Tool-supported Program Abstraction Tool-supported Program Abstraction for Finite-state Verificationfor Finite-state Verification
Matthew Dwyer1, John Hatcliff1, Corina Pasareanu1, Robby1, Roby Joehanes1, Shawn Laubach1, Willem Visser2, Hongjun Zheng1
Kansas State University1
NASA Ames Research Center/RIACS2http://www.cis.ksu.edu/santos/bandera
Abstraction: the key to scaling upAbstraction: the key to scaling up
Originalsystem
symbolic state
Abstract system
represents a set of states
abstraction
Safety: The set of behaviors of the abstract system over-approximates the set of behaviors of the original system
Goals of our work …Goals of our work …
Develop multiple forms of tool support for abstraction that are …
… applicable to program source code… largely automated… usable by non-experts
Evaluate the effectiveness of this tool support through…
… implementation in the Bandera toolset… application to real multi-threaded Java programs
Case Study: DEOS KernelCase Study: DEOS Kernel
A real-time operating system for integrated modular avionics systems
Large C++ program, manually sliced and inspected Slice translated to Java by NASA Ames
– 1443 lines of code, 20 classes, 6 threads With a known bug
Honeywell Dynamic Enforcement Operating System (DEOS)
Application processes are guaranteed to be scheduled for their budgeted time during a scheduling unit
Requirement:
DEOS ArchitectureDEOS Architecture
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
...if(...) assert(false);...
class Thread
class StartofPeriodEvent
class ListofThreads
class Scheduler
Verification of DEOSVerification of DEOS
We used Bandera and Java PathFinder (JPF) Verification of the system exhausted 4
Gigabytes of memory without completing– no information about satisfaction of requirement
To verify property or produce a counter-example– state space must be reduced– some form of abstraction is needed
Data Type AbstractionData Type Abstraction
int x = 0;if (x == 0) x = x + 1;
Data domains
(n<0) : NEG(n==0): ZERO(n>0) : POS
Signs
NEG POSZERO
int
Code
Signs x = ZERO;if (Signs.eq(x,ZERO)) x = Signs.add(x,POS);
Collapses data domains via abstract interpretation:
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
Control dependencies:
29 conditionals
16 methods
32 variables
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
Control dependencies:
29 conditionals
16 methods
32 variables
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
Unbounded!
Variable SelectionVariable Selection
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
Data dependencies
Attaching Abstract TypesAttaching Abstract Types
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
int itsPeriodId = 0; ...public int currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=itsPeriodId + 1; ... }
class StartofPeriodEvent
int itsLastExecution; ...public void startChargingCPUTime(){ int cp=itsEvent.currentPeriod(); if(cp == itsLastExecution) { ... }
class Thread
...if(...) assert(false);...
SIGNS
SIGNS
SIGNS
Code TransformationCode Transformation
Requirement Monitor
Environment
System Clock & Timer
User Process 1
User Process 2
...
DEOS Kernel
Signs itsPeriodId = ZERO; ...public Signs currentPeriod() { return itsPeriodId; }public void pulseEvent(...) {... if(countDown == 0) { itsPeriodId=Signs.add(itsPeriodId ,POS);... }
class StartofPeriodEvent
Signs itsLastExecution; ...public void startChargingCPUTime(){ Signs cp=itsEvent.currentPeriod(); if(Signs.eq(cp,itsLastExecution)){ ... }
class Thread
...if(...) assert(false);...
Verification of Abstracted DEOS Verification of Abstracted DEOS
JPF completed the check– produced a 464 step counter-example
Does the counter-example correspond to a feasible execution?– difficult to determine– because of abstraction, we may get spurious errors
We re-ran JPF to perform a customized search– found a guaranteed feasible 318 step counter-example
Our hypothesis Our hypothesis
Abstraction of data domains is necessaryAutomated support for
– Defining abstract domains (and operators)– Selecting abstractions for program components– Generating abstract program models– Interpreting abstract counter-examples
will make it possible to– Scale property verification to realistic systems– Ensure the safety of the verification process
Abstraction in BanderaAbstraction in Bandera
AbstractionLibrary
BASLCompiler
VariableConcrete Type
Abstract Type
Inferred Type
Object
xydonecount
ob
intintbool
Buffer
int….
SignsSignsSigns
intbool
….PointBuffer
Program Abstract CodeGenerator
AbstractedProgram
BanderaAbstractionSpecificationLanguage
AbstractionDefinition
PVS
Definition of Abstractions in BASLDefinition of Abstractions in BASLabstraction Signs abstracts intbegin TOKENS = { NEG, ZERO, POS };
abstract(n) begin n < 0 -> {NEG}; n == 0 -> {ZERO}; n > 0 -> {POS}; end
operator + add begin (NEG , NEG) -> {NEG} ; (NEG , ZERO) -> {NEG} ; (ZERO, NEG) -> {NEG} ; (ZERO, ZERO) -> {ZERO} ; (ZERO, POS) -> {POS} ; (POS , ZERO) -> {POS} ; (POS , POS) -> {POS} ; (_,_) -> {NEG,ZERO,POS}; /* case (POS,NEG),(NEG,POS) */ end
AutomaticGeneration
Forall n1,n2: neg?(n1) and neg?(n2) implies not pos?(n1+n2)
Forall n1,n2: neg?(n1) and neg?(n2) implies not zero?(n1+n2)
Forall n1,n2: neg?(n1) and neg?(n2) implies not neg?(n1+n2)
Proof obligations submitted to PVS...
Example: Start safe, then refine: +(NEG,NEG)={NEG,ZERO,POS}
Compiling BASL DefinitionsCompiling BASL Definitionsabstraction Signs abstracts intbegin TOKENS = { NEG, ZERO, POS };
abstract(n) begin n < 0 -> {NEG}; n == 0 -> {ZERO}; n > 0 -> {POS}; end
operator + add begin (NEG , NEG) -> {NEG} ; (NEG , ZERO) -> {NEG} ; (ZERO, NEG) -> {NEG} ; (ZERO, ZERO) -> {ZERO} ; (ZERO, POS) -> {POS} ; (POS , ZERO) -> {POS} ; (POS , POS) -> {POS} ; (_,_)-> {NEG, ZERO, POS}; /* case (POS,NEG), (NEG,POS) */ end
public class Signs { public static final int NEG = 0; // mask 1 public static final int ZERO = 1; // mask 2 public static final int POS = 2; // mask 4 public static int abs(int n) { if (n < 0) return NEG; if (n == 0) return ZERO; if (n > 0) return POS; }
public static int add(int arg1, int arg2) { if (arg1==NEG && arg2==NEG) return NEG; if (arg1==NEG && arg2==ZERO) return NEG; if (arg1==ZERO && arg2==NEG) return NEG; if (arg1==ZERO && arg2==ZERO) return ZERO; if (arg1==ZERO && arg2==POS) return POS; if (arg1==POS && arg2==ZERO) return POS; if (arg1==POS && arg2==POS) return POS; return Bandera.choose(7); /* case (POS,NEG), (NEG,POS) */ }
Compiled
Data Type AbstractionsData Type Abstractions Library of abstractions for base types
contains:– Range(i,j), i..j modeled precisely, e.g., Range(0,0) is
the signs abstraction
– Modulo(k), Set(v,…)
– Point maps all concrete values to unknown
– User extendable for base types Array abstractions: index & element abstractions
Class abstractions: abstract each field
Interpreting ResultsInterpreting Results
Example:x = -2; if(x + 2 == 0) then ...x = NEG; if(Signs.eq(Signs.add(x,POS),ZERO))
then ... {NEG,ZERO,POS}
For an abstracted program, a counter-example may be infeasible because:– Over-approximation introduced by abstraction
Choose-free state space searchChoose-free state space search
Theorem [Saidi:SAS’00] Every path in the abstracted program where all
assignments are deterministic is a path in the concrete program.
Bias the model checker– to look only at paths that do not include
instructions that introduce non-determinism JPF model checker modified
– to detect non-deterministic choice (i.e. calls to Bandera.choose()); backtrack from those points
Choice-bounded SearchChoice-bounded Search
choose()
X X
Detectable ViolationUndetectable Violation State space searched
Comparison to Related Work Comparison to Related Work Predicate abstraction (Graf/Saidi)
– We use PVS to abstract operator definitions, not complete systems
– We can reuse abstractions for different systems Tool support for program abstraction
– e.g., SLAM, JPF, Feaver Abstraction at the source-code level
– Supports multiple checking tools – e.g., JPF, Java Checker/Verisoft, FLAVERS/Java, …
Counter-example analysis – Theorem prover based (InVest)– Forward simulation (Clarke et. al.)
StatusStatus
Bandera supports abstraction – Library of base type abstractions– Tool-support for user-defined abstraction– Array abstractions– Finding feasible counter-examples
Surprisingly effective on realistic code– 1000s of lines, 10s of threads– Non-trivial data that influences control
Ongoing WorkOngoing Work
Extending abstractions– Heap abstractions– Symbolic abstractions
Automated support for selection– Counter-example driven refinement
Environments and abstraction Discrete-time abstractions
– Exploit scheduling information from RT Java