HiFrog: Interpolation-based Software Verification using Theory - PowerPoint PPT Presentation

HiFrog: Interpolation-based Software Verification using Theory Refinement Sepideh Asadi joint work with Karine Even Mendoza, Grigory Fedyukovich, AnM Hyvärinen, Hana Chockler, Natasha Sharygina Formal Verification and Security Lab University of Lugano (USI), Switzerland FMCAD 2017

What is HiFrog? ▪ An SMT-based bounded model checker for C ▪ Computes and reuses FuncSon Summaries • Based on Craig interpolaSon

What is HiFrog? ▪ An SMT-based bounded model checker for C ▪ Computes and reuses FuncSon Summaries • Based on Craig interpolaSon ▪ Controllable interpolaSon system for SMT • Flexible in Size & Strength • Compact and readable summaries

What is HiFrog? ▪ An SMT-based bounded model checker for C ▪ Computes and reuses FuncSon Summaries • Based on Craig interpolaSon ▪ Controllable interpolaSon system for SMT • Flexible in Size & Strength • Compact and readable summaries ▪ AutomaSc adjustment of abstracSon using different theories • Theory Refinement

HiFrog and Function Summarization sources + assertions SMT encoder EUF Function EUF parser Summaries symbolic LRA LRA execution assertions BV SSA optimizer BOOL slicing BOOL Interpolating SMT solver SAT summary proof proof refiner theory compressor solvers interpolation- itp for based BOOL summaries assertion violated itp for itp for & error trace LRA EUF UNSAT assertion holds!

HiFrog and Function Summarization sources + assertions SMT encoder EUF Function EUF parser Summaries symbolic LRA LRA execution assertions BV SSA optimizer BOOL slicing BOOL Interpolating SMT solver SAT summary proof proof refiner theory compressor solvers interpolation- itp for based BOOL summaries assertion violated itp for itp for & error trace LRA EUF theory UNSAT refiner assertion holds!

HiFrog and Theory Refinement

HiFrog and Theory Refinement Program + AsserSons 0 Symbolic Encoding

HiFrog and Theory Refinement Program + AsserSons 0 Symbolic Encoding initial entire 1 encoding less precise theory OpenSMT

HiFrog and Theory Refinement Program + AsserSons 0 Symbolic Encoding initial entire 1 encoding UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 0 Symbolic Encoding initial entire 1 encoding SAT + model 2 UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 3 0 Counter-example Symbolic sequence validator Encoding of all terms initial entire 1 encoding SAT + model 2 UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 4 3 0 Counter-example Symbolic term vs CEX precise sequence validator Encoding theory of all terms initial entire 1 encoding SAT OpenSMT + model 2 UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 4 3 0 Counter-example Symbolic term vs CEX precise sequence validator Encoding theory of all terms initial entire 1 encoding SAT SAT OpenSMT + model Do Nothing! 5 2 UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 4 3 0 Counter-example Symbolic term vs CEX precise sequence validator Encoding theory of all terms 5 UNSAT initial entire 1 term(s) encoding SAT SAT OpenSMT Refiner + model Do Nothing! 5 2 UNSAT less precise Safe theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 4 3 0 Counter-example Symbolic term vs CEX precise sequence validator Encoding theory of all terms 5 UNSAT initial entire 1 term(s) encoding SAT SAT OpenSMT Refiner + model Do Nothing! 5 2 6 local refinements UNSAT precise less precise Safe Binding theory theory 2 OpenSMT

HiFrog and Theory Refinement Program + AsserSons 4 3 0 Counter-example Symbolic term vs CEX precise sequence validator Encoding theory of all terms 5 UNSAT initial entire 1 term(s) encoding 7 SAT SAT OpenSMT nothing Unsafe Refiner + model Do Nothing! + to refine Counter-example 5 2 6 local refinements UNSAT precise less precise Safe Binding theory theory 2 OpenSMT

h,p://verify.inf.usi.ch/hifrog/ Looking forward to seeing you at poster sessions!