© Anvesh Komuravelli Spacer Compositional Verification of Procedural Programs using Horn Clauses over Integers and Arrays Anvesh Komuravelli work done at Carnegie Mellon University Joint work with Nikolaj Bjørner, Arie Gurfinkel, and Kenneth McMillan

© Anvesh Komuravelli Spacer In essence… 1 Efficiently under-approximating projections, in presence of array quantifiers.

© Anvesh Komuravelli Spacer Why projections? 2 Image computation Computing weakest preconditions (e.g., in IC3 style reasoning) Computing must summaries for procedural programs

© Anvesh Komuravelli Spacer SAT assignments to x 3 But, Quantifier Elimination is expensive! Under-approximate the Projection! Model-based Projection (MBP)

© Anvesh Komuravelli Spacer MBP for Propositional Logic 4 u 1 0 u 2 1 x 1 0 x 2 0 x 3 1 Model M substitute 0/u 1, 1/u 2 (under-approximates)

© Anvesh Komuravelli Spacer MBP for Linear (Real) Arithmetic 5 Infinite space of models – Substitution Method does not work! Loos-Weispfenning’s equivalence: Pick a disjunct based on the model

© Anvesh Komuravelli Spacer What if we have array variables? 6 Arrays are common for modeling heap memory In presence of procedures, can’t get rid off them easily! Inlining procedure calls and (hopefully) lowering arrays to registers bloats the program size exponentially Recursive procedures cannot be inlined MBP for the (extensional) theory of arrays?

© Anvesh Komuravelli Spacer 7 Eliminating Array Quantifiers

© Anvesh Komuravelli Spacer Eliminating array quantifiers can introduce quantifiers of index/value sort! 8 (Ackermann Reduction)

© Anvesh Komuravelli Spacer ArrayQE basically has 3 steps 9 1.Eliminate Writes 2.Eliminate (Partial) Equalities/Disequalities 3.Eliminate Reads (aka Ackermann Reduction) (the result can have quantifiers of index/value sorts) 1.Eliminate Writes 2.Eliminate (Partial) Equalities/Disequalities 3.Eliminate Reads (aka Ackermann Reduction) (the result can have quantifiers of index/value sorts)

© Anvesh Komuravelli Spacer ArrayQE Example 10 Eliminate Writes

© Anvesh Komuravelli Spacer ArrayQE Example 11 Eliminate Writes Partial Equality

© Anvesh Komuravelli Spacer ArrayQE Example 12 Eliminate Writes  Eliminate Equalities and Disequalities substitute

© Anvesh Komuravelli Spacer ArrayQE Example 13 Eliminate Writes  Eliminate Equalities and Disequalities  Eliminate Reads

© Anvesh Komuravelli Spacer 14 MBP for the Theory of Arrays (ARR)

© Anvesh Komuravelli Spacer ArrayMBP amounts to picking disjuncts from ArrayQE 15 Eliminate Writes

© Anvesh Komuravelli Spacer ArrayMBP Example 16 Eliminate Writes

© Anvesh Komuravelli Spacer substitute ArrayMBP Example 17 Eliminate Writes  Eliminate Equalities and Disequalities substitute

© Anvesh Komuravelli Spacer ArrayMBP Example 18 Eliminate Writes  Eliminate Equalities and Disequalities  Eliminate Reads

© Anvesh Komuravelli Spacer ArrayMBP Example 19 Eliminate Writes  Eliminate Equalities and Disequalities  Eliminate Reads

© Anvesh Komuravelli Spacer 20 MBP for the combination LIA + ARR

© Anvesh Komuravelli Spacer In 2 steps: 21 1.Eliminate array quantifiers using ArrayMBP ( which can introduce integer quantifiers ) 2.Eliminate integer quantifiers using MBP for LIA 1.Eliminate array quantifiers using ArrayMBP ( which can introduce integer quantifiers ) 2.Eliminate integer quantifiers using MBP for LIA

© Anvesh Komuravelli Spacer Caveat: Integer quantifiers cannot always be eliminated! 22 has no equivalent quantifier-free formula! Fall-back to the substitution method

© Anvesh Komuravelli Spacer Equality Resolution to avoid the Substitution Method 23

© Anvesh Komuravelli Spacer May SummariesMust Summaries Over-approximate QE with Interpolation Under-approximate QE with MBP Ideas are implemented in our tool Spacer 24 IC3-style compositional reasoning for Procedural Programs MBP for under-approximating weakest precondition Two kinds of procedure summaries

© Anvesh Komuravelli Spacer Substitution method can lead to diverging interpolants! 25 … … Weakest Precondition Under-approx

© Anvesh Komuravelli Spacer Heuristically privilege array (dis-)equalities 26

© Anvesh Komuravelli Spacer 27 Experimental Evaluation

© Anvesh Komuravelli Spacer Compare Spacer with and without inlining 28 The SeaHorn front-end has an option to inline procedure calls Inlining gets rid off most of the array variables, for Device Drivers category of SV-COMP’15. (Spacer minus ArrayMBP) can only handle a small fraction of the non-inlined programs The SeaHorn front-end has an option to inline procedure calls Inlining gets rid off most of the array variables, for Device Drivers category of SV-COMP’15. (Spacer minus ArrayMBP) can only handle a small fraction of the non-inlined programs

© Anvesh Komuravelli Spacer Compare Spacer with and without inlining 29 lots of time-outs

© Anvesh Komuravelli Spacer Conclusion 30 Model-based Projection (MBP) for the extensional theory of arrays Quantifiers of index and value sort cannot always be eliminated Heuristics to avoid the model substitution method Practical advantage over SV-COMP’15 benchmarks Adapt the ideas to obtain Quantified Invariants? Model-based Projection (MBP) for the extensional theory of arrays Quantifiers of index and value sort cannot always be eliminated Heuristics to avoid the model substitution method Practical advantage over SV-COMP’15 benchmarks Adapt the ideas to obtain Quantified Invariants?

© Anvesh Komuravelli Spacer 32 Questions?