Trace Abstraction Monday, December 14, 2011 Example Our Model of a - PowerPoint PPT Presentation

Trace Abstraction Monday, December 14, 2011

Example – Our Model of a Verification Problem ℓ 0 x:=0 x:=0 ℓ 0 : y:=0 ℓ 1 : ℓ 1 while(nondet) { x++ } ℓ 2 : y:=0 assert x!= -1 ℓ 2 x++ assert y!= -1 Example program P y==-1 x==-1 ℓ err Control flow graph of P

Statements Statement Letter of our alphabet. No further meaning. ℓ 0 In our example: x:=0 � � Σ = x:=0 , y:=0 , x++ , x==-1 , y==-1 ℓ 1 y:=0 ℓ 2 x++ y==-1 x==-1 ℓ err Control flow graph of P

Statements Statement Letter of our alphabet. No further meaning. ℓ 0 In our example: x:=0 � � Σ = x:=0 , y:=0 , x++ , x==-1 , y==-1 ℓ 1 y:=0 ℓ 2 x++ Trace Word over the alphabet of statements. y==-1 x==-1 Example: ℓ err π = y==-1 . x++ . x++ . x:=0 . x==-1 Control flow graph of P

Error Traces Control Automaton A P ℓ 0 Automaton over the set of statements. x:=0 Encodes a verification problem. A P = � LOC , δ, { ℓ init } , { ℓ err }� ℓ 1 y:=0 Error Trace of P ℓ 2 x++ Trace accepted by A P y==-1 x==-1 In our example ℓ err π = x:=0 . y:=0 . x++ . x==-1 is an error trace. Control automaton A P

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Set Theoretic View of Trace Abstraction set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1 x:=0 . x++ . y==-1

Trace Abstraction Definition (Trace Abstraction) A trace abstraction is given by a tuple of automata ( A 1 , . . . , A n ) such that each A i recognizes a subset of infeasible traces, for i = 1 , . . . , n . We say that the trace abstraction ( A 1 , . . . , A n ) does not admit an error trace if A P ∩ A 1 ∩ . . . ∩ A n is empty.

Trace Abstraction Definition (Trace Abstraction) A trace abstraction is given by a tuple of automata ( A 1 , . . . , A n ) such that each A i recognizes a subset of infeasible traces, for i = 1 , . . . , n . We say that the trace abstraction ( A 1 , . . . , A n ) does not admit an error trace if A P ∩ A 1 ∩ . . . ∩ A n is empty. Theorem (Soundness) L ( A P ∩ A 1 ∩ . . . ∩ A n ) = ∅ ⇒ P is correct Theorem (Completeness) If P is correct, there is a trace abstraction ( A 1 , . . . , A n ) such that L ( A P ∩ A 1 ∩ . . . ∩ A n ) = ∅

Example – Exclude an Infeasible Trace A 1 : x:=0 y:=0 x++ x==-1 A P : q 0 q 1 q 2 q 3 q 4 ℓ 0 x:=0 ℓ 1 y:=0 ℓ 2 x++ y==-1 x==-1 ℓ err

Example – Exclude an Infeasible Trace A 1 : x:=0 y:=0 x++ x==-1 A P : q 0 q 1 q 2 q 3 q 4 ℓ 0 . . . . . . . . . q s . . . . . . x:=0 ℓ 1 y:=0 ℓ 2 x++ y==-1 x==-1 ℓ err

Example – Exclude an Infeasible Trace A 1 : x:=0 y:=0 x++ x==-1 A P : q 0 q 1 q 2 q 3 q 4 ℓ 0 . . . . . . . . . q s . . . . . . x:=0 A P ∩ A 1 : ℓ 1 ℓ 0 q 0 x:=0 y:=0 ℓ err q 4 ℓ 1 q 1 ℓ 2 x++ x==-1 y:=0 x++ x++ ℓ 2 q 2 ℓ 2 q 3 ℓ 2 qs x++ y==-1 x==-1 y==-1 , x==-1 y==-1 ℓ err y==-1 , x==-1 ℓ err qs

Control flow as finite automaton ℓ 0 ℓ 0 : x:=0 x:=0 ℓ 1 ℓ 1 : y:=0 y:=0 ℓ 2 : while(nondet) { x++ } ℓ 2 x++ assert x!= -1 y==-1 x==-1 assert y!= -1 ℓ err Example program P Control flow graph of P

Floyd-Hoare proof as finite automaton true {⊤} ℓ 0 : x:=0 x:=0 { x ≥ 0 } x ≥ 0 ℓ 1 : y:=0 y:=0 { x ≥ 0 ∧ y = 0 } ℓ 2 : while(nondet) { x++ } x ≥ 0 ∧ y =0 x++ assert x!= -1 y==-1 x==-1 assert y!= -1 false Example program P Control flow graph of P

Floyd-Hoare proof as finite automaton true ℓ 0 : x:=0 x:=0 x ≥ 0 ℓ 1 : y:=0 y:=0 ℓ 2 : while(nondet) { x++ } x ≥ 0 ∧ y =0 x++ assert x!= -1 y==-1 x==-1 assert y!= -1 false Example program P Control flow graph of P Observation: Every transition is related to a Hoare triple! , y:=0 , ) ∈ δ post ( x ≥ 0 , y:=0 ) ⊆ x ≥ 0 ∧ y =0 e.g. (

Interpolant Automata Given: Sequence of predicates I = I 0 , I 1 , . . . , I n Definition (Interpolant Automaton A I ) A I = � Q I , δ I , Q init I , Q fin I � Q I = { q 0 , . . . , q n } ( q i , st , q j ) ∈ δ I implies post ( st , I i ) ⊆ I j q i ∈ Q init implies I i = true q i ∈ Q fin implies I i = false

Interpolant Automata Given: Sequence of predicates I = I 0 , I 1 , . . . , I n Definition (Interpolant Automaton A I ) A I = � Q I , δ I , Q init I , Q fin I � Q I = { q 0 , . . . , q n } ( q i , st , q j ) ∈ δ I implies post ( st , I i ) ⊆ I j q i ∈ Q init implies I i = true q i ∈ Q fin implies I i = false Theorem An interpolant automaton A I recognizes a subset of infeasible traces. L ( A I ) ⊆ Infeasible

Example – Refinement Using Interpolant Automata set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces x:=0 . y:=0 . x++ . x==-1

Example – Refinement Using Interpolant Automata set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces L ( A 1 ) y:=0 A 1 x:=0 . y:=0 . x++ . x==-1 q 0 q 1 q 2 x:=0 x==-1 x++

Example – Refinement Using Interpolant Automata set of all traces Σ ∗ traces respecting the control flow of P L ( A P ) Feasible Traces Error Traces L ( A 1 ) x:=0 . y:=0 . x++ . y==-1

Example – Refinement Using Interpolant Automata set of all traces Σ ∗ traces respecting the control flow of P L ( A 2 ) L ( A P ) Feasible Traces Error Traces L ( A 1 ) A 2 x:=0 . y:=0 . x++ . y==-1 q 0 q 1 q 2 y:=0 x==-1 x:=0 x++

CEGAR for Trace Abstraction annotated program P return trace automaton A n +1 such that n := 0 π ∈ L ( A n +1 ) and L ( A n +1 ) ⊆ I NFEASIBLE n := n + 1 yes L ( A P ∩ A 1 ∩ . . . ∩ A n ) = ∅ ? π ∈ I NFEASIBLE ? no yes no return error trace π such that π ∈ L ( A P ∩ A 1 ∩ . . . ∩ A n ) P is correct P is incorrect