Nested Interpolants Matthias Heizmann Jochen Hoenicke Andreas Podelski University of Freiburg, Germany POPL 2010
Result Interpolant-based software model checking for recursive programs ◮ avoid construction of an abstract program ◮ Hoare logic � nested words
Software model checking Thomas Ball, Sriram K. Rajamani: The SLAM project: debugging system software via static analysis. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Gr´ egoire Sutre Lazy abstraction. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Kenneth L. McMillan Abstractions from proofs. (POPL 2004) theorem model proving checking program abstract program invariant
Software model checking Thomas Ball, Sriram K. Rajamani: The SLAM project: debugging system software via static analysis. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Gr´ egoire Sutre Lazy abstraction. (POPL 2002) Thomas A. Henzinger, Ranjit Jhala, Rupak Majumdar, Kenneth L. McMillan Abstractions from proofs. (POPL 2004) theorem model proving checking program abstract program invariant Bottleneck: Construction of abstract program
Recent approaches: Avoid construction of abstract program Franjo Ivancic, Ilya Shlyakhter, Aarti Gupta, Malay K. Ganai Model checking C programs using F-SOFT (ICCD 2005) Kenneth L. McMillan Lazy abstraction with interpolants (CAV 2006) Nels Beckman, Aditya V. Nori, Sriram K. Rajamani, Robert J. Simmons Proofs from tests (ISSTA 2008) Bhargav S. Gulavani, Supratik Chakraborty, Aditya V. Nori, Sriram K. Rajamani Automatically refining abstract interpretations (TACAS 2008)
One idea: Use interpolants to avoid construction of the abstract program theorem model proving checking program abstract program invariant interpolating theorem prover
One idea: Use interpolants to avoid construction of the abstract program theorem model proving checking program abstract program invariant interpolating theorem prover Ranjit Jhala, Kenneth L. McMillan A practical and complete approach to predicate refinement (TACAS 2006) Kenneth L. McMillan Lazy abstraction with interpolants (CAV 2006) Quantified invariant generation using an interpolating saturation prover (TACAS 2008) Open: Interpolants in interprocedural analysis
Interprocedural static analysis - motivation Recursive Programs?
Interprocedural static analysis - motivation Modularity! Recursive Programs?
Interprocedural static analysis - motivation Modularity! Recursive Programs? Interprocedural analysis, a classical topic in programming languages Micha Sharir, Amir Pnueli Two approaches to interprocedural data flow analysis (1981) Thomas W. Reps, Susan Horwitz, Shmuel Sagiv Precise interprocedural dataflow analysis via graph reachability (POPL 1995) Shaz Qadeer, Sriram K. Rajamani, Jakob Rehof Summarizing procedures in concurrent programs (POPL 2004)
Interpolants Interpolant - for a proof Proof A ⇒ B Given: A ⇒ I ⇒ B . Interpolation: ... automatically generated by SMT solver (Craig interpolation)
Interpolants Interpolant - for a proof Proof A ⇒ B Given: A ⇒ I ⇒ B . Interpolation: ... automatically generated by SMT solver (Craig interpolation) Interpolant - for an execution traces Infeasible trace st 1 . . . st i st i +1 . . . st n Given: Interpolation: post ( true , st 1 . . . st i ) ⊆ I ⊆ wp ( st i +1 . . . st n , false ) ... can be new formula, not contained in program
Inductive interpolants Construct sequence of interpolants I 0 . . . I n inductively post ( I i , st i ) ⊆ I i +1 suitable Hoare annotation to prove infeasibility of program slice
Inductive interpolants Construct sequence of interpolants I 0 . . . I n inductively post ( I i , st i ) ⊆ I i +1 suitable Hoare annotation to prove infeasibility of program slice What if execution trace contains procedure calls?
Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution?
Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution? ◮ state with a stack? � locality of interpolant is lost
Interpolants for interprocedural analysis What is an interpolant for an interprocedural execution? ◮ state with a stack? � locality of interpolant is lost ◮ only local valuations? � call/return dependency lost, � sequence of interpolants is not a proof
Our gordian knot How can we keep track of the call/return dependency in a sequence of states without a stack?
Nested words Idea: Add call/return dependency explicitly to the word Rajeev Alur Marrying words and trees (PODS 2007) Rajeev Alur, P. Madhusudan Adding nesting structure to words (DLT 2006, J. ACM 56(3) 2009) Rajeev Alur, Swarat Chaudhuri Temporal reasoning for procedural programs (VMCAI 2010)
Nested words Idea: Add call/return dependency explicitly to the word Rajeev Alur Marrying words and trees (PODS 2007) Rajeev Alur, P. Madhusudan Adding nesting structure to words (DLT 2006, J. ACM 56(3) 2009) Rajeev Alur, Swarat Chaudhuri Temporal reasoning for procedural programs (VMCAI 2010)
Nested interpolants What is a sequence of interpolants for an interprocedural execution? Idea: Define sequence interpolants with respect to nested trace
Nested interpolants What is a sequence of interpolants for an interprocedural execution? Idea: Define sequence interpolants with respect to nested trace � � post I i , I k , return ⊆ I i +1
Control flow as nested word automata procedure m(x) returns (res) call m ℓ 0 ℓ 0 : if x>100 x<=100 ℓ 2 ℓ 1 : res:=x-10 x>100 else x m :=x+11 call m ℓ 3 x m := x+11 ℓ 2 : ℓ 4 ℓ 1 ℓ 3 : call m x m :=res m return m ↑ ℓ 3 ℓ 5 x m := res m ℓ 4 : res:=x-10 call m ℓ 5 : ℓ 6 res:=res m ℓ 6 : res := res m ℓ 7 return m ↑ ℓ 5 x ≤ 101 ∧ res � = 91 ℓ 7 : assert (x<=101 -> res=91) return m ℓ err McCarthy 91 function nested word automaton
Floyd-Hoare proof as nested word automata procedure m(x) returns (res) call m {⊤} ⊤ ℓ 0 : if x>100 x<=100 { x ≥ 101 } x ≤ 100 ℓ 1 : res:=x-10 x>100 else x m :=x+11 call m { x ≤ 100 } x m ≤ 111 x m := x+11 ℓ 2 : { x m ≤ 111 } res m ≤ 101 x ≥ 101 ℓ 3 : call m x m :=res m return m ↑ x m ≤ 111 { res m ≤ 101 } x m ≤ 101 x m := res m ℓ 4 : { x m ≤ 101 } res:=x-10 call m ℓ 5 : res m = 91 res:=res m { res m = 91 } ℓ 6 : res := res m res = 91 ∨ x ≥ 101 ∧ res = x − 10 { res = 91 ∨ ( x ≥ 101 ∧ res = x − 10) } return m ↑ x m ≤ 101 ℓ 7 : assert (x<=101 -> res=91) return m McCarthy 91 function nested word automaton
Floyd-Hoare proof as nested word automata procedure m(x) returns (res) call m {⊤} ⊤ ℓ 0 : if x>100 x<=100 { x ≥ 101 } x ≤ 100 ℓ 1 : res:=x-10 x>100 else x m :=x+11 call m { x ≤ 100 } x m ≤ 111 x m := x+11 ℓ 2 : { x m ≤ 111 } res m ≤ 101 x ≥ 101 ℓ 3 : call m x m :=res m return m ↑ x m ≤ 111 { res m ≤ 101 } x m ≤ 101 x m := res m ℓ 4 : { x m ≤ 101 } res:=x-10 call m ℓ 5 : res m = 91 res:=res m { res m = 91 } ℓ 6 : res := res m res = 91 ∨ x ≥ 101 ∧ res = x − 10 { res = 91 ∨ ( x ≥ 101 ∧ res = x − 10) } return m ↑ x m ≤ 101 ℓ 7 : assert (x<=101 -> res=91) return m McCarthy 91 function nested word automaton � x ≤ 100 , x m :=x+11 � e.g. post ⊆ x m ≤ 111
Constructing a proof of correctness Compute sequence of nested interpolants I 0 : ⊤ ϕ 0 : x − 1 ≤ 100 x<=100 I 1 : x ≤ 100 ϕ 1 : x 1 m = x − 1 +11 x m :=x+11 ϕ 2 : x 2 = x 1 call m I 2 : x m ≤ 111 I 3 : ⊤ m ϕ 3 : x 2 > 100 x>100 I 4 : ⊤ ϕ 4 : res 4 = x 2 − 10 res:=x-10 ϕ 5 : res 5 m = res 4 return m I 6 : res m ≤ 101 I 5 : res ≤ x − 10 ϕ 6 : x 6 m = res 5 x m :=res m m ϕ 7 : x 7 = x 6 call m I 7 : x m ≤ 101 I 8 : ⊤ m ϕ 8 : x 7 > 100 x>100 I 9 : x ≥ 101 ϕ 9 : res 9 = x 7 − 10 res:=x-10 return m ϕ 10 : res 10 m = res 9 I 11 : res m =91 I 10 : x ≥ 101 ∧ res = x − 10 ϕ 11 : res 11 = res 10 res:=res m m I 12 : res =91 ϕ 12 : x − 1 ≤ 100 ∧ res 11 � = 91 x ≤ 101 ∧ res � = 91) I 13 : ⊥ infeasible nested trace π SSA of π sequence of interpolants for π
Constructing a proof of correctness Nested interpolant automaton I 0 : ⊤ q 0 x<=100 I 1 : x ≤ 100 x<=100 q 1 x<=100 x m :=x+11 I 2 : x m ≤ 111 I 3 : ⊤ q 2 q 3 call m x>100 I 4 : ⊤ q 4 res:=x-10 I 6 : res m ≤ 101 I 5 : res ≤ x − 10 q 6 return m ↑ q 2 q 5 x m :=res m I 7 : x m ≤ 101 I 8 : ⊤ q 7 q 8 call m x>100 I 9 : x ≥ 101 return m ↑ q 2 q 9 res:=x-10 I 11 : res m =91 I 10 : x ≥ 101 ∧ res = x − 10 q 11 q 10 return m ↑ q 7 res:=res m return m ↑ q 7 I 12 : res =91 q 12 x ≤ 101 ∧ res � = 91) q 13 I 13 : ⊥ nested interpolant automaton sequence of interpolants for π
Recommend
More recommend
