1. CHARME’03 Predicate abstraction with Minimum Predicates Sagar Chaki*, Ed Clarke*, Alex Groce*, Ofer Strichman** * Carnegie Mellon University ** Technion

2. Overview of MAGIC  Specification S expressed using Labeled Transition Systems (LTS)  Model M extracted from C programs using predicate abstraction (LTS)  Checks if S weakly simulates M For this talk consider trace containment  Supports most but not all of ANSI-C Pointers are handled by abstraction Recursion disallowed

3. Predicate abstraction int x,y L0:x = 1; L1:y = 1; L2:if (x == y) L3:y = 1; L4:elsey = 2; Control Flow Automaton

4. Predicate abstraction Control Flow Automaton Predicate inference

5. Predicate abstraction Predicate inferenceAbstract model

6. Counter Example Guided Abstraction Refinement Predicate Abstraction Abstract Model predicates Model Checking Yes Model P Property M  Counter Example  Counterexample concrete? Yes Refinement No More predicates No P = P ’

7. Example Existing methods accumulate predicates: Ideally we should choose (A == 0) A = 0; if(A == 0) B = 0; if(B == 0) ERRORC = 0; if(C == 0) ERROR No Yes CE1 CE1: (B == 0) or (A==0) CE2 CE2: (C == 0) or (A==0)

8. Optimization Problem  Given a set of Candidate Predicates CP, find a minimal subset p µ CP s.t. A ( M, CP ) ²  ! A ( M, p ) ²  If -- no predicates are necessary. Only luck… If -- not relevant

9. Counter Example Guided Abstraction Refinement Predicate Abstraction Abstract Model predicates Model Checking Yes Counter Example  Counterexample concrete? Yes Refinement No More Predicates No Model P Property M  P = P ’  T

10. Counter Example Guided Abstraction Refinement Predicate Abstraction Abstract Model predicates Model Checking Yes Counter Example  Counterexample concrete? Yes Refinement No Different Predicates No Model P Property M  P = P ’  T

11. A(M,P)² A(M,P)²  Yes Counter- example  Pass CP = Candidate Predicates P == CP Yes Undecided No Algorithm Sample and Eliminate T = T [  Find minimal P2CP that eliminates T Impossible possible P =   concrete Yes Fail No

12. Minimization problem  Given a set of spurious traces T A set of candidate predicates CP  Find the smallest subset p 2 CP that eliminates all traces in T (If impossible return ‘undecided’)

13. Solution with 0-1 ILP (or PBS)  Derive a mapping from each trace t 2 T to the set of sets of predicates in CP that eliminate it First…  Encode each predicate p 2 CP with a Boolean variable p b Second…

14. Solution with 0-1 ILP (or PBS)  Derive  s.t. every satisfying assignment to  corresponds to a set of predicates that eliminate T. Third…  Among all satisfying assignments, find the one that minimizes the number of selected predicates ( min  p b ) Fourth…

15. Solution with 0-1 ILP (or PBS)  Example Let { p 1, p 3 },{ p 2, p 3, p 5 } be the set of sets of predicates that eliminate t 1 Let { p 2, p 3 },{ p 3, p 4, p 7 } be the set of sets of predicates that eliminate t 2 Min  p i s.t. t 1 : (( p 1 Æ p 2 ) Ç ( p 2 Æ p 3 Æ p 5 )) Æ t 2 : (( p 2 Æ p 3 ) Ç ( p 3 Æ p 4 Æ p 7 ))

16. Avoiding an exponential no. of constraints  Try only combinations up to size k In almost all examples we tried, counterexample traces could be eliminated with individual predicates.  Use data flow analysis and only combine branches that are related

17. Experiments  Open SSL - 20 properties of the Handshake mechanism of Open SSL. On average 350 lines of C code per property after slicing  5 examples from the BLAST benchmark set

18. Comparison with BLAST  BLAST applies Lazy Abstraction Lazy abstraction is orthogonal to predicate minimization  BLAST looks for fix point of the loops (for a given set of predicates) with theorem prover calls Magic unrolls loops up to a given bound (Conclusion: Not an entirely fair comparison)

19. Results (time in sec.)

22. Number of predicates

23. Memory (MB)

24. Solution with 0-1 ILP (or PBS)  Let k ( t ), 0 · k ( t ) · 2 | cp | be the number of sets that eliminate t  Let l(t,i,j)2CP be the j th literal in the i th set (1 · i · k ( t )) that eliminates t. Third…