A Data Driven Approach for Algebraic Loop Invariants Paper by Rahul - - PowerPoint PPT Presentation

A Data Driven Approach for Algebraic Loop Invariants

Paper by Rahul Sharma, Saurabh Gupta, Bharath Hariharan, Alex Aiken, Percy Liang, and Aditya V. Nori In ESOP 2013

Vanya Dancheva Seminar: Research Topics in Software Engineering 22.04.2013

1

Motivation

• Generating loop invariants is crucial for

program verification

• Major drawbacks with previous techniques for

algebraic invariants

– Restrict predicates on branches to either equalities or inequalities – Cannot handle nested loops – Interpret program variables as real numbers

2

Guess-and-check algorithm

• Finds algebraic invariant of the form
• Guess phase – suggests a candidate invariant
• Check phase – checks whether the candidate invariant

is an invariant

• Advantages

– Uses a decision procedure to check the candidate invariant – The guess phase operates over data

) ,..., (

1

= ∧

n i

x x f

i

3

Example

• First, run the program

and accumulate the resulting data

• Assume the loop is

exercised once

• Assume an upper

bound on the degree

• f the polynomials –

d = 2

1: assume(x=0 && y=0); 2: while(*) do 3: writelog(x, y); 4: y := y + 1; 5: x := x + y; 6: done

4

Example

• Enumerate all monomials up to the chosen

degree

• Construct a data matrix A

1 x y y2 x2 xy 1

} , , , , , 1 {

2 2

xy x y y x = α 

5

Example

• Employ the null space of A to compute a

candidate invariant is a basis for the null space of A

) 1 (

2 2 1

=                     ∧ ≡

=

xy x y y x b I

T i k i

} ,..., , {

2 1 k

b b b

6

Example

• The basis for the null space of A is
• Candidate invariant is

} 1 , 1 , 1 , 1 , 1 {                                                                                                    

2 2

= ∧ = ∧ = ∧ = ∧ = ≡ xy y x y x I

7

Example

• Check the candidate invariant

L ≡ while B do S

• 1. If is a precondition then
• 2. Executing the loop body S with a state

satisfying , results in a state satisfying

ϕ

I ⇒ ϕ

B I ∧

I I

8

Example

1. 2. A counter example for 2.

) ( ) (

2 2

= ∧ = ∧ = ∧ = ∧ = ⇒ = ∧ = xy y x y x y x

) ' ' ' ' ' ' ( ) ' ' 1 ' (

2 2 2 2

= ∧ = ∧ = ∧ = ∧ = ⇒ + = ∧ + = ∧ = ∧ = ∧ = ∧ = ∧ = y x y x y x y x x y y xy y x y x

1 ' , 1 ' = = y x

9

Example

• Lets generate more program states

A=

1 x y y2 x2 xy 1 1 1 1 1 1 1 1 3 2 4 9 36 1 6 3 9 36 18 1 10 4 16 100 40

10

Example

• Basis for the null space of A is
• New candidate invariant is
• Both conditions 1. and 2. are valid and this is the

desired loop invariant 1. 2.

} 1 1 2 {                     − −

2

2 =

− − ≡ y y x I

x y y y x 2 ) (

2 =

+ ⇒ = ∧ = ) ' 2 ' ' ( ) ' ' 1 ' 2 (

2 2

x y y y x x y y x y y = + ⇒ + = ∧ + = ∧ = +

11

The algorithm

Guess-And-Check(L,ϕ,d) Returns: A loop invariant I for L 1: x := vars (L) 2: Tests := TestGen(ϕ,L) 3: logfile := {} 4: for

• r t in Tests do

do 5: logfile := logfile :: Execute(L, x = t) 6: end end for

• r

7: repeat epeat 8: I := Guess(logfile, d) 9: (done, t) := Check(I, L, ϕ) 10: if if ¬done then hen 11: logfile := logfile :: t 12: end end if if 13: until til done 14: ret etur urn I Guess(logfile, d) Returns: A candidate invariant 1: if if logfile = {} then hen 2: ret etur urn false 3: end end if if 4: A := DataMatrix(logfile, d) 5: B := Basis(NullSpace(A)) 6: if if B = 0 then hen 7: // No non-trivial invariant 8: return true 9: end end if if 10: ret etur urn CandidateInvariant(B)

12

The algorithm

• The Guess-and-check algorithm terminates

after at most n iterations, if the Check procedure is sound and complete

– n is the total number of monomials with degree bounded by d

• If the algorithm Guess-and-check terminates

and the Check procedure is sound it returns an invariant

13

Extensions and Evaluation

• Guess-and-check easily extends to nested

loops

• Linear invariants
• Evaluated on benchmarks from the literature
• Terminated on all benchmarks in one iteration

14

References

• de Moura, L.M., Bjorner. “Z3: An efficient SMT

solver”. In TACAS. pp. 337-340 (2008)

• Sharma, R., Gupta, S., Hariharan, B., Aiken, A.,
• Nori. “A data driven approach for algebraic

loop invariants”. Tech. Report MSR-TR-2012- 97, Microsoft Research (2012)

15