By Dirk Beyer, Alessandro Cimatti, Alberto Griggio, Erkan Keremoglu and Roberto Sebastiani Simon...
-
Upload
damaris-strother -
Category
Documents
-
view
220 -
download
4
Transcript of By Dirk Beyer, Alessandro Cimatti, Alberto Griggio, Erkan Keremoglu and Roberto Sebastiani Simon...
By Dirk Beyer, Alessandro Cimatti, Alberto Griggio, Erkan Keremoglu and Roberto Sebastiani
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
A successful approach to model checking is through construction and analysis of an abstract reachability tree (ART) + predicate abstraction
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Unwind
ART nodes consist of Control-Flow Location Call stack Data State formulas
In Single-Block Encoding (SBE) each program op is represented by a single edge in ART Huge number of paths and nodes
But in Large-Block Encoding (LBE) entire part of the program is represented by an edge Smaller number of paths are enumerated in ART Exponential reduction in number of states (maybe)
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
We use Satisfiability Modulo Theories (SMT)
SBE LBE(more general representation of
abstract states)
Conjunction of Predicates Arbitrary Boolean Combination of Predicates
More Accurate Abstract Successor Computation
SBE + Cartesian Abs(BLAST, SLAM)
LBE + Boolean Abstraction(CPACHECKER)
Large number of successor computations
Reduced number of successor computations
Efficient computation of Cartesian abstraction by SMT
Boolean abstraction is expensivetradeoff
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
SBE
LBE
We work on a simple imperative PL Assume Op Assignment Just integers
Program is presented by a Control Flow Automaton (CFA) CFA: A(L, G) Program: P = (A, l0, lE)
A concrete data state of the program is a variable assignment like c that assigns to each variable an integer value
A formula φ represents the set S of states c that: S = {c | c |= φ}
SPOP (φ): represents the set of data states that are reachable from states in region φ after applying OP
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
We define precision (like π) as a finite subset from the universal predicate set of the program
Cartesian Predicate Abstraction: A CartPA φ c
π of a formula φ is the strongest conjunction of predicates from π entailed by φ
This is used as an Abstract State
Boolean Predicate Abstraction: A BoolPA φ B
π of a formula is the strongest combination of predicates from π entailed by φ
Simon Fraser University (Spring 09)
Presentation By:Pashootan Vaezipoor
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Cartesian Abstraction Boolean Abstraction
Simple Complex
Efficient Expensive
Imprecise Precisetradeoff
The Precision function assigns to each program location, a precision formula
The nodes of ART are like n=(l, φ) The tree is complete when there are no
uncovered nodes, or all possible abstract successor states are present in the ART as the children of the node
If the final ART does not have any error nodes, then we are done
Else the error path is checked for feasibility If feasible: the error is reported If not feasible: refinement!
For practical reasons, SBEs use Cartesian abstraction
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Each large control-flow subgraph that is free of loops is replaced with a single control-flow edge with a large formula
This is done with applying the following rules: Rule 0 (Error Sink): make all error points, a
sink Rule 1 (Sequence): remove intermediate
nodes and go directly to successor nodes Rule 2 (Choice): If there are two edges btw two
nodes we should replace that with a single edge
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Rule 1 Rule 2
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
LBE: Possibly exponentially smaller ARTs Less abstract refinement steps Each step is more expensive than SBE More expressive representation of
abstract states
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
In the paper, BLAST is used for the model checking phase All four configs are tested:▪ bfs▪ dfs▪ predH 0▪ predH 7
The config –dfs –predH 7 is the winner for programs without defects
For unsafe programs –bfs –predH 7 is winner
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor
In the experiments, all four combinations of LBE vs. SBE and Cartesian vs. Boolean abstraction are tested
Results: SBE doesn’t benefit from Boolean
Abstraction Combination of LBE with Cartesian
Abstraction failed to solve any experiments due to the loss of precision
SBE + CartAbs is OK LBE + BoolAbs is OK
Simon Fraser University (Spring 09)Presentation By:
Pashootan Vaezipoor