1 E. Yahav School of Computer Science Tel-Aviv University Verifying Safety Properties using Separation and Heterogeneous Abstractions G. Ramalingam IBM T.J. Watson Research Center

2 Lightweight Specification  "correct usage" rules a client must follow  "call open() before read()" Certification does the client program satisfy the lightweight specification? Verification of Safety Properties Component a library with cleanly encapsulated state Client a program that uses the library The Canvas Project (IBM Watson and Tel Aviv) (Component Annotation, Verification and Stuff)

3 Quick Overview: Fine Grained Heap Abstraction Heap H Precise but often too expensive

4 Quick Overview: Separation & Heterogeneous Abstraction Fine-grained abstraction Coarse abstraction

5 Separation: The Intuition InputStream ins1 = new InputStream(); InputStream ins2 = new InputStream();... if (?) { ins1.close();... } if (?) { ins2.close();... } … Problem: verify that InputStreams are used correctly: not read after they are closed. Possible states: (1) ins1: open; ins2: open (2) ins1: open; ins2: closed (3) ins1: closed; ins2: open (4) ins1: closed; ins2: closed

6 Separation: The Intuition InputStream ins1 = new InputStream(); InputStream ins2 = new InputStream();... if (?) { ins1.close();... } if (?) { ins2.close();... } … Sub-problems: (1)verify that ins1 is used correctly (2)verify that ins2 is used correctly Possible states (sub-problem 1) (1)ins1: open (2)ins1: closed Possible states (sub-problem 2) (1)ins2: open (2)ins2: closed

7 Separation: The Intuition Basic idea of separation is not new  independent attribute analysis vs. relational analysis  e.g. conventional (compiler) dataflow analyses  e.g. ESP (PLDI 2002) exploits separation

8 Our Contribution: Separation + Heap Analysis Separation for heap analysis integrated with verification Heterogeneous abstraction for heaps Separation for first-order safety properties Separation strategies More focused separation individual object vs. allocation-site

9 Heap (Pointer) Analysis Dynamic object creation (heap allocation) is the primary source of unbounded program state Creating a bounded representation of a potentially unbounded heap is a key aspect of program analysis  by merging multiple objects into a “summary” object  e.g., merge all objects allocated at same allocation site into one summary object

10 A Common Approach to Pointer Analysis in Software Verification Break verification problem into two phases  Preprocessing phase – separate points-to analysis typically no distinction between objects allocated at same site  Verification phase – verification using points-to results May lose precision  May lose ability to perform strong updates  May produce false alarms Program Property Pointer Analysis Verification Analysis

11 Loss of Precision in Two-Phase Approach f = new InputStream(); f.read(); f.close(); Verify f is not read after it is closed Straightforward...

12 Loss of Precision in Two-Phase Approach while (?) { f = new InputStream(); f.read(); f.close(); } f1 f closed False alarm! “read may be erroneous”

13 The TVLA Approach TVLA is a flexible (parametric) system for abstract interpretation and verification 1.parametric heap (i.e., pointer) analysis  user can specify criterion for merging heap-allocated objects  user can specify criterion for merging shape graphs 2.verification integrated with heap analysis  heap analysis (merging criterion) can adapt to verification Program Property Front end First-Order Transition Sys Abstract Interpretation

14 while (?) { f = new InputStream(); f.read(); f.close(); } The TVLA Approach: An Example f closed f f f … Concrete States f closed f f Abstract States

15 Fine Grained Heap Abstraction Heap H Precise but often too expensive

16 Separation & Heterogeneous Abstraction Fine-grained abstraction Coarse abstraction

17 Outline of Our Approach  Decompose verification problem into a set of subproblems  Adapt abstraction to each subproblem

18 Outline of Our Approach  Decompose verification problem into a set of subproblems Analysis-user specifies a separation strategy  Adapt abstraction to each subproblem  Heterogeneous abstraction

19 Example – Input Streams InputStream ins1 = getInputStream(); InputStream ins2 = getInputStream(); InputStream ins3 = getInputStream(); InputStream ins4 = getInputStream(); InputStream ins = ins1; if (?) { ins1.close(); ins = ins2; } if (?) { ins2.close(); ins = ins3; } if (?) { ins3.close(); ins = ins4; } int val = ins.read(); …

20 Separation Strategies choose some i : InputStream() site[1] ins1 site[1] ins2ins3ins4 site[1] ins2 site[1] ins1ins3ins4 site[1] ins3 site[1] ins1ins2ins4 site[1] ins4 site[1] ins1ins2ins3 Without separation site[1] ins1 site[1] ins2 site[1] ins3 site[1] ins4ins1 site[1] ins2ins3ins4 Abstraction 1 (expensive)Abstraction 2 (imprecise) Abstract state after creation of all four InputStream: (with separation)

21 Example – Input Streams InputStream ins1 = getInputStream(); InputStream ins2 = getInputStream(); InputStream ins3 = getInputStream(); InputStream ins4 = getInputStream(); InputStream ins = ins1; if (?) { ins1.close(); ins = ins2; } if (?) { ins2.close(); ins = ins3; } if (?) { ins3.close(); ins = ins4; } int val = ins.read(); … closed site[1] ins1ins site[1] ins2 site[1] ins3 site[1] ins4 site[1] ins1ins site[1] ins2 site[1] ins3 site[1] ins4 … … site[1] ins1ins site[1] ins2 site[1] ins3 site[1] ins4 closed site[1] ins1ins site[1] ins2 site[1] ins3 site[1] ins4 … closed site[1] ins1 closed site[1] ins2 closed site[1] ins3 site[1] ins4ins … … …

22 Example – Input Streams InputStream ins1 = getInputStream(); InputStream ins2 = getInputStream(); InputStream ins3 = getInputStream(); InputStream ins4 = getInputStream(); InputStream ins = ins1; if (?) { ins1.close(); ins = ins2; } if (?) { ins2.close(); ins = ins3; } if (?) { ins3.close(); ins = ins4; } int val = ins.read(); … closed site[1] ins1ins site[1] ins2ins3ins4 site[1] ins1ins site[1] ins2ins3ins4 site[1] ins1ins site[1] ins2ins3ins4 site[1] ins1ins closed = 1/2 site[1] ins2ins3ins4 closed site[1] ins1 closed=1/2 site[1] ins2ins3ins4ins

23 First-Order Safety Properties Involve multiple correlated objects  e.g., JDBC Problem can be decomposed into sub-problems in several different ways Different separation granularity Different efficiency, different precision... ResultSet rs2 = stmt2.executeQuery(...);... ResultSet minRs2 = stmt2.executeQuery(...)... rs2.next();

24 Example: JDBC Specification Class Connection { Set statements; … } class Statement { boolean closed; ResultSet myResultSet; Connection myConnection; Statement(Connection c) { closed = false; myConnection = c; myResultSet = null; } ResultSet executeQuery(String qry) { requires !closed; if (myResultSet != null) myResultSet.closed = true; myResultSet = new ResultSet(this); return myResultSet; } … } class ResultSet { boolean closed; Statement ownerStmt; ResultSet(Statement s) { closed = false ; ownerStmt = s; } void close() { closed = true; } boolean next() { requires !closed; }

25 Single Choice Separation choose some c : Connection() choose all s : Statement(x) / x == c choose all r : ResultSet(y) / y == s con1stmt1rs1 stmt myRS maxRs own con2stmt2minRs2 stmt myRS maxRs2 own rs2 con1stmt1rs1 stmt myRS maxRs own con2stmt2minRs2 stmt myRS maxRs2 own rs2

26 Multiple Choice Separation choose some c : Connection() choose some s : Statement(x) / x == c choose some r : ResultSet(y) / y == s con1stmt1rs1 stmt myRS maxRs own con2stmt2minRs2 stmt myRS maxRs2 own rs2 con1stmt1rs1 stmt myRS maxRs own con2stmt2minRs2 stmt myRS maxRs2 own rs2 + 6 more

27 Strategy Implementation separation strategy + program + property  compiled into TVLA input  using instrumentation predicates  details in paper

28 Prototype Implementation Implemented over TVLA Applied to several example programs  Up to 5000 lines of Java Used to verify  Absence of concurrent modification exception (CME)  JDBC API conformance  IOStreams API conformance Improved performance In some cases improved precision

29

30

31 Other Issues Objects chosen for verification Objects relevant for verification (for chosen object)  Identified via reachability  User hints via separation strategy

32 Related Work Demand-driven analysis  hard for heap analysis Program slicing  an approach to demand-driven analysis  simple slicing can be an effective optimization  precise slicing (for heap) is hard Client-driven pointer analysis (Guyer & Lin, SAS 2003) Counter-example guided abstraction refinement

33 Verification: Recent Work ESC/Modula-3, ESC/Java (CC ’98,...) MC (OSDI 2000,...) Bandera (ICSE 2000,...) SLAM (SPIN 2001,...) Vault (PLDI 2001,...) BLAST (POPL 2002,...) ESP (PLDI 2002,...) Foster, Terauchi and Aiken (PLDI 2002,...)... several others...

34 Some tasks are best done by machine, while others are best done by human insight; and a properly designed system will find the right balance. D. Knuth The End It is of highest importance... to be able to recognize out of a number of facts which are incidental and which vital... Otherwise your energy and attention must be dissipated instead of being concentrated. Arthur Conan Doyle