On solving existentially quantified Horn clauses (and proving CTL ...
Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey...
Transcript of Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey...
![Page 1: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/1.jpg)
Solving (Quantified) Horn Clauses
Andrey RybalchenkoMicrosoft Research Cambridge and TUM
joint work with
T. Beyene, N. Bjørner,S. Chaudhuri, K. McMillan, and C. Popeea
October 4, 2013
1 / 38
![Page 2: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/2.jpg)
Program Verification and Synthesis as(Horn) Constraint Solving
I Universal temporal properties, e.g., LTL
I Quantifier free invariants/auxiliary assertions
I Proof rule formalization as Horn clauses
2 / 38
![Page 3: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/3.jpg)
Transition System
I v - program variables
I init(v) - initial states
I step(v , v ′) - transition relation
I safe(v) - safe states
3 / 38
![Page 4: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/4.jpg)
Safety and Termination (WF) of Transition System
∃inv(v) :
init(v)→ inv(v)
inv(v) ∧ step(v , v ′)→ inv(v ′)
inv(v)→ safe(v) safety
wf (inv(v) ∧ step(v , v ′)) well-foundedness
4 / 38
![Page 5: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/5.jpg)
Safety and Termination (WF) of Transition System
∃inv(v) :
init(v)→ inv(v)
inv(v) ∧ step(v , v ′)→ inv(v ′)
inv(v)→ safe(v) safety
wf (inv(v) ∧ step(v , v ′)) well-foundedness
4 / 38
![Page 6: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/6.jpg)
From WF to DWF
wf (rel(v , v ′))
iff
∃ti(v , v ′) :
rel(v , v ′)→ ti(v , v ′)
ti(v , v ′) ∧ rel(v ′, v ′′)→ ti(v , v ′′)
dwf (ti(v , v ′)) disjunctive
well-foundedness
5 / 38
![Page 7: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/7.jpg)
Program with procedures
I v - program variables
I init(v) - initial states of main procedure
I step(v , v ′) - intra-procedural transition relation
I safe(v) - safe states
I call(v , v ′) - parameter passing relation
I ret(v , v ′) - return value passing
6 / 38
![Page 8: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/8.jpg)
Program with procedures
I v - program variables
I init(v) - initial states of main procedure
I step(v , v ′) - intra-procedural transition relation
I safe(v) - safe states
I call(v , v ′) - parameter passing relation
I ret(v , v ′) - return value passing
6 / 38
![Page 9: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/9.jpg)
Safety and Termination of Program with Procedures
∃sum(v , v ′) :
init(v0)→ sum(v0, v0)
sum(v0, v1) ∧ step(v1, v2)→ sum(v0, v2)
sum(v0, v1) ∧ call(v1, v2)→ sum(v2, v2)
sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4)→ sum(v0, v4)
sum(v0, v1)→ safe(v1)
wf (∃v1 : sum(v0, v1) ∧ call(v1, v2))
7 / 38
![Page 10: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/10.jpg)
Safety and Termination of Program with Procedures
∃sum(v , v ′) :
init(v0)→ sum(v0, v0)
sum(v0, v1) ∧ step(v1, v2)→ sum(v0, v2)
sum(v0, v1) ∧ call(v1, v2)→ sum(v2, v2)
sum(v0, v1) ∧ call(v1, v2) ∧ sum(v2, v3) ∧ ret(v3, v4)→ sum(v0, v4)
sum(v0, v1)→ safe(v1)
wf (∃v1 : sum(v0, v1) ∧ call(v1, v2))
7 / 38
![Page 11: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/11.jpg)
Multi-Threaded Program
I v = (g , l1, l2) - global and thread-local variables
I init(v) - initial states
I safe(v) - safe states
I step1 (v , v ′) - transition relation of 1st thread, preserves l2I step2 (v , v ′) - transition relation of 2nd thread, preserves l1
8 / 38
![Page 12: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/12.jpg)
Multi-Threaded Program
I v = (g , l1, l2) - global and thread-local variables
I init(v) - initial states
I safe(v) - safe states
I step1 (v , v ′) - transition relation of 1st thread, preserves l2I step2 (v , v ′) - transition relation of 2nd thread, preserves l1
8 / 38
![Page 13: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/13.jpg)
Rely/Guarantee Rule for Safety
∃inv1 (v) ∃inv2 (v) ∃env1 (v , v ′) ∃env2 (v , v ′) :
init(v)→ inv1 (v)
inv1 (v) ∧ step1 (v , v ′)→ inv1 (v ′) ∧ env2 (v , v ′)
inv1 (v) ∧ env1 (v , v ′)→ inv1 (v ′)
· · ·inv1 (v) ∧ inv2 (v)→ safe(v)
Clauses for preservation of inv2 (v) are symmetric
9 / 38
![Page 14: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/14.jpg)
Resolving Rely/Guarantee Rule
∃env2 (v , v ′) :
· · ·inv1 (v) ∧ step1 (v , v ′)→ env2 (v , v ′)
· · ·inv2 (v) ∧ env2 (v , v ′)→ inv2 (v ′)
· · ·
10 / 38
![Page 15: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/15.jpg)
Into Owicki/Gries Rule
· · ·env2 (v , v ′) := inv1 (v) ∧ step1 (v , v ′)
· · ·inv2 (v) ∧ inv1 (v) ∧ step1 (v , v ′)→ inv2 (v ′)
· · ·
11 / 38
![Page 16: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/16.jpg)
Owicki/Gries Rule for Safety
∃inv1 (v) ∃inv2 (v) :
init(v)→ inv1 (v)
inv1 (v) ∧ step1 (v , v ′)→ inv1 (v ′)
inv1 (v) ∧ inv2 (v) ∧ step2 (v , v ′)→ inv1 (v ′)
· · ·inv1 (v) ∧ inv2 (v)→ safe(v)
Clauses for preservation of inv2 (v) are symmetric
12 / 38
![Page 17: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/17.jpg)
Thread-Modular Rule for Safety
∃inv1 (g , l1) ∃inv2 (g , l2) ∃env(g , g ′) :
init(v)→ inv1 (g , l1)
inv1 (g , l1) ∧ step1 (v , v ′)→ inv1 (g ′, l ′1) ∧ env(g , g ′)
· · ·inv1 (g , l1) ∧ inv2 (g , l2)→ safe(v)
Clauses for preservation of inv2 (v) are symmetric
13 / 38
![Page 18: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/18.jpg)
Quantifier Free Horn Clauses
∀v ∀w : body(v ,w)→ head(v)
body(v ,w) and head(v) are quantifier free
14 / 38
![Page 19: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/19.jpg)
15 / 38
![Page 20: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/20.jpg)
Quantified Horn Clauses
I Existential temporal properties, e.g., CTL
I Program synthesis and infinite-state game solving
I Inference of transactions for concurrent programs
∀v ∀w : body(v ,w)→ ∃x : head(v , x)
I Quantified invariants/auxiliary assertions
∀v ∀w : (∀y : body(v ,w , y))→ head(v)
15 / 38
![Page 21: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/21.jpg)
Existentially Quantified Horn Clauses
∀v ∀w : body(v ,w)→ ∃x : head(v , x)
body(v ,w) and head(v , x) are quantifier free
16 / 38
![Page 22: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/22.jpg)
Proving CTL Properties
(init(v), step(v , v ′)) |= EF (q(v))
(init(v), step(v , v ′)) |= EG (EU(p(v), q(v)))
Based on proof system for CTL* by Kesten and Pnueli [TCS’05]
17 / 38
![Page 23: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/23.jpg)
Proving EF (q(v))
∃inv(v) ∃round(v , v ′) :
init(v)→ inv(v)
inv(v) ∧ ¬q(v)→ ∃v ′ : step(v , v ′)
∧ inv(v ′)
∧ round(v , v ′)
wf (round(v , v ′))
18 / 38
![Page 24: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/24.jpg)
Decomposing EG (EU(p(v), q(v)))
(init(v), step(v , v ′)) |= EG (EU(p(v), q(v)))
iff
∃mid(v) :
(init(v), step(v , v ′)) |= EG (mid(v))
(mid(v), step(v , v ′)) |= EU(p(v), q(v))
19 / 38
![Page 25: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/25.jpg)
Proving (init(v), step(v , v ′)) |= EG (mid(v)) and
(mid(v), step(v , v ′)) |= EU(p(v), q(v))
∃mid(v) ∃inv1 (v) ∃inv2 (v) ∃round(v , v ′) :
init(v)→ inv1 (v)
inv1 (v)→ mid(v) ∧ ∃v ′ : step(v , v ′) ∧ inv1 (v ′)
mid(v)→ inv2 (v)
inv2 (v) ∧ ¬q(v)→ p(v) ∧ ∃v ′ : step(v , v ′) ∧ inv2 (v ′) ∧ round(v , v ′)
wf (round(v , v ′))
20 / 38
![Page 26: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/26.jpg)
Solving Infinite-State Game
Given five empty bottles arranged in circle and jar full of water
I Stepmother pours all water from jar into some bottles
I Cinderella empties pair of adjucent bottles
I Jar is refilled for next round
Stepmother wins if some bottle overflows
21 / 38
![Page 27: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/27.jpg)
Formalization of Game Arena
I v = (v1, . . . , v5)
I B - bottle volume
I J - jar volume
init(v) = (v1 = · · · = v5 = 0)
cindy(v , v ′) = (v ′1 = v ′2 = 0 ∧ same(v3, v4, v5) ∨· · ·∨ v ′5 = v ′1 = 0 ∧ same(v2, v3, v4))
step(v , v ′) = (v ′1 ≥ v1 ∧ · · · ∧ v ′5 ≥ v5 ∧v ′1 + · · ·+ v ′5 − (v1 + · · ·+ v5) = J)
over(v) = (v1 > B ∨ · · · ∨ v5 > B)
22 / 38
![Page 28: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/28.jpg)
Stepmother’s Victory as Constraint Satisfaction
∃win(v) ∃round(v , v ′) :
init(v)→ win(v)
win(v) ∧ ¬over(v) ∧ cindy(v , v ′)→ ∃v ′′ : step(v ′, v ′′)
∧ win(v ′′)
∧ round(v , v ′′)
wf (round(v , v ′))
23 / 38
![Page 29: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/29.jpg)
Inference of Transactions
I v = (g , l1, l2) - global and thread-local variables
I init(v) - initial states
I safe(v) - safe states
I a(v , v ′), b(v , v ′) - transitions of 1st thread
I p(v , v ′), q(v , v ′) - transitions of 2nd thread
24 / 38
![Page 30: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/30.jpg)
Inference of Transactions
I v = (g , l1, l2) - global and thread-local variables
I init(v) - initial states
I safe(v) - safe states
I a(v , v ′), b(v , v ′) - transitions of 1st thread
I p(v , v ′), q(v , v ′) - transitions of 2nd thread
24 / 38
![Page 31: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/31.jpg)
Inference of Transactions
I v = (g , l1, l2) - global and thread-local variables
I init(v) - initial states
I safe(v) - safe states
I a(v , v ′), b(v , v ′) - transitions of 1st thread
I p(v , v ′), q(v , v ′) - transitions of 2nd thread
24 / 38
![Page 32: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/32.jpg)
Transaction Inference Constraints
I Abstract transitions
I Commutativity
I Transactions
I Invariance
25 / 38
![Page 33: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/33.jpg)
Abstract Transitions: Thread 1
inv(v) ∧ a(v , v ′)→ a(v , v ′)
inv(v) ∧ a(v , v ′) ∧ b(v ′, v ′′)→ b(v ′, v ′′)
26 / 38
![Page 34: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/34.jpg)
Abstract Transitions: Thread 1
inv(v) ∧ a(v , v ′)→ a(v , v ′)
inv(v) ∧ a(v , v ′) ∧ b(v ′, v ′′)→ b(v ′, v ′′)
26 / 38
![Page 35: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/35.jpg)
Commutativity: Thread 1
a is a right mover and b is a left mover
inv(v) ∧ a(v , v ′) ∧ p(v ′, v ′′)→ ∃v ′′′ : p(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ a(v , v ′) ∧ q(v ′, v ′′)→ ∃v ′′′ : q(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ p(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ p(v ′′′, v ′′)
inv(v) ∧ q(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ q(v ′′′, v ′′)
27 / 38
![Page 36: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/36.jpg)
Commutativity: Thread 1
a is a right mover and b is a left mover
inv(v) ∧ a(v , v ′) ∧ p(v ′, v ′′)→ ∃v ′′′ : p(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ a(v , v ′) ∧ q(v ′, v ′′)→ ∃v ′′′ : q(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ p(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ p(v ′′′, v ′′)
inv(v) ∧ q(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ q(v ′′′, v ′′)
27 / 38
![Page 37: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/37.jpg)
Commutativity: Thread 1
a is a right mover and b is a left mover
inv(v) ∧ a(v , v ′) ∧ p(v ′, v ′′)→ ∃v ′′′ : p(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ a(v , v ′) ∧ q(v ′, v ′′)→ ∃v ′′′ : q(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ p(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ p(v ′′′, v ′′)
inv(v) ∧ q(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ q(v ′′′, v ′′)
27 / 38
![Page 38: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/38.jpg)
Commutativity: Thread 1
a is a right mover and b is a left mover
inv(v) ∧ a(v , v ′) ∧ p(v ′, v ′′)→ ∃v ′′′ : p(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ a(v , v ′) ∧ q(v ′, v ′′)→ ∃v ′′′ : q(v , v ′′′) ∧ a(v ′′′, v ′′)
inv(v) ∧ p(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ p(v ′′′, v ′′)
inv(v) ∧ q(v , v ′) ∧ b(v ′, v ′′)→ ∃v ′′′ : b(v , v ′′′) ∧ q(v ′′′, v ′′)
27 / 38
![Page 39: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/39.jpg)
Transactions
inv(v) ∧ a(v , v ′) ∧ b(v ′, v ′′)→ ab(v , v ′′)
inv(v) ∧ p(v , v ′) ∧ q(v ′, v ′′)→ pq(v , v ′′)
28 / 38
![Page 40: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/40.jpg)
Transactions
inv(v) ∧ a(v , v ′) ∧ b(v ′, v ′′)→ ab(v , v ′′)
inv(v) ∧ p(v , v ′) ∧ q(v ′, v ′′)→ pq(v , v ′′)
28 / 38
![Page 41: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/41.jpg)
Invariance
init(v)→ inv(v)
inv(v) ∧ ab(v , v ′)→ inv(v ′)
inv(v) ∧ pq(v , v ′)→ inv(v ′)
inv(v)→ safe(v)
29 / 38
![Page 42: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/42.jpg)
Invariance
init(v)→ inv(v)
inv(v) ∧ ab(v , v ′)→ inv(v ′)
inv(v) ∧ pq(v , v ′)→ inv(v ′)
inv(v)→ safe(v)
29 / 38
![Page 43: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/43.jpg)
Invariance
init(v)→ inv(v)
inv(v) ∧ ab(v , v ′)→ inv(v ′)
inv(v) ∧ pq(v , v ′)→ inv(v ′)
inv(v)→ safe(v)
29 / 38
![Page 44: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/44.jpg)
Invariance
init(v)→ inv(v)
inv(v) ∧ ab(v , v ′)→ inv(v ′)
inv(v) ∧ pq(v , v ′)→ inv(v ′)
inv(v)→ safe(v)
29 / 38
![Page 45: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/45.jpg)
Universally Quantified Horn Clauses
∀v ∀w : (∀y : body(v ,w , y))→ head(v)
body(v ,w , y) and head(v) are quantifier free
30 / 38
![Page 46: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/46.jpg)
Vefication with Universally Quantified Invariants
for(i = 0; i < n; i++) { a[i] = i; }
assert("forall p: i <= p && p < n -> a[p] == p");
State-of-the-art recipe (e.g., Gopan et al. POPL’05,Gulwani
et al. POPL’08, Halbwachs et al. PLDI’08, Dillig et al. ESOP’10, Logozzo
et al. POPL’11, Alberti et al. CAV’12, Larraz et al. VMCAI’13):
I Quantification template
I Instantiation template
I Shape template with abstract domains
31 / 38
![Page 47: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/47.jpg)
Templates for Universally Quantified Invariants
I Quantification template
∀p : inv(i , n, p, a(p))
I Instantiation template
inv(i , n, e1, a(e1)) ∧ · · · ∧ inv(i , n, ek , a(ek))
I Shape template with abstract domains
inv(i , n, p, a(p)) = (guard(i , n, p)→ property(i , n, p, a(p)))
*under-approximation for guard(i , n, p)
32 / 38
![Page 48: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/48.jpg)
Universally Quantified Clauses
for(i = 0; i < n; i++) { a[i] = i; }
assert("forall p: i <= p && p < n -> a[p] == p");
I Quantification template ∀p : inv(i , n, p, a(p))
∃inv(i , n, p,
a(p)︷︸︸︷v ) :
i = 0→ (∀p : inv(i , n, p, a(p)))
(∀p : inv(i , n, p, a(p))) ∧ i < n ∧ i ′ = i + 1 ∧ a′ = a{i := i} →(∀q : inv(i ′, n, q, a′(q)))
(∀p : inv(i , n, p, a(p)))→ (∀q : 0 ≤ q < n→ a(q) = q)
33 / 38
![Page 49: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/49.jpg)
Universally Quantified Clauses
for(i = 0; i < n; i++) { a[i] = i; }
assert("forall p: i <= p && p < n -> a[p] == p");
I Quantification template ∀p : inv(i , n, p, a(p))
∃inv(i , n, p,
a(p)︷︸︸︷v ) :
i = 0→ inv(i , n, p, a(p))
(∀p : inv(i , n, p, a(p))) ∧ i < n ∧ a′ = a{i := i} →inv(i + 1, n, q, a′(q))
(∀p : inv(i , n, p, a(p))) ∧ 0 ≤ q < n→ a(q) = q
33 / 38
![Page 50: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/50.jpg)
Quantifier Instantiation Heuristic
Instantiation Constraint Generation
I If a(p) occcurs in clause then p ∈ inst(a)
I If a′ = a{· := ·} occcurs in clause then inst(a′) ⊆ inst(a)
Example
I Clause
(∀p : inv(i , n, p, a(p))) ∧ i < n ∧ a′ = a{i := i}→ inv(i + 1, n, q, a′(q))
I Instantiation constaints q ∈ inst(a′) and inst(a′) ⊆ inst(a)
I Instantiation solution inst(a) = inst(a′) = {q}
34 / 38
![Page 51: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/51.jpg)
Quantifier Instantiation Validation
inv(i , n, p, v) = (0 ≤ p < i → v = p) and inst(a) = inst(a′) = {q}
(0 ≤ q < i → q = a(q))
∧ i < n
∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
→ (0 ≤ q < i + 1→ a′(q) = q)
35 / 38
![Page 52: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/52.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 53: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/53.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 54: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/54.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 55: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/55.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q
a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 56: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/56.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q
a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 57: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/57.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q
a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 58: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/58.jpg)
Instantiation Based Proof
(0 ≤ q < i → a(q) = q) ∧ i < n ∧ a′(i) = i ∧ (q 6= i → a′(q) = a(q))
0 ≤ q < i + 1
q 6= i q = i
a(q) = q a′(q) = q
a′(q) = a(q)
a′(q) = q
a′(q) = q
(0 ≤ q < i + 1→ a′(q) = q)
36 / 38
![Page 59: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/59.jpg)
Universally Quantified Invariant for Termination
for(i = 0; i < n; i++) {
a[i] = 1;
}
while (x > 0) {
for(i = 0; i < n; i++) {
x = x-a[i];
}
}
inv1 (i , n, x , p, v) = (0 ≤ p < i → v ≥ 1)
inv2 (i , n, x , p, v) = (0 ≤ x ∧ 0 ≤ i < n ∧ (0 ≤ p < n→ v ≥ 1))
= inv3 (i , n, x , p, v)
37 / 38
![Page 60: Solving (Quantified) Horn Clauses · 2018-09-05 · Solving (Quanti ed) Horn Clauses Andrey Rybalchenko Microsoft Research Cambridge and TUM joint work with T. Beyene, N. Bj˝rner,](https://reader034.fdocuments.us/reader034/viewer/2022050116/5f4ccf3cc5699b7f6f6fa602/html5/thumbnails/60.jpg)
Further Pointers
I Solving recursion-free clauses over LI+UIF, [APLAS’11]
I Solving quantifier free clauses and well-foundedness, [PLDI’12]
I Solving existentially quantified clauses: [CAV’13]
I Solving universally quantified clauses: [SAS’13]
I Proof rules for multi-threaded programs [POPL’11, CAV’11,TACAS’12]
I Proof rules for functional programs [CAV’11, SAS’12]
I Software verification competition [SV-COMP’12,SV-COMP’13]
I Separation logic modulo theories [APLAS’13]
I A Constraint-Based Approach to Solving Games on InfiniteGraphs [POPL’2014]
38 / 38