Download presentation

Presentation is loading. Please wait.

Published byMaribel Springfield Modified over 2 years ago

1
© Anvesh Komuravelli Quantified Invariants in Rich Domains using Model Checking and Abstract Interpretation Anvesh Komuravelli, CMU Joint work with Ken McMillan

2
© Anvesh Komuravelli The Problem Array-Manipulating Program P + Assertions Array-Manipulating Program P + Assertions Automatic analysis for assertion failures Automatic analysis for assertion failures Safe + Proof Unsafe + CEX Unknown + Partial Proof 1 Quantified Invariants!

3
© Anvesh Komuravelli Quantified Invariants, Typically 2 Specialized Abstract Domains E.g. Segmentation abstraction, Indexed Predicate Abstraction, Points-to Analysis, etc. Restrictive False warnings Specialized Abstract Domains E.g. Segmentation abstraction, Indexed Predicate Abstraction, Points-to Analysis, etc. Restrictive False warnings Unrestricted Model Checking E.g. Interpolation-based Hard to find the right quantifiers Divergence Unrestricted Model Checking E.g. Interpolation-based Hard to find the right quantifiers Divergence Rich-enough abstract domain?

4
© Anvesh Komuravelli The abstract domain 3 i := 0; while (i < n) { // a[i] := c; i++; } assume (0 ≤ k < n) assert (a[k] = c) Quantified variables Predicate signature Abstract Domain Goal: Find a quantifier-free interpretation of the predicates Goal: Find a quantifier-free interpretation of the predicates

5
© Anvesh Komuravelli Guess-and-check doesn’t work anymore! 4 i := 0; while (i < n) { // a[i] := c; i++; } assume (0 ≤ k < n) assert (a[k] = c) Given a guess for P, how to check if it suffices? FOL validity is undecidable! Can we still use existing model checkers?

6
© Anvesh Komuravelli Let’s look at the VCs 5 i := 0; while (i < n) { // a[i] := c; i++; } assume (0 ≤ k < n) assert (a[k] = c)

7
© Anvesh Komuravelli Pulled to the outermost scope Let’s look at the VCs 6

8
© Anvesh Komuravelli Let’s look at the VCs 7 Real challenge! Find a sufficient set of witnesses

9
© Anvesh Komuravelli Let’s look at the VCs 8 Reduces to quantifier-free invariant generation (use an off-the-shelf model checker) Reduces to quantifier-free invariant generation (use an off-the-shelf model checker)

10
© Anvesh Komuravelli Two Goals 9 i := 0; while (i < n) { // a[i] := c; i++; } assume (0 ≤ k < n) assert (a[k] = c) Quantified variables Predicate signature Abstract Domain Goal 2: Find a quantifier-free interpretation of the predicates Goal 2: Find a quantifier-free interpretation of the predicates Goal 1: Find a sufficient set of witnesses for j Goal 1: Find a sufficient set of witnesses for j

11
© Anvesh Komuravelli A Strategy 10 Guess some witnesses Check if they suffice using a model checker Y Found Proof N Give up! Eager Syntactic Pattern Matching [BMR13] [BMR13]: On Solving Universally Quantified Horn Clauses, Bjorner, McMillan, Rybalchenko, SAS’13 Unguided instantiation Worst-case unbounded Grows exponentially with number of quantified vars May choke the model checker No fall-back strategy

12
© Anvesh Komuravelli Our Strategy 11 Guess some witnesses Check if they suffice using a model checker Y Found Proof NCEX Refine the guess Constraint on the witness Guess-and-check, but of the witnesses and not the invariant itself Guess-and-check, but of the witnesses and not the invariant itself

13
© Anvesh Komuravelli Obtaining Strong Constraints 12 Generalized Counterexamples Strong Constraints Symbolic Counterexamples Number of variables = O(size) Constraint solving becomes harder (easily diverging) Symbolic Counterexamples Number of variables = O(size) Constraint solving becomes harder (easily diverging) Ground Counterexamples + Abstract Interpretation Ground Counterexamples + Abstract Interpretation

14
© Anvesh Komuravelli Note – one witness suffices! 13 is equivalent to May not be expressible!

15
© Anvesh Komuravelli Concrete vs. Abstract 14

16
© Anvesh Komuravelli Concrete vs. Abstract 15

17
© Anvesh Komuravelli The algorithm 16 [B] [L] [E]

18
© Anvesh Komuravelli The algorithm 17 InstantiateCheck [B] [L] [E] P(k 0,v 0,i 0,c 0 ) P(k 1,v 1,i 1,c 1 ) P(k 2,v 2,i 2,c 2 ) B L L E

19
© Anvesh Komuravelli The algorithm 18 InstantiateCheck P(k 0,v 0,i 0,c 0 ) P(k 1,v 1,i 1,c 1 ) P(k 2,v 2,i 2,c 2 ) BL L E Analyze

20
© Anvesh Komuravelli The algorithm 19 InstantiateCheck P(0,0,0,0) P(0,0,1,0) P(0,0,2,0) BL L E Analyze ✕ ? ✕ ? ✕ ? ✕ ?

21
© Anvesh Komuravelli P(0,0,0,0) P(0,1,0,0) P(0,2,0,0) BL L E ✕ ? ✕ ? ✕ ? ✕ ? Use k for j The algorithm 20 InstantiateCheck Analyze

22
© Anvesh Komuravelli The algorithm 21 Instantiate [B] [L] [E]

23
© Anvesh Komuravelli The algorithm 22 Instantiate [B] [L] [E] …

24
© Anvesh Komuravelli Finding a new witness 23 Given Constraint Check local vars quantified variable Skolem Template f Solve for t using sampling-based approach restrict to linear templates restrict to linear templates

25
© Anvesh Komuravelli Add l c to existing samples S Pick candidate t c Quantifier Alternation using Sampling 24 ? Y Return t c CEX l c ? N CEX S N Y New candidate t c Source of Divergence! Quantifier Elimination Eliminate arrays (thanks to Nikolaj for the discussion), Cheap QE of integers Eliminate arrays (thanks to Nikolaj for the discussion), Cheap QE of integers

26
© Anvesh Komuravelli Abstract Post, in practice 25 1. Cheap QE tricks, case-split on equalities on j, etc. 2. Under-approximate, otherwise. Solve Generalize models 1. Cheap QE tricks, case-split on equalities on j, etc. 2. Under-approximate, otherwise. Solve Generalize models 1. Cheap QE tricks, case-split on array-index arguments, etc. 2. Under-approximate, otherwise. Solve an SMT problem Generalize models 1. Cheap QE tricks, case-split on array-index arguments, etc. 2. Under-approximate, otherwise. Solve an SMT problem Generalize models

27
© Anvesh Komuravelli Experiments 26 Implemented “qe_array” tactic in Z3 Prototype in Python using Z3Py interface for witness generation Implemented “qe_array” tactic in Z3 Prototype in Python using Z3Py interface for witness generation Automatically generated “sufficient witnesses” for small array-manipulating programs (BMR13) – array init, find, copy, concatenate, reverse, etc. Used GPDR engine in Z3 to solve for quantifier-free predicates Up to two universal quantifiers per predicate Witness was just a local variable in the VC Automatically generated “sufficient witnesses” for small array-manipulating programs (BMR13) – array init, find, copy, concatenate, reverse, etc. Used GPDR engine in Z3 to solve for quantifier-free predicates Up to two universal quantifiers per predicate Witness was just a local variable in the VC

28
© Anvesh Komuravelli Moving forward… 27 Scalability Handle large programs (with multiple procedures) How to pick relevant “set” of witnesses? Can we synthesize guards to combine them into a single witness? Scalability Handle large programs (with multiple procedures) How to pick relevant “set” of witnesses? Can we synthesize guards to combine them into a single witness? Implementation-wise Cache previous AI results Reuse bounded proofs – Proof-based Abstraction Lazy QE – postponing to later steps? Implementation-wise Cache previous AI results Reuse bounded proofs – Proof-based Abstraction Lazy QE – postponing to later steps? Alternatives Use over-approximations of reachable states Witness may not exist – need to refine the approximation Alternatives Use over-approximations of reachable states Witness may not exist – need to refine the approximation

29
© Anvesh Komuravelli Questions? 28

Similar presentations

OK

Lifting Abstract Interpreters to Quantified Logical Domains Sumit Gulwani, MSR Bill McCloskey, UCB Ashish Tiwari, SRI 1.

Lifting Abstract Interpreters to Quantified Logical Domains Sumit Gulwani, MSR Bill McCloskey, UCB Ashish Tiwari, SRI 1.

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google