Download presentation

Published byKaylee McMillan Modified over 5 years ago

1
**Demand-driven inference of loop invariants in a theorem prover**

K. Rustan M. Leino Microsoft Research, Redmond, WA, USA joint work with Francesco Logozzo École Polytechnique, Paris, France Spec# joint work with Mike Barnett, Robert DeLine, Manuel Fähndrich, Wolfram Schulte, and Herman Venter 3 April 2005 Invited talk, AVIS 2005 Edinburgh, Scotland, UK

2
**Software engineering problem**

Building and maintaining large systems that are correct

3
**Approach Specifications record design decisions**

bridge intent and code Tools amplify human effort manage details find inconsistencies ensure quality

4
**Spec# Experimental mix of contracts and tool support**

Aimed at experienced developers who know the high cost of testing and maintenance Superset of C# non-null types pre- and postconditions object invariants Tool support more type checking compiler-emitted run-time checks static program verification contracts everywhere C# into the future type checking run-time checks static verification degree of checking, effort

5
Spec# demo

6
**Basic architecture of a static verifier**

program with specifications verification condition generator verification condition theorem prover “correct” or list of errors

7
**Spec# static verifier architecture**

Spec# compiler MSIL (“bytecode”) Spec# static program verifier translator inference engine Boogie PL computes invariants over-approximates V.C. generator verification condition high precision needs invariants automatic theorem prover “correct” or list of errors

8
**Predicate abstraction and refinement**

e.g.: Graf & Saïdi, SLAM, BLAST, … correct model checker boolean program abstract trace predicate abstraction concrete trace C program predicates feasible? no yes error message predicate refinement

9
**Lemmas-by-demand theorem proving**

e.g.: Verifun, de Moura & Rueß, CVC Lite, Zap, … unsatisfiable SAT solver propositional formula monome conjunction of input literals input formula lemmas consistent with theories? no yes conflict-clause generation satisfiable

10
**Static program verification**

valid theorem prover verification condition counterexample verification condition generation program trace loop invariants program error message

11
**Loop invariants on demand**

valid theorem prover verification condition counterexample verification condition generation program trace loop invariants program give up? no yes more precise (stronger or context sensitive) inference error message

12
**Generating VC once valid theorem prover formula counterexample**

give up? no yes program more precise inference verification condition (VC) properties about loop invariants program trace error message

13
source language intermediate language passive command verification condition S,T ::= x := E | assert E | S ; T | if E then S else T end | while E do S end

14
source language intermediate language passive command verification condition C,D ::= x := E | assert E | assume E | C ; D | C [] D | while * do S end

15
**Tr[ while E do S end ] = while * do assume E ; Tr[ S ] end ; assume ¬E**

source language intermediate language passive command verification condition Tr[ x := E ] = x := E Tr[ assert E ] = assert E Tr[ S;T ] = Tr[ S ] ; Tr[ T ] Tr[ if E then S else T end ] = ( assume E ; Tr[ S ] [] assume ¬E ; Tr[ T ] ) Tr[ while E do S end ] = while * do assume E ; Tr[ S ] end ; assume ¬E

16
**Tr[ x := E ] = x := E Tr[ assert E ] = assert E**

source language intermediate language passive command verification condition Tr[ x := E ] = x := E Tr[ assert E ] = assert E Tr[ S;T ] = Tr[ S ] ; Tr[ T ] Tr[ if E then S else T end ] = ( assume E ; Tr[ S ] [] assume ¬E ; Tr[ T ] ) Tr[ while E do S end ] = while * do assume E ; Tr[ S ] end ; ( assume E ; Tr[ S ] ; assume false [] assume ¬E ) x := * ; assume J

17
**variation on Single Static Assignment (SSA) form Examples: **

source language intermediate language passive command verification condition variation on Single Static Assignment (SSA) form Examples: if name of x before assert E is x0, then translate assert E into: assert E[x0 / x] if name of x before x := E is x0, then make up a new name x1 and translate x := E into: assume x1 = E[x0 / x]

18
source language intermediate language passive command verification condition if name of x is x0 after S and x1 after T , then make up a new name x2 and translate S [] T into: S’ ; assume x2 = x0 [] T’ ; assume x2 = x1 if name of x is x0 before while * do S end , then make up a new name x1 and translate the loop into: assume J(x0, x1) where J is an uninterpreted predicate symbol

19
**wp( S;T, Q ) = wp( S, wp( T, Q )) **

source language intermediate language passive command verification condition wp( assert E, Q ) = E Q wp( assume E, Q ) = E Q wp( S;T, Q ) = wp( S, wp( T, Q )) wp( S [] T, Q ) = wp( S, Q ) wp( T, Q )

20
**Example finding index of minimum element in an array**

m := 0; x := 0; while x < N do if * then m := x end; x := x + 1 end; if N > 0 then assert 0 ≤ m < N end

21
**Example: passive command**

assume m0 = 0; assume x0 = 0; assume J(m0, m1, x0, x1); ( assume x1 < N ; ( assume m2 = m1 [] assume m2 = x1 ); assume x2 = x1 + 1; assume false [] assume ¬ (x1 < N) ); ( assume N > 0 ; assert 0 ≤ m1 < N [] assume ¬ (N > 0) )

22
**Example: from monome to lemma**

M : m0 = 0 x0 = 0 J(m0, m1, x0, x1) ¬ (x1 < N) N > 0 ¬(0 ≤ m1 < N) On entry to the loop, the names m0, m1, N are in scope, about which M says: m0 = 0 x0 = 0 N > 0 Thus, assuming the condition: m0 = 0 x0 = 0 N > 0 m0 = m x0 = x on entry to the loop, an abstract interpreter may infer the following loop invariant: 0 = m0 ≤ m < N 0 = x0 ≤ x ≤ N Thus, the abstract interpreter produces the following lemma about J: m0 = 0 x0 = 0 N > 0 J(m0, m1, x0, x1) 0 = m0 ≤ m1 < N 0 = x0 ≤ x1 ≤ N

23
**Summary and conclusions**

Spec# is a programming system that includes a static program verifier Trend: abstraction refinement on demand Inference of invariants can be done this way, inside theorem prover! Inference can be context sensitive VCs can be generated once Extensions to procedure summaries Watch for preliminary release of Spec# next week

Similar presentations

OK

Lecture 2 Towards a Verifying Compiler: Logic of Object oriented Programs Wolfram Schulte Microsoft Research Formal Methods 2006 Objects, references, heaps,

Lecture 2 Towards a Verifying Compiler: Logic of Object oriented Programs Wolfram Schulte Microsoft Research Formal Methods 2006 Objects, references, heaps,

© 2019 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google