Verification Suvam Mukherjee Programming Languages Laboratory, - PowerPoint PPT Presentation

Fun with Program Analysis and Verification Suvam Mukherjee Programming Languages Laboratory, Department of Computer Science and Automation, Indian Institute of Science, Bangalore 560012 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 1

BACKGROUND I’m from the Programming Languages Laboratory!  7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 2

What’s done in the PL Lab? If doubts encompass you regarding Java, Python or C, T o end your quest, in PL Lab you should be… 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 3

Deepak D’Souza K V Raghavan Aravind Aastha Raghavendra Tejas Narendran Girish Raveendra Remish Suvam 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 4

Related Laboratories • SEAL (Software Engineering and Analysis Laboratory): Dr. Aditya Kanade • Scalable Software Systems Lab: Dr. Murali Krishna Ramanathan • Compilers Laboratory: Prof. Y N Srikant • Multicore Computing Laboratory: Dr. Uday Kumar Reddy 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 5

Why analyze/verify programs? Ariane-5 Rocket Explosion 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 6

Suvam Mukherjee, CSA 7/8/2013 11:56:35 AM 7 Courtesy: YouTube

Ariane 5 Rocket Explosion • Crashed on June 4, 1996 • “…it crashed 36 seconds after the launch due to a conversion of a 64-bit floating point to a 16- bit integer value” [ Principles of Model Checking, Baier and Katoen] 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 8

Why analyze/verify programs? Therac 25 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 9

7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 10

Therac-25 • Radiation Therapy Machine • Caused the death of 6 cancer patients between 1985-87 due to radiation overdose • “ The accidents occurred when the high-power electron beam was activated instead of the intended low power beam…Therac -25 had removed them, depending instead on software interlocks for safety. The software interlock could fail due to a race condition. “ [Wikipedia] 7/8/2013 11:56:35 AM Suvam Mukherjee, CSA 11

Races temp = x; x = 0 if (temp >= 0) x = -1 { // Operation } 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 12

Races temp = x; x = 0 if (temp >= 0) x = -1 { // Operation } 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 13

Why analyze/verify programs? I could go on forever… 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 14

Why analyze/verify programs? • Information and Communication T echnologies have become ubiquitious • Incorrect software could have catastrophic consequences • Formal techniques to analyze/verify programs, to either improve performance or to make sure it doesn’t do something bad 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 15

Analysis of Flow of Data Abstract Interpretation 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 16

Example int i = 0; while(true) { i++; } 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 17

Control Flow Graph A i = 0 B [true] C id Is i ever negative at this program i++ location? D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 18

A Iteration #1 i = 0 B [true] C id i++ D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 19

A Iteration #2 i = 0 B [true] C id i++ D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 20

A Iteration #3 i = 0 B [true] C id i++ D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 21

A Iteration #3 i = 0 When do we B stop? [true] NEV EVER!!! ER!!! C id i++ D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 22

Issue • Variable i takes a value from an infinite domain: Integers • The more paths we cover, the more information we obtain • But we don’t need such precision! • Solution: Over-approximate the values i can assume at any program point -2 3 >-3 99 0 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 23

7/8/2013 11:56:36 AM Courtesy: Deepak D’Souza 24

A Over- approximations i = 0 B Join Over [true] All Paths (JOP) C id i++ D 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 25

Depends on what kind of analysis you are interested in How do we over-approximate? There are several “candidate” over - approximated values (possibly infinite). Which one to choose? 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 28

T ailoring Values to the Property odd/even odd even Exercise : {odd} x++ {?} 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 30

Definition • Concrete State: a snapshot of the memory x = x + y x = 0, x = 5, y = 5 y = 5 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 31

What We Need 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 33

x = 5 x >= 0 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 34

What we need • Doma main in of over-approximated values Is that enough? 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 35

x = 5 x >= 0 x ++ x >= 1 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 36

What we need • Doma main in of over-approximated values • Transfer sfer Function nctions: Is that enough? 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 37

x = 5 x >= 0 x ++ x >= 1 x >= 0 x >= 0 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 38

What we need • Doma main in La Latt ttice ice of over-approximated values • Transfer sfer Function nctions: 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 39

Lattice • A lattice is a partially ordered set, where every pair of elements has a least upper bound and a greatest lower bound. 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 42

Lattice Upper Bound Least Upper Bound 7/8/2013 11:56:36 AM Courtesy: Deepak D’Souza 43

Lattice Exercise 7/8/2013 11:56:36 AM Courtesy: Deepak D’Souza 44

Lattice • A lattice is a partially ordered set, where every pair of elements has a least upper bound and a greatest lower bound. Is that enough? 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 45

. . . What is the least upper bound of the set of Natural Numbers? 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 46

Complete Lattice • A complete lattice is a partially ordered set, where any subset of elements has a least upper bound and a greatest lower bound. 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 47

. . . 7/8/2013 11:56:36 AM Suvam Mukherjee, CSA 48

What we need • Doma main in Comp mplet lete e La Lattic ttice of over- approximated values. Lattice must be of finite height for termination. • Transfer sfer Function nctions: Is that enough? 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 51

Concretization Function i = 3 3 i = 87 i = 0 0 i = 88 i >= 0 i = 5 599 i = 10 i = 1 1 i = 100 i = 14 i = 2 2 i = 99 i = 33 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 52

Concretization Function 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 53

What we need • Doma main in Comp mplet lete e La Lattic ttice of over- approximated values. Lattice must be of finite height for termination. • Transfer sfer Function nctions: • Concr ncretizati etization on Funct nction: ion: Is that enough? YES  7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 54

Summary • Usual way of viewing programs: evolution of states • Given a property, “tailor” an abstract domain • Run the program with abstract values • Have fun • What if I need a proof of program correctness? 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 55

Proving Programs Correct Hoare Style Proofs Weakest Preconditions and Interpolants 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 56

Problem Given a program, with a given pre-condition and post-condition, give a proof of correctness of the program 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 57

Proof of Correctness • Consider any state satisfying P . Then, on executing S , if S terminates, we will be in a state satisfying Q . • Also known an a “ Hoare Triple ” 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 58

Hoare Style Proofs • An Axiomatic Basis for Computer Programming: C.A.R Hoare • Annotate each vertex of the CFG with a formula • Key to the proof are the Hoare Triples {P {P} } S {Q {Q} 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 59

Hoare Triples x = 1 x > -5 x = 2 P Q S x++ x >= 0 x >= 1 Q over-approximates the set of states reachable from P on executing S . 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 60

Hoare Triple: Example int i = 0; y = 1; {y = i 3 } {True} for(; i<3; i++) y = y * i 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 61

Example 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 63

n>0 i = 0 n>0 (n>0, i = 0) int i =0; [i<n] while (i < n) [i>=n] { id n >= i i++; } i++ (i = n) n >= i (i = n) 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 64

TRUE TRUE TRUE 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 65

Weakest Precondition/Strongest Postcondition 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 66

Verification Condition 7/8/2013 11:56:37 AM Suvam Mukherjee, CSA 67