Predicate Abstraction: A Tutorial - Predicate Abstraction

153 Pages·2012·0.8 MB·English

by  Daniel Kroening

Predicate Abstraction: A Tutorial
Predicate Abstraction
Daniel Kroening
May 28 2012
Outline
Introduction
Existential Abstraction
Predicate Abstraction for Software
Counterexample-Guided Abstraction Refinement
Computing Existential Abstractions of Programs
Checking the Abstract Model
Simulating the Counterexample
Refining the Abstraction
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 2
Model Checking with Predicate Abstraction
(cid:73) A heavy-weight formal analysis technique
(cid:73) Recent successes in software verification,
e.g., SLAM at Microsoft
(cid:73) The abstraction reduces the size of the model
by removing irrelevant detail
(cid:73) The abstract model is then small enough for an analysis
with a BDD-based Model Checker
(cid:73) Idea: only track predicates on data,
and remove data variables from model
(cid:73) Mostly works with control-flow dominated properties
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 3
Reminder Abstract Interpretation
Abstract Domain
Approximate representation of
sets of concrete values
α
−→ ˆ
S S
←−
γ
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 4
Predicate Abstraction as Abstract Domain
(cid:73) We are given a set of predicates over S,
denoted by Π ,...,Π .
1 n
(cid:73) An abstract state is a valuation of the predicates:
Sˆ = Bn
(cid:73) The abstraction function:
α(s) = (cid:104)Π (s),...,Π (s)(cid:105)
1 n
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 5
p ,¬p ¬p ,p
p ,p 1 2 1 2
1 2
¬p ,¬p
1 2
Predicates:
p ⇐⇒ x > y Abstract Transitions?
1
p ⇐⇒ y = 0
2
Predicate Abstraction: the Basic Idea
Concrete states over variables x, y:
x = 2 x = 2 x = 0
y = 0 y = 1 y = 0
x = 1 x = 1 x = 1
y = 0 y = 1 y = 2
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 6
p ,¬p ¬p ,p
p ,p 1 2 1 2
1 2
¬p ,¬p
1 2
Abstract Transitions?
Predicate Abstraction: the Basic Idea
Concrete states over variables x, y:
x = 2 x = 2 x = 0
y = 0 y = 1 y = 0
x = 1 x = 1 x = 1
y = 0 y = 1 y = 2
Predicates:
p ⇐⇒ x > y
1
p ⇐⇒ y = 0
2
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 6
Abstract Transitions?
Predicate Abstraction: the Basic Idea
Concrete states over variables x, y:
x = 2 x = 2 x = 0
y = 0 y = 1 y = 0
p ,¬p ¬p ,p
p ,p 1 2 1 2
1 2
x = 1 x = 1 x = 1
y = 0 y = 1 y = 2
¬p ,¬p
1 2
Predicates:
p ⇐⇒ x > y
1
p ⇐⇒ y = 0
2
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 6
Predicate Abstraction: the Basic Idea
Concrete states over variables x, y:
x = 2 x = 2 x = 0
y = 0 y = 1 y = 0
p ,¬p ¬p ,p
p ,p 1 2 1 2
1 2
x = 1 x = 1 x = 1
y = 0 y = 1 y = 2
¬p ,¬p
1 2
Predicates:
p ⇐⇒ x > y Abstract Transitions?
1
p ⇐⇒ y = 0
2
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 6
Existential Abstraction1
Definition (Existential Abstraction)
A model Mˆ = (Sˆ,Sˆ ,Tˆ) is an existential abstraction of
0
M = (S,S ,T) with respect to α : S → Sˆ iff
0
(cid:73) ∃s ∈ S .α(s) = sˆ ⇒ sˆ∈ Sˆ and
0 0
(cid:73) ∃(s,s(cid:48)) ∈ T.α(s) = sˆ∧α(s(cid:48)) = sˆ(cid:48) ⇒ (sˆ,sˆ(cid:48)) ∈ Tˆ.
1Clarke,Grumberg,Long: ModelCheckingandAbstraction,
ACMTOPLAS,1994
D.Kroening:SSFT12–PredicateAbstraction:ATutorial 7