Why Waste a Perfectly Good Abstraction?

Transcription

1 Why Wase a Perfecly Good Absracion? Arie Gurfinkel and Marsha Chechik Deparmen of Compuer Science, Universiy of Torono, Torono, ON M5S 3G4, Canada. arie,chechik@cs.orono.edu Absrac. Sofware model-checking based on he CEGAR framework can be made more precise by separaing non-deerminism from he lack of informaion due o absracion. The wo can be modeled individually using four-valued Belnap logic. In addiion, his logic allows reasoning abou negaions effecively and hus enables checking of full CTL. In his paper, we presen YASM a new symbolic sofware model-checker. Preliminary experience wih YASM shows ha our implemenaion can effecively consruc and analyze Belnap models wihou a subsanial overhead when compared o is classical counerpars. 1 Inroducion Symbolic sofware model-checking, pioneered by he Microsof s SLAM [1] projec, is a echnique ha works direcly on code and checks he program by combining auomaed predicae absracion [13] wih counerexample-guided absracion refinemen (CEGAR) [6]. The approach is divided ino hree phases: absracion, model-checking, and refinemen. During he absracion phase, a heorem-prover is ypically used o consruc, using a lis of predicaes, a finie model ha approximaes he program being verified. The model is analyzed by he model-checker, and counerexamples generaed by i are used o find addiional predicaes, if necessary. The process coninues unil eiher he propery is successfully proved or disproved, or resources are exhaused. For example, suppose our goal is o verify wheher he line labelled Ƚ can be reached in he (deerminisic) C program shown in Figure 1(a). This can be expressed in CTL as Ô È½µ. Figure 1(c)-(e) gives a series of predicae programs which are auomaically consruced while checking his propery. The absracion in Figure 1(c) is jus he conrol-flow graph of he program, where he symbol indicaes ha he condiion was absraced away, and is value is no known. is hus inerpreed as eiher rue or false, and reaed as a non-deerminisic choice during model-checking. Verifying Ô È½µ on his absracion yields false. I is possible o resolve nondeerminism so as o reach he line labeled Ƚ, i.e., by exiing he ÛÐ and enering he saemen. We hen check he feasibiliy of his execuion in he concree program, wih he goal of replacing he undesired non-deerminism. Specifically, a predicae Ü ¾ is needed o deermine wheher he conrol flow eners he saemen. The new absracion is shown in Figure 1(d): Ü ¾ becomes rue during iniializaion, is no affeced by he body of he loop, and is checked in he condiion of he saemen. Now, he analysis yields ha he propery is violaed if he loop erminaes, and he condiion Ý ¾ of he loop is added o he lis of predicaes, yielding an absracion

2 void main (void) { 1: in x = 2; in y = 2; 2: while (y <= 2) (a) 3: {y = y - 1;} 4: if (x == 2) 5: {P1:} 6:} (d) void main (void) { (x=2) := T; while (*) {(x=2) := (x=2);} if (x=2) {P1:} } (b) Ü ¾ Ý ¾ Ü ¾ Ý ¾ 2 Ý ¾ Ü ¾ skip skip Ƚ Ý Ý 3 ½ (c) (e) void main (void) { while (*) {} if (*) {P1:} } void main (void) { (x=2) := T; (y <= 2) := T; while (y<=2) {(y<=2) := (y<=2)? T : *; (x=2) := (x=2);} if (x=2) {P1:} } Fig. 1. A simple C program (a), is conrol-flow graph (b) and is predicae absracions: (c): no predicaes; (d): afer adding Ü ¾; (e): afer adding Ý ¾. (a) in x; x = 0; if (x > 0) {x++} else {x--} P1: if (*) (b) {} else {} P1: in x = 0; if (fopen (...)!= NULL) { if (x > 0) {x++;} (c) (d) else {x--} P1: } } if (NONDET) { if (*) {} else {} P1: Fig. 2. (a): a C program where line Ƚ is no reachable; (b): absracion of (a) wihou predicaes; (c): a non-deerminisic C program; (d) absracion of (c). in Figure 1(e). The saemen Ý Ý ½ is absraced as follows: if Ý ¾ is rue, hen decremening Ý leaves i as rue; oherwise, is value is unknown. The predicae Ü ¾ is no affeced. The predicae program in Figure 1(e) is sufficien o deermine ha he loop does no erminae, and hus he propery Ô È½µ holds. Now consider an example in Figure 2(a). Here, he propery ³ Ô È½µ fails in he concree program. However, exising echniques (i.e., SLAM or BLAST) will no be able o deermine his from he absrac program in Figure 2(b). To find a possible counerexample o ³, e.g., an execuion which passes hrough he Ð par of he saemen, hese echniques need o add anoher predicae, Ü ¼, and repea he refinemen and he model-checking phases. On he oher hand, a human can easily deermine ha ³ fails jus by looking a he absrac program in Figure 2(b): line Ƚ is reachable along every pah, regardless of which of hese are feasible. Thus, he absracion in Figure 2(b) is conclusive for ³, and we will use i in our analysis. Specifically, given an absracion and a propery Ô Üµ for some line Ü, we firs aemp o prove i direcly, jus like oher approaches. If he proof fails, we hen aemp o prove is negaion, i.e., ha Ô Ü is always reachable, wihou considering which absrac execuions are possible. If his proof fails as well, we gaher addiional predicaes and proceed o he refinemen phase. So far, we have assumed ha programs are deerminisic. This assumpion is unrealisic even for sequenial programs, e.g., because of user inpu or oher exernal facors, such as presence or absence of files ha he program aemps o use. For example, consider he program in Figure 2(d) which absracs he one in Figure 2(c). Here, he compuaion no leading o Ƚ occurs when he file canno be opened; since his behaviour is conrolled by he environmen, here exiss a concree execuion leading o Ƚ. Thus, we can conclude Ô È½µ fails, wihou any furher refinemens or analysis of he feasibiliy of his execuion. 2

3 f (a) f (b) Fig. 3. Belnap logic: (a) ruh order; (b) informaion order. In his paper, we presen an approach o proving ruh and falsiy of reachabiliy properies. I is based on reaing unknowns resuling from absracion,, differenly from unknowns resuling from he environmen, non-deerminism, as shown in he above example. Our approach is similar o he one aken by Reps and Sagiv [27] in he sense ha i uses a logic wih addiional ruh values (we use Belnap logic [4] which is an exension of Kleene logic [22] used in [27]) enabling us o perform boh checks during a single analysis phase. The analysis yields one of he following answers: (1) he propery holds; (2) he propery fails (as in he model in Figure 2(d)); (3) he value of he propery depends on he resoluion of, and hus he absracion needs o be furher refined. We also presen an implemenaion of his approach via a symbolic sofware modelchecker YASM 1. Alhough similar approaches have been sudied heoreically, e.g. see [8, 12], we believe his o be he firs efficien implemenaion wih performance ha is comparable o SLAM and BLAST. The implemenaion makes use of a number of ideas from exising CEGAR approaches, which we have generalized for our purposes. In paricular, our implemenaion is applicable o programs wih non-deerminisic conrolflow, and is no resriced o reachabiliy analysis. The res of his paper is organized as follows. Afer giving he necessary background in Secion 2, we describe, in Secion 3, he process of creaing and inerpreing absracions of programs we wan o check. We discuss hree absrac semanics: over-approximaion, under-approximaion and exac approximaion, used in YASM. In Secion 4, we describe model-checking of he models consruced via he exac approximaion and he use of counerexamples for conclusiveness, generaed by he modelchecker, for compuing refined absracions. Exac approximaions enable he use of effecive echniques for improving he speed and he precision of he analysis. We discuss a few of hem in Secion 5. We describe he ool and give is performance daa in Secion 6, and conclude in Secion 7 wih a comparison of our approach wih relaed work, a summary of he paper, and a discussion of fuure research direcions. 2 Background In his secion, we review muli-valued logics and define muli-valued Kripke srucures and heir absracions. Logics. Boolean logic ¾ is a se f ogeher wih he ruh ordering relaion Ú, s.. f Ú. Conjuncion and disjuncion represen mee and join wih respec o he ruh ordering. Addiionally, a negaion operaor is defined as f and f. Kleene logic [22] exends ¾ wih an addiional elemen, represening unknown informaion. In his paper, is used o represen, discussed in Secion 1. The ruh ordering 1 YASM sands for a Ye Anoher Sofware Model-checker. 3

4 of he logic is exended as f Ú and Ú, and negaion as. We define an addiional ordering, ha relaes values based on he amoun of informaion; hus and f, so ha represens he leas amoun of informaion. Belnap logic [4] exends wih an addiional elemen. The ruh ordering is exended so ha f Ú and Ú, and negaion as, i.e., is equivalen o wih respec o his ordering. Finally, he informaion ordering is exended by making be he larges elemen, i.e., f and. This makes ino he smalles srucure conaining ¾ ha is a complee disribuive laice under boh ruh and informaion orderings. The ruh and informaion orderings of are shown in Figure 3. Temporal Logic. Temporal logic properies are specified in proposiional -calculus Ä È µ [23]. Properies are ofen expressed in CTL, which is a subse of Ä [7]. Definiion 1. Le ÎÖ be a se of variable names, and È be a se of aomic proposiions. The logic Ä È µ is he se of formulas defined as: ³ Ô ³ ³ ³ ³ ³ µ where Ô ¾ È, ¾ ÎÖ, and ³ µ is synacically monoone in. We use he following synacic abbreviaions: ³ ³ µ ³ ³ ³ µ ³ µ The semanics of Ä is defined wih respec o an Ä-valued Kripke srucures. Definiion 2. An Ä-valued Kripke srucure over a se of aomic proposiions È is a uple Ã Ë Ä Ê Á, where Ë is a se of saes, Ä ¾ ¾ is a logic, Ê Ë Ë Ä is a ransiion relaion, and Á È Ë Ä is an inerpreaion of aomic proposiions ha assigns o each aomic proposiion a mapping from saes o values in Ä. We ofen refer o Ä-valued Kripke srucures simply as Kripke srucures when Ä is irrelevan or clear from he conex. For a ransiion relaion Ê Ë Ë Ä, we define he preimage of É Ë Ä w.r.. Ê, preê Ë Ä Ë Ä, as preê ɵ ¾ Ë Ï Ø¾Ë Ê Øµ É Øµ preê ɵ is a se of saes ha have an Ê-successor in É. A dual of pre is wp: wpê ɵ preê ɵ wpê ɵ is a se of saes whose Ê-successors are all in É. The semanics of Ä formula ³ in a Kripke srucure Ã, wrien ³ Ã, is defined inducively on he srucure of he formula, where ÎÖ Ä Ë is an objec assignmen for free variables: Ô Ã Á Ôµ Þ Ã Þµ ³ à ³Ã à ³ à ³Ã Ü ³ à lfpú Ë ³ à ³ à ÜË preê ³Ã µ 4

5 where lfp Ú is he Ú-leas fixpoin of. For a closed Ä formula ³, ³ à ³Ã ¼ for any and ¼, wrien as ³ Ã. For a Kripke srucure à and a sae, we wrie à ³ o mean ³ à µ rue. Noe ha when à is -valued, à ³ does no mean ha à ³, i.e., proving ha ³ is false is no he same as failing o prove ha ³ is rue. Finally, we define Ä and Ä o be subses of Ä, where he modal operaions are jus and, respecively, and negaion is allowed only a he level of aomic proposiions. 3 Program Absracion In his secion, we show how programs are approximaed by Boolean programs and presen hree approximaion semanics. 3.1 Programs Operaions. Le Î denoe he se of program variables. A program is buil ou of operaions ÇÔ of which here are wo kinds: (1) an assignmen Ð, where Ð is a variable from Î and is an expression over program variables, and (2) an operaion assume µ, where is a boolean expression. Assume operaions are used o model condiional branches. We also use an operaion skip as a synacic abbreviaion for assume ص. Programs as Conrol Flow Graphs. A Conrol Flow Graph CFG is a srucure ÄÓ Æ, where ÄÓ is a finie se of locaions, and Æ ÄÓ ÄÓ ¾ is a ransiion relaion. A program is modeled by a labeled CFG, where labels each edge of he CFG wih an operaion from ÇÔ. A CFG corresponding o he program in Figure 1(a) is shown in Figure 1(b). Programs as Kripke Srucures. A sae is a ype-correc valuaion of all program variables. We use Ë o denoe he se of all saes, and ܵ o denoe he value of he variable Ü in. Each operaion ÓÔ corresponds o a ransiion relaion Ë ÓÔµ defined as: Ë ÓÔµ ص Ø if ÓÔ is assume µ and Ð if ÓÔ is Ð Finally, a program È Ö corresponds o a Kripke srucure à Prg ÄÓ Ë ¾ Ê Prg Á Prg, where Ê and Á are defined as: Ê Prg Рص Æ Ð µ Ë Ð µµµ ص Á Prg Ô µ Ð µ Ð µ Á Prg µ Ð µ and is a boolean expression. The semanics of Ä is exended o programs in he obvious way: a program Prg saisfies ³ iff he corresponding Kripke srucure à Prg saisfies ³. 5

6 3.2 Boolean Programs Boolean Operaions. Le È Ô ½ Ô Ò be a se of quanifier-free firs-order boolean predicaes over program variables Î. A Boolean (or Predicae) program [2] is a program consruced ou of Boolean operaions ÇÔ. As before, he operaions are divided ino wo kinds: (1) a parallel assignmen Ô ½ ½ Ô Ò Ò, and (2) an operaion assume µ. We refer o elemens of a parallel assignmen as updaes, e.g., Ô ½ ½ Ô ¾ ¾ consiss of wo updaes, for predicaes Ô ½ and Ô ¾, respecively. The expressions on he righ-hand-side of he assignmen and in he argumen of he assume operaion are parial boolean expressions wih he following grammar: Ô ÜÔÖ choice ÓÓÐ ÜÔÖ ÓÓÐ ÜÔÖµ Ô ÜÔÖ ÓÓÐ ÜÔÖ Inuiively, sands for an unknown expression, and choice µ for an expression ha evaluaes o rue when is rue, o false when is false, and whose value is unknown oherwise. In Boolean programs, we use skip as a synacic abbreviaion for a parallel assignmen Ô ½ choice Ô ½ Ô ½ µ Ô Ò choice Ô Ò Ô Ò µ. As before, a Boolean program is a CFG whose edges are labeled wih operaions from ÇÔ. Synacic Absracion. We now show how a Boolean program BPrg is used o approximae a program Prg by describing he behavior of Prg using a finie se of predicaes. We presen he approximaion in a boom-up fashion, saring wih approximaion of expressions, and ending wih approximaion of programs. A parial boolean expression Ô approximaes a boolean expression (denoed as Ô ), if (a) Ô is a boolean expression logically equivalen o, (b) Ô is he expression, (c) Ô is of he form choice µ and logically implies, and logically implies. For example, Ý ½ is approximaed by choice Ý ¼ µ. Noe ha from he perspecive of he approximaion, is equivalen o choice µ. The approximaion is exended o he assume operaions in he obvious way: assume Ôµ assume µ iff Ô, e.g., assume Ý ½µ is approximaed by assume choice Ý ¼ µµ. A single updae Ôchoice µ approximaes an assignmen Ð if choice µ approximaes he weakes pre-condiion of he predicae Ô wih respec o he assignmen. In oher words, approximaes he condiion under which Ô becomes rue afer he assignmen, and approximaes he condiion under which Ô becomes false. For example, a program assignmen Ý Ý ½ is approximaed by Ý ¼µchoice Ý ¼ µ. Finally, a parallel assignmen approximaes an assignmen Ð if all updae operaions of approximae Ð. For example, Ý Ý ½ is approximaed by Ý ¼µ choice Ý ¼ µ Ü ¾µ choice Ü ¾ Ü ¾µµ. We say ha a Boolean program BPrg approximaes a program Prg if each operaion of BPrg approximaes he corresponding operaion of Prg. Since we have no ye given an operaional semanics o Boolean programs, we call his approximaion a synacic predicae absracion. There are sandard echniques o compue such absracions [1, 13]. 3.3 Three Semanics of Boolean Programs In order o evaluae emporal properies on Boolean programs, we mus equip hem wih Kripke semanics. The only difficuly is o find a proper way o model he parial expres- 6

7 ¼ ½ Ý ¼ Ü ¾ Ý ¼ Ü ¾ ¼ ½ Ý ¼ Ü ¾ Ý ¼ Ü ¾ Ý ¼ Ü ¾ (a) (b) (c) ¾ Ý ¼ Ü ¾ ¼ Ý ¼ ½ Ø Ü ¾ Ý ¼ ¾ Ü ¾ Fig. 4. Fragmen of a ransiion relaion: (a) over-approximaion, (b) under-approximaion, and (c) exac approximaion. sions, i.e., and choice µ. In his secion, we describe hree choices for his approximaion: (a) an over-approximaing semanics where unknown is modeled as a nondeerminisic choice beween rue and false his is he semanics used by mos exising model-checkers such as SLAM [2] and BLAST [20]; (b) an under-approximaing semanics where unknown is modeled by a parial assignmen; and (c) he exac semanics ha uses Belnap logic o combine over- and under-approximaion his is he semanics used by our model-checker YASM. The hree semanics are illusraed on a parallel assignmen Ý ¼µ choice Ý ¼ µ Ü ¾µ choice Ü ¾ Ü ¾µµ ha approximaes Ý Ý ½ using predicaes Ý ¼ and Ü ¾. Over-Approximaion. In his case, a sae is a boolean valuaion of predicaes, i.e., i is an elemen of ¾ È. Each operaion ÓÔ in ÇÔ is associaed wih a ransiion relaion Ç ÓÔµ ¾ È ¾ È, such ha absrac saes and are no conneced if we can conclude from he boolean operaion ha here is no ransiion beween he corresponding saes of he concree program. Tha is, if he curren sae does no saisfy he precondiion for Ô o become false, has a successor,, where Ô is rue. Formally, he semanics of an updae operaion is Ç Ô choice Õ Öµµ Ô µµ Ô µ Ø and Öµ or Ô µ and Õµ and semanics of a parallel assignmen is he conjuncion of all of is updaes: Ç Ô choice Õ Ö µ Ò ÎÒ ½ µ µ ½ Ç Ô choice Õ Ö µµ Ô µµµ For our running example, a par of a ransiion relaion Ç µ is shown in Figure 4(a). Noe ha a sae ½ corresponding o concree saes where Ý ¾µ and Ü ¾ has wo ougoing ransiions, o saes ¼ and ½, indicaing ha i is possible for Ý ¾ o non-deerminisically become rue or false in he nex sae. Tha is, he fac ha he value of Ý ¾ is unknown in he nex sae is modeled by non-deerminism. Finally, he semanics of he assume operaor is: Ç assume µµ µ and Ç skipµ µ Under-Approximaion. In his case, a sae is a parial valuaion of predicaes, i.e, an elemen of È, or a ri-vecor [1]. Each operaion ÓÔ ¾ ÇÔ is associaed wih a ransiion relaion Í ÓÔµ È È, such ha each predicae Ô is rue in he nex sae,, only if he curren sae,, saisfies a precondiion for Ô o become rue. 7

8 Ƚ ,4 6 2 Ƚ 3 in x; INIT: x = 10; P1:while(x > 0) x = x - 1; END: (a) (b) (c) (d) in x = 4; if(x > 0){ x=(in)(sqr(x)+xˆ3); if(x < 212){ x=(in)((3*x)/13); if(x*x > 100){ ; }}} END: Fig. 5. (a) a Kripke srucure corresponding o he Boolean program in Figure 2(d); (b) improving precision of ; (c) and (d) wo example programs. Formally, he semanics of an updae operaion is Í Ô choice Õ Öµµ Ô µµ Ô µ Ø and Õµ or Ô µ and Öµ or Ô µ µ and semanics of a parallel assignmen is he conjuncion of all of is updaes: Í Ô choice Õ Ö µ Ò ÎÒ ½ µ µ ½ Í Ô choice Õ Ö µµ µµ For our running example, a par of a ransiion relaion Í µ is shown in Figure 4(b). Here, sae ½ has a single ougoing ransiion o sae indicaing ha in he nex sae he value of Ý ¾ is unknown, and Ü ¾ remains rue. Finally, he semanics of he assume operaor is: Í assume µµ µ and Í skipµ µ Exac Approximaion. This approximaion combines he over- and under-approximaing semanics in a single -valued model. Thus, he saes are parial valuaions of predicaes, i.e., elemens of È. Each operaion ÓÔ in ÇÔ is associaed wih a -valued ransiion relaion ÓÔµ È È. Inuiively, a ransiion is Ø if i appears boh in he over- and he under-approximaions, if i appears only in he over-approximaion, and if i appears only in he under-approximaion. For our running example, a par of a ransiion relaion µ is shown in Figure 4(c). To define he semanics formally, we firs inroduce a funcion eval µ: Ø if ³ eval ³ µ if ³ if ³ and ³ Then, he semanics of an updae is eval Õ µ Ô choice Õ Öµµ Úµ eval Ö µ if Ú Ø if Ú if Ú and he semanics of a parallel assignmen is he conjuncion of all of is updaes: Í Ô choice Õ Ö µ Ò ÎÒ ½ µ µ ½ 8 Í Ô choice Õ Ö µµ µµ

9 Finally, he semanics of he assume operaion is: assume µµ µ eval µ skipµ µ The semanics of operaions is exended o Boolean programs in an obvious way. Thus, each semanics associaes a Boolean program wih a Kripke srucure. For example, he Kripke srucure corresponding o he boolean program in Figure 2(d) is shown in Figure 5(a). The following heorem shows ha over- and under-approximaing semanics preserve universal and exisenial fragmens of Ä, respecively, whereas he exac semanics preserves full Ä. Theorem 1. Le È Ö and È Ö be a program and is Boolean absracion, respecively. Then, for an absrac sae,, and a corresponding concree sae,, he following holds: ½ ³ ¾ Ä Ç È Öµ ³ µ È Ö ³ ¾ ³ ¾ Ä Í È Öµ ³ µ È Ö ³ ³ ¾ Ä È Öµ ³ µ È Ö ³ The over-approximaing semanics has been used in sandard sofware model-checking ools o prove ruh of properies. Our approach uses he exac semanics, which enables us o prove ruh and falsiy of such properies. We discuss i in he nex secion. 4 Absrac Model-Checking To model-check a emporal logic formula ³ in a sae and locaion Ð of a Boolean program BPrg, we use he echniques of Secion 3 o consruc a -valued Kripke srucure à BPrg and hen compue he value of ³ ÃBPrg Ð µ. The laer sep involves mulivalued model-checking, e.g., using he algorihm implemened in Chek [5]. In Secion 4.1, we describe how o perform model-checking wih Belnap logic using sandard BDD packages.in Secion 4.2, we show how o find addiional predicaes o refine he absracion if he resul of model-checking a formula ³ is inconclusive. 4.1 Model-Checking A symbolic muli-valued model-checking algorihm depends on an efficien represenaion and manipulaion of Belnap funcions, i.e., funcions from some se Ë ino. These funcions are represened in YASM as BDDs using he ideas below. Firs, any se Ë can be encoded by Ö boolean variables Ú ½ Ú Ö, for a sufficienly large Ö. Thus, we only need o find a represenaion for Belnap funcions whose domain is ¾ Ö. Second, any Belnap funcion ¾ Ö can be represened by a pair of boolean funcions over ¾ Ö [16], where is Ü Üµ Û and is Ü Üµ Û. Wih his decomposiion, ܵ is equivalen o ܵ µ ܵ µ. The following equivalences enable he direc compuaion of conjuncion and disjuncion of Belnap funcions: (a) ; (b) ; (c). Thus, we can represen each Belnap funcion by a pair of BDDs, one for each boolean funcion in he decomposiion. Third, a pair of 9

10 boolean funcions over variables Ú ½ Ú Ö is represened by a single boolean funcion wih a new boolean variable Þ, using he encoding Þ Þ. So, Belnap funcions can be represened and manipulaed as sandard BDDs a he expense of one addiional variable. Furhermore, as many oher symbolic model-checkers, we use he conrol-flow graph o pariion he ransiion relaion and is pre-image compuaion. 4.2 Absracion Refinemen Whenever model-checking ³ is inconclusive, our model-checker produces a behaviour of he sysem explaining why his is he case [15, 14]. So, we can use any of he exising echniques, e.g., [21], o deermine wheher his race is feasible and use i o obain addiional predicaes o refine he absracion. However, in he muli-valued framework, checking feasibiliy of he race is no necessary: we know exacly which par is inconclusive, and concenrae he refinemen on i. For example, consider he program in Figure 2(c), is absracion in Figure 2(d), and he corresponding Kripke srucure in Figure 5(a). Since he absracion is buil wihou any predicaes, he Kripke srucure is essenially equivalen o he CFG of he program. In his absracion, Ô È½µ ½µ is inconclusive, i.e.,, which is exemplified by a pah ½, ¾,, Ƚ wih an -ransiion beween saes ¾ and. In his example, he -ransiion is he resul of execuing a boolean operaion assume µ ha synacically absracs assume Ý ¾µ in he concree program. Thus, he value of he predicae Ý ¾ is required o make he proof conclusive, which is done by refining he absracion wih his predicae, and repeaing model-checking on he refined program. In general, a pah exemplifying why he resul of model-checking is inconclusive always conains a leas one -ransiion. Suppose such a ransiion is beween saes and Ð, where and Ð are program locaions, and and are boolean valuaions of predicaes. By consrucion, his ransiion corresponds o a boolean operaion ÓÔ such ha ÓÔµ µ. If ÓÔ is a parallel assignmen, hen by he definiion of he exac semanics here exiss a predicae Ô and an updae of he form Ô choice Õ Öµ in ÓÔ such ha Õ and Ö. The idea is o refine he updae, by srenghening he expressions Õ and Ö by he precondiion for Ô o become rue afer execuion of he concree operaion ÓÔ corresponding o ÓÔ. This is done by refining he Boolean program wih he predicae corresponding o he weakes precondiion of Ô wih respec o ÓÔ, i.e., wpóô Ôµ. For example, suppose we have model-checked a Boolean program wih a single predicae Ü ¼, and he cause of inconclusiveness is a -ransiion beween saes Ü ¼µ and Ü ¼µ Ø. Furher, assume ha he corresponding boolean operaion is Ü ¼µ choice Ü ¼ µ, which is he resul of absracing he concree operaion Ü Ü ½. We can hen refine he Boolean program by adding he predicae wpü Ü ½ Ü ¼µ Ü ½µ. The above approach o absracion-refinemen is no limied o reachabiliy properies. Our muli-valued model-checker can provide explanaions o inconclusiveness of arbirary CTL properies in he form of proofs [15], which we mine for addiional predicaes. 10

11 5 Exploiing Exac Approximaions The use of precise (Belnap) absracions, described in Secion 3, opens way o creaing a number of echniques for improving he speed and he precision of he analysis. In his secion, we discuss wo of hem. Reusing Resuls of Previous Absracions. One of he obvious limiaions of he CE- GAR framework is he fac ha inermediae resuls are no shared beween successive absracion-refinemen ieraions. For example, consider applying he framework o check wheher he propery Ô Æµ holds in locaion ÁÆÁÌ in he program in Figure 5(c). In he firs ieraion, we conclude ha reachabiliy of Æ depends on he value of Ü ¼, which is added o he lis of predicaes. During he model-checking phase of he second ieraion, i is proved ha Æ is reachable from Ƚ if Ü ¼, i.e., Ô Æµ Ƚ fµ holds in he corresponding Kripke srucure. Addiionally, during he refinemen phase, a new predicae Ü ½ is added. The hird ieraion once again reproves ha Æ is reachable from Ƚ provided ha Ü ¼ or Ü ½, adding a predicae Ü ¾. The process coninues, repeaing he work done a he previous ieraions, unil all predicaes of he form Ü, where ¼ ½¼, are added, and erminaion of he loop is esablished. To reuse resuls of previous compuaions, we mus firs idenify which resuls are preserved beween ieraions. For a program Prg, le Ã È be a Kripke srucure absracing Prg using predicaes È Ô ½ Ô Ò, consruced during an ieraion, and le Ã È ¼ be a Kripke srucure consruced during he ½ ieraion using predicaes È ¼ È Ô Ò ½. From he consrucion of he absracions, ³ ÃÈ Ð Ùµ ³ Ã È ¼ Ð Úµ for a formula ³ and hose saes Ð Ú of Ã È and Ð Ù of Ã È ¼, where Ú µ Ù µ for all Ò (i.e., Ú and Ù agree on he values of he firs Ò predicaes). In paricular, if he concreizaion of Ú is no empy, hen, if ³ is eiher or f in Ð Ù, i is correspondingly or f in Ð Ú. This allows us o use ³ ÃÈ, he resul of modelchecking ³ on à È, o help compue ³ Ã È Formally, we define È as follows: ¼ È Ð Ù ½ Ù Ò ½µ f if ³ ÃÈ Ð Ù ½ Ù Òµ oherwise The funcion È is an under-approximaion of ³ Ã È : for any sae of Ã È ¼ ¼ wih a non-empy concreizaion, È µ Ú ³ Ã È µ. If ³ is compued using a leas fixpoin, e.g., ³, È can be used as he saring poin in compuing ³ on Ã È ¼. ¼ For formulas ha are compued using a greaes fixpoin, an over-approximaion wih respec o he ruh ordering can be consruced and used in a similar manner. For a formula ³, he above opimizaion compues, a ieraion ½, reachabiliy of saes proved o saisfy a ieraion. In our example, his resuls in Ô Æµ during he firs and he second ieraion, Ô Æ Ô È½ Ü ¼µµ during he hird, Ô Æ Ô È½ Ü ½µµ during he fourh, ec. In he sandard approach, we would have been checking Ô Æµ from scrach afer each refinemen. 11

12 Handling Condiional Saemens. In his paper, every absrac sae corresponds o a unique conrol flow locaion, which simplifies consrucion of he absrac model bu limis is precision. Recall ha he goal of checking our program in Figure 2(d) and is corresponding Kripke srucure in Figure 5(a) was o esablish wheher he locaion Ô È½ is reachable. Inuiively, model-checking begins by labeling node Ƚ by, i.e., Ƚ is reachable from iself, and hen propagaes his labeling along he edges of he Kripke srucure. Thus, in he second ieraion, nodes Ô and Ô are labeled by, i.e., Ô È½ is definiely reachable from hese nodes. In he hird ieraion, we run ino a problem. We would like o conclude ha Ô È½ is reachable from he node Ô ¾ i is reachable from boh branches of he if-saemen. However, according o our algorihm, he value a Ô ¾ is obained by (a) propagaing he labeling of Ô hrough he ¾ µ-edge, (b) propagaing he labeling of Ô hrough he ¾ µ-edge, and (c) aking a disjuncion of (a) and (b). Thus, afer he hird ieraion, he node Ô ¾ is labeled wih µ µ, allowing us o conclude only ha Ô È½ is -reachable from Ô ¾. The cause of his problem is ha in our absrac domain, we canno express ha one of he branches of he if-saemens is aken, alhough we do no know which. One soluion is o increase he absrac domain o include a sae corresponding o several conrol flow locaions. Figure 5(b) shows a possible absracion wih an addiional absrac sae Ô µ, corresponding o he se of program saes in which he conrol locaion is eiher or. I has a -ransiion o Ô È½ since all saes corresponding o i have a ransiion here, and has a -ransiion from Ô ¾, indicaing ha he execuion of he if-saemen definiely resuls in he conrol passing o eiher locaion ¾ or. In his case, afer he second ieraion of he model-checking algorihm, nodes Ƚ,,, and µ are labeled wih, and he hird ieraion resuls in he desired resul: µ µ µ. Addiional absrac saes solve our problem; however, hey can significanly increase he size of he absrac model and complicae he absracion process. In YASM, we ake a differen approach, similar in spiri o hyper-ransiions (e.g., [25, 28, 9]). Insead of increasing he absrac domain, we use he fac ha for any concree (¾valued) lef-oal ransiion relaion Ê, wpê ɵ preê ɵ if all successors of a sae are in É, hen a leas one successor is in É. Thus, he pre-image compuaion of an absrac ransiion relaion Ê can be augmened from preê ɵ o preê ɵ wpê ɵ µ, i.e., a sae is assigned if eiher i has a definie successor in É, or all of is non-f successors are definiely in É. In our example, his changes he hird ieraion of model-checking of he Kripke srucure in Figure 5(a) as follows: in addiion o compuing pre along he edges ¾ µ and ¾ µ, wp along each edge is compued o be, and he node Ô ¾ is marked wih as desired. Thus, we can obain a conclusive absracion wihou he need o add he predicae Ü ¼. Our approach also enables us o give definie resuls for cerain programs wih nonlinear predicaes. Consider he program in Figure 5(d). If he goal of a successful modelchecking run is o examplify he pah o Æ (as is he case in sandard sofware modelchecking approaches), he presence of complex mahemaical operaions will make he heorem-proving quie difficul, if no impossible. Our approach enables us o avoid hese problems: we simply conclude ha he pah o Æ exiss, wheher i goes hrough 12

13 Name LOC YASM Resul BLAST Ieraions # of Pred Time (sec) Time (sec) # of Pred lan Ø 52 9 qpmouse Ø 1 2 qpmouse err s3 srvr Ø s3 srvr Ø Table 1. Experimenal resuls. he nesed saemen or no. For such cases, we effecively perform conex-sensiive slicing, removing pars of he absracion which are no necessary o achieve a conclusive answer. 6 Experimens The echniques described in his paper have been implemened in a sofware modelchecker YASM. YASM is wrien in JAVA and uses heorem prover CVC Lie [3] o approximae program saemens, and CUDD [29] library as a decision diagram engine. Table 1 summarizes he performance of YASM on several programs based on he examples disribued wih BLAST [20]. The experimens were performed on a Penium GHz machine running Linux For each experimen, we lis he number of ieraions required by he absracion-refinemen phase, he final number of predicaes, he overall model-checking ime, and he final analysis resul. For example, running YASM on a 4065-line qpmouse program ook hree ieraions and yielded wo predicaes, in 2.5 seconds, whereas BLAST solved his problem in 1 second, also using wo predicaes. For every example, we checked wheher an error condiion is unreachable, which holds everywhere excep qpmouse err. For hese experimens, YASM was configured o prefer adding new predicaes insead of compuing a more precise absracion. Our resuls clearly show ha he running ime of YASM is comparable o ha of BLAST. We ran he laer as a baseline, o deermine a reasonable performance for a sofware model-checker: a more direc comparison is no possible because he echniques used in he wo model-checkers are significanly differen. We do no repor he resuls of running BLAST on qpmouse err because he answer i gives when error is reachable is unsound: he pahs repored by he ool are ofen infeasible. 7 Conclusion and Relaed Work In his paper, we have presened YASM a BDD-based sofware model-checker ha combines auomaic predicae absracion-refinemen wih reasoning over Belnap logic. Our experience indicaes ha he CEGAR framework can be successfully exended o do proofs of reachabiliy and proofs of unreachabiliy, using he same absracion. This approach allows us o shoren he absracion-refinemen cycle, is applicable o programs wih non-deerminisic conrol-flow, and provides suppor for model-checking of arbirary CTL formulas. 13

14 There has been a lo of progress in applying auomaic predicae absracion of Graf and Saïdi [13] o sofware model-checking. The approach closes o ours is he one aken by SLAM [1] YASM simply reinerpres SLAM s boolean programs using 4- valued semanics. Like our work, [26] makes a disincion beween non-deerminisic and unknown ransiions and shows ha performance of an explici-sae sofware model-checker is improved by guiding i owards he former. In our erminology, his would mean guiding he search o prefer non- ransiion, which happens auomaically in our (symbolic) approach. -valued Kripke srucures and heir applicaion o absracion are equivalen o Mixed Transiion Sysems [8, 18]. They can also be seen as an exension of Modal Transiion Sysems [11] ha are defined using Kleene logic. We are no he firs o use muli-valued logic o model absracion in model-checking. Specifically, Kleene logic has been previously applied o reason abou absracions [27], and suggesed as a basis for absrac model-checking [11]. Belnap logic has also been used o model absracion in he conex of (G)STEs [19] in a manner similar o ours. Models based on Kleene logic have been used in [10] o separae handling of unknown and non-deerminism. Unlike our work or ha of [8], i does no accoun for he relaionship beween absrac saes, i.e., he case where µ µ for some absrac saes and. I uses a (raher expensive [10, 17]) generalized model-checking approach and does no address he issue of generaing counerexamples which are essenial for an applicaion of he CEGAR framework. The curren implemenaion of YASM is sill limied. For insance, non-recursive funcions are currenly handled by in-lining; handling recursion requires a -valued analog of Push Down Sysems (PDS). We believe ha Weighed PDSs [24] can provide such an analog, and are currenly exploring heir applicaion o YASM. Acknowledgmens We are graeful o Xin Ma, Kelvin Ku and Shiva Nejai for heir help implemening, evaluaing and improving YASM. We would like o acknowledge he financial suppor provided by NSERC. The firs auhor has also been parially suppored by an IBM Ph.D. Fellowship. References 1. T. Ball, A. Podelski, and S. Rajamani. Boolean and Caresian Absracion for Model Checking C Programs. STTT, 5(1):49 58, November T. Ball and S. Rajamani. The SLAM Toolki. In Proceedings of CAV 01, volume 2102 of LNCS, pages , C. Barre and S. Berezin. CVC Lie: A New Implemenaion of he Cooperaing Validiy Checker. In Proceedings of CAV 04, volume 3114 of LNCS, pages , N.D. Belnap. A Useful Four-Valued Logic. In Dunn and Epsein, ediors, Modern Uses of Muliple-Valued Logic, pages Reidel, M. Chechik, B. Devereux, and A. Gurfinkel. Chek: A Muli-Valued Model-Checker. In Proceedings of CAV 02, volume 2404 of LNCS, pages , July E. Clarke, O. Grumberg, S. Jha, Y. Lu, and H. Veih. Counerexample-Guided Absracion Refinemen for Symbolic Model Checking. Journal of he ACM, 50(5): ,

15 7. E. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, D. Dams, R. Gerh, and O. Grumberg. Absrac Inerpreaion of Reacive Sysems. ACM TOPLAS, 2(19): , L. de Alfaro, P. Godefroid, and R. Jagadeesan. Three-Valued Absracions of Games: Uncerainy, bu wih Precision. In Proceedings of LICS 04, pages , P. Godefroid. Reasoning abou Absrac Open Sysems wih Generalized Module Checking. In Proceedings of EMSOFT 2003, volume 2855 of LNCS, pages , P. Godefroid, M. Huh, and R. Jagadeesan. Absracion-based Model Checking using Modal Transiion Sysems. In Proceedings of CONCUR 01, volume 2154 of LNCS, pages , P. Godefroid and R. Jagadeesan. Auomaic Absracion Using Generalized Model- Checking. In Proceedings of CAV 02, volume 2404 of LNCS, pages , July S. Graf and H. Saïdi. Consrucion of Absrac Sae Graphs wih PVS. In Proceedings of CAV 97, volume 1254 of LNCS, pages 72 83, O. Grumberg, M. Lange, M. Leucker, and S. Shoham. Don Know in he -Calculus. In Proceedings of CAV 05, volume 3385 of LNCS, pages , A. Gurfinkel and M. Chechik. Generaing Counerexamples for Muli-Valued Model- Checking. In Proceedings of FME 03, volume 2805 of LNCS, Sepember A. Gurfinkel and M. Chechik. Muli-Valued Model-Checking via Classical Model- Checking. In Proceedings of CONCUR 03, volume 2761 of LNCS, pages , A. Gurfinkel and M. Chechik. How Thorough is Thorough Enough. In Proceedings of CHARME 05, volume 3725 of LNCS, Ocober A. Gurfinkel, O. Wei, and M. Chechik. Logical Absrac Inerpreaion. Technical Repor 532, Universiy of Torono, Sepember S. Hazelhurs and C. H. Seger. Model Checking Laices: Using and Reasoning abou Informaion Orders for Absracion. Logic Journal of he IGPL, 7(3): , May T. Henzinger, R. Jhala, R. Majumdar, and G. Sure. Lazy Absracion. In Proceedings of POPL 02, pages 58 70, T. A. Henzinger, R. Jhala, R. Majumdar, and K. L. McMillan. Absracions from Proofs. In Proceedings of POPL 04, pages , January S. C. Kleene. Inroducion o Meamahemaics. New York: Van Nosrand, D Kozen. Resuls on he Proposiional -calculus. Theoreical Compuer Science, 27: , A. Lal, T. Reps, and G. Balakrishnan. Exended Weighed Pushdown Sysems. In Proceedings of CAV 05, volume 3576 of LNCS, pages , K.G. Larsen and L. Xinxin. Equaion Solving Using Modal Transiion Sysems. In Proceedings of LICS 90, C. Pasareanu, M. Dwyer, and W. Visser. Finding Feasible Couner-examples when Model Checking Absraced Java Programs. In Proceedings of TACAS 03, volume 2031 of LNCS, pages , T.W. Reps, M. Sagiv, and R. Wilhelm. Saic Program Analysis via 3-Valued Logic. In Proceedings of CAV 04, volume 3114 of LNCS, pages 15 30, S. Shoham and O. Grumberg. Monoonic Absracion-Refinemen for CTL. In Proceedings of TACAS 04, volume 2988 of LNCS, F. Somenzi. CUDD: CU Decision Diagram Package Release,