Reasoning about nondeterminism in software IBM Programming - - PowerPoint PPT Presentation

▶
reasoning about nondeterminism in software
SMART_READER_LITE
LIVE PREVIEW

Reasoning about nondeterminism in software IBM Programming - - PowerPoint PPT Presentation

Jan 08, 2023 287 likes •1.57k views

Reasoning about nondeterminism in software IBM Programming Languages Day 2012 Eric Koskinen Research Scientist and Principal Investigator New York University ejk@cims.nyu.edu Monday, June 25, 12 Prove temporal properties of real programs

slide-1
SLIDE 1

Reasoning about nondeterminism in software

IBM Programming Languages Day 2012 Eric Koskinen Research Scientist and Principal Investigator New York University

ejk@cims.nyu.edu

Monday, June 25, 12

slide-2
SLIDE 2

Prove temporal properties of real programs

Monday, June 25, 12

slide-3
SLIDE 3

/* * StreamServerPort -- open a "listening" port to accept connections. * * Successfully opened sockets are added to the ListenSocket[] array, * at the first position that isn't -1. * * RETURNS: STATUS_OK or STATUS_ERROR */ int StreamServerPort(int family, char *hostName, unsigned short portNumber, char *unixSocketName, int ListenSocket[], int MaxListen) void body() { /* Initialize hint structure */ #ifdef HAVE_UNIX_SOCKETS if (family == AF_UNIX) { /* Lock_AF_UNIX will also fill in sock_path. */ /* if (Lock_AF_UNIX(portNumber, unixSocketName) != STATUS_OK) */ /* return STATUS_ERROR; */ service = sock_path; } else #endif /* HAVE_UNIX_SOCKETS */ { snprintf(1, sizeof(1), "%d", portNumber); service = 1; } ret = getaddrinfo_all(hostName, service, &hint, &addrs); if (ret || !addrs) {

  • if (hostName) {

/* ereport(LOG, */ /* (errmsg("could not translate host name \"%s\", service \"%s\" to address: %s", */ /* hostName, service, gai_strerror(ret)))); */

  • } else {

/* ereport(LOG, */ /* (errmsg("could not translate service \"%s\" to address: %s", */

int StreamServerPort(int family, ...)

PostgreSQL StreamServer

Monday, June 25, 12

slide-4
SLIDE 4

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

int StreamServerPort(int family, ...)

PostgreSQL StreamServer

Monday, June 25, 12

slide-5
SLIDE 5

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer

Monday, June 25, 12

slide-6
SLIDE 6

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-7
SLIDE 7

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer Previous technique Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-8
SLIDE 8

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer Previous technique timeout Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-9
SLIDE 9

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer Previous technique timeout Our work Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-10
SLIDE 10

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer

✔

Previous technique timeout Our work Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-11
SLIDE 11

*/ err = nondet(); // bind(fd, addr->ai_addr, addr->ai_addrlen); if (err < 0) { /* ereport(LOG, */ /* (errcode_for_socket_access(), */ /* /\* translator: %s is IPv4, IPv6, or Unix *\/ */ /* errmsg("could not bind %s socket: %m", */ /* familyDesc), */ /* (IS_AF_UNIX(addr_ai_family)) ? */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, remove socket file \"%s\" and retry.", */ /* (int) portNumber, sock_path) : */ /* errhint("Is another postmaster already running on port %d?" */ /* " If not, wait a few seconds and retry.", */ /* (int) portNumber))); */ closesocket(fd); continue; } #ifdef HAVE_UNIX_SOCKETS if (addr_ai_family == AF_UNIX) {

  • if (nondet() != STATUS_OK)

{ closesocket(fd); break; } } #endif /* * Select appropriate accept-queue length limit. PG_SOMAXCONN is * only intended to provide a clamp on the request on platforms * where an overly large request provokes a kernel error (are * there any?). */ maxconn = MaxBackends * 2; if (maxconn > PG_SOMAXCONN) maxconn = PG_SOMAXCONN; err = listen(fd, maxconn); if (err < 0) { closesocket(fd); continue; } ListenSocket_OF_listen_index = fd; added++; } //freeaddrinfo_all(hint.ai_family, addrs);

(G ¬error) ⇒ F (added>0 ∧ F ret=OK)

int StreamServerPort(int family, ...)

PostgreSQL StreamServer

✔

9.56 s Previous technique timeout Our work Proving this statically is challenging. Reason about termination. Reason about reachability.

Monday, June 25, 12

slide-12
SLIDE 12

Previous work

P ⊢ φ

∀CTL

Reduction

CAV’11

program analysis task (symbolic MC, AI) using Frontiers

Monday, June 25, 12

slide-13
SLIDE 13

Previous work

P ⊢ φ

∀CTL

Reduction

CAV’11

program analysis task (symbolic MC, AI) using Frontiers

These tools are good at finding the “right” abstraction

Monday, June 25, 12

slide-14
SLIDE 14

Previous work

P ⊢ φ

∀CTL

Reduction

CAV’11

program analysis task (symbolic MC, AI) using Frontiers

These tools are good at finding the “right” abstraction

P ⊢ φ

LTL

Trace-based properties (eg. LTL)

POPL’11

synth decision predicates

Monday, June 25, 12

slide-15
SLIDE 15

Previous work

P ⊢ φ

∀CTL

Reduction

CAV’11

program analysis task (symbolic MC, AI) using Frontiers

These tools are good at finding the “right” abstraction

P ⊢ φ

LTL

Trace-based properties (eg. LTL)

POPL’11

synth decision predicates

prove trace-based with iterated state-based techniques

Monday, June 25, 12

slide-16
SLIDE 16

Traditional Program Property Time(s) Example from Sec. 2 AFAGp 2.32

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 Toy acq/rel AG(p⇒AFq) 103.48 Toy lin. arith. 1 p⇒AFq 126.86 Toy lin. arith. 2 p⇒AFq timeout PostgreSQL strsrv AG(p⇒AFAGq) timeout PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 PostgreSQL pgarch AFAGp 31.50 PostgreSQL dropbuf AGp timeout PostgreSQL dropbuf AG(p⇒AFq) 53.99 Apache child AG(p⇒AGAFq) timeout Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 Windows frag. 1 AG(p⇒AFq) 901.81 Windows frag. 2 AFAGp 16.47 Windows frag. 2+bug AFAGp 26.15 Windows frag. 3 AFAGp 4.21 Windows frag. 4 AG(p⇒AFq) timeout Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 Windows frag. 5 AG(p⇒AFq) timeout Windows frag. 6 AFAGp 149.41 Windows frag. 6+bug AFAGp 6.06 Windows frag. 7 AGAFp timeout Windows frag. 8 FGp timeout

Previous work

Monday, June 25, 12

slide-17
SLIDE 17

Traditional Our Approach Program Property Time(s) Time(s) Example from Sec. 2 AFAGp 2.32 1.98

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 27.94 Toy acq/rel AG(p⇒AFq) 103.48 14.18 Toy lin. arith. 1 p⇒AFq 126.86 34.51 Toy lin. arith. 2 p⇒AFq timeout 6.74 PostgreSQL strsrv AG(p⇒AFAGq) timeout 9.56 PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 47.16 PostgreSQL pgarch AFAGp 31.50 15.20 PostgreSQL dropbuf AGp timeout 1.14 PostgreSQL dropbuf AG(p⇒AFq) 53.99 27.54 Apache child AG(p⇒AGAFq) timeout 197.41 Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 684.24 Windows frag. 1 AG(p⇒AFq) 901.81 539.00 Windows frag. 2 AFAGp 16.47 52.10 Windows frag. 2+bug AFAGp 26.15 30.37 Windows frag. 3 AFAGp 4.21 15.75 Windows frag. 4 AG(p⇒AFq) timeout 1,114.18 Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 100.68 Windows frag. 5 AG(p⇒AFq) timeout timeout Windows frag. 6 AFAGp 149.41 59.56 Windows frag. 6+bug AFAGp 6.06 22.12 Windows frag. 7 AGAFp timeout 55.77 Windows frag. 8 FGp timeout 5.24

Previous work

Monday, June 25, 12

slide-18
SLIDE 18

Traditional Our Approach Program Property Time(s) Time(s) Example from Sec. 2 AFAGp 2.32 1.98

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 27.94 Toy acq/rel AG(p⇒AFq) 103.48 14.18 Toy lin. arith. 1 p⇒AFq 126.86 34.51 Toy lin. arith. 2 p⇒AFq timeout 6.74 PostgreSQL strsrv AG(p⇒AFAGq) timeout 9.56 PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 47.16 PostgreSQL pgarch AFAGp 31.50 15.20 PostgreSQL dropbuf AGp timeout 1.14 PostgreSQL dropbuf AG(p⇒AFq) 53.99 27.54 Apache child AG(p⇒AGAFq) timeout 197.41 Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 684.24 Windows frag. 1 AG(p⇒AFq) 901.81 539.00 Windows frag. 2 AFAGp 16.47 52.10 Windows frag. 2+bug AFAGp 26.15 30.37 Windows frag. 3 AFAGp 4.21 15.75 Windows frag. 4 AG(p⇒AFq) timeout 1,114.18 Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 100.68 Windows frag. 5 AG(p⇒AFq) timeout timeout Windows frag. 6 AFAGp 149.41 59.56 Windows frag. 6+bug AFAGp 6.06 22.12 Windows frag. 7 AGAFp timeout 55.77 Windows frag. 8 FGp timeout 5.24

Previous work

Monday, June 25, 12

slide-19
SLIDE 19

Traditional Our Approach Program Property Time(s) Time(s) Example from Sec. 2 AFAGp 2.32 1.98

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 27.94 Toy acq/rel AG(p⇒AFq) 103.48 14.18 Toy lin. arith. 1 p⇒AFq 126.86 34.51 Toy lin. arith. 2 p⇒AFq timeout 6.74 PostgreSQL strsrv AG(p⇒AFAGq) timeout 9.56 PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 47.16 PostgreSQL pgarch AFAGp 31.50 15.20 PostgreSQL dropbuf AGp timeout 1.14 PostgreSQL dropbuf AG(p⇒AFq) 53.99 27.54 Apache child AG(p⇒AGAFq) timeout 197.41 Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 684.24 Windows frag. 1 AG(p⇒AFq) 901.81 539.00 Windows frag. 2 AFAGp 16.47 52.10 Windows frag. 2+bug AFAGp 26.15 30.37 Windows frag. 3 AFAGp 4.21 15.75 Windows frag. 4 AG(p⇒AFq) timeout 1,114.18 Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 100.68 Windows frag. 5 AG(p⇒AFq) timeout timeout Windows frag. 6 AFAGp 149.41 59.56 Windows frag. 6+bug AFAGp 6.06 22.12 Windows frag. 7 AGAFp timeout 55.77 Windows frag. 8 FGp timeout 5.24

Previous work

POPL’11, CAV’11

Monday, June 25, 12

slide-20
SLIDE 20

Traditional Our Approach Program Property Time(s) Time(s) Example from Sec. 2 AFAGp 2.32 1.98

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 27.94 Toy acq/rel AG(p⇒AFq) 103.48 14.18 Toy lin. arith. 1 p⇒AFq 126.86 34.51 Toy lin. arith. 2 p⇒AFq timeout 6.74 PostgreSQL strsrv AG(p⇒AFAGq) timeout 9.56 PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 47.16 PostgreSQL pgarch AFAGp 31.50 15.20 PostgreSQL dropbuf AGp timeout 1.14 PostgreSQL dropbuf AG(p⇒AFq) 53.99 27.54 Apache child AG(p⇒AGAFq) timeout 197.41 Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 684.24 Windows frag. 1 AG(p⇒AFq) 901.81 539.00 Windows frag. 2 AFAGp 16.47 52.10 Windows frag. 2+bug AFAGp 26.15 30.37 Windows frag. 3 AFAGp 4.21 15.75 Windows frag. 4 AG(p⇒AFq) timeout 1,114.18 Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 100.68 Windows frag. 5 AG(p⇒AFq) timeout timeout Windows frag. 6 AFAGp 149.41 59.56 Windows frag. 6+bug AFAGp 6.06 22.12 Windows frag. 7 AGAFp timeout 55.77 Windows frag. 8 FGp timeout 5.24

Previous work

POPL’11, CAV’11

timeout

Monday, June 25, 12

slide-21
SLIDE 21

Traditional Our Approach Program Property Time(s) Time(s) Example from Sec. 2 AFAGp 2.32 1.98

Example from Fig. 8 of [15]

AG(p⇒AFq) 209.64 27.94 Toy acq/rel AG(p⇒AFq) 103.48 14.18 Toy lin. arith. 1 p⇒AFq 126.86 34.51 Toy lin. arith. 2 p⇒AFq timeout 6.74 PostgreSQL strsrv AG(p⇒AFAGq) timeout 9.56 PostgreSQL strsrv+bug AG(p⇒AFAGq) 87.31 47.16 PostgreSQL pgarch AFAGp 31.50 15.20 PostgreSQL dropbuf AGp timeout 1.14 PostgreSQL dropbuf AG(p⇒AFq) 53.99 27.54 Apache child AG(p⇒AGAFq) timeout 197.41 Apache child accept liveness AG(p⇒(AFa ∨ AFb)) 685.34 684.24 Windows frag. 1 AG(p⇒AFq) 901.81 539.00 Windows frag. 2 AFAGp 16.47 52.10 Windows frag. 2+bug AFAGp 26.15 30.37 Windows frag. 3 AFAGp 4.21 15.75 Windows frag. 4 AG(p⇒AFq) timeout 1,114.18 Windows frag. 4 (AFp) ∨ (AFq) 1,223.96 100.68 Windows frag. 5 AG(p⇒AFq) timeout timeout Windows frag. 6 AFAGp 149.41 59.56 Windows frag. 6+bug AFAGp 6.06 22.12 Windows frag. 7 AGAFp timeout 55.77 Windows frag. 8 FGp timeout 5.24

Previous work

all “A” properties

Monday, June 25, 12

slide-22
SLIDE 22

all “A” properties

AFp Across all paths, eventually reach p AGp Across all paths, p always holds

Monday, June 25, 12

slide-23
SLIDE 23

all “A” properties

AFp Across all paths, eventually reach p AGp Across all paths, p always holds

Extend beyond the universal fragment, include existential properties . . .

Monday, June 25, 12

slide-24
SLIDE 24

The behavior of software is often nondeterministic

Initial states

if (read(&buf)) { computeA(); else { computeB(); } read() >0 ≤0

Monday, June 25, 12

slide-25
SLIDE 25

Modern software systems have elaborate control-flow.

Initial states

Monday, June 25, 12

slide-26
SLIDE 26

... and infinite state spaces!

Initial states . . .

. . . . . .

Monday, June 25, 12

slide-27
SLIDE 27

Initial states

. . .

Example: does there exist a way to reach a red state? EF red

Many important properties involve the branching behaviors of a program

Monday, June 25, 12

slide-28
SLIDE 28

Many important properties involve the branching behaviors of a program

Initial states

. . .

Example: are you assured you will always reach a state from which point you can always be in a green state? AF (EG green)

Monday, June 25, 12

slide-29
SLIDE 29

Many important properties involve the branching behaviors of a program

Initial states

. . .

Example: are you assured you will always reach a state from which point you can always be in a green state? AF (EG green)

Monday, June 25, 12

slide-30
SLIDE 30

Branching properties can be found in many temporal logics.

branching

AFp Across all paths, eventually reach p EFp There is a path that eventually reaches p AGp Across all paths, p always holds EGp There is a path along which p always holds

Computation Tree Logic [Clarke 1986]

CTL

Monday, June 25, 12

slide-31
SLIDE 31

Branching properties can be found in many temporal logics.

branching

AFp Across all paths, eventually reach p EFp There is a path that eventually reaches p AGp Across all paths, p always holds EGp There is a path along which p always holds

Computation Tree Logic [Clarke 1986]

CTL

Monday, June 25, 12

slide-32
SLIDE 32
  • Planning

Is there a position I can move to such that escape is possible? At any point system could terminate and when it does p holds.

branching

existential and universal

Monday, June 25, 12

slide-33
SLIDE 33
  • Planning

Is there a position I can move to such that escape is possible? At any point system could terminate and when it does p holds.

  • Games

Are there choices that I can make (“exists”) such that I will always outwit every move (“universal”) my opponent makes?

branching

existential and universal

Monday, June 25, 12

slide-34
SLIDE 34
  • Planning

Is there a position I can move to such that escape is possible? At any point system could terminate and when it does p holds.

  • Games

Are there choices that I can make (“exists”) such that I will always outwit every move (“universal”) my opponent makes?

  • Security

Can the system eventually repair itself after an intrusion? Is is possible that, no matter what inputs an attacker enters, the system can escape being compromised.

branching

existential and universal

Monday, June 25, 12

slide-35
SLIDE 35

branching

existential and universal

Can be treated similarly Can be treated similarly

Monday, June 25, 12

slide-36
SLIDE 36

Initial states

AG and EG (reachability)

. . . . . . . . .

AG yellow

Monday, June 25, 12

slide-37
SLIDE 37

Initial states

AG and EG (reachability)

. . . . . . . . .

AG yellow

Monday, June 25, 12

slide-38
SLIDE 38

Initial states

AG and EG (reachability)

. . . . . . . . .

AG yellow

Monday, June 25, 12

slide-39
SLIDE 39

Initial states

AG and EG (reachability)

. . . . . . . . .

AG yellow

Monday, June 25, 12

slide-40
SLIDE 40

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Monday, June 25, 12

slide-41
SLIDE 41

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Monday, June 25, 12

slide-42
SLIDE 42

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Monday, June 25, 12

slide-43
SLIDE 43

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Monday, June 25, 12

slide-44
SLIDE 44

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Monday, June 25, 12

slide-45
SLIDE 45

Initial states

. . . . . . . . .

EG yellow

AG and EG (reachability)

Looks like AG yellow

Monday, June 25, 12

slide-46
SLIDE 46

Initial states

. . . . . . . . .

EG yellow

Side Condition:

Recurrent set?

AG and EG (reachability)

Looks like AG yellow

Monday, June 25, 12

slide-47
SLIDE 47

AF and EF (termination)

Initial states

AF green

Monday, June 25, 12

slide-48
SLIDE 48

AF and EF (termination)

Initial states

AF green

Monday, June 25, 12

slide-49
SLIDE 49

Initial states

AF and EF (termination)

EF red

Monday, June 25, 12

slide-50
SLIDE 50

Initial states

AF and EF (termination)

EF red

Monday, June 25, 12

slide-51
SLIDE 51

Initial states

AF and EF (termination)

EF red

Looks like AF red

Monday, June 25, 12

slide-52
SLIDE 52

Initial states

AF and EF (termination)

EF red

Side Condition:

Recurrent set?

Looks like AF red

Monday, June 25, 12

slide-53
SLIDE 53

Treat universal and existential fragments similarly . . .

Monday, June 25, 12

slide-54
SLIDE 54

. . . . . . . . . Treat universal and existential fragments similarly . . . F ≡ {s | color(s) = green} C ≡ {s | color(s) = yellow}

F C X

EF green

Monday, June 25, 12

slide-55
SLIDE 55

. . . . . . . . . Treat universal and existential fragments similarly . . . F ≡ {s | color(s) = green} C ≡ {s | color(s) = yellow}

F C X

EF green

“Chute”

Monday, June 25, 12

slide-56
SLIDE 56

. . . . . . . . . Treat universal and existential fragments similarly . . . F ≡ {s | color(s) = green} C ≡ {s | color(s) = yellow}

F C X

EF green

“Chute” “Frontier”

Monday, June 25, 12

slide-57
SLIDE 57

. . . . . . . . . Treat universal and existential fragments similarly . . . F ≡ {s | color(s) = green} C ≡ {s | color(s) = yellow}

F C X

EF green

“Chute” For AFp, chute is simply S “Frontier”

Monday, June 25, 12

slide-58
SLIDE 58

. . . . . . . . . Treat universal and existential fragments similarly . . . F ≡ {s | color(s) = green} C ≡ {s | color(s) = yellow}

F C X

EF green

“Chute” For AFp, chute is simply S

Characterization for CTL . . .

“Frontier”

Monday, June 25, 12

slide-59
SLIDE 59

Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-60
SLIDE 60

Treat universal and existential fragments similarly . . . X ` Φ

Set of states

Monday, June 25, 12

slide-61
SLIDE 61

Treat universal and existential fragments similarly . . . X ` Φ

Set of states Property

Monday, June 25, 12

slide-62
SLIDE 62

Treat universal and existential fragments similarly . . . X ` Φ

Set of states Property

Standard CTL semantics

Monday, June 25, 12

slide-63
SLIDE 63

Treat universal and existential fragments similarly . . . X ` Φ

Set of states Property

Standard CTL semantics

I ` Φ ( ) 8s 2 I. s ✏ Φ

Monday, June 25, 12

slide-64
SLIDE 64

Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-65
SLIDE 65

Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-66
SLIDE 66

Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-67
SLIDE 67

Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-68
SLIDE 68

Similar to CTL* Decompose temporal operators: Treat universal and existential fragments similarly . . . X ` Φ

Monday, June 25, 12

slide-69
SLIDE 69

Similar to CTL* Decompose temporal operators: Treat universal and existential fragments similarly . . . X ` Φ X, C, F γ

Second kind of judgement

Monday, June 25, 12

slide-70
SLIDE 70

Treat universal and existential fragments similarly . . . X ` Φ X, C, F γ

Monday, June 25, 12

slide-71
SLIDE 71

Treat universal and existential fragments similarly . . . X ` Φ

Side Condition:

Recurrent set? X, C, F γ

Monday, June 25, 12

slide-72
SLIDE 72

Treat universal and existential fragments similarly . . . X ` Φ X, C, F γ Walk

Monday, June 25, 12

slide-73
SLIDE 73

Treat universal and existential fragments similarly . . . X ` Φ

Termination

X, C, F γ Walk

Monday, June 25, 12

slide-74
SLIDE 74

Treat universal and existential fragments similarly . . . X ` Φ

Termination

}

well-founded

X, C, F γ Walk

Monday, June 25, 12

slide-75
SLIDE 75

Treat universal and existential fragments similarly . . . X ` Φ X, C, F γ Walk

Monday, June 25, 12

slide-76
SLIDE 76

Treat universal and existential fragments similarly . . . X ` Φ

Safety

X, C, F γ Walk

Monday, June 25, 12

slide-77
SLIDE 77

CTL semantics Proof System

Treat universal and existential fragments similarly . . . X ` Φ

I ` Φ ( ) 8s 2 I. s ✏ Φ

Soundness and Completeness

Monday, June 25, 12

slide-78
SLIDE 78

Treat universal and existential fragments similarly . . . X ` Φ

  • Sets-of-states rather than singleton states
  • Works well for infinite state spaces
  • Partition rather than enumerate states
  • Symbolic representations/overapproximations
  • We believe it will work well in practice...

X, C, F γ

Monday, June 25, 12

slide-79
SLIDE 79

Side Condition:

Recurrent set?

Monday, June 25, 12

slide-80
SLIDE 80

Side Condition:

Recurrent set?

C X F

✘

Monday, June 25, 12

slide-81
SLIDE 81

C X F

✘

Side Condition:

Recurrent set?

In practice,

  • 1. Guess an invariant I for chute C

(using, e.g., Octagon)

  • 2. Check that I is recurrent set

(using an SMT solver)

Monday, June 25, 12

slide-82
SLIDE 82

EF (AF (EG x ))

x := 1 x = 0 x := 0

Monday, June 25, 12

slide-83
SLIDE 83

EF (AF (EG x ))

x := 1 x = 0 x := 0

Monday, June 25, 12

slide-84
SLIDE 84

EF (AF (EG x ))

x := 1 x = 0

x

x := 0

Monday, June 25, 12

slide-85
SLIDE 85

EF (AF (EG x ))

x := 1 x = 0

x EG x

x := 0

Monday, June 25, 12

slide-86
SLIDE 86

EF (AF (EG x ))

x := 1 x = 0

x EG x AF EG x

x := 0

Monday, June 25, 12

slide-87
SLIDE 87

EF (AF (EG x ))

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Monday, June 25, 12

slide-88
SLIDE 88

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Monday, June 25, 12

slide-89
SLIDE 89

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-90
SLIDE 90

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-91
SLIDE 91

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-92
SLIDE 92

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-93
SLIDE 93

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-94
SLIDE 94

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-95
SLIDE 95

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

Monday, June 25, 12

slide-96
SLIDE 96

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

  • (Finite) derivation despite infinite state spaces
  • Partition rather than enumerate states
  • Symbolic representations/overapproximations
  • We believe it will work well in practice...

Monday, June 25, 12

slide-97
SLIDE 97

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

How do we discover Frontiers and Chutes?

Monday, June 25, 12

slide-98
SLIDE 98

F1 ≡ pc = 4 C1 ≡ pc = 0 ⇒ ρ1 ∧ pc = 2 ⇒ ρ2 F2 ≡ pc = 6 C2 ≡ pc = 2 ⇒ ¬ρ2 F3 ≡ true

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

  • (Finite) derivation despite infinite state spaces
  • Partition rather than enumerate states
  • Symbolic representations/overapproximations
  • We believe it will work well in practice...

How do we discover Frontiers and Chutes?

Monday, June 25, 12

slide-99
SLIDE 99

Automation

How do we discover frontiers?

(see our work in CAV 2011)

Monday, June 25, 12

slide-100
SLIDE 100

Automation

How do we discover chutes?

Initial states

. . .

EF red

Monday, June 25, 12

slide-101
SLIDE 101

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Monday, June 25, 12

slide-102
SLIDE 102

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

. . .

Monday, June 25, 12

slide-103
SLIDE 103

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Counterexample

. . .

Monday, June 25, 12

slide-104
SLIDE 104

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Counterexample

. . .

Remove this behavior!

Monday, June 25, 12

slide-105
SLIDE 105

Automation

How do we discover chutes?

Initial states

. . .

EF red

Monday, June 25, 12

slide-106
SLIDE 106

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Monday, June 25, 12

slide-107
SLIDE 107

Automation

How do we discover chutes?

Initial states

. . .

EF red

Monday, June 25, 12

slide-108
SLIDE 108

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Monday, June 25, 12

slide-109
SLIDE 109

Automation

How do we discover chutes?

Initial states

. . .

EF red

Monday, June 25, 12

slide-110
SLIDE 110

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Monday, June 25, 12

slide-111
SLIDE 111

Automation

How do we discover chutes?

Initial states

. . .

EF red

Monday, June 25, 12

slide-112
SLIDE 112

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

Monday, June 25, 12

slide-113
SLIDE 113

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

AF red holds!

Monday, June 25, 12

slide-114
SLIDE 114

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

AF red holds!

Recurrent set.

Monday, June 25, 12

slide-115
SLIDE 115

Automation

How do we discover chutes?

Initial states

. . .

EF red AF red

AF red holds!

Recurrent set.

EF red

Monday, June 25, 12

slide-116
SLIDE 116

Automation

How do we discover chutes?

Initial states

. . .

EF red

C F

(X, C, F) is rcr F ` red X ` EF red X, C, F F red WC,F

X

is w.f.

X

Monday, June 25, 12

slide-117
SLIDE 117

Automation

Iterated refinement Algorithm

Prove(P, Φ) : let Φ’ = Φ where replace “E” with “A” in loop match ( P ⊢∀ Φ ) with | Fail χ in EG or EF → eliminate χ | Fail χ in AG or AF → return Fail | Succeed → if C’s are recurrent, return Succeed else return Fail

Monday, June 25, 12

slide-118
SLIDE 118

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Refinement: eliminate χ

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(¬ρ1) 1: loop

pc=0 ⇒ ρ1

Monday, June 25, 12

slide-119
SLIDE 119

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Refinement: eliminate χ

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(¬ρ1) 1: loop

pc=0 ⇒ ρ1

Monday, June 25, 12

slide-120
SLIDE 120

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Refinement: eliminate χ

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(¬ρ1) 1: loop

pc=0 ⇒ ρ1

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(ρ1); ρ2 = *; 2: assume(¬ρ2); 3780 loop

pc=0 ⇒ ρ2

Monday, June 25, 12

slide-121
SLIDE 121

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Refinement: eliminate χ

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(¬ρ1) 1: loop

pc=0 ⇒ ρ1

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(ρ1); ρ2 = *; 2: assume(¬ρ2); 3780 loop

pc=0 ⇒ ρ2

  • Counterex. to AF AF AG x

assume(x=0) 024: assume(ρ1 ,ρ2); 456: assume(x=1) 7802: assume(x=0) pc=2 ⇒ ¬ρ2

Monday, June 25, 12

slide-122
SLIDE 122

x := 1 x = 0

x EG x AF EG x EF AF EG x EF AF EG x

x := 0

Refinement: eliminate χ

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(¬ρ1) 1: loop

pc=0 ⇒ ρ1

  • Counterex. to AF(AF AG x)

assume(x=0) 0: assume(ρ1); ρ2 = *; 2: assume(¬ρ2); 3780 loop

pc=0 ⇒ ρ2

  • Counterex. to AF AF AG x

assume(x=0) 024: assume(ρ1 ,ρ2); 456: assume(x=1) 7802: assume(x=0) pc=2 ⇒ ¬ρ2

Recurrent set.

Monday, June 25, 12

slide-123
SLIDE 123

Implementation

  • Input: C program, CTL property
  • CIL front-end, generate the CAV’11 encoding
  • Safety: prove encoding “cannot return false”

(SLAM or BLAST)

  • Termination (AF/EF):
  • term. argument refinement via Terminator/ARMC
  • Recurrent sets (EF/EG): Octagon and SMT solver

Monday, June 25, 12

slide-124
SLIDE 124

Implementation

  • Input: C program, CTL property
  • CIL front-end, generate the CAV’11 encoding
  • Safety: prove encoding “cannot return false”

(SLAM or BLAST)

  • Termination (AF/EF):
  • term. argument refinement via Terminator/ARMC
  • Recurrent sets (EF/EG): Octagon and SMT solver

Work in progress . . .

Monday, June 25, 12

slide-125
SLIDE 125

Evaluation

Monday, June 25, 12

slide-126
SLIDE 126

Evaluation

Work in progress . . .

Monday, June 25, 12

slide-127
SLIDE 127

End of talk :-)

Monday, June 25, 12