440 likes | 567 Views
Spacer : Abstractions from Proofs and Counterexamples. Anvesh Komuravelli Carnegie Mellon University. Joint work with Arie Gurfinkel , Sagar Chaki and Edmund Clarke. Safety Verification. Safe. + Proof. Automatic analysis for assertion failures. Program P + Assertions. Unsafe.
E N D
Spacer : Abstractions fromProofs and Counterexamples AnveshKomuravelli Carnegie Mellon University Joint work with ArieGurfinkel, SagarChaki and Edmund Clarke
Safety Verification Safe + Proof Automatic analysis for assertion failures Program P + Assertions Unsafe + Counterexample Is it empty? Unknown + Partial Proof error(P) reach(P) Software Model Checking
Over-approximation Driven (OD) error(P) reach(P)
Over-approximation Driven (OD) error(P) reach(P)
Under-approximation Driven (UD) reach(P) error(P)
Under-approximation Driven (UD) error(P) reach(P)
But… μZ (SMT-Based Model Checker, part of Z3) Cannot solve in an hour x = y = z = w = 0; while (*) { if (*) {x++; y += 100;} else if (*) if (x ≥ 4) {x++; y++;} else if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (!(x ≥ 4 && y ≤ 2)) Solves an abstraction in < 1 sec. t = *; How to find abstractions automatically? Source: Automatically Refining Abstract Interpretations, Gulavani, Chakraborty, Nori and Rajamani, TACAS ‘08.
Our Strategy error(P) reach(P) Under-approx. Abstract Under-approx.
Our Strategy error(P) reach(P) Under-approx. Abstract Under-approx. Refine
Our Strategy error(P) reach(P) Under-approx. Abstract Under-approx. Refine Abstract
Our Strategy error(P) reach(P) And so on …
Our Strategy reach(P) is covered error(P) reach(P) Abstractions guide the SMT solver to look for general proofs
It’s based on UD Under-approximations … … A b s t r a c t … …
It’s based on UD Under-approximations … need not be monotonic … A b s t r a c t … …
Spacer is based on UD Under-approximations … non-trivial abstraction … A b s t r a c t … …
Spacer Program Abstract Under-Approximate Refine Proof-Based Abstraction CEGAR No No Check Safety Feasible? Feasible? Safety Proof Counterexample Yes Yes
Schematic Example init_stmt; c = 0; while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k1); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; } assert (safe); Loop Invariants Add Counters Under-approximate Solve
Schematic Example Treat as guessed unbounded invariants. Essentially like Houdini [FL’01]. init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k1); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Specific to under-approx. [FL’01] Houdini, an annotation assistant for ESC/Java, C. Flanagan and K.R.M. Leino, 2001 Extract Unbounded Invariants Unbounded! Strengthen with Invariants Under-approximate Feasible? Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Does not prove the assertion Under-approximate Feasible? NO Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k1); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Redundant for the proof Under-approximate Feasible? NO Abstract Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k1); if (*) { v1 = e1; v2 = *; } else { v3 = e3; v4 = *; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); Proof-Based Abstraction Under-approximate Feasible? NO Abstract Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { assume (c < k2); if (*) { v1 = e1; v2 = *; } else { v3 = e3; v4 = *; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); k2 > k1 Abstract Counterexample! Concretize Concrete control path is infeasible Under-approximate Feasible? NO Refine Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { assume (c < k2); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); CEGAR Under-approximate Feasible? NO Refine Solve
Schematic Example init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_5 // invar_6 assume (c < k2); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); Unbounded Invariants Under-approximate Feasible? YES Solve
Spacer Program Abstract Under-Approximate Refine Proof-Based Abstraction CEGAR No No Check Safety Feasible? Feasible? Safety Proof Counterexample Yes Yes
Spacer Tool Program Abstract Under-Approximate Refine Proof-Based Abstraction CEGAR No No Check Safety Feasible? Feasible? Safety Proof Counterexample Yes Yes μZ Horn-Clause Solver (part of Z3)
Spacer Tool Program Horn-Clause Encoding Abstract Under-Approximate Refine Proof-Based Abstraction CEGAR No No Check Safety Feasible? Feasible? Safety Proof Counterexample Yes Yes μZ Horn-Clause Solver (part of Z3)
Spacer Tool C Program Preprocessing UFO Frontend (based on LLVM) Simplification, Large Block Encoding, etc. Horn Clause Encoding Implemented using UFO Frontend
Results on SV-COMP’13 Benchmarks < 5 min. Mixed Results
Results on SV-COMP’13 Benchmarks Advantage!
Results on SV-COMP’13 Benchmarks Advantage! Time-out Mem-out
Initial Example μZ (SMT-Based Model Checker, part of Z3) Cannot solve in an hour x = y = z = w = 0; while (*) { if (*) {x++; y += 100;} else if (*) if (x ≥ 4) {x++; y++;} else if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (!(x ≥ 4 && y ≤ 2)) Solves an abstraction in < 1 sec. t = *; Spacer (our tool) Finds a proof in a min. Source: Automatically Refining Abstract Interpretations, Gulavani, Chakraborty, Nori and Rajamani, TACAS ‘08.
Conclusion Focused Proofs • Abstractions guide the SMT solver to look for certain kind of proofs • Avoid proofs specific to an under-approximation How to obtain abstractions? • From proofs of under-approximations! (Proof-Based Abstraction) • Hope: What’s sufficient for the under-approximation is sufficient in general • Downside: If abstraction is too coarse, need to refine (CEGAR) For more details: Read our CAV’13 paper!
Ongoing work init_stmt; c = 0; assume (invar_1, invar_2); while (*) { if (*) { v1 = e1; v2 = *; } else { v3 = e3; v4 = *; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Syntactic Abstraction Semantic Abstraction
Ongoing work – Handling Procedures Semantic Abstractions Procedure Summaries / Hoare-Triples Syntactic Abstractions Abstracting a procedure’s body Obtain a modular proof of safety
Ongoing work – Quantified Invariants(Joint work with Ken McMillan) i := 0; while (i < n) { // a[i] := c; i++; } assume (0 ≤ k < n) assert (a[k] = c)
Ongoing work – Quantified Invariants(Joint work with Ken McMillan) Abstraction
Ongoing work – Quantified Invariants(Joint work with Ken McMillan) Reduces to quantifier-free invariantgeneration (use an off-the-shelf model checker)