Presentation is loading. Please wait.

Presentation is loading. Please wait.

Efficient SAT/BDD-based Techniques for Predicate Abstraction Efficient SAT/BDD-based Techniques for Predicate Abstraction Shuvendu K. Lahiri Joint work.

Similar presentations


Presentation on theme: "Efficient SAT/BDD-based Techniques for Predicate Abstraction Efficient SAT/BDD-based Techniques for Predicate Abstraction Shuvendu K. Lahiri Joint work."— Presentation transcript:

1 Efficient SAT/BDD-based Techniques for Predicate Abstraction Efficient SAT/BDD-based Techniques for Predicate Abstraction Shuvendu K. Lahiri Joint work with Thomas Ball, Randy Bryant, Byron Cook, Robert Nieuwenhuis, Albert Oliveras Microsoft Research, Redmond

2 – 2 – Program analysis and abstraction Unbounded state space Unbounded integers, arrays, heap State exploration may not terminateAbstraction Construct an overapproximation of program behavior Abstract domain/operators ensures that the analysis terminates

3 – 3 – Automatic predicate abstraction Graf & Saïdi, CAV ’97 Underlying framework Abstract Interpretation, Cousot & Cousot ‘77Idea Given set of predicates P = {P 1, …, P k } Formulas describing properties of system state Finite Abstraction ss Abstraction (s) = subset of {P 1, …, P k } holds on s At most 2 k abstract states

4 – 4 – Predicate abstraction in practice Boolean Program from C programs SLAM Software Model Checking BLAST, MAGIC, … Loop invariant synthesis for arrays and lists ESC-JAVA,.. Distributed Protocol Verification UCLID, Murphi, …

5 – 5 – Definitions Predicates Literals in some theory T P = {x = 1, x = y, x < y + 2, f(x) = f(y) + 2,..}Formula Boolean combination of predicates  (x = 1  x < y + 2)

6 – 6 – Fundamental Operation: Predicate Cover P: Set of predicates  : Formula F P (  ) Predicate cover of  P Weakest expression over P that implies  A minterm over P A conjunction of predicates P i or their negations their negations  F P (  ) Partitioning defined by the predicates

7 – 7 – F P (  ) Example Minterms over P x  y  x  2 x < y  x  2 x  y  x = 2 x < y  x = 2 P : {x < y, x = 2}  : y > 1

8 – 8 – Traditional approaches  F P (  ) Predicate cover of  P Weakest expression over P that implies  Partitioning defined by the predicates P: Set of predicates  : Formula Check which minterms imply  Use a decision procedure to check the implication Exponential number of Decision Procedure Calls

9 – 9 – Traditional approaches Large number of decision procedure calls P Worst case exponential in P Exponential behavior often seen in practice Each decision procedure call can be expensive Limits scalability F P (  ) invoked a few thousand times during a single software verification run Tools have to sacrifice precision for efficiency

10 – 10 – Overview of the talk Two approaches to predicate abstraction Symbolic Decision Procedures Satisfiability Modulo Theory (SMT) based Symbolic decision procedures (SDP) [Lahiri, Ball, Cook CAV’05] SMT-based predicate abstraction Eager [Lahiri, Bryant, Cook CAV’03] DPLL(T) based [Lahiri, Oliveras, Nieuwenhuis CAV’06] Challenges ahead

11 – 11 – Predicate Abstraction using Symbolic Decision Procedures

12 – 12 – Overview of SDP Symbolic Decision Procedures Predicate abstraction SDP for Equality Logic Combining SDP for two theories

13 – 13 – Computing F P (  ) F P distributes over conjunction F P (  1   2 ) = F P (  1 )  F P (  2 ) Suffices to compute F P (e 1 e 2 …. e n ) Suffices to compute F P (e 1  e 2 ….  e n ) Each e i is a literal First convert  to an equivalent conjunctive normal form (CNF) Rest of the talk, assume n = 1 (simplicity) Concentrate on computing F P (e)

14 – 14 – Decision Procedure (DP) Input A set G = {g 1,…, g m } of literals A literal eOutput Is G  e valid?Equivalently Is g 1 .. g m   e UNSAT? Is G  {  e} UNSAT?

15 – 15 – Symbolic Decision Procedure (SDP) Input A set G = {g 1,….,g m } of atomic expressions An atomic expression eOutput Representation for {G’ | G’  G, and G’  {  e} is UNSAT} “Symbolic” Decision Procedure One run of SDP(G,e) represents an exponential ( 2 |G| ) number of runs of DP(G,e)

16 – 16 – Predicate Abstraction and SDP PBar = {  p | p  P } SDP(P PBar, e) represents F P (e) SDP(P  PBar, e) represents F P (e) F P (e) all minterms over P  PBar that imply e SDP(P  PBar, e) {G’ | G’  P  PBar, and G’  {  e} is UNSAT}

17 – 17 – Overview of SDP Symbolic Decision Procedures Predicate abstraction SDP for Equality Logic Combining SDP for two theories

18 – 18 – A Decision Procedure for Equality Logic Atomic expressions x = y, x  y Inference Rules (R) Reflexivity, Symmetry, Transitivity Contradiction x = y, x  y   Inference rule generates a new expression from existing expressions

19 – 19 – A Decision Procedure for Equality Logic Atomic expressions x = y, x  y Inference Rules (R) Reflexivity, Symmetry, Transitivity Contradiction x = y, x  y   Inference rule generates a new expression from existing expressions a = bb = c a  c a = c a  c  G = {a=b,b=c}; e : (a = c) e : (a = c)

20 – 20 – A Decision Procedure for Equality Logic Atomic expressions x = y, x  y Inference Rules (R) Reflexivity, Symmetry, Transitivity Contradiction x = y, x  y   Inference rule generates a new expression from existing expressions R R R G  {  e}  Contains  Yes UNSAT SAT lg(|G|)

21 – 21 – Symbolic DP for Equality Logic Modifications Introduce a Boolean variable [g] for each expression g in G Add “true” for  e Construct a “shared” expression for the derivations a = bb = c a  c [a = b][b = c]true a = dd = c [a = d][d = c] G = {a=b,b=c,a=d,d=c}; e : (a = c) e : (a = c)

22 – 22 – Symbolic DP for Equality Logic a = bb = c a  c a = c a  c [a = b][b = c]true a = dd = c [a = d][d = c] G = {a=b,b=c,a=d,d=c}; e : (a = c) e : (a = c) Modifications Introduce a Boolean variable [g] for each expression g in G Add “true” for  e Construct a “shared” expression for the derivations

23 – 23 – Symbolic DP for Equality Logic Modifications Introduce a Boolean variable [g] for each expression g in G Add “true” for  e Construct a “shared” expression for the derivationsSDP(G,e)  The expression representing “  ” after lg(|G|) steps a = bb = c a  c a = c  a  c [a = b][b = c]true a = dd = c [a = d][d = c] G = {a=b,b=c,a=d,d=c}; e : (a = c) e : (a = c)

24 – 24 – Symbolic DP for Equality Logic Output A shared Boolean expression with [.] variables in the leaves a = bb = c a  c a = c  a  c [a = b][b = c]true a = dd = c [a = d][d = c] G = {a=b,b=c,a=d,d=c}; e : (a = c) e : (a = c)

25 – 25 – SDP for Equality Logic Expression representing “  ” after lg(|G|) steps Shared expression for {G’ | G’  G, and DP(G’,e) is UNSAT} Shared expression can be computed in polynomial time Derivations repeated for lg(|G|) steps Each step has at most |V| 2 atomic expressions V: number of vars in G

26 – 26 – SDP for other theories Bounded-depth Saturating Theory T Decision procedure for T can be implemented by saturation G Provide a function Depth: G  Nat, to denote the max. depth to iterate R R R G  {  e}  Contains  Yes UNSAT SAT Depth(G) No

27 – 27 – SDP for other theories Equality with Uninterpreted Functions (EUF) Expressions: f(x) = f(g(y)), x = f(z) Depth(G) < 3m m is the number of terms in G Polynomial Complexity of SDP Difference Logic (DIFF) Expressions: x  y + c Depth(G) < lg(|G|) Pseudo Polynomial Complexity of SDP Depends on the size of constants in G

28 – 28 – Overview of SDP Predicate Abstraction Symbolic Decision Procedures Predicate abstraction SDP for Equality Logic Combining SDP for two theories

29 – 29 – Combining SDPs for two theories Extend Nelson-Oppen method for combining decision procedures for two theories T 1, T 2 [Nelson, Oppen TOPLAS ’79] The decision procedures communicate via equalities over shared variables Given SDP 1 and SDP 2 for theories T 1, T 2 Disjoint signatures, convex theories Each theory generates derivations of all equalities between variables Complexity of the resultant SDP (for T 1  T 2 ) only increases linearly in the number of variables

30 – 30 – Combining SDP for two theories SDP 1 SDP 2 SDP 1 { x=y } G1G1 G2G2 G1G1 N : number of shared variables

31 – 31 – Combining SDP for theories Combined SDP for EUF + DIFF Pseudo Polynomial complexity Important fragment of most program verification queries (especially in SLAM)

32 – 32 – SDP to Predicate Abstraction Output of SDP is an Expression DAG Represents F P (e) Can be used directly to construct Boolean programs (with intermediate variables) To compute explicit expression for F P (e) Construct a Binary Decision Diagram (BDD) from SDP, and enumerate prime-implicants BDDs crucial for exploiting the shared representation

33 – 33 – Evaluation SLAM benchmarks Generated 665 predicate abstraction queries from device driver verification Decision Procedure (Zapato) based approach: 27904sec SDP based approach: 273s 100X speedup

34 – 34 – Challenges SDP for other interesting theories and combinations Linear arithmetic, non-convex theories Incremental SDPs Useful for combining SDPs Output sensitive predicate abstraction? Complexity is polynomial in the number of minterms in the output

35 – 35 – Conclusion Predicate abstraction via symbolic decision procedures Polynomial algorithms for useful theories Modular combination of Symbolic Decision Procedures for theories Can design SDP for each theory in isolation Simple prototype implementation Promising results on SLAM queries

36 – 36 – Overview of the talk Two approaches to predicate abstraction Symbolic Decision Procedures Satisfiability Modulo Theory (SMT) based Symbolic decision procedures (SDP) [Lahiri, Ball, Cook CAV’05] SMT-based predicate abstraction Eager [Lahiri, Bryant, Cook CAV’03] DPLL(T) based [Lahiri, Oliveras, Nieuwenhuis CAV’06] Challenges ahead

37 – 37 – SMT-based predicate abstraction

38 – 38 – Satifiability Modulo Theories (SMT) SMT Decide satisfiability of a (ground) first-order formula with respect to a background theory T Example (EUF) g(a) = c  (f(g(a))  f(c)  g(a) = d)  c  dSMT-solvers Leverages efficient Boolean search of Boolean satifiability (SAT) solvers

39 – 39 – SMT for predicate abstraction Input A formula , a set of predicates P over a theory TOutput G P (  ): External predicate cover of  Same as  F P (  ) Main Idea Main Idea [Lahiri et al. CAV’03, Clarke et al. FMSD ’04]  Introduce fresh Boolean variables B = { b 1,.., b n }  Construct the formula   (  i ( b i  P i ))  Enumerate all the models over B

40 – 40 – Eager SMT techniques Methodology Translates a (ground) formula into equisatisfiable Boolean formula Use off-the-shelf SAT solvers to check the satisfiability Tools: UCLID Equisatisfiable Translation  ( X, B )  bool ( A, B ) Variables introduced during translation

41 – 41 – Predicate abstraction using eager SMT techniques Methodology [Lahiri, Bryant, Cook CAV’03] Translates a (ground) formula into Boolean formula Use off-the-shelf BDD or SAT solvers to perform AllSAT over B Implemented in UCLID Uses SATQE (Kroening) Equisatisfiable Translation   (  i ( b i  P i ))  bool ( A, B ) Equisatisfiable Translation + Preserves solutions over Boolean variables Variables introduced during translation

42 – 42 – Advantage over explicit approach Single Call to SAT-based Quantification Engine Removes exponential number of calls to theorem prover Learning in Incremental SAT Retains conflict clauses across different solutions Leverage future advances in SAT Without any change to the framework

43 – 43 – Evaluation Compared with a black-box decision procedure based approach Das, Dill and Park, CAV’99 SLAM benchmarks Device driver verification Eager SMT technique improves X on many benchmarks Distributed protocol verification (UCLID) Lahiri, Bryant VMCAI’04 Decision procedure (SVC/CVC) based approach unable to finish on most examples > 10,000 theorem prover calls

44 – 44 – Lazy SMT techniques Integrate a theory T-solver with SAT solver Lazily rule out T-inconsistent Boolean models using theory solver CVC-Lite, Verifun, MathSAT, Barcelogic,… Barcelogic Tool R. Nieuwenhuis and A. Oliveras CAV’05 Optimizations (based on DPLL(T))  Check partial Boolean models for T-inconsistency  Upon T-inconsistency, use the explanation as a conflicting clause and perform backjump  Theory (unit) propagation to generate implied facts

45 – 45 – Predicate abstraction using lazy methods Lahiri, Nieuwenhuis, Oliveras CAV’06, using Barcelogic Enumerate all the models over B for  []   [   (  i ( b i  P i )) ] while  is T-satisfiable do   M := T-model for  using SMT-solver  M := project M onto B  Consider  M as a conflicting clause  Perform conflict analysis to generate backjump clause  Optionally add backjump clause  Backjump and continue return all models over B

46 – 46 – Experimental results SLAM benchmarks ~5seconds on 665 benchmarks > 100X improvement on SDP based approach Hardware and protocol benchmarks Hardware and protocol benchmarks [UCLID] 7 set of benchmarks 22X – 143X improvement over Eager-SMT based approach Linked list verification Linked list verification [Lahiri, Qadeer POPL’06] 4 set of benchmarks 31X – 40X improvement over Eager-SMT based approach SDP-based technique not applied on the latter two classes Need support for (sound) quantifier-reasoning

47 – 47 – Hardware and protocol benchmarks  Theory propagation crucial for benchmarks with arithmetic E.g. 17X slowdown in OOO without it  Reusing lemmas and clauses improves 1.5X – 3X on most examples BenchmarksPredsEager(secs)Lazy(secs) # minterms # cubes Aodv Bakery BRP Cache_ibm Cache_ibm Dlx OOO # cubes: Number of prime-implicants in the BDD for the minterms

48 – 48 – Conclusions Relatively easy to turn SMT solver to perform predicate abstraction Clear benefit from leveraging learned clause and not restarting the search after each model Improvements in SMT translate to predicate abstraction case

49 – 49 – Overview of the talk Two approaches to predicate abstraction Symbolic Decision Procedures Satisfiability Modulo Theory (SMT) based Symbolic decision procedures (SDP) [Lahiri, Ball, Cook CAV’05] SMT-based predicate abstraction Eager [Lahiri, Bryant, Cook CAV’03] DPLL(T) based [Lahiri, Oliveras, Nieuwenhuis CAV’06] Challenges ahead

50 – 50 – Summary Symbolic decision procedures Symbolic decision procedures Can construct DAG representation of output in polynomial time for useful theories Modular combination of SDPs Require more optimizations to make it practical SMT-based procedures Can leverage SMT solvers without much effort ALLSAT using SAT-solvers (Eager) or SMT solvers (Lazy) Lazy approaches benefit from tighter SAT+theory reasoning

51 – 51 – Challenges for predicate abstraction tools Predicate abstraction with non-ground formulas Quantifiers were removed with simple instantiation techniques for UCLID/List verification benchmarks Generate partial models during ALLSAT Should improve the performace when ratio of #minterms : # cubes is large Incremental refinement of approximations Construct refined approximation of F P (  ) from coarser approximations, without repeating work Some initial directions in CAV’06 paper Refining the abstraction (incrementally) with monotonically increasing set of predicates

52 – 52 – Questions?

53 – 53 –

54 – 54 – Overview Predicate Abstraction Symbolic Decision Procedures (SDP) Predicate abstraction SDP for Equality Logic Combining SDP for two theories Implementation and Results Related Work

55 – 55 – Zap Overview [Ball, Lahiri, Musuvathi] Many automated program analysis tools require symbolic reasoning e.g. Unit-testing, model checking, static analysis, … Support symbolic operations for such tools Support richer operations, apart from validity checking Support useful theories for program analysis Leverage advances in SAT solving and theorem proving Zap theorem prover MUTT unit-testing Zing model checking Boogie static analysis SLAM/SDV

56 – 56 – Symbolic Reasoning for Automated Software Analysis Validity / Satisfiability Validity / Satisfiability Model generation Model generation Useful in test case generation Quantifier elimination Quantifier elimination Image operation in model checking Abstract interpretation operations Abstract interpretation operations abstract transformers, join, widen Interpolants Interpolants For abstraction-refinement

57 – 57 – Interesting Theories Theories Equality with uninterpreted functions (EUF) Linear Arithmetic Arrays Bounded Integers Lists Sets Combine the symbolic operations for different theories

58 – 58 – Symbolic Reasoning for Automated Software Analysis Validity / Satisfiability Validity / Satisfiability Model generation Model generation Useful in test case generation Quantifier elimination Quantifier elimination Image operation in model checking Abstract interpretation operations Abstract interpretation operations abstract transformers, join, widen Interpolants Interpolants For abstraction-refinement

59 – 59 –   F P (  )

60 – 60 – Evaluation SLAM benchmarks Generated 665 predicate abstraction queries from device driver verification Decision Procedure based approach: 27904sec SDP based approach: 273s 100X speedup Synthetic benchmark Comparison with UCLID More than 100X speedup

61 – 61 – Related Work Decision Procedure Based Calls a decision procedure to check implication with each minterm [Das & Dill], [Saidi & Shankar],… Boolean Quantifier Elimination Based [Lahiri, Bryant, Cook, CAV 03, Clarke et al., FMSD 04] Performs predicate abstraction by quantifier elimination Reduces restricted first-order quantifier elimination to Boolean quantifier elimination

62 – 62 – Experimental Setup Symbolic Method Incremental SAT-based method SATQE : Simple extension to Zchaff »Built by Daniel Kroening at CMU Explicit Method Algorithm of Das, Dill & Park, CAV’99 Avoids exponential worst case in many cases in practice Uses SVC as a decision procedure Device Driver Benchmarks from SLAM Toolkit Ball and Rajamani, MSR Queries during C  Boolean Program construction

63 – 63 – Evaluation on SLAM-benchmarks BDD based approach worse than SAT on larger benchmarks BDD based approach worse than SAT on larger benchmarks Example#Preds Explicit Explicit Symbolic Symbolic #CallsTime(sec) #Prop- vars SAT-based time (sec) Dr.1019>7576> Dr.1320>7351> Dr.1523>7237> Dr Dr

64 – 64 – Symbols  

65 – 65 – Challenges ahead


Download ppt "Efficient SAT/BDD-based Techniques for Predicate Abstraction Efficient SAT/BDD-based Techniques for Predicate Abstraction Shuvendu K. Lahiri Joint work."

Similar presentations


Ads by Google