Verification of Recursive Methods on Tree-like Data Structures - - PowerPoint PPT Presentation

▶
verification of recursive methods on tree like data
SMART_READER_LITE
LIVE PREVIEW

Verification of Recursive Methods on Tree-like Data Structures - - PowerPoint PPT Presentation

Nov 29, 2023 10 likes •512 views

Verification of Recursive Methods on Tree-like Data Structures Jyotirmoy V. Deshmukh E. Allen Emerson { deshmukh,emerson}@cs.utexas.edu University of Texas at Austin Formal Methods in Computer-Aided Design 2009 Verifying Recursive Methods on

slide-1
SLIDE 1

Verification of Recursive Methods on Tree-like Data Structures

Jyotirmoy V. Deshmukh

  • E. Allen Emerson

{deshmukh,emerson}@cs.utexas.edu

University of Texas at Austin

Formal Methods in Computer-Aided Design 2009

University of Texas at Austin

Verifying Recursive Methods on Trees

1 / 30

slide-2
SLIDE 2

Recursive Methods are Everywhere!

Data Structure Libraries. File Systems. BDD packages. Netlist Manipulation Routines.

University of Texas at Austin

Verifying Recursive Methods on Trees

2 / 30

slide-3
SLIDE 3

Recursive Method: changeData

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅)) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; } void incMod3 (x) { return (x + 1) mod 3; }

University of Texas at Austin

Verifying Recursive Methods on Trees

3 / 30

slide-4
SLIDE 4

Properties of Interest

Sample Pre-Condition Input is a binary tree, data values in {0, 1, 2}. Sample Post-Condition(s) (A) Output is an acyclic data structure. (B) Output is a binary tree (subsumes (A)). (C) Leaf nodes in Output incremented by one (mod 3). (D) Non-leaf nodes in Output remain unchanged. Verification instance of the Parameterized Reasoning problem.

University of Texas at Austin

Verifying Recursive Methods on Trees

4 / 30

slide-5
SLIDE 5

General Methods and Properties

In general, methods could . . . Change links. Add nodes. Delete nodes. For example, specifications could be . . . Sorted-ness in a list. Left key is less than Right key. Both children of every red node are black. All leaves are black.

University of Texas at Austin

Verifying Recursive Methods on Trees

5 / 30

slide-6
SLIDE 6

Outline

1

Scope

2

Method Automata

3

Verification Framework

4

Complexity and Results

University of Texas at Austin

Verifying Recursive Methods on Trees

6 / 30

slide-7
SLIDE 7

Scope

Outline

1

Scope

2

Method Automata

3

Verification Framework

4

Complexity and Results

University of Texas at Austin

Verifying Recursive Methods on Trees

7 / 30

slide-8
SLIDE 8

Scope

Most General Recursive Method over a Tree...

Signature: Arbitrary pointer arguments, data arguments. Pointer/Data value as return value. Body: (in no particular order) Assignments to pointer expressions. Recursive calls. Access to global pointer/data values.

University of Texas at Austin

Verifying Recursive Methods on Trees

8 / 30

slide-9
SLIDE 9

Scope

Decidable Fragment

An arbitrary recursive method can simulate a Turing Machine. Syntactic restrictions for decidability? Disallow: Global pointer variables.

(. . . else method models k-pebble automaton)

Pointers arbitrarily far apart.

(. . . else method models k-headed automaton)

Unbounded destructive changes.

(. . . else method models linear bounded automaton)

University of Texas at Austin

Verifying Recursive Methods on Trees

9 / 30

slide-10
SLIDE 10

Scope

Decidable Fragment

Syntactic restrictions for decidability? Disallow: Global pointer variables.

(. . . else method models k-pebble automata)

Pointers arbitrarily far apart.

(. . . else method models k-headed automata)

Unbounded destructive changes.

(. . . else method models Linear Bounded Automata)

University of Texas at Austin

Verifying Recursive Methods on Trees

10 / 30

slide-11
SLIDE 11

Scope

Syntactic Fragment: Updates within a bounded region

Designated pointer argument ‘iterator’ (iter). Destructive Update relative to iter ptr = iter, iter->nextj, iter->nextj-> . . . ->nextk. ptr->data = d; ptr->nextj = ptr’; ptr->nextj = new node(d, ptr1, ...ptrk); delete(ptr);

University of Texas at Austin

Verifying Recursive Methods on Trees

11 / 30

slide-12
SLIDE 12

Scope

Windows: Model updates within a bounded distance

Definition (Window) Finite Encoding for neighborhood of node. Concrete address replaced by “Local” address.

a 0x60 0x80 b 0xa0 ⊥ c 0x40 0xc0

0x40: 0x60: 0x60:

a 1 2 b * ⊥ c *

0: 1: 2: University of Texas at Austin

Verifying Recursive Methods on Trees

12 / 30

slide-13
SLIDE 13

Scope

Abstract Tree

a

Ti

b c a d

⊥

e

⊥ ⊥

b c

⊥

c

  • Ti

⊥ ⊥ ⊥ ⊥

a b c b a d c ⊥ e a ⊥ ⊥ d b c e ⊥ c

Obtain Ti from Ti by eliding everything but the root of each window.

University of Texas at Austin

Verifying Recursive Methods on Trees

13 / 30

slide-14
SLIDE 14

Scope

Decidable Fragment

Syntactic restrictions for decidability? Disallow: Global pointer variables.

(. . . else method models k-pebble automata)

Pointers arbitrarily far apart.

(. . . else method models k-headed automata)

Unbounded destructive changes.

(. . . else method models Linear Bounded Automata)

University of Texas at Austin

Verifying Recursive Methods on Trees

14 / 30

slide-15
SLIDE 15

Scope

Syntactic Fragment: Bounded Destructive Updates

Lemma For trees, ≤ 1 recursive invocation/child ⇒ #destructive updates by M bounded. Proof. M can destructively update n: (0) when M first visits n (after invoked from parent of n), (1) when M returns from 1st recursive call, . . . (K) when M returns from K th recursive call. ⇒ M destructively updates n at most K + 1 times. K is fixed for given K-ary tree.

University of Texas at Austin

Verifying Recursive Methods on Trees

15 / 30

slide-16
SLIDE 16

Scope

Decidable Fragment

Syntactic restrictions for decidability? Disallow: Global pointer variables.

(. . . else method models k-pebble automata)

Pointers arbitrarily far apart.

(. . . else method models k-headed automata)

Unbounded destructive changes.

(. . . else method models Linear Bounded Automata)

University of Texas at Austin

Verifying Recursive Methods on Trees

16 / 30

slide-17
SLIDE 17

Method Automata

Outline

1

Scope

2

Method Automata Tail Recursive Methods Non Tail-Recursive Methods

3

Verification Framework

4

Complexity and Results

University of Texas at Austin

Verifying Recursive Methods on Trees

17 / 30

slide-18
SLIDE 18

Method Automata Tail Recursive Methods

Template Tail-Recursive Method

void foo(iter) { if (cond) { base-du; } recur-du; foo (iter->next2); foo (iter->next1); foo (iter->next3); }

University of Texas at Austin

Verifying Recursive Methods on Trees

18 / 30

slide-19
SLIDE 19

Method Automata Tail Recursive Methods

Method Automaton AM

AM accepts Ti ◦ To iff To = M(Ti).

  • Tc encodes valid actions of M.

,

( )

  • Tc

,

( )

,

( )

,

( )

,

( )

,

( )

,

( )

University of Texas at Austin

Verifying Recursive Methods on Trees

19 / 30

slide-20
SLIDE 20

Method Automata Tail Recursive Methods

Method Automaton AM

AM accepts Ti ◦ To iff To = M(Ti).

  • Tc encodes valid actions of M.

,

( )

  • Ti

,

( )

,

( )

,

( )

,

( )

,

( )

,

( )

University of Texas at Austin

Verifying Recursive Methods on Trees

19 / 30

slide-21
SLIDE 21

Method Automata Tail Recursive Methods

Method Automaton AM

AM accepts Ti ◦ To iff To = M(Ti).

  • Tc encodes valid actions of M.

,

( )

  • To

,

( )

,

( )

,

( )

,

( )

,

( )

,

( )

University of Texas at Austin

Verifying Recursive Methods on Trees

19 / 30

slide-22
SLIDE 22

Method Automata Tail Recursive Methods

Method Automaton AM

AM accepts Ti ◦ To iff To = M(Ti).

  • Tc encodes valid actions of M.

,

(

recur-du? )

  • Tc =

Ti ◦ To ,

(

recur-du? )

,

(

recur-du? )

,

(

base-du? )

,

(

base-du? )

,

(

base-du? )

,

(

base-du? ) University of Texas at Austin

Verifying Recursive Methods on Trees

19 / 30

slide-23
SLIDE 23

Method Automata Non Tail-Recursive Methods

Template Non Tail-Recursive Method

void foo(iter) { if (cond) { base-du; } recur-du[0]; foo (iter->next2); recur-du[1]; foo (iter->next1); recur-du[2]; foo (iter->next3); recur-du[3]; }

University of Texas at Austin

Verifying Recursive Methods on Trees

20 / 30

slide-24
SLIDE 24

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 2

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-25
SLIDE 25

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 2 2

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-26
SLIDE 26

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 2 1 2

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-27
SLIDE 27

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 1 2

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-28
SLIDE 28

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 1

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-29
SLIDE 29

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 1 1

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-30
SLIDE 30

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

2 1 1

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-31
SLIDE 31

Method Automata Non Tail-Recursive Methods

Action of M

void changeData (iter) { if ((iter->next1==∅) && (iter->next2==∅) { incMod3(iter->data); return; } incMod3 (iter->data); if (iter->next1!=∅) { changeData (iter->next1); } incMod3 (iter->data); if (iter->next2!=∅) { changeData (iter->next2); } incMod3 (iter->data); return; }

1 1

University of Texas at Austin

Verifying Recursive Methods on Trees

21 / 30

slide-32
SLIDE 32

Method Automata Non Tail-Recursive Methods

Depth-first action represented by Finite Annotation

2 2 2 1 2 1 2 1 1 1 1 1 1 2 2 1 1 1 1 1 1 1 1 1 2 1,2,0,1 0,1,1,1 2,0,0,0 0,1,2,0

University of Texas at Austin

Verifying Recursive Methods on Trees

22 / 30

slide-33
SLIDE 33

Method Automata Non Tail-Recursive Methods

Structure of AM

(

, , ,. . . , ,

)

recur-du[0]? recur-du[1]? recur-du[K]?

(

, , ,. . . , ,

)

recur-du[0]? recur-du[1]? recur-du[K]?

(

, , ,. . . , ,

)

recur-du[0]? recur-du[1]? recur-du[K]?

(

, , ,. . . , ,

)

base-du?

≡ ≡

University of Texas at Austin

Verifying Recursive Methods on Trees

23 / 30

slide-34
SLIDE 34

Verification Framework

Outline

1

Scope

2

Method Automata

3

Verification Framework

4

Complexity and Results

University of Texas at Austin

Verifying Recursive Methods on Trees

24 / 30

slide-35
SLIDE 35

Verification Framework

Properties as Automata

Pre-condition Pre-condition ϕ provided as Aϕ. Aϕ operates on Tc = Ti ◦ To. Accepts Ti if Ti | = ϕ. Ignores To component of Tc. Post-condition Negated Post-condition ψ provided as A¬ψ. A¬ψ operates on Tc. Accepts To if To | = ψ. Ignores Ti component of Tc.

University of Texas at Austin

Verifying Recursive Methods on Trees

25 / 30

slide-36
SLIDE 36

Verification Framework

Product Automaton

Ap = AM ⊗ Aϕ ⊗ A¬ψ. Ap is non-empty ⇔:

AM accepts Ti ◦ To, i.e. To = M(Ti), Aϕ accepts Ti, i.e. Ti | = ϕ, A¬ψ accepts To, i.e. To | = ψ.

Ap is empty ⇔ M satisfies pre/post-conditions for all input trees.

University of Texas at Austin

Verifying Recursive Methods on Trees

26 / 30

slide-37
SLIDE 37

Complexity and Results

Outline

1

Scope

2

Method Automata

3

Verification Framework

4

Complexity and Results

University of Texas at Austin

Verifying Recursive Methods on Trees

27 / 30

slide-38
SLIDE 38

Complexity and Results

Complexity

|Ap| proportional to |AM|, properties. |AM| linear in |M|, exp. in size of window. Overall complexity: polynomial in |Ap|.

University of Texas at Austin

Verifying Recursive Methods on Trees

28 / 30

slide-39
SLIDE 39

Complexity and Results

Experimental Results

Method Spec. Timea Mem. (secs) (MB) AM Total On Linked Lists: DeleteNode Acyclic 0.3 1.3 20 InsertAtTail Acyclic 0.01 0.8 <1 InsertNode Acyclic 0.4 1.6 48 On Binary Trees: InsertNode Acyclic 15 329 2512 ReplaceAll(a,b) Acyclic 5 26 324 ∄iter : iter->d = a 5 27 432 DeleteLeaf Acyclic 12 48 630

aExperiments were performed on an Athlon 64X2 4200+ system with 6GB RAM. University of Texas at Austin

Verifying Recursive Methods on Trees

29 / 30

slide-40
SLIDE 40

Complexity and Results

Thank You!

University of Texas at Austin

Verifying Recursive Methods on Trees

30 / 30

slide-41
SLIDE 41

Template for Method in Decidable Fragment

void foo (iter, d1, ..., dn) { /* base case: */ if (condition) { d.u. to w(iter); return; } /* recursive case: */ d.u. to w(iter); foo (iter->3); // call to 3rd successor d.u. to w(iter); foo (iter->1); // call to 1st successor d.u. to w(iter); foo (iter->2); // call to 2nd successor d.u. to w(iter); return; }

University of Texas at Austin

Verifying Recursive Methods on Trees

1 / 10

slide-42
SLIDE 42

Structure of AM: Tail Recursive Methods

Input symbol σ = (wi, wo). State encodes part of σ overlapping with successor. Reads new σ′; rejects if overlapping parts differ. If σ | = base-case condition, AM accepts if wo = M(wi). If σ | = base-case condition:

Checks wo

?

= M(wi) (rejects otherwise). Transitions to (wi|j, wo|j) along jth successor.

University of Texas at Austin

Verifying Recursive Methods on Trees

2 / 10

slide-43
SLIDE 43

Macros

w h(w) w|1 w|2 consistent((xi, xo) | {z }

q

, (wi, wo) | {z }

σ

) def = (h(wi) = xi) | {z }

  • cons. input

∧ (h(wo) = xo) | {z }

  • cons. output

University of Texas at Austin

Verifying Recursive Methods on Trees

3 / 10

slide-44
SLIDE 44

AM for Tail-Recursive Methods

Transitions from the Initial State

q0 (wi, wo) acc acc (w′

i , w′

  • )

(wi|1,wo|1) (wi|2,wo|2) (w′′

i , w′′

  • )

rej rej

validBase(wi , wo) validRecur(w′

i , w′

  • )

invalidBase(w′′

i , w′′

  • )
  • r invalidRecur(w′′

i , w′′

  • )

University of Texas at Austin

Verifying Recursive Methods on Trees

4 / 10

slide-45
SLIDE 45

AM for Tail-Recursive Methods

Transitions from non-initial/final states

q = (wprev

i

|j, wprev

  • |j)

(wi, wo) acc acc (w′

i , w′

  • )

(wi|1,wo|1) (wi|2,wo|2) (w′′

i , w′′

  • )

rej rej

consistent(q, (wi , wo)) and validBase(wi , wo) consistent(q, (w′

i , w′

  • ))

and validRecur(w′

i , w′

  • )

¬consistent(q, (w′′

i , w′′

  • ))
  • r invalidBase(w′′

i , w′′

  • )
  • r invalidRecur(w′′

i , w′′

  • )

University of Texas at Austin

Verifying Recursive Methods on Trees

5 / 10

slide-46
SLIDE 46

More Macros

validBase(wi , wo) def = (wi | = bcond) | {z }

is base case.

∧ (wo = base_du(wi )) | {z }

matches base_du

invalidBase(wi , wo) def = (wi | = bcond) | {z }

is base case.

∧ (wo = base_du(wi )) | {z }

doesn′t match base_du

validRecur(wi , wo) def = (wi | = bcond) | {z }

not base case

∧ (wo = recur_du(wi )) | {z }

matches recur_du

invalidRecur(wi , wo) def = (wi | = bcond) | {z }

not base case

∧ (wo = recur_du(wi )) | {z }

doesn′t match recur_du

University of Texas at Austin

Verifying Recursive Methods on Trees

6 / 10

slide-47
SLIDE 47

Non Tail-Recursive Methods

Modified Macros:

consistent((xi , xo) | {z }

q

, (w0, . . . , wK+1) | {z }

σ

) def = (h(w0) = xi ) | {z }

  • cons. input

∧ (h(wK+1) = xo) | {z }

  • cons. output

validBase(w0, w1, . . . , wK+1) def = (w0 | = bcond) | {z }

is base case.

∧ (wK+1 = wK = . . . = w1 = base_du(w0)) | {z }

matches base_du

invalidBase(wi , wo) def = (w0 | = bcond) | {z }

is base case.

∧ ¬(wK+1 = wK = . . . = w1 = base_du(w0)) | {z }

doesn′t match base_du

validRecur(wi , wo) def = (w0 | = bcond) | {z }

not base case

∧ (w1 = recur_du[0](w0)) ∧ . . . ∧ (wK+1 = recur_du[K](wK )) | {z }

matches all recur_du′s

invalidRecur(wi , wo) def = (wi | = bcond) | {z }

not base case

∧ ¬((w1 = recur_du[0](w0)) ∧ . . . ∧ (wK+1 = recur_du[K](wK ))) | {z }

doesn′t match all recur_du′s

University of Texas at Austin

Verifying Recursive Methods on Trees

7 / 10

slide-48
SLIDE 48

AM for Non Tail-Recursive Methods

Transitions from the Initial State

q0 (wi, wo) acc acc (w′

i , w′

  • )

(wi|1,wo|1) (wi|2,wo|2) (w′′

i , w′′

  • )

rej rej

validBase(wi , wo) validRecur(w′

i , w′

  • )

invalidBase(w′′

i , w′′

  • )
  • r invalidRecur(w′′

i , w′′

  • )

University of Texas at Austin

Verifying Recursive Methods on Trees

8 / 10

slide-49
SLIDE 49

AM for Non Tail-Recursive Methods

Transitions from non-initial/final states

q = (xi, xo) (wi, wo) acc acc (w′

i , w′

  • )

(wi|1,wo|1) (wi|2,wo|2) (w′′

i , w′′

  • )

rej rej

consistent(q, (wi , wo)) and validBase(wi , wo) consistent(q, (w′

i , w′

  • ))

and validRecur(w′

i , w′

  • )

¬consistent(q, (w′′

i , w′′

  • ))
  • r invalidBase(w′′

i , w′′

  • )
  • r invalidRecur(w′′

i , w′′

  • )

University of Texas at Austin

Verifying Recursive Methods on Trees

9 / 10

slide-50
SLIDE 50

Future Work

Reduce |Σp| by clustering-based abstraction. Verify methods on dags: use single visit property. Use of Pushdown/Stack Tree Automata as Method Automata.

University of Texas at Austin

Verifying Recursive Methods on Trees

10 / 10