays of logical variables] constraints on domains of indexes / elements (and size) select : well-known constraint element [Van Hentenryck-Carillon 88, Brand 01] store : more recent work [Charreteur-Botella-Gotlieb 09] Element(ARRAY,I,E) :- ( integer(I)? ARRAY[I] == E, success ; D(E) ← D(E) ∩ � i ∈ D(I) D(ARRAY( i )), D(I) ← { i ∈ D(I) | D(E) ∩ D(ARRAY[i]) � = ∅} , wait(...) ) Bardin, S., Gotlieb, A. 8/ 19
CP and arrays : local filtering arrays represented by pairs ( index , element ) [explicit arrays of logical variables] constraints on domains of indexes / elements (and size) select : well-known constraint element [Van Hentenryck-Carillon 88, Brand 01] store : more recent work [Charreteur-Botella-Gotlieb 09] Update(A,I,E,A’) :- ( integer(I)? A’[I]==E, ∀ k � = I do A’[k]==A[k], success ; D(E) ← D(E) ∩ � i ∈ D(I) D(A’( i )), D(I) ← { i ∈ D(I) | D(E) ∩ D(A’[i]) � = ∅} , ∀ k �∈ D(I) do A’[k] == A[k] ∀ k ∈ D(I) do D(A’[k]) ← D(A’[k]) ∩ (D(A[k]) ∪ D(E)) ... ) Bardin, S., Gotlieb, A. 8/ 19
CP and arrays : local filtering (2) Fine for “simple” array constraints either small arrays or very few updates fixed-value indexes (or at least no wide-domain indexes) Insufficient for many array constraints from program verification large arrays, many updates, (wide-range) variable indexes [see formulas from SMT-LIB] Bardin, S., Gotlieb, A. 9/ 19
CP and arrays : local filtering (2) Fine for “simple” array constraints either small arrays or very few updates fixed-value indexes (or at least no wide-domain indexes) Insufficient for many array constraints from program verification large arrays, many updates, (wide-range) variable indexes [see formulas from SMT-LIB] e = select ( T , i ) ∧ f = select ( T , j ) ∧ e � = f ∧ i = j T array of size 100 Domains : 0..100 × fd : needs labelling [no answer in 60 min in COMET] Bardin, S., Gotlieb, A. 9/ 19
CP and arrays : local filtering (2) Fine for “simple” array constraints either small arrays or very few updates fixed-value indexes (or at least no wide-domain indexes) Insufficient for many array constraints from program verification large arrays, many updates, (wide-range) variable indexes [see formulas from SMT-LIB] e = select ( T , i ) ∧ f = select ( T , j ) ∧ e � = f ∧ i = j T array of size 100 Domains : 0..100 × fd : needs labelling [no answer in 60 min in COMET] Bardin, S., Gotlieb, A. 9/ 19
CP and arrays : local filtering (2) Fine for “simple” array constraints either small arrays or very few updates fixed-value indexes (or at least no wide-domain indexes) Insufficient for many array constraints from program verification large arrays, many updates, (wide-range) variable indexes [see formulas from SMT-LIB] i ∈ 1 .. 5 ∧ j ∈ 6 .. 10 ∧ a � = select ( store ( store ( T , j , a ) , i , b ) , j ) × fd : needs labelling, cannot established select ( store ( T , j , a ) , j ) = a Bardin, S., Gotlieb, A. 9/ 19
CP and arrays : local filtering (2) Fine for “simple” array constraints either small arrays or very few updates fixed-value indexes (or at least no wide-domain indexes) Insufficient for many array constraints from program verification large arrays, many updates, (wide-range) variable indexes [see formulas from SMT-LIB] i ∈ 1 .. 5 ∧ j ∈ 6 .. 10 ∧ a � = select ( store ( store ( T , j , a ) , i , b ) , j ) × fd : needs labelling, cannot established select ( store ( T , j , a ) , j ) = a Bardin, S., Gotlieb, A. 9/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Our approach Bardin, S., Gotlieb, A. 10/ 19
Recommend
More recommend
