An encoding of array verification problems into array-free Horn clauses∗ David Monniaux Univ. Grenoble Alpes, VERIMAG,F-38000 Grenoble 5 CNRS, VERIMAG,F-38000 Grenoble, France 1 0 Laure Gonnord 2 LIP, Univ. Lyon-1, France p e October 1, 2015 S 0 3 Abstract ] L Automatically verifying safety properties of programs is hard, and it P is even harder if the program acts upon arrays or other forms of maps. . s Many approaches exist for verifying programs operating upon Boolean c and integer values (e.g. abstract interpretation, counterexample-guided [ abstractionrefinementusinginterpolants),buttransposingthemtoarray 1 properties has been fraught with difficulties. v In contrast to most preceding approaches, we do not introducea new 2 abstract domainoranewinterpolation procedureforarrays. Instead,we 9 generate an abstraction as a scalar problem and feed it to a preexisting 0 solver, with tunableprecision. 9 Our transformed problem is expressed using Horn clauses, a common 0 formatwithclearandunambiguouslogicalsemanticsforverificationprob- . 9 lems. Animportantcharacteristicofourencodingisthatitcreatesanon- 0 linearHorn problem,with treeunfoldings, eventhough following “flatly” 5 thecontrol-graph structure ordinarily yields a linear Horn problem, with 1 linear unfoldings. That is, our encoding cannot be expressed by an en- : v coding into another control-flow graph problem, and truly leverages the i capacity of theHorn clause format. X We illustrate our approach with a completely automated proof of the r functional correctness of selection sort. a 1 Introduction Formal program verification, that is, proving that a given program behaves correctly according to specification in all circumstances, is difficult. Except for veryrestrictedclassesofprogramsandproperties,itisanundecidablequestion. Yet, a variety of approaches have been developed over the last 40 years for ∗The research leading to these results has received funding from the EuropeanResearchCouncil under the European Union’s Seventh Framework Programme (FP/2007-2013) /ERCGrantAgreementnr.306595“STATOR”. 1 automated or semi-automated verification, some of which have had industrial impact. In this article, we consider programs operating over arrays, or, more gen- erally, maps from an index type to a value type. (in the following, we shall use “array” and “map” interchangeably). Such programs contain read (e.g. v :=a[i]) and write (a[i]:=v) operations over arrays, as well as “scalar” operations.1 Universally quantified properties Veryoften,desirablepropertiesoverar- raysareuniversallyquantified;e.g. sortednessmaybeexpressedas∀k ,k k < 1 2 1 k =⇒ a[k ] ≤ a[k ]. However, formulas with universal quantification and 2 1 2 linear arithmetic over integers and at least one predicate symbol (a predicate being a function to the Booleans) are so expressive that one can define the ex- ecution of a Turing machine as a model to such a formula, whence this class is undecidable [12]. Some decidable subclasses have however been identified [6]. There is therefore no general algorithm for checking that such invariants hold,letaloneinferringthem. Yet,therehavebeenseveralapproachesproposed toinfersuchinvariants(moreonthisinSection7). Inthisarticle,weproposea methodforinferringsuchuniversallyquantifiedinvariants,givenaspecification ontheoutputoftheprogram. Becauseofundecidability,thisapproachmayfail to terminate in the general case. Our approach is based on conversion to Horn clauses, a popular format for program verification problems [25] supported by a number of tools. Most conversions to Horn clauses map variables and operations from the programto variablesofthesametypeandthesameoperationsintheHornclauseproblem:2 anintegerismappedtoaninteger,anarraytoanarray,etc. Ifsomedatatypes arenotsupportedby the back-endanalysis,the variablesofthese types maybe discarded, at the expense of precision — thus if the back-end analysis does not support arrays, array reads are abstracted as nondeterministic choices, array writesarediscarded,andscalaroperationsaremapped“asis”. Incontrast,our approach abstracts programs much less violently, with tunable precision, even though the result still is a Horn clause problems without arrays. Section 3 explains how many properties (e.g. initialization) can be proved using one “distinguished cell”, Section 4 explains how properties such as sortedness can be provedusingtwoofthem; completelydiscardingarrayscorrespondsto using zero of them. We illustrate this approach with an automated proof that the output of selection sort is sorted: we apply Section 4 to obtain a system of Horn clauses withoutarrays,whichwe feedtothe Spacer solver,whichproducesa modelof this system, meaning that the sortedness postcondition truly holds. Note that Spacer cannot, on its own, reason about universal properties on arrays. Previousapproaches[21]using“distinguishedcells”amounted(eventhough they were not described as such) to linear Horn rules; on contrast,our abstract semantics usesnon-linearHornrules,which leadsto higher precision(Sec. 7.2). 1Inthefollowing,weshalllumpas“scalar”operationsalloperationsnotinvolvingthearray under consideration, e.g. i := i+1. Any data types (integers, strings etc.) are supported providedthattheyaresupportedbytheback-endsolver. 2With the exception of pointers and references, which need special handling and may be internallyconvertedtoarrayaccesses. 2 Multisetofcontents Itisoftennecessarytoreasonnotonlyaboutindividual elementsofanarrayormap,butalsoaboutitscontentsasawhole: e.g. sorting algorithmspreservethecontentsofthearray(eventhough,locally,whenmoving elements around, they may break this invariant). Themultisetofthecontentsofanarrayofelementsoftypeβ isamapfromβ to N. Using thatremark,we canabstractthe arrayboth using our“distinguish cell”approachandasthemultisetofitselements(Sec.5.2);weprovidesuitable program transformations. We illustrate that approach with an automated proof that the output of selection sort has the same contents as its input (that is, the output is a per- mutation of the input). Contributions Our main contribution is a system of rules for transforming the atomic programstatements in a programoperating over arraysor maps, as wellas(optionally)theuniversallyquantifiedpostconditiontoprove,intoasys- temofnon-linearHornclausesoverscalarvariablesonly,withtunableprecision. Statementsoperatingovernon-arraysvariablesaremapped(almost)identically to their concretesemantics. This systemover-approximatesthe behavior ofthe program. Asolutionofthat systemcanbe mappedto inductive invariantsover the original programs,including universally properties over arrays. Asecondcontribution,baseduponthe first,is a systemofrules ofthe same kind that also keeps tracks of array/mapcontents. We illustrate both these systems with automated proofs of functional correctness of array initialization, array reversal and selection sort. For each of these proofs, we simply apply our transformationrules and apply a third-party solver for Horn clauses over scalars. We also show the user can optionally help the solver converge faster by supplying partial invariants. A third contribution is a counterexample reconstruction scheme (Sec. 6), if the property to prove is actually false. 2 Program Verification as solving Horn clauses A classical approachto programanalysis is to consider a programas a control- flowgraphandtoattachtoeachvertexp (controlpoint)aninductive invariant i I : a set of possible values x of the program variables (and memory stack and i heap, as needed) so that i) the set associated to the initial control point p i0 contains the possible initialization values S ii) for each edge p → p , the i0 i c j set I associated to the target control point p should include all the states j j reachable from the states in the set I associated to the source control point i p according to the transition relation τ of the edge. Inductiveness is thus i i,j defined by Horn clauses: ∀x, x∈S =⇒ x∈I (1) i0 i0 ∀x,x′ x∈I ∧(x,x′)∈τ =⇒ x′ ∈I (2) i i,j j Forprovingsafetyproperties,inadditiontoinductiveness,onerequiresthat error locations p ,...,p are proved to be unreachable (the associated set of e1 en states is empty): this amounts to Horn clauses implying false (⊥): ∀x, x ∈ I =⇒ ⊥. ei 3 exit i≥n j :=j+2 i:=0 j :=1 init loop incri incrj i0 i≥n i:=0 i0 =⇒ loop(n,0,a) (11) ∀n,i∈Z ∀a∈Array(Z,Z) i0 i:=0 i≥n i:=i+1 end Figure 3: Detailed control-flow graph for program2 Remark 3. The scalar statements include “killing” dead variables (Def. 5). Notethat,contrarytomanyotherabstractions,inours,removingsomevariables may cause irrecoverable loss of precision on other variables [21, Sec. 4.2]: if v is live, then one can represent ∀k, a[k]=v, which implies ∀k ,k a[k ]=a[k ] 1 2 1 2 (constantness), but if v is discarded, the constantness of a is lost. Theorem 6. If I♯,...,I♯ are a solution of a system of Horn clauses sound in 1 m the above sense, then γ(I♯),...,γ(I♯ ) are inductive invariants with respect to 1 m the concrete semantics → . c Proof. From the general properties of fixed points of monotone operators and Galois connections [7]. Definition 7 (Property conversion). A property “at program point p , for i all x ∈ χ and all k ∈ ι, φ(x,k,a[k]) holds” (where φ is a formula, say over arithmetic) is converted into a Horn query ∀x∈χ ∀k ∈ι φ(x,k,a ). k Our method for converting a scalar program into a system of Horn clauses over scalar variables is thus: Algorithm 1. 1. Construct the control-flow graph of the program. 2. To each control point p , with vector of scalar variables x , associate a i i predicate I♯x ,k,a ) in the Horn clause system (the vector of scalar vari- ( i k ables may change from control point to control point). 3. For each transition of the program, generate Horn rules according to Def.1,2,4asapplicable(aninitializationnodedoesnotneedantecedents in its rule). 4. Generate Horn queries from desired properties according to Def. 7. Example (Ex. 2, continued). Let us now apply the Horn abstract semantics from Definitions 1, 2 and 4 to Program 2, following the detailed control-flow graph (Fig 3); in this case, α = Z, ι = {0,...,n−1}, χ = Z. After a slight simplification of the Horn clauses, we obtain (Listing 8): ∀n,k,a ∈Z 0≤k

An encoding of array verification problems into array-free Horn clauses

Similar An encoding of array verification problems into array-free Horn clauses