Part III: Abstraction Refinement Javier Esparza Technische - - PowerPoint PPT Presentation

▶
part iii abstraction refinement
SMART_READER_LITE
LIVE PREVIEW

Part III: Abstraction Refinement Javier Esparza Technische - - PowerPoint PPT Presentation

Aug 09, 2023 344 likes •1.19k views

Part III: Abstraction Refinement Javier Esparza Technische Universitt Mnchen Javier Esparza Part III: Abstraction Refinement Example 1 ( X 0 ) ( X > 0 ) 2 3 The problem: X := X ( Y > 0 ) Is the error label reachable? ( Y

slide-1
SLIDE 1

Part III: Abstraction Refinement

Javier Esparza

Technische Universität München

Javier Esparza Part III: Abstraction Refinement

slide-2
SLIDE 2

Example

error

  • k

1 (X ≤ 0) (X > 0) X := −X 4 5 Y := −Y (Y > 0) 2 3 (Y ≤ 0) (X + Y > 0) (X + Y ≤ 0)

The problem: Is the error label reachable? The approach: Upgrade a BDD checker with abstraction refinement

Javier Esparza Part III: Abstraction Refinement

slide-3
SLIDE 3

Example

error

  • k

1 skip 4 5 skip (true) 2 3 (true) (true) (true) (true) (true)

Model-check the abstract program: Is the error label reachable considering only control flow?

Javier Esparza Part III: Abstraction Refinement

slide-4
SLIDE 4

Example

error

  • k

1 skip 4 5 skip (true) 2 3 (true) (true) (true) (true) (true)

Model-check the abstract program: Is the error label reachable considering only control flow? Yes!

Javier Esparza Part III: Abstraction Refinement

slide-5
SLIDE 5

Example

2 (X ≤ 0) error 1 (Y ≤ 0) 5 (X + Y > 0)

The concrete instructions are inserted again.

Javier Esparza Part III: Abstraction Refinement

slide-6
SLIDE 6

Example

2 (X ≤ 0) error 1 (Y ≤ 0) 5 (X + Y > 0)

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious?

Javier Esparza Part III: Abstraction Refinement

slide-7
SLIDE 7

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious? Spurious! ⇒ Hoare proof

Javier Esparza Part III: Abstraction Refinement

slide-8
SLIDE 8

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 (X ≤ 0) (X > 0) X := −X 4 5 Y := −Y (Y > 0) 2 3 (Y ≤ 0) (X + Y > 0) (X + Y ≤ 0)

Javier Esparza Part III: Abstraction Refinement

slide-9
SLIDE 9

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 (X ≤ 0) (true) skip 4 5 skip (true) 2 3 (Y ≤ 0) (X + Y > 0) (true)

Javier Esparza Part III: Abstraction Refinement

slide-10
SLIDE 10

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 (X ≤ 0) (true) skip 4 5 skip (true) 2 3 (Y ≤ 0) (l5 = false) (true)

Javier Esparza Part III: Abstraction Refinement

slide-11
SLIDE 11

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 (X ≤ 0) (true) skip 4 5 skip (true) 2 3 (l5 = false) if (l2) l5 := true l5 :=? else (true)

Javier Esparza Part III: Abstraction Refinement

slide-12
SLIDE 12

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 l2 := true (true) skip 4 5 skip (true) 2 3 (l5 = false) if (l2) l5 := true l5 :=? else (true)

Javier Esparza Part III: Abstraction Refinement

slide-13
SLIDE 13

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 4 5 2 3 (l5 = false) l5 := true l5 :=? else if (l2) l2 := true (true) skip (true) skip skip

Javier Esparza Part III: Abstraction Refinement

slide-14
SLIDE 14

Example

error 2 1 (Y ≤ 0) 5 (X + Y > 0) (X ≤ 0) {X ≤ 0} {X + Y ≤ 0} {false} {true}

l2 = (X ≤ 0) l5 = (X + Y ≤ 0)

error

  • k

1 4 5 2 3 skip (l5 = false) l5 := true l5 :=? else if (l2) l2 := true (true) skip (true) skip

Javier Esparza Part III: Abstraction Refinement

slide-15
SLIDE 15

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4

The concrete instructions are inserted again.

Javier Esparza Part III: Abstraction Refinement

slide-16
SLIDE 16

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious?

Javier Esparza Part III: Abstraction Refinement

slide-17
SLIDE 17

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious? Spurious! ⇒ Hoare-like proof

Javier Esparza Part III: Abstraction Refinement

slide-18
SLIDE 18

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

l2 ↔ (X ≤ 0) l4 ↔ (X − Y ≤ 0) l5 ↔ (X + Y ≤ 0)

error

  • k

1 4 5 2 3 (l5 = false) l2 := true (X > 0) X := −X (Y > 0) Y := −Y if (l2) l5 := true l5 :=? else (X + Y ≤ 0)

Javier Esparza Part III: Abstraction Refinement

slide-19
SLIDE 19

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

l2 ↔ (X ≤ 0) l4 ↔ (X − Y ≤ 0) l5 ↔ (X + Y ≤ 0)

error

  • k

if (l2) l5 := true l5 :=? else 1 4 5 l5 := l4 2 3 (l5 = false) l2 := true (X + Y ≤ 0) (X > 0) l4 := true else if (l2) l4 :=? X := −X

Javier Esparza Part III: Abstraction Refinement

slide-20
SLIDE 20

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

l2 ↔ (X ≤ 0) l4 ↔ (X − Y ≤ 0) l5 ↔ (X + Y ≤ 0)

error

  • k

l4 := true else if (l2) l4 :=? if (l2) l5 := true l5 :=? else 1 l4 :=? 4 5 l5 := l4 2 3 (l5 = false) l2 := true (true) skip

Javier Esparza Part III: Abstraction Refinement

slide-21
SLIDE 21

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

l2 ↔ (X ≤ 0) l4 ↔ (X − Y ≤ 0) l5 ↔ (X + Y ≤ 0)

error

  • k

l4 := true else if (l2) l4 :=? if (l2) l5 := true l5 :=? else 1 skip 4 5 l5 := l4 2 3 (l5 = false) l2 := true (true) (true)

Javier Esparza Part III: Abstraction Refinement

slide-22
SLIDE 22

Example

2 (X ≤ 0) error 1 Y := −Y 5 (X + Y > 0) (Y > 0) 4 {false} {X + Y ≤ 0} {X − Y ≤ 0} {X ≤ 0} {true}

l2 ↔ (X ≤ 0) l4 ↔ (X − Y ≤ 0) l5 ↔ (X + Y ≤ 0)

error

  • k

l4 := true else if (l2) l4 :=? if (l2) l5 := true l5 :=? else 1 l4 :=? 4 5 l5 := l4 2 3 (l5 = false) l2 := true (true) (l5 = true)

Javier Esparza Part III: Abstraction Refinement

slide-23
SLIDE 23

Example

error 2 1 Y := −Y 5 (X + Y > 0) X := −X 4 (X > 0)

The concrete instructions are inserted again.

Javier Esparza Part III: Abstraction Refinement

slide-24
SLIDE 24

Example

error 2 1 Y := −Y 5 (X + Y > 0) X := −X 4 (X > 0)

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious?

Javier Esparza Part III: Abstraction Refinement

slide-25
SLIDE 25

Example

error 2 1 Y := −Y 5 (X + Y > 0) X := −X 4 (X > 0)

The concrete instructions are inserted again. Analysis of the trace Is it real or spurious? Real! ⇒ Report it to the user!

Javier Esparza Part III: Abstraction Refinement

slide-26
SLIDE 26

A Spurious Trace is an Unsatisfiable Formula.

D := C + 1 Y := D (Y = X + 1) 3 1 2 X := C 4 error

Javier Esparza Part III: Abstraction Refinement

slide-27
SLIDE 27

A Spurious Trace is an Unsatisfiable Formula.

D := C + 1 Y := D (Y = X + 1) 3 1 2 X := C 4 error (D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-28
SLIDE 28

What is a Hoare-Proof of Spuriousness?

D := C + 1 Y := D (Y = X + 1) {false} {Y = X + 1} {D = X + 1} {C = X} {true} 3 1 2 X := C 4 error

Javier Esparza Part III: Abstraction Refinement

slide-29
SLIDE 29

What is a Hoare-Proof of Spuriousness?

D := C + 1 Y := D (Y = X + 1) {false} {Y = X + 1} {D = X + 1} {C = X} {true} 3 1 2 X := C 4 error {false} {true} (D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) {C2 = X2} {D3 = X3 + 1} {Y4 = X4 + 1} (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-30
SLIDE 30

What is a Hoare Proof of Spuriousness?

Observations A blue predicate {· · · } is implied by the conjunction of the instructions above.

Javier Esparza Part III: Abstraction Refinement

slide-31
SLIDE 31

What is a Hoare Proof of Spuriousness?

Observations A blue predicate {· · · } is implied by the conjunction of the instructions above. A blue predicate is unsatisfiable together with the conjunction of the instructions below.

Javier Esparza Part III: Abstraction Refinement

slide-32
SLIDE 32

What is a Hoare Proof of Spuriousness?

Observations A blue predicate {· · · } is implied by the conjunction of the instructions above. A blue predicate is unsatisfiable together with the conjunction of the instructions below. A blue predicate, together with the next instruction, implies the next blue predicate. The last property is called Tracking Property.

Javier Esparza Part III: Abstraction Refinement

slide-33
SLIDE 33

Craig Interpolation in Propositional Logics

Definition (Craig interpolant) Let (F, G) be a pair of formulas with F ∧ G unsatisfiable. An interpolant for (F, G) is a formula I with the following properties: F | = I, I ∧ G is unsatisfiable and I refers only to the common variables of F and G.

Javier Esparza Part III: Abstraction Refinement

slide-34
SLIDE 34

Craig Interpolation in Propositional Logics

Definition (Craig interpolant) Let (F, G) be a pair of formulas with F ∧ G unsatisfiable. An interpolant for (F, G) is a formula I with the following properties: F | = I, I ∧ G is unsatisfiable and I refers only to the common variables of F and G. Example F = x ∧ y G = ¬x ∧ z I = x is an interpolant for (F, G).

Javier Esparza Part III: Abstraction Refinement

slide-35
SLIDE 35

Craig Interpolation: Our Application

{false} {true} (D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) {C2 = X2} {D3 = X3 + 1} {Y4 = X4 + 1} 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-36
SLIDE 36

Craig Interpolation: Our Application

(D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) {C2 = X2} 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-37
SLIDE 37

Craig Interpolation: Our Application

(D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) {D3 = X3 + 1} 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-38
SLIDE 38

Craig Interpolation: Our Application

(D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) {Y4 = X4 + 1} 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-39
SLIDE 39

Craig Interpolation: Our Application

{false} {true} (D3 = C2 + 1) ∧ (C3 = C2) ∧ (X3 = X2) ∧ (Y3 = Y2) (Y4 = D3) ∧ (C4 = C3) ∧ (D4 = D3) ∧ (X4 = X3) (Y4 = X4 + 1) ∧ (Cerror = C4) ∧ (Derror = D4) ∧ (Xerror = X4) ∧ (Yerror = Y4) {C2 = X2} {D3 = X3 + 1} {Y4 = X4 + 1} 1 2 4 error (X2 = C1) ∧ (C2 = C1) ∧ (D2 = D1) ∧ (Y2 = Y1) 3

Javier Esparza Part III: Abstraction Refinement

slide-40
SLIDE 40

Summary

Spurious traces ↔ unsatisfiable formula Craig interpolants satisfying the tracking property → Hoare proofs of spuriousness ‘Clean’ Hoare proofs of spuriousness → Craig interpolants

Javier Esparza Part III: Abstraction Refinement

slide-41
SLIDE 41

Weakest and Strongest Interpolants

Definition (weakest interpolant) The weakest interpolant for (F, G) is the interpolant for (F, G) that is implied by all interpolants for (F, G). It is denoted by WI(F, G). Definition (strongest interpolant) The strongest interpolant for (F, G) is the interpolant for (F, G) that implies all interpolants for (F, G). It is denoted by SI(F, G). We show how to compute them and that they satisfy the tracking property.

Javier Esparza Part III: Abstraction Refinement

slide-42
SLIDE 42

A Charaterization of Weakest Interpolants

Theorem (weakest interpolant) Let (F, G) be a pair of formulas with F ∧ G unsatisfiable. Let Z be the variables that occur in G, but not in F. Then WI(F, G) ≡ ∀Z.¬G.

Javier Esparza Part III: Abstraction Refinement

slide-43
SLIDE 43

A Charaterization of Weakest Interpolants

Theorem (weakest interpolant) Let (F, G) be a pair of formulas with F ∧ G unsatisfiable. Let Z be the variables that occur in G, but not in F. Then WI(F, G) ≡ ∀Z.¬G. Very adequate for computation with BDDs.

Javier Esparza Part III: Abstraction Refinement

slide-44
SLIDE 44

Efficient Computation of Weakest Interpolants

F2(X2, X3) F3(X3, X4) 1 2 3 4 F1(X1, X2)

Theorem Let F1 ∧ F2 ∧ F3 be unsatisfiable. Let X3 be the variables that occur in F2, but not in F1. Then WI(F1, F2 ∧ F3) ≡ ∀X3(F2 → WI(F1 ∧ F2, F3)). Corollary (Tracking Property) WI(F1, F2 ∧ F3) ∧ F2 | = WI(F1 ∧ F2, F3).

Javier Esparza Part III: Abstraction Refinement

slide-45
SLIDE 45

Interpolants Computation for a Spurious Trace

F1(X1, X2) F2(X2, X3) F3(X3, X4) 1 2 3 4 WI(true, F1 ∧ F2 ∧ F3) ≡ true WI(F1 ∧ F2 ∧ F3, true) ≡ false

Javier Esparza Part III: Abstraction Refinement

slide-46
SLIDE 46

Interpolants Computation for a Spurious Trace

WI(F1 ∧ F2 ∧ F3, true) ≡ false F1(X1, X2) F2(X2, X3) F3(X3, X4) 1 2 3 4 WI(true, F1 ∧ F2 ∧ F3) ≡ true WI(F1 ∧ F2, F3) ≡ J3(X3) ≡ ∀X4(F3 → false)

Javier Esparza Part III: Abstraction Refinement

slide-47
SLIDE 47

Interpolants Computation for a Spurious Trace

WI(F1 ∧ F2 ∧ F3, true) ≡ false WI(F1 ∧ F2, F3) ≡ J3(X3) ≡ ∀X4(F3 → false) F1(X1, X2) F2(X2, X3) F3(X3, X4) 1 2 3 4 WI(true, F1 ∧ F2 ∧ F3) ≡ true WI(F1, F2 ∧ F3) ≡ J2(X2) ≡ ∀X3(F2 → J3)

Javier Esparza Part III: Abstraction Refinement

slide-48
SLIDE 48

Interpolants Computation for a Spurious Trace

WI(F1 ∧ F2 ∧ F3, true) ≡ false WI(F1 ∧ F2, F3) ≡ J3(X3) ≡ ∀X4(F3 → false) WI(F1, F2 ∧ F3) ≡ J2(X2) ≡ ∀X3(F2 → J3) F1(X1, X2) F2(X2, X3) F3(X3, X4) 1 2 3 4 WI(true, F1 ∧ F2 ∧ F3) ≡ J1(X1) ≡ ∀X2(F1 → J2) ≡ true

Javier Esparza Part III: Abstraction Refinement

slide-49
SLIDE 49

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0)

Spurious Counterexample DAGs Each path through the DAG is a spurious counterexample. Each path through the DAG corresponds to an unsatisfiable formula. The disjunction of the trace formulas is unsatisfiable.

Javier Esparza Part III: Abstraction Refinement

slide-50
SLIDE 50

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0) {false} {X = 0}

Javier Esparza Part III: Abstraction Refinement

slide-51
SLIDE 51

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0) {false} {X = 0} {X = 0} {X = 0}

Javier Esparza Part III: Abstraction Refinement

slide-52
SLIDE 52

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0) {false} {X = 0} {(A = 0 → X = 0) {X = 0} {X = 0}

Javier Esparza Part III: Abstraction Refinement

slide-53
SLIDE 53

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0) {false} {X = 0} {(A = 0 → X = 0) ∧ (A = 0 → X = 0)} {X = 0} {X = 0}

Javier Esparza Part III: Abstraction Refinement

slide-54
SLIDE 54

DAGs of Spurious Counterexamples

3 4 error 1 2 (A = 0) X := 0 5 (A = 0) Y := 2 Y := 1 (X = 0) {false} {X = 0} {(A = 0 → X = 0) ∧ (A = 0 → X = 0)} ≡ {X = 0} {X = 0} {X = 0} {true}

Javier Esparza Part III: Abstraction Refinement

slide-55
SLIDE 55

There Are Many Interpolants.

F SI(F, G) WI(F, G) ¬G

Javier Esparza Part III: Abstraction Refinement

slide-56
SLIDE 56

There Are Many Interpolants.

F SI(F, G) WI(F, G) ¬G ≡ x ∨ y ∨ (z ∧ w) ≡ x ∧ (y ∨ z)

Javier Esparza Part III: Abstraction Refinement

slide-57
SLIDE 57

There Are Many Interpolants.

F SI(F, G) WI(F, G) ¬G ≡ x ∨ y ∨ (z ∧ w) ≡ x ∧ (y ∨ z) ≡ ∀{w}.¬G ≡ x ∨ y ≡ ∃{}.F ≡ x ∧ (y ∨ z)

Javier Esparza Part III: Abstraction Refinement

slide-58
SLIDE 58

There Are Many Interpolants.

F SI(F, G) WI(F, G) ¬G ≡ x ∨ y ∨ (z ∧ w) ≡ x ∧ (y ∨ z) ≡ ∀{w}.¬G ≡ x ∨ y ≡ ∃{}.F ≡ x ∧ (y ∨ z)

Javier Esparza Part III: Abstraction Refinement

slide-59
SLIDE 59

There Are Many Interpolants.

SI(F, G) WI(F, G) ≡ ∀{w}.¬G ≡ x ∨ y ≡ ∃{}.F ≡ x ∧ (y ∨ z)

Javier Esparza Part III: Abstraction Refinement

slide-60
SLIDE 60

There Are Many Interpolants.

SI(F, G) ≡ x ∧ (y ∨ z) WI(F, G) ≡ x ∨ y

Javier Esparza Part III: Abstraction Refinement

slide-61
SLIDE 61

There Are Many Interpolants.

SI(F, G) ≡ x ∧ (y ∨ z) WI(F, G) ≡ x ∨ y SI(x ∧ (y ∨ z), ¬(x ∨ y)) ≡ ∃{z}.(x ∧ (y ∨ z)) ≡ x

Javier Esparza Part III: Abstraction Refinement

slide-62
SLIDE 62

There Are Many Interpolants.

WI(F, G) ≡ x ∨ y SI(x ∧ (y ∨ z), ¬(x ∨ y)) ≡ ∃{z}.(x ∧ (y ∨ z)) ≡ x

Javier Esparza Part III: Abstraction Refinement

slide-63
SLIDE 63

There Are Many Interpolants.

x WI(x, ¬(x ∨ y)) ≡ ∀{y}.(x ∨ y) ≡ x x ∨ y

Javier Esparza Part III: Abstraction Refinement

slide-64
SLIDE 64

There Are Many Interpolants.

x WI(x, ¬(x ∨ y)) ≡ ∀{y}.(x ∨ y) ≡ x

Javier Esparza Part III: Abstraction Refinement

slide-65
SLIDE 65

There Are Many Interpolants.

x x

Javier Esparza Part III: Abstraction Refinement

slide-66
SLIDE 66

There Are Many Interpolants.

x x

Javier Esparza Part III: Abstraction Refinement

Fixed points have been reached. We call them conciliated interpolants.

slide-67
SLIDE 67

Conciliated Interpolants

What about the Tracking Property? Conciliated interpolants by themselves do not necessarily satisfy the tracking property. Therefore, we

1

apply a strongest interpolants computation (forward),

2

apply a backward computation and conciliate after each step with the strongest interpolant.

The resulting interpolants satisfy the tracking property.

Javier Esparza Part III: Abstraction Refinement

slide-68
SLIDE 68

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 {true} 3 {false} {W = 0} {W = 0 ∨ X = 0} 4 5 6 {W = 0 ∨ X = 0 ∨ Z = 0} Y := 0 {W = 0 ∨ X = 0 ∨ Z = 0}

slide-69
SLIDE 69

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0

slide-70
SLIDE 70

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {W = 0}

slide-71
SLIDE 71

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false}

slide-72
SLIDE 72

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0}

slide-73
SLIDE 73

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0}

slide-74
SLIDE 74

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0}

slide-75
SLIDE 75

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0} {X = 0}

slide-76
SLIDE 76

Conciliated Interpolants as a Simplification Procedure

{true} {X = 0} {false} (X = 0) {false} (W = 0) (Z = 0) {X = 0 ∧ Y = 0} {X = 0 ∧ Y = 0 ∧ Z = 0} 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0} {X = 0} {true}

slide-77
SLIDE 77

Conciliated Interpolants

(X = 0) (W = 0) (Z = 0) 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0} {X = 0} {true}

Conciliated Interpolants lead to predicates on fewer variables

slide-78
SLIDE 78

Conciliated Interpolants

(X = 0) (W = 0) (Z = 0) 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0} {X = 0} {true}

Conciliated Interpolants lead to predicates on fewer variables faster computation

slide-79
SLIDE 79

Conciliated Interpolants

(X = 0) (W = 0) (Z = 0) 2 1 X := 0 3 {false} 4 5 6 Y := 0 {false} {X = 0} {X = 0} {X = 0} {true}

Conciliated Interpolants lead to predicates on fewer variables faster computation more meaningful predicates

slide-80
SLIDE 80

A Locking Example

struct file { bool locked; int pos; };

  • pen(file f) {

assert(¬f.locked); f.locked = true; f.pos = 0; } close(file f) { assert(f.locked ∨ f.pos==0); f.locked = false; } rw(file f) { assert(f.locked ∨ f.pos==0); f.pos = f.pos + 1; } main() { file f1,f2; f1.locked = f2.locked = false;

  • pen(f1);

while(*) {

  • pen(f2);

while(*) { rw(f2); rw(f1); } close(f2); } close(f1); }

Javier Esparza Part III: Abstraction Refinement

slide-81
SLIDE 81

Experimental Results

memory time/s (BDD nodes) # cycles w/o abstraction 460 440482 n/a weakest interp. 0.43 89936 14

  • concil. interp.

0.29 80738 10

Javier Esparza Part III: Abstraction Refinement

slide-82
SLIDE 82

Summary

Craig interpolation goes well with CEGAR if the program is given in terms of BDDs. Multiple counterexamples can be excluded at once. There are heuristics to enhance predicate generation. The model-checking process can be speeded up.

Javier Esparza Part III: Abstraction Refinement