Solving (Quantified) Horn Constraints for Program Verification and - - PowerPoint PPT Presentation

▶
solving quantified horn constraints for program
SMART_READER_LITE
LIVE PREVIEW

Solving (Quantified) Horn Constraints for Program Verification and - - PowerPoint PPT Presentation

Dec 03, 2022 541 likes •999 views

Solving (Quantified) Horn Constraints for Program Verification and Synthesis Andrey Rybalchenko (Microsoft Research) September 30, 2015 1 / 32 Programs vs/as Equations Execution of rule-based programs Solving of equations in form of

slide-1
SLIDE 1

Solving (Quantified) Horn Constraints for Program Verification and Synthesis

Andrey Rybalchenko (Microsoft Research) September 30, 2015

1 / 32

slide-2
SLIDE 2

Programs vs/as Equations

◮ Execution of rule-based programs ◮ Solving of equations in form of implication constraints

2 / 32

slide-3
SLIDE 3

Quiz

F1 := ∀x : (∃y : p(x, y)) → q(x) vs. F2 := ∀x ∀y : p(x, y) → q(x)

3 / 32

slide-4
SLIDE 4

Transition System

◮ v - program variables ◮ init(v) - initial states ◮ step(v, v′) - transition relation ◮ safe(v) - safe states

4 / 32

slide-5
SLIDE 5

Safety and Termination (WF) of Transition System

∃inv ∃round : init(v) → inv(v) inv(v) ∧ step(v, v′) → inv(v′)

5 / 32

slide-6
SLIDE 6

Safety and Termination (WF) of Transition System

∃inv ∃round : init(v) → inv(v) inv(v) ∧ step(v, v′) → inv(v′) inv(v) → safe(v) safety inv(v) ∧ step(v, v′) → round(v, v′) wf (round) well-foundedness

5 / 32

slide-7
SLIDE 7

From WF to DWF

wf (rel) iff ∃ti : rel(v, v′) → ti(v, v′) ti(v, v′) ∧ rel(v′, v′′) → ti(v, v′′) dwf (ti) disjunctive well-foundedness

6 / 32

slide-8
SLIDE 8

From WF to DWF

wf (rel) iff ∃ti : rel(v, v′) → ti(v, v′) ti(v, v′) ∧ rel(v′, v′′) → ti(v, v′′) dwf (ti) disjunctive well-foundedness dwf - finite union of well-founded relations

6 / 32

slide-9
SLIDE 9

Backward Safety of Transition System

∃inv : ¬safe(v) → inv(v) inv(v′) ∧ step(v, v′) → inv(v)

7 / 32

slide-10
SLIDE 10

Backward Safety of Transition System

∃inv : ¬safe(v) → inv(v) inv(v′) ∧ step(v, v′) → inv(v) inv(v) ∧ init(v) → false

7 / 32

slide-11
SLIDE 11

Forward and Backward Safety of Transition System

∃finv ∃binv : init(v) → finv(v) finv(v) ∧ step(v, v′) → finv(v′) ¬safe(v) → binv(v) binv(v′) ∧ step(v, v′) → binv(v)

8 / 32

slide-12
SLIDE 12

Forward and Backward Safety of Transition System

∃finv ∃binv : init(v) → finv(v) finv(v) ∧ step(v, v′) → finv(v′) ¬safe(v) → binv(v) binv(v′) ∧ step(v, v′) → binv(v) finv(v) ∧ binv(v) → false

8 / 32

slide-13
SLIDE 13

Program with procedures

◮ v - program variables ◮ init(v) - initial states of main procedure ◮ step(v, v′) - intra-procedural transition relation ◮ safe(v) - safe states

9 / 32

slide-14
SLIDE 14

Program with procedures

◮ v - program variables ◮ init(v) - initial states of main procedure ◮ step(v, v′) - intra-procedural transition relation ◮ safe(v) - safe states ◮ call(v, v′) - parameter passing relation ◮ ret(v, v′) - return value passing

9 / 32

slide-15
SLIDE 15

Safety of Program with Procedures

∃sum : init(v0) → sum(v0, v0) sum(v0, v1) ∧ step(v1, v2) → sum(v0, v2) sum(v0, v1) ∧ call(v1, v2) → sum(v2, v2) sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4) → sum(v0, v4)

10 / 32

slide-16
SLIDE 16

Safety of Program with Procedures

∃sum : init(v0) → sum(v0, v0) sum(v0, v1) ∧ step(v1, v2) → sum(v0, v2) sum(v0, v1) ∧ call(v1, v2) → sum(v2, v2) sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4) → sum(v0, v4) sum(v0, v1) → safe(v1)

10 / 32

slide-17
SLIDE 17

Termination of Program with Procedures

∃round ∃descent : . . . sum(v0, v1) ∧ step(v1, v2) → round(v1, v2) sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4) → round(v1, v4)

11 / 32

slide-18
SLIDE 18

Termination of Program with Procedures

∃round ∃descent : . . . sum(v0, v1) ∧ step(v1, v2) → round(v1, v2) sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4) → round(v1, v4) sum(v0, v1) ∧ call(v1, v2) → descent(v0, v2)

11 / 32

slide-19
SLIDE 19

Termination of Program with Procedures

∃round ∃descent : . . . sum(v0, v1) ∧ step(v1, v2) → round(v1, v2) sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4) → round(v1, v4) sum(v0, v1) ∧ call(v1, v2) → descent(v0, v2) wf (round) wf (descent)

11 / 32

slide-20
SLIDE 20

Solving Horn Constraints

12 / 32

slide-21
SLIDE 21

Symbolic self-composition (for non-interference)

∃sum : . . . v0 = w0 ∧ sum(v0, v1) ∧ sum(w0, w1) → v1 = w1

13 / 32

slide-22
SLIDE 22

Multi-Threaded Program

◮ v = (g, l1, l2) - global and thread-local variables ◮ init(v) - initial states ◮ safe(v) - safe states

14 / 32

slide-23
SLIDE 23

Multi-Threaded Program

◮ v = (g, l1, l2) - global and thread-local variables ◮ init(v) - initial states ◮ safe(v) - safe states ◮ step1(v, v′) - transition relation of 1st thread, preserves l2 ◮ step2(v, v′) - transition relation of 2nd thread, preserves l1

14 / 32

slide-24
SLIDE 24

Rely/Guarantee Rule for Safety

∃inv1 ∃inv2 ∃env1 ∃env2 : init(v) → inv1(v) inv1(v) ∧ step1(v, v′) → inv1(v′) ∧ env2(v, v′) inv1(v) ∧ env1(v, v′) → inv1(v′) · · · inv1(v) ∧ inv2(v) → safe(v) Clauses for preservation of inv2(v) are symmetric

15 / 32

slide-25
SLIDE 25

Resolving Rely/Guarantee Rule

∃env2 : · · · inv1(v) ∧ step1(v, v′) → env2(v, v′) · · · inv2(v) ∧ env2(v, v′) → inv2(v′) · · ·

16 / 32

slide-26
SLIDE 26

Into Owicki/Gries Rule

· · · env2(v, v′) := inv1(v) ∧ step1(v, v′) · · · inv2(v) ∧ inv1(v) ∧ step1(v, v′) → inv2(v′) · · ·

17 / 32

slide-27
SLIDE 27

Owicki/Gries Rule for Safety

∃inv1 ∃inv2 : init(v) → inv1(v) inv1(v) ∧ step1(v, v′) → inv1(v′) inv1(v) ∧ inv2(v) ∧ step2(v, v′) → inv1(v′) · · · inv1(v) ∧ inv2(v) → safe(v) Clauses for preservation of inv2(v) are symmetric

18 / 32

slide-28
SLIDE 28

Thread-Modular Rule for Safety

∃inv1 ∃inv2 ∃env : init(v) → inv1(g, l1) inv1(g, l1) ∧ step1(v, v′) → inv1(g′, l′

1) ∧ env(g, g′)

· · · inv1(g, l1) ∧ inv2(g, l2) → safe(v) Clauses for preservation of inv2(v) are symmetric

19 / 32

slide-29
SLIDE 29

Quantifier Free Horn Clauses ∀v ∀w : body(v, w) → head(v) body(v, w) and head(v) are quantifier free

20 / 32

slide-30
SLIDE 30

Quantified Horn Clauses

◮ Existential temporal properties, e.g., CTL ◮ Program synthesis and infinite-state game solving ◮ Inference of transactions for concurrent programs

∀v ∀w : body(v, w) → ∃x : head(v, x)

◮ Quantified invariants/auxiliary assertions

∀v ∀w : (∀y : body(v, w, y)) → head(v)

21 / 32

slide-31
SLIDE 31

Existentially Quantified Horn Clauses ∀v ∀w : body(v, w) → ∃x : head(v, x) body(v, w) and head(v, x) are quantifier free

22 / 32

slide-32
SLIDE 32

Proving CTL Properties

(init(v), step(v, v′)) | = EF(q(v)) (init(v), step(v, v′)) | = EG(EU(p(v), q(v))) Based on proof system for CTL* by Kesten and Pnueli [TCS’05]

23 / 32

slide-33
SLIDE 33

Proving EF(q(v))

∃inv ∃round : init(v) → inv(v) inv(v) ∧ ¬q(v) → ∃v′ : step(v, v′) ∧ inv(v′) ∧ round(v, v′) wf (round)

24 / 32

slide-34
SLIDE 34

Decomposing EG(EU(p(v), q(v)))

(init(v), step(v, v′)) | = EG(EU(p(v), q(v))) iff ∃mid : (init(v), step(v, v′)) | = EG(mid(v)) (mid(v), step(v, v′)) | = EU(p(v), q(v))

25 / 32

slide-35
SLIDE 35

Proving (init(v), step(v, v ′)) | = EG(mid(v)) and (mid(v), step(v, v ′)) | = EU(p(v), q(v))

∃mid ∃inv1 ∃inv2 ∃round : init(v) → inv1(v) inv1(v) → mid(v) ∧ ∃v′ : step(v, v′) ∧ inv1(v′) mid(v) → inv2(v) inv2(v) ∧ ¬q(v) → p(v) ∧ ∃v′ : step(v, v′) ∧ inv2(v′) ∧ round(v, v′) wf (round)

26 / 32

slide-36
SLIDE 36

Solving Infinite-State Game

Given five empty bottles arranged in circle and jar full of water

◮ Stepmother pours all water from jar into some bottles ◮ Cinderella empties pair of adjucent bottles ◮ Jar is refilled for next round

Stepmother wins if some bottle overflows

27 / 32

slide-37
SLIDE 37

Formalization of Game Arena

◮ v = (v1, . . . , v5) ◮ B - bottle volume ◮ J - jar volume

init(v) = (v1 = · · · = v5 = 0) cindy(v, v′) = (v′

1 = v′ 2 = 0 ∧ same(v3, v4, v5) ∨

· · · ∨ v′

5 = v′ 1 = 0 ∧ same(v2, v3, v4))

step(v, v′) = (v′

1 ≥ v1 ∧ · · · ∧ v′ 5 ≥ v5 ∧

v′

1 + · · · + v′ 5 − (v1 + · · · + v5) = J)

  • ver(v)

= (v1 > B ∨ · · · ∨ v5 > B)

28 / 32

slide-38
SLIDE 38

Stepmother’s Victory as Constraint Satisfaction

∃win ∃round : init(v) → win(v) win(v) ∧ ¬over(v) ∧ cindy(v, v′) → ∃v′′ : step(v′, v′′) ∧ win(v′′) ∧ round(v, v′′) wf (round)

29 / 32

slide-39
SLIDE 39

Example: instantiation of universal quantifiers

for(i = 0; i < n; i++) { a[i] = i; } assert("forall p: 0 <= p && p < n -> a[p] == p");

30 / 32

slide-40
SLIDE 40

Example: instantiation of universal quantifiers

for(i = 0; i < n; i++) { a[i] = i; } assert("forall p: 0 <= p && p < n -> a[p] == p");

∃invv1 : ∀i, n ∀a: i = 0 → invv1(i, n, a) ∀i, n ∀a, a′: invv1(i, n, a) ∧ i < n ∧ a′ = a{i := i} → invv1(i + 1, n, a′) ∀i, n ∀a: invv1(i, n, a) → (∀q : 0 ≤ q < n → a(q) = q)

30 / 32

slide-41
SLIDE 41

Example: instantiation of universal quantifiers

for(i = 0; i < n; i++) { a[i] = i; } assert("forall p: 0 <= p && p < n -> a[p] == p");

∃invv2 : ∀i, n ∀a: i = 0 → (∀q : invv2(i, n, q, a(q))) ∀i, n ∀a, a′: (∀p : invv2(i, n, p, a(p))) ∧ i < n ∧ a′ = a{i := i} → (∀q : invv2(i, n, q, a′(q))) ∀i, n ∀a: (∀p : invv2(i, n, p, a(p)) → (∀q : 0 ≤ q < n → a(q) = q)

30 / 32

slide-42
SLIDE 42

Example: instantiation of universal quantifiers

for(i = 0; i < n; i++) { a[i] = i; } assert("forall p: 0 <= p && p < n -> a[p] == p");

∃invv2 ∃t1, t2 : i = 0 → invv2(i, n, q, a(q))) t1(i, n, q, p) ∧ invv2(i, n, p, a(p)) ∧ i < n ∧ a′ = a{i := i} → invv2(i, n, q, a′(q)) t2(i, n, q, p) ∧ invv2(i, n, p, a(p)) ∧ 0 ≤ q < n → a(q) = q

30 / 32

slide-43
SLIDE 43

Universally Quantified Invariant for Termination

for(i = 0; i < n; i++) a[i] = 1; while (x > 0) for(i = 0; i < n; i++) x = x-a[i]; ∃inv ∃round : . . . inv(i, n, x, a) ∧ next(i, n, x, a, i′, n′, x′, a′) → round(i, n, x, a, i′, n′, x′, a′) wf (round)

31 / 32

slide-44
SLIDE 44

Further Pointers

◮ Solving recursion-free clauses over LI+UIF, [APLAS’11] ◮ Solving quantifier free clauses and well-foundedness, [PLDI’12] ◮ Solving existentially quantified clauses: [CAV’13] ◮ Solving universally quantified clauses: [SAS’13] ◮ Proof rules for multi-threaded programs [POPL’11, CAV’11, TACAS’12] ◮ Proof rules for functional programs [CAV’11, SAS’12] ◮ Software verification competition [SV-COMP’12, SV-COMP’13] ◮ Separation logic modulo theories [APLAS’13] ◮ A constraint-based approach to solving games on infinite graphs [POPL’2014] ◮ Compositional repair of programs with procedures ◮ Solving Horn clauses with cardinality constraints ◮ Probabilistic relational reasoning

32 / 32