Predicate-Based Model Checking Dirk Beyer LMU Munich, Germany Dirk - PowerPoint PPT Presentation

Predicate-Based Model Checking Dirk Beyer LMU Munich, Germany Dirk Beyer LMU Munich, Germany 1 / 1

Based on: Dirk Beyer, Matthias Dangl, Philipp Wendler: A Unifying View on SMT-Based Software Verification Journal of Automated Reasoning, Volume 60, Issue 3, 2018. https://doi.org/10.1007/s10817-017-9432-6 preprint: online on CPAchecker website under “Documentation” Dirk Beyer LMU Munich, Germany 2 / 1

SMT-based Software Model Checking ◮ Predicate Abstraction ( Blast , CPAchecker , Slam , ...) ◮ Impact ( CPAchecker , Impact , Wolverine , ...) ◮ Bounded Model Checking ( Cbmc , CPAchecker , Esbmc , ...) ◮ k -Induction ( CPAchecker , Esbmc , 2ls , ...) Dirk Beyer LMU Munich, Germany 3 / 1

Base: Adjustable-Block Encoding Originally for predicate abstraction: ◮ Abstraction computation is expensive ◮ Abstraction is not necessary after every transition ◮ Track precise path formula between abstraction states ◮ Reset path formula and compute abstraction formula at abstraction states ◮ Large-Block Encoding: abstraction only at loop heads (hard-coded) ◮ Adjustable-Block Encoding: introduce block operator "blk" to make it configurable Dirk Beyer LMU Munich, Germany 4 / 1

Base: Configurable Program Analysis Configurable Program Analysis (CPA): ◮ Beyer, Henzinger, Théoduloz: [CAV’07] ◮ One single unifying algorithm for all algorithms based on state-space exploration ◮ Configurable components: abstract domain, abstract-successor computation, path sensitivity, ... Dirk Beyer LMU Munich, Germany 5 / 1

Using the CPA Framework ◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains Source Parser & Results Code CFA Builder CPA Algorithm Dirk Beyer LMU Munich, Germany 6 / 1

Using the CPA Framework ◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain Source Parser & Results Code CFA Builder CPA Algorithm Predicate CPA Dirk Beyer LMU Munich, Germany 6 / 1

Using the CPA Framework ◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain ◮ Reuse other CPAs Source Parser & Results Code CFA Builder CPA Algorithm Spec Location Loop-Bound Predicate Spec CPA CPA CPA CPA Dirk Beyer LMU Munich, Germany 6 / 1

Using the CPA Framework ◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain ◮ Reuse other CPAs ◮ Built further algorithms on top that make use of reachability analysis k -induction Algorithm CEGAR Source Parser & Results Algorithm Code CFA Builder CPA Algorithm Spec Location Loop-Bound Predicate Spec CPA CPA CPA CPA Dirk Beyer LMU Munich, Germany 6 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P ( C, E P , [ [ · ] ] P ) Dirk Beyer LMU Munich, Germany 7 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Dirk Beyer LMU Munich, Germany 7 / 1

Predicate CPA: Abstract Domain ◮ Abstract state: ( ψ, ϕ ) ◮ tuple of abstraction formula ψ and path formula ϕ (for ABE) ◮ conjunctions represents state space ◮ abstraction formula can be a BDD or an SMT formula ◮ path formula is always SMT formula and concrete Dirk Beyer LMU Munich, Germany 8 / 1

Predicate CPA: Abstract Domain ◮ Abstract state: ( ψ, ϕ ) ◮ tuple of abstraction formula ψ and path formula ϕ (for ABE) ◮ conjunctions represents state space ◮ abstraction formula can be a BDD or an SMT formula ◮ path formula is always SMT formula and concrete ◮ Precision: set of predicates (per program location) Dirk Beyer LMU Munich, Germany 8 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Abstraction-Formula Representation BDD SMT-based Dirk Beyer LMU Munich, Germany 9 / 1

Predicate CPA: CPA Operators ◮ Transfer relation: ◮ computes strongest post ◮ changes only path formula, new abstract state is ( ψ, ϕ ′ ) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations) Dirk Beyer LMU Munich, Germany 10 / 1

Predicate CPA: CPA Operators ◮ Transfer relation: ◮ computes strongest post ◮ changes only path formula, new abstract state is ( ψ, ϕ ′ ) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations) ◮ Merge operator: ◮ standard for ABE: create disjunctions inside block Dirk Beyer LMU Munich, Germany 10 / 1

Predicate CPA: CPA Operators ◮ Transfer relation: ◮ computes strongest post ◮ changes only path formula, new abstract state is ( ψ, ϕ ′ ) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations) ◮ Merge operator: ◮ standard for ABE: create disjunctions inside block ◮ Stop operator: ◮ standard for ABE: check coverage only at block ends Dirk Beyer LMU Munich, Germany 10 / 1

Predicate CPA: CPA Operators ◮ Transfer relation: ◮ computes strongest post ◮ changes only path formula, new abstract state is ( ψ, ϕ ′ ) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations) ◮ Merge operator: ◮ standard for ABE: create disjunctions inside block ◮ Stop operator: ◮ standard for ABE: check coverage only at block ends ◮ Precision-adjustment operator: ◮ only active at block ends (as determined by blk) ◮ computes abstraction of current abstract state ◮ new abstract state is ( ψ ′ , true ) Dirk Beyer LMU Munich, Germany 10 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Abstraction-Formula Strongest Predicate blk Representation Postcondition Abstraction BDD SMT Theory blk SBE Cartesian SMT-based ABVFP blk l Boolean . . . blk lf blk never QF_UFLIRA Dirk Beyer LMU Munich, Germany 11 / 1

Predicate CPA: Refinement Four steps: 1. Reconstruct ARG path to abstract error state 2. Check feasibility of path 3. Discover abstract facts, e.g., ◮ interpolants ◮ weakest precondition ◮ heuristics 4. Refine abstract model ◮ add predicates to precision, cut ARG or ◮ conjoin interpolants to abstract states, recheck coverage relation Dirk Beyer LMU Munich, Germany 12 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Abstraction-Formula Strongest Refinement Predicate Abstract blk Representation Postcondition Abstraction Facts Strategy BDD SMT Theory blk SBE Cartesian fcover id Interpolants Predicate Path SMT-based ABVFP blk l Boolean fcover Impact Impact Invariants . . . blk lf Unsat Cores Weakest blk never QF_UFLIRA Preconditions Heuristic Predicates Dirk Beyer LMU Munich, Germany 13 / 1

Predicate Abstraction ◮ Predicate Abstraction ◮ [CAV’97, POPL’02, J. ACM’03, POPL’04] ◮ Abstract-interpretation technique ◮ Abstract domain constructed from a set of predicates π ◮ Use CEGAR to add predicates to π (refinement) ◮ Derive new predicates using Craig interpolation ◮ Abstraction formula as BDD Dirk Beyer LMU Munich, Germany 14 / 1

Expressing Predicate Abstraction ◮ Abstraction Formulas: BDDs ◮ Block Size (blk): e.g. blk SBE or blk l or blk lf ◮ Refinement Strategy: add predicates to precision, cut ARG Use CEGAR Algorithm: 1: while true do run CPA Algorithm 2: if target state found then 3: call refine 4: if target state reachable then 5: return false 6: else 7: return true 8: Dirk Beyer LMU Munich, Germany 15 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Abstraction-Formula Strongest Refinement Predicate Abstract blk Representation Postcondition Abstraction Facts Strategy BDD SMT Theory blk SBE Cartesian fcover id Interpolants Predicate Path SMT-based ABVFP blk l Boolean fcover Impact Impact Invariants . . . blk lf Unsat Cores Weakest blk never QF_UFLIRA Preconditions Heuristic Predicates Dirk Beyer LMU Munich, Germany 16 / 1

Example Program start l 2 int main () { 1 unsigned int x = 0; unsigned int x = 0; l 3 2 unsigned int y = 0; unsigned int y = 0; 3 l 4 while ( x < 2) { 4 [x < 2] x++; l 5 5 x++; [!(x != y)] y++; 6 l 6 ( x != y ) { [!(x < 2)] i f y++; 7 ERROR: 1; l 7 return 8 [x != y] } 9 l 8 } 10 l 11 ERROR: return 1; 0; return 11 return 0; } 12 l 12 Dirk Beyer LMU Munich, Germany 17 / 1

Predicate CPA Predicate CPA P D P = merge P stop P prec P Π P � P fcover P refine P ( C, E P , [ [ · ] ] P ) Abstraction-Formula Strongest Refinement Predicate Abstract blk Representation Postcondition Abstraction Facts Strategy BDD SMT Theory blk SBE Cartesian fcover id Interpolants Predicate Path SMT-based ABVFP blk l Boolean fcover Impact Impact Invariants . . . blk lf Unsat Cores Weakest blk never QF_UFLIRA Preconditions Heuristic Predicates Dirk Beyer LMU Munich, Germany 18 / 1