Software Model Checking with Abstraction Refinement

Transcription

1 Software Model Checking with Abstraction Refinement Computer Science and Artificial Intelligence Laboratory MIT Armando Solar-Lezama With slides from Thomas Henzinger, Ranjit Jhala and Rupak Majumdar. Used with permission. Dec 08, 20 December 08, 20

2 Model checking so far o o The promise of model checking - Exhaustive exploration of the state space of a program - Push-button verification of arbitrary temporal logic formulas - Dramatic performance improvements from But State reduction techniques Symbolic representations - It only works for programs with bounded state space 2

3 Abstraction to the rescue o We can abstract the infinite state space into a finite one - Every abstract state corresponds to an infinite set of states - Is this the same thing as abstract interpretation? : 2: 3: 4: 5: void main(){ int x = *; while(*){ if(x>0) x = 2*x; else x = x-; x = abs(*)/x; (,+) (,z) (,-) (2,+) (2,z) (2,-) (3,+) (4,z) (4,-) (5,+) (5,-) 3

4 The problem with abstraction o Abstractions usually have to be tailored to the program and property of interest - Imprecision on the abstraction can lead to spurious paths : 2: 3: 4: void main(){ int x = *; while(*){ if(x>) x = 2*x; else x = x-2; (,+) (,z) (,-) (2,+) (2,z) (2,-) (3,+) (4,+) (4,z) (4,-) 5: x = abs(*)/x; (5,+) (5,0) x x (5,-) 4

5 Spurious path under the microscope (2,+) : 2: 3: 4: 5: void main(){ int x = *; while(*){ if(x>) x = 2*x; else x = x-2; x = abs(*)/x; (,+) (2,+) (5,+) (4,+) (5,0) x x (5,0) (5,-) x>2 x= x=2 (5,0) (5,-) 5

6 2 Key ingredients for software MC o We need a simple way to come up with abstractions o Our abstractions must be flexible - We need to be able to refine them on demand - This is how we identify spurious paths and eliminate them 6

7 Predicate Abstraction o Abstract state defined by a set of predicates - Ex: x>0, p.next!= null, p.next.val > 0 o Transition function can be computed by a theorem prover x>0 x>0 x = x- not(x>0) o Big idea: - We can refine the abstraction by introducing more predicates! 7

8 Example Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4: while(new!= old); 5: unlock (); return; unlock lock unlock lock Henzinger, Jhala,Majumdar 8

9 What a program really is State Transition pc lock old new : unlock(); new++; 4: pc lock old new q 0x33a q 0x33a Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4: while(new!= old); 5: unlock (); return; Henzinger, Jhala,Majumdar 9

10 The Safety Verification Problem Error Safe Initial Is there a path from an initial to an error state? Problem: Infinite state graph Solution : Set of states = logical formula Henzinger, Jhala,Majumdar 0

11 Idea : Predicate Abstraction Predicates on program state: lock old = new States satisfying same predicates are equivalent Merged into one abstract state #abstract states is finite Henzinger, Jhala,Majumdar

12 Abstract States and Transitions State pc lock old new : unlock(); new++; 4: pc lock old new q 0x33a q 0x33a Theorem Prover lock old=new!lock! old=new Henzinger, Jhala,Majumdar 2

13 Abstraction State pc lock old new : unlock(); new++; 4: pc lock old new q 0x33a q 0x33a Theorem Prover Existential Lifting lock old=new! lock! old=new Henzinger, Jhala,Majumdar 3

14 Abstraction State pc lock old new : unlock(); new++; 4: pc lock old new q 0x33a q 0x33a lock old=new! lock! old=new Henzinger, Jhala,Majumdar 4

15 Analyze Abstraction Analyze finite graph No false negatives Problem Spurious counterexamples Henzinger, Jhala,Majumdar 5

16 Idea 2: Counterex.-Guided Refinement Solution Use spurious counterexamples to refine abstraction! Henzinger, Jhala,Majumdar 6

17 Idea 2: Counterex.-Guided Refinement Solution Use spurious counterexamples to refine abstraction. Add predicates to distinguish states across cut 2. Build refined abstraction Imprecision due to merge Henzinger, Jhala,Majumdar 7

18 Iterative Abstraction-Refinement Solution Use spurious counterexamples to refine abstraction [Kurshan et al 93] [Clarke et al 00] [Ball-Rajamani 0]. Add predicates to distinguish states across cut 2. Build refined abstraction -eliminates counterexample 3. Repeat search Till real counterexample or system proved safe Henzinger, Jhala,Majumdar 8

19 Lazy Abstraction C Program Abstract Yes Safe BLAST Property Refine No Trace Henzinger, Jhala,Majumdar 9

20 Lazy Abstraction C Program spec.opt Instrumented C file With ERROR label BLAST Yes Safe Property No Trace Henzinger, Jhala,Majumdar 20

21 Problem: Abstraction is Expensive Reachable Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Observe Fraction of state space reachable #Preds ~ 00 s, #States ~ 2 00, #Reach ~ 000 s Henzinger, Jhala,Majumdar 2

22 Solution: Only Abstract Reachable States Safe Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Build abstraction during search Henzinger, Jhala,Majumdar 22

23 Solution2: Don t Refine Error-Free Regions Error Free Problem #abstract states = 2 #predicates Exponential Thm. Prover queries Solution Don t refine error-free regions Henzinger, Jhala,Majumdar 23

24 Key Idea: Reachability Tree Initial 2 Unroll Abstraction. Pick tree-node (=abs. state) 2. Add children (=abs. successors) 3. On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Henzinger, Jhala,Majumdar 24

25 Key Idea: Reachability Tree Initial 2 Unroll Abstraction. Pick tree-node (=abs. state) 2. Add children (=abs. successors) 3. On re-visiting abs. state, cut-off Find min infeasible suffix - Learn new predicates - Rebuild subtree with new preds. Error Free Henzinger, Jhala,Majumdar 25

26 Key Idea: Reachability Tree Initial Unroll. Pick tree-node (=abs. state) 2 2. Add children (=abs. successors) 3. On re-visiting abs. state, cut-off Find min spurious suffix - Learn new predicates Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions Henzinger, Jhala,Majumdar 26

27 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 27

28 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); lock() old = new q=q->next 2 LOCK 2 Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 28

29 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); [q!=null] 3 2 LOCK LOCK 2 3 Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 29

30 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); q->data = new unlock() new LOCK LOCK Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 30

31 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK LOCK [new==old] Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 3

32 Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK LOCK Predicates: LOCK unlock() 5 Reachability Tree Henzinger, Jhala,Majumdar 32

33 Analyze Counterexample Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK LOCK lock() old = new q=q->next [q!=null] q->data = new unlock() new++ [new==old] 5 5 unlock() Predicates: LOCK Reachability Tree Henzinger, Jhala,Majumdar 33

34 Analyze Counterexample Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); Predicates: LOCK LOCK LOCK old = new new++ [new==old] Inconsistent new == old Reachability Tree Henzinger, Jhala,Majumdar 34

35 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); Predicates: LOCK, new==old Reachability Tree Henzinger, Jhala,Majumdar 35

36 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK, new==old 2 lock() old = new q=q->next 2 Predicates: LOCK, new==old Reachability Tree Henzinger, Jhala,Majumdar 36

37 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK, new==old 2 LOCK, new==old 3,! new = old 4 q->data = new unlock() new Predicates: LOCK, new==old Reachability Tree Henzinger, Jhala,Majumdar 37

38 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK, new==old 2 LOCK, new==old 3,! new = old 4 [new==old] Predicates: LOCK, new==old Reachability Tree Henzinger, Jhala,Majumdar 38

39 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK, new==old 2 LOCK, new==old 3,! new = old 4 [new!=old] Predicates: LOCK, new==old,! new == old Reachability Tree Henzinger, Jhala,Majumdar 39

40 Repeat Build-and-Search Example ( ) { : do{ lock(); old = new; q = q->next; 2: if (q!= NULL){ 3: q->data = new; unlock(); new ++; 4:while(new!= old); 5: unlock (); LOCK, new==old LOCK, new==old 3,! new = old LOCK, new=old SAFE Predicates: LOCK, new==old,! new == old 5, new==old Reachability Tree Henzinger, Jhala,Majumdar 40

41 Key Idea: Reachability Tree Initial 2 Unroll. Pick tree-node (=abs. state) 2. Add children (=abs. successors) 3. On re-visiting abs. state, cut-off Find min spurious suffix - Learn new predicates - Rebuild subtree with new preds. Error Free SAFE S: Only Abstract Reachable States S2: Don t refine error-free regions Henzinger, Jhala,Majumdar 4

42 Lazy Abstraction C Program Abstract Yes Safe Property Refine No Trace Problem: Abstraction is Expensive Solution:. Abstract reachable states, 2. Avoid refining error-free regions Key Idea: Reachability Tree Henzinger, Jhala,Majumdar 42

43 MIT OpenCourseWare Fundamentals of Program Analysis Fall 205 For information about citing these materials or our Terms of Use, visit: