From Under-approximations
to Over-approximations and
Back
Complementary material
By Yuri Meshman
yurime@cs.technion.ac.il
Example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Assume we have the following code example.
In this case, the ERROR label is not reachable, and we want to
prove that with predicate abstraction.
First step: we want to know what are all the reachable locations.
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡
v1
v2
v3
v4
v5
v6
v2’
v7
v3'
v8
v9
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
(V, E, 𝑣𝑒𝑛 ) − is a directed acyclic graph
v2
𝜈 – is a map from nodes to control locations
(several nodes can map to the same pc)
v3
v4
v5
In the graph example
𝑣𝑖 maps to the control reaching
line i of code. Apostrophes are
used to distinguish different
nodes mapped to the same
revisited line (e.g. 𝑣2 , 𝑣2 ′).
v6
v2’
v7
v3'
v8
v9
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
𝜏 – is a map from edges (E) to actions
(instructions) of the program
v2
v3
v4
v5
In the graph example
𝜏(𝑣1 , 𝑣2 )=“i=0,x=0;”
v6
v2’
v7
v3'
v8
v9
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v2
v3
{𝑡𝑟𝑢𝑒}
𝜓 – is a map from nodes (V) to formulas
over program variables.
{𝑡𝑟𝑢𝑒}
v4
v5
{𝑡𝑟𝑢𝑒}
In the graph example
v3'
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
option1 : all true – represents
reachable locations.
v7
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v8
{𝑡𝑟𝑢𝑒}
v9
{𝑡𝑟𝑢𝑒}
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
{𝑡𝑟𝑢𝑒}
{𝑥 ≥ 0}
v2
v3
{𝑥 ≥ 0}
𝜓 – is a map from nodes (V) to formulas
over program variables.
{𝑥 ≥ 0}
v4
v5
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
In the graph example
v3'
v6
{𝑥 ≥ 0}
v2’
{𝑥 ≥ 0}
option2: general formulas over
variables – abstracts variables
values reaching this location.
v7
{𝑡𝑟𝑢𝑒}
{𝑓𝑎𝑙𝑠𝑒} v8
{𝑥 ≥ 0}
v9
{𝑡𝑟𝑢𝑒}
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
{𝑡𝑟𝑢𝑒}
⊑ – an ancestor relation over the nodes
{𝑡𝑟𝑢𝑒}
v2
v3
Used to define fixed point, and covered
vertexes. If 𝑣2′ is covered by 𝑣2, we don’t need
{𝑡𝑟𝑢𝑒}
to explore more iterations of the loop.
{𝑡𝑟𝑢𝑒}
v4
v5
{𝑡𝑟𝑢𝑒}
In the graph example
v3'
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
v7
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v8
𝑣2′ is covered by 𝑣2 if:
1. 𝑣2 ⊑ 𝑣2′,
2.
𝑣2′ is dominated by 𝑣2 (all paths
from 𝑣𝑒 = 𝑣1 pass through it)
{𝑡𝑟𝑢𝑒} 3. 𝜈 v2 = 𝜈(v2′ ) same code line
4. 𝜓 v2′ → 𝜓(v2) – the label for v2′ is
v9 {𝑡𝑟𝑢𝑒}
subsumed by v2 label.
ARG Definiton
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We want to build an abstract reachability graph for it.
ARG: 𝐴 = V, E, 𝑣𝑒𝑛 , 𝜈, 𝜏, 𝜓, ⊑, ⊑𝑡 where
v1
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v2
v3
{𝑡𝑟𝑢𝑒}
⊑𝑡 – a fixed linearization of the topological
order.
Gives us the order by which to traverse the
graph.
{𝑡𝑟𝑢𝑒}
v4
v5
{𝑡𝑟𝑢𝑒}
In the graph example (one option)
v3'
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
𝑣2′ ⊑𝑡 𝑣6 ⊑𝑡 𝑣4 ⊑𝑡 𝑣5 ⊑𝑡 𝑣3 ⊑𝑡 𝑣2.
v7
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v8
{𝑡𝑟𝑢𝑒}
v9
{𝑡𝑟𝑢𝑒}
Post operator in abstract
interpretation:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Post operator:
Given:
- An abstract state u
- An operation (instruction from code)
- An abstraction level (such as set of predicates)
Returns:
The successor state abstraction.
Post operator in abstract
interpretation:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Post operator:
Given:
- An abstract state u
- An operation (instruction from code)
- An abstraction level (such as set of predicates)
Returns:
The successor state abstraction.
Definition:
Post(u,v)=ϕ such that:
𝜓 𝑢 ∧ 𝜏 𝑢, 𝑣 ⇒ 𝜙`
Where 𝜓 𝑢 is the abstraction of state 𝑢.
𝜏 𝑢, 𝑣 is the instruction from code and
its interpretation under the abstraction
Post operator in abstract
interpretation:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Post operator:
Given:
- An abstract state u
- An operation (instruction from code)
- An abstraction level (such as set of predicates)
Returns:
The successor state abstraction.
Example
Assume you have predicates P1:(i<n) P2:(i<=n)
You want to know their values after “i=i+1” (P1`,P2`)
on an abstract edge (u,v)
If only P1 was true before “i=i+1” we don’t know P1`.
-But we know that P2` will be true.
-If P1 was False that will mean i>=n held before
“i=i+1” which will mean P1 and P2 will be false after it.
-And so on..
Post operator in abstract
interpretation:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Post operator:
Given:
- An abstract state u
- An operation (instruction from code)
- An abstraction level (such as set of predicates)
Returns:
The successor state abstraction.
Example
Assume you have predicates P1:(i<n) P2:(i<=n)
You want to know their values after “i=i+1” (P1`,P2`)
on an abstract edge (u,v)
P1’= if ¬P1 then F
else unknown
- P2’= if P1 then T
else if ¬ P1 then F
else unknown
Post operator
run example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
P1:(i<n) P2:(i<=n)
v1
v2
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
The transition from v1 to v2
doesn’t change the predicates
Post(v1,v2)=true
Post operator
run example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
P1:(i<n) P2:(i<=n)
v1
v2
v3
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
The transition from v2 to v3
sets both predicates to true
Post(v2,v3)=P1∧P2
Post operator
run example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
P1:(i<n) P2:(i<=n)
v1
v2
v3
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v4
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v5
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
The transition from v3 to v4 or
from v3 to v5 doesn’t change the
predicates
…
Post operator
run example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
P1:(i<n) P2:(i<=n)
v1
v2
v3
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v4
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v5
v6
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
The transition from v3 to v4 or
v5 doesn’t change the predicates
And so does the transition from
v4 to v6 or from v5 to v6.
So their join is the same.
Post operator
run example
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
P1:(i<n) P2:(i<=n)
v1
v2
v3
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v4
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v5
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v6
{𝑖 < 𝑛 ∧ 𝑖 ≤ 𝑛}
v2’
{𝑖 ≤ 𝑛}
…
P1’= if ¬P1 then F
else unknown
- P2’= if P1 then T
else if (¬ P1 ∧ P2) then F
else unknown
The transition from v6 to v2’ is
as previously discussed
Under approximation
driven verification:
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
For UD – Post operator will always return true.
And we will see refinement, using interpolants.
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
{𝑡𝑟𝑢𝑒}
An initial node 𝑣1 is created and
given the label true.
𝑣1 has a single successor 𝑣2 which
we will continue to explore.
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
𝑣1 has a single successor 𝑣2
and as previously mentioned, the Post
operator will return true.
𝑣2 has two possible successors,
we will continue to explore 𝑣3 for now
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v3
v7
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
v3
{𝑡𝑟𝑢𝑒}
v4
v3'
Post operator will return true for 𝑣3.
And in that fashion, the exploration
will continue until finishing the loop
iteration and reaching the beginning
of the loop a second time – a node 𝑣2′.
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
𝑣2′ has two sons, 𝑣3′ – which indicates
a second iteration of the loop
and 𝑣7 – which indicates exiting the
loop after one iteration or more.
{𝑡𝑟𝑢𝑒}
v5
{𝑡𝑟𝑢𝑒}
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
v7
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v2
v3
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v4
v3'
𝑣2′-s label is subsumed by the one of
𝑣2 meaning the exploration of 𝑣3′ will
not provide new information, and its
label will be the same as the one of 𝑣3.
This is indicated by the black arrow
from 𝑣2′ to 𝑣2.
v5
{𝑡𝑟𝑢𝑒}
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v7
Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v2
v3
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v4
v3'
After finishing exploring all the paths,
the label of the error node 𝑣8 is not
false.
So we want to check:
1. if there is a concrete counter part to
the 2 paths 𝑣1 → ⋯ → 𝑣8.
2. if not reachable, use interpolants
to find new labels that capture
why those paths are not reachable.
v5
{𝑡𝑟𝑢𝑒}
v6
{𝑡𝑟𝑢𝑒}
v2’
{𝑡𝑟𝑢𝑒}
We describe next, how this Counter
Example Guided Abstraction
Refinement (CEGAR) phase is done.
v7
{𝑡𝑟𝑢𝑒}
{𝑡𝑟𝑢𝑒}
v8
{𝑡𝑟𝑢𝑒}
v9
{𝑡𝑟𝑢𝑒}
Building a formula for
CEGAR
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
We ignore all nodes and edges
irrelevant to the abstract path to err.
And, we add a boolean variable to each
node -- for convenience it will be the
name of the node.
v1
v2
Intuitively, if 𝑣1, 𝑣2, 𝑣3, 𝑣4, 𝑣6, 𝑣2′ , 𝑣7
𝑎𝑛𝑑 𝑣8 are all true then this path will
be feasible under concrete execution.
v3
v4
v5
Next, we add formulas for edges.
Similar to the way it would have been
done for Bounded Model Checking.
v6
v2’
v7
v8
Building a formula for
CEGAR
We use Static Single Assignment (SSA)
Form.
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Definition:
A program is in SSA form if an
assignment to each variable appears
at most once in its syntax.
v1
v2
v3
v4
Therefore we rename variables for
which assignments appear more then
once.
“𝑥“ will be 𝑥0 at lines 1—3
will become 𝑥1 at line 4
𝑥2 at line 5 etc.
v5
v6
v2’
v7
v8
Building a formula for
CEGAR
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
“6.i = i + 1;” will translate to a formula on
the edge 𝑣6, 𝑣2′ :
𝑒𝑛𝑐𝑜𝑑𝑒 𝑣6, 𝑣2′ = (𝑖1 = 𝑖0 + 1)
We use the path formulas to capture
error execution in the ARG:
𝜇6 : 𝑣6 ⇒ (𝑒𝑛𝑐𝑜𝑑𝑒 𝑣6, 𝑣2′ ∧ 𝑣2′)
v1
v2
v3
v4
v5
v6
v2’
v7
v8
Meaning if 𝑣6 is reached then 𝜋(𝑣6,𝑣2′)
will be taken and 𝑣2′ will be reached.
To avoid name conflicts each time a
variable appears on left side of an
assignment it receives a new subscript
(this is SSA).
Such as for 𝑒𝑛𝑐𝑜𝑑𝑒 𝑣6, 𝑣2′ .
Building a formula for
CEGAR
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
For the graph example we will receive:
𝜇1 : 𝑣1 ⇒ (𝑖0 = 0 ∧ 𝑥0 = 0 ∧ 𝑣2)
𝜇2 : 𝑣2 ⇒ ((𝑖0 < 𝑛 ∧ 𝑣3)
∨ 𝑖0 ≥ 𝑛 ∧ 𝑥4 = 𝑥0 ∧ 𝑣7 )
𝜇3 : 𝑣3 ⇒ ( 𝑖0 ≤ 2 ∧ 𝑣4 ∨ 𝑖0 > 2 ∧ 𝑣5 )
𝜇4 : 𝑣4 ⇒ (𝑥1 = 0 ∧ 𝑥3 = 𝑥1 ∧ 𝑣6)
𝜇5 : 𝑣5 ⇒ (𝑥2 = 𝑖0 ∧ 𝑥3 = 𝑥2 ∧ 𝑣6)
𝜇6 : 𝑣6 ⇒ (𝑖1 = 𝑖0 + 1 ∧ 𝑣2’)
𝜇2 ′: 𝑣2′ ⇒ (𝑖1 ≥ 𝑛 ∧ 𝑥4 = 𝑥3 ∧ 𝑣7)
𝜇7 : 𝑣7 ⇒ (𝑥4 < 0 ∧ 𝑣8)
v1
v2
v3
v4
v5
v6
v2’
v7
v8
The formula
𝑣1 ∧ 𝜇1 ∧ 𝜇2 ∧ 𝜇3 ∧ 𝜇4 ∧ 𝜇5 ∧ 𝜇6 ∧ 𝜇2 ′ ∧ 𝜇7
is UNSAT
Solving the formula for
CEGAR
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Definition
An interpolant for 𝐴 ∧ 𝐵(= 𝑈𝑁𝑆𝐴𝑇) is 𝐼 = 𝐼𝑛𝑡 𝐴, 𝐵 such that:
1. 𝐴 ⇒ 𝐼
2. 𝐼 ∧ 𝐵 = 𝑈𝑁𝑆𝐴𝑇
3. 𝐼 is over the intersection of the variables of 𝐵 and 𝐴.
Solving the formula for
CEGAR
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
Definition
An interpolant for 𝐴 ∧ 𝐵(= 𝑈𝑁𝑆𝐴𝑇) is 𝐼 = 𝐼𝑛𝑡 𝐴, 𝐵 such that:
1. 𝐴 ⇒ 𝐼
2. 𝐼 ∧ 𝐵 = 𝑈𝑁𝑆𝐴𝑇
3. 𝐼 is over the intersection of the variables of 𝐵 and 𝐴.
Note: In the following slides links appear to
implementation of the formulas in iz3 (for interpolants)
and z3 (for general formulas).
Pressing the links opens the online z3 or iz3 tool, and
pressing play at the opened site should calculate the
solutions.
Solving the formula for
CEGAR
An interpolant for 𝐴 ∧ 𝐵(= 𝑈𝑁𝑆𝐴𝑇) is 𝐼 = 𝐼𝑛𝑡 𝐴, 𝐵 such that:
1. 𝐴 ⇒ 𝐼
Foo(int n):
2. 𝐼 ∧ 𝐵 = 𝑈𝑁𝑆𝐴𝑇
3. 𝐼 is over the intersection of the variables of 𝐵 and 𝐴.
1. i=0,x=0;
We have:
2. while (i<n)
𝑣1 ∧ 𝜇1 ∧ 𝜇2 ∧ 𝜇3 ∧ 𝜇4 ∧ 𝜇5 ∧ 𝜇2 ′ ∧ 𝜇7
3.
if (i <= 2)
is UNSAT
4.
x = 0;
else
To derive a new label for 𝑣7 we can
5.
x = i;
calculate an interpolant for
6.
i = i + 1;
𝐵 = 𝜇7 and
7. If (x < 0)
′
A
=
𝑣1
∧
𝜇
∧
𝜇
∧
𝜇
∧
𝜇
∧
𝜇
∧
𝜇
1
2
3
4
5
2
8.
ERROR
ℎ𝑡𝑡𝑝://𝑟𝑖𝑠𝑒4𝑓𝑢𝑛. 𝑐𝑜𝑚/𝑖𝑍3/𝑡𝑧𝑄
A
9. return;
We get:
I7 = Int A, B = 𝑣7 ∧ 𝑥4 ≥ 0
v1
v2
v3
v4
v5
v6
v2’
v7
𝐼7
B
v8
Solving the formula for
CEGAR
To derive a new label for 𝑣2′
we can calculate an interpolant for
𝐵 = 𝜇2′ ∧ 𝜇7 and
A = 𝑣1 ∧ 𝜇1 ∧ 𝜇2 ∧ 𝜇3 ∧ 𝜇4 ∧ 𝜇5 ∧ 𝜇6
http://rise4fun.com/iZ3/5b
In that case we will receive:
(after transforming to nnf )
𝐼2′
= ( 𝑥4 ≥ 0 ∨ 𝑥4! = 𝑥3 ) ∧ 𝑣2′)
∨ ( 𝑥4 ≥ 0 ∧ 𝑣7)
Informally it means that either execution
reaches 𝑣2′ with 𝑥4 ≥ 0 or it reaches
𝑣7 with 𝑥4 ≥ 0 .
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
v3
A
v4
v5
v6
v2’
𝐼2′
v7
B
v8
The resulting formula needs cleaning to
get a label for 𝑣6.
Cleaning the formula of
CEGAR
𝐼2′
= ( 𝑥4 ≥ 0 ∨ 𝑥4! = 𝑥3 ) ∧ 𝑣2′)
∨ ( 𝑥4 ≥ 0 ∧ 𝑣7)
We want to extract for v2′ the label (𝑥3
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
v3
A
v4
v5
v6
v2’
𝐼2′
v7
B
v8
Cleaning the formula of
CEGAR
If we return to the equations we got
interpolants from
𝑥4 is relevant for 𝑣7
𝑥0 is relevant for 𝑣2
𝒙𝟑 is relevant for 𝒗𝟐′
𝒙𝟒 is relevant for 𝒗7
B
𝐼2′
= ( 𝑥4 ≥ 0 ∨ 𝑥4! = 𝑥3 ) ∧ 𝑣2′)
∨ ( 𝑥4 ≥ 0 ∧ 𝑣7)
We want to extract for v2′ the label
𝑥3 ≥ 0 .
Why x3?
𝜇1 : 𝑣1 ⇒ (𝑖0 = 0 ∧ 𝑥0 = 0 ∧ 𝑣2)
𝜇2 : 𝑣2 ⇒ ((𝑖0 < 𝑛 ∧ 𝑣3)
∨ 𝑖0 ≥ 𝑛 ∧ 𝑥4 = 𝑥0 ∧ 𝑣7 )
𝜇3 : 𝑣3 ⇒ ( 𝑖0 ≤ 2 ∧ 𝑣4 ∨ 𝑖0 > 2 ∧ 𝑣5 )
𝜇4 : 𝑣4 ⇒ (𝑥1 = 0 ∧ 𝑥3 = 𝑥1 ∧ 𝑣6)
𝜇5 : 𝑣5 ⇒ (𝑥2 = 𝑖0 ∧ 𝑥3 = 𝑥2 ∧ 𝑣6)
𝜇6 : 𝑣6 ⇒ (𝑖1 = 𝑖0 + 1 ∧ 𝑣2’)
𝜇2 ′: 𝑣2′ ⇒ (𝑖1 ≥ 𝑛 ∧ 𝑥4 = 𝑥3 ∧ 𝑣7)
𝜇7 : 𝑣7 ⇒ (𝑥4 < 0 ∧ 𝑣8)
Cleaning the formula of
CEGAR
𝐼2′
= ( 𝑥4 ≥ 0 ∨ 𝑥4! = 𝑥3 ) ∧ 𝑣2′)
∨ ( 𝑥4 ≥ 0 ∧ 𝑣7)
We want to extract for v2′ the label
𝑥3 ≥ 0 .
To do so:
we will quantify all the variables out of
𝑣2′ scope - in this case 𝑥4;
and quantify all node-variables other then
𝑣2′ - in this case 𝑣7.
To remove the 𝑣2′ variable we set it to
true.
http://rise4fun.com/Z3/d8km
And so we receive 𝑥3 ≥ 0 .
(actually 𝑥3 > −1 )
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
v3
A
v4
v5
v6
v2’
𝐼2′
v7
B
v8
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖 means variables relevant to that node.
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖 means variables relevant to that node.
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖 means variables relevant to that node.
Why is it quantified ∀ for things we want to disappear?
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖 means variables relevant to that node.
Why is it quantified ∀ for things we want to disappear?
For example we did:
∀𝑣7. 𝐼2′ = ∀𝑣7. ( 𝑥4 ≥ 0 ∨ 𝑥4! = 𝑥3 ) ∧ 𝑣2′) ∨ ( 𝑥4 ≥ 0 ∧ 𝑣7)
We wanted the invariant that holds at node 𝑣2′ regardless of whether
𝑣7 was reachable or not.
So we search solution both for when 𝑣7 = 𝑇(reachable) and when
𝑣7 = 𝐹.
Cleaning the formula of
CEGAR
𝐶𝐿𝐸𝐴𝑁 𝐼𝑖 ≜ ∀ 𝑥 𝑥 ∈ 𝑣𝑎𝑟 𝐼𝑖 ∧ ¬𝑖𝑛𝑆𝑐𝑜𝑝𝑒 𝑥, 𝑢𝑖
Foo(int n):
⋅ ∀{𝑐𝑢𝑖 |𝑢𝑗 ∈ 𝑉} ⋅ 𝐼𝑖 [𝑐𝑢𝑖 ← 𝑇]
Where 𝑣𝑎𝑟 𝐼𝑖 is the set of variables and 𝑐𝑢𝑖 the boolean variable we
added. (both were 𝑣𝑖 so far)
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
𝑇ℎ𝑒𝑜𝑟𝑒𝑚 3(from the paper) Let 𝐼′𝑘 =
𝐶𝐿𝐸𝐴𝑁(𝐼𝑘 ).
a. If k=1 then 𝐼′𝑘 ≡ 𝑡𝑟𝑢𝑒 and if k=n then
𝐼′𝑘 ≡ 𝑓𝑎𝑙𝑠𝑒
b. For any two nodes 𝑢𝑖 , 𝑢𝑗 ∈ 𝑉 s.t.
𝑢𝑖 , 𝑢𝑗 ∈ 𝐸 :
𝐼′𝑖 ∧ 𝑒𝑛𝑐𝑜𝑑𝑒 𝑢𝑖 , 𝑢𝑗 ⇒ 𝐼′𝑗
v1
v2
v3
v4
v5
v6
Where 𝑒𝑛𝑐𝑜𝑑𝑒 𝑢𝑖 , 𝑢𝑗 is the formula on
the edge as shown previously.
v2’
v7
v8
Back to Under approximation
driven verification:
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
After cleaning we get a new label per
each node.
v1
{𝑡𝑟𝑢𝑒}
{𝑥 ≥ 0}
v2
v3
{𝑥 ≥ 0}
{𝑥 ≥ 0} v4
v3'
If the label of v2′ is not still subsumed by
the label of 𝑣2, we continue to explore
𝑣3′ and iterations 2,3 etc. of the loop.
With Post operator returning true as a
label for each new node.
v5
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v6
{𝑥 ≥ 0}
v2’
{𝑥 ≥ 0}
In this case, the label of v2′ is still
subsumed by the label of 𝑣2 so the
algorithm terminates.
v7
{𝑡𝑟𝑢𝑒}
{𝑓𝑎𝑙𝑠𝑒} v8
{𝑥 ≥ 0}
v9
{𝑡𝑟𝑢𝑒}
Over approximation driven
verification:
Over approximation driven
verification:
Assuming we started with operator Post
as true, and refinement staged returned
as described before.
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
{𝑥 ≥ 0}
v2
v3
{𝑥 ≥ 0}
{𝑥 ≥ 0} v4
v3'
We take the predicates it used, in this
case 𝑥 ≥ 0, 𝑖 ≥ 0 an recalculate Post
operator as described before.
{𝑡𝑟𝑢𝑒}
v5
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v6
{𝑥 ≥ 0}
v2’
{𝑥 ≥ 0}
v7
{𝑡𝑟𝑢𝑒}
{𝑓𝑎𝑙𝑠𝑒} v8
{𝑥 ≥ 0}
v9
{𝑡𝑟𝑢𝑒}
Over approximation driven
verification:
Statement “i=0,x=0;” sets both predicates
to true.
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
And they stay true through the rest of the
program.
{𝑡𝑟𝑢𝑒}
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v3
v4
v5
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v6
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v2’
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v7
v3'
{𝑓𝑎𝑙𝑠𝑒} v8
v9
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
UFO:
UFO:
In this paper the authors start with UD
and after CEGAR continue with the new
Post operator they get.
Foo(int n):
1. i=0,x=0;
2. while (i<n)
3.
if (i <= 2)
4.
x = 0;
else
5.
x = i;
6.
i = i + 1;
7. If (x < 0)
8.
ERROR
9. return;
v1
v2
v3
{𝑥 ≥ 0} v4
{𝑡𝑟𝑢𝑒}
𝑥 ≥0∧𝑖 ≥0 ?
Meaning, if 𝑣2 was not still subsumed by
the label of 𝑣2 they would have
continued exploring from 𝑣2′ with post
operator for 𝑥 ≥ 0, 𝑖 ≥ 0 .
{𝑡𝑟𝑢𝑒}
{𝑥 ≥ 0}
{𝑥 ≥ 0}
v5
{𝑥 ≥ 0 ∧ 𝑖 ≥ 0}
v6
{𝑥 ≥ 0}
v2’
{𝑥 ≥ 0}
v7
v3'
{𝑓𝑎𝑙𝑠𝑒} v8
{𝑥 ≥ 0}
v9
{𝑡𝑟𝑢𝑒}
Boolean/Cartezian Predicate
Abstraction
Boolean Predicate Abstraction
Given predicates 𝑝1 , 𝑝2 , … , 𝑝𝑛 we represent them using boolean vectors (𝑏1 , 𝑏2 , … , 𝑏𝑛 ) where
𝑏𝑖 = 𝑡𝑟𝑢𝑒 ↔ 𝑝𝑖 = 𝑡𝑟𝑢𝑒.
𝑇, 𝑇, 𝑇 ,
(𝑝1 ∧ 𝑝2 ∧ 𝑝3) ∨ (¬𝑝1 ∧ 𝑝2 ∧ 𝑝3) ∨ (𝑝1 ∧ ¬𝑝2 ∧ 𝑝3)
𝐹, 𝑇, 𝑇 ,
𝑇, 𝐹, 𝑇
We will have 2𝑛 possible states per each program counter location.
Cartesian Predicate Abstraction
We represent a cross product 𝑃1 × 𝑃2 × ⋯ × 𝑃𝑛 .
At each location we store separately per each predicate if it is 𝑡𝑟𝑢𝑒, 𝑓𝑎𝑙𝑠𝑒.
If the predicate can be both we store “∗”.
(𝑝1 ∧ 𝑝2 ∧ 𝑝3) ∨ (¬𝑝1 ∧ 𝑝2 ∧ 𝑝3) ∨ (𝑝1 ∧ ¬𝑝2 ∧ 𝑝3)
(Note that (¬𝑝1 ∧ ¬𝑝2 ) is now also part of the state.)
(∗,∗, 𝑇)
A more compact representation (compared to Boolean) but we loose precision.
Results
• 105 programs in benchmark
• Compared with Wolverine http://www.cprover.org/wolverine/
• 5 versions of UFO
1.
2.
3.
4.
5.
Pure UD called ufoNo (Post returns true)
With Cartesian Predicate abstraction called ufoCP
With Boolean Predicate abstraction called ufoBP
Pure OD with Cartesian Predicate abstraction called CP
Pure OD with Boolean Predicate abstraction called BP
• Reports results for instances that should verify
(#Safe) number of instances solved.
and for instance where an error should be
discovered (#Unsafe) number of instances solved.
Results
Results
• UFO performs much better then Wolverine
• cpUFO performs significantly better than all other UFO
configurations.
• In the next slide we go deeper in to results and per example
first for #SAFE instances and then for #UNSAFE
• Benchmarks of token ring protocols and SSH servers various
hand shaking protocols.
• Fastest time at each line emphasized
Results a closer look
(Safe)
Results a closer look
(Safe)
• Number of refinements goes down as you go down
the predicate abstraction
• CP failed for all but 3 examples so wasn’t included
in results.
• No one clear winner in terms of time. Can be seen
also from the Unsafe results.
Results a closer look
(UnSafe)
FIN