Verifying Pointer Programs using Graph Grammars Christina Jansen, - PowerPoint PPT Presentation

Verifying Pointer Programs using Graph Grammars Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll

Overview The Abstract Execution Approach Juggrnaut Abstract State Space Pointer-Program 1 1 l r l r ◮ completeness → LTL Yes or No ∀ x : F ( x = cur ) 1 B ◮ termination Graph Grammar Specification Model Checker 2 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

pos tmp head tail 𝑞𝑠𝑓𝑤 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 𝑜𝑓𝑦𝑢 • • • = pos.prev;} 𝑞𝑠𝑓𝑤 pos pos.prev = tmp; pos.next = pos.prev; = pos.next; tmp while (pos != null ){ tmp := pos.next; 𝑜𝑓𝑦𝑢 The Concrete State Space Heap Modelling & Operational Semantics Linked List Reversal Heap Representation: Doubly-Linked List 3 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

pos tmp 𝑞𝑠𝑓𝑤 tmp := pos.next; 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 • • • = pos.prev;} pos pos.prev = tmp; pos.next = pos.prev; = pos.next; tmp while (pos != null ){ The Concrete State Space Heap Modelling & Operational Semantics Linked List Reversal Heap Representation: Doubly-Linked List head tail 3 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

tmp head tail 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 • • • = pos.prev;} 𝑜𝑓𝑦𝑢 pos pos.prev = tmp; pos.next = pos.prev; = pos.next; tmp while (pos != null ){ tmp := pos.next; 𝑞𝑠𝑓𝑤 The Concrete State Space Heap Modelling & Operational Semantics Linked List Reversal Heap Representation: Doubly-Linked List pos 3 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

head tail = pos.prev;} 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 • • • 𝑞𝑠𝑓𝑤 pos 𝑞𝑠𝑓𝑤 pos.prev = tmp; pos.next = pos.prev; = pos.next; tmp while (pos != null ){ tmp := pos.next; 𝑜𝑓𝑦𝑢 The Concrete State Space Heap Modelling & Operational Semantics Linked List Reversal Heap Representation: Doubly-Linked List pos tmp 3 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

next next next head tail prev prev prev 𝑜𝑓𝑦𝑢 2 𝑞𝑠𝑓𝑤 1 21 1 1 2 𝑞𝑠𝑓𝑤 2 1 1 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 1 2 𝑀 • • • 2 1 2 1 The Abstract State Space Data Abstraction Heap Representation head tail • placeholders: nonterminal (labelled) edges of rank 𝑜 • variables: edges of rank 1 • pointers: terminal (labelled) edges of rank 2 4 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

next next next head tail prev prev prev 𝑜𝑓𝑦𝑢 2 𝑞𝑠𝑓𝑤 1 21 1 1 2 𝑞𝑠𝑓𝑤 2 1 1 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 1 2 𝑀 • • • 2 1 2 1 The Abstract State Space Data Abstraction Heap Representation : Hypergraph head tail • placeholders: nonterminal (labelled) edges of rank 𝑜 • variables: edges of rank 1 • pointers: terminal (labelled) edges of rank 2 4 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

head tail 𝑜𝑓𝑦𝑢 𝑀 1 𝑞𝑠𝑓𝑤 1 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 1 1 2 • • • 2 1 2 1 2 1 2 1 2 21 The Abstract State Space Data Abstraction Heap Representation : Hypergraph next next next head tail prev prev prev • placeholders: nonterminal (labelled) edges of rank 𝑜 • variables: edges of rank 1 • pointers: terminal (labelled) edges of rank 2 4 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

next next next head tail prev prev prev 1 1 𝑜 2 1 2 1 2 𝑞 2 2 𝑀 1 1 𝑀 → 1 2 𝑜𝑓𝑦𝑢 2 1 2 1 𝑞 • • • 𝑀 1 𝑜𝑓𝑦𝑢 21 𝑞𝑠𝑓𝑤 𝑜𝑓𝑦𝑢 𝑞𝑠𝑓𝑤 𝑜 𝑞𝑠𝑓𝑤 1 2 The Abstract State Space Data Abstraction Heap Representation : Hypergraph head tail • placeholders: nonterminal (labelled) edges of rank 𝑜 • variables: edges of rank 1 • pointers: terminal (labelled) edges of rank 2 Specify Placeholder: Hyperedge Replacement Grammar 4 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

Concretise whenever necessary; abstract whenever possible. abstr. concr. concr. abstr. 1 𝑞 𝑢𝑛𝑞 𝑀 𝑀 𝑞 𝑞 𝑜 𝑞 1 2 𝑜 2 𝑞𝑝𝑡 𝑜 𝑢𝑛𝑞 𝑀 𝑞 𝑞 𝑜 𝑞 𝑞𝑝𝑡 𝑜 𝑢𝑛𝑞 1 𝑞𝑝𝑡 𝑜 𝑞 𝑜 tmp := pos.next; 𝑀 𝑜 𝑞 𝑞 1 2 𝑞𝑝𝑡 𝑜 𝑞 𝑢𝑛𝑞 𝑀 𝑞 𝑞𝑝𝑡 𝑞 𝑜 𝑞 1 2 𝑞𝑝𝑡 𝑜 𝑞 𝑢𝑛𝑞 𝑜 𝑞 𝑞 2 The Abstract State Space Abstract Execution 5 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

Concretise whenever necessary; abstract whenever possible. abstr. abstr. 𝑀 𝑢𝑛𝑞 𝑜 𝑞𝑝𝑡 2 1 2 1 𝑞 𝑜 𝑞 1 𝑀 𝑀 𝑞 𝑞 𝑞 𝑀 → 𝑀 1 𝑞 𝑜 2 1 𝑞 𝑞 𝑞𝑝𝑡 2 1 𝑢𝑛𝑞 𝑜 𝑞𝑝𝑡 𝑜 𝑢𝑛𝑞 𝑜 𝑞 tmp := pos.next; 𝑀 𝑜 𝑞 𝑞 1 2 𝑞𝑝𝑡 𝑜 𝑞 𝑢𝑛𝑞 2 𝑀 𝑜 𝑞 𝑞 𝑜 𝑜 𝑞𝑝𝑡 𝑞 𝑜 𝑞 𝑞 𝑢𝑛𝑞 𝑜 𝑞 𝑜 𝑞𝑝𝑡 2 1 𝑞 2 The Abstract State Space Abstract Execution concr. concr. Reminder: Linked Lists HRG 5 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

Concretise whenever necessary; abstract whenever possible. abstr. abstr. 𝑀 𝑢𝑛𝑞 𝑜 𝑞𝑝𝑡 2 1 2 1 𝑞 𝑜 𝑞 1 𝑀 𝑀 𝑞 𝑞 𝑞 𝑀 → 𝑀 1 𝑞 𝑜 2 1 𝑞 𝑞 𝑞𝑝𝑡 2 1 𝑢𝑛𝑞 𝑜 𝑞𝑝𝑡 𝑜 𝑢𝑛𝑞 𝑜 𝑞 tmp := pos.next; 𝑀 𝑜 𝑞 𝑞 1 2 𝑞𝑝𝑡 𝑜 𝑞 𝑢𝑛𝑞 2 𝑀 𝑜 𝑞 𝑞 𝑜 𝑜 𝑞𝑝𝑡 𝑞 𝑜 𝑞 𝑞 𝑢𝑛𝑞 𝑜 𝑞 𝑜 𝑞𝑝𝑡 2 1 𝑞 2 The Abstract State Space Abstract Execution concr. concr. Reminder: Linked Lists HRG 5 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015

Concretise whenever necessary; abstract whenever possible. 𝑞 2 𝑢𝑛𝑞 𝑜 𝑞𝑝𝑡 2 1 1 𝑞 𝑞 𝑜 𝑞 𝑜 𝑀 𝑀 𝑀 𝑞 1 𝑜 𝑞 𝑞𝑝𝑡 𝑜 𝑢𝑛𝑞 1 2 𝑞𝑝𝑡 2 𝑀 → 1 2 𝑜 𝑞 𝑞 𝑞 𝑢𝑛𝑞 𝑞 tmp := pos.next; 𝑀 𝑜 𝑞 𝑞 1 2 𝑞𝑝𝑡 𝑜 𝑞 𝑢𝑛𝑞 2 𝑀 𝑜 𝑞 𝑀 𝑜 𝑜 𝑞𝑝𝑡 𝑞 𝑜 𝑞 𝑞 𝑢𝑛𝑞 𝑜 𝑞 𝑜 𝑞𝑝𝑡 2 1 𝑞 1 The Abstract State Space Abstract Execution abstr. concr. concr. abstr. Reminder: Linked Lists HRG 5 of 14 Verifying Pointer Programs using Graph Grammars | Christina Jansen, Joost-Pieter Katoen, Christoph Matheja, Thomas Noll | RWTH Aachen University | Dagstuhl Seminar “Verification of Evolving Graph Structures” | 03.11.2015