A SAT characterization of boolean-program correctness K. Rustan M. Leino Microsoft Research,...

A SAT characterization of A SAT characterization of boolean-program boolean-program

correctnesscorrectness

K. Rustan M. LeinoK. Rustan M. LeinoMicrosoft Research, Redmond, WAMicrosoft Research, Redmond, WA

14 Nov 2002IFIP WG 2.4 meeting, Schloβ Dagstuhl, Germany

MotivationMotivation

This program has performed an illegal operation.If the problem persists, please contact the vendor.

APIERR DevGetStatus(LPSTATUS status){

unsigned int t;struct _Info info;for (i = 0; i < SPIGOT_COUNT; i++){

APIERR err;info.cbSize = sizeof(struct _Info);info.iSpigot = i;err = W_GetStatus(&info);if (err != APIERR_Success){

return err;}t |= info.fStatus & SPIGOT_ALIVE;

}status->result = t | 0x2055;return APIERR_Success;

APIERR W_GetStatus(struct _Info * pinfo){

APIERR err;bool fChanged = TRUE;do{

err = DevRegisterColumn(pinfo, TRUE);if (err != APIERR_Success){

return err;}if (pinfo->huwMagi < 10){

fChanged = FALSE;}else{

err = DevReleaseColumn(pinfo);}

} while (fChanged);return DevReleaseColumn(pinfo);

The SLAM toolkitThe SLAM toolkitTom Ball, Sriram Rajamani, et al., Microsoft Research

Device driver (C program)

Abstraction (boolean program)

y := false;

x := true;

x := x y;

assert x;

Properties of interest: x “resource is locked” y t > 0

Predicate abstraction

y := false;

x := true;

x := x y;

assert x;assert x

y := false;

x := true;

x := x y;

assert x;assert x

real error

y := false;

x := true;

x := x y;

assert x;

infeasible path

y := false;

x := true;

x := x y;

assert x;

Predicate abstraction

Properties of interest: x “resource is locked” y t > 0 z p≠ NULL

z := true;

if (z) …Predicate abstraction

Boolean programsBoolean programs Prog ::= Prog ::= varvar Id* ; Block* Id* ; Block* Block ::= LabelId : Stmt* Block ::= LabelId : Stmt* gotogoto

LabelId*LabelId* Stmt ::=Stmt ::= Id := ExprId := Expr

|| assertassert Expr Expr|| assumeassume Expr Expr

Expr ::= false | true | Id | Expr ::= false | true | Id | ExprExpr|| Expr Expr Expr | Expr Expr | Expr Expr Expr

ExampleExample varvar x, y; x, y;

A:A: x := true; x := true; gotogoto B BB:B: assertassert x; x := x x; x := x y; y; gotogoto B B oror C CC:C:

A: x := true

B: assert x;x := x y

Semantics: Weakest Semantics: Weakest preconditionspreconditions

For any statement S and For any statement S and postcondition Q, wp(S,Q) postcondition Q, wp(S,Q) characterizes those pre-states from characterizes those pre-states from which execution is guaranteed:which execution is guaranteed: not to go wrong, andnot to go wrong, and either the execution doesn’t terminate either the execution doesn’t terminate

or it terminates in a state satisfying Qor it terminates in a state satisfying QS

wp(S,Q)

Semantics: Weakest Semantics: Weakest preconditionspreconditions

wp(x := E, Q) = Q[x:=E]wp(x := E, Q) = Q[x:=E]wp(wp(assertassert E, Q) = E E, Q) = E Q Qwp(wp(assumeassume E, Q) = E E, Q) = E Q Q

wp(wp(skipskip, Q) = Q, Q) = Qwp(S;T, Q) = wp(S, wp(T,Q))wp(S;T, Q) = wp(S, wp(T,Q))

wp(wp(gotogoto labelslabels, Q) =, Q) =(( L L labelslabels :: wp(L,Q)) :: wp(L,Q))

For any block:For any block:var w;var w;……L: S; goto labelsL: S; goto labels……

introduce a boolean function L, such introduce a boolean function L, such that:that:

What I write:

L(w) =L(w) = wp(S, (wp(S, (GGlabels :: labels :: G(w)))G(w)))

Semantics of blocksSemantics of blocks

((w ::w :: L(w) =L(w) = wp(S, (wp(S, (GGlabels :: labels :: G(w))) )G(w))) )

L = (L = (λλw ::w :: wp(S, (wp(S, (GGlabels :: labels :: G(w))) )G(w))) )

What I really mean:

or equivalently:

ExampleExample

A(x,y) = wp(x := true, B(x,y))A(x,y) = wp(x := true, B(x,y))

B(x,y) = wp(B(x,y) = wp(assertassert x; x := x x; x := x y, y,

B(x,y) B(x,y) C(x,y)) C(x,y))

C(x,y) = wp(C(x,y) = wp(skipskip, true), true)A: x := true

B: assert x;x := x y

A(x,y) = B(true,y)A(x,y) = B(true,y)

B(x,y) = x B(x,y) = x B(x B(x y, y) y, y) C(x C(x y, y) y, y)

C(x,y) = trueC(x,y) = true

Equations with multiple Equations with multiple solutionssolutions

The unknownsSolution 0:

A(x,y) = falseB(x,y) = falseC(x,y) = true

Solution 1:

A(x,y) = yB(x,y) = x yC(x,y) = true

We want the weakest solution

A, B, C :A, B, C : A(x,y) = B(true, y)A(x,y) = B(true, y)

B(x,y) = x B(x,y) = x B(x B(xy, y) y, y) C(x C(xy, y,

C(x,y) = trueC(x,y) = true

Weakest solutionWeakest solution

A,B,C :A,B,C : A(x,y) = B(true, y)A(x,y) = B(true, y)B(x,y) = x B(x,y) = x B(x B(xy, y) y, y) C(x C(xy, y,

y)y)C(x,y) = trueC(x,y) = true

Weakest solutionWeakest solution

F(A,B,C) G(A,B,C) H(A,B,C)

A,B,C :A,B,C : A = (A = (λλx,y :: B(true, y))x,y :: B(true, y))B = (B = (λλx,y :: x x,y :: x B(x B(xy, y) y, y) C(x C(xy, y,

y))y))C = (C = (λλx,y :: true)x,y :: true)

F(A,B,C) G(A,B,C) H(A,B,C)

A,B,C :A,B,C : A = F(A,B,C) A = F(A,B,C) B = G(A,B,C)B = G(A,B,C)C = H(A,B,C)C = H(A,B,C)

wherewhere F = ( F = (λλx,y :: B(true, y))x,y :: B(true, y)) G = ( G = (λλx,y :: x x,y :: x B(x B(xy, y) y, y) C(x C(xy, y))y, y)) H = ( H = (λλx,y :: true)x,y :: true)

((λλx,y :: x x,y :: x B(x B(xy, y) y, y) C(x C(xy, y))y, y))((λλx,y :: true)x,y :: true)

Weakest solution/fixpointWeakest solution/fixpoint

Weakest solution of A,B,C

((λλx,y :: B(true, y))x,y :: B(true, y))

Weakest fixpoint of F,G,H

Program correctnessProgram correctness A program with variables w and start A program with variables w and start

block A is correct iff:block A is correct iff:

((w :: A(w))w :: A(w))

That is, the program has an error iff:That is, the program has an error iff:

A(w)A(w)

is satisfiable.is satisfiable.

boolean equations, satisfiability

functions, weakest solutions

Equations over a closed set of Equations over a closed set of “terms”“terms”

Using the definitions:Using the definitions:A(x,y) = B(true, y)A(x,y) = B(true, y)B(x,y) = x B(x,y) = x B(x B(xy, y) y, y) C(x C(xy, y)y, y)C(x,y) = trueC(x,y) = true

We produce:We produce: A(x,y) = B(true, y)A(x,y) = B(true, y) B(true, y) = true B(true, y) = true B(true B(truey, y) y, y) C(true C(truey, y)y, y) B(trueB(truey, y) = truey, y) = truey y B(true B(trueyyy, y) y, y) C(true C(trueyyy, y,

y)y) C(trueC(truey, y) = truey, y) = true

Point functionsPoint functions A function:A function:

f(w) = f(false) f(w) = f(false) f(w) f(w)

can be expressed as two can be expressed as two point point functions functions ::

fffalsefalse = f = ffalsefalse f ffalsefalse

fftruetrue = f = ffalsefalse f ftruetrue

Point-function equationsPoint-function equations A set of equations:A set of equations:

f :f : f(w) = f(false) f(w) = f(false) f(w) f(w)

can be expressed as:can be expressed as:

fffalsefalse, f, ftruetrue : : fffalsefalse = f = ffalsefalse f ffalsefalse

fftruetrue = f = ffalsefalse f ftruetrue

A fixpoint theoremA fixpoint theorem Given a function F on a complete Given a function F on a complete

lattice,lattice,if F is continuous, then its weakest if F is continuous, then its weakest fixpoint exists and is given by:fixpoint exists and is given by:

FFkk( T )( T )

for some natural number k.for some natural number k.

k is the k is the fixpoint depthfixpoint depth of F of F

fixpoint depth fixpoint depth lattice height lattice height

F F k k ( T )( T )

Computing fixpoints: Computing fixpoints: outwardoutward

TT{ apply F }{ apply F }

F(F(TT)){ apply F }{ apply F }

F(F(F(T)F(T))){ apply F }{ apply F }

F(F(F(F(T))F(F(T)))){ apply F }{ apply F }

F(F(F(F(F(T)))F(F(F(T)))))

equal to each other—weakest fixpoint of F

Suppose fixpoint depth of F is 3

produced in previous step

Computing fixpoints: inwardComputing fixpoints: inward { replace { replace with F( with F() }) }

F(F()){ replace { replace with F( with F() }) }

F(F(F(F()))){ replace { replace with F( with F() }) }

F(F(F(F(F(F()))))){ replace { replace with T } with T }

F(F(F(F(F(F(TT)))))) weakest fixpoint of F

no need for further applications of F

Suppose fixpoint depth of F is 3

produced in previous step

Multiple unknownsMultiple unknowns a,b :a,b :a = F(a,b)a = F(a,b)

b = G(a,b)b = G(a,b) Suppose fixpoint depths of F,G are 2,1Suppose fixpoint depths of F,G are 2,1 Weakest solution for a is:Weakest solution for a is:

aa0000

F(aF(a10 10 , b, b10 10 )) F(F(aF(F(a2020, b, b20 20 ), G(a), G(a11 11 , b, b1111)))) F(F(T , G(aF(F(T , G(a2121, b, b2121)), G(F(a)), G(F(a2121, b, b2121), T ))), T )) F(F(T , G(T , T F(F(T , G(T , T )), G(F(T , T )), G(F(T , T ), T ))), T ))

Number of enclosing applications of G

Number of enclosing applications of F

Special instanceSpecial instance Lattice of booleans has height 1Lattice of booleans has height 1 If F returns a boolean, then F’s If F returns a boolean, then F’s

fixpoint depth is at most 1fixpoint depth is at most 1 and so F’s weakest fixpoint is F(T)and so F’s weakest fixpoint is F(T)

Back to our problemBack to our problem Using the definitions:Using the definitions:

A(x,y) = B(true, y)A(x,y) = B(true, y)B(x,y) = x B(x,y) = x B(x B(xy, y) y, y) C(x C(xy, y)y, y)C(x,y) = trueC(x,y) = true

We produce:We produce: AAx,yx,y = B = Btrue,ytrue,y

BBtrue,ytrue,y = true = true B Btruetruey,yy,y C Ctruetruey,yy,y

BBy,yy,y = y = y B Byyy,yy,y C Cyyy,yy,y

Using the definitions:Using the definitions:A(x,y) = B(true, y)A(x,y) = B(true, y)B(x,y) = x B(x,y) = x B(x B(xy, y) y, y) C(x C(xy, y)y, y)C(x,y) = trueC(x,y) = true

We produce:We produce: AAx,yx,y = B = Btrue,ytrue,y

BBy,yy,y = y = y true true C Cyyy,yy,y

CCy,yy,y = true = true

Back to our problemBack to our problem

Leibniz constraintsLeibniz constraints Being a function means, for any f:Being a function means, for any f:

((w,w’ :: (w=w’) w,w’ :: (w=w’) (f(w)=f(w’))) (f(w)=f(w’)))

“Leibniz’s rule”“Leibniz’s rule”

So when we have:So when we have:BBtrue,ytrue,y = … = …

BBy,yy,y = … = …

we also generate the following we also generate the following Leibniz constraint Leibniz constraint ::

(true=y) (true=y) (y=y) (y=y) (B (Btrue,ytrue,y = B = By,yy,y))

SAT formulaSAT formula From the closed set of terms:From the closed set of terms:

AAx,yx,y = B = Btrue,ytrue,y

BBy,yy,y = y = y true true C Cyyy,yy,y

CCy,yy,y = true = true

we produce the following SAT equations:we produce the following SAT equations:aaa = ba = bb = true b = true b’ b’ c cb’ = y b’ = y true true c cc = truec = truey y (b=b’) (b=b’)

Leibniz constraint

negated start symbol:

A(x,y)

abb’c

SummarySummary Boolean program, whose semantics is defined Boolean program, whose semantics is defined

by weakest solution of weakest-precondition by weakest solution of weakest-precondition equationsequations

Translate to SAT problem:Translate to SAT problem: Instantiate equations to get a closed set of termsInstantiate equations to get a closed set of terms Replace nested recursive instantiations by trueReplace nested recursive instantiations by true Conjoin negated start symbol and Leibniz constraintsConjoin negated start symbol and Leibniz constraints Write point functions as propositional variablesWrite point functions as propositional variables Check for satisfiabilityCheck for satisfiability

Performance? Heuristics?Performance? Heuristics? Are Leibniz constraints really needed?Are Leibniz constraints really needed? Better encoding of procedures?Better encoding of procedures?

ComplexityComplexity With N blocks and K variables:With N blocks and K variables:

each boolean function has K arguments, each boolean function has K arguments, each a boolean expressioneach a boolean expression

there are 2there are 222KK different boolean expressions different boolean expressions

So, there are N·2So, there are N·2KK··22KK different terms different terms

Suppose each of the 2Suppose each of the 2KK initial states initial states were considered individually:were considered individually: each boolean-function argument can then each boolean-function argument can then

be folded into one of the 2 boolean be folded into one of the 2 boolean constantsconstants

Then, there are only 2Then, there are only 2KK·N·2·N·2KK different terms different terms

Explicit-state checking:

Symbolic checking:

Symbolic vs. explicit-state Symbolic vs. explicit-state checkingchecking

The following equality (and others?) The following equality (and others?) can be exploited heuristically to try can be exploited heuristically to try to get a good balance:to get a good balance:

f(P, Q, R)f(P, Q, R)==(P (P f(true, Q, R)) f(true, Q, R)) ( (P P f(false, Q, R)) f(false, Q, R))

SummarySummary Boolean program, whose semantics is defined by Boolean program, whose semantics is defined by

weakest solution of weakest-precondition weakest solution of weakest-precondition equationsequations

Translate to SAT problem:Translate to SAT problem: Instantiate equations to get a closed set of termsInstantiate equations to get a closed set of terms Replace nested recursive instantiations by trueReplace nested recursive instantiations by true Conjoin negated start symbol and Leibniz constraintsConjoin negated start symbol and Leibniz constraints Write point functions as propositional variablesWrite point functions as propositional variables Check for satisfiabilityCheck for satisfiability

Performance heuristics: symbolic vs. explicit-Performance heuristics: symbolic vs. explicit-statestate

Other heuristics?Other heuristics? Are Leibniz constraints really needed?Are Leibniz constraints really needed? Better encoding of procedures?Better encoding of procedures?

A SAT characterization of boolean-program correctness K. Rustan M. Leino Microsoft Research,...

Documents

Checking correctness properties of object-oriented programs K. Rustan M. Leino Microsoft Research, Redmond, WA Lecture 4 EEF summer school on Specification,

Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLine’s CSE 503, Software Engineering University of Washington 28 Apr 2004

This is Boogie 2 - · PDF fileThis is Boogie 2 K. Rustan M. Leino Microsoft Research, Redmond, WA, USA leino@microsoft.com Manuscript KRML 178, working draft 24 June 2008. Abstract

Challenges in increasing tool support for programming K. Rustan M. Leino Microsoft Research, Redmond, WA, USA 23 Sep 2004 ICTAC Guiyang, Guizhou, PRC joint

K. Rustan M. Leino Microsoft Research, Redmond, WA, USA 19 July 2007 Invited talk, CADE-21 Bremen, Germany

K. Rustan M. Leino Principal Researcher Microsoft Research, Redmond, WA, USA 14 Nov 2007 Øredev Malmö, Sweden

Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,

K. Rustan M. Leino RiSE, Microsoft Research 1 Dec 2008 Invited talk, working group meeting COST Action IC0701, Formal Verification of Object-Oriented Software

Advanced programming tools at Microsoft K. Rustan M. Leino Microsoft Research, Redmond, WA, USA 16 May 2005 Distinguished lecture, York University Toronto,

K. Rustan M. Leino RiSE, Microsoft Research, Redmond joint work with Peter Müller and Jan Smans Lecture 0 1 September 2009 FOSAD 2009, Bertinoro, Italy

Program Verification Using the Spec# Programming System ETAPS Tutorial K. Rustan M. Leino, Microsoft Research, Redmond Rosemary Monahan, NUIM Maynooth

Writing specifications for object-oriented programs K. Rustan M. Leino Microsoft Research, Redmond, WA, USA 21 Jan 2005 Invited talk, AIOOL 2005 Paris,

Lecture Notes in Computer Science 6605 Science/2...Dept. of Information Technology 751 05 Uppsala, Sweden E-mail: parosh@it.uu.se K. Rustan M. Leino Microsoft Research Redmond, WA

Abstract Interpretation with Alien Expressions and Heap Structures Bor-Yuh Evan ChangK. Rustan M. Leino University of California, BerkeleyMicrosoft Research

Specification and Verification of Object-Oriented Software · Specification and Verification of Object-Oriented Software K. Rustan M. LEINO Microsoft Research, Redmond, WA, USA

Trigger Selection Strategies to Stabilize Program …€¦Trigger Selection Strategies to Stabilize Program Veriﬁers K. Rustan M. Leino and Clément Pit-Claudel 1 Microsoft Research

K. Rustan M. Leino Peter Müller IFIP WG 2.3 meeting 49 10 June 2009 Boston, MA

Going beyond a basic ownership system in Spec# K. Rustan M. Leino Microsoft Research, Redmond, WA Joint work with: Peter Müller Angela Wallenburg ESF workshop

Demand-driven inference of loop invariants in a theorem prover K. Rustan M. Leino Microsoft Research, Redmond, WA, USA joint work with Francesco Logozzo

Vale: Verifying High-Performance Cryptographic …Vale: Verifying High-Performance Cryptographic Assembly Code Barry Bond ⋆, Chris Hawblitzel , Manos Kapritsos†, K. Rustan M. Leino