Verification of Recursive Methods on Tree-like Data Structures - PowerPoint PPT Presentation

Verification of Recursive Methods on Tree-like Data Structures Jyotirmoy V. Deshmukh E. Allen Emerson { deshmukh,emerson}@cs.utexas.edu University of Texas at Austin Formal Methods in Computer-Aided Design 2009 Verifying Recursive Methods on Trees University of Texas at Austin 1 / 30

Recursive Methods are Everywhere! Data Structure Libraries. File Systems. BDD packages. Netlist Manipulation Routines. Verifying Recursive Methods on Trees University of Texas at Austin 2 / 30

Recursive Method: changeData void changeData (iter) { if (( iter -> next 1 == ∅ ) && ( iter -> next 2 == ∅ )) { incMod3(iter -> data); return; } incMod3 (iter -> data); if ( iter -> next 1 != ∅ ) { changeData (iter -> next 1 ); } incMod3 (iter -> data); if ( iter -> next 2 != ∅ ) { changeData (iter -> next 2 ); } incMod3 (iter -> data); return; } void incMod3 (x) { return (x + 1) mod 3; } Verifying Recursive Methods on Trees University of Texas at Austin 3 / 30

Properties of Interest Sample Pre-Condition Input is a binary tree, data values in { 0 , 1 , 2 } . Sample Post-Condition(s) (A) Output is an acyclic data structure. (B) Output is a binary tree (subsumes (A)). (C) Leaf nodes in Output incremented by one (mod 3). (D) Non-leaf nodes in Output remain unchanged. Verification instance of the Parameterized Reasoning problem. Verifying Recursive Methods on Trees University of Texas at Austin 4 / 30

General Methods and Properties In general, methods could . . . Change links. Add nodes. Delete nodes. For example, specifications could be . . . Sorted-ness in a list. Left key is less than Right key. Both children of every red node are black. All leaves are black. Verifying Recursive Methods on Trees University of Texas at Austin 5 / 30

Outline 1 Scope 2 Method Automata 3 Verification Framework 4 Complexity and Results Verifying Recursive Methods on Trees University of Texas at Austin 6 / 30

Scope Outline Scope 1 Method Automata 2 Verification Framework 3 Complexity and Results 4 Verifying Recursive Methods on Trees University of Texas at Austin 7 / 30

Scope Most General Recursive Method over a Tree... Signature: Arbitrary pointer arguments, data arguments. Pointer/Data value as return value. Body: (in no particular order) Assignments to pointer expressions. Recursive calls. Access to global pointer/data values. Verifying Recursive Methods on Trees University of Texas at Austin 8 / 30

Scope Decidable Fragment An arbitrary recursive method can simulate a Turing Machine. Syntactic restrictions for decidability? Disallow: Global pointer variables. (. . . else method models k -pebble automaton) Pointers arbitrarily far apart. (. . . else method models k -headed automaton) Unbounded destructive changes. (. . . else method models linear bounded automaton) Verifying Recursive Methods on Trees University of Texas at Austin 9 / 30

Scope Decidable Fragment Syntactic restrictions for decidability? Disallow: Global pointer variables. (. . . else method models k -pebble automata) Pointers arbitrarily far apart. (. . . else method models k -headed automata) Unbounded destructive changes. (. . . else method models Linear Bounded Automata) Verifying Recursive Methods on Trees University of Texas at Austin 10 / 30

Scope Syntactic Fragment: Updates within a bounded region Designated pointer argument ‘iterator’ ( iter ). Destructive Update relative to iter ptr = iter , iter -> next j , iter -> next j -> . . . -> next k . ptr->data = d; ptr->next j = ptr’; ptr->next j = new node(d, ptr 1 , ...ptr k ); delete(ptr); Verifying Recursive Methods on Trees University of Texas at Austin 11 / 30

Scope Windows: Model updates within a bounded distance Definition (Window) Finite Encoding for neighborhood of node . Concrete address replaced by “Local” address. a 0x40: 0x60 0x80 a 0: 1 2 c 0x60: 0x60: b 0xa0 ⊥ 0x40 0xc0 c 1: b * ⊥ 2: 0 * Verifying Recursive Methods on Trees University of Texas at Austin 12 / 30

Scope Abstract Tree � T i T i a a b c b c b c a d ⊥ e a d ⊥ e ⊥ a d e ⊥ ⊥ b c ⊥ c ⊥ ⊥ ⊥ b c c ⊥ ⊥ ⊥ Obtain T i from � T i by eliding everything but the root of each window. Verifying Recursive Methods on Trees University of Texas at Austin 13 / 30

Scope Decidable Fragment Syntactic restrictions for decidability? Disallow: Global pointer variables. (. . . else method models k -pebble automata) Pointers arbitrarily far apart. (. . . else method models k -headed automata) Unbounded destructive changes. (. . . else method models Linear Bounded Automata) Verifying Recursive Methods on Trees University of Texas at Austin 14 / 30

Scope Syntactic Fragment: Bounded Destructive Updates Lemma For trees, ≤ 1 recursive invocation/child ⇒ #destructive updates by M bounded. Proof. M can destructively update n : (0) when M first visits n (after invoked from parent of n ), (1) when M returns from 1 st recursive call, . . . (K) when M returns from K th recursive call. ⇒ M destructively updates n at most K + 1 times. K is fixed for given K -ary tree. Verifying Recursive Methods on Trees University of Texas at Austin 15 / 30

Scope Decidable Fragment Syntactic restrictions for decidability? Disallow: Global pointer variables. (. . . else method models k -pebble automata) Pointers arbitrarily far apart. (. . . else method models k -headed automata) Unbounded destructive changes. (. . . else method models Linear Bounded Automata) Verifying Recursive Methods on Trees University of Texas at Austin 16 / 30

Method Automata Outline Scope 1 Method Automata 2 Tail Recursive Methods Non Tail-Recursive Methods Verification Framework 3 Complexity and Results 4 Verifying Recursive Methods on Trees University of Texas at Austin 17 / 30

Method Automata Tail Recursive Methods Template Tail-Recursive Method void foo(iter) { if (cond) { base-du; } recur-du; foo (iter -> next 2 ); foo (iter -> next 1 ); foo (iter -> next 3 ); } Verifying Recursive Methods on Trees University of Texas at Austin 18 / 30

Method Automata Tail Recursive Methods Method Automaton A M A M accepts � T i ◦ � T o iff T o = M ( T i ) . � T c encodes valid actions of M . ( , ) ( , ) ( , ) � T c ( , ) ( , ) ( , ) ( , ) Verifying Recursive Methods on Trees University of Texas at Austin 19 / 30

Method Automata Tail Recursive Methods Method Automaton A M A M accepts � T i ◦ � T o iff T o = M ( T i ) . � T c encodes valid actions of M . ( , ) ( , ) ( , ) � T i ( , ) ( , ) ( , ) ( , ) Verifying Recursive Methods on Trees University of Texas at Austin 19 / 30

Method Automata Tail Recursive Methods Method Automaton A M A M accepts � T i ◦ � T o iff T o = M ( T i ) . � T c encodes valid actions of M . ( , ) ( , ) ( , ) � T o ( , ) ( , ) ( , ) ( , ) Verifying Recursive Methods on Trees University of Texas at Austin 19 / 30

Method Automata Tail Recursive Methods Method Automaton A M A M accepts � T i ◦ � T o iff T o = M ( T i ) . � T c encodes valid actions of M . ( recur-du? ) , ( recur-du? ) , ( recur-du? ) , T c = � � T i ◦ � T o ( base-du? ) , ( base-du? ) , ( base-du? ) , ( base-du? ) , Verifying Recursive Methods on Trees University of Texas at Austin 19 / 30

Method Automata Non Tail-Recursive Methods Template Non Tail-Recursive Method void foo(iter) { if (cond) { base-du; } recur-du[0]; foo (iter -> next 2 ); recur-du[1]; foo (iter -> next 1 ); recur-du[2]; foo (iter -> next 3 ); recur-du[3]; } Verifying Recursive Methods on Trees University of Texas at Austin 20 / 30

Method Automata Non Tail-Recursive Methods Action of M void changeData (iter) { if (( iter -> next 1 == ∅ ) && ( iter -> next 2 == ∅ ) { incMod3(iter -> data); return; } 0 incMod3 (iter -> data); if ( iter -> next 1 != ∅ ) { changeData (iter -> next 1 ); 1 } incMod3 (iter -> data); if ( iter -> next 2 != ∅ ) { 0 2 changeData (iter -> next 2 ); } incMod3 (iter -> data); return; } Verifying Recursive Methods on Trees University of Texas at Austin 21 / 30

Method Automata Non Tail-Recursive Methods Action of M void changeData (iter) { if (( iter -> next 1 == ∅ ) && ( iter -> next 2 == ∅ ) { incMod3(iter -> data); return; } 1 incMod3 (iter -> data); if ( iter -> next 1 != ∅ ) { changeData (iter -> next 1 ); 2 } incMod3 (iter -> data); if ( iter -> next 2 != ∅ ) { 0 2 changeData (iter -> next 2 ); } incMod3 (iter -> data); return; } Verifying Recursive Methods on Trees University of Texas at Austin 21 / 30

Method Automata Non Tail-Recursive Methods Action of M void changeData (iter) { if (( iter -> next 1 == ∅ ) && ( iter -> next 2 == ∅ ) { incMod3(iter -> data); return; } 1 incMod3 (iter -> data); if ( iter -> next 1 != ∅ ) { changeData (iter -> next 1 ); 2 } incMod3 (iter -> data); if ( iter -> next 2 != ∅ ) { 1 2 changeData (iter -> next 2 ); } incMod3 (iter -> data); return; } Verifying Recursive Methods on Trees University of Texas at Austin 21 / 30