Model Checking C-Programs – An Example: Integer Square Root Wenhui Zhang

Contents Integer Square Root Model Checking Summary Compositional Reasoning

A Concrete Example of such a Software Take a number n Output a number m s2 s0 initialize start s1 Transformation in() isr(n,k), isk(n,k) Correctness Claim: The ouput is the integer square root of the input Correctness Claim: The ouput is the integer square root of the input Correctness Claim: (m*m)<=n; (m*m)+2*m+1>n Correctness Claim: (m*m)<=n; (m*m)+2*m+1>n

Example: Function main() #include /********************************************/ int in(); int isr(int x,int k); int isk(int n,int k); /********************************************/ int main() { int n=0, m=0; int k=1; printf("INFO: system is now active\n"); while (1) { n=in(); m=isr(n,k); k=isk(n,k); printf("RESULT: %i\n\n",m); }

Example: Function in() int in() { char c=0; int k=0; while (1) { k=0; putc('N',stdout); putc(':',stdout); putc(9,stdout); c=getc(stdin); if (c=='\n') { printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } if (c '9') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } k=c-'0'; c=getc(stdin); if (c=='\n') { return k; } if (c '9') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } if (k<2) k=k*10+(c-'0'); else if (k==2&&c=='0') k=20; else { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input number must be in {0,...,20}\n\n"); continue; } c=getc(stdin); if (c!='\n') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } return k; }

Example: isr() and isk() int isr(int x,int k) { int y1=0; int y2=0; int y3=0; y1=0; y2=1; y3=1; if (x==2||(x>2&&k==20)) x=x-1; while (y3<=x) { y1=y1+1; y2=y2+2; y3=y3+y2; } return y1; } int isk(int n,int k) { if (k!=20) { if (k!=n) k=21; else if (k==19) k=0; else k=k+2; } else { k=21; } return k; }

Execution and Interaction #include /**************************************************/ int in(); int isr(int x,int k); int isk(int n,int k); /**************************************************/ main(int argc, char **argv ) { int n=0,m=0; int k=1; printf("system is now active\n"); while (1) { n=in(); m=isr(n,k); k=isk(n,k); printf("RESULT: %i\n\n",m); } /**************************************************/ int isr(int y,int k) { int y1=0; int y2=0; int y3=0; int z=0; int x=y; y1=0; y2=1; y3=1; if (x==2||(x>2&&k==20)) x=x-1; while (y3<=x) { y1=y1+1; y2=y2+2; y3=y3+y2; } z=y1; return z; } /**************************************************/ int isk(int n,int k) { if (k!=20) { if (k!=n) k=21; else { if (k==19) k=0; else k=k+2; } } else { k=21; } return k; } /**************************************************/ int in() { char c; int k=0; while (1) { k=0; putc('N',stdout); putc(':',stdout); putc(9,stdout); c=getc(stdin); /* printf("%i\n",c); */ if (c=='\n') { printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } if (c '9') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } k=c-'0'; c=getc(stdin); if (c=='\n') { return k; } if (c '9') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } k=k*10+(c-'0'); if (k>20) { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input number must be in {0,...,20}\n\n"); continue; } c=getc(stdin); if (c!='\n') { while (1) { c=getc(stdin); if (c=='\n') break; } printf("INFO: the input must be 1 or 2 digits\n\n"); continue; } return k; } /**************************************************/ 2013cp]$./isr1a INFO: system is now active N: 1 RESULT: 1 N: 23 INFO: the input number must be in {0,...,20} N: 19 RESULT: 4 N: ad INFO: the input must be 1 or 2 digits N: 9 RESULT: 3 N:

Program Correctness It looks that the correctness claim holds, according to the sample executions. Question: Does the claim holds for all input sequences? In fact, there is an error when the input sequence is: In fact, there is an error when the input sequence is: The input history may affect the behavior of the software, and it may cause errors in certain cases

Program Correctness Question: Is the claim correct? Use model checking!

Contents Integer Square Root Model Checking Summary Compositional Reasoning

Modeling and Model Checking Model Checking with VERDS – Input to VERDS – VVM (VERDS verification model) Modeling Language – VML (VERDS modeling langauge)

Verification Process C Program Model Automatic Translator Automatic Translator VERDS Model Checker VERDS Model Checker Properties

(at line 17): ((m*m) n) Correctness Claim (isr1a.sp)

Model Checking./verds –c isr.c –sp isr.sp VERSION: verds DEC 2012 FILE: isr.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 667. bound =105 time = time = 1068 The property is false, preparing files... CONCLUSION: FALSE (time=3156) 2013cp]$../verds -c isr1a.c -sp isr1a.sp VERSION: verds JAN 2013 FILE: isr1a.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 326 bound = 1 time = time = 326. bound =105 time = time = 675 The property is false, preparing files... CONCLUSION: FALSE (time=3985 sec)

Verification Process C Program Model Automatic Translator Automatic Translator VERDS Model Checker VERDS Model Checker Properties Negative Conclusion Negative Conclusion Error Trace

Error Trace (isr1a.cex) --- STATE n =0 m =0 k =1 pc =0 --- TRANS STATE n =0 m =0 k =1 pc =1 --- TRANS STATE n =0 m =0 k =1 pc =2 --- TRANS STATE n =1 m =0 k =1 pc =3 … --- STATE n =18 m =4 k =20 pc =2 --- TRANS STATE n =4 m =4 k =20 pc =3 --- TRANS STATE n =4 m =1 k =20 pc =4 --- TRANS STATE n =4 m =1 k =21 pc =5

Analysis of the Error Trace An error occurred with the following sequence of inputs: Confirmation of the error by testing Correction to the program is made

Correction: Function main() #include /********************************************/ int in(); int isr(int x,int k); int isk(int n,int k); /********************************************/ int main() { int n=0, m=0; int k=1; printf("INFO: system is now active\n"); while (1) { n=in(); k=isk(n,k); m=isr(n,k); printf("RESULT: %i\n\n",m); }

Verification of the Corrected One./verds –c isr.c –sp isr.sp VERSION: verds DEC 2012 FILE: isr.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 667. bound =105 time = time = 1068 The property is false, preparing files... CONCLUSION: FALSE (time=3156) 2013cp]$../verds -c isr2a.c -sp isr1a.sp VERSION: verds JAN 2013 FILE: isr2a.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 276 bound = 1 time = time = 276. bound =105 time = time = 607 CONCLUSION: TRUE (time=607 sec)

Verification of the Corrected One C Program Model Automatic Translator Automatic Translator VERDS Model Checker VERDS Model Checker Positive Conclusion Positive Conclusion Properties

Contents Integer Square Root Model Checking Summary Compositional Reasoning

Verification Times Number of called functionsVerification Time (sec) 3 607

Use of Assumption-Guarantee Each function is augmented with a pair of assumption- guarantee as follows (isr2a.fsp): FUNCTION z=isk(x,y) ASSUMPTION 0<=x&&x<=20; GUARANTEE (!(z==20)||x=18); FUNCTION z=in() ASSUMPTION TRUE; GUARANTEE 0<=z&&z<=20;

Verification Process (A/G) C Program Model Automatic Translator Automatic Translator VERDS Model Checker VERDS Model Checker Properties A/G Specification A/G Specification

Verification Subgoals../verds -c isr2a.c -sp isr1a.sp -fsp isr2a.fsp../verds -ck in -Dint=i5 isr2a.vvm../verds -ck isk -Dint=i5 isr2a.vvm 102 verification subgoals, one for main(), and one for each of the functions.

Verification of the Corrected One./verds –c isr.c –sp isr.sp VERSION: verds DEC 2012 FILE: isr.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 667. bound =105 time = time = 1068 The property is false, preparing files... CONCLUSION: FALSE (time=3156) 2013cp]$../verds -c isr2a.c -sp isr1a.sp -fsp isr2a.fsp VERSION: verds JAN 2013 FILE: isr2a.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 75 bound = 1 time = time = 75 bound = 2 time = time = 75. bound = 11 time = time = 82 CONCLUSION: TRUE (time=82 sec)

Verification of the Corrected One./verds –c isr.c –sp isr.sp VERSION: verds DEC 2012 FILE: isr.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 667. bound =105 time = time = 1068 The property is false, preparing files... CONCLUSION: FALSE (time=3156) 2013cp]$../verds -Dint=i5 -ck in isr2a.vvm VERSION: verds JAN 2013 FILE: isr2a.vvm bound = 0 time = time = 31 bound = 1 time = time = 31 INFO: A/G=1 CONCLUSION: TRUE (time=34 sec)

Verification of the Corrected One./verds –c isr.c –sp isr.sp VERSION: verds DEC 2012 FILE: isr.vvm PROPERTY: A G (! (pc = 5 )| (((m * m ){ n )& (((m * m )+ ((2 * m )+ 1 ))> n ))) bound = 0 time = time = 667. bound =105 time = time = 1068 The property is false, preparing files... CONCLUSION: FALSE (time=3156) 2013cp]$../verds -Dint=i5 -ck isk isr2a.vvm VERSION: verds JAN 2013 FILE: isr2a.vvm bound = 0 time = time = 32 bound = 1 time = time = 32 INFO: A/G=1 CONCLUSION: TRUE (time=37 sec)

Verification Times Verification SubgoalVerification Time (sec) main() with A/G82 in()34 isk()37 Sum153 Original task with model checking time = 607 seconds 3 tasks with model checking time < 100 for each Original task with model checking time = 607 seconds 3 tasks with model checking time < 100 for each

Contents Integer Square Root Model Checking Summary Compositional Reasoning

Questions?