Static Program Analysis

Transcription

1 Static Program Analysis Lecture 16: Abstract Interpretation VI (Counterexample-Guided Abstraction Refinement) Thomas Noll Lehrstuhl für Informatik 2 (Software Modeling and Verification) noll@cs.rwth-aachen.de Winter Semester 2014/15

2 Oral Exam in Static Program Analysis Options: Thu 12 March Tue 24 March Thu 26 March Wed 08 April Registration via Exam-Static-Program-Analysis (accessible through Static Program Analysis Winter Semester 2014/

3 Outline 1 Recap: Predicate Abstraction 2 Additional Remarks 3 Counterexample-Guided Abstraction Refinement Static Program Analysis Winter Semester 2014/

4 Predicate Abstraction I Definition (Predicate abstraction) Let Var be a set of variables. A predicate is a Boolean expression p BExp over Var. A state σ Σ satisfies p BExp (σ = p) if val σ (p) = true. p implies q (p = q) if σ = q whenever σ = p (or: p is stronger than q, q is weaker than p). p and q are equivalent (p q) if p = q and q = p. Let P = {p 1,..., p n } BExp be a finite set of predicates, and let P := { p 1,..., p n }. An element of P P is called a literal. The predicate abstraction lattice is defined by: ({ } ) Abs(p 1,..., p n ) := Q Q P P, =. Abbreviations: true :=, false := {p i, p i,...} Static Program Analysis Winter Semester 2014/

5 Predicate Abstraction II Lemma Abs(p 1,..., p n ) is a complete lattice with = false, = true Q 1 Q 2 = Q 1 Q 2 Q 1 Q 2 = Q 1 Q 2 where b := {q P P b = q} (i.e., strongest formula in Abs(p 1,..., p n ) that is implied by Q 1 Q 2 ) Example Let P := {p 1, p 2, p 3 }. 1 For Q 1 := p 1 p 2 and Q 2 := p 2 p 3, we obtain Q 1 Q 2 = Q 1 Q 2 p 1 p 2 p 3 Q 1 Q 2 = Q 1 Q 2 p 2 (p 1 p 3 ) p 2 2 For Q 1 := p 1 p 2 and Q 2 := p 1 p 2, we obtain Q 1 Q 2 = Q 1 Q 2 false Q 1 Q 2 = Q 1 Q 2 p 1 (p 2 p 2 ) p 1 Static Program Analysis Winter Semester 2014/

6 Predicate Abstraction III Definition (Galois connection for predicate abstraction) The Galois connection for predicate abstraction is determined by with α : 2 Σ Abs(p 1,..., p n ) and γ : Abs(p 1,..., p n ) 2 Σ α(s) := {Q σ σ S} and γ(q) := {σ Σ σ = Q} where Q σ := ({p i 1 i n, σ = p i } { p i 1 i n, σ = p i }). Example Let Var := {x, y} Let P := {p 1, p 2, p 3 } where p 1 := (x<=y), p 2 := (x=y), p 3 := (x>y) If S = {σ 1, σ 2 } Σ with σ 1 = [x 1, y 2], σ 2 = [x 2, y 2], then α(s) = Q σ1 Q σ2 = (p 1 p 2 p 3 ) (p 1 p 2 p 3 ) = (p 1 p 2 p 3 ) (p 1 p 2 p 3 ) p 1 p 3 If Q = p 1 p 2 Abs(p 1,..., p n ), then γ(q) = {σ Σ σ(x) < σ(y)} Static Program Analysis Winter Semester 2014/

7 Abstract Semantics for Predicate Abstraction I Definition (Execution relation for predicate abstraction) If c Cmd and Q Abs(p 1,..., p n ), then c, Q is called an abstract configuration. The execution relation for predicate abstraction is defined by the following rules: (skip) skip, Q, Q (asgn) x := a, Q, {Qσ[x val σ(a)] σ = Q} (seq1) c 1, Q c 1, Q c 1 c 1 ;c 2, Q c 1 ;c 2, Q (seq2) c 1, Q, Q c 1 ;c 2, Q c 2, Q (if1) if b then c1 else c 2, Q c 1, Q b (if2) if b then c1 else c 2, Q c 2, Q b (wh1) while b do c, Q c;while b do c, Q b (wh2) while b do c, Q, Q b Static Program Analysis Winter Semester 2014/

8 Outline 1 Recap: Predicate Abstraction 2 Additional Remarks 3 Counterexample-Guided Abstraction Refinement Static Program Analysis Winter Semester 2014/

9 Additional Remarks In Rules (if1, (if2), (wh1), (wh2), the fact that b = p i for some i {1,..., n} implies Q [ ]b Abs(p 1,..., p n ), but not Q [ ]b = Q [ ]b Example 16.1 (cf. Example 15.7) p 1 := (x > y), p 2 := (x >= y) Q := true, b := p 1 Q b = p 1 p 2 Q b = p 1 For similar reasons, generally Q 1 Q 2 (= Q 1 Q 2 ) Q 1 Q 2 Example 16.2 p 1 := (x > y), p 2 := (x >= y), p 3 := (x = y) Q 1 := p 1 p 2 p 3 ( x > y), Q 2 := p 3 ( x = y) Q 1 Q 2 = Q 1 Q 2 = p 2 Q 1 Q 2 = true Static Program Analysis Winter Semester 2014/

10 Computation of Postconditions Problem: b = {q P P b = q} (i.e., the strongest formula in Abs(p 1,..., p n ) that is implied by b) is generally not computable (due to undecidability of implication in certain logics) Solutions: Over-approximation: fall back to non-strongest postconditions in practice, (automatic) theorem proving for every i {1,..., n}, try to prove b = p i and b = p i approximate b by conjunction of all provable literals Restriction of programs: = decidable for certain logics example: Presburger arithmetic (first-order theory of N with +) thus b computable for WHILE programs without multiplication Restriction to finite domains: for example, binary numbers of fixed size thus everything (domain, Galois connection,...) exactly computable problem: exponential blowup = solution: Binary Decision Diagrams Static Program Analysis Winter Semester 2014/

11 Outline 1 Recap: Predicate Abstraction 2 Additional Remarks 3 Counterexample-Guided Abstraction Refinement Static Program Analysis Winter Semester 2014/

12 Reminder: CEGAR Verification successful yes Start with (coarse) initial abstraction A Remove counterexample by refining A Property ϕ satisfied in A? no Find run violating ϕ spurious Problems: How to decide realness of counterexample? How to extract new predicates from spurious counterexample? Analyze counterexample real Error found Static Program Analysis Winter Semester 2014/

13 Counterexamples Typical properties of interest: a certain program location is not reachable (dead code) division by zero is excluded the value of x never becomes negative after program termination, the value of y is even Definition 16.3 (Counterexample) A counterexample is a sequence of abstract transitions of the form c 0, true c 1, Q 1... c k, Q k where k 1 c 0,..., c k Cmd (or c k = ) Q 1,..., Q k Abs(p 1,..., p n ) with Q k false It is called real if there exist concrete states σ 0,..., σ k Σ such that i {1,..., k} : σ i = Q i and c i 1, σ i 1 c i, σ i Otherwise it is called spurious. Static Program Analysis Winter Semester 2014/

14 Elimination of Spurious Counterexamples I Lemma 16.4 If c 0, true c 1, Q 1... c k, Q k is a spurious counterexample, there exist Boolean expressions b 0,..., b k with b 0 true, b k false, and i {1,..., k}, σ, σ Σ : σ = b i 1, c i 1, σ c i, σ = σ = b i Proof (idea). Inductive definition of b i as strongest postconditions: 1 b 0 := true 2 for i = 1,..., k: definition of b i depending on b i 1 and on (axiom) transition rule applied in c i 1,. c i,. : (skip) b i := b i 1 (asgn) b i := x.(b i 1 [x x ] x = a[x x ]) (x = previous value of x) (yields p k false; by induction on k) (if1) b i := b i 1 b (if2) b i := b i 1 b (wh1) b i := b i 1 b (wh2) b i := b i 1 b Static Program Analysis Winter Semester 2014/

15 Elimination of Spurious Counterexamples II Example 16.5 Let c 0 := [x := z] 0 ;[z := z + 1] 1 ;[y := z] 2 ; if [x = y] 3 then [skip] 4 else [skip] 5 Interesting property: after termination, x y, i.e., label 4 unreachable Initial abstraction: P = ( = Abs(P) = {true, false}) (Spurious) counterexample: 0, true 1, true 2, true 3, true 4, true Forward construction of Boolean expressions: b 0 := true (asgn) b i := x.(b i 1 [x x ] x = a[x x ]) = b 1 := x.(b 0 [x x ] x = z[x x ]) (x = z) (asgn) b i := x.(b i 1 [x x ] x = a[x x ]) = b 2 := z.(b 1 [z z ] z = z + 1[z z ]) = z.(x = z z = z + 1) (x + 1 = z) (asgn) b i := x.(b i 1 [x x ] x = a[x x ]) = b 3 := y.(b 2 [y y ] y = z[y y ]) (x + 1 = z y = z) (if1) b i := b i 1 b = b 4 := b 3 x = y (x + 1 = z y = z x = y) false Static Program Analysis Winter Semester 2014/

16 Abstraction Refinement Abstraction refinement step: Using b 1,..., k k 1 as computed before, let P := P {p 1,..., p n } where p 1,..., p n are the atomic conjuncts occurring in b 1,..., k k 1 Refine Abs(P) to Abs(P ) Lemma 16.6 After refinement, the spurious counterexample c 0, true c 1, Q 1... c k, Q k with Q k false does not exist anymore. Proof. omitted Static Program Analysis Winter Semester 2014/

17 A Simple Example Example 16.7 (cf. Example 16.5) Let c 0 := [x := z] 0 ;[z := z + 1] 1 ;[y := z] 2 ; if [x = y] 3 then [skip] 4 else [skip] 5 P =, P = {x}{{ = z}, x } + {{ 1 = z }, y = z} }{{} p 1 p 2 p 3 Refined abstract transitions: 0, true 1, p 1 p 2 2, p 1 p 2 3, p 1 p 2 p 3 4, p 1 p 2 p 3 x=y }{{} false Static Program Analysis Winter Semester 2014/

18 Another Example: Multiplication Example 16.8 Let c 0 := [z := 0] 0 ; while [x > 0] 1 do [z := z + y] 2 ; [x := x - 1] 3 ; if [z mod y = 0] 4 then [skip] 5 ; else [skip] 6 ; Initial assumption: y > 0 Interesting property: label 6 unreachable Initial abstraction: P = ( = Abs(P) = {true, false}) Abstraction refinement: on the board Static Program Analysis Winter Semester 2014/