Tutorial: Proving termination and liveness

Slides:



Advertisements
Similar presentations
Assertion Checking over Combined Abstraction of Linear Arithmetic and Uninterpreted Functions Sumit Gulwani Microsoft Research, Redmond Ashish Tiwari SRI.
Advertisements

Copyright 2000 Cadence Design Systems. Permission is granted to reproduce without modification. Introduction An overview of formal methods for hardware.
Automated Theorem Proving Lecture 1. Program verification is undecidable! Given program P and specification S, does P satisfy S?
Type-based termination analysis with disjunctive invariants Dimitrios Vytiniotis, MSR Cambridge with Byron Cook (MSR Cambridge) and Ranjit Jhala (UCSD)
De necessariis pre condiciones consequentia sine machina P. Consobrinus, R. Consobrinus M. Aquilifer, F. Oratio.
1 Termination and shape-shifting heaps Byron Cook Microsoft Research, Cambridge Joint work with Josh Berdine, Dino Distefano, and.
An Abstract Interpretation Framework for Refactoring P. Cousot, NYU, ENS, CNRS, INRIA R. Cousot, ENS, CNRS, INRIA F. Logozzo, M. Barnett, Microsoft Research.
© 2009 Microsoft Corporation. All rights reserved. Automatic Verification of Heap Manipulation using Separation Logic Josh Berdine with thanks to Byron.
TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A A AAA A A A AA A Proving that non-blocking algorithms don't block.
Semantics Static semantics Dynamic semantics attribute grammars
Shape Analysis by Graph Decomposition R. Manevich M. Sagiv Tel Aviv University G. Ramalingam MSR India J. Berdine B. Cook MSR Cambridge.
Heap Decomposition for Concurrent Shape Analysis R. Manevich T. Lev-Ami M. Sagiv Tel Aviv University G. Ramalingam MSR India J. Berdine MSR Cambridge Dagstuhl.
Inferring Disjunctive Postconditions Corneliu Popeea and Wei-Ngan Chin School of Computing National University of Singapore - ASIAN
1 Symbolic Execution for Model Checking and Testing Corina Păsăreanu (Kestrel) Joint work with Sarfraz Khurshid (MIT) and Willem Visser (RIACS)
Aaron Bradley University of Colorado, Boulder
Logic as the lingua franca of software verification Ken McMillan Microsoft Research TexPoint fonts used in EMF: A A A A A Joint work with Andrey Rybalchenko.
1 Thorough Static Analysis of Device Drivers Byron Cook – Microsoft Research Joint work with: Tom Ball, Vladimir Levin, Jakob Lichtenberg,
Program Analysis as Constraint Solving Sumit Gulwani (MSR Redmond) Ramarathnam Venkatesan (MSR Redmond) Saurabh Srivastava (Univ. of Maryland) TexPoint.
Termination Proofs for Systems Code Andrey Rybalchenko, EPFL/MPI joint work with Byron Cook, MSR and Andreas Podelski, MPI PLDI’2006, Ottawa.
Lifting Abstract Interpreters to Quantified Logical Domains Sumit Gulwani, MSR Bill McCloskey, UCB Ashish Tiwari, SRI 1.
Using Statically Computed Invariants Inside the Predicate Abstraction and Refinement Loop Himanshu Jain Franjo Ivančić Aarti Gupta Ilya Shlyakhter Chao.
Programming Language Semantics Mooly SagivEran Yahav Schrirber 317Open space html://
A Numerical Abstract Domain based on Expression Abstraction + Max Operator with Application in Timing Analysis Sumit Gulwani (MSR Redmond) Bhargav Gulavani.
Predicate Abstraction for Software and Hardware Verification Himanshu Jain Model checking seminar April 22, 2005.
Semantics with Applications Mooly Sagiv Schrirber html:// Textbooks:Winskel The.
Describing Syntax and Semantics
Formal verification Marco A. Peña Universitat Politècnica de Catalunya.
Formal Verification of SpecC Programs using Predicate Abstraction Himanshu Jain Daniel Kroening Edmund Clarke Carnegie Mellon University.
1 Hardware synthesis 2.0 Byron Cook and Satnam Singh with Ashutosh Gupta, Stephen Magill, Andrey Rybalchenko, Jiri Simsa, and Viktor Vafeiadis TexPoint.
From Program Verification to Program Synthesis Saurabh Srivastava * Sumit Gulwani ♯ Jeffrey S. Foster * * University of Maryland, College Park ♯ Microsoft.
1 Employing decision procedures for automatic analysis and verification of heap-manipulating programs Greta Yorsh under the supervision of Mooly Sagiv.
Program Analysis with Dynamic Change of Precision Dirk Beyer Tom Henzinger Grégory Théoduloz Presented by: Pashootan Vaezipoor Directed Reading ASE 2008.
Shape Analysis Overview presented by Greta Yorsh.
Yang Liu, Jun Sun and Jin Song Dong School of Computing National University of Singapore.
Inferring Specifications to Detect Errors in Code Mana Taghdiri Presented by: Robert Seater MIT Computer Science & AI Lab.
Variance Analyses from Invariance Analyses Josh Berdine Microsoft Research, Cambridge Joint work with Aziem Chawdhary, Byron Cook, Dino.
Convergence of Model Checking & Program Analysis Philippe Giabbanelli CMPT 894 – Spring 2008.
Beyond Reachability: Shape Abstraction in the presence of Pointer Arithmetic Hongseok Yang (Queen Mary, University of London) (Joint work with Dino Distefano,
CSCI1600: Embedded and Real Time Software Lecture 28: Verification I Steven Reiss, Fall 2015.
Compositionality Entails Sequentializability Pranav Garg, P. Madhusudan University of Illinois at Urbana-Champaign.
Formal Specification: a Roadmap Axel van Lamsweerde published on ICSE (International Conference on Software Engineering) Jing Ai 10/28/2003.
1 MSR/Cambridge Formal Verification Overview Byron Cook Microsoft Research, Cambridge.
SAT-Based Model Checking Without Unrolling Aaron R. Bradley.
Learning Universally Quantified Invariants of Linear Data Structures Pranav Garg 1, Christof Loding, 2 P. Madhusudan 1 and Daniel Neider 2 1 University.
Getting Started in PL Design Research Stephanie Weirich University of Pennsylvania.
1 Proving program termination Lecture 5 · February 4 th, 2008 TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A.
Adaptive Shape Analysis Thomas Wies joint work with Josh Berdine Cristiano Calcagno TexPoint fonts used in EMF. Read the TexPoint manual before you delete.
Quantified Data Automata on Skinny Trees: an Abstract Domain for Lists Pranav Garg 1, P. Madhusudan 1 and Gennaro Parlato 2 1 University of Illinois at.
Property-Guided Shape Analysis S.Itzhaky, T.Reps, M.Sagiv, A.Thakur and T.Weiss Slides by Tomer Weiss Submitted to TACAS 2014.
/ PSWLAB Thread Modular Model Checking by Cormac Flanagan and Shaz Qadeer (published in Spin’03) Hong,Shin Thread Modular Model.
CS/APMA 202 Spring 2005 Aaron Bloomfield. Sequences in Nature
서울대한양대 ( 안 산 ) 충남대 1년1년 컴퓨터기초 (C) 컴퓨터프로그래밍 (C, Java) 컴퓨터프로그래밍 (C) 2. 봄 프로그래밍 원리 (Scheme, ML) Structure & Interpretation of Computer Programs 프로그래밍 방법론.
CPSC 121: Models of Computation REVIEW. Course Learning Outcomes You should be able to: – model important problems so that they are easier to discuss,
Spring 2017 Program Analysis and Verification
Presentation Title 2/4/2018 Software Verification using Predicate Abstraction and Iterative Refinement: Part Bug Catching: Automated Program Verification.
Shape Analysis Termination Analysis Linear Time
Reasoning About Code.
Reasoning about code CSE 331 University of Washington.
Formal Methods in Software Engineering 1
Automating Induction for Solving Horn Clauses
Enhancing PDR/IC3 with Localization Abstraction
Alan Mishchenko Robert Brayton UC Berkeley
Relatively Complete Refinement Type System for Verification of Higher-Order Non-deterministic Programs Hiroshi Unno (University of Tsukuba) Yuki Satake.
Property Directed Reachability with Word-Level Abstraction
Lecture 5 Floyd-Hoare Style Verification
Reduction in End-User Shape Analysis
Automated Extraction of Inductive Invariants to Aid Model Checking
Predicate Transformers
Data Structures & Programming
Presentation transcript:

Tutorial: Proving termination and liveness Byron Cook Microsoft Research and Queen Mary, Univ. of London

Introduction

Introduction

Introduction

Introduction

Introduction

Introduction

Introduction

Introduction

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Well-founded relations =

Well-founded relations =

Well-founded relations =

Well-founded relations

Well-founded relations

Well-founded relations

Well-founded relations

Well-founded relations

Well-founded relations

Well-founded relations

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rules

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule

Termination proof rule assume(y>=1); x := x – y; assume(x>=1);

Termination proof rule assume(y>=1); x := x – y; assume(x>=1);

Termination proof rule assume(y>=1); x := x – y; assume(x>=1);

Termination proof rule assume(y>=1); x := x – y; assume(x>=1);

Termination proof rule assume(y>=1); x := x – y; assume(x>=1);

Termination proof rule

Termination proof rule

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Strategy: Advantages: Disadvantages: Refinement Start with empty termination argument Iteratively weaken and re-check termination argument Weaken using linear rank function synthesis Advantages: Can use existing safety property checking technology to check argument validity Finds complex termination arguments with only linear rank functions Leads to counterexamples Accurate Disadvantages: Very slow May not terminate (in several ways)

Refinement

Refinement Ø

Refinement Ø

Refinement Ø

Refinement Ø

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement

Refinement copied = 0; . x = f(x,y); while(x<y) { if (!copied) { g(&y,x); } copied = 0; . if (!copied) { if (*) { H[x] = x; H[y] = y; copied = 1; } } else { assert(T1 || T2 || T3); while(x<y) { copied = 0;

Examples

Examples

Examples

Examples

Examples

Examples

Examples

Examples

Examples

Examples

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

The bad news

More bad news

More bad news

More bad news

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Refinement-based termination proving Variance analysis Outline Basics Refinement-based termination proving Variance analysis Recent and future work Conclusion

Variance analysis

Variance analysis

Variance analysis Strategy: Advantages: Disadvantages: Use abstract interpretation techniques to compute (disjunctive) over-approximation Check that the parts of the disjunction are well founded Advantages: Can use existing abstract interpretation tools to compute overapproximation Always terminates Fast Disadvantages: No counterexamples Less accurate than refinement-based approach Abstract domains (currently) not built for our application Widening can be too aggressive Redundant information kept

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 2.1 2.2 2 3

Variance analysis 1 ü ü 2.1 2.2 2 3

Variance analysis Strategy: Advantages: Disadvantages: Use abstract interpretation techniques to compute (disjunctive) over-approximation Check that the parts of the disjunction are well founded Advantages: Can use existing abstract interpretation tools to compute overapproximation Always terminates Fast Disadvantages: No counterexamples Less accurate than refinement-based approach Abstract domains (currently) not built for our application Widening can be too aggressive Redundant information kept

Variance analysis Strategy: Advantages: Disadvantages: Use abstract interpretation techniques to compute (disjunctive) over-approximation Check that the parts of the disjunction are well founded Advantages: Can use existing abstract interpretation tools to compute overapproximation Always terminates Fast Disadvantages: No counterexamples Less accurate than refinement-based approach Abstract domains (currently) not built for our application Widening can be too aggressive Redundant information kept

Termination proof rules

Termination proof rules

Termination proof rule

Termination proof rule

Termination proof rule

Refinement-based termination proving Termination analysis Outline Basics Refinement-based termination proving Termination analysis Recent and future work Conclusion

Refinement-based termination proving Termination analysis Outline Basics Refinement-based termination proving Termination analysis Recent and future work Conclusion

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Proving that non-blocking algorithms don’t block

Proving that non-blocking algorithms don’t block

Proving that non-blocking algorithms don’t block

Proving that non-blocking algorithms don’t block

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing preconditions to termination Automatic termination/liveness proving is now a reality Advanced termination/liveness tools now supporting Concurrency, Pointers, Heap, Recursion, Omega-regular properties, Counterexample-generation, etc Tools: Terminator (currently being transferred into Windows SDV product) ARMC (Andrey’s publicly available version) Polyrank (from Bradley, Manna, Sipma) T2 (in development for my book and CMU course)

Motivation Automatic termination/liveness proving is now a reality Advanced termination/liveness tools now supporting Concurrency, Pointers, Heap, Recursion, Omega-regular properties, Counterexample-generation, etc Tools: Terminator (currently being transferred into Windows SDV product) ARMC (Andrey’s publicly available version) Polyrank (from Bradley, Manna, Sipma) T2 (in development for my book and CMU course)

Automatic termination/liveness proving is now a reality Advanced termination/liveness tools now supporting Concurrency, Pointers, Heap, Recursion, Omega-regular properties, Counterexample-generation, etc Tools: Terminator (currently being transferred into Windows SDV product) ARMC (Andrey’s publicly available version) Polyrank (from Bradley, Manna, Sipma) T2 (in development for my book and CMU course)

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Synthesizing pre-conditions to termination Recent and future work Concurrency Proving thread-termination [PLDI’08] Proving that non-blocking algorithms don’t block [POPL’09] Recursion Proving termination of recursive programs [Submitted] Synthesizing pre-conditions to termination Proving conditional termination [CAV’08] Termination for non-linear programs Proving termination by divergence [SEFM’07]

Proving termination inductively Recent and future work Proving termination inductively Podelski & Rybalchenko [LICS’04] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Proving termination inductively Recent and future work Proving termination inductively Podelski & Rybalchenko [LICS’04] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Induction

Induction

Proving termination inductively Recent and future work Proving termination inductively Podelski & Rybalchenko [LICS’04] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Recent and future work

Recent and future work

Recent and future work

Proving termination inductively Recent and future work Proving termination inductively Podelski & Rybalchenko [LICS’04] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Proving termination inductively Recent and future work Proving termination inductively Podelski & Rybalchenko [LICS’04] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Proving termination inductively Recent and future work Separation logic based shape analysis for systems code: Scalable shape analysis for systems code [CAV’08] Support for concurrency: Thread-modular shape analysis [PLDI’07b] Local reasoning for storable locks and threads [APLAS’07] Shape analysis for complex data structures: Shape analysis for composite data structures [CAV’07] Producing arithmetic abstractions of programs with heap: Arithmetic strengthening for shape analysis [SAS’07] Automatic termination proofs for programs with shape-shifting heaps [CAV’06] Proving termination inductively Podelski & Rybalchenko [POPL’07a] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Variance analysis, and inductive techniques Recent and future work Separation logic based shape analysis for systems code: Scalable shape analysis for systems code [CAV’08] Support for concurrency: Thread-modular shape analysis [PLDI’07b] Local reasoning for storable locks and threads [APLAS’07] Shape analysis for complex data structures: Shape analysis for composite data structures [CAV’07] Producing arithmetic abstractions of programs with heap: Arithmetic strengthening for shape analysis [SAS’07] Automatic termination proofs for programs with shape-shifting heaps [CAV’06] acquire(); while(……) { …… } release(); Variance analysis, and inductive techniques Variance analyses from invariance analyses [POPL’07a] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Variance analysis, and inductive techniques Recent and future work Separation logic based shape analysis for systems code: Scalable shape analysis for systems code [CAV’08] Support for concurrency: Thread-modular shape analysis [PLDI’07b] Local reasoning for storable locks and threads [APLAS’07] Shape analysis for complex data structures: Shape analysis for composite data structures [CAV’07] Producing arithmetic abstractions of programs with heap: Arithmetic strengthening for shape analysis [SAS’07] Automatic termination proofs for programs with shape-shifting heaps [CAV’06] acquire(); while(……) { …… } release(); Variance analysis, and inductive techniques Variance analyses from invariance analyses [POPL’07a] Ranking abstractions [ESOP’08] Liveness properties (fair termination) Proving that software eventually does something good [POPL’07b] Better support for heap-manipulating programs Automatic termination proofs for programs with shape-shifting heaps [CAV’06]

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Experimental results

Current frontiers: Bitvectors + unbounded numbers Scalability Recent and future work Current frontiers: Bitvectors + unbounded numbers Scalability Precision Finding inductive termination arguments Non-linear systems Counterexamples/non-termination Concurrency Programs with data structures Finding better pre-conditions Programs with higher-order functions Collatz program (a.k.a. the 3n+1 problem)

Refinement-based termination proving Termination analysis Outline Basics Refinement-based termination proving Termination analysis Recent and future work Conclusion

Refinement-based termination proving Termination analysis Outline Basics Refinement-based termination proving Termination analysis Recent and future work Conclusion

Trend: use of modular termination arguments Conclusion Trend: use of modular termination arguments Easier to construct Harder to prove valid, but techniques are available New termination proving strategies Refinement-based termination proving Variance analysis using invariance analysis Size-change, etc Result: termination proving is not impossible after all Next step: “Judgment day” Scalability, precision, concurrency, heap, commercial viability

See research.microsoft.com/~bycook for pointers to papers Conclusion See research.microsoft.com/~bycook for pointers to papers Write to bycook@microsoft.com Thank you for your attention