Invariant Generation for Parametrized Systems using Self-Reflection

Size: px

Start display at page:

Download "Invariant Generation for Parametrized Systems using Self-Reflection"

Angelica O’Connor’
5 years ago
Views:

1 Invariant Generation for Parametrized Systems using Self-Reflection Alejandro Sánchez 1 César Sánchez 1,3 Sriram Sankaranarayanan 2 Bor-Yuh Evan Chang 2 1 IMDEA Software Institute, Spain 2 University of Colorado, USA 3 Spanish Council for Scientific Research (CSIC), Spain Rich Model Toolkit COST Action Meeting, Malta, 17 June 2013

2 Motivation

3 Motivation P 1 P 2 P N Consider a finite but unbounded set of processes

4 Motivation P 1 P 2 P N Consider a finite but unbounded set of processes Running the same program in paralallel

5 Motivation P 1 P 2 P N Consider a finite but unbounded set of processes Running the same program in paralallel Classical scenarios include: Device drivers Distributed algorithms Concurrent datastructures Robotic swarms Biological Systems

6 Motivation P 1 P 2 P N GOAL : Automatic Infer Parametrized Invariants Consider a finite but unbounded set of processes Running the same program in paralallel Classical scenarios include: Device drivers Distributed algorithms Concurrent datastructures Robotic swarms Biological Systems

7 Our Contribution

8 Our Contribution An automatic abstract-interpretation-based framework Able to reason over parametrized programs Capable of infering indexed invariants

9 Our Contribution An automatic abstract-interpretation-based framework Able to reason over parametrized programs Capable of infering indexed invariants... and even more important... Adapting existing invariant synthesis techniques Leveraging off-the-shelf sequential invariant generators

10 Our Contribution An automatic abstract-interpretation-based framework Able to reason over parametrized programs Capable of infering indexed invariants... and even more important... Adapting existing invariant synthesis techniques Leveraging off-the-shelf sequential invariant generators In this talk Introduce the notion of Reflective Abstraction Report first empirical evaluation

11 Motivating Example: Workstealing

12 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: }

13 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } next len-1 data

14 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } next len-1 data

15 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } next len-1 data c end

16 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } next len-1 data c end

17 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } data c end

18 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } data T 1 T i T j T N

19 Motivating Example: Workstealing global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } data As example, for a 2-indexed invariant T 1 T i T j T N P [1] P [2] materialized materialized

20 Motivating Example: Workstealing data global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } As example, for a 2-indexed invariant T 1 T i T j T N P [1] P [2] materialized materialized

21 Motivating Example: Workstealing data global Int len > 0; Array[len] data; Int next = 0; procedure Workstealing local Int c = 0; Int end = 0; 1: if next + 4 len{c := next; end := next + 5; next := next + 5; } 2: while c < end{ 3: data[c] := processdata[c]; 4: c := c + 1; 5: } As example, for a 2-indexed invariant T 1 T i T j T N P [1] P [2] materialized materialized Reflective Abstraction

22 Motivating Example: Workstealing Invariant examples # Mat. Threads Ψ 0 : next mod 5 = 0 0 Ψ 1 : ( i) 0 c[i] < len 1 Ψ 2 : ( i 1, i 2 ) c[i 1 ] c[i 2 ] 2 data T 1 T i T j T N P [1] P [2] materialized materialized Reflective Abstraction

23 Reflective Invariants in a Nutshell

24 Reflective Invariants in a Nutshell Materialized

25 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 l 2

26 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 next + 5 > len l 2

27 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 next + 5 > len l 2 c < end l 3

28 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 next + 5 > len l 2 c < end c = c + 1 l 3 processdata[c] l 4

29 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 l 2 next + 5 > len c end c < end c = c + 1 l 3 l 5 processdata[c] l 4

30 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 l 2 next + 5 > len c end c < end c = c + 1 l 3 l 5 processdata[c] l 4 Transition modifying shared variable next

31 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4 Transition modifying shared variable next

32 Reflective Invariants in a Nutshell Materialized next + 5 len c = next next = next + 5 end = next + 5 l 1 l 2 next + 5 > len c end ( c, end, c, end ) Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4 Transition modifying shared variable next

33 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4

34 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4

35 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4 Over approximation True

36 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 processdata[c] l 4 Over approximation True False

37 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 1. Begin, l Loc, Inv 1 (l) = false processdata[c] l 4

38 Reflective Invariants in a Nutshell Materialized l 1 ( c, end, c, end ) l 2 next + 5 > len c end Inv@l 1 next + 10 len c = next next = next + 10 end = next + 10 c < end m c = c + 1 l 3 l 5 1. Begin, l Loc, Inv 1 (l) = false l 4 processdata[c] 2. Compute Σ j using Inv j 3. Obtain Inv j+1 = AbsInt(Σ j ) 4. Stop when l Loc, Inv j+1 (l) Inv j (l)

39 Reflective Abstraction and Inductive Invariants

40 Reflective Abstraction and Inductive Invariants We define as usual: Parametrized Transition System: Π = G, X, Trs, l 0, Θ Transition: τ = l src, l dst, ρ A reflective abstraction over approximates all parametrized instances of Π by a finite transition system

41 Reflective Abstraction and Inductive Invariants We define as usual: Parametrized Transition System: Π = G, X, Trs, l 0, Θ Transition: τ = l src, l dst, ρ A reflective abstraction over approximates all parametrized instances of Π by a finite transition system Let Γ[X] be some fixed first-order language of assertions An assertion map η : Loc fin Γ[X] is inductive when: 1. Θ η(l 0 ) 2. for any τ : l src, l dst, ρ, τ(η(l src )) η(l dst )

42 Reflective Abstraction and Inductive Invariants We define as usual: Parametrized Transition System: Π = G, X, Trs, l 0, Θ Transition: τ = l src, l dst, ρ A reflective abstraction over approximates all parametrized instances of Π by a finite transition system Let Γ[X] be some fixed first-order language of assertions An assertion map η : Loc fin Γ[X] is inductive when: 1. Θ η(l 0 ) 2. for any τ : l src, l dst, ρ, τ(η(l src )) η(l dst ) In formal verification, to show Ψ, we seek an inductive assertion map η s.t. l Loc, η(l) Ψ

43 Reflective Abstraction and Inductive Invariants Given Π = G, X, Loc, Trs, l 0, Θ and assertion map η, we define: Reflect Π (η) as a sequential transition system with: variables : G X locations : Loc transitions : Trs { (τ, η, l) τ Trs and l Loc } pres(x) ( Y, Y ) ( η(l src )[G, Y ] ρ[g, Y, G, Y ] ) l

44 Theorem: Reflection Soundness Let η be an inductive assertion map for Reflect Π (η), then for each location l of Π, η(l) is a 1-index invariant

45 Theorem: Reflection Soundness Let η be an inductive assertion map for Reflect Π (η), then for each location l of Π, η(l) is a 1-index invariant What about k-index invariants? Start from Π Π }{{} k To obtain an assertion map η k : Loc Loc fin Γ[X]

46 Reflective Abstract Interpretation We iteratively generate invariants for parametrized systems As fix point of a monotone operator over an abstract domain Applying abstract interpretation on reflective abstractions η = lfp F (, Σ)

47 Reflective Abstract Interpretation We consider 3 schemas: Lazy: η Lazy = lfp G L,Π ( ) G L,Π ( η) def = lfp F (, Reflect Π (γ η)) Eager: η Eager = lfp G E,Π ( ) G E,Π ( η) def = F ( η, Reflect Π (γ η)) Eager+: η Eager+ = lfp G E +,Π( ) G E,Π ( η) def = lfp F (, Reflect Π (γ η Eager ))

48 Reflective Abstraction vs. Interference Abstraction

49 Reflective Abstraction vs. Interference Abstraction Consider the following example: global Int g 0; Thread P { local Int x = 0; 1: await(g > 0); x := g; g := 0; 2: x := x + 1 3: g := x 4: }

50 Reflective Abstraction vs. Interference Abstraction Consider the following example: global Int g 0; Thread P { local Int x = 0; 1: await(g > 0); x := g; g := 0; 2: x := x + 1 3: g := x 4: } For the, considering transition 3, we have: ( x) η(l 3 ) g = x

51 Reflective Abstraction vs. Interference Abstraction Consider the following example: global Int g 0; Thread P { local Int x = 0; 1: await(g > 0); x := g; g := 0; 2: x := x + 1 3: g := x 4: } For the, considering transition 3, we have: ( x) η(l 3 ) g = x Interference Abstraction Reflective Abstraction

52 Reflective Abstraction vs. Interference Abstraction Consider the following example: global Int g 0; Thread P { local Int x = 0; 1: await(g > 0); x := g; g := 0; 2: x := x + 1 3: g := x 4: } For the, considering transition 3, we have: ( x) η(l 3 ) g = x Interference Abstraction over approximates from True Reflective Abstraction fails to derive g 0 (a non- deterministic update to g)

53 Reflective Abstraction vs. Interference Abstraction Consider the following example: global Int g 0; Thread P { local Int x = 0; 1: await(g > 0); x := g; g := 0; 2: x := x + 1 3: g := x 4: } For the, considering transition 3, we have: ( x) η(l 3 ) g = x Interference Abstraction over approximates from True Reflective Abstraction over approximates from False fails to derive g 0 (a non- deterministic update to g) incrementally infers invs over x (derives g 0)

54 Empirical Evaluation We study these examples (2-75 locs., 6-24 vars., 4-49 trans.): Simple software barrier Centralized software barrier Workstealing Generalized dinning philosophers Robot swarm moving on a m n grid

55 Empirical Evaluation We study these examples (2-75 locs., 6-24 vars., 4-49 trans.): Simple software barrier Centralized software barrier Workstealing Generalized dinning philosophers Robot swarm moving on a m n grid We compare 4 schemes: Lazy Eager Eager+ Interference

56 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal I P O Cbar I P TO O TO Phil I P O TO Rb(2,2) I P TO O TO Rb(2,3) I P TO O TO Rb(3,3) I P TO O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0

57 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal I P O Cbar I P TO O TO Phil I P O TO Rb(2,2) I P TO O TO Rb(2,3) I P TO O TO Rb(3,3) I P TO O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0 Still interference abstraction is the fastest

58 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal I P O Cbar I P TO O TO Phil I P O TO Rb(2,2) I P TO O TO Rb(2,3) I P TO O TO Rb(3,3) I P TO O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0 Lazy abstraction was the slowest (with many TO)

59 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. ID Dom Time(Lazy) Time(Eager) Time(Eager+) Time(Interf) Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal P O Wsteal I P O Cbar I Cbar P TO P 0 TO O TO O TO Phil I P O TO Phil P Rb(2,2) I P TO O TO O 0 TO Rb(2,3) I P TO O TO Rb(3,3) P TO O TO Rb(3,3) I P TO O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0 Polyhedra in general results faster than octagons (possibly due to Apron library)

60 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. ID Dom Prps Prp(Lazy) Prp(Eager) Prp(Eager+) Prp(Interf) Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal I Wsteal I P P O Cbar I Cbar P TO I O TO P Phil I P O TO Phil I P Rb(2,2) I P TO O TO Rb(2,3) I P TO O TO Rb(4,4) I Rb(3,3) I P TO P O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0 Interference infers more properties in polyhedra,

61 Empirical Evaluation Results: ID Dom Prps Lazy Eager Eager+ Interf. ID Dom Prps Prp(Lazy) Prp(Eager) Prp(Eager+) Prp(Interf) Time Wid* Prp Time Wid Prp Time Wid Prp Time Wid Prp Tbar I P O Wsteal I Wsteal I P P O Cbar I Cbar P TO I O TO P Phil I P O TO Phil I P Rb(2,2) I P TO O TO Rb(2,3) I P TO O TO Rb(4,4) I Rb(3,3) I P TO P O TO Rb(4,4) I 29 TO P TO O TO 0 TO 0 TO 0 TO 0 Interference infers more properties in polyhedra, but less in intervals

62 Empirical Evaluation Relative strengths of inferred invariants ID Dom L:E L:E+ L:In E:In E+:In E:E+ Tbar I = P = = = O = = = Wsteal I = P + O = = = Cbar I = P TO TO TO O TO TO TO + + = Phil I = P = O TO TO TO + + = Rb(2,2) I = P TO TO TO O TO TO TO + Rb(2,3) I = P TO TO TO O TO TO TO + Rb(3,3) I = P TO TO TO O TO TO TO + Rb(4,4) I TO TO TO + + = P TO TO TO O TO TO TO TO TO TO

63 Empirical Evaluation Relative strengths of inferred invariants ID Dom L:E L:E+ L:In E:In E+:In E:E+ Tbar I = P = = = O = = = Wsteal I = P + O = = = Cbar I = P TO TO TO O TO TO TO + + = Phil I = P = O TO TO TO + + = Rb(2,2) I = P TO TO TO O TO TO TO + Rb(2,3) I = P TO TO TO O TO TO TO + Rb(3,3) I = P TO TO TO O TO TO TO + Rb(4,4) I TO TO TO + + = P TO TO TO O TO TO TO TO TO TO Lazy, eager and eager+ prove stronger invariants for interval domain compared to interference

64 Empirical Evaluation Relative strengths of inferred invariants ID Dom L:E L:E+ L:In E:In E+:In E:E+ Tbar I = P = = = O = = = Wsteal I = P + O = = = Cbar I = P TO TO TO O TO TO TO + + = Phil I = P = O TO TO TO + + = Rb(2,2) I = P TO TO TO O TO TO TO + Rb(2,3) I = P TO TO TO O TO TO TO + Rb(3,3) I = P TO TO TO O TO TO TO + Rb(4,4) I TO TO TO + + = P TO TO TO O TO TO TO TO TO TO Trend is reversed for polyhedra domain

65 Conclusions We presented a new technique: Reflective Abstraction Helpful to infer k-indexed invariants on parametrized systems Enables leveraging off-the-shelf invariant generators We studied three variants of reflective abstraction, analyzing their relative strength in inferring invariants Possible future directions, study the possibility of additional structure on the summarized threads

Proofs of Correctness: Introduction to Axiomatic Verification

Proofs of Correctness: Introduction to Axiomatic Verification Introduction Weak correctness predicate Assignment statements Sequencing Selection statements Iteration 1 Introduction What is Axiomatic Verification?