1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison
description
Transcript of 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison
![Page 1: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/1.jpg)
1
Simulating Reachability using First-Order Logic with Applications to Verification
of Linked Data Structures
Tal Lev-Ami1, Neil Immerman2, Tom Reps3, Mooly Sagiv1, Siddharth Srivastava2 and Greta Yorsh1
1 Tel Aviv University2 University of Massachusetts-Amherst3 University of Wisconsin-Madison CADE 2005
![Page 2: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/2.jpg)
2
Applications of TC in verification
Transitive closure is natural for reasoning about linked data structures
Element (v) of a list (pointed to by x)w. x(w)n*(w,v)
Acyclicity v1,v2. n(v1,v2) n*(v2,v1)
Unreachable objects (garbage)v2.v1. Var(v1) f*(v1,v2)
Deadlocks
![Page 3: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/3.jpg)
3
Automated reasoning for FOL
Powerful tools available for automated reasoning in FOL (with equality)
ResolutionSPASS, Vampire, …
Nelson-OppenSimplify, Zapato, …
…
Prove, disprove (or diverge)
![Page 4: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/4.jpg)
4
What about FOL+TC?
No known tools for automated reasoning in full FOL+TC
No surprise – TC is very powerful, even small fragments of FOL become undecidable with the addition of TC
C2,
No R.E. axiomatization of TC in FOL
![Page 5: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/5.jpg)
5
Agenda
Verifying heap-manipulating programs
Initial axiomatization
Induction axiom scheme
Automating axiom instantiation
Conclusion
![Page 6: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/6.jpg)
6
Verifying heap-manipulating programs
Heap objects: Individuals
Reference variables: Unary relation symbolsx(v), y(v) – if v is pointed to by x, y
Fields: Binary relation symbolsn(v,w) – the n field of v points to w
![Page 7: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/7.jpg)
7
Reflexive transitive closure
n*(v1,v2)
v2 is reachable from v1 by following 0 or more n-fields
n*(v1,v2) is the least fixed point of ntc in
v1,v2.ntc(v1,v2)↔(v1=v2)w.n(v1,w)ntc(w,v2)
or
v1,v2.ntc(v1,v2)↔(v1=v2)w.ntc(v1,w)n(w,v2)
![Page 8: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/8.jpg)
8
Verification example
A list pointed to by x
A list pointed to by y
Show that xy the lists are disjoint
![Page 9: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/9.jpg)
9
Premise
Unary reachability (shorthand) v. rz,n(v) ↔w.z(w)n*(w,v)
No heap sharingv,v1,v2.n(v1,v)n(v2,v)v1=v2
No incoming edges to x and yv,w. x(v) y(v) n(w, v)
x and y are unique and differentv1,v2.x(v1)x(v2)v1=v2
v1,v2.y(v1)y(v2)v1=v2
v. (x(v)y(v))
![Page 10: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/10.jpg)
10
Goal
The lists pointed to by x and y are disjointv. rx,n(v) ry,n(v)
![Page 11: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/11.jpg)
11
Approximating TC in FOL
Extend vocabulary with new binary relation symbol ntc
Replace all occurrences of n* with ntc
Add ‘Natural’ axiomsv1,v2.ntc(v1,v2)↔(v1=v2)w.n(v1,w)ntc(w,v2)
v1,v2.ntc(v1,v2)↔(v1=v2)w.ntc(v1,w)n(w,v2)
The problem – minimalityLeast fixed point is not expressible in FOL
![Page 12: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/12.jpg)
12
TC-models
TC-model - a model M s.t. if n and ntc are in the vocabulary of M, then
(ntc)M = (nM)*, i.e., M interprets ntc as the reflexive, transitive closure of its interpretation of n
A set of axioms (axiomatization) isTC-valid - if is true in every TC-model.
TC-complete - if for every formula that is true in all TC-models,
![Page 13: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/13.jpg)
13
Approximating TC in FOL
Natural axiomatization is TC-complete for acyclic finite models
Not TC-complete otherwise
Negative occurrences of TC are the problemTC-valid formulas with only positive occurrences of TC are implied from the natural axiomatization
![Page 14: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/14.jpg)
14
Problems: cycles
n
n*=ntc n* ntc
ntc
ntc
ntc
n ntc
ntc
ntc
n ntc
ntc
ntc
n ntc
ntc
ntc
ntc
ntc
ntc
TC-model
u1
u2
u3
u4
v1,v2.ntc(v1,v2)↔(v1=v2)w.n(v1,w)ntc(w,v2)
v1,v2.ntc(v1,v2)↔(v1=v2)w.ntc(v1,w)n(w,v2)
![Page 15: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/15.jpg)
15
n*=ntc
…n n n nx
…n n n ny
n*ntc
x …n n n
…n …n n n ny
TC-model
Problems: infinite models
![Page 16: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/16.jpg)
16
Problems: infinite models
Existing FOL theorem provers cannot be restricted to finite models
Finiteness is not FOL expressible
![Page 17: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/17.jpg)
17
Induction axiom scheme
IND[P,Z,n] = (w. Z(w) P(w)) (w1,w2. P(w1) n(w1,w2) P(w2)) (w1,w2. Z(w1) ntc(w1,w2) P(w2))
IncompleteComplete axiomatization is non-R.E.
How to choose Z and P?
![Page 18: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/18.jpg)
18
Choosing axiom instantiations
Hard to find Z and P to instantiate IND directly
Introduce new axiom schemes provable from IND in FOL
Add enough axioms to to prove target formula
Used in practice to prove interesting examples
![Page 19: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/19.jpg)
19
Ideas towards solution
Reasoning about edges toward reasoning about paths
Reasoning about one type of paths toward reasoning about another type
![Page 20: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/20.jpg)
20
Coloring axioms
Start with transitivityw1,w2,w3. ntc(w1,w2)ntc(w2,w3) ntc(w1,w3)
Add instances of coloring axiom schemesNoExit
NewStart
![Page 21: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/21.jpg)
21
A
NoExit
NoExit[A,n] = (w1,w2. A(w1) n(w1,w2) A(w2)) (w1,w2. A(w1) ntc(w1,w2) A(w2))
![Page 22: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/22.jpg)
22
n*=ntc
…n n n ny
…n n n nx
n*ntc
y …n n n
…n …n n n nx
TC-model
![Page 23: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/23.jpg)
23
Example RevisitedTwo lists pointed to by x and y respectively
NoExit[rx,n,n]
Axiom Premise v1,v2. rx,n(v1)n(v1,v2) rx,n(v2)
w
n
u
v
¬ntc
ntcx
u’ntc
n
=
=
![Page 24: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/24.jpg)
24
Example revisitedTwo lists pointed to by x and y respectively
NoExit[rx,n,n]
Axiom Premise v1,v2. rx,n(v1)n(v1,v2) rx,n(v2)
v1,v2. rx,n(v1) ntc(v1,v2) rx,n(v2)
disjointness: v. rx,n(v) ry,n(v)
![Page 25: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/25.jpg)
25
f
A
g
NewStart
![Page 26: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/26.jpg)
26
gtc
ftc
gtc
gtc
f
A
g
NewStart
w1,w2. A(w1)A(w2)g(w1,w2)f(w1,w2)
![Page 27: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/27.jpg)
27
gtc
ftc
gtc
gtc
f
A
g
NewStart
NewStart[A,g,f] = (w1,w2. A(w1)A(w2)g(w1,w2)f(w1,w2)) w1,w2. gtc(w1,w2)ftc(w1,w2)
w.A(w)gtc(w1,w)gtc(w,w2)
![Page 28: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/28.jpg)
28
NewStart
Important when updating fieldsProve no fields changed within A
Prove no incoming or no outgoing paths to A
Conclude no paths changed within A
![Page 29: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/29.jpg)
29
Instantiating coloringaxiom schemes
Coloring axioms are effective only if they can be automatically instantiated
Verification of imperative programs
Use boolean combinations of program variables and unary reachability
Exponential number of axioms
![Page 30: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/30.jpg)
30
Incremental algorithm
Axioms are built as PremiseConclusionBoth closed formulas
Try to prove Premise and only then introduce Conclusion
Try boolean combinations in BFS
![Page 31: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/31.jpg)
31
Prototype implementation
Used to automatically prove partial correctness (given loop invariants) of several interesting programs
Destructive reversal of singly linked list
Destructive append
Simple mark & sweep garbage collector
Use SPASS as underlying theorem prover
![Page 32: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/32.jpg)
32
Completeness
TC-complete with respect to a theory
Finiteness is expressible with TC
TC-complete axiomatization implies FINITE-VALIDITY is decidable
No R.E. TC-complete axioms with respect to logic with 2 binary relation symbols encoding partial functions
![Page 33: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/33.jpg)
33
Related work
Nelson’s axiomatization [Nelson ‘83]Incomplete and follows from INDMark & Sweep
Updating transitive closure using FO [Dong, Su ‘95], [Hesse ‘03] Induction [Bundy ’01]Inductionless induction [Lankford ‘81] [Comon ‘01]Decidable logics with TC (e.g. MSO)
![Page 34: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/34.jpg)
34
Future work
New axioms
FinitenessEND[n]: v. w. ntc(v, w)
(u. n(w, u)) (u. n(w, u)ntc(u, w))
Fragments of FOL where axiomatization is possible
Integration with TVLA
![Page 35: 1 Tel Aviv University 2 University of Massachusetts-Amherst 3 University of Wisconsin-Madison](https://reader034.fdocuments.in/reader034/viewer/2022051402/56815a83550346895dc7f1ad/html5/thumbnails/35.jpg)
35
Thank you