1 / 62

Logical Abstract Interpretation

Logical Abstract Interpretation. Sumit Gulwani Microsoft Research, Redmond. Final Goal of the class. Automatically verify partial correctness of programs like the following using abstract interpretation. Void Init(int* A, int n) { for (i := 0; i<n; i++;) A[i] := 0;

hensleyj
Download Presentation

Logical Abstract Interpretation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Logical Abstract Interpretation Sumit Gulwani Microsoft Research, Redmond

  2. Final Goal of the class Automatically verify partial correctness of programs like the following using abstract interpretation. Void Init(int* A, int n) { for (i := 0; i<n; i++;) A[i] := 0; for (j := 0; j<n; j++;) Assert(A[j] = 0); }

  3. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  4. Decision Procedures DPT() = Yes, if  is satisfiable = No, if  is unsatisfiable Without loss of generality, we can assume that  is a conjunction of atomic facts. • Why? • DP(1Ç2) is sat iff DP(1) is sat or DP(2) is sat • What is the trade-off? • Converting  into DNF may incur exponential blow-up

  5. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  6. Linear Arithmetic Expressions e := y | c | e1§ e2 | c £ e Atomic facts g := e¸0 | e0 Note that e=0 can be represented as e¸0 Æ e·0 e>0 can be represented as e-1¸0 (over integer LA) • The decision problem for integer LA is NP-hard. • The decision problem for rational LA is PTime. • PTime algorithms are complicated to implement. Popular choice is an exponential algorithm called “Simplex” • We will study a PTime algorithm for a special case.

  7. Difference Constraints • A special case of Linear Arithmetic • Constraints of the form x·c and x-y·c • We can represent x·c by x-u·c, where u is a special zero variable. Wlog, we will assume henceforth that we only have constraints x-y·c • Reasoning required: x-y·c1Æ y-z·c2) x-z·c1+c2 • O(n3) (saturation-based) decision procedure • Represent contraints by a matrix Mn£n • where M[i][j] = c represents xi–xj· c • Perform transitive closure of M • M[i][j] = min { M[i][j], M[i][k]+M[k][j] } •  is unsat iff 9i: M[i][i] < 0

  8. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  9. Uninterpreted Functions Expressions e := x | F(e1,e2) Atomic fact g := e1=e2 | e1e2 Axiom 8e1,e2,e1’,e2’: e1=e1’ Æ e2=e2’ ) F(e1,e2)=F(e1’,e2’) (called congruence axiom) (saturation-based) Decision Procedure • Represent equalities e1=e2 2 G in Equivalence DAG (EDAG) • Nodes of an EDAG represent congruence classes of expressions that are known to be equal. • Saturate equalities in the EDAG by following rule: • If C(e1)=C(e1’) Æ C(e2)=C(e2’), Merge C(F(e1,e2)), C(F(e1’,e2’)) where C(e) denotes congruence class of expression e • Declare unsatisfiability iff 9 e1e2 in G s.t. C(e1) = C(e2)

  10. Uninterpreted Functions: Example y=F5(y) yF(y) y=F3(y) Æ Æ F F F(y)=F4(y) F F2(y)=F5(y) F y=F2(y) F F(y)=F3(y) y y=F(y) ?: unsat

  11. Uninterpreted Functions: Complexity • Complexity of congruence closure : O(n log n), where n is the size of the input formula • In each step, we merge 2 congruence classes. The total number of steps required is thus n, where n is a bound on the original number of congruence classes. • The complexity of each step can be O(log n) by using union-find data structure

  12. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  13. Combination of Linear Arithmetic and Uninterpreted Functions Expressions e := y | c | e1§ e2 | c £ e | F(e1,e2) Atomic Facts g := e¸0 | e0 Axioms: Combined axioms of linear arithmetic + uninterpreted fns. Decision Procedure: Nelson-Oppen methodology for combining decision procedures

  14. Combining Decision Procedures • Nelson-Oppen gave an algorithm in 1979 to combine decision procedures for theories T1 and T2, where: • T1 and T2 have disjoint signatures • except equality • T1, T2 are stably infinite • Complexity is O(2n2£(W1(n)+W2(n)). • If T1, T2 are convex, complexity is O(n3£(W1(n)+W2(n)). The theories of linear arithmetic and uninterpreted functions satisfy all of the above criterions.

  15. Convex Theory A theory is convex if the following holds. Let G = g1Æ … Æ gn If G ) e1=e2Ç e3=e4, then G ) e1=e2 or G ) e3=e4 Examples of convex theory: • Rational Linear Arithmetic • Uninterpreted Functions

  16. 2·y·3 ) y=2 Ç y=3 But 2·y·3 ) y=2 and 2·y·3 ) y=3 / / Examples of Non-convex Theory • Theory of Integer Linear Arithmetic • Theory of Arrays y=sel(upd(M,a,0),b) ) y=0 Ç y=sel(M,b) But y=sel(upd(M,a,0),b) ) y=0 and y=sel(upd(M,a,0),b) ) y=sel(M,b) / /

  17. Stably Infinite Theory • A theory T is stably infinite if for all quantifier-free formulas  over T, the following holds: If  is satisfiable, then  is satisfiable over an infinite model. • Examples of stably infinite theories • Linear arithmetic, Uninterpreted Functions • Examples of non-stably infinite theories • A theory that enforces finite # of distinct elements. Eg., a theory with the axiom: 8x,y,z (x=y Ç x=z Ç y=z). Consider the quantifier free formula : y1=y2.  is satisfiable but doesn’t have an infinite model.

  18. Nelson-Oppen Methodology • Purification: Decompose  into 1Æ2 such that i contains symbols from theory Ti. • This can be done by introducing dummy variables. • Exchange variable equalities between 1 and 2 until no more equalities can be deduced. • Sharing of disequalities is not required because of stably-infiniteness. • Sharing of disjunctions of equalities is not required because of convexity. •  is unsat iff 1 is unsat or 2 is unsat.

  19. y1=y2 y1=a2 y1=a1 Combining Decision Procedures: Example y1 · 4y3 · F(2y2-y1) Æ y1=F(y1) Æ y2=F(F(y1)) Æ y14y3 Purification a1=2y2-y1 y1·4y3·a2 Æ y14y3 y1 = y2 y1 = a2 a2=F(a1) y1=F(y1) Æ y2=F(F(y1)) y1 = a1 Saturation ?: unsat

  20. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  21. Logical Abstract Interpretation • Abstract Interpretation of a program involves interpreting the program over abstract values from some abstract domain D equipped with a partial order ¹ • Logical Abstract Interpretation refers to the case when • D = logical formulas over theory T • ¹ = logical implication relationship, i.e., E ¹ E’ iff E )T E’ • We will study following examples of logical interpretation • D consists of finite conjunctions of atomic facts over T. • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Functions • D consists of universally quantified formulas over T.

  22. G’ g G2 G1 False True G’ G2 = G’Æ:g G1 = G’Æg y := e G =Join(G1,G2) = dG1Ç G2e Conditional Node G =Postcondition(y := e, G’) =d 9y’: G’[y’/y] Æ y=e[y’/y] e Join Node Assignment Node Transfer Functions for Logical Abstract Interpreter • An abstract interpreter computes abstract values or facts at each program point from facts at preceding program points using appropriate transfer fns. • Transfer functions for a logical abstract interpreter thus involve providing operators for over-approximating disjunction and existential quantifier elimination.

  23. Fixed-point Computation • In presence of loops, fixed-point computation is required. The process is accelerated by using a widening operator, which takes the facts in the current and previous iteration (at some point inside a loop) and generates something weaker than the current fact. • A widening operator should guarantee convergence in a bounded number of steps. • Widening is typically applied at loop header points. • Facts generated after fixed-point are invariants and can be used to validate assertions using decision procedures. G’ assert(g) Validate iff G’Æ: g is unsat

  24. Initialization • The fact at program entry is initialized to >, which in our setting is the logical formula “true”. • This denotes that we make no assumptions about inputs, and whatever we prove will be valid for all inputs. • The facts at all other program points are initialized to ?, which in our setting is the logical formula “false”. • This denotes our optimistic assumption of unreachability of program locations (unless we can prove them reachable in the process of fixed-point computation).

  25. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  26. Difference Constraints • Abstract element: • conjunction of xi-xj· cij • can be represented using matrix M, where M[i][j]=cij • Decide(M): • M’ := Saturate(M) • Declare unsat iff 9i: M’[i][i] < 0 • Join(M1, M2): • M’1 := Saturate(M1); M’2 := Saturate(M2); • Let M3 be s.t. M3[i][j] = Max { M’1[i][j], M’2[i][j] } • return M3

  27. Difference Constraints • Eliminate(M, xi): • M’ := Saturate(M); • Let M1 be s.t. M1[j][k] = 1 (if j=i or k=i) = M’[j][k] otherwise • return M1 • Widen(M1, M2): • M’1 := Saturate(M1); M’2 := Saturate(M2); • Let M3 be s.t. M3[i][j] = M1[i][j] (if M1[i][j] = M2[i][j])) = 1 (otherwise) • return M3

  28. Difference Constraints: Example true y := 0; z := 2; y=0, z=2 ? y=0 Æ z=2 ? 0·y·1 Æ z=y+2 0·y·2 Æ z=y+2 0·y Æ z=y+2 0·y<51 Æ z=y+2 1·y·2 Æ z=y+2 1·y<51 Æ z=y+2 y=1 Æ z=3 ? y < 50 y=50 Æ z=y+2 False True Assert (z=52) y=0 Æ z=2 0·y·1 Æ z=y+2 0·y<50 Æ z=y+2 ? y++; z++;

  29. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  30. Uninterpreted Functions • Abstract element: • conjunction of e1=e2, where e := y | F(e1,e2) • can be represented using EDAGs • Decide(G): • G’ := Saturate(G); • Declare unsat iff G contains e1  e2 and G’ has e1, e2 in the same congruence class. • Eliminate(G, y): • G’ := Saturate(G); • Erase y; (might need to delete some dangling expressions) • return G’

  31. Uninterpreted Functions • Join(G1, G2): • G’1 := Saturate(G1); G’2 := Saturate(G2); • G := Intersect(G’1, G’2); • return G; For each node n = <U, {ni,n’i}> in G ’1 and node m = <V, {mj, m’j}> in G2’, G contains a node [n,m] = <U Å V, {[ni, mj], [n’i,m’j]}>

  32. y1, F y1, F y1, F y2, F y2, F y2, F F F F F F F y3,y4 y5 y6 y7 y6,y7 y3 y4,y5 y7 y6 y4,y5 y3 Uninterpreted Functions: Example of Join G1 G2 G = Join(G1,G2)

  33. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  34. Combination: Decision Procedure • DP(E12): • <E1, E2> := Purify&Saturate(E12); • Return DPT1(E1) Æ DPT2(E2);

  35. Combination: Join Algorithm • JoinT12(L12, R12): • <L1, L2> := Purify&Saturate(L12); <R1, R2> := Purify&Saturate(R12); • DL := Æ {vi=<vi,vj> | vi2Vars(L1ÆL2), vj2Vars(R1ÆR2) }; DR := Æ {vj=<vi,vj> | vi2Vars(L1ÆL2), vj2Vars(R1ÆR2) }; • L’1 := L1Æ DL; R’1 := R1Æ DR; L’2 := L2Æ DL; R’2 := R2Æ DR; • A1 := JoinT1(L’1, R’1); A2 := JoinT2(L’2, R’2); • V := Vars(A1ÆA2) – Program Variables; A12 := EliminateT12(A1ÆA2, V); • Return A12;

  36. Combination: Example of Join Algorithm z=a-1 Æ y=F(a) z=b-1 Æ y=F(b) Joinuf+la z=a-1 a=ha,bi y=F(a) a=ha,bi z=b-1 b=ha,bi y=F(b) b=ha,bi Joinuf Joinla ha,bi=1+z y=F(ha,bi) { ha,bi } Eliminateuf+la y=F(1+z)

  37. Combination: Existential Quantifier Elimination • ElimintateT12(E12, V): • <E1, E2> := Purify&Saturate(E12); • <D, Defs> := DefSaturate(E1, E2, V [ Temp Variables); • V’ := V [ Temp Variables – D; E’1 := EliminateT1(E1, V’); E’2 := EliminateT2(E2, V’); • E := (E’1Æ E’2) [Defs(y)/y]; • Return E; DefSaturate(E1, E2, U) returns the set of all variables D that have definitions Defs in terms of variables not in U as implied by E1Æ E2.

  38. c  z-1 a F(z-1) Combination: Example of Existential Elimination a·b·y Æ z=c+1 Æ a=F2(b) Æ c=F(b) { a, b, c } Eliminateuf+la a·b·y Æ z=c+1 a=F2(b) Æ c=F(b) Defuf Defla { b } Eliminatela Eliminateuf c  z-1 a F(z-1) a · y Æ z=c+1 a = F(c) Substitute F(z-1) · y

  39. Abstract Interpretation over Combined Domain: Example true struct List { struct List* next; } x, y; N(z) = 0, if z = null = 1 + N(z!next) y := x; i := 0; y=x, i=0 ? 0·i·2, N(x)=N(y)+i 0·i, N(x)=N(y)+i 0·i·1 N(x)=N(y)+i 1·i·2, N(x)=N(y)+i ? y=x, i=0 1·i, N(x)=N(y)+i y=x!next, i=1, xnull N(x)=N(x!next)+1 ? ynull 0·i·1, y  null N(x)=N(y)+i 0·i, y  null N(x)=N(y)+i ? y=x, i=0, ynull i := i+1; y := y!next;

  40. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  41. Universally Quantified Abstract Domain • Abstract element is of the form E ÆÆi(8X: Ai)Bi) • where E, Ai, Bi are from some underlying base domain(s) D. • The partial order ¹ is a refinement of the more natural implication relationship. E ÆÆi(8X: Ai)Bi) ¹ E’ ÆÆj(8X: A’j)B’j) iff • E ) E’ • 8j 9i s.t. EÆA’j)Ai and EÆBi)B’j • Another way to state the above thing would be to say that the partial order is still the implication relationship but transfer functions are incomplete.

  42. Quantified Abstract Domain: Join Algorithm • Consider a simpler case first. Let (E Æ 8X:A)B) = Join(E1Æ8X:A1)B1, E2Æ8X:A2)B2). Then, • (E1Æ8X:A1)B1)¹ (E Æ8X:A)B) • (E2Æ8X:A2)B2)¹ (E Æ8X:A)B) Or, equivalently, • E1)E and E2)E. Thus, E = Join(E1, E2). • E1ÆA)A1 and E2ÆA)A2, i.e., A ) (E1)A1 Æ E2)A2). Thus, A = bE1)A1 Æ E2)A2c. • E1ÆB1) B and E2ÆB2) B. Thus, B = Join(E1ÆB1, E2ÆB2). • Join(E1ÆÆi(8X: A1i)B1i), E2ÆÆi(8X: A2i)B2i)): • result := JoinD(E1, E2); • Forall i,j: • A := bE1)A1iÆ E2)A2jc; B := JoinD(E1ÆB1i, E2ÆB2j); • result := result Æ8X:A)B • return result;

  43. Quantified Abstract Domain: Example of Join Let G1 = (i=0Æ8k: k=0)F[k]=i) G2 = (i=1Æ8k: 0·k·1)F[k]=0) Then Join(G1, G2) = 0·i·1Æ8k: A)B, where A = b(i=0)k=0) Æ (i=1)0·k·1)c = 0·k·i B = JoinD(i=0ÆF[k]=i, i=1ÆF[k]=0) = F[k]=0

  44. Quantified Abstract Domain: Eliminate Let (E’ Æ 8X:A’)B’) = Eliminate(E Æ8X:A)B, s). Then, (E Æ8X:A)B)¹ (E’ Æ8X:A’)B’) among other things. For simplicity, assume that s doesn’t affect terms in A,B involving X. Then, • E)E’ and E’ doesn’t contain any term affected by change to s. • Thus, E’ = EliminateD(E,s). • EÆA’)A and A doesn’t contain any term affected by change to s. • Thus, A’ = b8s:E)Ac. • EÆB)B’ and B’ doesn’t contain any term affected by change to s. • Thus, B’ = EliminateD(EÆB, s).

  45. Quantified Abstract Domain: Eliminate • Eliminate(G, s): • Let G be E Æ8X:A)B • Psuedo-code can be easily extended for multiple 8 • T := { e | e occurs in A or B; Vars(e) Å X ; } • A := A ÆÆe2T NotEffect(<s,G>, e); • E’ := EliminateD(E,s); • B’ := EliminateD(BÆE,s); • A’ := b8s:E)Ac; • return (E’ Æ8X: A’)B’) • NotEffect(<s,G>, e) denotes a constraint g s.t. GÆg implies that s does not affect e.

  46. Quantified Abstract Domain: Example of Eliminate Let G = (F[0]>10Æ8k: 0·k<F[0])F[k]>F[0] ) Then Eliminate(G, F[0]) = true Æ8k: A’)B’, where T = { k, F[k] } NotEffect(<F[0],G>, F[k]) = k0 NotEffect(<F[0],G>, F[k]) = true A1 = 0·k<F[0]Æk  0Ætrue = 1·k<F[0] A’ = b8F[0]: F[0]>10)1·k<F[0]c = 1·k<10 B’ = Eliminate(F[k]>F[0]ÆF[0]>10, F[0]) = F[k]<10

  47. Quantified Abstract Domain : Example true F[0] := 0; i := 1; i=1 Æ F[0]=0 i=1 Æ8k:k=0 ) F[k]=0 ? i=2 Æ F[0]=0 Æ F[1]=0 2·i·3 Æ8k: 0·k<i ) F[k]=0 2·i·n Æ8k: 0·k<i ) F[k]=0 i=2 Æ8k:0·k·1 ) F[k]=0 i=1 Æ F[0]=0 ? 1·i Æ8k: 0·k<i ) F[k]=0 1·i Æ8k: 0·k<i ) F[k]=0 1·i·2 Æ8k: 0·k<i ) F[k]=0 1·i·3 Æ8k: 0·k<i ) F[k]=0 ? i < n False i¸n Æ8k: 0·k<i ) F[k]=0 True i=1 Æ F[0]=0 1·i·2 Æ8k: 0·k<i ) F[k]=0 1·i<n Æ8k: 0·k<i ) F[k]=0 i := 0; ? F[i] := 0; i++; i=0 Æ8k: 0·k<n ) F[k]=0

  48. References • Uninterpreted Functions • “A polynomial time algorithm for global value numbering” SAS 2004, S. Gulwani, G. Necula • “Join algorithms for the theory of uninterpreted fns” FSTTCS 2004, S. Gulwani, A. Tiwari, G. Necula • Combination of Linear Arithmetic and Uninterpreted Fns • “Combining Abstract Interpreters” PLDI 2006, S. Gulwani, A. Tiwari • Universally Quantified Abstract Domain • “Lifting Abstract Interpreters to Quantified Logical Domains” POPL 2008, S. Gulwani, B. McCloskey, A. Tiwari

  49. Outline • Decision Procedures • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Logical Abstract Interpretation • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns • Universally Quantified Formulas • Hardness of Assertion Checking • Linear Arithmetic • Uninterpreted Functions • Combination of Linear Arithmetic and Uninterpreted Fns

  50. g Assert(g) False True y := ? y := e Conditional Assertion Non-deterministic Assignment Assignment Abstract Program Model / Problem Statement Linear Arithmetic e := y | c | e1§ e2 | c eg := e¸0 Uninterpreted Functions e := y | F(e1,e2)g := e1=e2 Combination e := y | c | e1§ e2 | c e | F(e1,e2)g := e¸0

More Related