© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.

© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work with Arie Gurfinkel, Sagar Chaki and Edmund Clarke

© Anvesh Komuravelli Spacer The Problem Program P + Assertions Program P + Assertions Automatic analysis for assertion failures Automatic analysis for assertion failures Safe Unsafe Unknown Software Model Checking + Proof + Counterexample + Partial Proof reach(P) error(P) 1 Is it empty?

© Anvesh Komuravelli Spacer Over-approximation driven (OD) Key IdeaCEGAR based on Predicate Abstraction Symbolic Method BDDs for fixed point computation, SMT for new predicates ToolsSLAM, BLAST, SDV, etc. 4

© Anvesh Komuravelli Spacer Key Recent Advancements 2003Interpolation for Hardware Model CheckingMcMillan 2006IMPACT (Path Interpolants)McMillan 2009Path Interpolants for Hardware Model CheckingGrumberg et al. 2010IC3 (Different way of computing Interpolants, Hardware)Bradley 2011WOLVERINE (Bit-level Implementation of IMPACT)Kroening et al. 2012UFO (DAG Interpolation method, Predicate Abstraction + Interpolation)Gurfinkel et al. 2012VINTA (Abstract Interpretation + Interpolation)Gurfinkel et al. 2011FunFrog (Interprocedural)Sharygina et al. 2012μZ (Horn clause solver based on GPDR)Bjorner et al. 2012Duality (Horn clause solver based on Interpolation) McMillan, Rybalchenko 2012WHALE (Interprocedural)Gurfinkel et al. 8

© Anvesh Komuravelli Spacer Why Abstraction? x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (0 ≤ y) 18 only way to fail the assertion

© Anvesh Komuravelli Spacer UD Reasoning x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (0 ≤ y) 1 st Iteration: w = 0, z = 0 1 st Iteration: w = 0, z = 0 19 y ≤ 100x

© Anvesh Komuravelli Spacer UD Reasoning x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (0 ≤ y) 2 nd Iteration: w = 1, z =10 2 nd Iteration: w = 1, z =10 20 y ≤ 100x

© Anvesh Komuravelli Spacer UD Reasoning x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (0 ≤ y) 3 rd Iteration: w = 2, z = 20 3 rd Iteration: w = 2, z = 20 21 y ≤ 100x And so on…

© Anvesh Komuravelli Spacer But … x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (0 ≤ y) 22 The value ‘1’ doesn’t matter!

© Anvesh Komuravelli Spacer UD Reasoning on the Abstraction x = y = z = w = 0; while (*) { x = *; y = *; assume (0 ≤ y ≤ 100x); if (y > 10w && z ≥ 100x) { y = −y; } t = *; w += t; z += 10t; } assert (0 ≤ y) 24 2 nd Iteration w = t, z = 10t z = 10w All Iterations Resolve t away y ≤ 100x Redundant

© Anvesh Komuravelli Spacer Original Example x = y = z = w = 0; while (*) { if (*) {x++; y += 100;} else if (*) if (x ≥ 4) {x++; y++;} else if (y > 10w && z ≥ 100x) { y = −y; } t = 1; w += t; z += 10t; } assert (!(x ≥ 4 && y ≤ 2)) Source: Automatically Refining Abstract Interpretations, Gulavani, Chakraborty, Nori and Rajamani, TACAS ‘08. 25 μZ (SMT-Based Model Checker, part of Z3) Cannot solve in an hour Spacer (our tool) Finds a proof in a min. Solves an abstraction in < 1 sec. t = *;

© Anvesh Komuravelli Spacer What’s the magic? Focused Proofs Abstractions guide the SMT solver to look for certain kind of proofs Avoid proofs specific to an under-approximation Abstractions guide the SMT solver to look for certain kind of proofs Avoid proofs specific to an under-approximation How to obtain abstractions? From proofs of under-approximations! (Proof-Based Abstraction) Hope: What’s sufficient for the under-approximation is sufficient in general Downside: If abstraction is too coarse, need to refine (CEGAR) From proofs of under-approximations! (Proof-Based Abstraction) Hope: What’s sufficient for the under-approximation is sufficient in general Downside: If abstraction is too coarse, need to refine (CEGAR) 26

© Anvesh Komuravelli Spacer Schematic Example init_stmt; c = 0; while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k 1 ); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; } assert (safe); Add Counters Under-approximate Solve  Loop Invariants 28

© Anvesh Komuravelli Spacer Schematic Example Under-approximate Solve  Feasible? init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k 1 ); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe);  Unbounded! Specific to under-approx. 29 Treat as guessed unbounded invariants. Essentially like Houdini [FL’01]. Treat as guessed unbounded invariants. Essentially like Houdini [FL’01]. Extract Unbounded Invariants Strengthen with Invariants [FL’01] Houdini, an annotation assistant for ESC/Java, C. Flanagan and K.R.M. Leino, 2001

© Anvesh Komuravelli Spacer init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Does not prove the assertion Does not prove the assertion Schematic Example Under-approximate Solve  Feasible?  NO 30

© Anvesh Komuravelli Spacer init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k 1 ); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = e6; c += 1; assume (invar_1, invar_2); } assert (safe); Redundant for the proof Schematic Example Under-approximate Solve  Feasible?  NOAbstract  31

© Anvesh Komuravelli Spacer Schematic Example Under-approximate Solve  Feasible?  NOAbstract  32 init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_1, invar_2 // invar_3, invar_4 assume (c < k 1 ); if (*) { v1 = e1; v2 = *; } else { v3 = e3; v4 = *; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); Proof-Based Abstraction

© Anvesh Komuravelli Spacer init_stmt; c = 0; assume (invar_1, invar_2); while (*) { assume (c < k 2 ); if (*) { v1 = e1; v2 = *; } else { v3 = e3; v4 = *; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); Concretize k 2 > k 1 Schematic Example Under-approximate Solve  Abstract Counterexample! Feasible?  Concrete control path is infeasible NORefine  33

© Anvesh Komuravelli Spacer Schematic Example Under-approximate Solve  Feasible?  NORefine  34 init_stmt; c = 0; assume (invar_1, invar_2); while (*) { assume (c < k 2 ); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); CEGAR

© Anvesh Komuravelli Spacer init_stmt; c = 0; assume (invar_1, invar_2); while (*) { // invar_5 // invar_6 assume (c < k 2 ); if (*) { v1 = e1; v2 = e2; } else { v3 = e3; v4 = e4; } v5 = e5; v6 = *; c += 1; assume (invar_1, invar_2); } assert (safe); Unbounded Schematic Example Under-approximate Solve  Feasible?  YES 35 Invariants

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; while (*) { if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; } assert (!(x ≥ 4 && y ≤ 2)); if (nd ()) {x++; y += 100;} else if (nd () && x ≥ 4) {x++; y++;} else if (y > 10w && z ≥ 100x) {y = −y;} else assume (0); if (nd ()) {x++; y += 100;} else if (nd () && x ≥ 4) {x++; y++;} else if (y > 10w && z ≥ 100x) {y = −y;} else assume (0); non-deterministic choice (e.g. as in Promela) C-like 37

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; c += 1; } assert (!(x ≥ 4 && y ≤ 2)); Add Counters Under-approximate Solve  Loop Invariants 38

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; c += 1; } assert (!(x ≥ 4 && y ≤ 2)); Inductive Invariant Under-approximate Solve  Safe 39

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  Preserved! Specific to under-approx. Depend on counter Extract Unbounded Invariants Strengthen with Invariants 40

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  NO Does not prove the assertion Does not prove the assertion 41

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w++; z += 10; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  NOAbstract  Redundant 42

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y = *; ::(x ≥ 4) -> x++; y = *; ::(y > 10w && z ≥ 100x) -> y = *; fi w = *; z = *; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  NOAbstract  Fails Enlarge error 43

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x, // x ≤ 2, c ≤ 0 => x ≤ 0, c ≤ 1 => x ≤ 1 assume (c < 2); if ::x++; y = *; ::(x ≥ 4) -> x++; y = *; ::(y > 10w && z ≥ 100x) -> y = *; fi w = *; z = *; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4)); Under-approximate Solve  Feasible?  NOAbstract  44

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { assume (c < 4); if ::x++; y = *; ::(x ≥ 4) -> x++; y = *; ::(y > 10w && z ≥ 100x) -> y = *; fi w = *; z = *; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4)); Under-approximate Solve  Counterexample! Increment x to 4 Choose y arbitrarily Feasible?  Concrete control path is infeasible NORefine  Concretize 45

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { assume (c < 4); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w = *; z = *; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  NORefine  46

© Anvesh Komuravelli Spacer Detailed Example x = y = z = w = 0; c = 0; assume (y > 10w => z < 100x, z ≤ 100x); while (*) { // (y > 10w) => (z < 100x), z ≤ 100x // y > 0, (x > 0) => (y ≥ 100) assume (c < 4); if ::x++; y += 100; ::(x ≥ 4) -> x++; y++; ::(y > 10w && z ≥ 100x) -> y = −y; fi w = *; z = *; c += 1; assume (y > 10w => z < 100x, z ≤ 100x); } assert (!(x ≥ 4 && y ≤ 2)); Under-approximate Solve  Feasible?  YES Inductive Invariant Safe Unbounded 47

© Anvesh Komuravelli Spacer Implementation Details – Unbounded Invariants Maximal subset of true post-lemmas Minimal number of b i ’s to be set to false Maximal subset of true post-lemmas Minimal number of b i ’s to be set to false Fixed point Iteration: 50 Introduce Assumption variables

© Anvesh Komuravelli Spacer Spacer Tool Program Under- Approximate Check Safety Feasible? Abstract Refine Proof-Based Abstraction CEGAR No Yes Safety ProofCounterexample 56 μZ Horn-Clause Solver (part of Z3) μZ Horn-Clause Solver (part of Z3)

© Anvesh Komuravelli Spacer Spacer Tool Program Under- Approximate Check Safety Feasible? Abstract Refine Proof-Based Abstraction CEGAR No Yes Safety ProofCounterexample 57 Horn-Clause Encoding μZ Horn-Clause Solver (part of Z3) μZ Horn-Clause Solver (part of Z3)

© Anvesh Komuravelli Spacer Conclusion Focused Proofs Abstractions guide the SMT solver to look for certain kind of proofs Avoid proofs specific to an under-approximation Abstractions guide the SMT solver to look for certain kind of proofs Avoid proofs specific to an under-approximation How to obtain abstractions? From proofs of under-approximations! (Proof-Based Abstraction) Hope: What’s sufficient for the under-approximation is sufficient in general Downside: If abstraction is too coarse, need to refine (CEGAR) From proofs of under-approximations! (Proof-Based Abstraction) Hope: What’s sufficient for the under-approximation is sufficient in general Downside: If abstraction is too coarse, need to refine (CEGAR) 65 A framework for automated abstraction in SMT-based Software Model Checking Implementation using an existing SMT-based model checker with practical advantage A framework for automated abstraction in SMT-based Software Model Checking Implementation using an existing SMT-based model checker with practical advantage Contributions

© Anvesh Komuravelli Spacer Conclusion (contd…) 66 Post-pruning of Proofs during Abstraction (Local vs. Global Proofs) Non-monotonic abstractions Major role of invariants (exploit the generality of proofs of under-approximations Post-pruning of Proofs during Abstraction (Local vs. Global Proofs) Non-monotonic abstractions Major role of invariants (exploit the generality of proofs of under-approximations Visit spacer.bitbucket.org to download tool and detailed slides! Why does PBA work?

© Anvesh Komuravelli Spacer On-going and Future Work Observation: Fixed granularity of abstraction – at the program level Observation: Restricted space of abstractions Questions: When/How to abstract/refine? Observation: Proofs too dependent on counter constraints (i.e. underapprox.) Question: How to use counters only when needed? In general, how to minimize the use of a given set of assumptions? Observation: Abstraction is done offline, after obtaining a proof of an under- approximation. Question: How does an on-the-fly abstraction work? When each transition is treated as a recursion-free procedure, it is similar to summarizing procedures on-the-fly. Also, how to handle recursion? 67

© Anvesh Komuravelli Spacer SMT-Based Model Checking init error CFGLoop-Free Unrolling Possibility 1 : UNSAFE Possibility 2 : SAFE Path Interpolants (McMillan ‘06) Discharge Verification Condition on SMT solver 70

© Anvesh Komuravelli Spacer SMT-Based Model Checking init error CFG Further Unrolling Possibility 1 : UNSAFE Possibility 2 : SAFE DAG Interpolants [AGC’12] Continue Until Convergence Discharge Verification Condition on SMT solver [AGC’12] : From Under-approximations to Over- approximations and Back, Albarghouthi, Gurfinkel and Chechik, TACAS ‘12 71

© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.

Similar presentations

Presentation on theme: "© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.

Similar presentations

Presentation on theme: "© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work."— Presentation transcript:

Similar presentations

About project

Feedback