Automatic Verification of Parameterized Data Structures

Transcription

1 Automatic Verification of Parameterized Data Structures Jyotirmoy V. Deshmukh, E. Allen Emerson and Prateek Gupta The University of Texas at Austin The University of Texas at Austin 1

2 Outline Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 2

3 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 3

4 Motivation Motivation Data structures: basic building blocks of software systems. Methods: programs operating on data structures. Traditional approach: check correctness up to bounded size. Parameterized verification: correctness for arbitrarily large sizes. Parameterized verification faces several difficulties! The University of Texas at Austin 4

5 Motivation Verifying programs operating on data structures Data structures: may have arbitrarily large sizes. may use pointers that range over arbitrarily large address space. may use data values that range over unbounded domains. Parameterized correctness is generally undecidable. Decidable classes of programs face severe combinatorial explosion. The University of Texas at Austin 5

6 Motivation Potential Applications Verification of data structure libraries in C++, Java. File system manipulation routines. Memory management algorithms, e.g. garbage collection. Algorithms in SoC designs. The University of Texas at Austin 6

7 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 7

8 Preliminaries Correspondence between a data structure and a graph root a b c a root(g) b d c null null null null null d Data Structure Corresponding Graph The University of Texas at Austin 8

9 Preliminaries Problem Definition Given: MethodM : operates on input graph G i to produce output graph G o =M (G i ). Property ϕ: some predicate on graphs. Parameterized correctness: For any arbitrarily large G i, determine if: ϕ(g i ) M ϕ(g o ) The University of Texas at Austin 9

10 Preliminaries Review: Tree automata The University of Texas at Austin 10

11 Preliminaries Example: Nondeterministic tree automaton for reachability (EF b) Σ = {a,b,c,d} Q = {q,q f } q 0 = q Φ : {c(q) = red(1),c(q f ) = green(2)} q 0 1 a,c,d a,c,d b q f 0 a,b,c, d 1 0 a,b,c, d Transition diagram for δ 1 The University of Texas at Austin 11

12 Preliminaries Example: accepting run ofa reach (EF b) a a c a b d a The University of Texas at Austin 12

13 Preliminaries Example: accepting run ofa reach (EF b) a q a c a b d a The University of Texas at Austin 13

14 Preliminaries Example: accepting run ofa reach (EF b) a q a q c q f a b d a The University of Texas at Austin 14

15 Preliminaries Example: accepting run ofa reach (EF b) a q a q c q f q f a b q q f q f d a The University of Texas at Austin 15

16 Preliminaries Example: accepting run ofa reach (EF b) a q a q c q f q f a b q q f q f d q f q f q f a q f q f q f The University of Texas at Austin 16

17 Preliminaries Definition: Destructive pass Pass: Traversal of graph visiting each node at most once. Destructive update: Modification of the input graph. e.g. Adding a node, Deleting a node, Changing a link, Changing a value, etc. Destructive pass: pass that performs at least one destructive update. The University of Texas at Austin 17

18 Preliminaries Stipulations Methods: must terminate. should perform only a bounded number of destructive passes over the graph. should be iterative (no recursion). Domain of data values should be finite. Input graphs have varying, but bounded branching. The University of Texas at Austin 18

19 Preliminaries Example methods Insertion/Deletion of nodes in linked lists (linear/circular), Insertion/Deletion of nodes in k-ary trees, Iterative modification of nodes in general graphs, Reversal of linked lists, Swapping nodes within a bounded distance. The University of Texas at Austin 19

20 Preliminaries Property specification Properties specified as non-deterministic tree automata. A ϕ anda ϕ called property automata. Examples include: Acyclicity, Sortedness, Reachability, Treeness, Listness, etc. The University of Texas at Austin 20

21 Preliminaries Example: checking acyclicity in a binary graph A cy = {Σ,{q,q f },q,δ,{c(q) = red(1),c(q f ) = green(2)}} q 0 σ null 1 null 0 1 q f 0 1 σ Transition diagram for A cy The University of Texas at Austin 21

22 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 22

23 Solution strategy Modeling the method MethodM modeled using tree automatona M. (G i,g o ) represented as composite graph G c. A M accepts all graphs G c that represent valid I/O behavior ofm. The University of Texas at Austin 23

24 Solution strategy Input Graph: G i root n 1 n 2 n 3 (d (d 2, d 1, d 1) 2) (d 3, d 3) Original node/edge Added node/edge Deleted node/edge The University of Texas at Austin 24

25 Solution strategy Output Graph: G o root n 1 n 3 (d 1, d 1) (d 3, d 3) n new (d new, d new ) Original node/edge Added node/edge Deleted node/edge The University of Texas at Austin 25

26 Solution strategy Composite Graph root n 1 n 2 n 3 (d (d 2, d 1, d 1) 2) (d 3, d 3) n new (d new, d new ) Original node/edge Added node/edge Deleted node/edge The University of Texas at Austin 26

27 Solution strategy Composite automaton Given:A ϕ,a ϕ anda M. Construct: Composite automatona c. A c : (synchronous) product ofa ϕ,a M anda ϕ. A c accepts G c, iff: A M accepts G c, A ϕ accepts G i (input part), and A ϕ accepts G o (output part). The University of Texas at Austin 27

28 Solution strategy Reduction to language emptiness A c accepts exactly those graphs that witness a failure ofm. M is correct iff language accepted bya c is empty. A c is empty implies parameterized correctness ofm. The University of Texas at Austin 28

29 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 29

30 Programming language Node of a data structure Data Fields (data) next 1 next 2 next k The University of Texas at Austin 30

31 Programming language Programming language Methods equipped with an iterator called cursor. Bounded window (w): set of nodes within fixed distance from cursor. Auxiliary pointers: denote positions within w, relative to cursor. Types of statements: Assignment, Conditional and Loop statements. The University of Texas at Austin 31

32 Programming language Example method: Insertion in a singly linked list method InsertNode (value, newvalue){ 1: cursor := head; 2: while (cursor!= null) { [ncursor := cursor->next] 3: if (cursor->data == value) { 4: cursor->next := new node { data := newvalue; next := ncursor;}; 5: break; } 6: cursor := ncursor when true; } } The University of Texas at Austin 32

33 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 33

34 Translation How doesa M emulatem? While operating on composite graph G c = (G i,g o ),A M : reads a new node n = (n i,n o ), changes state to mimic atomic updates to n i, checks if updated node matches n o, and if yes, moves to next node. The University of Texas at Austin 34

35 Translation FromM toa M : I A M starts in state q 0 and reads node (n i,n o ). State ofa M encodes updated value of n i. Statements that do not alter cursor position map to ε-moves. e.g. conditionals, loop body, assignments (except to cursor) The University of Texas at Austin 35

36 Translation FromM toa M : II For assignments that alter cursor position: check if current state matches n o, if yes, read new node, if no, transition to reject state. Transition to accept state after last statement inm. Add self-loops to reject and accept states. The University of Texas at Austin 36

37 Translation Example: Compilation of a while statement Enter loop; ψ is true Skip loop, ψ is false while (ψ) { loop body; (l.b.) update statement; } States encoding action of loop body l.b. acting on n i does not match n o! Read Next Node ψ holds true Exit loop; ψ is false stmt; States encoding action of stmt Reject! The University of Texas at Austin 37

38 Motivation Preliminaries Solution strategy Programming language Compiling into automata Examples Efficiency Related work and conclusions The University of Texas at Austin 38

39 Example method: Insertion in a singly linked list method InsertNode (value, newvalue){ 1: cursor := head; 2: while (cursor!= null) { [ncursor := cursor->next] 3: if (cursor->data == value) { 4: cursor->next := new node { data := newvalue; next := ncursor;}; 5: break; } 6: cursor := ncursor when true; } } The University of Texas at Austin 39

40 Example method automaton for insertnode q 0 Q 1 Q 2 Q ψ 2 Q ψ 2 Q 3 Q φ 3 R τ R τ R = Q φ 3 Q 4 Q τ 4 Q τ 4 node q rej Q 6 Q ψ 6 Q ψ 6 q acc The University of Texas at Austin 40

41 Example: An incorrect method method samplemethod { cursor->next := cursor; cursor->data := 10; } Does this method preserve acyclicity? The University of Texas at Austin 41

42 Constructing the composite automaton Method automaton q 0 c = 1 c = 2 Property automata β = (n null) conf orm Q 1 conf orm q β β q β β q acc q rej q f q f A M A ϕ A ϕ The University of Texas at Austin 42

43 Composite automaton is non-empty! Method automaton Property automata Witness to nonemptiness q 0 c = 1 c = 2 β = (n null) conf orm Q 1 conf orm q β β q β β n (d, d ) null q acc q rej q f q f A M A ϕ A ϕ The University of Texas at Austin 43

44 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 44

45 Efficiency Efficiency A c : linear in A M, A ϕ and A ϕ. Size ofa M : O( M ). A M,A ϕ,a ϕ have small, fixed number of colors in parity condition. Non-emptiness: polynomial in A c. Overall complexity: polynomial in size of M and property automata. The University of Texas at Austin 45

46 Motivation Preliminaries Solution strategy Programming language Compiling into automata Efficiency Related work and conclusions The University of Texas at Austin 46

47 Related work Related work: I Pointer Assertion Logic Engine: [Møller, Schwartzbach, 2001] More general (uses MSOL), but complexity is non-elementary. Requires human ingenuity in providing loop invariants. Separation logic: [O Hearn, Reynolds, Yang, 2001] Deductive system with proof rules. Decidable fragment treats only linked lists. The University of Texas at Austin 47

48 Related work Related Work: II Shape analysis: [Sagiv, Reps, Wilhelm, 1999] Shape invariants represented using 3-valued logic. Broad scope, but inexact solutions. Transducer-based approach:[bouajjani et al, 2005] Abstraction refinement based approach. Limited to single successor data structures. The University of Texas at Austin 48

49 Conclusions Efficient algorithmic technique for verification of parameterized data structures. Reasoning about a large class of methods, examples include: Adding, deleting, inserting nodes in linked lists, binary search trees, swapping nodes within a bounded distance, reversing lists, etc. Properties such as: acyclicity, reachability, sortedness, treeness, listness, sharing etc. Complexity: polynomial in size of method and property specifications. The University of Texas at Austin 49

50 Thank You! The University of Texas at Austin 50

51 Tree automata A (parity) tree automatona has the form: (Σ,Q,δ,q 0,Φ), where: Σ is the input alphabet (nodes of the graph), Q is the finite non-empty set of states, δ : Q Σ 2 Qk is the non-deterministic transition relation, q 0 is the initial state, and Φ is the parity acceptance condition. The University of Texas at Austin 51

52 Run of a tree automatona Run: Annotation of input tree with states ofa. Accepting run: Run in which acceptance condition is true for all paths. Aaccepts tree T if there is some accepting run on T. Notion of run can be generalized to general graphs. The University of Texas at Austin 52

53 Parity acceptance condition States colored with colors {c 0,...,c m }. π is some finite/infinite sequence of states. π satisfies parity condition iff: maximal index of color appearing infinitely often is even. Remark: Our technique needs 2 colors in most cases. The University of Texas at Austin 53

54 Programming language: Syntax Assignment statement syntax: cursor->data := d; (Modify data value) cursor->next := ptr; (Redirect an edge) cursor := ptr; (Change cursor location) cursor := new node{data:=d;next 1 :=null;...}; (Add new node) cursor->next := new node {... }; (Add new node after cursor) Conditional statements: standard if-then-else construct test condition: data comparison, pointer comparison (within the window) The University of Texas at Austin 54

55 while (ψ) { loop body; update statement; } Loop statements Used for iterating through the data structure. Nesting of loops not permitted. cursor cannot be changed inside loop body. Update statement used to change cursor position. The University of Texas at Austin 55