Proving and inferring invariants David Monniaux CNRS / VERIMAG - PowerPoint PPT Presentation

Proving and inferring invariants David Monniaux CNRS / VERIMAG Grenoble, France December 13, 2013 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 1 / 54

Grenoble David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 2 / 54

VERIMAG VERIMAG is a joint research laboratory of CNRS, Universit´ e Joseph Fourier (Grenoble-1) and Grenoble-INP David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 3 / 54

Plan Safety properties 1 Inductive invariants 2 Policy iteration 3 Min-policy iteration Max-policy iteration Implicit graphs Unknown template shape 4 Conclusion 5 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 4 / 54

Safety properties Proving properties of programs : safety : the program never enters an undesirable state (crash, variable too large for specification, assertion violation. . . ) liveness : the program progresses (no entering into deadlocks or neverending loops) David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 5 / 54

Safety properties Proving properties of programs : safety : the program never enters an undesirable state (crash, variable too large for specification, assertion violation. . . ) liveness : the program progresses (no entering into deadlocks or neverending loops) In this talk, focus on safety (liveness often uses safety properties). David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 5 / 54

Proofs on programs A program written in a real programmming language ⇓ Its semantics : its “meaning” in mathematical terms David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 6 / 54

Proofs on programs A program written in a real programmming language ⇓ Its semantics : its “meaning” in mathematical terms For real languages (C, C++, PHP. . . ), very difficult and fraught with errors. We’ll bravely assume the problem solved and suppose a toy language with well-defined mathematical semantics. David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 6 / 54

Properties to prove A property in natural language (e.g. “the program sorts the array”) ⇓ A mathematical property (e.g. definition of the total order on array elements, the output is sorted, it is a permutation of the input. . . ) David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 7 / 54

Properties to prove A property in natural language (e.g. “the program sorts the array”) ⇓ A mathematical property (e.g. definition of the total order on array elements, the output is sorted, it is a permutation of the input. . . ) Again, fraught with errors. We’ll bravely assume mathematically defined properties. David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 7 / 54

The setting A set C of control points : instructions heads of control blocks lines of program Memory state as a vector of variables in S (can be Z n (or Q n , or B m × Q n where B = { 0 , 1 } Booleans) For i , j ∈ C , a transition relation τ i , j ⊆ S × S (often expressed with x , y , . . . variables before and x ′ , y ′ , . . . after) A starting state q 0 ∈ C and a “bad” state q B ∈ C . David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 8 / 54

Concrete example j = 0; for ( int i=0; i<100; i++) { j = j+2; } i ≥ 100 i ′ = 0 i ′ = i j ′ = 0 j ′ = j q 0 q 1 q 2 i < 100 i ′ = i + 1 j ′ = j + 2 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 9 / 54

Concrete example with an assertion j = 0; for ( int i=0; i<100; i++) { j = j+2; } assert(j < 210); i ′ = i i ≥ 100 i ′ = 0 i ′ = i j ′ = j j ′ = 0 j ′ = j j < 210 q 0 q 1 q 2 q 3 i ′ = i j ′ = j q B j ≥ 210 i < 100 i ′ = i + 1 j ′ = j + 2 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 10 / 54

Proving safety Whether q B is reachable. . . David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 11 / 54

Proving safety Whether q B is reachable. . . Is an undecidable problem ( halting problem ) David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 11 / 54

Plan Safety properties 1 Inductive invariants 2 Policy iteration 3 Min-policy iteration Max-policy iteration Implicit graphs Unknown template shape 4 Conclusion 5 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 12 / 54

Floyd-Hoare-like proofs (Ideas dating back to at least Robert Floyd and C.A.R Hoare, late 1960s, and even to Turing): Adorn each state q i in the automaton with a formula φ i Show that these formulas are inductive : if φ i ( x ) and τ i , j ( x , x ′ ) then φ j ( x ) Check that the formula φ 0 for q 0 (initial state) is “true” Check that the formula φ B for q B (bad state) is “false” David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 13 / 54

Floyd-Hoare-like proofs (Ideas dating back to at least Robert Floyd and C.A.R Hoare, late 1960s, and even to Turing): Adorn each state q i in the automaton with a formula φ i Show that these formulas are inductive : if φ i ( x ) and τ i , j ( x , x ′ ) then φ j ( x ) Check that the formula φ 0 for q 0 (initial state) is “true” Check that the formula φ B for q B (bad state) is “false” By induction on the length of the computation, the system state ( c , x ) ∈ S × S can never exit the φ i “invariant”: For any reachable ( c , x ), x satifies φ c . David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 13 / 54

Direct induction does not necessarily work Program initialization: − 1 ≤ x ≤ 1 ∧ y = 0 Operation: ( x ′ , y ′ ) = rotate (( x , y ) , 45) − 1 ≤ x ≤ 1 ∧ − 1 ≤ y ≤ 1 is always true. . . David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 14 / 54

Direct induction does not necessarily work Program initialization: − 1 ≤ x ≤ 1 ∧ y = 0 Operation: ( x ′ , y ′ ) = rotate (( x , y ) , 45) − 1 ≤ x ≤ 1 ∧ − 1 ≤ y ≤ 1 is always true. . . But not by induction! Need some stronger inductive property e.g. x 2 + y 2 ≤ 1. David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 14 / 54

With invariants j = 0; for ( int i=0; i<100; i++) { j = j+2; } assert(j < 210); i ′ = i i ≥ 100 i ′ = 0 i ′ = i j ′ = j j ′ = 0 j ′ = j j < 210 i = j i = 100 true true j = 200 i ≤ 100 i ′ = i j ′ = j i < 100 false i ′ = i + 1 j ≥ 210 j ′ = j + 2 David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 15 / 54

Checking inductive invariants A tool requires the user to provide invariants, and checks that they are inductive. Possible if the invariants φ i and the transition relations τ i , j are within a decidable theory : Check that φ i ∧ τ i , j ∧ ¬ φ j is unsatisfiable for all i , j . Various degrees of automation Tools : Frama-C, Why, B-Method, Frama-C. . . David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 16 / 54

Inferring inductive invariants More ambitious: complete automation! The problem: exhibit φ c at all control state c ∈ C so that the φ c are inductive and φ 0 is “true” and φ B is “false” But what is φ c ? An arbitrary first-order formula? David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 17 / 54

Abstract domains So as to automatize the task: look for φ c in a particular class (or domain ) of properties: e.g. propositional formulas over the Boolean variables conjunctions of linear inequalities over rational/integer variables ( convex polyhedra ) intervals over rational/integer variables David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 18 / 54

Example of an inductive polyhedron David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 19 / 54

Abstract interpretation in convex polyhedra j = 0; for ( int i=0; i<100; i++) { j = j+2; } David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 20 / 54

Abstract interpretation in convex polyhedra j = 0; for ( int i=0; i<100; i++) { j = j+2; } David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 20 / 54

Abstract interpretation in convex polyhedra j = 0; for ( int i=0; i<100; i++) { j = j+2; } David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 20 / 54

Abstract interpretation in convex polyhedra j = 0; for ( int i=0; i<100; i++) { j = j+2; } David Monniaux (CNRS / VERIMAG) Proving and inferring invariants December 13, 2013 20 / 54