Transition Predicate Abstraction and Fair Termination

Transcription

1 Transition Predicate Abstraction and Fair Termination Andreas Podelski and Andrey Rybalchenko Max-Planck-Institut für Informatik Saarbrücken, Germany POPL 2005 ETH Zürich Can Ali Akgül 2009

2 Introduction Verification Tools usingpredicate abstraction Finite state machine Safety properties Guarantee the absence of bad events (eg. deadlock) Check automated Liveness properties Ensure that good events eventually happen manualwork (so far) 2

3 Introduction Presented method liveness property under fairness assumptions Automated 3

4 Goal Given Program Requested liveness properties - do hold - don t hold 4

5 Solution Procedure 1. Reduction 2. Program P -> P# 3. Termination checks 4. Fairness checks 5. Interpretation of result P while (..) {... } good(); P# Is good() called? 1 Fair termination Yes! / No! 5 5

6 1. Reduction Reduction of the verification problem for general temporal properties to the one for fair termination Verification problem 1 Fair termination problem 6

7 2. P -> P# P P# while (..) {... } good(); 2 Transition predicate abstraction-based transformation program P abstract-transition program P# 7

8 2. P -> P# P P# while (..) {... } good(); 2 Algorithm Informal idea Build a graph Nodesare abstract transitions - represents some reachability relationships from the starting node Edges are transitions - Like arrows in a finite state machine 8

9 2. P -> P# P P# while (..) {... } good(); 2 Example program program P abstract-state program P abtract-transition program P# 9

10 2. P -> P# P P# while (..) {... } good(); 2 Given program P Requested Graph P# Example abstract-state program P y' = y 1 becomes y' <= y - 1 abtract-transition program P# 10

11 3. Termination checks Mark nodes of P# as terminating t program P# program P# terminating nodes 11

12 3. Termination checks For all nodes in P# If well-founded(node) - terminating t program P# A set S is well-founded iff Every non-empty subset of S has a minimal element More details: See Paper 12

13 4. Fairness checks Mark nodes of P# as fair/unfair unfair unfair t unfair fair&t program P# terminating nodes program P# terminating & fair/unfair nodes 13

14 4. Fairness checks fairness justice compassion Just Fairness means being just to everyone. Compassionate Fairness means being compassionate to everyone. 14

15 5. Interpretation of resulting P# Yes! / No! 5 Return property verified if each fair node is marked terminating unfair unfair unfair fair&t property verified program P# fair/unfair nodes 15

16 Summary Automated method for the verification of liveness P while (..) {... } good(); Is good() called? properties under full fairness assumptions (justice and P# 2 1 compassion). Fair termination Extended the applicability of predicate abstraction-based program verification to the full set of temporal properties Yes! / No! 5 16

17 Personal opinion Confusing names justice vs. compassion transition vs. abstract transition Hard to understand Interesting research topic 17

18 Tools Termination is an example of a basic liveness property. We are working on the next generation of TERMINATOR that will prove general liveness properties under fairness assumptions Microsoft Research Max-Planck-Institut für Informatik Universität Freiburg, Institut für Informatik EPFL 18

19 Questions? 19

20 Reduction reduction Verification Fair termination Fairness Justice Compassion Termination Well-foundedness 20

21 4. Fairness checks Justice τ 2 Compassion T 3 T 4 T 2 T 1 τ 1 τ 1 T 1 T 2 continuously enabled τ 1 : infinitely often τ 2 enabled:

22 Justice Justice is sensitive to the enabledness of transitions. A transition τ is enabled on the state s if the set of states {s (s, s ) ρ τ } is not empty. We write En(τ) for the set of states on which the transition τ is enabled. Justice requirement is represented by a set J of just transitions, J T. Every just transition that is continually enabled beyond a certain point must be taken infinitely often. 22

23 Further example 23