© Anvesh Komuravelli Quantified Invariants in Rich Domains using Model Checking and Abstract...

© Anvesh Komuravelli

Quantified Invariants in Rich Domainsusing

Model Checking and Abstract Interpretation

Anvesh Komuravelli, CMU

Joint work with Ken McMillan

© Anvesh Komuravelli 2

The Problem

Array-Manipulating Program P

+ Assertions

Automatic analysis for

assertion failures

Safe + Proof

Unsafe + CEX

Unknown + Partial Proof

Quantified Invariants!


Quantified Invariants, Typically

Specialized Abstract Domains

E.g. Segmentation abstraction,Indexed Predicate

Abstraction,Points-to Analysis, etc.

• Restrictive• False warnings

Unrestricted Model Checking

E.g. Interpolation-based

• Hard to find the right quantifiers• Divergence

Rich-enough abstract domain?


The abstract domain

i := 0;while (i < n) {

//a[i] := c;i++;

}

assume (0 ≤ k < n)assert (a[k] = c)

Quantified variables

Predicate signature

AbstractDomain

Goal: Find a quantifier-free interpretationof the predicates


Guess-and-check doesn’t work anymore!

i := 0;while (i < n) {

//a[i] := c;i++;

}


Given a guess for P, how to check if it suffices?

FOL validity is undecidable!

Can we still use existing model checkers?


Let’s look at the VCs

i := 0;while (i < n) {

//a[i] := c;i++;

}



Pulled to the outermost

scope




Real challenge!

Find a sufficient set of witnesses



Reduces to quantifier-freeinvariant generation

(use an off-the-shelfmodel checker)


Two Goals

i := 0;while (i < n) {

//a[i] := c;i++;

}


Quantified variables

Predicate signature

AbstractDomain

Goal 2: Find a quantifier-free interpretationof the predicates

Goal 1: Find a sufficient set ofwitnesses for j


A Strategy

Guess some witnesses

Check if they suffice using a model checkerY

Found Proof

N

Give up!

Eager Syntactic Pattern Matching

[BMR13]

[BMR13]: On Solving Universally Quantified Horn Clauses,Bjorner, McMillan, Rybalchenko, SAS’13

• Unguided instantiation• Worst-case unbounded• Grows exponentially with

number of quantified vars• May choke the model checker• No fall-back strategy


Our Strategy

Guess some witnesses

Check if they suffice using a model checkerY

Found Proof

N CEX

Refine the guessConstraint

on the witness

Guess-and-check,but of the witnesses and

not the invariant itself


Obtaining Strong Constraints

Generalized Counterexamples Strong Constraints

Symbolic Counterexamples

• Number of variables = O(size)• Constraint solving becomes harder

(easily diverging)

Ground Counterexamples+

Abstract Interpretation


Note – one witness suffices!

is equivalent to

May not be expressible!


Concrete vs. Abstract


The algorithm[B]

[L]

[E]


The algorithm

Instantiate Check

[B]

[L]

[E]

P(k0,v0,i0,c0)

P(k1,v1,i1,c1)

P(k2,v2,i2,c2)

B

L

L

E


The algorithm

Instantiate Check

P(k0,v0,i0,c0) P(k1,v1,i1,c1) P(k2,v2,i2,c2)B L L E

Analyze


The algorithm

Instantiate Check

P(0,0,0,0) P(0,0,1,0) P(0,0,2,0)B L L E

Analyze

✕?

✕?

✕?

✕?


P(0,0,0,0) P(0,1,0,0) P(0,2,0,0)B L L E

✕?

✕?

✕?

✕?

Use k for j

The algorithm

Instantiate Check Analyze


The algorithm

Instantiate

[B]

[L]

[E]


The algorithm

Instantiate

[B]

[L]

[E]

…


Finding a new witness

Given Constraint

Check

local vars

quantified variable

Skolem Template f

Solve for t using sampling-based approachrestrict to

linear templates


Add lc to existing samples S

Pick candidate tc

Quantifier Alternation using Sampling

?Y

Return tc

CEX lc

?

N

CEX SNY

Newcandidate

tc

Source of Divergence!

Quantifier Elimination

Eliminate arrays(thanks to Nikolaj for

the discussion),

Cheap QE of integers


Abstract Post, in practice

1. Cheap QE tricks, case-split on equalities on j, etc.2. Under-approximate, otherwise.

SolveGeneralize models

1. Cheap QE tricks, case-split on array-index arguments, etc.2. Under-approximate, otherwise.

Solve an SMT problemGeneralize models


Experiments

Implemented “qe_array” tactic in Z3 Prototype in Python using Z3Py interface for witness generation

Automatically generated “sufficient witnesses” for small array-manipulatingprograms (BMR13) – array init, find, copy, concatenate, reverse, etc. Used GPDR engine in Z3 to solve for quantifier-free predicates Up to two universal quantifiers per predicate Witness was just a local variable in the VC


Moving forward…

Scalability

Handle large programs (with multiple procedures) How to pick relevant “set” of witnesses? Can we synthesize guards to combine them into a single witness?

Implementation-wise

Cache previous AI results Reuse bounded proofs – Proof-based Abstraction Lazy QE – postponing to later steps?

Alternatives

Use over-approximations of reachable states Witness may not exist – need to refine the approximation


Questions?

© Anvesh Komuravelli Quantified Invariants in Rich Domains using Model Checking and Abstract...

Documents

Transcript of © Anvesh Komuravelli Quantified Invariants in Rich Domains using Model Checking and Abstract...