Property-Directed k-Induction Dejan Jovanovi Bruno Dutertre SRI - PowerPoint PPT Presentation

Property-Directed k-Induction Dejan Jovanović Bruno Dutertre SRI International FMCAD 2016, Mountain View, CA Thanks to NASA

Outline Introduction 1 Property-Directed k-Induction 2 Experimental Evaluation 3

Outline Introduction 1 Property-Directed k-Induction 2 Experimental Evaluation 3

Introduction the problem Given a transition system S = ⟨ I , T ⟩ with x : state variables, ⃗ I ( ⃗ x ) : initial state formula, T ( ⃗ x ,⃗ x ′ ) : state transition formula, check whether all reachable states satisfy a property P . Example: Zeno Given S = ⟨ I , T ⟩ with T ≡ ( x ′ = x + y ) ∧ ( y ′ = y /2) , I ≡ ( x = 0) ∧ ( y = 0 . 5) , check whether ( x < 1) .

Introduction the problem Automation goals Given a transition system S = ⟨ I , T ⟩ with Find bugs 1 x : state variables, Prove properties ⃗ 2 I ( ⃗ x ) : initial state formula, T ( ⃗ x ,⃗ x ′ ) : state transition formula, check whether all reachable states satisfy a property P . Example: Zeno Given S = ⟨ I , T ⟩ with T ≡ ( x ′ = x + y ) ∧ ( y ′ = y /2) , I ≡ ( x = 0) ∧ ( y = 0 . 5) , check whether ( x < 1) .

Finite reachability Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction bounded model checking

Finite reachability Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction bounded model checking I ( ⃗ x 0 ) ∧ ¬ P ( ⃗ x 0 )

Finite reachability Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction bounded model checking I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ ¬ P ( ⃗ x 1 )

Finite reachability Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction bounded model checking I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ ¬ P ( ⃗ x 2 )

Finite reachability Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction bounded model checking I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ∧ ¬ P ( ⃗ x 3 )

Finite reachability Introduction bounded model checking I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ∧ ¬ P ( ⃗ x 3 ) Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive

Introduction bounded model checking I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ∧ ¬ P ( ⃗ x 3 ) Can find bugs, can not prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Finite reachability �

I x P x P x T x x P x Can prove properties Can use ofg-the-shelf SAT/SMT solver Introduction induction

P x T x x P x Can prove properties Can use ofg-the-shelf SAT/SMT solver Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P I

Can prove properties Can use ofg-the-shelf SAT/SMT solver Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) P P T

Can prove properties Can use ofg-the-shelf SAT/SMT solver Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) P P P T T

Can prove properties Can use ofg-the-shelf SAT/SMT solver Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) P P P P T T T

Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) Can prove properties Can use ofg-the-shelf SAT/SMT solver

Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) Zeno Can prove properties I ≡ ( x = 0) ∧ ( y = 0 . 5) Can use ofg-the-shelf SAT/SMT solver T ≡ ( x ′ = x + y ) ∧ ( y ′ = y /2) Zeno: property ( x < 1) is not inductive P ≡ ( x < 1)

Introduction induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) Zeno Can prove properties I ≡ ( x = 0) ∧ ( y = 0 . 5) Can use ofg-the-shelf SAT/SMT solver T ≡ ( x ′ = x + y ) ∧ ( y ′ = y /2) Zeno: property ( x < 1) ∧ ( x + 2 y ≤ 1) is inductive P ≡ ( x < 1)

I x P x I x T x x P x I x T x x T x x P x P x T x x P x T x x P x T x x P x Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction

I x T x x P x I x T x x T x x P x P x T x x P x T x x P x T x x P x Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) P I

I x T x x T x x P x P x T x x P x T x x P x T x x P x Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) P P T I

P x T x x P x T x x P x T x x P x Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P P P T T I

Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ P ( ⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ P ( ⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ⇒ P ( ⃗ x 3 ) P P P P T T T

Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ P ( ⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ P ( ⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ⇒ P ( ⃗ x 3 ) P P P P P T T T T

Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ P ( ⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ P ( ⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ⇒ P ( ⃗ x 3 ) Can find bugs, can prove properties Can use ofg-the-shelf SAT/SMT solver For non-trivial systems unrolling can be expensive

Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ P ( ⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ P ( ⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ⇒ P ( ⃗ x 3 ) Stronger Can find bugs, can prove properties I ≡ ( x = 0) ∧ ( y = 0) Can use ofg-the-shelf SAT/SMT solver T ≡ ( x ′ = 3 5 x + 2 For non-trivial systems unrolling can be expensive 5 y ) ∧ ( | y ′ | < 1) Example: property ( | x | < 1) is not inductive P ≡ ( | x | < 1)

Introduction k -induction I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 ) I ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ⇒ P ( ⃗ x 2 ) P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ∧ P ( ⃗ x 1 ) ∧ T ( ⃗ x 1 ,⃗ x 2 ) ∧ P ( ⃗ x 2 ) ∧ T ( ⃗ x 2 ,⃗ x 3 ) ⇒ P ( ⃗ x 3 ) Stronger Can find bugs, can prove properties I ≡ ( x = 0) ∧ ( y = 0) Can use ofg-the-shelf SAT/SMT solver T ≡ ( x ′ = 3 5 x + 2 For non-trivial systems unrolling can be expensive 5 y ) ∧ ( | y ′ | < 1) Example: property ( | x | < 1) is 2-inductive P ≡ ( | x | < 1)

x P x Same for k -induction Is k -induction stronger? Introduction strengthening Key problem: find a strengthening that proves the property P P I ( ⃗ x 0 ) ⇒ P ( ⃗ x 0 ) T P ( ⃗ x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ P ( ⃗ x 1 )

Same for k -induction Is k -induction stronger? Introduction strengthening F F Key problem: find a strengthening that proves the property P P I ( ⃗ x 0 ) ⇒ F ( ⃗ x 0 ) T x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ F ( ⃗ x 1 ) F ( ⃗ L 1 L 1 x ) ⇒ P ( ⃗ x ) F ( ⃗

Same for k -induction Is k -induction stronger? Introduction strengthening F F Key problem: find a strengthening that proves the property P P I ( ⃗ x 0 ) ⇒ F ( ⃗ x 0 ) T x 0 ) ∧ T ( ⃗ x 0 ,⃗ x 1 ) ⇒ F ( ⃗ x 1 ) F ( ⃗ L 1 L 1 x ) ⇒ P ( ⃗ x ) F ( ⃗ L 2 L 2