Verification that Reachable States are Safe

Transcription

1 APPLICATION AN INTRODUCTION TO PREDICATE ABSTRACTION TO AND LOCAL COMPLETION (REFINEMENT) ABSTRACT INTERPRETATION P. Cousot Biarritz IFIP-WG meetig (1) (2) mars 23, Hotel Miramar, Biarritz, Frace Verificatio that Reachable States are Safe States: Iitial states: I Safe states: S Trasitio relatio t ˆ (Small step operatioal sematics) Verificatio problem: ľ P. Cousot, all rights reserved. 3. Applicatio to Static Aalysis, post[t? ]I S 1 X I [ post[t]x C A S ; A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 25/3/3 3:1/58 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:9/121 J []? I Idx, Toc The Structure of Program States 3.2 Applicatio to Predicate Abstractio Program poits/labels: L is fiite Variables: X is fiite (for a give program) Set of values: V Memory states: M = X 7``! V Idead a abstract iterpretatio of: [2] S. Graf ad H. Saïdi. Costructio of abstract state graphs with PVS. I Proc. 9 th It. Cof. CAV 97,LNCS 1254, pp Spriger, A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:8/121 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:1/121 J []? I Idx, Toc

2 Local Versus Global Assertios Isomorphism betwee global ad local assertios: # h}(lˆm); i ``` ```` `!! hl 7``! }(M); i # #(P )= fm jh ; mi 2P g # (Q) =fh ; mi j 2L^m 2 Q g ad is the poitwise orderig: Q Q if ad oly if 8 2L: Q Q. Predicate Abstractio A memory state property Q 2 }(M) is approximated by the subset of predicates p of P which holds whe Q holds (formally Q I[[p]]). This defies a Galois coectio: h}(m); i ```! P ` h}(p); «i P P(Q) = def fp 2 P j Q I[[p]]g P (P ) = def \fi[[p]] j p 2 P g A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:11/121 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:13/121 J []? I Idx, Toc Sytactic Predicates Choose a set P of sytactic predicates such that: S 1 A 2 P 8S P a iterpretatio I2P7``! }(M) such that: 8S P : S 1 A = p2s \ I[[p]] It follows that fi[[p]] j p 2 Pg is a Moore family. Poitwise Extesio to All Program Poits By poitwise extesio, we have for all program poits: hl 7``! }(M); i ```! P ` hl 7``! }(P); «i P P(Q) = P(Q ) P (P )= P (P ) P «P = 8 2L: P «P A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:12/121 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:14/121 J []? I Idx, Toc

3 Boolea Ecodig P = fp 1 ;:::;p k g is fiite B = ftt; ffg is the set of booleas with ff ) ff ) tt ) tt We ca use a boolea ecodig of subsets of P: h}(p); «i ``` ```` b!`! h k Y B; : (i b i=1 b(p )= k Y (p i 2 P ) i=1 b (Q) =fp i j 1» i» k ^ Q i g Q : ( Q = 8i :1» i» k : Q i ( Q i Compositio: Poitwise Boolea Ecoded Predicate Abstractio By compositio, we get: h}(lˆm); i ``` ````!`! hl 7``! k Y i=1 B; :: (i (P )= b P #(P ) (Q) = # P b (Q) A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:15/121 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:17/121 J []? I Idx, Toc Poitwise Extesio to All program Poits By poitwise extesio, we have for all program poits: hl 7``! }(P); «i ``` ```` b!`! hl 7``! k Y B; :: (i b i=1 b(p )= b(p ) b (Q) = b (Q ) Q :: ( Q = 8 2L: Q : ( Q Abstract Predicate Trasformer (Sketchy) P post[[x:=e]] P (fq 1 ;:::;q g) where fq 1 ;:::;q g fp 1 ;:::;p k g = P post[[x:=e]]( \i=1 I[[q i]]) def. P = P(fj[X=[[E]]j] j j 2 \i=1 I[[q i]]g) def. post[[x:=e]] = P( \i=1 fj[x=[[e]]j] j j 2I[[q i]]g) def. \ = P( \i=1 I[[q i[x=e]]) def. substitutio = fp j ji[[q i [X=E] ) p j ]]g def. P )fp j j theorem_prover[[q i [X=E] ) p j ]]g sice theorem_prover[q i [X=E] ) p j ] implies I [q i [X=E] ) p j ] A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:16/121 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:18/121 J []? I Idx, Toc

4 Example of No Distributivity [POPL 79] Kildall s costat propagatio hf;; Zg[ffig j i 2 Zg; i [ Local Completio g.4h g.3h g.2h g1h g2h g3h g4h See Sec. 9.2 of [POPL 79]. 6 th POPL, pages ,SaAtoio,TX,1979.ACMPress. 31 A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:31/12 J []? I Idx, Toc is ot distributive: < j(f1g) [ j(f2g) =f1; 2g 6= Z = j(j(f1g) [ j(f2g)) : 6 th POPL, pages ,SaAtoio,TX,1979.ACMPress. 33 A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:33/12 J []? I Idx, Toc No Distributivity [POPL 79] Disjuctive Completio [POPL 79] A abstractio j is [-complete or distributive, wheeverthe uio of abstract properties is abstract: 8S }( ) : [ P 2S j(p )=j( [ P 2S j(p )) Hece, the abstract uio of abstract properties looses o iformatio with respect to their cocrete oe; Otherwise it is [-icomplete or o-distributive. The [-completio or disjuctive completio C [ (A) of a abstract domai A is the smallest distributive abstract domai cotaiig A; The disjuctive completio adds all missig jois to the abstract domai: C [ (A) =lfpā A M A [f[ P 2S j A (P ) j j A ([ P 2S j A (P )) 6= [ P 2S j A (P )g «6 th POPL, pages ,SaAtoio,TX,1979.ACMPress th POPL, pages , Sa Atoio, TX, ACM Press. 34 A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:32/12 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:34/12 J []? I Idx, Toc

5 Example of Disjuctive Completio [POPL 79] Local Image Completio 5 Kildall s costat propagatio hf;; Zg[ffig j i 2 Zg; i g.4h g.3h [ g.2h g1h g2h g3h g4h is ot distributive; The disjuctive completio is h}(z); i (i.e. idetity abstractio!). 6 th POPL, pages ,SaAtoio,TX,1979.ACMPress. 35 < A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:35/12 J []? I Idx, Toc The f-completio C f (A) of a abstract domai A is the smallest f-complete abstract domai cotaiig A; The local image completio adds all missig abstract elemets to the abstract domai: C f (A) =lfpā A M A [ff j A (P ) j j A f j A (P ) 6= f j A (P )g «(1) 5 See other completio methods i: P. Cousot. Partial Completeess of Abstract Fixpoit Checkig, ivited paper. I 4 th It. Symp. SARA 2, LNAI1864, Spriger, pp. 1 25, 2. R. Giacobazzi, F. Razato, ad F. Scozzari. Makig abstract iterpretatios complete. J. ACM, 47(2): , 2. A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:37/12 J []? I Idx, Toc Local Image Completeess [POPL 79] Fixpoit Completio Give f 2 }( ) 7``! }( ), the abstractio j is f-complete iff the f-trasformatio of abstract properties is abstract: 8P 2 }( ) : j f j(p )=f j(p ) Hece, the abstract trasformatio of a abstract property looses o iformatio with respect to the cocrete oe; Otherwise j is f-icomplete. We wat to prove lfp F (I) i.e. (lfp F ) v ] I The abstractio is i geeral icomplete so lfp F ] 6v ] I Hece we look for the most abstract abstractio which is more precise tha ad is fixpoit complete: (lfp F )=lfp F ] where F ] = F This is soud sice lfp F ] v ] I implies (lfp F ) v ] I that is lfp F (I) This is complete sice lfp F (I) = (I) so (lfp F ) v ] I i.e. lfp F ] v ] I is ow provable i the abstract. 6 th POPL, pages ,SaAtoio,TX,1979.ACMPress. 36 A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:36/12 J []? I Idx, Toc A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:57/12 J []? I Idx, Toc

6 Local Image ad Domai Completeess Whe F ] = F ad j =, the abstract commutatio coditio F = F ] amouts to local domai completeess j F = j F j; This is differet from local image completeess F j = j F j for which we provided a completio costructio (1) 7 ; A commo particular case is whe F has a adjoit F g such that hp; i ```! g F hq; vi i which case adjoied local image completeess F g j = j F g j implies local domai completeess F j F = j F j. 7 Local domai completio is also possible but more complicated, see R. Giacobazzi, F. Razato, ad F. Scozzari. Makig abstract iterpretatios complete. J. ACM, 47(2): , 2. A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:58/12 J []? I Idx, Toc Predicate Abstractio Completio B Priciple of refiemet for 1 X I [ post[t]x C A: ; Start from P = P ; (e.g. P ftrueg) Iteratively repeat B 1 X I [ post[t]x C A S by pred. abs. P ; If failed, do local domai completio of P ito P +1 for adjoit pre[t] g util verificatio doe 1 ; Afewcovicigpractical experieces e.g. [3] [3] T. Ball, R. Majumdar, T.D. Millstei, ad S.K. Rajamai. Automatic predicate abstractio of C programs. I Proc. ACM SIGPLAN 21 Cof. PLDI. ACM SIGPLAN Not. 36(5), pages ACMPress,Jue covergece has to be eforced by wideigs sice the problem isudecidablee.g.<n or I do t kow. A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 24/3/3 3:19/121 J []? I Idx, Toc Exact Fixpoit Abstractio by Adjoit Local Image Completio Whe F has a adjoit g F,asufficiet coditio to esure exact fixpoit abstractio (lfp F )=lfp F ] where F ] = F is: Local dual image completeess that is F g = F ] ḡ (i.e. g F j = j F g j where j = ); This ca be achieved by refiig the origial abstract domai j by the local image fixpoit completio costructio (1) 8; 9 ; This implies local domai completeess j F = j F j (i.e. F j = j F j); This i tur implies exact/precise fixpoit abstractio (lfp F )= lfp F ] i the refied domai. 8 The local dual image completio ca be restricted to the fixpoit iterates. 9 I geeral, the completed domai does ot satisfy the ascedig chai coditio (see the previous costat propagatio example). A Itroductio to Abstract Iterpretatio, ľ P. Cousot, 23/3/3 2:59/12 J []? I Idx, Toc