Exploring Interpolants Philipp R ummer, Pavle Suboti c Uppsala - PowerPoint PPT Presentation

Exploring Interpolants Philipp R¨ ummer, Pavle Suboti´ c Uppsala University, Sweden COST Meeting, October 17 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 1 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist The choice of interpolants affect if/how a program is verified R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist The choice of interpolants affect if/how a program is verified We present a technique that: ◮ Discovers a range of interpolants R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist The choice of interpolants affect if/how a program is verified We present a technique that: ◮ Discovers a range of interpolants ◮ Incorporates domain specific knowledge R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist The choice of interpolants affect if/how a program is verified We present a technique that: ◮ Discovers a range of interpolants ◮ Incorporates domain specific knowledge ◮ Semantic in nature R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Introduction Interpolants in Model Checking Craig interpolants used in model checking to refine abstractions For a given interpolation problem several interpolants may exist The choice of interpolants affect if/how a program is verified We present a technique that: ◮ Discovers a range of interpolants ◮ Incorporates domain specific knowledge ◮ Semantic in nature ◮ Prover independent R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 2 / 39

Preliminaries Craig Interpolants Let ( A ∧ B = false ) then there exists an interpolant I for ( A , B ) such that: A → I B → ¬ I I refers only to common symbols of A , B R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 3 / 39

Motivation Motivating Example i = 0; x = j; // init while (i<50) { // loop i++; x++; } if (j == 0) assert (x >= 50); // error location Safety Properties No feasible path exists that reaches an error state R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 4 / 39

Motivation Analysis using CEGAR Compute an approximation of CFG with respect to a set of predicates 1 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 5 / 39

Motivation Analysis using CEGAR Compute an approximation of CFG with respect to a set of predicates 1 Choose a (spurious or genuine) path to error 2 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 5 / 39

Motivation Analysis using CEGAR Compute an approximation of CFG with respect to a set of predicates 1 Choose a (spurious or genuine) path to error 2 If spurious, use interpolation to generate further predicates 3 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 5 / 39

Motivation Motivating Example i = 0; x = j; // init while (i<50) { // loop i++; x++; } if (j == 0) assert (x >= 50); // error location Counter Example - one loop iteration init � �� � i 0 = 0 ∧ x 0 = j R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 6 / 39

Motivation Motivating Example i = 0; x = j; // init while (i<50) { // loop i++; x++; } if (j == 0) assert (x >= 50); // error location Counter Example - one loop iteration init loop � �� � � �� � i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 7 / 39

Motivation Motivating Example i = 0; x = j; // init while (i<50) { // loop i++; x++; } if (j == 0) assert (x >= 50); // error location Counter Example - one loop iteration init loop error � �� � � �� � � �� � i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 ∧ i 1 ≥ 50 ∧ j = 0 ∧ x 1 < 50 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 8 / 39

Motivation Counter Example - one loop iteration i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 ∧ i 1 ≥ 50 ∧ j = 0 ∧ x 1 < 50 � �� � � �� � A B Interpolation Problem i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 → I � �� � A i 1 ≥ 50 ∧ j = 0 ∧ x 1 < 50 → ¬ I � �� � B where I has symbols only from A and B R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 9 / 39

Motivation Candidate Interpolant I 1 = ( i 1 ≤ 1 ) The Interpolant i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 → i 1 ≤ 1 � � �� � A i 1 ≥ 50 ∧ j = 0 ∧ x 1 < 50 → ¬ i 1 ≤ 1 � � �� � B i 1 ∈ sym ( A ) and i 1 ∈ sym ( B ) � R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 10 / 39

Motivation The Problem ( i 1 ≤ 1 ) eliminates the counter-example Results in unrolling the loop - not general enough What we really would like is an inductive invariant R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 11 / 39

Motivation A Better Candidate Interpolant I 2 = ( x 1 ≥ i 1 + j ) The Interpolant i 0 = 0 ∧ x 0 = j ∧ i 0 < 50 ∧ i 1 = i 0 + 1 ∧ x 1 = x 0 + 1 → ( x 1 ≥ i 1 + j ) � � �� � A i 1 ≥ 50 ∧ j = 0 ∧ x 1 < 50 → ¬ ( x 1 ≥ i 1 + j ) � � �� � B x 1 , i 1 , j ∈ sym ( A ) and x 1 , i 1 , j ∈ sym ( B ) � R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 12 / 39

Motivation Interpolants ( x 1 ≥ i 1 + j ) avoids loop unrolling But how do we get ( x 1 ≥ i 1 + j ) instead of ( i 1 ≤ 1 ) from the theorem prover? R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 13 / 39

Interpolant lattice for the example j � = 0 ∨ i 1 ≤ 49 ∨ x 1 ≥ 50 I ⊤ . . i 1 ≤ 49 . j � = 0 ∨ x 1 ≥ i 1 i 1 ≤ 2 x 1 ≥ i 1 + j I 2 i 1 ≤ 1 I 1 x 1 = i 1 + j . . . i 1 = 1 x 1 = j + 1 ∧ i 1 = 1 I ⊥ R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 14 / 39

Interpolant lattice for the example j � = 0 ∨ i 1 ≤ 49 ∨ x 1 ≥ 50 I ⊤ . . i 1 ≤ 49 . j � = 0 ∨ x 1 ≥ i 1 i 1 ≤ 2 x 1 ≥ i 1 + j I 2 i 1 ≤ 1 I 1 x 1 = i 1 + j . . . i 1 = 1 x 1 = j + 1 ∧ i 1 = 1 I ⊥ How to navigate in lattice? How to compare “quality” of interpolants? R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 14 / 39

Some Related Work Syntactic restrictions (R. Jhala and K. L. McMillan, TACAS 06) Interpolant strength (V. D’Silva VMCAI 10) Beautiful Interpolants (A.Albarghouthi, K. L. McMillan, CAV 13) Term abstraction (F . Alberti, R. Bruttomesso, S. Ghilardi, S. Ranise, and N. Sharygina, LPAR 12) R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 15 / 39

Our Approach Pre-process the interpolation query R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 16 / 39

Our Approach Pre-process the interpolation query General, prover independent framework R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 16 / 39

Our Approach Pre-process the interpolation query General, prover independent framework Generate several interpolants for a given interpolation problem R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 16 / 39

Our Approach Pre-process the interpolation query General, prover independent framework Generate several interpolants for a given interpolation problem Incorporate domain specific knowledge in defining interpolant quality R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 16 / 39

Outline Interpolation Abstractions 1 Exploring Interpolants 2 Experiments on Software Programs 3 Conclusion 4 R¨ ummer, Suboti´ c Exploring Interpolants COST Meeting, October 17 17 / 39