Automating Relatively Complete Verification of Higher-Order Functional Programs Hiroshi Unno (University of Tsukuba) Tachio Terauchi (Nagoya University)

Slides:

Advertisements

Similar presentations

Assertion Checking over Combined Abstraction of Linear Arithmetic and Uninterpreted Functions Sumit Gulwani Microsoft Research, Redmond Ashish Tiwari SRI.

Advertisements

Exploiting SAT solvers in unbounded model checking

A practical and complete approach to predicate abstraction Ranjit Jhala UCSD Ken McMillan Cadence Berkeley Labs.

Consequence Generation, Interpolants, and Invariant Discovery Ken McMillan Cadence Berkeley Labs.

Demand-driven inference of loop invariants in a theorem prover

Constraint-based Invariant Inference over Predicate Abstraction Sumit Gulwani Ramarathnam Venkatesan Microsoft Research, Redmond Saurabh Srivastava University.

HASKELL TO LOGIC THROUGH DENOTATIONAL SEMANTICS Dimitrios Vytiniotis, Koen Claessen, Simon Peyton Jones, Dan Rosén POPL 2013, January

Type-based termination analysis with disjunctive invariants Dimitrios Vytiniotis, MSR Cambridge with Byron Cook (MSR Cambridge) and Ranjit Jhala (UCSD)

Satisfiability Modulo Theories and Network Verification Nikolaj Bjørner Microsoft Research Formal Methods and Networks Summer School Ithaca, June

Software Model Checking with SMT Ken McMillan Microsoft Research TexPoint fonts used in EMF: A A A A A.

From Verification to Synthesis Sumit Gulwani Microsoft Research, Redmond August 2013 Marktoberdorf Summer School Lectures: Part 1.

Satisfiability Modulo Theories (An introduction)

1 PROPERTIES OF A TYPE ABSTRACT INTERPRETATER. 2 MOTIVATION OF THE EXPERIMENT § a well understood case l type inference in functional programming à la.

Software Engineering & Automated Deduction Willem Visser Stellenbosch University With Nikolaj Bjorner (Microsoft Research, Redmond) Natarajan Shankar (SRI.

1 Logic Programming School of Informatics, University of Edinburgh Transformations Specification-Program An introduction to moving between Prolog and First.

1 Eran Yahav Technion Joint work with Martin Vechev (ETH), Greta Yorsh (ARM), Michael Kuperstein (Technion), Veselin Raychev (ETH)

© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.

© Anvesh Komuravelli Quantified Invariants in Rich Domains using Model Checking and Abstract Interpretation Anvesh Komuravelli, CMU Joint work with Ken.

Logic as the lingua franca of software verification Ken McMillan Microsoft Research TexPoint fonts used in EMF: A A A A A Joint work with Andrey Rybalchenko.

Program Analysis as Constraint Solving Sumit Gulwani (MSR Redmond) Ramarathnam Venkatesan (MSR Redmond) Saurabh Srivastava (Univ. of Maryland) TexPoint.

Relatively Complete Verification of Higher- Order Programs (via Automated Refinement Type Inference) Tachio Terauchi Nagoya University TexPoint fonts used.

The Software Model Checker BLAST by Dirk Beyer, Thomas A. Henzinger, Ranjit Jhala and Rupak Majumdar Presented by Yunho Kim Provable Software Lab, KAIST.

Rahul Sharma Işil Dillig, Thomas Dillig, and Alex Aiken Stanford University Simplifying Loop Invariant Generation Using Splitter Predicates.

Termination Proofs for Systems Code Andrey Rybalchenko, EPFL/MPI joint work with Byron Cook, MSR and Andreas Podelski, MPI PLDI’2006, Ottawa.

Ranjit Jhala Rupak Majumdar Bit-level Types for High-level Reasoning.

State-Event Software Verification for Branching-Time Specifications Sagar Chaki, Ed Clarke, Joel Ouaknine, Orna Grumberg Natasha Sharygina, Tayssir Touili,

Lazy Abstraction Thomas A. Henzinger Ranjit Jhala Rupak Majumdar Grégoire Sutre UC Berkeley.

Interpolants [Craig 1957] G(y,z) F(x,y)

Counterexample-Guided Focus TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAA A A A AA A A Thomas Wies Institute of.

Counter Example Guided Refinement CEGAR Mooly Sagiv.

Verification and Data Structures int kmp_search(char str[], char pat[]){ p = 0; s = 0; while (p

Software Reliability Methods Sorin Lerner. Software reliability methods: issues What are the issues?

Goal: Static Software Verification Verify absence of run-time errors Buffer overflows Deadlocks Assertion failures Requires precise data structure verification.

Temporal-Safety Proofs for Systems Code Thomas A. Henzinger Ranjit Jhala Rupak Majumdar George Necula Westley Weimer Grégoire Sutre UC Berkeley.

Implicit Typing in Lambda Logic Copyright, 2005 Michael Beeson ESHOL Workshop LPAR-12 Jamaica, 2005.

Dr. Muhammed Al-Mulhem 1ICS ICS 535 Design and Implementation of Programming Languages Part 1 Fundamentals (Chapter 4) Axiomatic Semantics ICS 535.

VS 3 : Verification and Synthesis using SMT Solvers SMT Solvers for Program Verification Saurabh Srivastava * Sumit Gulwani ** Jeffrey S. Foster * * University.

Carnegie Mellon University Symbolic Approaches to Invariant Checking and Automatic Predicate Abstraction Randal E. Bryant.

Quantifier Elimination Procedures in Z3 Support for Non-linear arithmetic Fixed-points – features and a preview.

Program Verification using Templates over Predicate Abstraction Saurabh Srivastava University of Maryland, College Park Sumit Gulwani Microsoft Research,

Patrick M. Rondon, Ming Kawaguchi, Ranjit Jhala University of California, San Diego.

Higher-Order Verification With Liquid Types Ranjit Jhala, UC San Diego (with Pat Rondon, Ming Kawaguchi)

TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A Sumit Gulwani Microsoft Research, Redmond, USA

CSC2108 Lazy Abstraction on Software Model Checking Wai Sum Mong.

Constraint-based Invariant Inference. Invariants Dictionary Meaning: A function, quantity, or property which remains unchanged Property (in our context):

Dimensions in Synthesis Part 3: Ambiguity (Synthesis from Examples & Keywords) Sumit Gulwani Microsoft Research, Redmond May 2012.

Abstract Refinement Types Niki Vazou 1, Patrick M. Rondon 2, and Ranjit Jhala 1 1 UC San Diego 2 Google 1.

An Algebra for Composing Access Control Policies (2002) Author: PIERO BONATTI, SABRINA DE CAPITANI DI, PIERANGELA SAMARATI Presenter: Siqing Du Date:

Refinement Type Inference via Horn Constraint Optimization Kodai Hashimoto and Hiroshi Unno (University of Tsukuba, Japan)

A Template-based Approach to Complete Predicate Refinement Tachio Terauchi (Nagoya University) Hiroshi Unno (University of Tsukuba) Naoki Kobayashi (University.

Rahul Sharma Joint work with Aditya Nori (MSR India) and Alex Aiken (Stanford)

Proof-Carrying Code & Proof-Carrying Authentication Stuart Pickard CSCI 297 June 2, 2005.

Program Analysis and Verification Spring 2015 Program Analysis and Verification Lecture 12: Abstract Interpretation IV Roman Manevich Ben-Gurion University.

Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System Jean Yang MIT CSAIL Chris Hawblitzel Microsoft Research.

11 Counter-Example Based Predicate Discovery in Predicate Abstraction Satyaki Das and David L. Dill Computer Systems Lab Stanford University

Automated tactics for separation logic VeriML Reconstruct Z3 Proof Safe incremental type checker Certifying code transformation Proof carrying hardware.

Symbolic and Concolic Execution of Programs Information Security, CS 526 Omar Chowdhury 10/7/2015Information Security, CS 5261.

Logic Engines as a Service Leonardo de Moura and Nikolaj Bjørner Microsoft Research.

Selected Decision Procedures and Techniques for SMT More on combination – theories sharing sets – convex theory Un-interpreted function symbols (quantifier-free.

Software Verification With Liquid Types Ranjit Jhala, UC San Diego (with Pat Rondon, Ming Kawaguchi)

© Anvesh Komuravelli Spacer Model Checking with Proofs and Counterexamples Anvesh Komuravelli Carnegie Mellon University Joint work with Arie Gurfinkel,

SAT for Software Model Checking Introduction to SAT-problem for newbie

SS 2017 Software Verification Bounded Model Checking, Outlook

SMT-Based Verification of Parameterized Systems

Solving Linear Arithmetic with SAT-based MC

Automating Induction for Solving Horn Clauses

MoCHi: Software Model Checker for a Higher-Order Functional Language

Stateful Manifest Contracts

Relatively Complete Refinement Type System for Verification of Higher-Order Non-deterministic Programs Hiroshi Unno (University of Tsukuba) Yuki Satake.

Inferring Simple Solutions to Recursion-free Horn Clauses via Sampling

Presentation transcript:

Automating Relatively Complete Verification of Higher-Order Functional Programs Hiroshi Unno (University of Tsukuba) Tachio Terauchi (Nagoya University) Naoki Kobayashi (University of Tokyo) 2013/1/23POPL 20131

Path-Sensitive Verifier for Functional Programs (cf. SLAM, BLAST, … for Imperative Programs) 2013/1/23POPL let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) Verifier Program & Spec. Result Certificate or Counterexample All these verifiers are based on refinement type system (cf. Hoare logic for first-order imperative programs) Demo Refinement type inference by Horn clause solving [Unno and Kobayashi 2008, 2009] Liquid Types [Rondon, Kawaguchi and Jhala 2008, …] Depcegar [Terauchi 2010] MoCHi [Sato, Unno and Kobayashi 2011, 2013] HMC [Jhala, Majumdar and Rybalchenko 2011]

Refinement Types 2013/1/23POPL FOL formulas for refinement

2013/1/23POPL Well-typed!

Automated Verification via Refinement Type Inference 2013/1/23POPL 20135

Incompleteness: There is a safe but untypable program 2013/1/23POPL whereas Hoare logic is relatively complete

Example: Safe but Untypable Program 2013/1/23POPL 20137

Our Contributions 2013/1/23POPL 20138

Our Contributions 2013/1/23POPL 20139

2013/1/23POPL

Our Approach: Restricted Use of Quantification Add one universal quantifier over integer just before each function parameter [Goerdt 1985, German, Clarke, and Halpern 1983, 1989] 2013/1/23POPL

2013/1/23POPL Well-typed!

2013/1/23POPL

Our Contributions 2013/1/23POPL

2013/1/23POPL

Our Approach 2013/1/23POPL

Our Approach 2013/1/23POPL

Counterexample Guided Refinement Type Inference 2013/1/23POPL unsafe Step 1: Fixed-Point Type Inference [1,2] Step 3: Refinement [1,2] safe yes no unknown [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011

Our Approach 2013/1/23POPL

2013/1/23POPL unsafe Step 1: Fixed-Point Type Inference [1,2] safe yes no [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011 Step 3: Refinement [1,2]

2013/1/23POPL

Example: Reduction to Non-Linear Constraint Solving 2013/1/23POPL

Example: Non-linear Constraint Solving (1/2) 2013/1/23POPL

Example: Non-linear Constraint Solving (2/2) 2013/1/23POPL Bit-vector modeling & SMT [Gulwani, Srivastava, Venkatesan 2008]

Implementation 2013/1/23POPL let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) MoCHi Program & Spec. Result Certificate or Counterexample

Conclusion 2013/1/23POPL