Newton: A tool for generating abstract explanations of infeasibility1 The Problem P (C Program) BP (Boolean Program of P) CFG(P) CFG(BP)

Newton: A tool for generating abstract explanations of infeasibility2 The Problem P (C Program) BP (Boolean Program of P) CFG(P) CFG(BP) need refinement Where do predicates come from?

Newton: A tool for generating abstract explanations of infeasibility3 Generating Abstract Explanation of Spurious Counterexamples in C Programs Thomas Ball, Sriram K. Rajamani Technical Report Yunkyung Ahn some figures and slides are from

Newton: A tool for generating abstract explanations of infeasibility4 Goal P (path program) Found Bug good explanation (infeasible) Newton

Newton: A tool for generating abstract explanations of infeasibility5 The SLAM Process boolean pgm path predicates pgm P SLIC rule slic pgm P’ c2bp bebop newton

Newton: A tool for generating abstract explanations of infeasibility6 Path Program (Example) do { KeAcquireSpinLock(); A: KeAcquireSpinLock_return(); nPacketsOld = nPackets; request = devExt->WLHV; if(request){ request = request->Next; KeReleaseSpinLock(); B: KeReleaseSpinLock_return(); nPackets++; } C: } while (nPackets != nPacketsOld); KeReleaseSpinLock(); D: KeReleaseSpinLock_return(); enum { Unlocked=0, Locked=1 } state = Unlocked; void slic_abort() { SLIC_ERROR: ; } void KeAcquireSpinLock_return() { if (state == Locked) slic_abort(); else E: E: state = Locked; } void KeReleaseSpinLock_return { if (state == Unlocked) slic_abort(); else F: F: state = Unlocked; }

Newton: A tool for generating abstract explanations of infeasibility7 Path Program (Example) do { skip; A: KeAcquireSpinLock_return(); skip; if(*){ skip; B: KeReleaseSpinLock_return(); skip; } C: } while (*); skip; D: KeReleaseSpinLock_return(); decl {state==Locked}, {state==Unlocked}; void slic_abort() { SLIC_ERROR: skip; } void KeAcquireSpinLock_return() { if ({state==Locked}) slic_abort(); else E: E: {state==Locked},{state==Unlocked} := T,F; } void KeReleaseSpinLock_return() { if ({state == Unlocked}) slic_abort(); else F: F: {state==Locked},{state==Unlocked} := F,T; }

Newton: A tool for generating abstract explanations of infeasibility8 Path Program (Example) do { KeAcquireSpinLock(); A: KeAcquireSpinLock_return(); nPacketsOld = nPackets; request = devExt->WLHV; if(request){ request = request->Next; KeReleaseSpinLock(); B: KeReleaseSpinLock_return(); nPackets++; } C: } while (nPackets != nPacketsOld); KeReleaseSpinLock(); D: KeReleaseSpinLock_return(); enum { Unlocked=0, Locked=1 } state = Unlocked; void slic_abort() { SLIC_ERROR: ; } void KeAcquireSpinLock_return() { if (state == Locked) slic_abort(); else E: E: state = Locked; } void KeReleaseSpinLock_return { if (state == Unlocked) slic_abort(); else F: F: state = Unlocked; } nPackets = nPacketsOld; request = devExt->WLHeadVa; nPackets = nPacketsOld; request = devExt->WLHeadVa; assume(!request); assume(nPackets != nPacketsOld);

Newton: A tool for generating abstract explanations of infeasibility9 Example p1 is infeasible condition: e1 = (b > 0)  (c = 2b)  (a = b - 1) e1 implies (a  c) E1 = {(b > 0), (c = 2b), (a = b), (a = b-1)} an explanation of p1’ infeasibility 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c); p1 (path program ) (b > 0)(b > 0), (c=2b)(b > 0), (c=2b), (a=b)(b > 0), (c=2b), (a=b-1)

Newton: A tool for generating abstract explanations of infeasibility10 Example Is there a better explanation than E1? p2 is infeasible condition: e2 = (b > 0)  (c = 2b)  (a < b) e2 implies (a  c) e2 is more abstract (weaker) than e1 e1 = (b > 0)  (c = 2b)  (a = b - 1) e2 = (b > 0)  (c = 2b)  (a < b) e1  e2 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c); p1 (path program ) 1 assume(b>0); 2 c := 2  b; 5 assume(a<b); 6 assume(a=c); p2 (path program )

Newton: A tool for generating abstract explanations of infeasibility11 Example E1 = {(b > 0), (c = 2b), (a = b), (a = b-1)} E2 = {(b > 0), (c = 2b), (a < b)} E1, E2: explanations of p1’s infeasibility E2 is a better explanation than E1 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c); p1 (path program ) 1 assume(b>0); 2 c := 2  b; 5 assume(a<b); 6 assume(a=c); p2 (path program )

Newton: A tool for generating abstract explanations of infeasibility12 Example - Annotation introduce a fresh symbolic constant in p1, there is no variable is used without first being defined 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c); p1 1 b :=  b 2 assume(b>0); 3 c := 2  b; 4 a := b; 5 a := a – 1; 6 assume(a<b); 7 assume(a=c); p1’

Newton: A tool for generating abstract explanations of infeasibility13 Semantics of Path SP (strongest post condition) in terms of p SP maps a context to a new context : a context ,store represents the current valuation ,condition represents the constraints ,history represents the past valuations

Newton: A tool for generating abstract explanations of infeasibility14 Strongest Postcondition Example (Path simulation of p1) p1’  : store  : conditions  : history b :=  b ; assume(b>0); c := 2  b; a := b; a := a – 1; assume(a<b); assume(a=c); p1’  : store  : conditions  : history b :=  b ;(b,  b ) assume(b>0); c := 2  b; a := b; a := a – 1; assume(a<b); assume(a=c); p1’  : store  : conditions  : history b :=  b ;(b,  b ) assume(b>0);(b,  b )  b > 0 c := 2  b; a := b; a := a – 1; assume(a<b); assume(a=c); p1’  : store  : conditions  : history b :=  b ;(b,  b ) assume(b>0);(b,  b )  b > 0 c := 2  b;(b,  b ), (c, 2  b )  b > 0 a := b;(a,  b ), (b,  b ), (c, 2  b )  b > 0 a := a – 1;(a,  b -1), (b,  b ), (c, 2  b )  b > 0(a,  b ) assume(a<b);(a,  b -1), (b,  b ), (c, 2  b )  b > 0,  b -1 <  b (a,  b ) assume(a=c);(a,  b -1), (b,  b ), (c, 2  b )  b > 0,  b -1 <  b, 2  b =  b - 1 (a,  b ) p1’  : store  : conditions  : history b :=  b ;(b,  b ) assume(b>0);(b,  b )  b > 0 c := 2  b;(b,  b ), (c, 2  b )  b > 0 a := b;(a,  b ), (b,  b ), (c, 2  b )  b > 0 a := a – 1;(a,  b -1), (b,  b ), (c, 2  b )  b > 0(a,  b ) assume(a<b);(a,  b -1), (b,  b ), (c, 2  b )  b > 0,  b -1 <  b (a,  b ) assume(a=c);(a,  b -1), (b,  b ), (c, 2  b )  b > 0,  b -1 <  b, 2  b =  b - 1 (a,  b )

Newton: A tool for generating abstract explanations of infeasibility15 Example How to generate a good explanation p1,p2: infeasible paths p2 is a ICPP (Infeasible Consistent Path Projection) of p1 we can use the ICPP to generate an abstract explanation 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c); 1 assume(b>0); 2 c := 2  b; 5 assume(a<b); 6 assume(a=c); p1p2

Newton: A tool for generating abstract explanations of infeasibility16 Example p2 is a ICPP of p1 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b);, b :=  b ; 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; a :=  a ; 5 assume(a<b); 6 assume(a=b); p2 p1 1 assume(b>0); 2 c := 2  b; a :=  a ; 5 assume(a<b); 6 assume(a=b); b :=  b ; 1 assume(b>0); 2 c := 2  b; a :=  a ; 5 assume(a<b); 6 assume(a=b);

Newton: A tool for generating abstract explanations of infeasibility17 Newton implements SP to check if a path p is infeasible find an abstract explanation for the infeasibility of p based on constructing ICPPs, if p is infeasible Internal state of Newton has 3 components store (  ): map from variables to values condition(  ): predicates over symbols history(  ) : past valuations of the store Newton function in 3 phases: Phase1: check feasibility Phase2: minimize conditions Phase3: find a explanation

Newton: A tool for generating abstract explanations of infeasibility18 Example Store ConditionsHistory 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility19 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility20 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) Store 1b bb () 2c2  b (1) 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility21 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) Store 1b bb () 2c2  b (1) Store 1b bb () 2c2  b (1) 3a bb 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility22 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) Store 1b bb () 2c2  b (1) Store 1b bb () 2c2  b (1) 3a bb Store 1b bb () 2c2  b (1) 4a  b -1(3) History 3a bb (1) 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility23 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) Store 1b bb () 2c2  b (1) Store 1b bb () 2c2  b (1) 3a bb Store 1b bb () 2c2  b (1) 4a  b -1(3) History 3a bb (1) Store 1b bb () 2c2  b (1) 5a aa () Conditions (  b > 0)(1) (  a <  b )(1,5) 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility24 Example Store ConditionsHistoryStore 1b bb () Conditions (  b > 0)(1) Store 1b bb () 2c2  b (1) Store 1b bb () 2c2  b (1) 3a bb Store 1b bb () 2c2  b (1) 4a  b -1(3) History 3a bb (1) Store 1b bb () 2c2  b (1) 5a aa () Conditions (  b > 0)(1) (  a <  b )(1,5) Conditions (  b > 0)(1) (  a <  b )(1,5) (  a = 2  b )(2,5) a explanation of infeasibility {(  b > 0),(  a <  b ), (  a = 2  b )} {, } 1 assume(b>0); 2 c := 2  b; 3 a := b; 4 a := a – 1; 5 assume(a<b); 6 assume(a=c);

Newton: A tool for generating abstract explanations of infeasibility25 Experimental Results Newton generates a very small explanation. Every iteration of Newton took under a minute consumed less than 10MB of memory in a 996Mhz Pentium PC with 256MB RAM

Newton: A tool for generating abstract explanations of infeasibility26 Summary Symbolic path simulator Check conditions for inconsistency using theorem prover (Simplify) After detecting inconsistency: minimize inconsistent conditions traverse dependencies obtain predicates SLAM = The first CEGAR project CEGAR = Counter-Example Guided Abstraction Iterative Abstraction Refinement