[PPT] - First-Order Theorem Proving and Program Analysis Laura Kov acs PowerPoint Presentation

SLIDE 1

First-Order Theorem Proving and Program Analysis

Laura Kov´ acs

Chalmers University of Technology

SLIDE 2

Chalmers

Laura Kovács

SLIDE 3

Chalmers

Laura Kovács

Focus of my Research: Automated Program Analysis (ex. ~200kLoC, Vampire prover)

SLIDE 4

Chalmers

Laura Kovács

a=0, b=0, c=0; while (a<n) do if A[a]>0 then B[b]=A[a]+h(b); b=b+1; else C[c]=A[a]; c=c+1; a=a+1; end do

Focus of my Research: Automated Program Analysis

SLIDE 5

Chalmers

Laura Kovács

a=0, b=0, c=0; while (a<n) do if A[a]>0 then B[b]=A[a]+h(b); b=b+1; else C[c]=A[a]; c=c+1; a=a+1; end do

Focus of my Research: Automated Program Analysis

Program property: (∀p)(0≤p<b ⇒ (∃q)(0≤q<a ∧ B[p]=A[q]+h(p) ∧ A[q]>0)

SLIDE 6

Chalmers

Laura Kovács

a=0, b=0, c=0; while (a<n) do if A[a]>0 then B[b]=A[a]+h(b); b=b+1; else C[c]=A[a]; c=c+1; a=a+1; end do

Focus of my Research: Automated Program Analysis

cnt=0, fib1=1, fib2=0; while (cnt<n) do t=fib1; fib1=fib1+fib2; fib2=t; cnt++; end do h

SLIDE 7

Chalmers

Laura Kovács

a=0, b=0, c=0; while (a<n) do if A[a]>0 then B[b]=A[a]+h(b); b=b+1; else C[c]=A[a]; c=c+1; a=a+1; end do

Focus of my Research: Automated Program Analysis

cnt=0, fib1=1, fib2=0; while (cnt<n) do t=fib1; fib1=fib1+fib2; fib2=t; cnt++; end do h

Program property: fib14+ fib24 + 2fib1fib23 – 2 fib13fib2 - fib12fib22 -1 = 0

SLIDE 8

Chalmers

Laura Kovács

a=0, b=0, c=0; while (a<n) do if A[a]>0 then B[b]=A[a]+h(b); b=b+1; else C[c]=A[a]; c=c+1; a=a+1; end do

Focus of my Research: Automated Program Analysis

cnt=0, fib1=1, fib2=0; while (cnt<n) do t=fib1; fib1=fib1+fib2; fib2=t; cnt++; end do h

Math ¡ Logic ¡

fib14+ fib24 + 2fib1fib23 – 2 fib13fib2 - fib12fib22 -1 = 0 (∀p)(0≤p<b ⇒ (∃q)(0≤q<a ∧ B[p]=A[q]+h(p) ∧ A[q]>0)

SLIDE 9

Chalmers

Laura Kovács

Math ¡ Logic ¡ Program ¡Analysis ¡

My ¡Research ¡

Vampire prover

SLIDE 10

Chalmers

Laura Kovács

Symbolic ¡ Computa:on ¡ Automated ¡ Theorem ¡Proving ¡ Program ¡Analysis ¡

My ¡Research ¡

funded ¡by: ¡

SLIDE 11

Chalmers

Laura Kovács

Symbolic ¡ Computa:on ¡ Automated ¡ Theorem ¡Proving ¡ Program ¡Analysis ¡

My ¡Research ¡

funded ¡by: ¡

Need industrial partners/interest!

(We have the funding!)

SLIDE 12

Outline

Program Analysis and Theorem Proving Loop Assertions by Symbol Elimination Automated Theorem Proving Overview Saturation Algorithms Conclusions

SLIDE 13

Example: Array Partition

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while A :

1
3
1
5
8
2

a = 0 B :

*
*
*
*
*
*
*

b = 0 C :

*
*
*
*
*
*
*

c = 0

SLIDE 14

Example: Array Partition

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while A :

1
3
1
5
8
2

a = 7 B :

1
3
8
*
*
*

b = 4 C :

1
5
2
*
*
*
*

c = 3

SLIDE 15

Example: Array Partition

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while A :

1
3
1
5
8
2

a = 7 B :

1
3
8
*
*
*

b = 4 C :

1
5
2
*
*
*
*

c = 3

Invariants with ∀ ∃

◮ Each of B[0], . . . , B[b − 1] is non-negative and equal to one of

A[0], . . . , A[a − 1]. (∀p)(0 ≤ p < b → B[p] ≥ 0 ∧ (∃i)(0 ≤ i < a ∧ A[i] = B[p]))

SLIDE 16

Example: Array Partition

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while A :

1
3
1
5
8
2

a = 7 B :

1
3
8
*
*
*

b = 4 C :

1
5
2
*
*
*
*

c = 3

Invariants with ∀ ∃

◮ Each of B[0], . . . , B[b − 1] is non-negative and equal to one of

A[0], . . . , A[a − 1]. (∀p)(0 ≤ p < b → B[p] ≥ 0 ∧ (∃i)(0 ≤ i < a ∧ A[i] = B[p]))

SLIDE 17

Invariant Generation – Overview of Our Method

◮ Given loop L; ◮ Extend L to L′; ◮ Extract a set P of loop properties in L′; ◮ Generate loop property p in L s.t. P → p.

SLIDE 18

Invariant Generation – Overview of Our Method

◮ Given loop L; ◮ Extend L to L′; ◮ Extract a set P of loop properties in L′; ◮ Generate loop property p in L s.t. P → p.

SLIDE 19

Invariant Generation – Overview of Our Method

◮ Given loop L; ◮ Extend L to L′; ◮ Extract a set P of loop properties in L′; ◮ Generate loop property p in L s.t. P → p.

← Symbol elimination!

SLIDE 20

Invariant Generation - The Method

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while

1. Extend the language L to L′:

◮ variables as functions of n:

v (i) with 0 ≤ i < n

◮ predicates as loop properties:

iter

2. Collect loop properties:

(∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x)∧(∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

SLIDE 21

Invariant Generation - The Method

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while

1. Extend the language L to L′:

◮ variables as functions of n:

v (i) with 0 ≤ i < n

◮ predicates as loop properties:

iter

2. Collect loop properties:

◮ Polynomial scalar properties ◮ Monotonicity properties of scalars ◮ Update predicates of arrays ◮ Translation of guarded assignments

(∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x)∧(∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

SLIDE 22

Invariant Generation - The Method

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while

1. Extend the language L to L′:

◮ variables as functions of n:

v (i) with 0 ≤ i < n

◮ predicates as loop properties:

iter

2. Collect loop properties:

◮ Polynomial scalar properties ◮ Monotonicity properties of scalars ◮ Update predicates of arrays ◮ Translation of guarded assignments

(∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x)∧(∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

SLIDE 23

Invariant Generation - The Method

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while

1. Extend the language L to L′:

◮ variables as functions of n:

v (i) with 0 ≤ i < n

◮ predicates as loop properties:

iter

2. Collect loop properties:

◮ Polynomial scalar properties ◮ Monotonicity properties of scalars ◮ Update predicates of arrays ◮ Translation of guarded assignments

3. Eliminate symbols → Invariants

(∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x)∧(∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

SLIDE 24

Invariant Generation - The Method

a := 0; b := 0; c := 0; while (a ≤ k) do if A[a] ≥ 0 then B[b] := A[a];b := b + 1; else C[c] := A[a];c := c + 1; a := a + 1; end while

1. Extend the language L to L′:

◮ variables as functions of n:

v (i) with 0 ≤ i < n

◮ predicates as loop properties:

iter

2. Collect loop properties:

◮ Polynomial scalar properties ◮ Monotonicity properties of scalars ◮ Update predicates of arrays ◮ Translation of guarded assignments

3. Eliminate symbols
HOW?

→ Invariants (∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x)∧(∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

SLIDE 25

Invariant Generation by Symbol Elimination

(∀i)(i ∈ iter ⇔ 0 ≤ i ∧ i < n) updB(i, p) ⇔ i ∈ iter ∧ p = b(i) ∧ A[a(i)] ≥ 0 updB(i, p, x) ⇔ updB(i, p) ∧ x = A[a(i)] a = b + c, a ≥ 0, b ≥ 0, c ≥ 0 (∀i ∈ iter)(a(i+1) > a(i)) (∀i ∈ iter)(b(i+1) = b(i) ∨ b(i+1) = b(i) + 1) (∀i ∈ iter)(a(i) = a(0) + i) (∀j, k ∈ iter)(k ≥ j → b(k) ≥ b(j)) (∀j, k ∈ iter)(k ≥ j → b(j) + k ≥ b(k) + j) (∀p)(b(0) ≤ p < b(n)→(∃i ∈ iter)(b(i) = p∧ A[a(i)] ≥ 0)) (∀i)¬updB(i, p) → B(n)[p] = B(0)[p] updB(i, p, x) ∧ (∀j > i)¬updB(j, p)→B(n)[p]=x (∀i ∈ iter)(A[a(i)] ≥ 0 →B(i+1)[b(i)] = A[a(i)]∧ b(i+1) = b(i) + 1∧ c(i+1) = c(i) )

First-Order Theorem Proving

I1, I2, I3, I4, I5, . . .

SLIDE 26

Outline

Program Analysis and Theorem Proving Loop Assertions by Symbol Elimination Automated Theorem Proving Overview Saturation Algorithms Conclusions

SLIDE 27

First-Order Theorem Proving. Example

Group theory theorem: if a group satisfies the identity x2 = 1, then it is commutative.

SLIDE 28

First-Order Theorem Proving. Example

Group theory theorem: if a group satisfies the identity x2 = 1, then it is commutative. More formally: in a group “assuming that x2 = 1 for all x prove that x · y = y · x holds for all x, y.”

SLIDE 29

First-Order Theorem Proving. Example

Group theory theorem: if a group satisfies the identity x2 = 1, then it is commutative. More formally: in a group “assuming that x2 = 1 for all x prove that x · y = y · x holds for all x, y.” What is implicit: axioms of the group theory. ∀x(1 · x = x) ∀x(x−1 · x = 1) ∀x∀y∀z((x · y) · z = x · (y · z))

SLIDE 30

Formulation in First-Order Logic

∀x(1 · x = x) Axioms (of group theory): ∀x(x−1 · x = 1) ∀x∀y∀z((x · y) · z = x · (y · z)) Assumptions: ∀x(x · x = 1) Conjecture: ∀x∀y(x · y = y · x)

SLIDE 31

In the TPTP Syntax

The TPTP library (Thousands of Problems for Theorem Provers), http://www.tptp.org contains a large collection of first-order problems. For representing these problems it uses the TPTP syntax, which is understood by all modern theorem provers, including Vampire.

SLIDE 32

In the TPTP Syntax

The TPTP library (Thousands of Problems for Theorem Provers), http://www.tptp.org contains a large collection of first-order problems. For representing these problems it uses the TPTP syntax, which is understood by all modern theorem provers, including Vampire. First-Order Logic (FOL) TPTP ⊥, ⊤ $false, $true ¬F ˜F F1 ∧ . . . ∧ Fn F1 & ... & Fn F1 ∨ . . . ∨ Fn F1 | ... | Fn F1 → Fn F1 => Fn (∀x1) . . . (∀xn)F ! [X1,...,Xn] : F (∃x1) . . . (∃xn)F ? [X1,...,Xn] : F

SLIDE 33

In the TPTP Syntax

The TPTP library (Thousands of Problems for Theorem Provers), http://www.tptp.org contains a large collection of first-order problems. For representing these problems it uses the TPTP syntax, which is understood by all modern theorem provers, including Vampire. In the TPTP syntax this group theory problem can be written down as follows: %---- 1 * x = 1 fof(left identity,axiom, ! [X] : mult(e,X) = X). %---- i(x) * x = 1 fof(left inverse,axiom, ! [X] : mult(inverse(X),X) = e). %---- (x * y) * z = x * (y * z) fof(associativity,axiom, ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z))). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X] : mult(X,Y) = mult(Y,X)).

SLIDE 34

More on the TPTP Syntax

%---- 1 * x = x fof(left identity,axiom,( ! [X] : mult(e,X) = X )). %---- i(x) * x = 1 fof(left inverse,axiom,( ! [X] : mult(inverse(X),X) = e )). %---- (x * y) * z = x * (y * z) fof(associativity,axiom,( ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z)) )). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e ). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X,Y] : mult(X,Y) = mult(Y,X) ).

SLIDE 35

More on the TPTP Syntax

◮ Comments;

%---- 1 * x = x fof(left identity,axiom,( ! [X] : mult(e,X) = X )). %---- i(x) * x = 1 fof(left inverse,axiom,( ! [X] : mult(inverse(X),X) = e )). %---- (x * y) * z = x * (y * z) fof(associativity,axiom,( ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z)) )). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e ). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X,Y] : mult(X,Y) = mult(Y,X) ).

SLIDE 36

More on the TPTP Syntax

◮ Comments; ◮ Input formula names;

%---- 1 * x = x fof(left identity,axiom,( ! [X] : mult(e,X) = X )). %---- i(x) * x = 1 fof(left inverse,axiom,( ! [X] : mult(inverse(X),X) = e )). %---- (x * y) * z = x * (y * z) fof(associativity,axiom,( ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z)) )). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e ). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X,Y] : mult(X,Y) = mult(Y,X) ).

SLIDE 37

More on the TPTP Syntax

◮ Comments; ◮ Input formula names; ◮ Input formula roles (very important);

%---- 1 * x = x fof(left identity,axiom,( ! [X] : mult(e,X) = X )). %---- i(x) * x = 1 fof(left inverse,axiom,( ! [X] : mult(inverse(X),X) = e )). %---- (x * y) * z = x * (y * z) fof(associativity,axiom,( ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z)) )). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e ). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X,Y] : mult(X,Y) = mult(Y,X) ).

SLIDE 38

More on the TPTP Syntax

◮ Comments; ◮ Input formula names; ◮ Input formula roles (very important); ◮ Equality

%---- 1 * x = x fof(left identity,axiom,( ! [X] : mult(e,X) = X )). %---- i(x) * x = 1 fof(left inverse,axiom,( ! [X] : mult(inverse(X),X) = e )). %---- (x * y) * z = x * (y * z) fof(associativity,axiom,( ! [X,Y,Z] : mult(mult(X,Y),Z) = mult(X,mult(Y,Z)) )). %---- x * x = 1 fof(group of order 2,hypothesis, ! [X] : mult(X,X) = e ). %---- prove x * y = y * x fof(commutativity,conjecture, ! [X,Y] : mult(X,Y) = mult(Y,X) ).

SLIDE 39

Running Vampire on a TPTP file

is easy: simply use vampire <filename>

SLIDE 40

Running Vampire on a TPTP file

is easy: simply use vampire <filename> One can also run Vampire with various options, some of them will be explained later. For example, save the group theory problem in a file group.tptp and try vampire group.tptp

SLIDE 41

Running Vampire on a TPTP file

is easy: simply use vampire <filename> One can also run Vampire with various options, some of them will be explained later. For example, save the group theory problem in a file group.tptp and try vampire --thanks LCCC group.tptp

SLIDE 42