Predicate-Based Model Checking Dirk Beyer LMU Munich, Germany Dirk - - PowerPoint PPT Presentation

▶
predicate based model checking
SMART_READER_LITE
LIVE PREVIEW

Predicate-Based Model Checking Dirk Beyer LMU Munich, Germany Dirk - - PowerPoint PPT Presentation

Jul 27, 2023 38 likes •664 views

Predicate-Based Model Checking Dirk Beyer LMU Munich, Germany Dirk Beyer LMU Munich, Germany 1 / 1 Based on: Dirk Beyer, Matthias Dangl, Philipp Wendler: A Unifying View on SMT-Based Software Verification Journal of Automated Reasoning,

slide-1
SLIDE 1

Predicate-Based Model Checking

Dirk Beyer

LMU Munich, Germany

Dirk Beyer LMU Munich, Germany 1 / 1

slide-2
SLIDE 2

Based on: Dirk Beyer, Matthias Dangl, Philipp Wendler: A Unifying View on SMT-Based Software Verification Journal of Automated Reasoning, Volume 60, Issue 3, 2018. https://doi.org/10.1007/s10817-017-9432-6 preprint: online on CPAchecker website under “Documentation”

Dirk Beyer LMU Munich, Germany 2 / 1

slide-3
SLIDE 3

SMT-based Software Model Checking

◮ Predicate Abstraction (Blast, CPAchecker, Slam, ...) ◮ Impact (CPAchecker, Impact, Wolverine, ...) ◮ Bounded Model Checking (Cbmc, CPAchecker, Esbmc, ...) ◮ k-Induction (CPAchecker, Esbmc, 2ls, ...)

Dirk Beyer LMU Munich, Germany 3 / 1

slide-4
SLIDE 4

Base: Adjustable-Block Encoding

Originally for predicate abstraction: ◮ Abstraction computation is expensive ◮ Abstraction is not necessary after every transition ◮ Track precise path formula between abstraction states ◮ Reset path formula and compute abstraction formula at abstraction states ◮ Large-Block Encoding: abstraction only at loop heads (hard-coded) ◮ Adjustable-Block Encoding: introduce block operator "blk" to make it configurable

Dirk Beyer LMU Munich, Germany 4 / 1

slide-5
SLIDE 5

Base: Configurable Program Analysis

Configurable Program Analysis (CPA): ◮ Beyer, Henzinger, Théoduloz: [CAV’07] ◮ One single unifying algorithm for all algorithms based on state-space exploration ◮ Configurable components: abstract domain, abstract-successor computation, path sensitivity, ...

Dirk Beyer LMU Munich, Germany 5 / 1

slide-6
SLIDE 6

Using the CPA Framework

◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains

Source Code Results Parser & CFA Builder CPA Algorithm

Dirk Beyer LMU Munich, Germany 6 / 1

slide-7
SLIDE 7

Using the CPA Framework

◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain

Source Code Results Parser & CFA Builder CPA Algorithm Predicate CPA

Dirk Beyer LMU Munich, Germany 6 / 1

slide-8
SLIDE 8

Using the CPA Framework

◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain ◮ Reuse other CPAs

Source Code Spec Results Parser & CFA Builder CPA Algorithm Spec CPA Location CPA Loop-Bound CPA Predicate CPA

Dirk Beyer LMU Munich, Germany 6 / 1

slide-9
SLIDE 9

Using the CPA Framework

◮ CPA Algorithm is a configurable reachability analysis for arbitrary abstract domains ◮ Provide Predicate CPA for our predicate-based abstract domain ◮ Reuse other CPAs ◮ Built further algorithms on top that make use of reachability analysis

Source Code Spec Results Parser & CFA Builder k-induction Algorithm CEGAR Algorithm CPA Algorithm Spec CPA Location CPA Loop-Bound CPA Predicate CPA

Dirk Beyer LMU Munich, Germany 6 / 1

slide-10
SLIDE 10

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Dirk Beyer LMU Munich, Germany 7 / 1

slide-11
SLIDE 11

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP fcoverP refineP Dirk Beyer LMU Munich, Germany 7 / 1

slide-12
SLIDE 12

Predicate CPA: Abstract Domain

◮ Abstract state: (ψ, ϕ)

◮ tuple of abstraction formula ψ and path formula ϕ (for ABE) ◮ conjunctions represents state space ◮ abstraction formula can be a BDD or an SMT formula ◮ path formula is always SMT formula and concrete

Dirk Beyer LMU Munich, Germany 8 / 1

slide-13
SLIDE 13

Predicate CPA: Abstract Domain

◮ Abstract state: (ψ, ϕ)

◮ tuple of abstraction formula ψ and path formula ϕ (for ABE) ◮ conjunctions represents state space ◮ abstraction formula can be a BDD or an SMT formula ◮ path formula is always SMT formula and concrete

◮ Precision: set of predicates (per program location)

Dirk Beyer LMU Munich, Germany 8 / 1

slide-14
SLIDE 14

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Abstraction-Formula Representation BDD SMT-based fcoverP refineP Dirk Beyer LMU Munich, Germany 9 / 1

slide-15
SLIDE 15

Predicate CPA: CPA Operators

◮ Transfer relation:

◮ computes strongest post ◮ changes only path formula, new abstract state is (ψ, ϕ′) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations)

Dirk Beyer LMU Munich, Germany 10 / 1

slide-16
SLIDE 16

Predicate CPA: CPA Operators

◮ Transfer relation:

◮ computes strongest post ◮ changes only path formula, new abstract state is (ψ, ϕ′) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations)

◮ Merge operator:

◮ standard for ABE: create disjunctions inside block

Dirk Beyer LMU Munich, Germany 10 / 1

slide-17
SLIDE 17

Predicate CPA: CPA Operators

◮ Transfer relation:

◮ computes strongest post ◮ changes only path formula, new abstract state is (ψ, ϕ′) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations)

◮ Merge operator:

◮ standard for ABE: create disjunctions inside block

◮ Stop operator:

◮ standard for ABE: check coverage only at block ends

Dirk Beyer LMU Munich, Germany 10 / 1

slide-18
SLIDE 18

Predicate CPA: CPA Operators

◮ Transfer relation:

◮ computes strongest post ◮ changes only path formula, new abstract state is (ψ, ϕ′) ◮ purely syntactic, cheap ◮ variety of encodings using different SMT theories possible (different approximations for arithmetic and heap operations)

◮ Merge operator:

◮ standard for ABE: create disjunctions inside block

◮ Stop operator:

◮ standard for ABE: check coverage only at block ends

◮ Precision-adjustment operator:

◮ only active at block ends (as determined by blk) ◮ computes abstraction of current abstract state ◮ new abstract state is (ψ′, true)

Dirk Beyer LMU Munich, Germany 10 / 1

slide-19
SLIDE 19

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP refineP Dirk Beyer LMU Munich, Germany 11 / 1

slide-20
SLIDE 20

Predicate CPA: Refinement

Four steps:

  • 1. Reconstruct ARG path to abstract error state
  • 2. Check feasibility of path
  • 3. Discover abstract facts, e.g.,

◮ interpolants ◮ weakest precondition ◮ heuristics

  • 4. Refine abstract model

◮ add predicates to precision, cut ARG

  • r

◮ conjoin interpolants to abstract states, recheck coverage relation

Dirk Beyer LMU Munich, Germany 12 / 1

slide-21
SLIDE 21

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 13 / 1

slide-22
SLIDE 22

Predicate Abstraction

◮ Predicate Abstraction

◮ [CAV’97, POPL’02, J. ACM’03, POPL’04] ◮ Abstract-interpretation technique ◮ Abstract domain constructed from a set of predicates π ◮ Use CEGAR to add predicates to π (refinement) ◮ Derive new predicates using Craig interpolation ◮ Abstraction formula as BDD

Dirk Beyer LMU Munich, Germany 14 / 1

slide-23
SLIDE 23

Expressing Predicate Abstraction

◮ Abstraction Formulas: BDDs ◮ Block Size (blk): e.g. blkSBE or blkl or blklf ◮ Refinement Strategy: add predicates to precision, cut ARG Use CEGAR Algorithm:

1: while true do 2:

run CPA Algorithm

3:

if target state found then

4:

call refine

5:

if target state reachable then

6:

return false

7:

else

8:

return true

Dirk Beyer LMU Munich, Germany 15 / 1

slide-24
SLIDE 24

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 16 / 1

slide-25
SLIDE 25

Example Program

1

int main () {

2

unsigned int x = 0;

3

unsigned int y = 0;

4

while ( x < 2) {

5

x++;

6

y++;

7

i f ( x != y ) {

8

ERROR: return 1;

9

}

10

}

11

return 0;

12

}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

Dirk Beyer LMU Munich, Germany 17 / 1

slide-26
SLIDE 26

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 18 / 1

slide-27
SLIDE 27

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-28
SLIDE 28

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, x0 = 0 ∧ y0 = 0))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-29
SLIDE 29

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-30
SLIDE 30

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2)))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-31
SLIDE 31

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-32
SLIDE 32

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬¬(x1 = y1)))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-33
SLIDE 33

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, true))

Dirk Beyer LMU Munich, Germany 19 / 1

slide-34
SLIDE 34

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, true)) covered by

Dirk Beyer LMU Munich, Germany 19 / 1

slide-35
SLIDE 35

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, true)) e9: (l8, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1))) covered by

Dirk Beyer LMU Munich, Germany 19 / 1

slide-36
SLIDE 36

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, true)) e9: (l8, (false, true)) covered by

Dirk Beyer LMU Munich, Germany 19 / 1

slide-37
SLIDE 37

Predicate Abstraction: Example

with blkl, π(l4) = {x = y} and π(l8) = {false}

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)]

e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (x = y, ¬(x0 < 2))) e4: (l12, (x = y, ¬(x0 < 2))) e5: (l5, (x = y, x0 < 2)) e6: (l6, (x = y, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (x = y, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l4, (x = y, true)) e9: (l8, (false, true)) covered by

Dirk Beyer LMU Munich, Germany 19 / 1

slide-38
SLIDE 38

Impact

◮ Impact

◮ "Lazy Abstraction with Interpolants" [CAV’06] ◮ Abstraction is derived dynamically/lazily ◮ Solution to avoiding expensive abstraction computations ◮ Compute fixed point over three operations

◮ Expand ◮ Refine ◮ Cover

◮ Abstraction formula as SMT formula ◮ Optimization: forced covering

Dirk Beyer LMU Munich, Germany 20 / 1

slide-39
SLIDE 39

Expressing Impact

◮ Abstraction Formulas: SMT-based ◮ Block Size (blk): blkSBE or other (new!) ◮ Refinement Strategy: conjoin interpolants to abstract states, recheck coverage relation Furthermore: ◮ Use CEGAR Algorithm ◮ Precision stays empty → predicate abstraction never computed

Dirk Beyer LMU Munich, Germany 21 / 1

slide-40
SLIDE 40

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 22 / 1

slide-41
SLIDE 41

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 23 / 1

slide-42
SLIDE 42

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, x0 = 0 ∧ y0 = 0))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-43
SLIDE 43

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-44
SLIDE 44

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2)))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-45
SLIDE 45

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-46
SLIDE 46

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1)))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-47
SLIDE 47

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (true, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (true, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-48
SLIDE 48

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-49
SLIDE 49

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬¬(x1 = y1)))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-50
SLIDE 50

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (true, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-51
SLIDE 51

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (true, true)) e10: (l5, (true, x1 < 2)) e11: (l6, (true, x1 < 2 ∧ x2 = x1 + 1)) e12: (l7, (true, x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1)) e13: (l8, (true, x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1 ∧ ¬(x2 = y2)))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-52
SLIDE 52

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (true, true)) e10: (l5, (true, x1 < 2)) e11: (l6, (true, x1 < 2 ∧ x2 = x1 + 1)) e12: (l7, (true, x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1)) e13: (l8, (true, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-53
SLIDE 53

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (x = y, true)) e10: (l5, (true, x1 < 2)) e11: (l6, (true, x1 < 2 ∧ x2 = x1 + 1)) e12: (l7, (true, x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1)) e13: (l8, (false, true))

Dirk Beyer LMU Munich, Germany 24 / 1

slide-54
SLIDE 54

Impact: Example

with blkl

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true)) e1: (l3, (true, x0 = 0)) e2: (l4, (x = y, true)) e3: (l11, (true, ¬(x0 < 2))) e4: (l12, (true, ¬(x0 < 2))) e5: (l5, (true, x0 < 2)) e6: (l6, (true, x0 < 2 ∧ x1 = x0 + 1)) e7: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1)) e8: (l8, (false, true)) e9: (l4, (x = y, true)) e10: (l5, (true, x1 < 2)) e11: (l6, (true, x1 < 2 ∧ x2 = x1 + 1)) e12: (l7, (true, x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1)) e13: (l8, (false, true)) covered by

Dirk Beyer LMU Munich, Germany 24 / 1

slide-55
SLIDE 55

Bounded Model Checking

◮ Bounded Model Checking:

◮ Biere, Cimatti, Clarke, Zhu: [TACAS’99] ◮ No abstraction ◮ Unroll loops up to a loop bound k ◮ Check that P holds in the first k iterations:

k

  • i=1

P(i)

Dirk Beyer LMU Munich, Germany 25 / 1

slide-56
SLIDE 56

Expressing BMC

◮ Block Size (blk): blknever Furthermore: ◮ Add CPA for bounding state space (e.g., loop bounds) ◮ Choices for abstraction formulas and refinement irrelevant because block end never encountered ◮ Use Algorithm for iterative BMC:

1: k = 1 2: while !finished do 3:

run CPA Algorithm

4:

check feasibility of each abstract error state

5:

k++

Dirk Beyer LMU Munich, Germany 26 / 1

slide-57
SLIDE 57

Predicate CPA

Predicate CPA P DP = (C, EP, [ [·] ]P) ΠP P mergeP stopP precP Strongest Postcondition SMT Theory ABVFP . . . QF_UFLIRA Abstraction-Formula Representation BDD SMT-based Predicate Abstraction Cartesian Boolean blk blkSBE blkl blklf blknever fcoverP fcoverid fcoverImpact refineP Abstract Facts Interpolants Path Invariants Unsat Cores Weakest Preconditions Heuristic Predicates Refinement Strategy Predicate

Impact

Dirk Beyer LMU Munich, Germany 27 / 1

slide-58
SLIDE 58

Bounded Model Checking: Example with k = 1

l2 start l3 l4 l5 l6 l7 l8 l11 l12 unsigned int x = 0; unsigned int y = 0; [x < 2] [!(x < 2)] x++; y++; [x != y] ERROR: return 1; return 0; [!(x != y)] e0: (l2, (true, true), {l4 → −1}) e1: (l3, (true, x0 = 0), {l4 → −1}) e2: (l4, (true, x0 = 0 ∧ y0 = 0), {l4 → 0}) e3: (l11, (true, x0 = 0 ∧ y0 = 0 ∧ ¬(x0 < 2)), {l4 → 0}) e4: (l12, (true, x0 = 0 ∧ y0 = 0 ∧ ¬(x0 < 2)), {l4 → 0}) e5: (l5, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2), {l4 → 0}) e6: (l6, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2 ∧ x1 = x0 + 1), {l4 → 0}) e7: (l7, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1), {l4 → 0}) e8: (l8, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1)), {l4 → 0}) e9: (l12, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1)), {l4 → 0}) e10: (l4, (true, x0 = 0 ∧ y0 = 0 ∧ x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1))), {l4 → 1}) Dirk Beyer LMU Munich, Germany 28 / 1

slide-59
SLIDE 59

1-Induction

◮ 1-Induction:

◮ Base case: Check that the safety property holds in the first loop iteration: P(1) → Equivalent to BMC with loop bound 1 ◮ Step case: Check that the safety property is 1-inductive: ∀n : (P(n) ⇒ P(n + 1))

Dirk Beyer LMU Munich, Germany 29 / 1

slide-60
SLIDE 60

k-Induction

◮ k-Induction generalizes the induction principle:

◮ No abstraction ◮ Base case: Check that P holds in the first k iterations: → Equivalent to BMC with loop bound k ◮ Step case: Check that the safety property is k-inductive: ∀n :

k

  • i=1

P(n + i − 1)

  • ⇒ P(n + k)
  • ◮ Stronger hypothesis is more likely to succeed

◮ Add auxiliary invariants ◮ Kahsai, Tinelli: [PDMC’11]

Dirk Beyer LMU Munich, Germany 30 / 1

slide-61
SLIDE 61

k-Induction with Auxiliary Invariants

Induction:

1: k = 1 2: while !finished do 3:

BMC(k)

4:

Induction(k, invariants)

5:

k++ Invariant generation:

1: prec = <weak> 2: invariants = ∅ 3: while !finished do 4:

invariants = GenInv(prec)

5:

prec = RefinePrec(prec)

Dirk Beyer LMU Munich, Germany 31 / 1

slide-62
SLIDE 62

k-Induction: Example

e0: (l4, (true, true), {l4 → 0}) e1: (l11, (true, ¬(x0 < 2)), {l4 → 0}) e2: (l12, (true, ¬(x0 < 2)), {l4 → 0}) e3: (l5, (true, x0 < 2), {l4 → 0}) e4: (l6, (true, x0 < 2 ∧ x1 = x0 + 1), {l4 → 0}) e5: (l7, (true, ∧x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1), {l4 → 0}) e6: (l8, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1)), {l4 → 0}) e7: (l12, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(x1 = y1)), {l4 → 0}) e8: (l4, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1))), {l4 → 1}) e9: (l11, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ ¬(x1 < 2)), {l4 → 1}) e10: (l12, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ ¬(x1 < 2)), {l4 → 1}) e11: (l5, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x1 < 2), {l4 → 1}) e12: (l6, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x1 < 2 ∧ x2 = x1 + 1), {l4 → 1}) e13: (l7, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x1 < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1), {l4 → 1}) e14: (l8, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1 ∧ ¬(x2 = y2)), {l4 → 1}) e15: (l12, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1 ∧ ¬(x2 = y2)), {l4 → 1}) e16: (l4, (true, x0 < 2 ∧ x1 = x0 + 1 ∧ y1 = y0 + 1 ∧ ¬(¬(x1 = y1)) ∧ x < 2 ∧ x2 = x1 + 1 ∧ y2 = y1 + 1 ∧ ¬(¬(x2 = y2))), {l4 → 2})

Dirk Beyer LMU Munich, Germany 32 / 1